summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/broadcom/brcm80211
AgeCommit message (Collapse)Author
2018-02-27brcmfmac: usb: call brcmf_usb_up() during brcmf_bus_preinit()Arend Van Spriel
By calling brcmf_usb_up() during brcmf_bus_preinit() it does not need to be called in brcmf_usb_bus_setup(). Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-27brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()Arend Van Spriel
Now we can move brcmf_attach() until after the firmware has been downloaded to the device. Make the call just before brcmf_bus_started(). Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-27brcmfmac: move allocation of control rx buffer to brcmf_sdio_bus_preinit()Arend Van Spriel
Allocate the control rx buffer needed for firmware control interface during brcmf_sdio_bus_preinit(). This relies on common layer setting struct brcmf_bus::maxctl during brcmf_attach(). By moving the allocation we can move brcmf_attach() in subsequent change. Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-02-27brcmfmac: move brcmf_bus_preinit() call just after changing bus stateArend Van Spriel
Moving the brcmf_bus_preinit() call allows the bus code to do some required initialization before handling firmware control messages. Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-24brcmfmac: separate firmware errors from i/o errorsArend Van Spriel
When using the firmware api it can fail simply because firmware does not like the request or it fails due to issues in the host interface. Currently, there is only a single error code which is confusing. So adding a parameter to pass the firmware error separately and in case of a firmware error always return -EBADE to user-space. Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-24brcmfmac: assure bcdc dcmd api does not return value > 0Arend Van Spriel
The protocol layer api defines callbacks for dongle commands. Although not really well documented these should only return an error code in case of an error, or 0 upon success. In the bcdc protocol it can return value above 0 and we carry a fix in the caller of the protocol layer api. This patch makes it adhere to the intent of the api as described above. Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-19Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller
The BPF verifier conflict was some minor contextual issue. The TUN conflict was less trivial. Cong Wang fixed a memory leak of tfile->tx_array in 'net'. This is an skb_array. But meanwhile in net-next tun changed tfile->tx_arry into tfile->tx_ring which is a ptr_ring. Signed-off-by: David S. Miller <davem@davemloft.net>
2018-01-16brcmfmac: fix CLM load error for legacy chips when user helper is enabledWright Feng
For legacy chips without CLM blob files, kernel with user helper function returns -EAGAIN when we request_firmware(), and then driver got failed when bringing up legacy chips. We expect the CLM blob file for legacy chip is not existence in firmware path, but the -ENOENT error is transferred to -EAGAIN in firmware_class.c with user helper. Because of that, we continue with CLM data currently present in firmware if getting error from doing request_firmware(). Cc: stable@vger.kernel.org # v4.15.y Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-11brcmfmac: Use zeroing memory allocator than allocator/memsetHimanshu Jha
Use dma_zalloc_coherent for allocating zeroed memory and remove unnecessary memset function. Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci Suggested-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-11brcmfmac: rename brcmf_sdiod_buff_{read,write}() functionsArend Van Spriel
Rename functions to brcmf_sdio_skbuff_{read,write}() as we pass an skbuff to this function. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-11brcmfmac: add comment block in brcmf_sdio_buscore_read()Arend Van Spriel
In brcmf_sdio_buscore_read() there is some special handling upon register access to chipid register of the chipcommon core. Add comment explaining why it is done here. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-11brcmfmac: Remove array of functionsArend Van Spriel
Replace the array of functions with a pair of pointers to the relevant functions. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Support 43455 save-restore (SR) feature if FW include -srDouble Lo
This patch will add 43455 into the save-restore(SR) capable chip list, so the SR engine will be enabled with 43455 FW which built-in the -sr function. Signed-off-by: Double Lo <double.lo@cypress.com> Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Clean up interrupt macrosIan Molton
Make it more obvious that this code acually enables interrupts, and provide nice definitions for the bits in the register. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Replace function index with function pointerIan Molton
In preparation for removing the function array, remove all code that refers to function by index and replace with pointers to the function itself. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> [arend: replace BUG() with WARN() macro] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: More efficient and slightly easier to read fixup for 4339 chipsArend Van Spriel
Its more efficient to test the register we're interested in first, potentially avoiding two more comparisons, and therefore always avoiding one comparison per call on all other chips. Signed-off-by: Ian Molton <ian@mnementh.co.uk> [arend: fix some checkpatch warnings] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Remove func0 from function arrayIan Molton
func0 is not provided by the mmc stack as a function when probing. Instead providing specific access functions to read/write it. This prepares for a patch to remove the actual array entry itself. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> [arend: rephrased the commit message] [arend: removed unrelated comment for which separate patch is warranted] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Correctly handle accesses to SDIO func0Ian Molton
Rather than workaround the restrictions on func0 addressing in the driver, set MMC_QUIRK_LENIENT_FN0 Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: stabilise the value of ->sbwad in use for some xfer routines.Ian Molton
The IO functions operate within the Chipcommon IO window. Explicitly set this, rather than relying on the last initialisation IO access to leave it set to the right value by chance. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Rename buscore to core for consistencyArend Van Spriel
Avoid confusion with unrelated _buscore labels. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> [arend: only do the rename] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-01-08brcmfmac: Remove {r,w}_sdreg32Ian Molton
Remove yet another IO function from the code and replace with one that already exists. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> [arend: keep address calculation, ie. (base + offset) in one line] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-19Merge tag 'wireless-drivers-next-for-davem-2017-12-18' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next The drivers/net/wireless/intel/iwlwifi/pcie/drv.c conflict was resolved using a diff provided by Kalle in his pull request. Kalle Valo says: ==================== wireless-drivers-next patches for 4.16 A bigger pull request this time, the most visible change being the new driver mt76. But there's also Kconfig refactoring in ath9k and ath10k, work beginning in iwlwifi to have rate scaling in firmware/hardware, wcn3990 support getting closer in ath10k and lots of smaller changes. mt76 * a new driver for MT76x2e, a 2x2 PCIe 802.11ac chipset by MediaTek ath10k * enable multiqueue support for all hw using mac80211 wake_tx_queue op * new Kconfig option ATH10K_SPECTRAL to save RAM * show tx stats on QCA9880 * new qcom,ath10k-calibration-variant DT entry * WMI layer support for wcn3990 ath9k * new Kconfig option ATH9K_COMMON_SPECTRAL to save RAM wcn36xx * hardware scan offload support wil6210 * run-time PM support when interface is down iwlwifi * initial work for rate-scaling offload * Support for new FW API version 36 * Rename the temporary hw name A000 to 22000 ssb * make SSB a menuconfig to ease disabling it all mwl8k * enable non-DFS 5G channels 149-165 ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-12-14brcmfmac: enlarge buffer size of caps to 512 bytesWright Feng
The buffer size of return of cap iovar is greater than 256 bytes in some firmwares. For instance, the return size of cap iovar is 271 bytes in 4373 13.10.246.79 firmare. It makes feature capability parsing failed because caps buffer is default value. So we enlarge caps buffer size to 512 bytes and add the error print for cap iovar error. Signed-off-by: Wright Feng <wright.feng@cypress.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Remove repeated calls to brcmf_chip_get_core()Ian Molton
There is no need to repeatdly call brcmf_chip_get_core(), which traverses a list of cores every time its called (including during register access code!). Call it once, and store a pointer to the core structure. The existing code does nto keep track of users of the cores anyway, and even so, this will allow for easier refcounting in future. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Remove unused macro.Ian Molton
This macro is used exactly nowhere in the code. Delete it. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Cleanup offsetof()Ian Molton
Create a macro to make the code a bit more readable, whilst we're stuck with using struct element offsets as register offsets. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> [arend: rename macro to SD_REG] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: remove unnecessary call to brcmf_sdiod_set_backplane_window()Ian Molton
All functions that might require the window address changing call brcmf_sdiod_set_backplane_window() prior to access. Thus resetting the window is not required. Signed-off-by: Ian Molton <ian@mnementh.co.uk> [arend: corrected the driver prefix in the subject] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Remove brcmf_sdiod_addrprep()Ian Molton
This function has become trivial enough that it may as well be pushed into its callers, which has the side-benefit of clarifying what's going on. Remove it, and rename brcmf_sdiod_set_sbaddr_window() to brcmf_sdiod_set_backplane_window() as it's easier to understand. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Tidy register definitions a littleIan Molton
Trivial tidy of register definitions. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Rename / replace old IO functions with simpler ones.Ian Molton
Primarily this patch removes: brcmf_sdiod_f0_writeb() brcmf_sdiod_reg_write() brcmf_sdiod_reg_read() Since we no longer use the quirky method of deciding which function to address via the address being accessed, take the opportunity to rename some IO functions more in line with common kernel code. We also convert those that map directly to sdio_{read,write}*() to macros. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Clarify if using braces.Ian Molton
Whilst this if () statement is technically correct, it lacks clarity. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: whitespace fixes in brcmf_sdiod_send_buf()Ian Molton
Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> [arend: mention function in patch subject] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmfmac: Split brcmf_sdiod_buffrw function up.Ian Molton
This function needs to be split up into separate read / write variants for clarity. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-14brcmsmac: use ARRAY_SIZE on rfseq_updategainu_eventsColin Ian King
Use the ARRAY_SIZE macro on rfseq_updategainu_events to determine size of the array. Improvement suggested by coccinelle. Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-08wireless: use ARRAY_SIZEJérémy Lefaure
Using the ARRAY_SIZE macro improves the readability of the code. Also, it is not always useful to use a variable to store this constant calculated at compile time. Found with Coccinelle with the following semantic patch: @r depends on (org || report)@ type T; T[] E; position p; @@ ( (sizeof(E)@p /sizeof(*E)) | (sizeof(E)@p /sizeof(E[...])) | (sizeof(E)@p /sizeof(T)) ) Signed-off-by: Jérémy Lefaure <jeremy.lefaure@lse.epita.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Avoid build error with make W=1Andy Shevchenko
When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for the first run, all next ones are okay. CC [M] drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union! scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed Seems like something happened with W=1 and wrong kernel doc format. As a quick fix remove dubious /** in the code. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Rename bcmerror to errIan Molton
Trivial cleanup of nasty variable name Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Remove noisy debugging.Ian Molton
If you need debugging this low level, you're doing something wrong. Remove these noisy debug statements so the code is more readable. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Fix asymmetric IO functions.Ian Molton
Unlikely to be a problem, but brcmf_sdiod_regrl() is not symmetric with brcmf_sdiod_regrb() in initializing the data value on stack. Fix that. Signed-off-by: Ian Molton <ian@mnementh.co.uk> [arend: reword the commit message a bit] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Remove brcmf_sdiod_request_data()Ian Molton
This function is obfuscating how IO works on this chip. Remove it and push its logic into brcmf_sdiod_reg_{read,write}(). Handling of -ENOMEDIUM is altered, but as that's pretty much broken anyway we can ignore that. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Remove bandaid for SleepCSRIan Molton
Register access code is not the place for band-aid fixes like this. If this is a genuine problem, it should be fixed further up in the driver stack. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Remove dead IO codeIan Molton
The value passed to brcmf_sdiod_addrprep() is *always* 4 remove this parameter and the unused code to handle it. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Clean up brcmf_sdiod_set_sbaddr_window()Ian Molton
This function sets the address of the IO window used for SDIO accesses onto the backplane of the chip. It currently uses 3 separate masks despite the full mask being defined in the code already. Remove the separate masks and clean up. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Split brcmf_sdiod_regrw_helper() up.Ian Molton
This large function is concealing a LOT of obscure logic about how the hardware functions. Time to split it up. This first patch splits the function into two pieces - read and write, doing away with the rw flag in the process. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Register sizes on hardware are not dependent on compiler typesIan Molton
The 4 IO functions in this patch are incorrect as they use compiler types to determine how many bytes to send to the hardware. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-07brcmfmac: Fix parameter order in brcmf_sdiod_f0_writeb()Ian Molton
All the other IO functions are the other way round in this driver. Make this one match. Signed-off-by: Ian Molton <ian@mnementh.co.uk> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-12-02brcmfmac: change driver unbind order of the sdio function devicesArend Van Spriel
In the function brcmf_sdio_firmware_callback() the driver is unbound from the sdio function devices in the error path. However, the order in which it is done resulted in a use-after-free issue (see brcmf_ops_sdio_remove() in bcmsdh.c). Hence change the order and first unbind sdio function #2 device and then unbind sdio function #1 device. Cc: stable@vger.kernel.org # v4.12.x Fixes: 7a51461fc2da ("brcmfmac: unbind all devices upon failure in firmware callback") Reported-by: Stefan Wahren <stefan.wahren@i2se.com> Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-11-21treewide: setup_timer() -> timer_setup()Kees Cook
This converts all remaining cases of the old setup_timer() API into using timer_setup(), where the callback argument is the structure already holding the struct timer_list. These should have no behavioral changes, since they just change which pointer is passed into the callback with the same available pointers after conversion. It handles the following examples, in addition to some other variations. Casting from unsigned long: void my_callback(unsigned long data) { struct something *ptr = (struct something *)data; ... } ... setup_timer(&ptr->my_timer, my_callback, ptr); and forced object casts: void my_callback(struct something *ptr) { ... } ... setup_timer(&ptr->my_timer, my_callback, (unsigned long)ptr); become: void my_callback(struct timer_list *t) { struct something *ptr = from_timer(ptr, t, my_timer); ... } ... timer_setup(&ptr->my_timer, my_callback, 0); Direct function assignments: void my_callback(unsigned long data) { struct something *ptr = (struct something *)data; ... } ... ptr->my_timer.function = my_callback; have a temporary cast added, along with converting the args: void my_callback(struct timer_list *t) { struct something *ptr = from_timer(ptr, t, my_timer); ... } ... ptr->my_timer.function = (TIMER_FUNC_TYPE)my_callback; And finally, callbacks without a data assignment: void my_callback(unsigned long data) { ... } ... setup_timer(&ptr->my_timer, my_callback, 0); have their argument renamed to verify they're unused during conversion: void my_callback(struct timer_list *unused) { ... } ... timer_setup(&ptr->my_timer, my_callback, 0); The conversion is done with the following Coccinelle script: spatch --very-quiet --all-includes --include-headers \ -I ./arch/x86/include -I ./arch/x86/include/generated \ -I ./include -I ./arch/x86/include/uapi \ -I ./arch/x86/include/generated/uapi -I ./include/uapi \ -I ./include/generated/uapi --include ./include/linux/kconfig.h \ --dir . \ --cocci-file ~/src/data/timer_setup.cocci @fix_address_of@ expression e; @@ setup_timer( -&(e) +&e , ...) // Update any raw setup_timer() usages that have a NULL callback, but // would otherwise match change_timer_function_usage, since the latter // will update all function assignments done in the face of a NULL // function initialization in setup_timer(). @change_timer_function_usage_NULL@ expression _E; identifier _timer; type _cast_data; @@ ( -setup_timer(&_E->_timer, NULL, _E); +timer_setup(&_E->_timer, NULL, 0); | -setup_timer(&_E->_timer, NULL, (_cast_data)_E); +timer_setup(&_E->_timer, NULL, 0); | -setup_timer(&_E._timer, NULL, &_E); +timer_setup(&_E._timer, NULL, 0); | -setup_timer(&_E._timer, NULL, (_cast_data)&_E); +timer_setup(&_E._timer, NULL, 0); ) @change_timer_function_usage@ expression _E; identifier _timer; struct timer_list _stl; identifier _callback; type _cast_func, _cast_data; @@ ( -setup_timer(&_E->_timer, _callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, &_callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, _callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, &_callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)_callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)&_callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)_callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)&_callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E._timer, _callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, _callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, &_callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, &_callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)_callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)_callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)&_callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)&_callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | _E->_timer@_stl.function = _callback; | _E->_timer@_stl.function = &_callback; | _E->_timer@_stl.function = (_cast_func)_callback; | _E->_timer@_stl.function = (_cast_func)&_callback; | _E._timer@_stl.function = _callback; | _E._timer@_stl.function = &_callback; | _E._timer@_stl.function = (_cast_func)_callback; | _E._timer@_stl.function = (_cast_func)&_callback; ) // callback(unsigned long arg) @change_callback_handle_cast depends on change_timer_function_usage@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _origtype; identifier _origarg; type _handletype; identifier _handle; @@ void _callback( -_origtype _origarg +struct timer_list *t ) { ( ... when != _origarg _handletype *_handle = -(_handletype *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg | ... when != _origarg _handletype *_handle = -(void *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg | ... when != _origarg _handletype *_handle; ... when != _handle _handle = -(_handletype *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg | ... when != _origarg _handletype *_handle; ... when != _handle _handle = -(void *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg ) } // callback(unsigned long arg) without existing variable @change_callback_handle_cast_no_arg depends on change_timer_function_usage && !change_callback_handle_cast@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _origtype; identifier _origarg; type _handletype; @@ void _callback( -_origtype _origarg +struct timer_list *t ) { + _handletype *_origarg = from_timer(_origarg, t, _timer); + ... when != _origarg - (_handletype *)_origarg + _origarg ... when != _origarg } // Avoid already converted callbacks. @match_callback_converted depends on change_timer_function_usage && !change_callback_handle_cast && !change_callback_handle_cast_no_arg@ identifier change_timer_function_usage._callback; identifier t; @@ void _callback(struct timer_list *t) { ... } // callback(struct something *handle) @change_callback_handle_arg depends on change_timer_function_usage && !match_callback_converted && !change_callback_handle_cast && !change_callback_handle_cast_no_arg@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _handletype; identifier _handle; @@ void _callback( -_handletype *_handle +struct timer_list *t ) { + _handletype *_handle = from_timer(_handle, t, _timer); ... } // If change_callback_handle_arg ran on an empty function, remove // the added handler. @unchange_callback_handle_arg depends on change_timer_function_usage && change_callback_handle_arg@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _handletype; identifier _handle; identifier t; @@ void _callback(struct timer_list *t) { - _handletype *_handle = from_timer(_handle, t, _timer); } // We only want to refactor the setup_timer() data argument if we've found // the matching callback. This undoes changes in change_timer_function_usage. @unchange_timer_function_usage depends on change_timer_function_usage && !change_callback_handle_cast && !change_callback_handle_cast_no_arg && !change_callback_handle_arg@ expression change_timer_function_usage._E; identifier change_timer_function_usage._timer; identifier change_timer_function_usage._callback; type change_timer_function_usage._cast_data; @@ ( -timer_setup(&_E->_timer, _callback, 0); +setup_timer(&_E->_timer, _callback, (_cast_data)_E); | -timer_setup(&_E._timer, _callback, 0); +setup_timer(&_E._timer, _callback, (_cast_data)&_E); ) // If we fixed a callback from a .function assignment, fix the // assignment cast now. @change_timer_function_assignment depends on change_timer_function_usage && (change_callback_handle_cast || change_callback_handle_cast_no_arg || change_callback_handle_arg)@ expression change_timer_function_usage._E; identifier change_timer_function_usage._timer; identifier change_timer_function_usage._callback; type _cast_func; typedef TIMER_FUNC_TYPE; @@ ( _E->_timer.function = -_callback +(TIMER_FUNC_TYPE)_callback ; | _E->_timer.function = -&_callback +(TIMER_FUNC_TYPE)_callback ; | _E->_timer.function = -(_cast_func)_callback; +(TIMER_FUNC_TYPE)_callback ; | _E->_timer.function = -(_cast_func)&_callback +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -_callback +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -&_callback; +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -(_cast_func)_callback +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -(_cast_func)&_callback +(TIMER_FUNC_TYPE)_callback ; ) // Sometimes timer functions are called directly. Replace matched args. @change_timer_function_calls depends on change_timer_function_usage && (change_callback_handle_cast || change_callback_handle_cast_no_arg || change_callback_handle_arg)@ expression _E; identifier change_timer_function_usage._timer; identifier change_timer_function_usage._callback; type _cast_data; @@ _callback( ( -(_cast_data)_E +&_E->_timer | -(_cast_data)&_E +&_E._timer | -_E +&_E->_timer ) ) // If a timer has been configured without a data argument, it can be // converted without regard to the callback argument, since it is unused. @match_timer_function_unused_data@ expression _E; identifier _timer; identifier _callback; @@ ( -setup_timer(&_E->_timer, _callback, 0); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, _callback, 0L); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, _callback, 0UL); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E._timer, _callback, 0); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, _callback, 0L); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, _callback, 0UL); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_timer, _callback, 0); +timer_setup(&_timer, _callback, 0); | -setup_timer(&_timer, _callback, 0L); +timer_setup(&_timer, _callback, 0); | -setup_timer(&_timer, _callback, 0UL); +timer_setup(&_timer, _callback, 0); | -setup_timer(_timer, _callback, 0); +timer_setup(_timer, _callback, 0); | -setup_timer(_timer, _callback, 0L); +timer_setup(_timer, _callback, 0); | -setup_timer(_timer, _callback, 0UL); +timer_setup(_timer, _callback, 0); ) @change_callback_unused_data depends on match_timer_function_unused_data@ identifier match_timer_function_unused_data._callback; type _origtype; identifier _origarg; @@ void _callback( -_origtype _origarg +struct timer_list *unused ) { ... when != _origarg } Signed-off-by: Kees Cook <keescook@chromium.org>
2017-11-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-nextLinus Torvalds
Pull networking updates from David Miller: "Highlights: 1) Maintain the TCP retransmit queue using an rbtree, with 1GB windows at 100Gb this really has become necessary. From Eric Dumazet. 2) Multi-program support for cgroup+bpf, from Alexei Starovoitov. 3) Perform broadcast flooding in hardware in mv88e6xxx, from Andrew Lunn. 4) Add meter action support to openvswitch, from Andy Zhou. 5) Add a data meta pointer for BPF accessible packets, from Daniel Borkmann. 6) Namespace-ify almost all TCP sysctl knobs, from Eric Dumazet. 7) Turn on Broadcom Tags in b53 driver, from Florian Fainelli. 8) More work to move the RTNL mutex down, from Florian Westphal. 9) Add 'bpftool' utility, to help with bpf program introspection. From Jakub Kicinski. 10) Add new 'cpumap' type for XDP_REDIRECT action, from Jesper Dangaard Brouer. 11) Support 'blocks' of transformations in the packet scheduler which can span multiple network devices, from Jiri Pirko. 12) TC flower offload support in cxgb4, from Kumar Sanghvi. 13) Priority based stream scheduler for SCTP, from Marcelo Ricardo Leitner. 14) Thunderbolt networking driver, from Amir Levy and Mika Westerberg. 15) Add RED qdisc offloadability, and use it in mlxsw driver. From Nogah Frankel. 16) eBPF based device controller for cgroup v2, from Roman Gushchin. 17) Add some fundamental tracepoints for TCP, from Song Liu. 18) Remove garbage collection from ipv6 route layer, this is a significant accomplishment. From Wei Wang. 19) Add multicast route offload support to mlxsw, from Yotam Gigi" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2177 commits) tcp: highest_sack fix geneve: fix fill_info when link down bpf: fix lockdep splat net: cdc_ncm: GetNtbFormat endian fix openvswitch: meter: fix NULL pointer dereference in ovs_meter_cmd_reply_start netem: remove unnecessary 64 bit modulus netem: use 64 bit divide by rate tcp: Namespace-ify sysctl_tcp_default_congestion_control net: Protect iterations over net::fib_notifier_ops in fib_seq_sum() ipv6: set all.accept_dad to 0 by default uapi: fix linux/tls.h userspace compilation error usbnet: ipheth: prevent TX queue timeouts when device not ready vhost_net: conditionally enable tx polling uapi: fix linux/rxrpc.h userspace compilation errors net: stmmac: fix LPI transitioning for dwmac4 atm: horizon: Fix irq release error net-sysfs: trigger netlink notification on ifalias change via sysfs openvswitch: Using kfree_rcu() to simplify the code openvswitch: Make local function ovs_nsh_key_attr_size() static openvswitch: Fix return value check in ovs_meter_cmd_features() ...
2017-11-11brcmfmac: add CLM download supportChung-Hsien Hsu
The firmware for brcmfmac devices includes information regarding regulatory constraints. For certain devices this information is kept separately in a binary form that needs to be downloaded to the device. This patch adds support to download this so-called CLM blob file. It uses the same naming scheme as the other firmware files with extension of .clm_blob. The CLM blob file is optional. If the file does not exist, the download process will be bypassed. It will not affect the driver loading. Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>