summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-02-26ath9k: remove set but not used variable 'acq'YueHaibing
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/ath9k/recv.c: In function 'ath_rx_count_airtime': drivers/net/wireless/ath/ath9k/recv.c:1010:18: warning: variable 'acq' set but not used [-Wunused-but-set-variable] It's not used after 89cea7493a34 ("ath9k: Switch to mac80211 TXQ scheduling and airtime APIs"). Also remove related variables. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath9k: debugfs: Fix SPUR-DOWN fieldAndrea Greco
SPUR DOWN field returns spurup instead of spurdown. Signed-off-by: Andrea Greco <a.greco@4sigma.it> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath9k: Make sure to zero status.tx_time before reporting TX statusToke Høiland-Jørgensen
Since ath9k reports airtime usage directly using the ieee80211_report_airtime() callback, it shouldn't also report it using the tx_time in status. Make sure the field is zeroed before TX status is reported to avoid spurious airtime being accounted by bits being left over from earlier uses of the cb. Fixes: 89cea7493a34 ("ath9k: Switch to mac80211 TXQ scheduling and airtime APIs") Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: update the max num of peers supported for WCN3990Abhishek Ambure
WCN3990 firmware versions WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1 & onwards supports maximum 33 peers including self peer. To support maximum peers, send updated peer param to firmware during initialization. Tested HW: WCN3990 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Signed-off-by: Abhishek Ambure <aambure@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: remove the calibration data fetch for sdioWen Gong
The calibration data fetch will trigger sdio error, then sdio will become fail untill reboot system. If happens when run ifconfig wlan down, then ifconfig wlan up will fail untill reboot system.Remove it fix the ifconfig wlan issue. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00005-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: Fix length of wmi tlv command for protected mgmt framesSurabhi Vishnoi
The length of wmi tlv command for management tx send is calculated incorrectly in case of protected management frames as there is addition of IEEE80211_CCMP_MIC_LEN twice. This leads to improper behaviour of firmware as the wmi tlv mgmt tx send command for protected mgmt frames is formed wrongly. Fix the length calculation of wmi tlv command for mgmt tx send in case of protected management frames by adding the IEEE80211_CCMP_MIC_LEN only once. Tested HW: WCN3990 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Fixes: 1807da49733e "ath10k: wmi: add management tx by reference support over wmi" Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: don't report unset rssi values to mac80211Alagu Sankar
The SDIO firmware does not provide RSSI value to the host, it's only set to zero. In that case don't report the value to mac80211. One risk here is that value zero might be a valid value with other firmware, currently there's no way to detect that. Without the fix, the rssi value indicated by iw changes between the actual value and -95. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00005-QCARMSWP-1. Co-developed-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Alagu Sankar <alagusankar@silex-india.com> Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: sdio: reset chip on power_down()Wen Gong
The target device needs to be reset during power_down(), otherwise only the first power_up() will work. And as ath10k calls power_up() during driver initialisation the driver would be otherwise unusable. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00005-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: sdio: disable fwlog printsAlagu Sankar
The SDIO firmware may turn it on based on scratch registers so disable the firmware log to avoid that. Co-developed-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Alagu Sankar <alagusankar@silex-india.com> Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: sdio: set hi_acs_flagsAlagu Sankar
The SDIO firmware does not allow transmitting packets with the reduced tx completion HI_ACS option. SDIO firmware uses 1544 as alternate credit size, which is not big enough for the maximum sized mac80211 frames. Disable both these HI_ACS flags for SDIO. Co-developed-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Alagu Sankar <alagusankar@silex-india.com> Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: correct the format of host memory chunks in wmi init commandYu Wang
This is a theoretical fix, the issue is found in code review. When adding the host memory chunks into wmi-tlv init command, there is no separate tlv header for each host memory chunk in the struct array, which breaches the convention between host and firmware, will result in mismatch between the two. To fix this issue, add separate tlv headers for the host memory chunks in wmi-tlv init command. Signed-off-by: Yu Wang <yyuwang@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: enhance logging for vdev pdev & peer set paramRakesh Pillai
Currently after enabling the WMI debug logging, there is no detail printed about the param id and the param value for the pdev, vdev and peer params which are set. Enhance the WMI logging to print the param id and the param value for pdev, vdev and peer set param wmi commands. Tested HW: WCN3990 Tested FW: WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Signed-off-by: Rakesh Pillai <pillair@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: add support for ack rssi value of data tx packetsAbhishek Ambure
In WCN3990, WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI service Indicates that the firmware has the capability to send the RSSI value of the ACK for all data and management packets transmitted. If WMI_RSRC_CFG_FLAG_TX_ACK_RSSI is set in host capability then firmware sends RSSI value in "data" tx completion event. Host extracts ack rssi values of data packets from their tx completion event. Tested HW: WCN3990 Tested FW: WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1 Signed-off-by: Abhishek Ambure <aambure@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: add support for ack rssi value of management tx packetsAbhishek Ambure
In WCN3990, WMI_TLV_SERVICE_TX_DATA_MGMT_ACK_RSSI service Indicates that the firmware has the capability to send the RSSI value of the ACK for all data and management packets transmitted. If WMI_RSRC_CFG_FLAG_TX_ACK_RSSI is set in host capability then firmware sends RSSI value in "management" tx completion event. Host extracts ack rssi values of management packets from their tx completion event. Tested HW: WCN3990 Tested FW: WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1 Signed-off-by: Abhishek Ambure <aambure@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26ath10k: fix descriptor size in ce tx completion for WCN3990Rakesh Pillai
When the driver receives the tx completion of the descriptor over ce, it clears the nbytes configured for that particular descriptor. WCN3990 uses ce descriptors with 64-bit address. Currently during handling the tx completion of the descriptors, the nbytes are accessed from the descriptors using ce_desc for 32-bit targets. This will lead to clearing of memory at incorrect offset if DMA MASK is set to greater than 32 bits. Attach different ce tx copy completed handler for targets using address above 32-bit address. Tested HW: WCN3990 Tested FW: WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 Signed-off-by: Rakesh Pillai <pillair@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-26dt-bindings: regulator: tps65218: rectify units of LS3Christian Hohnstaedt
LS3 has a selectable current limit. Change units to microamp in the example. Signed-off-by: Christian Hohnstaedt <Christian.Hohnstaedt@wago.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26dt-bindings: regulator: add LS2 load switch documentationChristian Hohnstaedt
Document device-tree settings of the load-switch LS2 in the tps65218 device. Signed-off-by: Christian Hohnstaedt <Christian.Hohnstaedt@wago.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26regulator: da9062: Use struct_size() in devm_kzalloc()Gustavo A. R. Silva
One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; struct boo entry[]; }; size = sizeof(struct foo) + count * sizeof(struct boo); instance = alloc(size, GFP_KERNEL) Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = alloc(struct_size(instance, entry, count), GFP_KERNEL) Notice that, in this case, variable size is not necessary, hence it is removed. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Acked-by: Steve Twiss <stwiss.opensource@diasemi.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26regulator: mcp16502: Remove module versionAxel Lin
The module version is unlikely to be updated, use kernel version should be enough. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26regulator: fan53555: Check pdata->slew_rate settingAxel Lin
Current code does not really avoid array access out of bounds, fix it by add checking for pdata->slew_rate. If pdata->slew_rate is too big, it's a bug in pdata that needs fix. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26regulator: arizona_ldo1: Simplify arizona_ldo1_hc_set/get_voltage_selAxel Lin
Setup .vsel_reg and .vsel_mask then we can use the standard set/get_voltage_sel_regmap helpers to simplify the code. Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uAAxel Lin
The wm831x_dcdc_ilim entries needs to be uA because it is used to compare with min_uA and max_uA. While at it also make the array const and change to use unsigned int. Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support") Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2019-02-26mt76: add driver for MT7603E and MT7628/7688Felix Fietkau
This driver is for a newer generation of 2x2 MediaTek 802.11n chipsets. MT7603E is a PCIe chip. MT7628 and MT7688 are MIPS SoC devices with built-in WLAN. MT7688 is limited to 1x1 This driver fully supports AP, station, mesh, ad-hoc and monitor mode. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26dt-bindings: net: mt76: update binding for mt7603 driverFelix Fietkau
In addition to MT7603E PCI devices, the driver supports the WLAN core on MT7628/MT7688, which needs to be defined in DT. Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: add driver callback for when a sta is associatedFelix Fietkau
MT7603 needs this to update the HT/VHT capabilities Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: remove no longer used routine declarationsLorenzo Bianconi
Remove following routine declarations that are no longer used after commit cfca5f693c5d ("mt76usb: remove usb_mcu.c"): - mt76u_mcu_complete_urb - mt76u_deinit - mt76u_buf_free - mt76u_submit_urb Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: usb: check urb->num_sgs limit in mt76u_process_rx_entryLorenzo Bianconi
check nsgs value is less than urb->num_sgs in mt76u_process_rx_entry in order to avoid an out-of-bound access of urb->sg array Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: usb: simplify mt76u_tx_build_sg routineLorenzo Bianconi
Use skb_to_sgvec instad of skb_to_sgvec_nomark in mt76u_tx_build_sg. Remove nsgs check in mt76u_tx_build_sg since it is already performed by skb_to_sgvec Suggested-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: usb: simplify rx buffer allocationLorenzo Bianconi
Squash mt76u_buf_alloc_sg and mt76u_buf_alloc and remove duplicated code. Reuse mt76u_refill_rx in mt76u_buf_alloc Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: usb: introduce mt76u_fill_bulk_urb routineLorenzo Bianconi
Add mt76u_fill_bulk_urb to initialize tx/rx urbs and remove duplicate code Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: usb: fix warning in mt76u_buf_freeLorenzo Bianconi
Fix following static checker warning in mt76u_buf_free: drivers/net/wireless/mediatek/mt76/usb.c:372 mt76u_buf_free() warn: address of 'urb->sg[i]' is non-NULL There is no need to check sg page pointer since urb->num_sgs has been already validated in mt76u_fill_rx_sg Fixes: cb83585e1121 ("mt76: usb: fix possible memory leak in mt76u_buf_free") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76usb: remove usb_mcu.cStanislaw Gruszka
Don't need separate file just for kmalloc/kfree. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76usb: use synchronous msg for mcu command responsesStanislaw Gruszka
Use usb_bulk_msg for reading MCU command responses. This simplify code a lot. Together with 97a3005759c ("mt76usb: allow mt76u_bulk_msg be used for reads") it also fix possible problems with rx data buffers not being aligned and contained within single page. After doing page_frag_alloc(1024) consecutive page_frag_alloc(PAGE_SIZE) will alloc PAGE_SIZE buffer at PAGE_SIZE - 1024 offset. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76usb: allow mt76u_bulk_msg be used for readsStanislaw Gruszka
Extend mt76u_bulk_msg() such it can be used for synchronous bulk reads. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26iommu/dmar: Fix buffer overflow during PCI bus notificationJulia Cartwright
Commit 57384592c433 ("iommu/vt-d: Store bus information in RMRR PCI device path") changed the type of the path data, however, the change in path type was not reflected in size calculations. Update to use the correct type and prevent a buffer overflow. This bug manifests in systems with deep PCI hierarchies, and can lead to an overflow of the static allocated buffer (dmar_pci_notify_info_buf), or can lead to overflow of slab-allocated data. BUG: KASAN: global-out-of-bounds in dmar_alloc_pci_notify_info+0x1d5/0x2e0 Write of size 1 at addr ffffffff90445d80 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.14.87-rt49-02406-gd0a0e96 #1 Call Trace: ? dump_stack+0x46/0x59 ? print_address_description+0x1df/0x290 ? dmar_alloc_pci_notify_info+0x1d5/0x2e0 ? kasan_report+0x256/0x340 ? dmar_alloc_pci_notify_info+0x1d5/0x2e0 ? e820__memblock_setup+0xb0/0xb0 ? dmar_dev_scope_init+0x424/0x48f ? __down_write_common+0x1ec/0x230 ? dmar_dev_scope_init+0x48f/0x48f ? dmar_free_unused_resources+0x109/0x109 ? cpumask_next+0x16/0x20 ? __kmem_cache_create+0x392/0x430 ? kmem_cache_create+0x135/0x2f0 ? e820__memblock_setup+0xb0/0xb0 ? intel_iommu_init+0x170/0x1848 ? _raw_spin_unlock_irqrestore+0x32/0x60 ? migrate_enable+0x27a/0x5b0 ? sched_setattr+0x20/0x20 ? migrate_disable+0x1fc/0x380 ? task_rq_lock+0x170/0x170 ? try_to_run_init_process+0x40/0x40 ? locks_remove_file+0x85/0x2f0 ? dev_prepare_static_identity_mapping+0x78/0x78 ? rt_spin_unlock+0x39/0x50 ? lockref_put_or_lock+0x2a/0x40 ? dput+0x128/0x2f0 ? __rcu_read_unlock+0x66/0x80 ? __fput+0x250/0x300 ? __rcu_read_lock+0x1b/0x30 ? mntput_no_expire+0x38/0x290 ? e820__memblock_setup+0xb0/0xb0 ? pci_iommu_init+0x25/0x63 ? pci_iommu_init+0x25/0x63 ? do_one_initcall+0x7e/0x1c0 ? initcall_blacklisted+0x120/0x120 ? kernel_init_freeable+0x27b/0x307 ? rest_init+0xd0/0xd0 ? kernel_init+0xf/0x120 ? rest_init+0xd0/0xd0 ? ret_from_fork+0x1f/0x40 The buggy address belongs to the variable: dmar_pci_notify_info_buf+0x40/0x60 Fixes: 57384592c433 ("iommu/vt-d: Store bus information in RMRR PCI device path") Signed-off-by: Julia Cartwright <julia@ni.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2019-02-26mt76: mt76x02: set MT_TXOP_HLDR_TX40M_BLK_EN for mt76x2Felix Fietkau
It needs to be always enabled for 76x2 and conditionally enabled/disabled for 76x0. Since mt76x2_mac_stop clears this bit, ensure that it is enabled in mt76x02_edcca_init Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x2: unify mt76x2[u]_mac_resumeFelix Fietkau
They are now the same and short enough to be turned into an inline function Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix ED/CCA enabling/disablingFelix Fietkau
ED/CCA needs to be disable before stopping the MAC to avoid hangs from tx being blocked. It must only be enabled again after the MAC has been started again. In many places this wasn't done properly, so fix this by always clearing the relevant ED/CCA bits in mt76x2_mac_stop and set it up again after channel change or calibration is done Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: issue watchdog reset on MCU request timeoutFelix Fietkau
MCU request timeout usually indicates that the device is no longer responsive, and it usually does not recover without a reset Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: only reset beacon drift counter when enabling beaconsFelix Fietkau
When the timer is already running, there is no need to reset the counter, because the drift will remain the same. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix beacon timer issueFelix Fietkau
When mt76x0 and mt76x2 beacon code was unified, it changed the order in which beacon enable and beacon interval are configured. Configuring beacon enable before beacon interval can in some cases cause problems with the beacon timer, leading to clients not waking up properly from powersave mode. Fix this by changing the order back to interval first, then enable. Fixes: cc726268e4dce ("mt76: move mt76x02_bss_info_changed in mt76x02-lib module") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix beacon timer drift adjustmentFelix Fietkau
Check the count before incrementing it to match vendor code behavior. This defers the adjustment by one more tick, which should improve accuracy Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26mt76: mt76x02: fix TSF sync modeFelix Fietkau
MT_BEACON_TIME_CFG_SYNC_MODE needs to be set for AP mode, according to the documentation. For other modes it should be irrelevant in this case. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-02-26Bluetooth: hci_qca: Set HCI_QUIRK_USE_BDADDR_PROPERTY for wcn3990Matthias Kaehlcke
Set quirk for wcn3990 to read BD_ADDR from a firmware node property. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Tested-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26Bluetooth: btqcomsmd: use HCI_QUIRK_USE_BDADDR_PROPERTYMatthias Kaehlcke
Use the HCI_QUIRK_USE_BDADDR_PROPERTY quirk to let the HCI core handle the reading of 'local-bd-address'. With this there is no need to set HCI_QUIRK_INVALID_BDADDR, the case of a non-existing or invalid fwnode property is handled by the core code. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26Bluetooth: Add quirk for reading BD_ADDR from fwnode propertyMatthias Kaehlcke
Add HCI_QUIRK_USE_BDADDR_PROPERTY to allow controllers to retrieve the public Bluetooth address from the firmware node property 'local-bd-address'. If quirk is set and the property does not exist or is invalid the controller is marked as unconfigured. Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Tested-by: Balakrishna Godavarthi <bgodavar@codeaurora.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26mmc: tmio: fix access width of Block Count RegisterTakeshi Saito
In R-Car Gen2 or later, the maximum number of transfer blocks are changed from 0xFFFF to 0xFFFFFFFF. Therefore, Block Count Register should use iowrite32(). If another system (U-boot, Hypervisor OS, etc) uses bit[31:16], this value will not be cleared. So, SD/MMC card initialization fails. So, check for the bigger register and use apropriate write. Also, mark the register as extended on Gen2. Signed-off-by: Takeshi Saito <takeshi.saito.xv@renesas.com> [wsa: use max_blk_count in if(), add Gen2, update commit message] Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Cc: stable@kernel.org Reviewed-by: Simon Horman <horms+renesas@verge.net.au> [Ulf: Fixed build error] Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-02-26Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in ↵Kefeng Wang
hci_uart_set_proto() task A: task B: hci_uart_set_proto flush_to_ldisc - p->open(hu) -> h5_open //alloc h5 - receive_buf - set_bit HCI_UART_PROTO_READY - tty_port_default_receive_buf - hci_uart_register_dev - tty_ldisc_receive_buf - hci_uart_tty_receive - test_bit HCI_UART_PROTO_READY - h5_recv - clear_bit HCI_UART_PROTO_READY while() { - p->open(hu) -> h5_close //free h5 - h5_rx_3wire_hdr - h5_reset() //use-after-free } It could use ioctl to set hci uart proto, but there is a use-after-free issue when hci_uart_register_dev() fail in hci_uart_set_proto(), see stack above, fix this by setting HCI_UART_PROTO_READY bit only when hci_uart_register_dev() return success. Reported-by: syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Reviewed-by: Jeremy Cline <jcline@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-26Bluetooth: mgmt: Use struct_size() helperGustavo A. R. Silva
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*rp) + (sizeof(rp->entry[0]) * count); to : struct_size(rp, entry, count) Notice that, in this case, variable rp_len is not necessary, hence it is removed. This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2019-02-25scsi: hptiop: fix calls to dma_set_mask()Hannes Reinecke
The change to use dma_set_mask() incorrectly made a second call with the 32 bit DMA mask value when the call with the 64 bit DMA mask value succeeded. Fixes: 453cd3700ca3 ("scsi: hptiop: use dma_set_mask") Cc: <stable@vger.kernel.org> Suggested-by: Ewan D. Milne <emilne@redhat.com> Signed-off-by: Hannes Reinecke <hare@suse.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Ewan D. Milne <emilne@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
generated by cgit (git 2.34.1) at 2025-09-13 10:43:35 +0000