Re: [PATCH] libertas: Avoid reading past end of buffer

[Joe Perches]

On Tue, 2017-05-09 at 16:23 -0700, Kees Cook wrote:
> Using memcpy() from a string that is shorter than the length copied means
> the destination buffer is being filled with arbitrary data from the kernel
> rodata segment. Instead, use strncpy() which will fill the trailing bytes
> with zeros. Additionally adjust indentation to keep checkpatch.pl happy.
> 
> This was found with the future CONFIG_FORTIFY_SOURCE feature.
[]
> diff --git a/drivers/net/wireless/marvell/libertas/mesh.c 
> b/drivers/net/wireless/marvell/libertas/mesh.c
[]
> @@ -1177,9 +1177,9 @@ void lbs_mesh_ethtool_get_strings(struct net_device 
> *dev,
>   switch (stringset) {
>   case ETH_SS_STATS:
>   for (i = 0; i < MESH_STATS_NUM; i++) {
> - memcpy(s + i * ETH_GSTRING_LEN,
> - mesh_stat_strings[i],
> - ETH_GSTRING_LEN);
> + strncpy(s + i * ETH_GSTRING_LEN,
> + mesh_stat_strings[i],
> + ETH_GSTRING_LEN);
>   }

The better solution is to declare
mesh_stat_strings in in the normal way

---
 drivers/net/wireless/marvell/libertas/mesh.c | 18 +-
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/marvell/libertas/mesh.c 
b/drivers/net/wireless/marvell/libertas/mesh.c
index d0c881dd5846..a535e7f48d2d 100644
--- a/drivers/net/wireless/marvell/libertas/mesh.c
+++ b/drivers/net/wireless/marvell/libertas/mesh.c
@@ -1108,15 +1108,15 @@ void lbs_mesh_set_txpd(struct lbs_private *priv,
  * Ethtool related
  */
 
-static const char * const mesh_stat_strings[] = {
-   "drop_duplicate_bcast",
-   "drop_ttl_zero",
-   "drop_no_fwd_route",
-   "drop_no_buffers",
-   "fwded_unicast_cnt",
-   "fwded_bcast_cnt",
-   "drop_blind_table",
-   "tx_failed_cnt"
+static const char mesh_stat_strings[][ETH_GSTRING_LEN] = {
+   "drop_duplicate_bcast",
+   "drop_ttl_zero",
+   "drop_no_fwd_route",
+   "drop_no_buffers",
+   "fwded_unicast_cnt",
+   "fwded_bcast_cnt",
+   "drop_blind_table",
+   "tx_failed_cnt",
 };
 
 void lbs_mesh_ethtool_get_stats(struct net_device *dev,

[PATCH] libertas: Avoid reading past end of buffer

[Kees Cook]

Using memcpy() from a string that is shorter than the length copied means
the destination buffer is being filled with arbitrary data from the kernel
rodata segment. Instead, use strncpy() which will fill the trailing bytes
with zeros. Additionally adjust indentation to keep checkpatch.pl happy.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc: Daniel Micay 
Signed-off-by: Kees Cook 
---
 drivers/net/wireless/marvell/libertas/mesh.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/marvell/libertas/mesh.c 
b/drivers/net/wireless/marvell/libertas/mesh.c
index d0c881dd5846..d0b1948ca242 100644
--- a/drivers/net/wireless/marvell/libertas/mesh.c
+++ b/drivers/net/wireless/marvell/libertas/mesh.c
@@ -1177,9 +1177,9 @@ void lbs_mesh_ethtool_get_strings(struct net_device *dev,
switch (stringset) {
case ETH_SS_STATS:
for (i = 0; i < MESH_STATS_NUM; i++) {
-   memcpy(s + i * ETH_GSTRING_LEN,
-   mesh_stat_strings[i],
-   ETH_GSTRING_LEN);
+   strncpy(s + i * ETH_GSTRING_LEN,
+   mesh_stat_strings[i],
+   ETH_GSTRING_LEN);
}
break;
}
-- 
2.7.4


-- 
Kees Cook
Pixel Security

Re: [PATCH] wcn36xx: Close SMD channel on device removal

[Bjorn Andersson]

On Mon 08 May 23:17 PDT 2017, Kalle Valo wrote:

> Bjorn Andersson  writes:
> 
> > The SMD channel is not the primary WCNSS channel and must explicitly be
> > closed as the device is removed, or the channel will already by open on
> > a subsequent probe call in e.g. the case of reloading the kernel module.
> >
> > This issue was introduced because I simplified the underlying SMD
> > implementation while the SMD adaptions of the driver sat on the mailing
> > list, but missed to update these patches. The patch does however only
> > apply back to the transition to rpmsg, hence the limited Fixes.
> >
> > Fixes: 5052de8deff5 ("soc: qcom: smd: Transition client drivers from smd to 
> > rpmsg")
> > Reported-by: Eyal Ilsar 
> > Signed-off-by: Bjorn Andersson 
> 
> As this is a regression I'll queue this to 4.12.
> 

Thanks.

> But if this is an older bug (didn't quite understand your description
> though) should there be a separate patch for stable releases?
> 

AFAICT this never worked, as it seems I did the rework in SMD while we
tried to figure out the dependency issues we had with moving to SMD. So
v4.9 through v4.11 has SMD support - with this bug.

How do I proceed, do you want me to write up a fix for stable@? Do I
send that out as an ordinary patch?

Regards,
Bjorn

Re: [PATCH v5] qtnfmac: announcement of new FullMAC driver for Quantenna chipsets

[Igor Mitsyanko]

On 05/09/2017 08:07 AM, Kalle Valo wrote:


External Email


Kalle Valo  writes:


QSR10G (aka Pearl) is Quantenna's 8x8, 160M, 11ac offering.
QSR10G supports 2 simultaneous WMACs - one 5G and one 2G.
5G WMAC supports 160M, 8x8 configuration. FW supports
up to 8 concurrent virtual interfaces on each WMAC.

Patch introduces 2 new drivers:
- qtnfmac.ko for interfacing with kernel wireless core
- qtnfmac_pearl_pcie.ko for interfacing with hardware over PCIe interface


Please mention in the commit log also what modes (AP, managed, monitor
etc) are supported.


Oh, and drop the word "announcement" from the title. Something like
"qtnfmac: add new FullMAC driver for Quantenna chipsets" is good enough.


OK,
thanks Kalle.



--
Kalle Valo

[PATCH] mac80211: Validate michael MIC before attempting packet decode.

[Michael Skeffington]

In order to allow wpa_supplicant to correctly identify a perceived WPA TKIP key
recovery attack the michael MIC must be checked before the packet decode is
attempted.  A packet with an invalid MIC will always fail a decrypt check which
previously was being checked first.  Therefore the MIC failure bit of
status flags
describing the error would remain unset.

Signed-off-by: Michael Skeffington 

---

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bc08185..71f1a56 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3176,9 +3176,10 @@ static void ieee80211_rx_handlers(struct
ieee80211_rx_data *rx,
CALL_RXH(ieee80211_rx_h_check_more_data)
CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
CALL_RXH(ieee80211_rx_h_sta_process)
+   /* must be before decrypt so MIC failures are reported
to netlink */
+   CALL_RXH(ieee80211_rx_h_michael_mic_verify)
CALL_RXH(ieee80211_rx_h_decrypt)
CALL_RXH(ieee80211_rx_h_defragment)
-   CALL_RXH(ieee80211_rx_h_michael_mic_verify)
/* must be after MMIC verify so header is counted in MPDU mic */
 #ifdef CONFIG_MAC80211_MESH
if (ieee80211_vif_is_mesh(>sdata->vif))

Re: [v2,1/3] ath9k: Support channels in licensed bands

[Adrian Chadd]

On 9 May 2017 at 05:57, Simon Wunderlich  wrote:
> Hey Kalle,
>
> it seems like there was some discussion here and I wouldn't expect too many
> more opinions ... do you think we can have a decision based on what has been
> discussed here?

(Note: FreeBSD has had in-tree support for 4.9GHz and 900MHz bands
since forever. I'm actually thinking of extending it to include 5.9
and other UHF bands to cover licenced hardware people are making but
then leaving the support disabled unless you compile in very specific
licenced bits. No, it doesn't work out of the box unless your NIC
actually supports it in the calibration section.)

(Note note: some of those channels have non-megahertz boundaries,
which means ... yeah, hello inter-operability boundaries. Hilarious.)



-adrian

[no subject]

[Michael Skeffington]

subscribe linux-wireless

Re: [PATCH v5] qtnfmac: announcement of new FullMAC driver for Quantenna chipsets

[Kalle Valo]

Kalle Valo  writes:

>>> QSR10G (aka Pearl) is Quantenna's 8x8, 160M, 11ac offering.
>>> QSR10G supports 2 simultaneous WMACs - one 5G and one 2G.
>>> 5G WMAC supports 160M, 8x8 configuration. FW supports
>>> up to 8 concurrent virtual interfaces on each WMAC.
>>>
>>> Patch introduces 2 new drivers:
>>> - qtnfmac.ko for interfacing with kernel wireless core
>>> - qtnfmac_pearl_pcie.ko for interfacing with hardware over PCIe interface
>
> Please mention in the commit log also what modes (AP, managed, monitor
> etc) are supported.

Oh, and drop the word "announcement" from the title. Something like
"qtnfmac: add new FullMAC driver for Quantenna chipsets" is good enough.

-- 
Kalle Valo

Re: [PATCH v5] qtnfmac: announcement of new FullMAC driver for Quantenna chipsets

[Kalle Valo]

Igor Mitsyanko  writes:

> On 03/11/2017 12:04 PM, Igor Mitsyanko wrote:
>> This patch adds support for new FullMAC WiFi driver for Quantenna
>> QSR10G chipsets.
>
> Hi all,
> this patch is pending for a while now, does it require more work
> (except for what Christian mentioned)?

I just did a diff between v4 and v5 and looking good at least to me. Do
others have more comments/concerns?

Now would be a very good time to submit a new driver as we are getting
close to the rc1 release. This way it gets plenty of testing time in
linux-next. So sooner you can submit v6 the better.

>> QSR10G (aka Pearl) is Quantenna's 8x8, 160M, 11ac offering.
>> QSR10G supports 2 simultaneous WMACs - one 5G and one 2G.
>> 5G WMAC supports 160M, 8x8 configuration. FW supports
>> up to 8 concurrent virtual interfaces on each WMAC.
>>
>> Patch introduces 2 new drivers:
>> - qtnfmac.ko for interfacing with kernel wireless core
>> - qtnfmac_pearl_pcie.ko for interfacing with hardware over PCIe interface

Please mention in the commit log also what modes (AP, managed, monitor
etc) are supported.

But PLEASE edit your quotes, the insane 8000 line quote makes my use of
patchwork[1] difficult:

https://patchwork.kernel.org/patch/9619075/

[1] And I do almost all of my maintainer work via patchwork so this
habit of not editing quotes is a big hindrance for me. And
unfortunately it's getting more popular :(

-- 
Kalle Valo

Re: [PATCH 1/3] rsi: Rename the file rsi_91x_pkt.c to rsi_91x_hal.c

[amit karwar]

Hi Kvalle,

On Tue, Apr 4, 2017 at 10:30 AM, Prameela Rani Garnepudi
 wrote:
> The file rsi_91x_hal.c will contain new firmware loading method for
> RSI 9113 chipset. So this file will have device specific operations.
> As the file 'rsi_91x_pkt.c' contains code for preparing device
> (frimware understandable) specific descriptors for the transmit frames,
> it is moved to 'rsi_91x_hal.c'
>
> Signed-off-by: Prameela Rani Garnepudi 
> ---
>  drivers/net/wireless/rsi/Makefile  |   2 +-
>  drivers/net/wireless/rsi/rsi_91x_hal.c | 215 
> +
>  drivers/net/wireless/rsi/rsi_91x_pkt.c | 215 
> -
>  3 files changed, 216 insertions(+), 216 deletions(-)
>  create mode 100644 drivers/net/wireless/rsi/rsi_91x_hal.c
>  delete mode 100644 drivers/net/wireless/rsi/rsi_91x_pkt.c
>
> diff --git a/drivers/net/wireless/rsi/Makefile 
> b/drivers/net/wireless/rsi/Makefile
> index 25828b6..a475c81 100644
> --- a/drivers/net/wireless/rsi/Makefile
> +++ b/drivers/net/wireless/rsi/Makefile
> @@ -2,7 +2,7 @@ rsi_91x-y   += rsi_91x_main.o
>  rsi_91x-y  += rsi_91x_core.o
>  rsi_91x-y  += rsi_91x_mac80211.o
>  rsi_91x-y  += rsi_91x_mgmt.o
> -rsi_91x-y  += rsi_91x_pkt.o
> +rsi_91x-y  += rsi_91x_hal.o
>  rsi_91x-$(CONFIG_RSI_DEBUGFS)  += rsi_91x_debugfs.o
>
>  rsi_usb-y  += rsi_91x_usb.o rsi_91x_usb_ops.o
> diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c 
> b/drivers/net/wireless/rsi/rsi_91x_hal.c
> new file mode 100644
> index 000..02920c9
> --- /dev/null
> +++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
> @@ -0,0 +1,215 @@
> +/**
> + * Copyright (c) 2014 Redpine Signals Inc.
> + *
> + * Permission to use, copy, modify, and/or distribute this software for any
> + * purpose with or without fee is hereby granted, provided that the above
> + * copyright notice and this permission notice appear in all copies.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
> + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
> + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
> + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
> + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> + */
> +
> +#include "rsi_mgmt.h"
> +
> +/**
> + * rsi_send_data_pkt() - This function sends the recieved data packet from
> + *  driver to device.
> + * @common: Pointer to the driver private structure.
> + * @skb: Pointer to the socket buffer structure.
> + *
> + * Return: status: 0 on success, -1 on failure.
> + */
> +int rsi_send_data_pkt(struct rsi_common *common, struct sk_buff *skb)
> +{
> +   struct rsi_hw *adapter = common->priv;
> +   struct ieee80211_hdr *tmp_hdr;
> +   struct ieee80211_tx_info *info;
> +   struct skb_info *tx_params;
> +   struct ieee80211_bss_conf *bss;
> +   int status;
> +   u8 ieee80211_size = MIN_802_11_HDR_LEN;
> +   u8 extnd_size;
> +   __le16 *frame_desc;
> +   u16 seq_num;
> +
> +   info = IEEE80211_SKB_CB(skb);
> +   bss = >control.vif->bss_conf;
> +   tx_params = (struct skb_info *)info->driver_data;
> +
> +   if (!bss->assoc) {
> +   status = -EINVAL;
> +   goto err;
> +   }
> +
> +   tmp_hdr = (struct ieee80211_hdr *)>data[0];
> +   seq_num = (le16_to_cpu(tmp_hdr->seq_ctrl) >> 4);
> +
> +   extnd_size = ((uintptr_t)skb->data & 0x3);
> +
> +   if ((FRAME_DESC_SZ + extnd_size) > skb_headroom(skb)) {
> +   rsi_dbg(ERR_ZONE, "%s: Unable to send pkt\n", __func__);
> +   status = -ENOSPC;
> +   goto err;
> +   }
> +
> +   skb_push(skb, (FRAME_DESC_SZ + extnd_size));
> +   frame_desc = (__le16 *)>data[0];
> +   memset((u8 *)frame_desc, 0, FRAME_DESC_SZ);
> +
> +   if (ieee80211_is_data_qos(tmp_hdr->frame_control)) {
> +   ieee80211_size += 2;
> +   frame_desc[6] |= cpu_to_le16(BIT(12));
> +   }
> +
> +   if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
> +   (common->secinfo.security_enable)) {
> +   if (rsi_is_cipher_wep(common))
> +   ieee80211_size += 4;
> +   else
> +   ieee80211_size += 8;
> +   frame_desc[6] |= cpu_to_le16(BIT(15));
> +   }
> +
> +   frame_desc[0] = cpu_to_le16((skb->len - FRAME_DESC_SZ) |
> +   (RSI_WIFI_DATA_Q << 12));
> +   frame_desc[2] = cpu_to_le16((extnd_size) | (ieee80211_size) << 8);
> +
> +   if (common->min_rate != 0x) {
> +  

[v2 05/11] rsi: Remove unnecessary buffer allocation

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

In functions usb read register and usb write register, dynamic allocation
of 4 bytes is used. This is removed as it is unncessary for local variable
and for such small data.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 18 --
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 73b01a8..8eb7407 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -157,12 +157,8 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
u16 *value,
u16 len)
 {
-   u8 *buf;
-   int status = -ENOMEM;
-
-   buf  = kmalloc(0x04, GFP_KERNEL);
-   if (!buf)
-   return status;
+   u8 buf[4];
+   int status;
 
status = usb_control_msg(usbdev,
 usb_rcvctrlpipe(usbdev, 0),
@@ -179,7 +175,6 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
"%s: Reg read failed with error code :%d\n",
__func__, status);
}
-   kfree(buf);
 
return status;
 }
@@ -199,12 +194,8 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
 u16 value,
 u16 len)
 {
-   u8 *usb_reg_buf;
-   int status = -ENOMEM;
-
-   usb_reg_buf  = kmalloc(0x04, GFP_KERNEL);
-   if (!usb_reg_buf)
-   return status;
+   u8 usb_reg_buf[4];
+   int status;
 
usb_reg_buf[0] = (value & 0x00ff);
usb_reg_buf[1] = (value & 0xff00) >> 8;
@@ -225,7 +216,6 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
"%s: Reg write failed with error code :%d\n",
__func__, status);
}
-   kfree(usb_reg_buf);
 
return status;
 }
-- 
2.7.4

[v2 08/11] rsi: Add host interface operations as separate structure.

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

Host interface operations are currently function pointers in rsi_hw
structure. As more host interface operations are going to be introduced,
separate structure is added for these for convenience.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_hal.c  | 16 +++-
 drivers/net/wireless/rsi/rsi_91x_sdio.c | 11 +--
 drivers/net/wireless/rsi/rsi_91x_usb.c  |  9 -
 drivers/net/wireless/rsi/rsi_main.h | 18 --
 4 files changed, 40 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c 
b/drivers/net/wireless/rsi/rsi_91x_hal.c
index 02920c9..8fbf904 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -100,9 +100,8 @@ int rsi_send_data_pkt(struct rsi_common *common, struct 
sk_buff *skb)
(skb->priority & 0xf) |
(tx_params->sta_id << 8));
 
-   status = adapter->host_intf_write_pkt(common->priv,
- skb->data,
- skb->len);
+   status = adapter->host_intf_ops->write_pkt(common->priv, skb->data,
+  skb->len);
if (status)
rsi_dbg(ERR_ZONE, "%s: Failed to write pkt\n",
__func__);
@@ -148,9 +147,9 @@ int rsi_send_mgmt_pkt(struct rsi_common *common,
}
skb_push(skb, extnd_size);
skb->data[extnd_size + 4] = extnd_size;
-   status = adapter->host_intf_write_pkt(common->priv,
- (u8 *)skb->data,
- skb->len);
+   status = adapter->host_intf_ops->write_pkt(common->priv,
+  (u8 *)skb->data,
+  skb->len);
if (status) {
rsi_dbg(ERR_ZONE,
"%s: Failed to write the packet\n", __func__);
@@ -203,9 +202,8 @@ int rsi_send_mgmt_pkt(struct rsi_common *common,
 
msg[7] |= cpu_to_le16(vap_id << 8);
 
-   status = adapter->host_intf_write_pkt(common->priv,
- (u8 *)msg,
- skb->len);
+   status = adapter->host_intf_ops->write_pkt(common->priv, (u8 *)msg,
+  skb->len);
if (status)
rsi_dbg(ERR_ZONE, "%s: Failed to write the packet\n", __func__);
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c 
b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index 39d94b3..bdbec8b 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -676,8 +676,6 @@ static int rsi_init_sdio_interface(struct rsi_hw *adapter,
}
sdio_release_host(pfunction);
 
-   adapter->host_intf_write_pkt = rsi_sdio_host_intf_write_pkt;
-   adapter->host_intf_read_pkt = rsi_sdio_host_intf_read_pkt;
adapter->determine_event_timeout = rsi_sdio_determine_event_timeout;
adapter->check_hw_queue_status = rsi_sdio_read_buffer_status_register;
 
@@ -691,6 +689,13 @@ static int rsi_init_sdio_interface(struct rsi_hw *adapter,
return status;
 }
 
+static struct rsi_host_intf_ops sdio_host_intf_ops = {
+   .write_pkt  = rsi_sdio_host_intf_write_pkt,
+   .read_pkt   = rsi_sdio_host_intf_read_pkt,
+   .read_reg_multiple  = rsi_sdio_read_register_multiple,
+   .write_reg_multiple = rsi_sdio_write_register_multiple,
+};
+
 /**
  * rsi_probe() - This function is called by kernel when the driver provided
  *  Vendor and device IDs are matched. All the initialization
@@ -713,6 +718,8 @@ static int rsi_probe(struct sdio_func *pfunction,
__func__);
return 1;
}
+   adapter->rsi_host_intf = RSI_HOST_INTF_SDIO;
+   adapter->host_intf_ops = _host_intf_ops;
 
if (rsi_init_sdio_interface(adapter, pfunction)) {
rsi_dbg(ERR_ZONE, "%s: Failed to init sdio interface\n",
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index fc52311..8b81a73 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -382,6 +382,12 @@ static int rsi_usb_host_intf_write_pkt(struct rsi_hw 
*adapter,
  len);
 }
 
+static struct rsi_host_intf_ops usb_host_intf_ops = {
+   .write_pkt  = rsi_usb_host_intf_write_pkt,
+   .read_reg_multiple  = rsi_usb_read_register_multiple,
+   

[v2 10/11] rsi: Add new firmware loading method

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

The older firmware loading method has been deprecated and not in use
for any chipets. New method is introduced which works based on soft
boot loader. In this method, complete RAM image and FLASH image are
present in the flash. Before loading the functional firmware, host
issues boot loader commands to verify whether firmware to load is
different from the current functional firmware. If not, firmware
upgrade progresses and boot loader will switch to the new functional
firmware.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_hal.c  | 527 
 drivers/net/wireless/rsi/rsi_91x_sdio.c |  11 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c  |  16 +-
 drivers/net/wireless/rsi/rsi_hal.h  |  90 ++
 drivers/net/wireless/rsi/rsi_main.h |  10 +
 5 files changed, 644 insertions(+), 10 deletions(-)
 create mode 100644 drivers/net/wireless/rsi/rsi_hal.h

diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c 
b/drivers/net/wireless/rsi/rsi_91x_hal.c
index 8fbf904..d49dbaa 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -14,7 +14,16 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include 
 #include "rsi_mgmt.h"
+#include "rsi_hal.h"
+#include "rsi_sdio.h"
+
+/* FLASH Firmware */
+static struct ta_metadata metadata_flash_content[] = {
+   {"flash_content", 0x0001},
+   {"rs9113_wlan_qspi.rps", 0x0001},
+};
 
 /**
  * rsi_send_data_pkt() - This function sends the recieved data packet from
@@ -211,3 +220,521 @@ int rsi_send_mgmt_pkt(struct rsi_common *common,
rsi_indicate_tx_status(common->priv, skb, status);
return status;
 }
+
+static void bl_cmd_timeout(unsigned long priv)
+{
+   struct rsi_hw *adapter = (struct rsi_hw *)priv;
+
+   adapter->blcmd_timer_expired = true;
+   del_timer(>bl_cmd_timer);
+}
+
+static int bl_start_cmd_timer(struct rsi_hw *adapter, u32 timeout)
+{
+   init_timer(>bl_cmd_timer);
+   adapter->bl_cmd_timer.data = (unsigned long)adapter;
+   adapter->bl_cmd_timer.function = (void *)_cmd_timeout;
+   adapter->bl_cmd_timer.expires = (msecs_to_jiffies(timeout) + jiffies);
+
+   adapter->blcmd_timer_expired = false;
+   add_timer(>bl_cmd_timer);
+
+   return 0;
+}
+
+static int bl_stop_cmd_timer(struct rsi_hw *adapter)
+{
+   adapter->blcmd_timer_expired = false;
+   if (timer_pending(>bl_cmd_timer))
+   del_timer(>bl_cmd_timer);
+
+   return 0;
+}
+
+static int bl_write_cmd(struct rsi_hw *adapter, u8 cmd, u8 exp_resp,
+   u16 *cmd_resp)
+{
+   struct rsi_host_intf_ops *hif_ops = adapter->host_intf_ops;
+   u32 regin_val = 0, regout_val = 0;
+   u32 regin_input = 0;
+   u8 output = 0;
+   int status;
+
+   regin_input = (REGIN_INPUT | adapter->priv->coex_mode);
+
+   while (!adapter->blcmd_timer_expired) {
+   regin_val = 0;
+   status = hif_ops->master_reg_read(adapter, SWBL_REGIN,
+ _val, 2);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE,
+   "%s: Command %0x REGIN reading failed..\n",
+   __func__, cmd);
+   return status;
+   }
+   mdelay(1);
+   if ((regin_val >> 12) != REGIN_VALID)
+   break;
+   }
+   if (adapter->blcmd_timer_expired) {
+   rsi_dbg(ERR_ZONE,
+   "%s: Command %0x REGIN reading timed out..\n",
+   __func__, cmd);
+   return -ETIMEDOUT;
+   }
+
+   rsi_dbg(INFO_ZONE,
+   "Issuing write to Regin val:%0x sending cmd:%0x\n",
+   regin_val, (cmd | regin_input << 8));
+   status = hif_ops->master_reg_write(adapter, SWBL_REGIN,
+  (cmd | regin_input << 8), 2);
+   if (status < 0)
+   return status;
+   mdelay(1);
+
+   if (cmd == LOAD_HOSTED_FW || cmd == JUMP_TO_ZERO_PC) {
+   /* JUMP_TO_ZERO_PC doesn't expect
+* any response. So return from here
+*/
+   return 0;
+   }
+
+   while (!adapter->blcmd_timer_expired) {
+   regout_val = 0;
+   status = hif_ops->master_reg_read(adapter, SWBL_REGOUT,
+_val, 2);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE,
+   "%s: Command %0x REGOUT reading failed..\n",
+   __func__, cmd);
+   return status;
+   }
+   mdelay(1);
+   if ((regout_val >> 8) == 

[v2 11/11] rsi: Remove old firmware loading method

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

The older firmware loading method is not usable by any Redpine chipset.
Hence removing that part of the code.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 187 
 drivers/net/wireless/rsi/rsi_91x_usb.c  |   6 +-
 drivers/net/wireless/rsi/rsi_91x_usb_ops.c  | 126 ---
 drivers/net/wireless/rsi/rsi_common.h   |   3 +-
 drivers/net/wireless/rsi/rsi_sdio.h |   1 -
 drivers/net/wireless/rsi/rsi_usb.h  |   3 -
 6 files changed, 3 insertions(+), 323 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c 
b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index 225042f..df2a63b 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -60,171 +60,6 @@ int rsi_sdio_master_access_msword(struct rsi_hw *adapter, 
u16 ms_word)
 }
 
 /**
- * rsi_copy_to_card() - This function includes the actual funtionality of
- * copying the TA firmware to the card.Basically this
- * function includes opening the TA file,reading the
- * TA file and writing their values in blocks of data.
- * @common: Pointer to the driver private structure.
- * @fw: Pointer to the firmware value to be written.
- * @len: length of firmware file.
- * @num_blocks: Number of blocks to be written to the card.
- *
- * Return: 0 on success and -1 on failure.
- */
-static int rsi_copy_to_card(struct rsi_common *common,
-   const u8 *fw,
-   u32 len,
-   u16 num_blocks)
-{
-   struct rsi_hw *adapter = common->priv;
-   struct rsi_91x_sdiodev *dev =
-   (struct rsi_91x_sdiodev *)adapter->rsi_dev;
-   u32 indx, ii;
-   u16 block_size = dev->tx_blk_size;
-   u32 lsb_address;
-   __le32 data[] = { TA_HOLD_THREAD_VALUE, TA_SOFT_RST_CLR,
- TA_PC_ZERO, TA_RELEASE_THREAD_VALUE };
-   u32 address[] = { TA_HOLD_THREAD_REG, TA_SOFT_RESET_REG,
- TA_TH0_PC_REG, TA_RELEASE_THREAD_REG };
-   u32 base_address;
-   u16 msb_address;
-
-   base_address = TA_LOAD_ADDRESS;
-   msb_address = base_address >> 16;
-
-   for (indx = 0, ii = 0; ii < num_blocks; ii++, indx += block_size) {
-   lsb_address = ((u16) base_address | RSI_SD_REQUEST_MASTER);
-   if (rsi_sdio_write_register_multiple(adapter,
-lsb_address,
-(u8 *)(fw + indx),
-block_size)) {
-   rsi_dbg(ERR_ZONE,
-   "%s: Unable to load %s blk\n", __func__,
-   FIRMWARE_RSI9113);
-   return -1;
-   }
-   rsi_dbg(INIT_ZONE, "%s: loading block: %d\n", __func__, ii);
-   base_address += block_size;
-   if ((base_address >> 16) != msb_address) {
-   msb_address += 1;
-   if (rsi_sdio_master_access_msword(adapter,
- msb_address)) {
-   rsi_dbg(ERR_ZONE,
-   "%s: Unable to set ms word reg\n",
-   __func__);
-   return -1;
-   }
-   }
-   }
-
-   if (len % block_size) {
-   lsb_address = ((u16) base_address | RSI_SD_REQUEST_MASTER);
-   if (rsi_sdio_write_register_multiple(adapter,
-lsb_address,
-(u8 *)(fw + indx),
-len % block_size)) {
-   rsi_dbg(ERR_ZONE,
-   "%s: Unable to load f/w\n", __func__);
-   return -1;
-   }
-   }
-   rsi_dbg(INIT_ZONE,
-   "%s: Succesfully loaded TA instructions\n", __func__);
-
-   if (rsi_sdio_master_access_msword(adapter, TA_BASE_ADDR)) {
-   rsi_dbg(ERR_ZONE,
-   "%s: Unable to set ms word to common reg\n",
-   __func__);
-   return -1;
-   }
-
-   for (ii = 0; ii < ARRAY_SIZE(data); ii++) {
-   /* Bringing TA out of reset */
-   if (rsi_sdio_write_register_multiple(adapter,
-(address[ii] |
-RSI_SD_REQUEST_MASTER),
-(u8 *)[ii],
- 

[v2 06/11] rsi: Handle usb multi-byte write failure case properly

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

In function usb_write_register_multiple, if any intermediate block transfer
is failed, further operations should be terminated. 'else' is removed, as
there is no significance for it after return.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 8eb7407..634f726 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -306,11 +306,12 @@ int rsi_usb_write_register_multiple(struct rsi_hw 
*adapter,
rsi_dbg(ERR_ZONE,
"Reg write failed with error code :%d\n",
status);
-   } else {
-   count -= transfer;
-   data += transfer;
-   addr += transfer;
+   kfree(buf);
+   return status;
}
+   count -= transfer;
+   data += transfer;
+   addr += transfer;
}
 
kfree(buf);
-- 
2.7.4

[v2 09/11] rsi: Add new host interface operations

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

Host interface opearation master_reg_read, master_reg_write and
load_data_master_write are added. These functions are needed for the
new firmware loading method. As part of this, the function
master_access_msword is moved from rsi_91x_sdio_ops.c to rsi_91x_sdio.c.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_sdio.c | 179 
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c |   3 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c  |  65 ++
 drivers/net/wireless/rsi/rsi_main.h |   8 ++
 drivers/net/wireless/rsi/rsi_sdio.h |   1 +
 5 files changed, 254 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c 
b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index bdbec8b..b397e2c 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -552,6 +552,182 @@ int rsi_sdio_write_register_multiple(struct rsi_hw 
*adapter,
return status;
 }
 
+static int rsi_sdio_load_data_master_write(struct rsi_hw *adapter,
+  u32 base_address,
+  u32 instructions_sz,
+  u16 block_size,
+  u8 *ta_firmware)
+{
+   u32 num_blocks, offset, i;
+   u16 msb_address, lsb_address;
+   u8 temp_buf[block_size];
+   int status;
+
+   num_blocks = instructions_sz / block_size;
+   msb_address = base_address >> 16;
+
+   rsi_dbg(INFO_ZONE, "ins_size: %d, num_blocks: %d\n",
+   instructions_sz, num_blocks);
+
+   /* Loading DM ms word in the sdio slave */
+   status = rsi_sdio_master_access_msword(adapter, msb_address);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE, "%s: Unable to set ms word reg\n", __func__);
+   return status;
+   }
+
+   for (offset = 0, i = 0; i < num_blocks; i++, offset += block_size) {
+   memset(temp_buf, 0, block_size);
+   memcpy(temp_buf, ta_firmware + offset, block_size);
+   lsb_address = (u16)base_address;
+   status = rsi_sdio_write_register_multiple
+   (adapter,
+lsb_address | RSI_SD_REQUEST_MASTER,
+temp_buf, block_size);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE, "%s: failed to write\n", __func__);
+   return status;
+   }
+   rsi_dbg(INFO_ZONE, "%s: loading block: %d\n", __func__, i);
+   base_address += block_size;
+
+   if ((base_address >> 16) != msb_address) {
+   msb_address += 1;
+
+   /* Loading DM ms word in the sdio slave */
+   status = rsi_sdio_master_access_msword(adapter,
+  msb_address);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE,
+   "%s: Unable to set ms word reg\n",
+   __func__);
+   return status;
+   }
+   }
+   }
+
+   if (instructions_sz % block_size) {
+   memset(temp_buf, 0, block_size);
+   memcpy(temp_buf, ta_firmware + offset,
+  instructions_sz % block_size);
+   lsb_address = (u16)base_address;
+   status = rsi_sdio_write_register_multiple
+   (adapter,
+lsb_address | RSI_SD_REQUEST_MASTER,
+temp_buf,
+instructions_sz % block_size);
+   if (status < 0)
+   return status;
+   rsi_dbg(INFO_ZONE,
+   "Written Last Block in Address 0x%x Successfully\n",
+   offset | RSI_SD_REQUEST_MASTER);
+   }
+   return 0;
+}
+
+#define FLASH_SIZE_ADDR 0x0416
+static int rsi_sdio_master_reg_read(struct rsi_hw *adapter, u32 addr,
+   u32 *read_buf, u16 size)
+{
+   u32 addr_on_bus, *data;
+   u32 align[2] = {};
+   u16 ms_addr;
+   int status;
+
+   data = PTR_ALIGN([0], 8);
+
+   ms_addr = (addr >> 16);
+   status = rsi_sdio_master_access_msword(adapter, ms_addr);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE,
+   "%s: Unable to set ms word to common reg\n",
+   __func__);
+   return status;
+   }
+   addr &= 0x;
+
+   addr_on_bus = 

[v2 07/11] rsi: Add usb multi-byte read operation

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

USB multibyte read will be used in the new firmware loading method
for RS9113 chipset.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 40 ++
 1 file changed, 40 insertions(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 634f726..fc52311 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -266,6 +266,46 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter)
return status;
 }
 
+static int rsi_usb_read_register_multiple(struct rsi_hw *adapter, u32 addr,
+ u8 *data, u16 count)
+{
+   struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+   u8 *buf;
+   u16 transfer;
+   int status;
+
+   if (!addr)
+   return -EINVAL;
+
+   buf = kzalloc(4096, GFP_KERNEL);
+   if (!buf)
+   return -ENOMEM;
+
+   while (count) {
+   transfer = min_t(u16, count, 4096);
+   status = usb_control_msg(dev->usbdev,
+usb_rcvctrlpipe(dev->usbdev, 0),
+USB_VENDOR_REGISTER_READ,
+RSI_USB_REQ_IN,
+((addr & 0x) >> 16),
+(addr & 0x), (void *)buf,
+transfer, USB_CTRL_GET_TIMEOUT);
+   if (status < 0) {
+   rsi_dbg(ERR_ZONE,
+   "Reg read failed with error code :%d\n",
+status);
+   kfree(buf);
+   return status;
+   }
+   memcpy(data, buf, transfer);
+   count -= transfer;
+   data += transfer;
+   addr += transfer;
+   }
+   kfree(buf);
+   return 0;
+}
+
 /**
  * rsi_usb_write_register_multiple() - This function writes multiple bytes of
  *information to multiple registers.
-- 
2.7.4

[v2 04/11] rsi: use macros in USB specific code

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

For USB vendor read and write operations new macros added to avoid
redundant usage of long or'ed macros. Also for timeouts standard USB
macros are used.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 15 +--
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index dfb8a75..73b01a8 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -141,6 +141,9 @@ static int rsi_find_bulk_in_and_out_endpoints(struct 
usb_interface *interface,
return 0;
 }
 
+#define RSI_USB_REQ_OUT(USB_TYPE_VENDOR | USB_DIR_OUT | 
USB_RECIP_DEVICE)
+#define RSI_USB_REQ_IN (USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE)
+
 /* rsi_usb_reg_read() - This function reads data from given register address.
  * @usbdev: Pointer to the usb_device structure.
  * @reg: Address of the register to be read.
@@ -164,11 +167,11 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
status = usb_control_msg(usbdev,
 usb_rcvctrlpipe(usbdev, 0),
 USB_VENDOR_REGISTER_READ,
-USB_TYPE_VENDOR,
+RSI_USB_REQ_IN,
 ((reg & 0x) >> 16), (reg & 0x),
 (void *)buf,
 len,
-HZ * 5);
+USB_CTRL_GET_TIMEOUT);
 
*value = (buf[0] | (buf[1] << 8));
if (status < 0) {
@@ -211,12 +214,12 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
status = usb_control_msg(usbdev,
 usb_sndctrlpipe(usbdev, 0),
 USB_VENDOR_REGISTER_WRITE,
-USB_TYPE_VENDOR,
+RSI_USB_REQ_OUT,
 ((reg & 0x) >> 16),
 (reg & 0x),
 (void *)usb_reg_buf,
 len,
-HZ * 5);
+USB_CTRL_SET_TIMEOUT);
if (status < 0) {
rsi_dbg(ERR_ZONE,
"%s: Reg write failed with error code :%d\n",
@@ -303,12 +306,12 @@ int rsi_usb_write_register_multiple(struct rsi_hw 
*adapter,
status = usb_control_msg(dev->usbdev,
 usb_sndctrlpipe(dev->usbdev, 0),
 USB_VENDOR_REGISTER_WRITE,
-USB_TYPE_VENDOR,
+RSI_USB_REQ_OUT,
 ((addr & 0x) >> 16),
 (addr & 0x),
 (void *)buf,
 transfer,
-HZ * 5);
+USB_CTRL_SET_TIMEOUT);
if (status < 0) {
rsi_dbg(ERR_ZONE,
"Reg write failed with error code :%d\n",
-- 
2.7.4

[v2 03/11] rsi: Changes in USB read and write operations

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

USB read and write registers maximum size is limited 2^16. More than
this size is not used in the driver.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 6 +++---
 drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 9 +
 drivers/net/wireless/rsi/rsi_usb.h | 2 +-
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c 
b/drivers/net/wireless/rsi/rsi_91x_usb.c
index cc8deec..dfb8a75 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -286,11 +286,11 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter)
 int rsi_usb_write_register_multiple(struct rsi_hw *adapter,
u32 addr,
u8 *data,
-   u32 count)
+   u16 count)
 {
struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
u8 *buf;
-   u8 transfer;
+   u16 transfer;
int status = 0;
 
buf = kzalloc(4096, GFP_KERNEL);
@@ -298,7 +298,7 @@ int rsi_usb_write_register_multiple(struct rsi_hw *adapter,
return -ENOMEM;
 
while (count) {
-   transfer = (u8)(min_t(u32, count, 4096));
+   transfer = min_t(u16, count, 4096);
memcpy(buf, data, transfer);
status = usb_control_msg(dev->usbdev,
 usb_sndctrlpipe(dev->usbdev, 0),
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c 
b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
index de49008..1c3e654 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
@@ -33,12 +33,12 @@
 static int rsi_copy_to_card(struct rsi_common *common,
const u8 *fw,
u32 len,
-   u32 num_blocks)
+   u16 num_blocks)
 {
struct rsi_hw *adapter = common->priv;
struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
u32 indx, ii;
-   u32 block_size = dev->tx_blk_size;
+   u16 block_size = dev->tx_blk_size;
u32 lsb_address;
u32 base_address;
 
@@ -134,9 +134,10 @@ static int rsi_load_ta_instructions(struct rsi_common 
*common)
struct rsi_hw *adapter = common->priv;
struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
const struct firmware *fw_entry = NULL;
-   u32 block_size = dev->tx_blk_size;
+   u16 block_size = dev->tx_blk_size;
const u8 *fw;
-   u32 num_blocks, len;
+   u16 num_blocks;
+   u32 len;
int status = 0;
 
status = request_firmware(_entry, FIRMWARE_RSI9113, adapter->device);
diff --git a/drivers/net/wireless/rsi/rsi_usb.h 
b/drivers/net/wireless/rsi/rsi_usb.h
index ebea0c4..52379c6 100644
--- a/drivers/net/wireless/rsi/rsi_usb.h
+++ b/drivers/net/wireless/rsi/rsi_usb.h
@@ -63,6 +63,6 @@ static inline int rsi_usb_event_timeout(struct rsi_hw 
*adapter)
 
 int rsi_usb_device_init(struct rsi_common *common);
 int rsi_usb_write_register_multiple(struct rsi_hw *adapter, u32 addr,
-   u8 *data, u32 count);
+   u8 *data, u16 count);
 void rsi_usb_rx_thread(struct rsi_common *common);
 #endif
-- 
2.7.4

[v2 02/11] rsi: Changes to sdio reads and writes

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

SDIO read or write maximum size is limited to 2^16. This is done to make
the host interface operations common for SDIO and USB.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/rsi_91x_sdio.c | 10 +-
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c |  8 
 drivers/net/wireless/rsi/rsi_sdio.h |  4 ++--
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c 
b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index 8428858..39d94b3 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -487,8 +487,8 @@ void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit)
  */
 static int rsi_sdio_read_register_multiple(struct rsi_hw *adapter,
   u32 addr,
-  u32 count,
-  u8 *data)
+  u8 *data,
+  u16 count)
 {
struct rsi_91x_sdiodev *dev =
(struct rsi_91x_sdiodev *)adapter->rsi_dev;
@@ -518,7 +518,7 @@ static int rsi_sdio_read_register_multiple(struct rsi_hw 
*adapter,
 int rsi_sdio_write_register_multiple(struct rsi_hw *adapter,
 u32 addr,
 u8 *data,
-u32 count)
+u16 count)
 {
struct rsi_91x_sdiodev *dev =
(struct rsi_91x_sdiodev *)adapter->rsi_dev;
@@ -614,8 +614,8 @@ int rsi_sdio_host_intf_read_pkt(struct rsi_hw *adapter,
 
status = rsi_sdio_read_register_multiple(adapter,
 length,
-length, /*num of bytes*/
-(u8 *)pkt);
+(u8 *)pkt,
+length); /*num of bytes*/
 
if (status)
rsi_dbg(ERR_ZONE, "%s: Failed to read frame: %d\n", __func__,
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c 
b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index 40d7231..7c9cf01 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -75,13 +75,13 @@ static int rsi_sdio_master_access_msword(struct rsi_hw 
*adapter,
 static int rsi_copy_to_card(struct rsi_common *common,
const u8 *fw,
u32 len,
-   u32 num_blocks)
+   u16 num_blocks)
 {
struct rsi_hw *adapter = common->priv;
struct rsi_91x_sdiodev *dev =
(struct rsi_91x_sdiodev *)adapter->rsi_dev;
u32 indx, ii;
-   u32 block_size = dev->tx_blk_size;
+   u16 block_size = dev->tx_blk_size;
u32 lsb_address;
__le32 data[] = { TA_HOLD_THREAD_VALUE, TA_SOFT_RST_CLR,
  TA_PC_ZERO, TA_RELEASE_THREAD_VALUE };
@@ -171,10 +171,10 @@ static int rsi_load_ta_instructions(struct rsi_common 
*common)
struct rsi_91x_sdiodev *dev =
(struct rsi_91x_sdiodev *)adapter->rsi_dev;
u32 len;
-   u32 num_blocks;
+   u16 num_blocks;
const u8 *fw;
const struct firmware *fw_entry = NULL;
-   u32 block_size = dev->tx_blk_size;
+   u16 block_size = dev->tx_blk_size;
int status = 0;
u32 base_address;
u16 msb_address;
diff --git a/drivers/net/wireless/rsi/rsi_sdio.h 
b/drivers/net/wireless/rsi/rsi_sdio.h
index c7e8f2b..a82bc4c 100644
--- a/drivers/net/wireless/rsi/rsi_sdio.h
+++ b/drivers/net/wireless/rsi/rsi_sdio.h
@@ -110,7 +110,7 @@ struct rsi_91x_sdiodev {
u8 sdio_clock_speed;
u32 cardcapability;
u8 prev_desc[16];
-   u32 tx_blk_size;
+   u16 tx_blk_size;
u8 write_fail;
 };
 
@@ -122,7 +122,7 @@ int rsi_sdio_host_intf_read_pkt(struct rsi_hw *adapter, u8 
*pkt, u32 length);
 int rsi_sdio_write_register(struct rsi_hw *adapter, u8 function,
u32 addr, u8 *data);
 int rsi_sdio_write_register_multiple(struct rsi_hw *adapter, u32 addr,
-u8 *data, u32 count);
+u8 *data, u16 count);
 void rsi_sdio_ack_intr(struct rsi_hw *adapter, u8 int_bit);
 int rsi_sdio_determine_event_timeout(struct rsi_hw *adapter);
 int rsi_sdio_read_buffer_status_register(struct rsi_hw *adapter, u8 q_num);
-- 
2.7.4

[v2 01/11] rsi: Rename file rsi_91x_pkt.c to rsi_91x_hal.c

[Amitkumar Karwar]

From: Prameela Rani Garnepudi 

The file rsi_91x_hal.c is going to contain device specific code i.e new
firmware loading method for RS9113 chipset. As the file rsi_91x_pkt.c
contains code to prepare device specific descriptors for transmit packet,
this file is renamed to rsi_91x_hal.c which is more relevant as per it's
functionality.

Signed-off-by: Prameela Rani Garnepudi 
Signed-off-by: Amitkumar Karwar 
---
 drivers/net/wireless/rsi/Makefile | 2 +-
 drivers/net/wireless/rsi/{rsi_91x_pkt.c => rsi_91x_hal.c} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename drivers/net/wireless/rsi/{rsi_91x_pkt.c => rsi_91x_hal.c} (100%)

diff --git a/drivers/net/wireless/rsi/Makefile 
b/drivers/net/wireless/rsi/Makefile
index 25828b6..a475c81 100644
--- a/drivers/net/wireless/rsi/Makefile
+++ b/drivers/net/wireless/rsi/Makefile
@@ -2,7 +2,7 @@ rsi_91x-y   += rsi_91x_main.o
 rsi_91x-y  += rsi_91x_core.o
 rsi_91x-y  += rsi_91x_mac80211.o
 rsi_91x-y  += rsi_91x_mgmt.o
-rsi_91x-y  += rsi_91x_pkt.o
+rsi_91x-y  += rsi_91x_hal.o
 rsi_91x-$(CONFIG_RSI_DEBUGFS)  += rsi_91x_debugfs.o
 
 rsi_usb-y  += rsi_91x_usb.o rsi_91x_usb_ops.o
diff --git a/drivers/net/wireless/rsi/rsi_91x_pkt.c 
b/drivers/net/wireless/rsi/rsi_91x_hal.c
similarity index 100%
rename from drivers/net/wireless/rsi/rsi_91x_pkt.c
rename to drivers/net/wireless/rsi/rsi_91x_hal.c
-- 
2.7.4

[v2 00/11] Firmware loading changes

[Amitkumar Karwar]

This patch series includes firmware loading enhancements for
Redpine 9113 chipset. The older method is not being used by any
Redpine chipset. There is no firmware image submitted to upstream
yet. We will submit 9113's firmware image once these changes are
accepted.

This patch series is based on original work submitted by Prameela
earlier. We have done some cleanup work and prepared smaller
incremental patches. We will start maintaining changelog for further
revisions.

Prameela Rani Garnepudi (11):
  rsi: Rename file rsi_91x_pkt.c to rsi_91x_hal.c
  rsi: Changes to sdio reads and writes
  rsi: Changes in USB read and write operations
  rsi: use macros in USB specific code
  rsi: Remove unnecessary buffer allocation
  rsi: Handle usb multi-byte write failure case properly
  rsi: Add usb multi-byte read operation
  rsi: Add host interface operations as separate structure.
  rsi: Add new host interface operations
  rsi: Add new firmware loading method
  rsi: Remove old firmware loading method

 drivers/net/wireless/rsi/Makefile   |   2 +-
 drivers/net/wireless/rsi/rsi_91x_hal.c  | 740 
 drivers/net/wireless/rsi/rsi_91x_pkt.c  | 215 
 drivers/net/wireless/rsi/rsi_91x_sdio.c | 211 +++-
 drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 190 +--
 drivers/net/wireless/rsi/rsi_91x_usb.c  | 182 +--
 drivers/net/wireless/rsi/rsi_91x_usb_ops.c  | 125 -
 drivers/net/wireless/rsi/rsi_common.h   |   3 +-
 drivers/net/wireless/rsi/rsi_hal.h  |  90 
 drivers/net/wireless/rsi/rsi_main.h |  36 +-
 drivers/net/wireless/rsi/rsi_sdio.h |   6 +-
 drivers/net/wireless/rsi/rsi_usb.h  |   3 -
 12 files changed, 1215 insertions(+), 588 deletions(-)
 create mode 100644 drivers/net/wireless/rsi/rsi_91x_hal.c
 delete mode 100644 drivers/net/wireless/rsi/rsi_91x_pkt.c
 create mode 100644 drivers/net/wireless/rsi/rsi_hal.h

-- 
2.7.4

[PATCH v2] ath10k: remove unnecessary code

[Gustavo A. R. Silva]

The array fields in struct wmi_start_scan_arg that are checked here are
fixed size arrays so they can never be NULL.

Addresses-Coverity-ID: 1260031
Cc: Arend Van Spriel 
Cc: Kalle Valo 
Signed-off-by: Gustavo A. R. Silva 
---
Changes in v2:
 Rephrase commit log.

 drivers/net/wireless/ath/ath10k/wmi.c | 9 -
 1 file changed, 9 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c 
b/drivers/net/wireless/ath/ath10k/wmi.c
index 2f1743e..135cf83 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -5933,15 +5933,6 @@ static struct sk_buff 
*ath10k_wmi_10_4_op_gen_init(struct ath10k *ar)
 
 int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
 {
-   if (arg->ie_len && !arg->ie)
-   return -EINVAL;
-   if (arg->n_channels && !arg->channels)
-   return -EINVAL;
-   if (arg->n_ssids && !arg->ssids)
-   return -EINVAL;
-   if (arg->n_bssids && !arg->bssids)
-   return -EINVAL;
-
if (arg->ie_len > WLAN_SCAN_PARAMS_MAX_IE_LEN)
return -EINVAL;
if (arg->n_channels > ARRAY_SIZE(arg->channels))
-- 
2.5.0

[PATCH v2] ath9k: remove unnecessary code

[Gustavo A. R. Silva]

The array field eeprom_data in struct th9k_platform_data
is a fixed size array so it can never be NULL.

Addresses-Coverity-ID: 1364903
Cc: Arend Van Spriel 
Cc: Kalle Valo 
Signed-off-by: Gustavo A. R. Silva 
---
Changes in v2:
 Rephrase commit log.

 drivers/net/wireless/ath/ath9k/eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c 
b/drivers/net/wireless/ath/ath9k/eeprom.c
index fb80ec8..5c3bc28 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -143,7 +143,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 
*data)
 
if (ah->eeprom_blob)
ret = ath9k_hw_nvram_read_firmware(ah->eeprom_blob, off, data);
-   else if (pdata && !pdata->use_eeprom && pdata->eeprom_data)
+   else if (pdata && !pdata->use_eeprom)
ret = ath9k_hw_nvram_read_pdata(pdata, off, data);
else
ret = common->bus_ops->eeprom_read(common, off, data);
-- 
2.5.0

Re: [PATCH] net: wireless: ath: ath9k: remove unnecessary code

[Gustavo A. R. Silva]

Quoting Kalle Valo :


"Gustavo A. R. Silva"  writes:


Hi Kalle,

Quoting Kalle Valo :


"Gustavo A. R. Silva"  writes:

The name of an array used by itself will always return the  
array's address.

So this test will always evaluate as true.

Addresses-Coverity-ID: 1364903
Signed-off-by: Gustavo A. R. Silva 
---
 drivers/net/wireless/ath/ath9k/eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c
b/drivers/net/wireless/ath/ath9k/eeprom.c
index fb80ec8..5c3bc28 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -143,7 +143,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32
off, u16 *data)

if (ah->eeprom_blob)
ret = ath9k_hw_nvram_read_firmware(ah->eeprom_blob, off, data);
-   else if (pdata && !pdata->use_eeprom && pdata->eeprom_data)
+   else if (pdata && !pdata->use_eeprom)
ret = ath9k_hw_nvram_read_pdata(pdata, off, data);
else
ret = common->bus_ops->eeprom_read(common, off, data);


The patch may very well be valid (didn't check yet) but the commit log
is gibberish for me.



Let me correct that and I'll send the patch again.


Thanks.

Also no need to have that long "net: wireless: ath:" prefix, "ath9k: "
or "ath10k: " is enough.



I get it.

Thanks!
--
Gustavo A. R. Silva

Re: [v2,1/3] ath9k: Support channels in licensed bands

[Simon Wunderlich]

Hey Kalle,

it seems like there was some discussion here and I wouldn't expect too many 
more opinions ... do you think we can have a decision based on what has been 
discussed here?

I'd be happy to rebase the remaining patches if that is necessary.

Thank you!
 Simon

On Friday, April 21, 2017 2:40:51 PM CEST Mathias Kretschmer wrote:
> Hi all,
> 
> as one of the parties who triggered this patch to be included into the
> main line kernel, we do support Simon's or Ben's point of view.
> 
> Safeguards against accidental misuse are in place. Various patches are
> (have been) already in the open, so if someone wants to be evil, it
> can't be prevented.
> 
> Also, these patches do not make up new channels out of the blue, they
> merely enable channels which are allowed in certain countries under
> specific regulations. To me it seems to be the task of the distribution
> manager (or manufacturer) to ensure that only hardware/kernel features
> are made available that are legal in the given jurisdiction.
> 
> The default behavior is to disable those extra channels. If you are
> building, i.e. First Responder solutions, you need to ensure that those
> guys use the systems incl. the frequency spectrum accordingly.
> 
> To be pragmatic and to avoid out-of-tree code maintenance, my vote would
> be for integration into mainline.
> 
> Best regards,
> 
> Mathias
> 
> 
> 
> 
> Hence, for
> 
> On 21-Apr-17 13:29, Simon Wunderlich wrote:
> > Hi,
> > 
> > On Tuesday, April 18, 2017 10:09:59 AM CEST Ben Greear wrote:
> >> [...]
> >> 
> >>>  In my personal view, we have quite a few obstacles which I consider
> >>>  "enough", but would be interesting to hear others opinions ...
> >>> 
> >>> I'll throw in my 2-cents. This patch is treading on very dangerous
> >>> ground.
> >>> I can't speak to other regulatory environments, but at least the FCC is
> >>> cracking down on even the possibility that anyone can operate a WiFi
> >>> device outside the regulatory bounds.
> >> 
> >> These patches make it slightly easier to use the licensed bands, but no
> >> one
> >> can accidentally use them due to the regdb and other constaints in these
> >> patches.
> >> 
> >> So, I don't think these patches offer any fundamental new vulnerability
> >> that should concern the FCC.
> >> 
> >> After all, someone who really wants to do evil can find and apply the
> >> patches without undue effort, and it could easily be that those applying
> >> the patches would then make it even easier to abuse the new channels due
> >> to
> >> laziness or poor coding choices.
> > 
> > I'm with Ben on this one. I also have followed the FCC actions in the past
> > few years, and I've also been involved into that [1,2,3]. There are
> > mailing lists on the topic if you want to get involved. I agree that the
> > topic is important, but I would prefer to not have this patch serving as
> > battleground. :)
> > 
> > The patches proposed here, as Ben says, at least put proper warnings and
> > obstacles which users have to knowingly overcome (or read). It's probably
> > safer than keeping the driver as is and having people apply random patches
> > from the internet which they don't understand or hack the code themselves.
> > Frankly, it's not that hard to enable those channels.
> > 
> > As we have seen by the number of questions and people trying to bring this
> > patch in (Ben and Julian), there is quite some interest for supporting
> > those bands. I've also got a few requests from companies to have it
> > supported (Fraunhofer is one of those).
> > 
> > Cheers,
> > 
> >Simon
> > 
> > [1] https://www.reddit.com/r/wireless/comments/3irr5b/
> > openwrt_vs_fcc_forced_firmware_lockdown/
> > [2] http://hackaday.com/2016/02/26/fcc-locks-down-router-firmware/
> > [3] https://libreplanet.org/wiki/Save_WiFi
> 
> ___
> ath10k mailing list
> ath...@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/ath10k



signature.asc
Description: This is a digitally signed message part.

Re: [PATCH] net: wireless: ath: ath10k: remove unnecessary code

[Gustavo A. R. Silva]

Hi Arend,

Quoting Arend Van Spriel :


On 9-5-2017 7:33, Kalle Valo wrote:

"Gustavo A. R. Silva"  writes:


The name of an array used by itself will always return the array's address.
So these tests will always evaluate as false and therefore the _return_
will never be executed.

Signed-off-by: Gustavo A. R. Silva 


I don't understand the commit log, especially what does "The name of an
array used by itself" mean?


The array fields in struct wmi_start_scan_arg that are checked here are
fixed size arrays so they can never be NULL.

Maybe that helps rephrasing this commit message.



Definitely. Thank you!
--
Gustavo A. R. Silva

Re: [PATCH] net: wireless: ath: ath9k: remove unnecessary code

[Gustavo A. R. Silva]

Hi Kalle,

Quoting Kalle Valo :


"Gustavo A. R. Silva"  writes:


The name of an array used by itself will always return the array's address.
So this test will always evaluate as true.

Addresses-Coverity-ID: 1364903
Signed-off-by: Gustavo A. R. Silva 
---
 drivers/net/wireless/ath/ath9k/eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c  
b/drivers/net/wireless/ath/ath9k/eeprom.c

index fb80ec8..5c3bc28 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -143,7 +143,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32  
off, u16 *data)


if (ah->eeprom_blob)
ret = ath9k_hw_nvram_read_firmware(ah->eeprom_blob, off, data);
-   else if (pdata && !pdata->use_eeprom && pdata->eeprom_data)
+   else if (pdata && !pdata->use_eeprom)
ret = ath9k_hw_nvram_read_pdata(pdata, off, data);
else
ret = common->bus_ops->eeprom_read(common, off, data);


The patch may very well be valid (didn't check yet) but the commit log
is gibberish for me.



Let me correct that and I'll send the patch again.

Thanks!
--
Gustavo A. R. Silva

Re: [PATCH] wil6210: Replace five seq_puts() calls by seq_putc()

[Eric Dumazet]

On Tue, 2017-05-09 at 09:50 +0200, SF Markus Elfring wrote:
> From: Markus Elfring 
> Date: Mon, 8 May 2017 22:22:04 +0200
> 
> Five single characters (line breaks) should be put into a sequence.
> Thus use the corresponding function "seq_putc".
> 
> This issue was detected by using the Coccinelle software.

There is no _issue_ at all here, only a matter of taste.

printf("\n")  or putchar('\n')  in some slow path is really not that
interesting.

Re: [PATCH] net: wireless: ath: ath9k: remove unnecessary code

[Kalle Valo]

"Gustavo A. R. Silva"  writes:

> Hi Kalle,
>
> Quoting Kalle Valo :
>
>> "Gustavo A. R. Silva"  writes:
>>
>>> The name of an array used by itself will always return the array's address.
>>> So this test will always evaluate as true.
>>>
>>> Addresses-Coverity-ID: 1364903
>>> Signed-off-by: Gustavo A. R. Silva 
>>> ---
>>>  drivers/net/wireless/ath/ath9k/eeprom.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c
>>> b/drivers/net/wireless/ath/ath9k/eeprom.c
>>> index fb80ec8..5c3bc28 100644
>>> --- a/drivers/net/wireless/ath/ath9k/eeprom.c
>>> +++ b/drivers/net/wireless/ath/ath9k/eeprom.c
>>> @@ -143,7 +143,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32
>>> off, u16 *data)
>>>
>>> if (ah->eeprom_blob)
>>> ret = ath9k_hw_nvram_read_firmware(ah->eeprom_blob, off, data);
>>> -   else if (pdata && !pdata->use_eeprom && pdata->eeprom_data)
>>> +   else if (pdata && !pdata->use_eeprom)
>>> ret = ath9k_hw_nvram_read_pdata(pdata, off, data);
>>> else
>>> ret = common->bus_ops->eeprom_read(common, off, data);
>>
>> The patch may very well be valid (didn't check yet) but the commit log
>> is gibberish for me.
>>
>
> Let me correct that and I'll send the patch again.

Thanks.

Also no need to have that long "net: wireless: ath:" prefix, "ath9k: "
or "ath10k: " is enough.

-- 
Kalle Valo

Re: [PATCH] net: wireless: ath: ath10k: remove unnecessary code

[Kalle Valo]

Arend Van Spriel  writes:

> On 9-5-2017 7:33, Kalle Valo wrote:
>> "Gustavo A. R. Silva"  writes:
>> 
>>> The name of an array used by itself will always return the array's address.
>>> So these tests will always evaluate as false and therefore the _return_
>>> will never be executed.
>>>
>>> Signed-off-by: Gustavo A. R. Silva 
>> 
>> I don't understand the commit log, especially what does "The name of an
>> array used by itself" mean?
>
> The array fields in struct wmi_start_scan_arg that are checked here are
> fixed size arrays so they can never be NULL.
>
> Maybe that helps rephrasing this commit message.

Much much better, thanks!

-- 
Kalle Valo

Re: [PATCH] net: wireless: ath: ath10k: remove unnecessary code

[Arend Van Spriel]

On 9-5-2017 7:33, Kalle Valo wrote:
> "Gustavo A. R. Silva"  writes:
> 
>> The name of an array used by itself will always return the array's address.
>> So these tests will always evaluate as false and therefore the _return_
>> will never be executed.
>>
>> Signed-off-by: Gustavo A. R. Silva 
> 
> I don't understand the commit log, especially what does "The name of an
> array used by itself" mean?

The array fields in struct wmi_start_scan_arg that are checked here are
fixed size arrays so they can never be NULL.

Maybe that helps rephrasing this commit message.

Regards,
Arend

Re: [PATCH] net: wireless: ath: ath10k: remove unnecessary code

[Gustavo A. R. Silva]

Hi Kalle,

Quoting Kalle Valo :


"Gustavo A. R. Silva"  writes:


The name of an array used by itself will always return the array's address.
So these tests will always evaluate as false and therefore the _return_
will never be executed.

Signed-off-by: Gustavo A. R. Silva 


I don't understand the commit log, especially what does "The name of an
array used by itself" mean?



Let me correct that and I'll send the patch again.

Thanks!
--
Gustavo A. R. Silva

Re: [PATCH] net: wireless: ath: ath9k: remove unnecessary code

[Kalle Valo]

"Gustavo A. R. Silva"  writes:

> The name of an array used by itself will always return the array's address.
> So this test will always evaluate as true.
>
> Addresses-Coverity-ID: 1364903
> Signed-off-by: Gustavo A. R. Silva 
> ---
>  drivers/net/wireless/ath/ath9k/eeprom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c 
> b/drivers/net/wireless/ath/ath9k/eeprom.c
> index fb80ec8..5c3bc28 100644
> --- a/drivers/net/wireless/ath/ath9k/eeprom.c
> +++ b/drivers/net/wireless/ath/ath9k/eeprom.c
> @@ -143,7 +143,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 
> *data)
>  
>   if (ah->eeprom_blob)
>   ret = ath9k_hw_nvram_read_firmware(ah->eeprom_blob, off, data);
> - else if (pdata && !pdata->use_eeprom && pdata->eeprom_data)
> + else if (pdata && !pdata->use_eeprom)
>   ret = ath9k_hw_nvram_read_pdata(pdata, off, data);
>   else
>   ret = common->bus_ops->eeprom_read(common, off, data);

The patch may very well be valid (didn't check yet) but the commit log
is gibberish for me.

-- 
Kalle Valo

Re: [PATCH] wil6210: Replace five seq_puts() calls by seq_putc()

[Johannes Berg]

On Tue, 2017-05-09 at 09:50 +0200, SF Markus Elfring wrote:
> From: Markus Elfring 
> Date: Mon, 8 May 2017 22:22:04 +0200
> 
> Five single characters (line breaks) should be put into a sequence.
> Thus use the corresponding function "seq_putc".

Please stop, this isn't really an issue worth worrying about.

johannes

[PATCH] wil6210: Replace five seq_puts() calls by seq_putc()

[SF Markus Elfring]

From: Markus Elfring 
Date: Mon, 8 May 2017 22:22:04 +0200

Five single characters (line breaks) should be put into a sequence.
Thus use the corresponding function "seq_putc".

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
---
 drivers/net/wireless/ath/wil6210/debugfs.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c 
b/drivers/net/wireless/ath/wil6210/debugfs.c
index 5648ebbd0e16..90118d286fb9 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -76,11 +76,11 @@ static void wil_print_vring(struct seq_file *s, struct 
wil6210_priv *wil,
volatile struct vring_tx_desc *d = >va[i].tx;
 
if ((i % 128) == 0 && (i != 0))
-   seq_puts(s, "\n");
+   seq_putc(s, '\n');
seq_printf(s, "%c", (d->dma.status & BIT(0)) ?
_s : (vring->ctx[i].skb ? _h : 'h'));
}
-   seq_puts(s, "\n");
+   seq_putc(s, '\n');
}
seq_puts(s, "}\n");
 }
@@ -233,7 +233,7 @@ static void wil_print_ring(struct seq_file *s, const char 
*prefix,
wil_seq_hexdump(s, databuf, len, "  : ");
}
} else {
-   seq_puts(s, "\n");
+   seq_putc(s, '\n');
}
}
  out:
@@ -1366,7 +1366,7 @@ static void wil_print_rxtid_crypto(struct seq_file *s, 
int tid,
seq_printf(s, " [%i%s]%6phN", i, cc->key_set ? "+" : "-",
   cc->pn);
}
-   seq_puts(s, "\n");
+   seq_putc(s, '\n');
 }
 
 static int wil_sta_debugfs_show(struct seq_file *s, void *data)
@@ -1423,7 +1423,7 @@ __acquires(>tid_rx_lock) __releases(>tid_rx_lock)
 mcs++)
seq_printf(s, " %lld",
   p->stats.rx_per_mcs[mcs]);
-   seq_puts(s, "\n");
+   seq_putc(s, '\n');
}
}
 
-- 
2.12.2

[PATCH 3/3] ath9k: Adjust a null pointer check in three functions

[SF Markus Elfring]

From: Markus Elfring 
Date: Mon, 8 May 2017 22:17:13 +0200

The script "checkpatch.pl" pointed information out like the following.

Comparison to NULL could be written "!buf"

Thus adjust this expression.

Signed-off-by: Markus Elfring 
---
 drivers/net/wireless/ath/ath9k/debug.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/debug.c 
b/drivers/net/wireless/ath/ath9k/debug.c
index 0d215598193c..5f2c1d8e8e70 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -161,7 +161,7 @@ static ssize_t read_file_ani(struct file *file, char __user 
*user_buf,
};
 
buf = kzalloc(size, GFP_KERNEL);
-   if (buf == NULL)
+   if (!buf)
return -ENOMEM;
 
len += scnprintf(buf + len, size - len, "%15s: %s\n", "ANI",
@@ -315,7 +315,7 @@ static ssize_t read_file_antenna_diversity(struct file 
*file,
};
 
buf = kzalloc(size, GFP_KERNEL);
-   if (buf == NULL)
+   if (!buf)
return -ENOMEM;
 
if (!(pCap->hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)) {
@@ -1008,7 +1008,7 @@ static ssize_t read_file_btcoex(struct file *file, char 
__user *user_buf,
size_t retval;
 
buf = kzalloc(size, GFP_KERNEL);
-   if (buf == NULL)
+   if (!buf)
return -ENOMEM;
 
if (!sc->sc_ah->common.btcoex_enabled) {
-- 
2.12.2

[PATCH 2/3] ath9k: Replace four seq_printf() calls by seq_putc()

[SF Markus Elfring]

From: Markus Elfring 
Date: Mon, 8 May 2017 22:04:47 +0200

Four single characters (line breaks) should be put into a sequence.
Thus use the corresponding function "seq_putc".

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
---
 drivers/net/wireless/ath/ath9k/debug.c | 10 --
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/debug.c 
b/drivers/net/wireless/ath/ath9k/debug.c
index 981b38a1e352..0d215598193c 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -421,7 +421,7 @@ static int read_file_dma(struct seq_file *file, void *data)
 
for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++) {
if (i % 4 == 0)
-   seq_puts(file, "\n");
+   seq_putc(file, '\n');
 
val[i] = REG_READ_D(ah, AR_DMADBG_0 + (i * sizeof(u32)));
seq_printf(file, "%d: %08x ", i, val[i]);
@@ -702,8 +702,7 @@ static int read_file_misc(struct seq_file *file, void *data)
if (rxfilter & ATH9K_RX_FILTER_CONTROL_WRAPPER)
seq_puts(file, " CONTROL_WRAPPER");
 
-   seq_puts(file, "\n");
-
+   seq_putc(file, '\n');
reg = sc->sc_ah->imask;
 
seq_printf(file, "INTERRUPT-MASK: 0x%x", reg);
@@ -723,8 +722,7 @@ static int read_file_misc(struct seq_file *file, void *data)
if (reg & ATH9K_INT_BB_WATCHDOG)
seq_puts(file, " BB_WATCHDOG");
 
-   seq_puts(file, "\n");
-
+   seq_putc(file, '\n');
i = 0;
ath_for_each_chanctx(sc, ctx) {
if (list_empty(>vifs))
@@ -981,7 +979,7 @@ static int read_file_dump_nfcal(struct seq_file *file, void 
*data)
seq_printf(file, " %d\t %d\t %d\t\t", i, h[i].privNF, nread);
for (j = 0; j < nread; j++)
seq_printf(file, " %d", h[i].nfCalBuffer[j]);
-   seq_puts(file, "\n");
+   seq_putc(file, '\n');
}
 
return 0;
-- 
2.12.2

[PATCH 1/3] ath9k: Reduce function calls for sequence output in read_file_dma()

[SF Markus Elfring]

From: Markus Elfring 
Date: Mon, 8 May 2017 21:55:09 +0200

Some data were put into a sequence by separate function calls.
Print the same data with two function calls less.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
---
 drivers/net/wireless/ath/ath9k/debug.c | 9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/debug.c 
b/drivers/net/wireless/ath/ath9k/debug.c
index 2e64977a8ab6..981b38a1e352 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -427,9 +427,7 @@ static int read_file_dma(struct seq_file *file, void *data)
seq_printf(file, "%d: %08x ", i, val[i]);
}
 
-   seq_puts(file, "\n\n");
-   seq_puts(file, "Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
-
+   seq_puts(file, "\n\nNum QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
for (i = 0; i < ATH9K_NUM_QUEUES; i++, qcuOffset += 4, dcuOffset += 5) {
if (i == 8) {
qcuOffset = 0;
@@ -448,9 +446,8 @@ static int read_file_dma(struct seq_file *file, void *data)
   (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
}
 
-   seq_puts(file, "\n");
-
-   seq_printf(file, "qcu_stitch state:   %2xqcu_fetch state:
%2x\n",
+   seq_printf(file,
+  "\nqcu_stitch state:   %2xqcu_fetch state:%2x\n",
   (val[3] & 0x003c) >> 18, (val[3] & 0x03c0) >> 22);
seq_printf(file, "qcu_complete state: %2xdcu_complete state: 
%2x\n",
   (val[3] & 0x1c00) >> 26, (val[6] & 0x3));
-- 
2.12.2

[PATCH 0/3] ath9k: Fine-tuning for some function implementations

[SF Markus Elfring]

From: Markus Elfring 
Date: Tue, 9 May 2017 09:19:09 +0200

Three update suggestions were taken into account
from static source code analysis.

Markus Elfring (3):
  Reduce function calls for sequence output in read_file_dma()
  Replace four seq_printf() calls by seq_putc()
  Adjust a null pointer check in three functions

 drivers/net/wireless/ath/ath9k/debug.c | 25 ++---
 1 file changed, 10 insertions(+), 15 deletions(-)

-- 
2.12.2

Re: [PATCH] wcn36xx: Close SMD channel on device removal

[Kalle Valo]

Bjorn Andersson  writes:

> The SMD channel is not the primary WCNSS channel and must explicitly be
> closed as the device is removed, or the channel will already by open on
> a subsequent probe call in e.g. the case of reloading the kernel module.
>
> This issue was introduced because I simplified the underlying SMD
> implementation while the SMD adaptions of the driver sat on the mailing
> list, but missed to update these patches. The patch does however only
> apply back to the transition to rpmsg, hence the limited Fixes.
>
> Fixes: 5052de8deff5 ("soc: qcom: smd: Transition client drivers from smd to 
> rpmsg")
> Reported-by: Eyal Ilsar 
> Signed-off-by: Bjorn Andersson 

As this is a regression I'll queue this to 4.12.

But if this is an older bug (didn't quite understand your description
though) should there be a separate patch for stable releases?

-- 
Kalle Valo