Merge Upstream's stable 3.0.21 branch into msm-3.0
This consists 814 commits and some merge conflicts.
The merge conflicts are because of some local changes to
msm-3.0 as well as some conflicts between google's tree and
the upstream tree.
Conflicts:
arch/arm/kernel/head.S
drivers/bluetooth/ath3k.c
drivers/bluetooth/btusb.c
drivers/mmc/core/core.c
drivers/tty/serial/serial_core.c
drivers/usb/host/ehci-hub.c
drivers/usb/serial/qcserial.c
fs/namespace.c
fs/proc/base.c
Change-Id: I62e2edbe213f84915e27f8cd6e4f6ce23db22a21
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
Merge Google's Android tree into msm-3.0
This consists of the following conflicts and 42 commits:
Conflicts:
drivers/mmc/core/bus.c
drivers/rtc/class.c
drivers/usb/gadget/android.c
Most of the conflicts stem from the changes made to the
local msm-3.0 branch.
commit 1f8c5cecfe
Author: Heiko Stuebner <heiko@sntech.de>
Date: Wed Feb 1 10:33:01 2012 -0800
Input: evdev - fix variable initialisation
Commit 509f87c5f564 (evdev - do not block waiting for an event if
fd
is nonblock) created a code path were it was possible to use retval
uninitialized.
This could lead to the xorg evdev input driver getting corrupt data
and refusing to work with log messages like
AUO-Pixcir touchscreen: Read error: Success
sg060_keys: Read error: Success
AUO-Pixcir touchscreen: Read error: Success
sg060_keys: Read error: Success
(for drivers auo-pixcir-ts and gpio-keys).
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
drivers/input/evdev.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit 4dc43d7079
Author: Arve Hjønnevåg <arve@android.com>
Date: Fri Oct 17 15:20:55 2008 -0700
Input: evdev - Add ioctl to block suspend while event queue is not empty.
Add an ioctl, EVIOCSSUSPENDBLOCK, to enable a wakelock that will block
suspend while the event queue is not empty. This allows userspace code to
process input events while the device appears to be asleep.
The current code holds the wakelock for up 5 seconds for every input
device and client. This can prevent suspend if sensor with a high data
rate is active, even when that sensor is not capable of waking the
device once it is suspended.
Change-Id: I624d66ef30a0b3abb543685c343382b8419b42b9
Signed-off-by: Arve Hjønnevåg <arve@android.com>
drivers/input/evdev.c | 53 +++++++++++++++++++++++++++++++++++++++++++-----
include/linux/input.h | 3 ++
2 files changed, 50 insertions(+), 6 deletions(-)
commit 7cc846069a
Author: Arve Hjønnevåg <arve@android.com>
Date: Mon Jan 23 17:15:45 2012 -0800
Input: evdev - Don't hold wakelock when no data is available to user-space
If there is no SYN_REPORT event in the buffer the buffer data is invisible
to user-space. The wakelock should not be held in this case.
Change-Id: Idae890ff0da8eb46a2cfce61a95b3a97252551ad
Signed-off-by: Arve Hjønnevåg <arve@android.com>
drivers/input/evdev.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
commit 0e80804a2e
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Jan 31 11:06:23 2012 -0800
net: wireless: bcmdhd: Increase pm_notify callback priority
Make pm_notify callback to be called the first on suspend/resume path to
ensure it will always be called.
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_linux.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit dfc896e1c8
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Mon Jan 30 15:43:31 2012 -0800
net: wireless: bcmdhd: Fix crash on dhdsdio_probe_attach() failure
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_linux.c | 17 ++++++++++++++---
drivers/net/wireless/bcmdhd/dhd_sdio.c | 8 +++++++-
2 files changed, 21 insertions(+), 4 deletions(-)
commit 256a6b23be
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Mon Jan 30 13:03:19 2012 -0800
net: wireless: bcmdhd: Daemonize wl_event_handler
Daemonizing makes thread (besides other things) NON-FREEZABLE, and it will not
get fake signal on suspend to quicl down_interruptible()
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_linux.c | 13 -------------
drivers/net/wireless/bcmdhd/include/linuxver.h | 12 ++++++++++++
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 3 +++
3 files changed, 15 insertions(+), 13 deletions(-)
commit ff93146589
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Jan 24 13:59:40 2012 -0800
net: wireless: bcmdhd: Update to Version 5.90.195.23
- WFD fixes
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_cfg80211.c | 269 -------------------------
drivers/net/wireless/bcmdhd/dhd_linux.c | 2 +-
drivers/net/wireless/bcmdhd/dhd_sdio.c | 8 +-
drivers/net/wireless/bcmdhd/include/epivers.h | 8 +-
drivers/net/wireless/bcmdhd/siutils.c | 5 +
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 223 +++++++++++++++------
drivers/net/wireless/bcmdhd/wl_cfgp2p.c | 175 ++++++++++++++++-
drivers/net/wireless/bcmdhd/wl_cfgp2p.h | 37 ++--
8 files changed, 368 insertions(+), 359 deletions(-)
commit 96034c2006
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Jan 24 13:55:00 2012 -0800
net: wireless: bcmdhd: Update to Version 5.90.195.22
- Disable Ad-hoc support for cfg80211
- dhd_linux.c: Fix incorrect pid check
- Merge Android changes from Android tree
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/bcmsdh_linux.c | 24 ++------------------
drivers/net/wireless/bcmdhd/bcmsdh_sdmmc_linux.c | 25 +++++++++++++++------
drivers/net/wireless/bcmdhd/dhd_linux.c | 10 ++++----
drivers/net/wireless/bcmdhd/dhd_sdio.c | 11 +++++++--
drivers/net/wireless/bcmdhd/hndpmu.c | 16 ++++++++++++++
drivers/net/wireless/bcmdhd/include/bcmdevs.h | 2 +
drivers/net/wireless/bcmdhd/include/epivers.h | 8 +++---
drivers/net/wireless/bcmdhd/siutils.c | 3 ++
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 11 ++++++++-
9 files changed, 68 insertions(+), 42 deletions(-)
commit 494661a1ac
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Jan 24 13:47:47 2012 -0800
net: wireless: bcmdhd: Update to Version 5.90.195.19
- Add WFD changes
- Add extra locking for internal ioctl operations
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/Makefile | 4 +-
drivers/net/wireless/bcmdhd/bcmsdh_linux.c | 25 +-
drivers/net/wireless/bcmdhd/bcmsdh_sdmmc.c | 4 +-
drivers/net/wireless/bcmdhd/dhd.h | 10 +-
drivers/net/wireless/bcmdhd/dhd_cdc.c | 7 +-
drivers/net/wireless/bcmdhd/dhd_cfg80211.c | 862 ++++++++
drivers/net/wireless/bcmdhd/dhd_cfg80211.h | 42 +
drivers/net/wireless/bcmdhd/dhd_common.c | 7 +-
drivers/net/wireless/bcmdhd/dhd_linux.c | 103 +-
drivers/net/wireless/bcmdhd/dhd_linux_mon.c | 409 ----
drivers/net/wireless/bcmdhd/dhd_sdio.c | 4 +-
drivers/net/wireless/bcmdhd/include/dhdioctl.h | 3 +-
drivers/net/wireless/bcmdhd/include/epivers.h | 8 +-
drivers/net/wireless/bcmdhd/include/proto/802.11.h | 12 +-
drivers/net/wireless/bcmdhd/include/wlioctl.h | 19 +-
drivers/net/wireless/bcmdhd/wl_android.c | 22 +-
drivers/net/wireless/bcmdhd/wl_android.h | 2 +-
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 2142 ++++++--------------
drivers/net/wireless/bcmdhd/wl_cfg80211.h | 125 +-
drivers/net/wireless/bcmdhd/wl_cfgp2p.c | 245 ++-
drivers/net/wireless/bcmdhd/wl_cfgp2p.h | 27 +-
drivers/net/wireless/bcmdhd/wl_linux_mon.c | 409 ++++
drivers/net/wireless/bcmdhd/wldev_common.c | 69 +-
drivers/net/wireless/bcmdhd/wldev_common.h | 20 +-
24 files changed, 2485 insertions(+), 2095 deletions(-)
commit 1dddb0cc0d
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Jan 24 13:37:34 2012 -0800
net: wireless: bcmdhd: Update to Version 5.90.195.15
- Add WFD concurrent mode support
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/bcmevent.c | 8 +-
drivers/net/wireless/bcmdhd/bcmsdh_sdmmc_linux.c | 12 +-
drivers/net/wireless/bcmdhd/bcmutils.c | 4 +-
drivers/net/wireless/bcmdhd/dhd.h | 25 +-
drivers/net/wireless/bcmdhd/dhd_cdc.c | 9 +-
drivers/net/wireless/bcmdhd/dhd_common.c | 4 +-
drivers/net/wireless/bcmdhd/dhd_linux.c | 148 +++--
drivers/net/wireless/bcmdhd/dhd_linux_mon.c | 28 +-
drivers/net/wireless/bcmdhd/dhd_sdio.c | 27 +-
drivers/net/wireless/bcmdhd/dhd_wlfc.h | 12 +-
drivers/net/wireless/bcmdhd/hndpmu.c | 44 +-
drivers/net/wireless/bcmdhd/include/Makefile | 2 +-
drivers/net/wireless/bcmdhd/include/aidmp.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmcdc.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmdefs.h | 37 +-
drivers/net/wireless/bcmdhd/include/bcmdevs.h | 573 +++++++++++++-
drivers/net/wireless/bcmdhd/include/bcmendian.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmpcispi.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmperf.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmsdbus.h | 10 +-
drivers/net/wireless/bcmdhd/include/bcmsdh.h | 10 +-
drivers/net/wireless/bcmdhd/include/bcmsdh_sdmmc.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmsdpcm.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmsdspi.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmsdstd.h | 34 +-
drivers/net/wireless/bcmdhd/include/bcmspi.h | 2 +-
drivers/net/wireless/bcmdhd/include/bcmutils.h | 14 +-
drivers/net/wireless/bcmdhd/include/bcmwifi.h | 2 +-
drivers/net/wireless/bcmdhd/include/dhdioctl.h | 2 +-
drivers/net/wireless/bcmdhd/include/epivers.h | 14 +-
drivers/net/wireless/bcmdhd/include/hndpmu.h | 2 +-
.../net/wireless/bcmdhd/include/hndrte_armtrap.h | 2 +-
drivers/net/wireless/bcmdhd/include/hndrte_cons.h | 2 +-
drivers/net/wireless/bcmdhd/include/hndsoc.h | 2 +-
drivers/net/wireless/bcmdhd/include/htsf.h | 2 +-
drivers/net/wireless/bcmdhd/include/linux_osl.h | 2 +-
drivers/net/wireless/bcmdhd/include/linuxver.h | 6 +-
drivers/net/wireless/bcmdhd/include/miniopt.h | 2 +-
drivers/net/wireless/bcmdhd/include/msgtrace.h | 2 +-
drivers/net/wireless/bcmdhd/include/osl.h | 2 +-
.../wireless/bcmdhd/include/packed_section_end.h | 2 +-
.../wireless/bcmdhd/include/packed_section_start.h | 2 +-
drivers/net/wireless/bcmdhd/include/pcicfg.h | 28 +-
drivers/net/wireless/bcmdhd/include/proto/802.11.h | 317 +++++++-
.../net/wireless/bcmdhd/include/proto/802.11_bta.h | 2 +-
.../net/wireless/bcmdhd/include/proto/802.11e.h | 2 +-
drivers/net/wireless/bcmdhd/include/proto/802.1d.h | 2 +-
drivers/net/wireless/bcmdhd/include/proto/bcmeth.h | 2 +-
.../net/wireless/bcmdhd/include/proto/bcmevent.h | 9 +-
drivers/net/wireless/bcmdhd/include/proto/bcmip.h | 2 +-
.../net/wireless/bcmdhd/include/proto/bt_amp_hci.h | 2 +-
drivers/net/wireless/bcmdhd/include/proto/eapol.h | 2 +-
.../net/wireless/bcmdhd/include/proto/ethernet.h | 3 +-
drivers/net/wireless/bcmdhd/include/proto/p2p.h | 2 +-
drivers/net/wireless/bcmdhd/include/proto/sdspi.h | 2 +-
drivers/net/wireless/bcmdhd/include/proto/vlan.h | 2 +-
drivers/net/wireless/bcmdhd/include/proto/wpa.h | 12 +-
drivers/net/wireless/bcmdhd/include/sbchipc.h | 168 ++++-
drivers/net/wireless/bcmdhd/include/sbconfig.h | 2 +-
drivers/net/wireless/bcmdhd/include/sbhnddma.h | 6 +-
drivers/net/wireless/bcmdhd/include/sbpcmcia.h | 2 +-
drivers/net/wireless/bcmdhd/include/sbsdio.h | 2 +-
drivers/net/wireless/bcmdhd/include/sbsdpcmdev.h | 2 +-
drivers/net/wireless/bcmdhd/include/sbsocram.h | 2 +-
drivers/net/wireless/bcmdhd/include/sdio.h | 5 +-
drivers/net/wireless/bcmdhd/include/sdioh.h | 32 +-
drivers/net/wireless/bcmdhd/include/sdiovar.h | 2 +-
drivers/net/wireless/bcmdhd/include/siutils.h | 30 +-
drivers/net/wireless/bcmdhd/include/trxhdr.h | 3 +-
drivers/net/wireless/bcmdhd/include/typedefs.h | 5 +-
drivers/net/wireless/bcmdhd/include/wlfc_proto.h | 2 +-
drivers/net/wireless/bcmdhd/include/wlioctl.h | 87 ++-
drivers/net/wireless/bcmdhd/linux_osl.c | 23 +-
drivers/net/wireless/bcmdhd/siutils.c | 195 +++++-
drivers/net/wireless/bcmdhd/wl_android.c | 6 +-
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 875 ++++++++++++--------
drivers/net/wireless/bcmdhd/wl_cfg80211.h | 282 +++++---
drivers/net/wireless/bcmdhd/wl_cfgp2p.c | 165 ++++-
drivers/net/wireless/bcmdhd/wl_cfgp2p.h | 12 +-
drivers/net/wireless/bcmdhd/wl_iw.c | 110 +++-
drivers/net/wireless/bcmdhd/wl_iw.h | 17 +-
81 files changed, 2737 insertions(+), 752 deletions(-)
commit 52bdb6f543
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Mon Jan 23 12:47:21 2012 -0800
net: wireless: bcmdhd: Add WIPHY_FLAG_SUPPORTS_FW_ROAM flag
Adding this flag will allow NL80211_ATTR_ROAM_SUPPORT, and will set
WPA_DRIVER_FLAGS_BSS_SELECTION flag in wpa_supplicant
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
commit b1a94205e9
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Fri Jan 20 14:15:05 2012 -0800
net: wireless: bcmdhd: Fake PNO event to wake up the wpa_supplicant
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_linux.c | 4 +++-
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 20 ++++++++++++++++----
2 files changed, 19 insertions(+), 5 deletions(-)
commit 09701e3edf
Author: Scott Anderson <saa@google.com>
Date: Wed Jan 18 15:56:51 2012 -0800
usb: gadget: android: Honor CONFIG_USB_GADGET_VBUS_DRAW
The maximum current draw was hard coded to 500 mA. composite.c
has code that uses CONFIG_USB_GADGET_VBUS_DRAW to set the
bMaxPower and to set whether or not the device is self-powered if
they haven't been set. This change removes the code in android.c
to allow composite.c to set them.
Change-Id: I9db37922e91ee86e9e5c0e14519e119e5c41ca48
Signed-off-by: Scott Anderson <saa@google.com>
drivers/usb/gadget/android.c | 3 ---
1 files changed, 0 insertions(+), 3 deletions(-)
commit a6ccb73389
Author: Benoit Goby <benoit@android.com>
Date: Fri Jan 20 14:42:41 2012 -0800
usb: gadget: Fix usb string id allocation
Don't reset next_string_id every time the gadget is enabled, this makes
the next strings allocated overwrite strings allocated at probe time.
Instead, fix rndis not to allocate new string ids on every config bind.
Change-Id: Ied28ee416bb6f00c434c34176fe5b7f0dcb2b2d4
Signed-off-by: Benoit Goby <benoit@android.com>
drivers/usb/gadget/android.c | 1 -
drivers/usb/gadget/f_rndis.c | 12 +++++-------
drivers/usb/gadget/rndis.c | 11 +++++++++++
3 files changed, 16 insertions(+), 8 deletions(-)
commit 87159de9c3
Author: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Thu Aug 11 11:46:22 2011 +0300
nl80211/cfg80211: Make addition of new sinfo fields safer
Add a comment pointing out the use of enum station_info_flags for
all new struct station_info fields. In addition, memset the sinfo
buffer to zero before use on all paths in the current tree to avoid
leaving uninitialized pointers in the data.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
include/net/cfg80211.h | 5 +++++
net/mac80211/sta_info.c | 1 +
net/wireless/nl80211.c | 1 +
3 files changed, 7 insertions(+), 0 deletions(-)
commit d692df224b
Author: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Mon Aug 8 12:11:52 2011 +0300
cfg80211/nl80211: Send AssocReq IEs to user space in AP mode
When user space SME/MLME (e.g., hostapd) is not used in AP mode, the
IEs from the (Re)Association Request frame that was processed in
firmware need to be made available for user space (e.g., RSN IE for
hostapd). Allow this to be done with cfg80211_new_sta().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
include/net/cfg80211.h | 8 ++++++++
net/wireless/nl80211.c | 4 ++++
2 files changed, 12 insertions(+), 0 deletions(-)
commit d1e94136fc
Author: Dima Zavin <dima@android.com>
Date: Mon Jan 23 10:39:02 2012 -0800
misc: remove android pmem driver, it's obsolete.
Change-Id: I48d9778007e1e9eed2bb34e33ceee818c23afaa5
Signed-off-by: Dima Zavin <dima@android.com>
drivers/misc/Kconfig | 4 -
drivers/misc/Makefile | 1 -
drivers/misc/pmem.c | 1345 ------------------------------------------
include/linux/android_pmem.h | 93 ---
4 files changed, 0 insertions(+), 1443 deletions(-)
commit dac306d896
Author: Dima Zavin <dima@android.com>
Date: Thu Jan 19 09:51:07 2012 -0800
Revert "proc: enable writing to /proc/pid/mem"
This reverts commit 198214a7ee.
fs/proc/base.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
commit a65e28a014
Author: Dima Zavin <dima@android.com>
Date: Thu Jan 12 15:55:25 2012 -0800
ram_console: set CON_ANYTIME console flag
We want to ensure that we get all the console messages, even ones
that occur while the printing CPU is not yet online.
Change-Id: I1d2694d05ac9415669a92f38efdd8e71c927705b
Signed-off-by: Dima Zavin <dima@android.com>
drivers/staging/android/ram_console.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit f16e6fb3e3
Author: Benoit Goby <benoit@android.com>
Date: Thu Dec 15 18:40:37 2011 -0800
Revert "usb: gadget: rndis: don't use dev_get_stats"
This reverts commit ffdab0c0c4.
Not needed anymore in 2.6.39 and 3.0, dev_get_stats has been fixed
and may be called from atomic context. See:
1ac9ad1 net: remove dev_txq_stats_fold()
drivers/usb/gadget/rndis.c | 23 ++---------------------
1 files changed, 2 insertions(+), 21 deletions(-)
commit e1493f1544
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Mon Dec 19 10:24:09 2011 -0800
net: wireless: bcmdhd: Enable wlan access on resume for all sdio functions
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/bcmsdh_sdmmc_linux.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)
commit bbd08c6e95
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Fri Dec 16 12:54:51 2011 -0800
net: wireless: bcmdhd: Fix P2P interface removal
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_linux.c | 3 ++
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 43 ++++++++++++++++++++++-------
drivers/net/wireless/bcmdhd/wl_cfg80211.h | 9 ++++--
3 files changed, 42 insertions(+), 13 deletions(-)
commit 37ff4411a5
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Thu Dec 15 12:12:20 2011 -0800
net: wireless: bcm4329: Fix pno_enable if disassociated
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcm4329/dhd_common.c | 43 ++++++++++++++++++++++++-----
1 files changed, 36 insertions(+), 7 deletions(-)
commit 599c8566fa
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Dec 13 17:39:48 2011 -0800
net: wireless: bcmdhd: Fix proper scan command even if request is NULL
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 16 ++++++++++------
1 files changed, 10 insertions(+), 6 deletions(-)
commit f227b88c89
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Dec 13 12:27:49 2011 -0800
net: wireless: bcmdhd: Decrease event wake_lock timeout to 1500 ms
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd.h | 4 ++--
drivers/net/wireless/bcmdhd/dhd_linux.c | 8 ++++----
drivers/net/wireless/bcmdhd/wl_iw.c | 2 +-
3 files changed, 7 insertions(+), 7 deletions(-)
commit ed3f356087
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Mon Dec 12 15:40:33 2011 -0800
net: wireless: bcmdhd: Fix getting arp_hostip table
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_common.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit c561cedf2b
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Tue Dec 6 16:27:37 2011 -0800
net: wireless: bcmdhd: Allow to push more packets to FW for Tx
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_sdio.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit 4f36cb88d6
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Fri Dec 2 13:24:01 2011 -0800
net: wireless: bcmdhd: Fix scan crash in ibss mode
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit af16732d4c
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Fri Dec 2 13:10:47 2011 -0800
net: wireless: bcmdhd: Add FW reloading in case of FW hang
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_linux.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
commit 7caeacd6ed
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Wed Nov 30 12:49:02 2011 -0800
net: wireless: bcmdhd: Update to Version 5.90.125.94.1
- Return zeroed private command buffer
- Fix memory leak in wl_inform_single_bss()
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/dhd_common.c | 5 +++--
drivers/net/wireless/bcmdhd/dhd_linux_mon.c | 10 ++++++----
drivers/net/wireless/bcmdhd/include/epivers.h | 2 +-
drivers/net/wireless/bcmdhd/wl_android.c | 9 ++++++---
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 9 ++++++---
5 files changed, 22 insertions(+), 13 deletions(-)
commit 8d71d882e7
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Fri Nov 11 16:04:12 2011 -0800
net: wireless: bcmdhd: Use CONFIG_DHD_USE_STATIC_BUF for preallocated memory
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/net/wireless/bcmdhd/Kconfig | 7 +++
drivers/net/wireless/bcmdhd/bcmsdh_sdmmc.c | 16 ++++----
drivers/net/wireless/bcmdhd/dhd.h | 4 +-
drivers/net/wireless/bcmdhd/dhd_cdc.c | 4 +-
drivers/net/wireless/bcmdhd/dhd_linux.c | 4 +-
drivers/net/wireless/bcmdhd/dhd_sdio.c | 4 +-
drivers/net/wireless/bcmdhd/include/linux_osl.h | 2 +-
drivers/net/wireless/bcmdhd/linux_osl.c | 52 +++++++++++++----------
drivers/net/wireless/bcmdhd/wl_android.c | 7 ++-
9 files changed, 57 insertions(+), 43 deletions(-)
commit 35047200c4
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Mon Dec 19 12:32:21 2011 -0800
wireless: Protect regdomain change by mutex
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
net/wireless/reg.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
commit ea693bf7f8
Author: Dmitry Shmidt <dimitrysh@google.com>
Date: Fri Dec 16 17:52:18 2011 -0800
mmc: Set suspend/resume bus operations if CONFIG_PM_RUNTIME is used
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
drivers/mmc/core/bus.c | 24 +++++++-----------------
1 files changed, 7 insertions(+), 17 deletions(-)
commit dc1b634039
Author: Benoit Goby <benoit@android.com>
Date: Fri Dec 9 18:05:00 2011 -0800
usb: gadget: android: Don't allow changing the functions list if enabled
Change-Id: I3ad39b420ce79a8602a7eca1daac1f56b30bad5c
Signed-off-by: Benoit Goby <benoit@android.com>
drivers/usb/gadget/android.c | 28 ++++++++++++++++++++++++----
1 files changed, 24 insertions(+), 4 deletions(-)
commit e0de0a507d
Author: Benoit Goby <benoit@android.com>
Date: Tue Nov 29 13:49:27 2011 -0800
usb: gadget: android: Cancel pending ctrlrequest before disabling
Make sure there is no pending ctrlrequest before removing the config.
Otherwise the ctrlrequest complete callback could access structures
after they have been freed. Unbind cancels pending transfers but not
ep0 requests.
Bug: 5513065 5440193
Change-Id: I063c22bf5d104a3d2df71cf622409459fac5f27a
Signed-off-by: Benoit Goby <benoit@android.com>
drivers/usb/gadget/android.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
commit b86fd0b622
Author: Colin Cross <ccross@android.com>
Date: Tue Nov 29 16:37:07 2011 -0800
ARM: idle: call idle notifiers before stopping nohz tick
If an idle notifier modifies a timer, calling the notifier after
the sched tick has been stopped may leave the sched tick set too
early. Move teh idle notifier call before the call to
tick_nohz_stop_sched_tick.
Change-Id: I0db3284bec6d0193bc5e2a57650ab06bd8342319
Signed-off-by: Colin Cross <ccross@android.com>
arch/arm/kernel/process.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit 6a4a38525d
Author: Benoit Goby <benoit@android.com>
Date: Mon Nov 28 18:01:03 2011 -0800
usb: gadget: android: Reset next_string_id before enable
Reset next_string_id to 0 before enabling the gadget driver. Otherwise,
after a large number of enable/disable cycles, bind will fail
because we cannot allocate new string ids. String ids cannot be larger
than 254 per USB spec.
Change-Id: I44f5fece45008b7a0a18c025d4eb5ce842585c28
Signed-off-by: Benoit Goby <benoit@android.com>
drivers/usb/gadget/android.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
commit dbb18fb2c1
Author: hyungseoung.yoo <hyungseoung.yoo@samsung.com>
Date: Fri Nov 18 13:57:01 2011 +0900
Bluetooth: Keep master role when SCO or eSCO is active
This improves compatbility with a lot of headset / chipset
combinations. Ideally this should not be needed.
Change-Id: I8b676701e12e416aa7d60801b9d353b15d102709
Signed-off-by: hyungseoung.yoo <hyungseoung.yoo@samsung.com>
Signed-off-by: Jaikumar Ganesh <jaikumarg@android.com>
net/bluetooth/hci_event.c | 12 +++++++++++-
1 files changed, 11 insertions(+), 1 deletions(-)
commit 9d187300df
Author: Arve Hjønnevåg <arve@android.com>
Date: Tue Nov 22 14:56:50 2011 -0800
rtc: Fix some bugs that allowed accumulating time drift in suspend/resume
The current code checks if abs(delta_delta.tv_sec) is greater or
equal to two before it discards the old delta value, but this can
trigger at close to -1 seconds since -1.000000001 seconds is stored
as tv_sec -2 and tv_nsec 999999999 in a normalized timespec.
rtc_resume had an early return check if the rtc value had not changed
since rtc_suspend. This effectivly stops time for the duration of the
short sleep. Check if sleep_time is positive after all the adjustments
have been applied instead since this allows the old_system adjustment
in rtc_suspend to have an effect even for short sleep cycles.
Change-Id: I00b45c0349ec91a4bab9b41a126b377515427898
Signed-off-by: Arve Hjønnevåg <arve@android.com>
drivers/rtc/class.c | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)
commit 452d440ab2
Author: Arve Hjønnevåg <arve@android.com>
Date: Tue Nov 22 15:28:27 2011 -0800
Fix "time: Catch invalid timespec sleep values in __timekeeping_inject_sleeptime" to compile on 3.0
Change-Id: I1225f279cda04dedbfb7f853f6b58f1032bd6d2b
kernel/time/timekeeping.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
commit cf70c6a400
Author: John Stultz <john.stultz@linaro.org>
Date: Wed Jun 1 18:18:09 2011 -0700
time: Catch invalid timespec sleep values in __timekeeping_inject_sleeptime
Arve suggested making sure we catch possible negative sleep time
intervals that could be passed into timekeeping_inject_sleeptime.
CC: Arve Hjønnevåg <arve@android.com>
CC: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <john.stultz@linaro.org>
kernel/time/timekeeping.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
commit 340ede3671
Author: John Stultz <john.stultz@linaro.org>
Date: Fri May 27 11:33:18 2011 -0700
rtc: Avoid accumulating time drift in suspend/resume
Because the RTC interface is only a second granular interface,
each time we read from the RTC for suspend/resume, we introduce a
half second (on average) of error.
In order to avoid this error accumulating as the system is suspended
over and over, this patch measures the time delta between the RTC
and the system CLOCK_REALTIME.
If the delta is less then 2 seconds from the last suspend, we compensate
by using the previous time delta (keeping it close). If it is larger
then 2 seconds, we assume the clock was set or has been changed, so we
do no correction and update the delta.
Note: If NTP is running, ths could seem to "fight" with the NTP corrected
time, where as if the system time was off by 1 second, and NTP slewed the
value in, a suspend/resume cycle could undo this correction, by trying to
restore the previous offset from the RTC. However, without this patch,
since each read could cause almost a full second worth of error, its
possible to get almost 2 seconds of error just from the suspend/resume
cycle alone, so this about equal to any offset added by the compensation.
Further on systems that suspend/resume frequently, this should keep time
closer then NTP could compensate for if the errors were allowed to
accumulate.
Credits to Arve Hjønnevåg for suggesting this solution.
This patch also improves some of the variable names and adds more clear
comments.
CC: Arve Hjønnevåg <arve@android.com>
CC: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <john.stultz@linaro.org>
drivers/rtc/class.c | 65 +++++++++++++++++++++++++++++++++++++-------------
1 files changed, 48 insertions(+), 17 deletions(-)
Change-Id: I16f522e7ee2b301cbdaea62d52d50d7249f565c2
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
WiFi Drivers can advertize the number of bands dynamically.
A check has been added to see if the band information is
present and only then the values are extracted.
Without this check, a kernel crash shall occur as we would
extract the band information though the driver does not
advertize.
Change-Id: Ia726a692a3c2dcef2fcff0a59363053524c5f806
Signed-off-by: Sunil Dutt Undekari<duttus@codeaurora.org>
Provision to distinguish the P2P scan and the normal scan
with no_cck flag and thus disable the 11b rates for
p2p scan.
Change-Id: Ia4073a5f926c6ac97dffdee99f54ba53535fea85
Signed-off-by: Sunil Dutt Undekari<duttus@codeaurora.org>
Add a comment pointing out the use of enum station_info_flags for
all new struct station_info fields. In addition, memset the sinfo
buffer to zero before use on all paths in the current tree to avoid
leaving uninitialized pointers in the data.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
When user space SME/MLME (e.g., hostapd) is not used in AP mode, the
IEs from the (Re)Association Request frame that was processed in
firmware need to be made available for user space (e.g., RSN IE for
hostapd). Allow this to be done with cfg80211_new_sta().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Instead of using a hardcoded list of cipher suites in nl80211.c, use a
shared function in util.c to verify that the driver advertises support
for the specified cipher. This provides more accurate validation of the
values and allows vendor-specific cipher suites to be added in drivers.
Change-Id: I649a1e896cadc1045701a8d5f93a83a7214fcda0
Acked-by: Jim Zmuda <jzmuda@qca.qualcomm.com>
Signed-off-by: Jack Cheung <jackc@codeaurora.org>
NL80211_ATTR_AKM_SUITES can be used to configure new AKMs, like FT or
the SHA-256 -based AKMs or FT from 802.11r/802.11w. In addition, vendor
specific AKMs could be used. The current validation code for the connect
command prevents cfg80211-based drivers from using these mechanisms even
if the driver would not actually use this AKM value (i.e., it uses
WPA/RSN IE from user space). mac80211-based drivers allow any AKM to be
used since this value is not used there.
Remove the unnecessary validation step in cfg80211 to allow drivers to
decide what AKMs are supported. In theory, we could handle this by
advertising supported AKMs, but that would not be very effective unless
we enforce all drivers (including mac80211) to advertise the set of
supported AKMs. This would require additional changes in many places
whenever a new AKM is introduced even though no actually functionality
changes may be required in most drivers.
Change-Id: Ia75b2f236b1b016c0f62dc96b03511f5f4d0cf28
Acked-by: Jim Zmuda <jzmuda@qca.qualcomm.com>
Signed-off-by: Jack Cheung <jackc@codeaurora.org>
This removes need from drivers to parse the beacon tail/head data
to figure out what crypto settings are to be used in AP mode in case
the Beacon and Probe Response frames are fully constructed in the
driver/firmware.
nl80211/cfg80211: Allow SSID to be specified in new beacon command
This makes it easier for drivers that generate Beacon and Probe Response
frames internally (in firmware most likely) in AP mode.
nl80211/cfg80211: Add extra IE configuration to AP mode setup
The NL80211_CMD_NEW_BEACON command is, in practice, requesting AP mode
operations to be started. Add new attributes to provide extra IEs
(e.g., WPS IE, P2P IE) for drivers that build Beacon, Probe Response,
and (Re)Association Response frames internally (likely in firmware).
Change-Id: Ib91cd3fa2bad68e3724db98985e3f3bac72715f0
Signed-off-by: Deepthi Gowri <deepthi@codeaurora.org>
When user space SME/MLME (e.g., hostapd) is not used in AP mode, the
IEs from the (Re)Association Request frame that was processed in
firmware need to be made available for user space (e.g., RSN IE for
hostapd). Allow this to be done with cfg80211_new_sta().
Add a comment pointing out the use of enum station_info_flags for
all new struct station_info fields. In addition, memset the sinfo
buffer to zero before use on all paths in the current tree to avoid
leaving uninitialized pointers in the data.
Change-Id: Ia2220d58ee81c1b7ca905cfc8eb55b6a84779d38
Signed-off-by: Deepthi Gowri <deepthi@codeaurora.org>
commit 0bac71af6e66dc798bf07d0c0dd14ee5503362f9 upstream.
Johannes' patch for "cfg80211: fix regulatory NULL dereference"
broke user regulaotry hints and it did not address the fact that
last_request was left populated even if the previous regulatory
hint was stale due to the wiphy disappearing.
Fix user reguluatory hints by only bailing out if for those
regulatory hints where a request_wiphy is expected. The stale last_request
considerations are addressed through the previous fixes on last_request
where we reset the last_request to a static world regdom request upon
reset_regdomains(). In this case though we further enhance the effect
by simply restoring reguluatory settings completely.
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit a042994dd377d86bff9446ee76151ceb6267c9ba upstream.
There is a theoretical race that if hit will trigger
a crash. The race is between when we issue the first
regulatory hint, regulatory_hint_core(), gets processed
by the workqueue and between when the first device
gets registered to the wireless core. This is not easy
to reproduce but it was easy to do so through the
regulatory simulator I have been working on. This
is a port of the fix I implemented there [1].
[1] a246ccf81f
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit de3584bd62d87b4c250129fbc46ca52c80330add upstream.
By the time userspace returns with a response to
the regulatory domain request, the wiphy causing
the request might have gone away. If this is so,
reject the update but mark the request as having
been processed anyway.
Cc: Luis R. Rodriguez <lrodriguez@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit e007b857e88097c96c45620bf3b04a4e309053d1 upstream.
MAC addresses have a fixed length. The current
policy allows passing < ETH_ALEN bytes, which
might result in reading beyond the buffer.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 58ebacc66bd11be2327edcefc79de94bd6f5bb4a upstream.
Commit 4d9d88d1 by Scott James Remnant <keybuk@google.com> added
the .uevent() callback for the regulatory device used during
the platform device registration. The change was done to account
for queuing up udev change requests through udevadm triggers.
The change also meant that upon regulatory core exit we will now
send a uevent() but the uevent() callback, reg_device_uevent(),
also accessed last_request. Right before commiting device suicide
we free'd last_request but never set it to NULL so
platform_device_unregister() would lead to bogus kernel paging
request. Fix this and also simply supress uevents right before
we commit suicide as they are pointless.
This fix is required for kernels >= v2.6.39
$ git describe --contains 4d9d88d1
v2.6.39-rc1~468^2~25^2^2~21
The impact of not having this present is that a bogus paging
access may occur (only read) upon cfg80211 unload time. You
may also get this BUG complaint below. Although Johannes
could not reproduce the issue this fix is theoretically correct.
mac80211_hwsim: unregister radios
mac80211_hwsim: closing netlink
BUG: unable to handle kernel paging request at ffff88001a06b5ab
IP: [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
PGD 1836063 PUD 183a063 PMD 1ffcb067 PTE 1a06b160
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
CPU 0
Modules linked in: cfg80211(-) [last unloaded: mac80211]
Pid: 2279, comm: rmmod Tainted: G W 3.1.0-wl+ #663 Bochs Bochs
RIP: 0010:[<ffffffffa030df9a>] [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
RSP: 0000:ffff88001c5f9d58 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88001d2eda88 RCX: ffff88001c7468fc
RDX: ffff88001a06b5a0 RSI: ffff88001c7467b0 RDI: ffff88001c7467b0
RBP: ffff88001c5f9d58 R08: 000000000000ffff R09: 000000000000ffff
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88001c7467b0
R13: ffff88001d2eda78 R14: ffffffff8164a840 R15: 0000000000000001
FS: 00007f8a91d8a6e0(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff88001a06b5ab CR3: 000000001c62e000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process rmmod (pid: 2279, threadinfo ffff88001c5f8000, task ffff88000023c780)
Stack:
ffff88001c5f9d98 ffffffff812ff7e5 ffffffff8176ab3d ffff88001c7468c2
000000000000ffff ffff88001d2eda88 ffff88001c7467b0 ffff880000114820
ffff88001c5f9e38 ffffffff81241dc7 ffff88001c5f9db8 ffffffff81040189
Call Trace:
[<ffffffff812ff7e5>] dev_uevent+0xc5/0x170
[<ffffffff81241dc7>] kobject_uevent_env+0x1f7/0x490
[<ffffffff81040189>] ? sub_preempt_count+0x29/0x60
[<ffffffff814cab1a>] ? _raw_spin_unlock_irqrestore+0x4a/0x90
[<ffffffff81305307>] ? devres_release_all+0x27/0x60
[<ffffffff8124206b>] kobject_uevent+0xb/0x10
[<ffffffff812fee27>] device_del+0x157/0x1b0
[<ffffffff8130377d>] platform_device_del+0x1d/0x90
[<ffffffff81303b76>] platform_device_unregister+0x16/0x30
[<ffffffffa030fffd>] regulatory_exit+0x5d/0x180 [cfg80211]
[<ffffffffa032bec3>] cfg80211_exit+0x2b/0x45 [cfg80211]
[<ffffffff8109a84c>] sys_delete_module+0x16c/0x220
[<ffffffff8108a23e>] ? trace_hardirqs_on_caller+0x7e/0x120
[<ffffffff814cba02>] system_call_fastpath+0x16/0x1b
Code: <all your base are belong to me>
RIP [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
RSP <ffff88001c5f9d58>
CR2: ffff88001a06b5ab
---[ end trace 147c5099a411e8c0 ]---
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Cc: Scott James Remnant <keybuk@google.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 6c7394197af90f6a332180e33f5d025d3037d883 upstream.
Since the NL80211_ATTR_HT_CAPABILITY attribute is
used as a struct, it needs a minimum, not maximum
length. Enforce that properly. Not doing so could
potentially lead to reading after the buffer.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 1b9ca0272ffae212e726380f66777b30a56ed7a5 upstream.
Incorrect variable was used in validating the akm_suites array from
NL80211_ATTR_AKM_SUITES. In addition, there was no explicit
validation of the array length (we only have room for
NL80211_MAX_NR_AKM_SUITES).
This can result in a buffer write overflow for stack variables with
arbitrary data from user space. The nl80211 commands using the affected
functionality require GENL_ADMIN_PERM, so this is only exposed to admin
users.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit aa3d7eef398dd4f29045e9889b817d5161afe03e upstream.
During the association, the regulatory is updated by country IE
that reaps the previously found beacons. The impact is that
after a STA disconnects *or* when for any reason a regulatory
domain change happens the beacon hint flag is not cleared
therefore preventing future beacon hints to be learned.
This is important as a regulatory domain change or a restore
of regulatory settings would set back the passive scan and no-ibss
flags on the channel. This is the right place to do this given that
it covers any regulatory domain change.
Reviewed-by: Luis R. Rodriguez <mcgrof@gmail.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Acked-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit a203c2aa4cefccb879c879b8e1cad1a09a679e55 upstream.
At the beginning of wiphy_update_regulatory() a check is performed
whether the request is to be ignored. Then the request is sent to
the driver nevertheless. This happens even if last_request points
to NULL, leading to a crash in the driver:
[<bf01d864>] (lbs_set_11d_domain_info+0x28/0x1e4 [libertas]) from [<c03b714c>] (wiphy_update_regulatory+0x4d0/0x4f4)
[<c03b714c>] (wiphy_update_regulatory+0x4d0/0x4f4) from [<c03b4008>] (wiphy_register+0x354/0x420)
[<c03b4008>] (wiphy_register+0x354/0x420) from [<bf01b17c>] (lbs_cfg_register+0x80/0x164 [libertas])
[<bf01b17c>] (lbs_cfg_register+0x80/0x164 [libertas]) from [<bf020e64>] (lbs_start_card+0x20/0x88 [libertas])
[<bf020e64>] (lbs_start_card+0x20/0x88 [libertas]) from [<bf02cbd8>] (if_sdio_probe+0x898/0x9c0 [libertas_sdio])
Fix this by returning early. Also remove the out: label as it is
not any longer needed.
Signed-off-by: Sven Neumann <s.neumann@raumfeld.com>
Cc: linux-wireless@vger.kernel.org
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Daniel Mack <daniel@zonque.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
There was a deadlock when rfkill-blocking a wireless interface,
because we were locking the rdev mutex on NETDEV_GOING_DOWN to stop
sched_scans that were eventually running. The rfkill block code was
already holding a mutex under rdev:
kernel: =======================================================
kernel: [ INFO: possible circular locking dependency detected ]
kernel: 3.0.0-rc1-00049-g1fa7b6a #57
kernel: -------------------------------------------------------
kernel: kworker/0:1/4525 is trying to acquire lock:
kernel: (&rdev->mtx){+.+.+.}, at: [<ffffffff8164c831>] cfg80211_netdev_notifier_call+0x131/0x5b0
kernel:
kernel: but task is already holding lock:
kernel: (&rdev->devlist_mtx){+.+.+.}, at: [<ffffffff8164dcef>] cfg80211_rfkill_set_block+0x4f/0xa0
kernel:
kernel: which lock already depends on the new lock.
To fix this, add a new mutex specifically for sched_scan, to protect
the sched_scan_req element in the rdev struct, instead of using the
global rdev mutex.
Reported-by: Duane Griffin <duaneg@dghda.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sometimes when reporting a MIC failure rx->key may be unset. This
code path is hit when receiving a packet meant for a multicast
address, and decryption is performed in HW.
Fortunately, the failing key_idx is not used for anything up to
(and including) usermode, so we allow ourselves to drop it on the
way up when a key cannot be retrieved.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
When one of the SSID's length passed in a scan or sched_scan request
is larger than 255, there will be an overflow in the u8 that is used
to store the length before checking. This causes the check to fail
and we overrun the buffer when copying the SSID.
Fix this by checking the nl80211 attribute length before copying it to
the struct.
This is a follow up for the previous commit
208c72f4fe, which didn't fix the problem
entirely.
Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Commit 0a35d36 ("cfg80211: Use capability info to detect mesh beacons")
assumed that probe response with both ESS and IBSS bits cleared
means that the frame was sent by a mesh sta.
However, these capabilities are also being used in the p2p_find phase,
and the mesh-validation broke it.
Rename the WLAN_CAPABILITY_IS_MBSS macro, and verify that mesh ies
exist before assuming this frame was sent by a mesh sta.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
In both trigger_scan and sched_scan operations, we were checking for
the SSID length before assigning the value correctly. Since the
memory was just kzalloc'ed, the check was always failing and SSID with
over 32 characters were allowed to go through.
This was causing a buffer overflow when copying the actual SSID to the
proper place.
This bug has been there since 2.6.29-rc4.
Cc: stable@kernel.org
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Some stack variables (name *ssid and *channel) are only used to define
the size of the memory block that needs to be allocated for the
request structure in the nl80211_trigger_scan() and
nl80211_start_sched_scan() functions.
This is unnecessary because the sizes of the actual elements in the
structure can be used instead.
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
cfg80211 scan code adds separate BSS entries if the same BSS shows up
on multiple channels. However, sme implementation does not use the
frequency when fetching the BSS entry. Fix this by adding channel
information to cfg80211_roamed() and include it in cfg80211_get_bss()
calls.
Please note that drivers using cfg80211_roamed() need to be modified to
fully implement this fix. This commit includes only minimal changes to
avoid compilation issues; it maintains the old (broken) behavior for
most drivers. ath6kl was the only one that I could test, so I updated
it to provide the operating frequency in the roamed event.
Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Currently the devices that have already stripped IEEE 802.11
header from the AMSDU SKB can not use ieee80211_amsdu_to_8023s
routine. This patch enhances ieee80211_amsdu_to_8023s() API by
changing mandatory removing of IEEE 802.11 header from AMSDU
to optional.
Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
These definitions need to be exposed now that we can set the peer link
states via NL80211_ATTR_STA_PLINK_STATE. They were already being
(opaquely) reported by NL80211_STA_INFO_PLINK_STATE.
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Add the ability to advertise interface combinations in nl80211.
This allows the driver to indicate what the combinations are
that it supports. "Combinations" of just a single interface are
implicit, as previously. Note that cfg80211 will enforce that
the restrictions are met, but not for all drivers yet (once all
drivers are updated, we can remove the flag and enforce for all).
When no combinations are actually supported, an empty list will
be exported so that userspace can know if the kernel exported
this info or not (although it isn't clear to me what tools using
the info should do if the kernel didn't export it).
Since some interface types are purely virtual/software and don't
fit the restrictions, those are exposed in a new list of pure SW
types, not subject to restrictions. This mainly exists to handle
AP-VLAN and monitor interfaces in mac80211.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
When sched_scan_stopped was called by the driver, mac80211 calls
cfg80211, which in turn was calling mac80211 back with a flag
"driver_initiated". This flag was used so that mac80211 would do the
necessary cleanup but would not call the driver. This was enough to
prevent the bounce back between the driver and mac80211, but not
between mac80211 and cfg80211.
To fix this, we now do the cleanup in mac80211 before calling
cfg80211. To help with locking issues, the workqueue was moved from
cfg80211 to mac80211.
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Multiple virtual AP interfaces can currently try
to use different beacon intervals, but that just
leads to problems since it won't actually be done
that way by drivers. Return an error in this case
to make sure it won't be done wrong.
Also, ignore attempts to change the DTIM period
or beacon interval during the lifetime of the BSS.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Introduce NL80211_ATTR_SCHED_SCAN_INTERVAL as a required attribute for
NL80211_CMD_START_SCHED_SCAN. This value informs the driver at which
intervals the scheduled scan cycles should be executed.
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Implement new functionality for scheduled scan offload. With this feature we
can scan automatically at certain intervals.
The idea is that the hardware can perform scan automatically and filter on
desired results without waking up the host unnecessarily.
Add NL80211_CMD_START_SCHED_SCAN and NL80211_CMD_STOP_SCHED_SCAN
commands to the nl80211 interface. When results are available they are
reported by NL80211_CMD_SCHED_SCAN_RESULTS events. The userspace is
informed when the scheduled scan has stopped with a
NL80211_CMD_SCHED_SCAN_STOPPED event, which can be triggered either by
the driver or by a call to NL80211_CMD_STOP_SCHED_SCAN.
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Mesh beacons no longer use all-zeroes BSSID. Beacon frames for MBSS,
infrastructure BSS, or IBSS are differentiated by the Capability
Information field in the Beacon frame. A mesh STA sets the ESS and IBSS
subfields to 0 in transmitted Beacon or Probe Response management
frames.
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Introduce a new configuration option to support AMPE from userspace.
Prior to this series we only supported authentication in userspace: an
authentication daemon would authenticate peer candidates in userspace
and hand them over to the kernel. From that point the mesh stack would
take over and establish a peer link (Mesh Peering Management).
These patches introduce support for Authenticated Mesh Peering Exchange
in userspace. The userspace daemon implements the AMPE protocol and on
successfull completion create mesh peers and install encryption keys.
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
