wifi: ath6kl: reduce WARN to dev_dbg() in callback

The warn is triggered on a known race condition, documented in the code above
the test, that is correctly handled. Using WARN() hinders automated

wifi: ath6kl: reduce WARN to dev_dbg() in callback

The warn is triggered on a known race condition, documented in the code above
the test, that is correctly handled. Using WARN() hinders automated testing.
Reducing severity.

Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload")
Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru

show more ...

ath6kl: remove redundant check of status != 0

The check on status not being zero is redundant as previous code
paths that set status to an error value break out of the while
loop and hence status is

ath6kl: remove redundant check of status != 0

The check on status not being zero is redundant as previous code
paths that set status to an error value break out of the while
loop and hence status is never non-zero at the check. Remove
this redundant code.

Addresses-Coverity: ("Logically dead code")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

show more ...

ath6kl: remove redundant variables netlen, orig_buf, orig_len, dropped and stats

Variables netlen, orig_buf, orig_len, dropped and stats are assigned values
but are never used hence they are redunda

ath6kl: remove redundant variables netlen, orig_buf, orig_len, dropped and stats

Variables netlen, orig_buf, orig_len, dropped and stats are assigned values
but are never used hence they are redundant and can be removed.

Cleans up clang warnings:
warning: variable 'netlen' set but not used [-Wunused-but-set-variable]
warning: variable 'orig_buf' set but not used [-Wunused-but-set-variable]
warning: variable 'orig_len' set but not used [-Wunused-but-set-variable]
warning: variable 'dropped' set but not used [-Wunused-but-set-variable]
warning: variable 'stats' set but not used [-Wunused-but-set-variable]

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

show more ...

networking: make skb_push & __skb_push return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not

networking: make skb_push & __skb_push return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not.

Make these functions return void * and remove all the casts across
the tree, adding a (u8 *) cast only where the unsigned char pointer
was used directly, all done with the following spatch:

@@
expression SKB, LEN;
typedef u8;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
@@
- *(fn(SKB, LEN))
+ *(u8 *)fn(SKB, LEN)

@@
expression E, SKB, LEN;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
type T;
@@
- E = ((T *)(fn(SKB, LEN)))
+ E = fn(SKB, LEN)

@@
expression SKB, LEN;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
@@
- fn(SKB, LEN)[0]
+ *(u8 *)fn(SKB, LEN)

Note that the last part there converts from push(...)[0] to the
more idiomatic *(u8 *)push(...).

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...

networking: make skb_put & friends return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not.

M

networking: make skb_put & friends return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not.

Make these functions (skb_put, __skb_put and pskb_put) return void *
and remove all the casts across the tree, adding a (u8 *) cast only
where the unsigned char pointer was used directly, all done with the
following spatch:

@@
expression SKB, LEN;
typedef u8;
identifier fn = { skb_put, __skb_put };
@@
- *(fn(SKB, LEN))
+ *(u8 *)fn(SKB, LEN)

@@
expression E, SKB, LEN;
identifier fn = { skb_put, __skb_put };
type T;
@@
- E = ((T *)(fn(SKB, LEN)))
+ E = fn(SKB, LEN)

which actually doesn't cover pskb_put since there are only three
users overall.

A handful of stragglers were converted manually, notably a macro in
drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many
instances in net/bluetooth/hci_sock.c. In the former file, I also
had to fix one whitespace problem spatch introduced.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...

ath6kl: fix spelling mistake: "Indicat" -> "Indicate"

Trivial fix to spelling mistake in ath6kl_dbg debug message

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Steve deRosie

ath6kl: fix spelling mistake: "Indicat" -> "Indicate"

Trivial fix to spelling mistake in ath6kl_dbg debug message

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Steve deRosier <derosier@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: add __printf verification to ath6kl_dbg

Fix fallout too.

Signed-off-by: Joe Perches <joe@perches.com>
Reviewed-by: Steve deRosier <derosier@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.q

ath6kl: add __printf verification to ath6kl_dbg

Fix fallout too.

Signed-off-by: Joe Perches <joe@perches.com>
Reviewed-by: Steve deRosier <derosier@gmail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: implement rx flush for htc pipe

rx flush was not implemented for htc pipe, add that now. Doesn't fix any known
issues.

Also free the skb if htc control messages get canceled.

Signed-off-by

ath6kl: implement rx flush for htc pipe

rx flush was not implemented for htc pipe, add that now. Doesn't fix any known
issues.

Also free the skb if htc control messages get canceled.

Signed-off-by: Jessica Wu <wjessica@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: fix blank lines before and after braces

Fixes checkpatch warnings:

CHECK: Blank lines aren't necessary after an open brace '{'
CHECK: Blank lines aren't necessary before a close brace '}'

ath6kl: fix blank lines before and after braces

Fixes checkpatch warnings:

CHECK: Blank lines aren't necessary after an open brace '{'
CHECK: Blank lines aren't necessary before a close brace '}'

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: cold reset target after host warm boot

Julien reported that ar6004 usb device fails to initialise
after host has been rebooted and power is still on for the ar6004 device. He
found out that

ath6kl: cold reset target after host warm boot

Julien reported that ar6004 usb device fails to initialise
after host has been rebooted and power is still on for the ar6004 device. He
found out that doing a cold reset fixes the issue.

I wasn't sure what would be the best way to detect if target needs a reset so I
settled on checking a timeout from htc_wait_recv_ctrl_message().

Reported-by: Julien Massot <jmassot@aldebaran-robotics.com>
Tested-by: Julien Massot <jmassot@aldebaran-robotics.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: fix usb related error handling and warnings

It was annoying to debug usb warm reboot initialisation problems as many usb
related functions just ignored errors and it wasn't obvious from the

ath6kl: fix usb related error handling and warnings

It was annoying to debug usb warm reboot initialisation problems as many usb
related functions just ignored errors and it wasn't obvious from the kernel
logs what was failing. Fix all that so that error messages are printed and
errors are handled properly.

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: small cleanup in ath6kl_htc_pipe_rx_complete()

It's harmless, but Smatch complains if we use "htc_hdr->eid" before
doing the bounds check.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle

ath6kl: small cleanup in ath6kl_htc_pipe_rx_complete()

It's harmless, but Smatch complains if we use "htc_hdr->eid" before
doing the bounds check.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: small cleanup in ath6kl_htc_pipe_rx_complete()

It's harmless, but Smatch complains if we use "htc_hdr->eid" before
doing the bounds check.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle

ath6kl: small cleanup in ath6kl_htc_pipe_rx_complete()

It's harmless, but Smatch complains if we use "htc_hdr->eid" before
doing the bounds check.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

show more ...

ath6kl: Fix kernel panic on continuous driver load/unload

On continuous loading and unloading of AR6004 ath6kl USB
driver it triggers a panic due to NULL pointer dereference of
'target' pointer.

wh

ath6kl: Fix kernel panic on continuous driver load/unload

On continuous loading and unloading of AR6004 ath6kl USB
driver it triggers a panic due to NULL pointer dereference of
'target' pointer.

while true; do sudo modprobe -v ath6kl_core;
sudo modprobe -v ath6kl_usb; sudo modprobe -r usb;
sudo modprobe -r ath6kl_core; done

ar->htc_target can be NULL due to a race condition that can occur
during driver initialization(we do 'ath6kl_hif_power_on' before
initializing 'ar->htc_target' via 'ath6kl_htc_create').
'ath6kl_hif_power_on' assigns 'ath6kl_recv_complete' as
usb_complete_t/callback function for 'usb_fill_bulk_urb'.
Thus the possibility of ar->htc_target being NULL
via ath6kl_recv_complete -> ath6kl_usb_io_comp_work
before even 'ath6kl_htc_create' is finished to initialize
ar->htc_create.

Worth noting is the obvious solution of doing 'ath6kl_hif_power_on'
later(i.e after we are done with 'ath6kl_htc_create', causes a
h/w bring up failure in AR6003 SDIO, as 'ath6kl_hif_power_on' is a
pre-requisite to get the target version 'ath6kl_bmi_get_target_info'.
So simply check for NULL pointer for 'ar->htc_target' and bail out.

[23614.518282] BUG: unable to handle kernel NULL pointer dereference at
00000904
[23614.518463] IP: [<c012e7a6>] __ticket_spin_trylock+0x6/0x30
[23614.518570] *pde = 00000000
[23614.518664] Oops: 0000 [#1] SMP
[23614.518795] Modules linked in: ath6kl_usb(O+) ath6kl_core(O)
[23614.520012] EIP: 0060:[<c012e7a6>] EFLAGS: 00010286 CPU: 0
[23614.520012] EIP is at __ticket_spin_trylock+0x6/0x30
Call Trace:
[<c03f2a44>] do_raw_spin_trylock+0x14/0x40
[<c06daa12>] _raw_spin_lock_bh+0x52/0x80
[<f85464b4>] ? ath6kl_htc_pipe_rx_complete+0x3b4/0x4c0 [ath6kl_core]
[<f85464b4>] ath6kl_htc_pipe_rx_complete+0x3b4/0x4c0 [ath6kl_core]
[<c05bc272>] ? skb_dequeue+0x22/0x70
[<c05bc272>] ? skb_dequeue+0x22/0x70
[<f855bb32>] ath6kl_core_rx_complete+0x12/0x20 [ath6kl_core]
[<f848771a>] ath6kl_usb_io_comp_work+0xaa/0xb0 [ath6kl_usb]
[<c015b863>] process_one_work+0x1a3/0x5e0
[<c015b7e7>] ? process_one_work+0x127/0x5e0
[<f8487670>] ? ath6kl_usb_reset_resume+0x30/0x30 [ath6kl_usb]
[<c015bfde>] worker_thread+0x11e/0x3f0
Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: remove unnecessary check for NULL skb

dev_kfree_skb kernel API itself takes for checking for NULL
skb, so an explicit check is not required.

Signed-off-by: Mohammed Shafi Shajakhan <mohamme

ath6kl: remove unnecessary check for NULL skb

dev_kfree_skb kernel API itself takes for checking for NULL
skb, so an explicit check is not required.

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Use standard way to assign the boolean variable

Assign 'true' to the bool variable instead of needless typecasting.

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signe

ath6kl: Use standard way to assign the boolean variable

Assign 'true' to the bool variable instead of needless typecasting.

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: use list_move_tail instead of list_del/list_add_tail

Using list_move_tail() instead of list_del() + list_add_tail().

spatch with a semantic match is used to found this problem.
(http://cocc

ath6kl: use list_move_tail instead of list_del/list_add_tail

Using list_move_tail() instead of list_del() + list_add_tail().

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: assign Tx packet drop threshold per endpoint on htc pipe layer

On the htc mbox layer, it will assign each endpoint (AC) with a
different Tx-packet-drop threshold, so lower priority AC is mor

ath6kl: assign Tx packet drop threshold per endpoint on htc pipe layer

On the htc mbox layer, it will assign each endpoint (AC) with a
different Tx-packet-drop threshold, so lower priority AC is more
likely to drop packets and the cookies become more available to higher
priority AC.

On the htc pipe layer, assign the tx packet drop threshold as well, it
will let AC to drop packets when cookies below the tx packet drop
threshold.

Signed-off-by: Kevin Fang <kevin.fang@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: list_first_entry() is never NULL

We can remove the NULL check here. It triggers a Smatch warning because
list_first_entry() never is NULL and people who check for it normally
intend to chec

ath6kl: list_first_entry() is never NULL

We can remove the NULL check here. It triggers a Smatch warning because
list_first_entry() never is NULL and people who check for it normally
intend to check for list_empty() instead. In these cases however,
we've already verified that the lists are not empty.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

show more ...

ath6kl: Add HTC pipe implementation

This is needed for USB.

Based on code by Kevin Fang.

Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

ath6kl: remove redundant check of status != 0

The check on status not being zero is redundant as previous code
paths that set status to an error value break out of the while
loop and

ath6kl: remove redundant check of status != 0

The check on status not being zero is redundant as previous code
paths that set status to an error value break out of the while
loop and hence status is never non-zero at the check. Remove
this redundant code.

Addresses-Coverity: ("Logically dead code")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

show more ...

ath6kl: remove redundant variables netlen, orig_buf, orig_len, dropped and stats

Variables netlen, orig_buf, orig_len, dropped and stats are assigned values
but are never used hence they

ath6kl: remove redundant variables netlen, orig_buf, orig_len, dropped and stats

Variables netlen, orig_buf, orig_len, dropped and stats are assigned values
but are never used hence they are redundant and can be removed.

Cleans up clang warnings:
warning: variable 'netlen' set but not used [-Wunused-but-set-variable]
warning: variable 'orig_buf' set but not used [-Wunused-but-set-variable]
warning: variable 'orig_len' set but not used [-Wunused-but-set-variable]
warning: variable 'dropped' set but not used [-Wunused-but-set-variable]
warning: variable 'stats' set but not used [-Wunused-but-set-variable]

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

show more ...

Merge tag 'wireless-drivers-next-for-davem-2017-06-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireles

Merge tag 'wireless-drivers-next-for-davem-2017-06-25' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

Kalle Valo says:

====================
wireless-drivers-next patches for 4.13

New features and bug fixes to quite a few different drivers, but
nothing really special standing out.

What makes me happy that we have now more vendors actively
contributing to upstream drivers. In this pull request we have patches
from Broadcom, Intel, Qualcomm, Realtek and Redpine Signals, and I
still have patches from Marvell and Quantenna pending in patchwork. Now
that's something comparing to how things looked 11 years ago in Jeff
Garzik's "State of the Union: Wireless" email:

https://lkml.org/lkml/2006/1/5/671

Major changes:

wil6210

* add low level RF sector interface via nl80211 vendor commands

* add module parameter ftm_mode to load separate firmware for factory
testing

* support devices with different PCIe bar size

* add support for PCIe D3hot in system suspend

* remove ioctl interface which should not be in a wireless driver

ath10k

* go back to using dma_alloc_coherent() for firmware scratch memory

* add per chain RSSI reporting

brcmfmac

* add support multi-scheduled scan

* add scheduled scan support for specified BSSIDs

* add support for brcm43430 revision 0

wlcore

* add wil1285 compatible

rsi

* add RS9113 USB support

iwlwifi

* FW API documentation improvements (for tools and htmldoc)

* continuing work for the new A000 family

* bump the maximum supported FW API to 31

* improve the differentiation between 8000, 9000 and A000 families
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...

networking: make skb_push & __skb_push return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more of

networking: make skb_push & __skb_push return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not.

Make these functions return void * and remove all the casts across
the tree, adding a (u8 *) cast only where the unsigned char pointer
was used directly, all done with the following spatch:

@@
expression SKB, LEN;
typedef u8;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
@@
- *(fn(SKB, LEN))
+ *(u8 *)fn(SKB, LEN)

@@
expression E, SKB, LEN;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
type T;
@@
- E = ((T *)(fn(SKB, LEN)))
+ E = fn(SKB, LEN)

@@
expression SKB, LEN;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
@@
- fn(SKB, LEN)[0]
+ *(u8 *)fn(SKB, LEN)

Note that the last part there converts from push(...)[0] to the
more idiomatic *(u8 *)push(...).

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...

networking: make skb_put & friends return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often

networking: make skb_put & friends return void pointers

It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not.

Make these functions (skb_put, __skb_put and pskb_put) return void *
and remove all the casts across the tree, adding a (u8 *) cast only
where the unsigned char pointer was used directly, all done with the
following spatch:

@@
expression SKB, LEN;
typedef u8;
identifier fn = { skb_put, __skb_put };
@@
- *(fn(SKB, LEN))
+ *(u8 *)fn(SKB, LEN)

@@
expression E, SKB, LEN;
identifier fn = { skb_put, __skb_put };
type T;
@@
- E = ((T *)(fn(SKB, LEN)))
+ E = fn(SKB, LEN)

which actually doesn't cover pskb_put since there are only three
users overall.

A handful of stragglers were converted manually, notably a macro in
drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many
instances in net/bluetooth/hci_sock.c. In the former file, I also
had to fix one whitespace problem spatch introduced.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...