- 03 Oct, 2013 24 commits
-
-
Larry Finger authored
Smatch lists the following: CHECK drivers/net/wireless/rtlwifi/rtl8192de/dm.c drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1054 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'ofdm_index' 2 <= 2 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1056 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'ofdm_index' 2 <= 2 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1126 rtl92d_dm_txpower_tracking_callback_thermalmeter() debug: remove_pools: nr_children over 4000 (4596). (rtlpriv->dbg.global_debuglevel merged) drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1126 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1129 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1132 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1135 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1138 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1141 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1144 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1147 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch1ch13' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1151 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1154 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1157 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1160 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1163 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1166 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1169 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 drivers/net/wireless/rtlwifi/rtl8192de/dm.c:1172 rtl92d_dm_txpower_tracking_callback_thermalmeter() error: buffer overflow 'cckswing_table_ch14' 33 <= 255 This patch fixes several off-by-one errors. It also removes a comment referencing variable 'noise' in the rts_stats struct. Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
John W. Linville <linville@tuxdriver.com>
-
Stanislaw Gruszka authored
Add support for new RF chip ID: 3070. It seems to be the same as 5370, maybe vendor just put wrong value on the eeprom, but add this id anyway since devices with it showed on the marked. Signed-off-by:
Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by:
-
Arend van Spriel authored
The brcmfmac has common and bus specific part. The rx function api was using sk_buff_head. Changed to sk_buff instead. Reviewed-by:
Hante Meuleman <meuleman@broadcom.com> Reviewed-by:
Franky (Zhenhui) Lin <frankyl@broadcom.com> Reviewed-by:
Pieter-Paul Giesberts <pieterpg@broadcom.com> Signed-off-by:
Arend van Spriel <arend@broadcom.com> Signed-off-by:
-
Hante Meuleman authored
SDIO firmware download routines uses one name for firmware file and nvram file for all sdio devices. This is not user friendly. Use fw filename and nvram filename based upon chip id and revision. Reported-by:
Stephen Warren <swarren@wwwdotorg.org> Reviewed-by:
-
Arend van Spriel authored
The definition of BRCMF_EVENTING_MASK_LEN results in a sparse error message .../fweh.c:331:22: error: bad constant expression .../fweh.c:388:22: error: bad constant expression .../dhd_common.c:256:22: error: bad constant expression This is caused by the use of roundup() in BRCMF_EVENTING_MASK_LEN and it is used to allocate an array variable on the stack. Better use DIV_ROUND_UP() macro. Reviewed-by:
-
Franky Lin authored
Bus layer need to share sk_buff::cb with firmware signal feature. Reserve necessary memory so they won't overwrite each other. Reviewed-by:
-
Franky Lin authored
Perform a valid check for core index to avoid illegal address access. Reviewed-by:
-
Franky Lin authored
BCM4339 is an a/b/g/n/ac 1x1 WiFi chip. This patch adds support for it through SDIO interface. Reviewed-by:
-
Franky Lin authored
Update event list to keep sync with firmware development. Use calculated event mask length instead of hard-coded value. Reviewed-by:
-
John W. Linville authored
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
-
-
-
Marcel Holtmann authored
The Bluetooth specification makes it clear that only one command should be present in the L2CAP LE signalling packet. So tighten the checks here and restrict it to exactly one command. This is different from L2CAP BR/EDR signalling where multiple commands can be part of the same packet. Signed-off-by:
Marcel Holtmann <marcel@holtmann.org> Signed-off-by:
Johan Hedberg <johan.hedberg@intel.com>
-
Marcel Holtmann authored
When SMP packets are received, make sure they contain at least 1 byte header for the opcode. If not, drop the packet and disconnect the link. Signed-off-by:
-
Marcel Holtmann authored
The ATT fixed channel is only valid when using LE connections. On BR/EDR it is required to go through L2CAP connection oriented channel for ATT. Drop ATT packets when they are received on a BR/EDR connection. Signed-off-by:
-
Marcel Holtmann authored
When receiving connectionless packets on a LE connection, just drop the packet. There is no concept of connectionless channels for LE. Signed-off-by:
-
Marcel Holtmann authored
When receiving SMP packets on a BR/EDR connection, then just drop the packet and do not try to process it. Signed-off-by:
-
Marcel Holtmann authored
The L2CAP raw sockets are only used for BR/EDR signalling. Packets on LE links should not be forwarded there. Signed-off-by:
-
Marcel Holtmann authored
The switch statement for the various L2CAP fixed channel handlers is not really ordered. Signed-off-by:
-
Marcel Holtmann authored
Changing the device class when BR/EDR is disabled has no visible effect for remote devices. However to simplify the logic allow it as long as the controller supports BR/EDR operations. If it is not allowed, then the overall logic becomes rather complicated since the class of device values would need clearing or restoring when BR/EDR setting changes. Signed-off-by:
-
Marcel Holtmann authored
Loading long term keys into a BR/EDR only controller make no sense. The kernel would never use any of these keys. So instead of allowing userspace to waste memory, reject such operation with a not supported error message. Signed-off-by:
-
Marcel Holtmann authored
Loading link keys into a LE only controller make no sense. The kernel would never use any of these keys. So instead of allowing userspace to waste memory, reject such operation with a not supported error message. Signed-off-by:
-
Marcel Holtmann authored
Setting the static address does not depend on LE beeing enabled. It only depends on a controller with LE support. When depending on LE enabled this command becomes really complicated since in case LE gets disabled, it would be required to clear the static address and also its random address representation inside the controller. With future support for private addresses such complex setup should be avoided. Signed-off-by:
-
Marcel Holtmann authored
Only when BR/EDR is supported and enabled, allow changing of the SSP setting. Just checking if the hardware supports SSP is not enough since it might be the case that BR/EDR is disabled. In the case that BR/EDR is disabled, but SSP supported by the controller the not supported error message is now returned. Signed-off-by:
-
- 02 Oct, 2013 16 commits
-
-
Marcel Holtmann authored
The wrong type of L2CAP signalling packets on the wrong type of either BR/EDR or LE links need to be dropped. When that happens the packet is dropped, but the memory not freed. So actually free the memory as well. Signed-off-by:
Gustavo Padovan <gustavo.padovan@collabora.co.uk>
-
DoHyun Pyun authored
The Slave Page Response Timeout event indicates to the Host that a slave page response timeout has occurred in the BR/EDR Controller. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 110 "7.7.72 Slave Page Response Timeout Event [New Section] ... Note: this event will be generated if the slave BR/EDR Controller responds to a page but does not receive the master FHS packet (see Baseband, Section 8.3.3) within pagerespTO. Event Parameters: NONE" Signed-off-by:
Dohyun Pyun <dh79.pyun@samsung.com> Signed-off-by:
C S Bhargava <cs.bhargava@samsung.com> Signed-off-by:
-
DoHyun Pyun authored
The Synchronization Train Complete event indicates that the Start Synchronization Train command has completed. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 103 "7.7.67 Synchronization Train Complete Event [New Section] ... Event Parameters: Status 0x00 Start Synchronization Train command completed successfully. 0x01-0xFF Start Synchronization Train command failed. See Part D, Error Codes, for error codes and descriptions." Signed-off-by: -
DoHyun Pyun authored
The Start_Synchronization_Train command controls the Synchronization Train functionality in the BR/EDR Controller. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 86 "7.1.51 Start Synchronization Train Command [New Section] ... If connectionless slave broadcast mode is not enabled, the Command Disallowed (0x0C) error code shall be returned. After receiving this command and returning a Command Status event, the Baseband starts attempting to send synchronization train packets containing information related to the enabled Connectionless Slave Broadcast packet timing. Note: The AFH_Channel_Map used in the synchronization train packets is configured by the Set_AFH_Channel_Classification command and the local channel classification in the BR/EDR Controller. The synchronization train packets will be sent using the parameters specified by the latest Write_Synchronization_Train_Parameters command. The Synchronization Train will continue until synchronization_trainTO slots (as specified in the last Write_Synchronization_Train command) have passed or until the Host disables the Connectionless Slave Broadcast logical transport." Signed-off-by:
-
DoHyun Pyun authored
he Set_Connectionless_Slave_Broadcast command controls the Connectionless Slave Broadcast functionality in the BR/EDR Controller. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 78 "7.1.49 Set Connectionless Slave Broadcast Command [New Section] ... The LT_ADDR indicated in the Set_Connectionless_Slave_Broadcast shall be pre-allocated using the HCI_Set_Reserved_LT_ADDR command. If the LT_ADDR has not been reserved, the Unknown Connection Identifier (0x02) error code shall be returned. If the controller is unable to reserve sufficient bandwidth for the requested activity, the Connection Rejected Due to Limited Resources (0x0D) error code shall be returned. The LPO_Allowed parameter informs the BR/EDR Controller whether it is allowed to sleep. The Packet_Type parameter specifies which packet types are allowed. The Host shall either enable BR packet types only, or shall enable EDR and DM1 packet types only. The Interval_Min and Interval_Max parameters specify the range from which the BR/EDR Controller must select the Connectionless Slave Broadcast Interval. The selected Interval is returned." Signed-off-by:
-
DoHyun Pyun authored
The Write_Synchronization_Train_Parameters command configures the Synchronization Train functionality in the BR/EDR Controller. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 97 "7.3.90 Write Synchronization Train Parameters Command [New Section] ... Note: The AFH_Channel_Map used in the Synchronization Train packets is configured by the Set_AFH_Channel_Classification command and the local channel classification in the BR/EDR Controller. Interval_Min and Interval_Max specify the allowed range of Sync_Train_Interval. Refer to [Vol. 2], Part B, section 2.7.2 for a detailed description of Sync_Train_Interval. The BR/EDR Controller shall select an interval from this range and return it in Sync_Train_Interval. If the Controller is unable to select a value from this range, it shall return the Invalid HCI Command Parameters (0x12) error code. Once started (via the Start_Synchronization_Train Command) the Synchronization Train will continue until synchronization_trainTO slots have passed or Connectionless Slave Broadcast has been disabled." Signed-off-by:
-
DoHyun Pyun authored
The Set_Connectionless_Slave_Broadcast_Data command provides the ability for the Host to set Connectionless Slave Broadcast data in the BR/EDR Controller. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 93 "7.3.88 Set Connectionless Slave Broadcast Data Command [New Section] ... If connectionless slave broadcast mode is disabled, this data shall be kept by the BR/EDR Controller and used once connectionless slave broadcast mode is enabled. If connectionless slave broadcast mode is enabled, and this command is successful, this data will be sent starting with the next Connectionless Slave Broadcast instant. The Data_Length field may be zero, in which case no data needs to be provided. The Host may fragment the data using the Fragment field in the command. If the combined length of the fragments exceeds the capacity of the largest allowed packet size specified in the Set Connectionless Slave Broadcast command, all fragments associated with the data being assembled shall be discarded and the Invalid HCI Command Parameters error (0x12) shall be returned." Signed-off-by:
-
DoHyun Pyun authored
The Delete_Reserved_LT_ADDR command requests that the BR/EDR Controller cancel the reservation for a specific LT_ADDR reserved for the purposes of Connectionless Slave Broadcast. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 92 "7.3.87 Delete Reserved LT_ADDR Command [New Section] ... If the LT_ADDR indicated in the LT_ADDR parameter is not reserved by the BR/EDR Controller, it shall return the Unknown Connection Identifier (0x02) error code. If connectionless slave broadcast mode is still active, then the Controller shall return the Command Disallowed (0x0C) error code." Signed-off-by:
-
DoHyun Pyun authored
The Set_Reserved_LT_ADDR command allows the host to request that the BR/EDR Controller reserve a specific LT_ADDR for Connectionless Slave Broadcast. The Core Spec Addendum 4 adds this command in part B Connectionless Slave Broadcast. Bluetooth Core Specification Addendum 4 - Page 90 "7.3.86 Set Reserved LT_ADDR Command [New Section] ... If the LT_ADDR indicated in the LT_ADDR parameter is already in use by the BR/EDR Controller, it shall return the ACL Connection Already Exists (0x0B) error code. If the LT_ADDR indicated in the LT_ADDR parameter is out of range, the controller shall return the Invalid HCI Command Parameters (0x12) error code. If the command succeeds, then the reserved LT_ADDR shall be used when issuing subsequent Set Connectionless Slave Broadcast Data and Set Connectionless Slave Broadcast commands. To ensure that the reserved LT_ADDR is not already allocated, it is recommended that this command be issued at some point after HCI_Reset is issued but before page scanning is enabled or paging is initiated." Signed-off-by:
-
Johannes Berg authored
The merge b35c8097 seems to have lost commit eabc4ac5, put the code back. Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Signed-off-by:
-
Marcel Holtmann authored
This patch increments the management interface revision due to the various fixes, improvements and other changes that have gone in lately. Signed-off-by:
-
Johan Hedberg authored
We shouldn't include the simultaneous LE & BR/EDR flags in the LE advertising data if BR/EDR is disabled on a dual-mode controller. This patch fixes this issue and ensures that the create_ad function generates the correct flags when BR/EDR is disabled. Signed-off-by:
-
Johan Hedberg authored
The REJECTED management response should mainly be used when the adapter is in a state where we cannot accept some command or a specific parameter value. The NOT_SUPPORTED response in turn means that the adapter really cannot support the command or parameter value. This patch fixes this distinction and adds two helper functions to easily get the appropriate LE or BR/EDR related status response. Signed-off-by:
-
Marcel Holtmann authored
On dual-mode BR/EDR/LE and LE only controllers it is possible to configure a random address. There are two types or random addresses, one is static and the other private. Since the random private addresses require special privacy feature to be supported, the configuration of these two are kept separate. This command allows for setting the static random address. It is only supported on controllers with LE support. The static random address is suppose to be valid for the lifetime of the controller or at least until the next power cycle. To ensure such behavior, setting of the address is limited to when the controller is powered off. The special BDADDR_ANY address (00:00:00:00:00:00) can be used to disable the static address. This is also the default value. Signed-off-by:
-
Marcel Holtmann authored
Disabling the high speed setting when the controller is powered on has too many side effects that are not taken care of. And in general it is not an useful operation anyway. So just make such a command fail with a rejection error message. Signed-off-by:
-
Johan Hedberg authored
This patch introduces a new mgmt command for enabling/disabling BR/EDR functionality. This can be convenient when one wants to make a dual-mode controller behave like a single-mode one. The command is only available for dual-mode controllers and requires that LE is enabled before using it. The BR/EDR setting can be enabled at any point, however disabling it requires the controller to be powered off (otherwise a "rejected" response will be sent). Disabling the BR/EDR setting will automatically disable all other BR/EDR related settings. Signed-off-by:
-
