The ashmem driver did not check that the size/offset of the vma passed
to its .mmap() function was not larger than the ashmem object being
mapped. This could cause mmap() to succeed, even though accessing parts
of the mapping would later fail with a segmentation fault.

Ensure an error is returned by the ashmem_mmap() function if the vma
size is larger than the ashmem object size. This enables safer handling
of the problem in userspace.

Cc: Todd Kjos <tkjos@android.com>
Cc: devel@driverdev.osuosl.org
Cc: linux-kernel@vger.kernel.org
Cc: kernel-team@android.com
Cc: Joel Fernandes <joel@joelfernandes.org>
Signed-off-by: Alistair Strachan <astrachan@google.com>
Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There is no speed difference, and it makes the code harder to read.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Todd Kjos <tkjos@android.com>
Cc: Martijn Coenen <maco@android.com>
Cc: devel@driverdev.osuosl.org
Cc: linux-kernel@vger.kernel.org
Cc: kernel-team@android.com
Cc: Joel Fernandes <joel@joelfernandes.org>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Alistair Strachan <astrachan@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Item [1] in TODO list is already addressed, so removed it from TODO file.

[1]. Move handling for each individual members of 'union message_body' out
into a separate 'struct work_struct' and completely remove the
multiplexerthat is currently part of host_if_work(), allowing movement
of the implementation of each message handler into the callsite of the
function that currently queues the 'host_if_msg'.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Instead of static variable now allocating the data and passing to
handle_get_rssi() to fill the rssi information.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Avoided the use of static variable 'inactive_time' and move it as part of
'sta_inactive_t' structure.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Handle freeing of memory allocated to keep 'key' & 'seq' in wilc_add_rx_gtk().
Once completion event is received, free the memory allocated for
to avoid missing of free in work function.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Handle freeing of memory allocated to store the 'key' in wilc_add_ptk()
function. Once work completion notification is received, free the
memory allocated to avoid missing of free in work function sepecially
for error scenario.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Modified the code to free the allocated memory, used to store the key in
wilc_add_wep_key_bss_sta() and wilc_add_wep_key_bss_ap().
After work completion notification is received, free the
memory allocated to avoid missing of free in work function.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Rename wilc_enqueue_cmd() to wilc_enqueue_work() because its used to
enqueue the work queue. Also removed the function header comment for
wilc_enqueue_cmd() as its not correct.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove 'hif_thread_comp' completions as its not required after adding
completion event as part work data to handle each sync call.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Added 'work_comp' completion in 'host_if_msg'. It allows handling the
sync call to wait for sepecific completion event.
The commands can be run in sync way waiting for their specific
completion event.
Added is_sync flag in wilc_create_work_queue() to handle the sync call to
host interface.

After adding completion as part of host_if_msg now
below completion are not required
 comp_test_key_block;
 comp_test_disconn_block
 comp_get_rssi
 comp_inactive_time
 hif_wait_response

Modified wilc_get_statistics() API to handle get statistic in sync &
async way.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Instead of allocating the host_if_cmd in wilc_enqueue_cmd() now moved
the allocation of cmd in the caller. Added the NULL check for
'hif_workqueue' before posting the work queue in wilc_enqueue_cmd().
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

After removing the multiplexing of hif commands in hif_if_work()
macros prefix with 'HOST_IF_MSG_' are not required. Also 'id' field in
host_if_msg is not required anymore.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove multiplexing of command at host_if_work().
Make use of function pointer instead of command ID to track individual
work_struct separately.

Modified the handler function to take work_struct pointer as argument
and its return type is changes to void. Now prototype of 'handle_'
function is same work_struct i.e. 'void (*fun)(struct struct *)' to
register with work_queue.
Removed host_if_work() because its not required now.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use structs ethhdr, iphdr and tcphdr instead of manual parsing in
tcp_process.
This commit fix handling of ip packets containing options.
It also fixes the following sparse warning:

drivers/staging/wilc1000//wilc_wlan.c:201:19: warning: cast to restricted __be16
Signed-off-by: Thibaut Robert <thibaut.robert@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Banks shouldn't be defined in DT if number of resources
per bank is not variable. We actually know that this SoC
has three banks so take that into account in order to don't
overspecify the device tree. Device tree will only have one
node making it simple. Update device tree, binding doc and
code accordly.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Kconfig is using a generic 'Mediatek GPIO Support' in
description and help which is not specific at all about
the current SoC which is MT7621. Update it.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Checkpatch script is complaining about a comment line
which exceeds 80 characteres. Just silence it.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently the driver defines 3 gpiochips, one for each bank.

/sys/class/gpio/gpiochip416/label:1e000600.gpio
/sys/class/gpio/gpiochip448/label:1e000600.gpio
/sys/class/gpio/gpiochip480/label:1e000600.gpio

Unfortunately they all have the same label

Interrupts from /proc/interrupt show the same name which is
confusing:

/proc/interrupts:

17: 0  0  0  0  MIPS GIC  19  mt7621, mt7621, mt7621

which is the interrupt from the GPIO controller.
It is a little weird that all three banks are named "mt7621"
here. We also have:

26: 0  0  0  0  GPIO  18  reset

which is the interrupt from GPIO which provides the "reset"
button. I suspect that if I had interrupts form two different
banks they would both be called "GPIO" which would be a little
confusing.

In order to unify all of this set different names for each chip
Use a 'bank-based' name instead the same for all: 'mt7621-bank[0-2]'.
Create a new 'mediatek_gpio_bank_name' function which return the
name depending on the bank number. This function is allways called
with a valid index 0, 1 or 2.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There is no need to check for 'pending' before loop over the
interrupts using 'for_each_set_bit' if nothing is set the
return values will be the same so just avoid this check avoiding
also one level intentation and improving readability.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

If there is no interrupt defined in the dts 'irq_of_parse_and_map'
returns 0 and we should't set up interrupts for each gpio chip in
that case.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Function 'to_mediatek_gpio' cannot return NULL, so this NULL
checkings are pointless.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There was two remaining defines which weren't properly
aligned with the rest. Align them improving readability.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Update kernel doc for mtk_data and also remove no needed
documentation for mtk_gc which is clear enough to don't
need it.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

PIN_MASK macro was being used because of the fact we were only
using one interrupt controller for all of the gpio chips. This
has been changed to use one per gpio chip and each has 32 irqs.
Because of this this macro is not needed anymore. Use BIT macro
instead.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Instead of create a custom irq_domain for this chip, use
'gpiochip_set_chained_irqchip' from GPIOLIB_IRQCHIP. It
is ok to call this function several times. We have to
manually mark the line with 'IRQF_SHARED' and then loop
over the three banks until you find a hit. There were
some problems with removing an irqchip like that but this
driver is a bool so it might work just fine. After this
changes the functions 'mediatek_gpio_to_irq' is not needed
anymore and also the 'gpio_irq_domain' field from the state
container. Instead of use the custom irq domain in the irq
handler use the associated domain from the gpio_chip in
'irq_find_mapping' function. Function 'mediatek_gpio_bank_probe'
has been moved a it to the botton to have all the irq related
functions together and avoid some forward declarations to resolve
some symbols along the code.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This chip support high level and low level interrupts. Those
have to be implemented also to get a complete and clean driver.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This commit adds kerneldoc for the two data containers in
order to better understanding of its existence.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This driver is actually platform-agnostic.  Add COMPILE_TEST for
the compilation test coverage.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

When implementing custom irqchips it is important to also
implement .irq_request_resources() and .irq_release_resources()
and make sure these call gpiochip_[un]lock_as_irq().
Add those two for this driver. Also store struct device pointer
in global state structure to be able to use 'dev_err' with the
device from 'mediatek_request_resources' function.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This driver was being registered using 'module_platform_driver'
but it is not a module at all. Instead of this use
'builtin_platform_driver' which seems to be the correct one.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Including file '<linux/gpio.h>' should be avoided in
new drivers code, so just remove it because it is
no necessary at all.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Gpio complexity is just masking the fact that offset is always
0..n and writes to bits 0..n of some memory address. Because
of this whole thing can just me converted to use GPIO_GENERIC
and avoid duplications of a lot of driver custom functions.
So use bgpio_init instead of custom code adding GPIO_GENERIC
dependency to the Kconfig file. Also to make easier using
bgpio_init function offset for each gpio bank, enumeration
where register were defined has been replaced in favour of
some macros which handle each gpio offset taking into account
the bank where are located. Because of this change write and
read functions which are being used for remaining irq handling
stuff have been updated also as well as its dependencies along
the code.
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use eth_hw_addr_random() to set a random dev_addr and update
addr_assign_type.

Fixes: e3cbf478 ('staging: mt7621-eth: add the drivers core files')
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix memory leak in error path of mtk_add_mac() by make sure to free
the allocated netdev.

Fixes: e3cbf478 ('staging: mt7621-eth: add the drivers core files')
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This currently fixes the remaining dtb warnings:

Node /pcie@1e140000/pcie0 has a reg or ranges property, but no unit name
Node /pcie@1e140000/pcie1 has a reg or ranges property, but no unit name
Node /pcie@1e140000/pcie2 has a reg or ranges property, but no unit name
Node /pcie@1e140000/pcie0 node name is not "pci" or "pcie"
Node /pcie@1e140000/pcie0 missing ranges for PCI bridge (or not a bridge)
Node /pcie@1e140000/pcie0 missing bus-range for PCI bridge
Node /pcie@1e140000/pcie1 node name is not "pci" or "pcie"
Node /pcie@1e140000/pcie1 missing ranges for PCI bridge (or not a bridge)
Node /pcie@1e140000/pcie1 missing bus-range for PCI bridge
Node /pcie@1e140000/pcie2 node name is not "pci" or "pcie"
Node /pcie@1e140000/pcie2 missing ranges for PCI bridge (or not a bridge)
Node /pcie@1e140000/pcie2 missing bus-range for PCI bridge
Warning (unit_address_format): Failed prerequisite 'pci_bridge'
Warning (pci_device_reg): Failed prerequisite 'pci_bridge'
Warning (pci_device_bus_num): Failed prerequisite 'pci_bridge'

device_type was removed since according to documentation, it's deprecated
for pci(e) devices.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The response type of the SD_APP_OP_COND command is correctly
determined using the mmc_resp_type macro, because the only use of that
opcode, mmc_send_app_op_cond, correctly places MMC_RSP_R3 in cmd.flags.

So there is no need to treat that opcode separately.
Signed-off-by: Christian Lütke-Stetzkamp <christian@lkamp.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The response type of the MMC_SEND_OP_COND command is correctly
determined using the mmc_resp_type macro, because the only use of that
opcode, mmc_send_op_cond, correctly places MMC_RSP_R3 in cmd.flags.

So there is no need to treat that opcode separately.
Signed-off-by: Christian Lütke-Stetzkamp <christian@lkamp.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently msdc_command_start does multiple things and is hard to read,
so factor out the finding of the response type.
Signed-off-by: Christian Lütke-Stetzkamp <christian@lkamp.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The argument tune of msdc_do_command is never used, so remove it.
Signed-off-by: Christian Lütke-Stetzkamp <christian@lkamp.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>