This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".
The branch, master has been updated via 91e56a59a4adc968b3fed8a95a9a3f569230f145 (commit) from 4d7f5ead1657438247e1f0ce378e259cc04aef48 (commit)
Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.
- Log ----------------------------------------------------------------- commit 91e56a59a4adc968b3fed8a95a9a3f569230f145 Author: Arne Fitzenreiter arne_f@ipfire.org Date: Wed Dec 31 08:48:56 2014 +0100
kernel: add backports 3.18.1-1.
-----------------------------------------------------------------------
Summary of changes: lfs/{igb => backports} | 53 +- make.sh | 5 + src/patches/backports-3.18.1-1-grsecurity.patch | 3806 ++++++++++++++++++++ src/patches/backports-3.18.1-1-ipfire-build.patch | 34 + ...h => backports-3.18.1-1_add_libertas_uap.patch} | 109 +- 5 files changed, 3930 insertions(+), 77 deletions(-) copy lfs/{igb => backports} (54%) create mode 100644 src/patches/backports-3.18.1-1-grsecurity.patch create mode 100644 src/patches/backports-3.18.1-1-ipfire-build.patch copy src/patches/{linux-3.10.39-add_libertas_uap.patch => backports-3.18.1-1_add_libertas_uap.patch} (97%)
Difference in files: diff --git a/lfs/backports b/lfs/backports new file mode 100644 index 0000000..c5aae66 --- /dev/null +++ b/lfs/backports @@ -0,0 +1,116 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2014 IPFire Team info@ipfire.org # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see http://www.gnu.org/licenses/. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VERSUFIX = ipfire$(KCFG) + +VER = 3.18.1-1 + +THISAPP = backports-$(VER) +DL_FILE = $(THISAPP).tar.xz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP)-kmod-$(KVER)-$(VERSUFIX) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 6cef5f2c800e12441d2cba9fa42b6a5b + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + $(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1-ipfire-build.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1-grsecurity.patch + + # DVB patches + cd $(DIR_APP) && patch -Np2 < $(DIR_SRC)/src/patches/v4l-dvb_fix_tua6034_pll.patch + + # Wlan patches + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/compat-drivers-3.8.3-ath_ignore_eeprom_regdomain.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.22-iwlwifi-noibss_only_on_radar_chan.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.10.37-rt2800usb_add_dlink_dwa137_usbid.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/backports-3.18.1-1_add_libertas_uap.patch + + # generate config + cd $(DIR_APP) && make KLIB=/lib/modules/$(KVER)-$(VERSUFIX)/ allmodconfig + + # Disable some settings + cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_DEVELOPER_WARNINGS=y/# CPTCFG_CFG80211_DEVELOPER_WARNINGS is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_CERTIFICATION_ONUS=y/# CPTCFG_CFG80211_CERTIFICATION_ONUS is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_REG_CELLULAR_HINTS=y/# CPTCFG_CFG80211_REG_CELLULAR_HINTS is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_REG_RELAX_NO_IR=y/# CPTCFG_CFG80211_REG_RELAX_NO_IR is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_INTERNAL_REGDB=y/# CPTCFG_CFG80211_INTERNAL_REGDB is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/CPTCFG_CFG80211_DEFAULT_PS=y/# CPTCFG_CFG80211_DEFAULT_PS is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/CPTCFG_NFC=m/# CPTCFG_NFC is not set/g" .config + + # Disable some modules (build fail) + cd $(DIR_APP) && sed -i -e "s/CPTCFG_VIDEO_VIA_CAMERA=m/# CPTCFG_VIDEO_VIA_CAMERA is not set/g" .config + + # Disable DEBUG + cd $(DIR_APP) && sed -i -e "s/.*DEBUG=y/# & is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/.*DEBUGFS=y/# & is not set/g" .config + cd $(DIR_APP) && sed -i -e "s/=y is not set/ is not set/g" .config + + cd $(DIR_APP) && make $(MAKETUNING) KLIB=/lib/modules/$(KVER)-$(VERSUFIX)/ install + + # Remove vsp1 module (not mach to our platforms) + rm -rf /lib/modules/$(KVER)-$(VERSUFIX)/kernel/drivers/media/platform/vsp1 + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index fa7fb55..18ac3da 100755 --- a/make.sh +++ b/make.sh @@ -408,6 +408,7 @@ buildipfire() { i586) # x86-pae (Native and new XEN) kernel build ipfiremake linux KCFG="-pae" + ipfiremake backports KCFG="-pae" ipfiremake cryptodev KCFG="-pae" ipfiremake e1000e KCFG="-pae" ipfiremake igb KCFG="-pae" @@ -416,6 +417,7 @@ buildipfire() {
# x86 kernel build ipfiremake linux KCFG="" + ipfiremake backports KCFG="" ipfiremake cryptodev KCFG="" ipfiremake e1000e KCFG="" ipfiremake igb KCFG="" @@ -426,11 +428,13 @@ buildipfire() { armv5tel) # arm-rpi (Raspberry Pi) kernel build ipfiremake linux KCFG="-rpi" + ipfiremake backports KCFG="-rpi" ipfiremake cryptodev KCFG="-rpi" ipfiremake linux-initrd KCFG="-rpi"
# arm multi platform (Panda, Wandboard ...) kernel build ipfiremake linux KCFG="-multi" + ipfiremake backports KCFG="-multi" ipfiremake cryptodev KCFG="-multi" ipfiremake e1000e KCFG="-multi" ipfiremake igb KCFG="-multi" @@ -439,6 +443,7 @@ buildipfire() {
# arm-kirkwood (Dreamplug, ICY-Box ...) kernel build ipfiremake linux KCFG="-kirkwood" + ipfiremake backports KCFG="-kirkwood" ipfiremake cryptodev KCFG="-kirkwood" ipfiremake e1000e KCFG="-kirkwood" ipfiremake igb KCFG="-kirkwood" diff --git a/src/patches/backports-3.18.1-1-grsecurity.patch b/src/patches/backports-3.18.1-1-grsecurity.patch new file mode 100644 index 0000000..711f2e3 --- /dev/null +++ b/src/patches/backports-3.18.1-1-grsecurity.patch @@ -0,0 +1,3806 @@ +diff -Naur backports-3.18.1-1.org/drivers/bluetooth/btwilink.c backports-3.18.1-1/drivers/bluetooth/btwilink.c +--- backports-3.18.1-1.org/drivers/bluetooth/btwilink.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/drivers/bluetooth/btwilink.c 2014-12-28 14:10:09.480888533 +0100 +@@ -288,7 +288,7 @@ + + static int bt_ti_probe(struct platform_device *pdev) + { +- static struct ti_st *hst; ++ struct ti_st *hst; + struct hci_dev *hdev; + int err; + +diff -Naur backports-3.18.1-1.org/drivers/media/dvb-core/dvbdev.c backports-3.18.1-1/drivers/media/dvb-core/dvbdev.c +--- backports-3.18.1-1.org/drivers/media/dvb-core/dvbdev.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/dvb-core/dvbdev.c 2014-12-28 14:10:09.528888772 +0100 +@@ -185,7 +185,7 @@ + const struct dvb_device *template, void *priv, int type) + { + struct dvb_device *dvbdev; +- struct file_operations *dvbdevfops; ++ file_operations_no_const *dvbdevfops; + struct device *clsdev; + int minor; + int id; +diff -Naur backports-3.18.1-1.org/drivers/media/dvb-frontends/af9033.h backports-3.18.1-1/drivers/media/dvb-frontends/af9033.h +--- backports-3.18.1-1.org/drivers/media/dvb-frontends/af9033.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/dvb-frontends/af9033.h 2014-12-28 14:10:09.528888772 +0100 +@@ -96,6 +96,6 @@ + int (*pid_filter_ctrl)(struct dvb_frontend *fe, int onoff); + int (*pid_filter)(struct dvb_frontend *fe, int index, u16 pid, + int onoff); +-}; ++} __no_const; + + #endif /* AF9033_H */ +diff -Naur backports-3.18.1-1.org/drivers/media/dvb-frontends/dib3000.h backports-3.18.1-1/drivers/media/dvb-frontends/dib3000.h +--- backports-3.18.1-1.org/drivers/media/dvb-frontends/dib3000.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/dvb-frontends/dib3000.h 2014-12-28 14:10:09.528888772 +0100 +@@ -39,7 +39,7 @@ + int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff); + int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff); + int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl); +-}; ++} __no_const; + + #if IS_ENABLED(CPTCFG_DVB_DIB3000MB) + extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config, +diff -Naur backports-3.18.1-1.org/drivers/media/dvb-frontends/dib7000p.h backports-3.18.1-1/drivers/media/dvb-frontends/dib7000p.h +--- backports-3.18.1-1.org/drivers/media/dvb-frontends/dib7000p.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/dvb-frontends/dib7000p.h 2014-12-28 14:10:09.528888772 +0100 +@@ -64,7 +64,7 @@ + int (*get_adc_power)(struct dvb_frontend *fe); + int (*slave_reset)(struct dvb_frontend *fe); + struct dvb_frontend *(*init)(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib7000p_config *cfg); +-}; ++} __no_const; + + #if IS_ENABLED(CPTCFG_DVB_DIB7000P) + void *dib7000p_attach(struct dib7000p_ops *ops); +diff -Naur backports-3.18.1-1.org/drivers/media/dvb-frontends/dib8000.h backports-3.18.1-1/drivers/media/dvb-frontends/dib8000.h +--- backports-3.18.1-1.org/drivers/media/dvb-frontends/dib8000.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/dvb-frontends/dib8000.h 2014-12-28 14:10:09.528888772 +0100 +@@ -61,7 +61,7 @@ + int (*pid_filter_ctrl)(struct dvb_frontend *fe, u8 onoff); + int (*pid_filter)(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff); + struct dvb_frontend *(*init)(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib8000_config *cfg); +-}; ++} __no_const; + + #if IS_ENABLED(CPTCFG_DVB_DIB8000) + void *dib8000_attach(struct dib8000_ops *ops); +diff -Naur backports-3.18.1-1.org/drivers/media/pci/cx88/cx88-video.c backports-3.18.1-1/drivers/media/pci/cx88/cx88-video.c +--- backports-3.18.1-1.org/drivers/media/pci/cx88/cx88-video.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/pci/cx88/cx88-video.c 2014-12-28 14:10:09.528888772 +0100 +@@ -50,9 +50,9 @@ + + /* ------------------------------------------------------------------ */ + +-static unsigned int video_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET }; +-static unsigned int vbi_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET }; +-static unsigned int radio_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET }; ++static int video_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET }; ++static int vbi_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET }; ++static int radio_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET }; + + module_param_array(video_nr, int, NULL, 0444); + module_param_array(vbi_nr, int, NULL, 0444); +diff -Naur backports-3.18.1-1.org/drivers/media/pci/ivtv/ivtv-driver.c backports-3.18.1-1/drivers/media/pci/ivtv/ivtv-driver.c +--- backports-3.18.1-1.org/drivers/media/pci/ivtv/ivtv-driver.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/pci/ivtv/ivtv-driver.c 2014-12-28 14:10:09.528888772 +0100 +@@ -83,7 +83,7 @@ + MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl); + + /* ivtv instance counter */ +-static atomic_t ivtv_instance = ATOMIC_INIT(0); ++static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0); + + /* Parameter declarations */ + static int cardtype[IVTV_MAX_CARDS]; +diff -Naur backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10-core.c backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10-core.c +--- backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10-core.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10-core.c 2014-12-28 14:10:09.528888772 +0100 +@@ -424,7 +424,7 @@ + + static int solo_sysfs_init(struct solo_dev *solo_dev) + { +- struct bin_attribute *sdram_attr = &solo_dev->sdram_attr; ++ bin_attribute_no_const *sdram_attr = &solo_dev->sdram_attr; + struct device *dev = &solo_dev->dev; + const char *driver; + int i; +diff -Naur backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10-g723.c backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10-g723.c +--- backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10-g723.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10-g723.c 2014-12-28 14:10:09.528888772 +0100 +@@ -351,7 +351,7 @@ + + int solo_g723_init(struct solo_dev *solo_dev) + { +- static struct snd_device_ops ops = { NULL }; ++ static struct snd_device_ops ops = { }; + struct snd_card *card; + struct snd_kcontrol_new kctl; + char name[32]; +diff -Naur backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10.h backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10.h +--- backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10.h 2014-12-28 14:10:09.532888798 +0100 +@@ -219,7 +219,7 @@ + + /* P2M DMA Engine */ + struct solo_p2m_dev p2m_dev[SOLO_NR_P2M]; +- atomic_t p2m_count; ++ atomic_unchecked_t p2m_count; + int p2m_jiffies; + unsigned int p2m_timeouts; + +diff -Naur backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10-p2m.c backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10-p2m.c +--- backports-3.18.1-1.org/drivers/media/pci/solo6x10/solo6x10-p2m.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/pci/solo6x10/solo6x10-p2m.c 2014-12-28 14:10:09.532888798 +0100 +@@ -73,7 +73,7 @@ + + /* Get next ID. According to Softlogic, 6110 has problems on !=0 P2M */ + if (solo_dev->type != SOLO_DEV_6110 && multi_p2m) { +- p2m_id = atomic_inc_return(&solo_dev->p2m_count) % SOLO_NR_P2M; ++ p2m_id = atomic_inc_return_unchecked(&solo_dev->p2m_count) % SOLO_NR_P2M; + if (p2m_id < 0) + p2m_id = -p2m_id; + } +diff -Naur backports-3.18.1-1.org/drivers/media/platform/omap/omap_vout.c backports-3.18.1-1/drivers/media/platform/omap/omap_vout.c +--- backports-3.18.1-1.org/drivers/media/platform/omap/omap_vout.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/platform/omap/omap_vout.c 2014-12-28 14:10:09.532888798 +0100 +@@ -63,7 +63,6 @@ + OMAP_VIDEO2, + }; + +-static struct videobuf_queue_ops video_vbq_ops; + /* Variables configurable through module params*/ + static u32 video1_numbuffers = 3; + static u32 video2_numbuffers = 3; +@@ -1012,6 +1011,12 @@ + { + struct videobuf_queue *q; + struct omap_vout_device *vout = NULL; ++ static struct videobuf_queue_ops video_vbq_ops = { ++ .buf_setup = omap_vout_buffer_setup, ++ .buf_prepare = omap_vout_buffer_prepare, ++ .buf_release = omap_vout_buffer_release, ++ .buf_queue = omap_vout_buffer_queue, ++ }; + + vout = video_drvdata(file); + v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, "Entering %s\n", __func__); +@@ -1029,10 +1034,6 @@ + vout->type = V4L2_BUF_TYPE_VIDEO_OUTPUT; + + q = &vout->vbq; +- video_vbq_ops.buf_setup = omap_vout_buffer_setup; +- video_vbq_ops.buf_prepare = omap_vout_buffer_prepare; +- video_vbq_ops.buf_release = omap_vout_buffer_release; +- video_vbq_ops.buf_queue = omap_vout_buffer_queue; + spin_lock_init(&vout->vbq_lock); + + videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev, +diff -Naur backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_grp_layer.c backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_grp_layer.c +--- backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_grp_layer.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_grp_layer.c 2014-12-28 14:10:09.532888798 +0100 +@@ -235,7 +235,7 @@ + { + struct mxr_layer *layer; + int ret; +- struct mxr_layer_ops ops = { ++ static struct mxr_layer_ops ops = { + .release = mxr_graph_layer_release, + .buffer_set = mxr_graph_buffer_set, + .stream_set = mxr_graph_stream_set, +diff -Naur backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer.h backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer.h +--- backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer.h 2014-12-28 14:10:09.532888798 +0100 +@@ -156,7 +156,7 @@ + /** layer index (unique identifier) */ + int idx; + /** callbacks for layer methods */ +- struct mxr_layer_ops ops; ++ struct mxr_layer_ops *ops; + /** format array */ + const struct mxr_format **fmt_array; + /** size of format array */ +diff -Naur backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_reg.c backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_reg.c +--- backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_reg.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_reg.c 2014-12-28 14:10:09.532888798 +0100 +@@ -276,7 +276,7 @@ + layer->update_buf = next; + } + +- layer->ops.buffer_set(layer, layer->update_buf); ++ layer->ops->buffer_set(layer, layer->update_buf); + + if (done && done != layer->shadow_buf) + vb2_buffer_done(&done->vb, VB2_BUF_STATE_DONE); +diff -Naur backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_video.c backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_video.c +--- backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_video.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_video.c 2014-12-28 14:10:09.532888798 +0100 +@@ -210,7 +210,7 @@ + layer->geo.src.height = layer->geo.src.full_height; + + mxr_geometry_dump(mdev, &layer->geo); +- layer->ops.fix_geometry(layer, MXR_GEOMETRY_SINK, 0); ++ layer->ops->fix_geometry(layer, MXR_GEOMETRY_SINK, 0); + mxr_geometry_dump(mdev, &layer->geo); + } + +@@ -228,7 +228,7 @@ + layer->geo.dst.full_width = mbus_fmt.width; + layer->geo.dst.full_height = mbus_fmt.height; + layer->geo.dst.field = mbus_fmt.field; +- layer->ops.fix_geometry(layer, MXR_GEOMETRY_SINK, 0); ++ layer->ops->fix_geometry(layer, MXR_GEOMETRY_SINK, 0); + + mxr_geometry_dump(mdev, &layer->geo); + } +@@ -334,7 +334,7 @@ + /* set source size to highest accepted value */ + geo->src.full_width = max(geo->dst.full_width, pix->width); + geo->src.full_height = max(geo->dst.full_height, pix->height); +- layer->ops.fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0); ++ layer->ops->fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0); + mxr_geometry_dump(mdev, &layer->geo); + /* set cropping to total visible screen */ + geo->src.width = pix->width; +@@ -342,12 +342,12 @@ + geo->src.x_offset = 0; + geo->src.y_offset = 0; + /* assure consistency of geometry */ +- layer->ops.fix_geometry(layer, MXR_GEOMETRY_CROP, MXR_NO_OFFSET); ++ layer->ops->fix_geometry(layer, MXR_GEOMETRY_CROP, MXR_NO_OFFSET); + mxr_geometry_dump(mdev, &layer->geo); + /* set full size to lowest possible value */ + geo->src.full_width = 0; + geo->src.full_height = 0; +- layer->ops.fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0); ++ layer->ops->fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0); + mxr_geometry_dump(mdev, &layer->geo); + + /* returning results */ +@@ -474,7 +474,7 @@ + target->width = s->r.width; + target->height = s->r.height; + +- layer->ops.fix_geometry(layer, stage, s->flags); ++ layer->ops->fix_geometry(layer, stage, s->flags); + + /* retrieve update selection rectangle */ + res.left = target->x_offset; +@@ -954,13 +954,13 @@ + mxr_output_get(mdev); + + mxr_layer_update_output(layer); +- layer->ops.format_set(layer); ++ layer->ops->format_set(layer); + /* enabling layer in hardware */ + spin_lock_irqsave(&layer->enq_slock, flags); + layer->state = MXR_LAYER_STREAMING; + spin_unlock_irqrestore(&layer->enq_slock, flags); + +- layer->ops.stream_set(layer, MXR_ENABLE); ++ layer->ops->stream_set(layer, MXR_ENABLE); + mxr_streamer_get(mdev); + + return 0; +@@ -1030,7 +1030,7 @@ + spin_unlock_irqrestore(&layer->enq_slock, flags); + + /* disabling layer in hardware */ +- layer->ops.stream_set(layer, MXR_DISABLE); ++ layer->ops->stream_set(layer, MXR_DISABLE); + /* remove one streamer */ + mxr_streamer_put(mdev); + /* allow changes in output configuration */ +@@ -1068,8 +1068,8 @@ + + void mxr_layer_release(struct mxr_layer *layer) + { +- if (layer->ops.release) +- layer->ops.release(layer); ++ if (layer->ops->release) ++ layer->ops->release(layer); + } + + void mxr_base_layer_release(struct mxr_layer *layer) +@@ -1095,7 +1095,7 @@ + + layer->mdev = mdev; + layer->idx = idx; +- layer->ops = *ops; ++ layer->ops = ops; + + spin_lock_init(&layer->enq_slock); + INIT_LIST_HEAD(&layer->enq_list); +diff -Naur backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_vp_layer.c backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_vp_layer.c +--- backports-3.18.1-1.org/drivers/media/platform/s5p-tv/mixer_vp_layer.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/platform/s5p-tv/mixer_vp_layer.c 2014-12-28 14:10:09.532888798 +0100 +@@ -206,7 +206,7 @@ + { + struct mxr_layer *layer; + int ret; +- struct mxr_layer_ops ops = { ++ static struct mxr_layer_ops ops = { + .release = mxr_vp_layer_release, + .buffer_set = mxr_vp_buffer_set, + .stream_set = mxr_vp_stream_set, +diff -Naur backports-3.18.1-1.org/drivers/media/radio/radio-cadet.c backports-3.18.1-1/drivers/media/radio/radio-cadet.c +--- backports-3.18.1-1.org/drivers/media/radio/radio-cadet.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/radio/radio-cadet.c 2014-12-28 14:10:09.532888798 +0100 +@@ -333,6 +333,8 @@ + unsigned char readbuf[RDS_BUFFER]; + int i = 0; + ++ if (count > RDS_BUFFER) ++ return -EFAULT; + mutex_lock(&dev->lock); + if (dev->rdsstat == 0) + cadet_start_rds(dev); +@@ -349,8 +351,9 @@ + readbuf[i++] = dev->rdsbuf[dev->rdsout++]; + mutex_unlock(&dev->lock); + +- if (i && copy_to_user(data, readbuf, i)) +- return -EFAULT; ++ if (i > sizeof(readbuf) || (i && copy_to_user(data, readbuf, i))) ++ i = -EFAULT; ++ + return i; + } + +diff -Naur backports-3.18.1-1.org/drivers/media/radio/radio-maxiradio.c backports-3.18.1-1/drivers/media/radio/radio-maxiradio.c +--- backports-3.18.1-1.org/drivers/media/radio/radio-maxiradio.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/radio/radio-maxiradio.c 2014-12-28 14:10:09.532888798 +0100 +@@ -61,7 +61,7 @@ + /* TEA5757 pin mappings */ + static const int clk = 1, data = 2, wren = 4, mo_st = 8, power = 16; + +-static atomic_t maxiradio_instance = ATOMIC_INIT(0); ++static atomic_unchecked_t maxiradio_instance = ATOMIC_INIT(0); + + #define PCI_VENDOR_ID_GUILLEMOT 0x5046 + #define PCI_DEVICE_ID_GUILLEMOT_MAXIRADIO 0x1001 +diff -Naur backports-3.18.1-1.org/drivers/media/radio/radio-shark2.c backports-3.18.1-1/drivers/media/radio/radio-shark2.c +--- backports-3.18.1-1.org/drivers/media/radio/radio-shark2.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/radio/radio-shark2.c 2014-12-28 14:10:09.532888798 +0100 +@@ -74,7 +74,7 @@ + u8 *transfer_buffer; + }; + +-static atomic_t shark_instance = ATOMIC_INIT(0); ++static atomic_unchecked_t shark_instance = ATOMIC_INIT(0); + + static int shark_write_reg(struct radio_tea5777 *tea, u64 reg) + { +diff -Naur backports-3.18.1-1.org/drivers/media/radio/radio-shark.c backports-3.18.1-1/drivers/media/radio/radio-shark.c +--- backports-3.18.1-1.org/drivers/media/radio/radio-shark.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/radio/radio-shark.c 2014-12-28 14:10:09.532888798 +0100 +@@ -79,7 +79,7 @@ + u32 last_val; + }; + +-static atomic_t shark_instance = ATOMIC_INIT(0); ++static atomic_unchecked_t shark_instance = ATOMIC_INIT(0); + + static void shark_write_val(struct snd_tea575x *tea, u32 val) + { +diff -Naur backports-3.18.1-1.org/drivers/media/radio/radio-si476x.c backports-3.18.1-1/drivers/media/radio/radio-si476x.c +--- backports-3.18.1-1.org/drivers/media/radio/radio-si476x.c 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/radio/radio-si476x.c 2014-12-28 14:10:09.532888798 +0100 +@@ -1445,7 +1445,7 @@ + struct si476x_radio *radio; + struct v4l2_ctrl *ctrl; + +- static atomic_t instance = ATOMIC_INIT(0); ++ static atomic_unchecked_t instance = ATOMIC_INIT(0); + + radio = devm_kzalloc(&pdev->dev, sizeof(*radio), GFP_KERNEL); + if (!radio) +diff -Naur backports-3.18.1-1.org/drivers/media/usb/dvb-usb/cinergyT2-core.c backports-3.18.1-1/drivers/media/usb/dvb-usb/cinergyT2-core.c +--- backports-3.18.1-1.org/drivers/media/usb/dvb-usb/cinergyT2-core.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/usb/dvb-usb/cinergyT2-core.c 2014-12-28 14:10:09.532888798 +0100 +@@ -50,29 +50,73 @@ + + static int cinergyt2_streaming_ctrl(struct dvb_usb_adapter *adap, int enable) + { +- char buf[] = { CINERGYT2_EP1_CONTROL_STREAM_TRANSFER, enable ? 1 : 0 }; +- char result[64]; +- return dvb_usb_generic_rw(adap->dev, buf, sizeof(buf), result, +- sizeof(result), 0); ++ char *buf; ++ char *result; ++ int retval; ++ ++ buf = kmalloc(2, GFP_KERNEL); ++ if (buf == NULL) ++ return -ENOMEM; ++ result = kmalloc(64, GFP_KERNEL); ++ if (result == NULL) { ++ kfree(buf); ++ return -ENOMEM; ++ } ++ ++ buf[0] = CINERGYT2_EP1_CONTROL_STREAM_TRANSFER; ++ buf[1] = enable ? 1 : 0; ++ ++ retval = dvb_usb_generic_rw(adap->dev, buf, 2, result, 64, 0); ++ ++ kfree(buf); ++ kfree(result); ++ return retval; + } + + static int cinergyt2_power_ctrl(struct dvb_usb_device *d, int enable) + { +- char buf[] = { CINERGYT2_EP1_SLEEP_MODE, enable ? 0 : 1 }; +- char state[3]; +- return dvb_usb_generic_rw(d, buf, sizeof(buf), state, sizeof(state), 0); ++ char *buf; ++ char *state; ++ int retval; ++ ++ buf = kmalloc(2, GFP_KERNEL); ++ if (buf == NULL) ++ return -ENOMEM; ++ state = kmalloc(3, GFP_KERNEL); ++ if (state == NULL) { ++ kfree(buf); ++ return -ENOMEM; ++ } ++ ++ buf[0] = CINERGYT2_EP1_SLEEP_MODE; ++ buf[1] = enable ? 1 : 0; ++ ++ retval = dvb_usb_generic_rw(d, buf, 2, state, 3, 0); ++ ++ kfree(buf); ++ kfree(state); ++ return retval; + } + + static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap) + { +- char query[] = { CINERGYT2_EP1_GET_FIRMWARE_VERSION }; +- char state[3]; ++ char *query; ++ char *state; + int ret; ++ query = kmalloc(1, GFP_KERNEL); ++ if (query == NULL) ++ return -ENOMEM; ++ state = kmalloc(3, GFP_KERNEL); ++ if (state == NULL) { ++ kfree(query); ++ return -ENOMEM; ++ } ++ ++ query[0] = CINERGYT2_EP1_GET_FIRMWARE_VERSION; + + adap->fe_adap[0].fe = cinergyt2_fe_attach(adap->dev); + +- ret = dvb_usb_generic_rw(adap->dev, query, sizeof(query), state, +- sizeof(state), 0); ++ ret = dvb_usb_generic_rw(adap->dev, query, 1, state, 3, 0); + if (ret < 0) { + deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep " + "state info\n"); +@@ -80,7 +124,8 @@ + + /* Copy this pointer as we are gonna need it in the release phase */ + cinergyt2_usb_device = adap->dev; +- ++ kfree(query); ++ kfree(state); + return 0; + } + +@@ -141,12 +186,23 @@ + static int cinergyt2_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + { + struct cinergyt2_state *st = d->priv; +- u8 key[5] = {0, 0, 0, 0, 0}, cmd = CINERGYT2_EP1_GET_RC_EVENTS; ++ u8 *key, *cmd; + int i; + ++ cmd = kmalloc(1, GFP_KERNEL); ++ if (cmd == NULL) ++ return -EINVAL; ++ key = kzalloc(5, GFP_KERNEL); ++ if (key == NULL) { ++ kfree(cmd); ++ return -EINVAL; ++ } ++ ++ cmd[0] = CINERGYT2_EP1_GET_RC_EVENTS; ++ + *state = REMOTE_NO_KEY_PRESSED; + +- dvb_usb_generic_rw(d, &cmd, 1, key, sizeof(key), 0); ++ dvb_usb_generic_rw(d, cmd, 1, key, 5, 0); + if (key[4] == 0xff) { + /* key repeat */ + st->rc_counter++; +@@ -157,12 +213,12 @@ + *event = d->last_event; + deb_rc("repeat key, event %x\n", + *event); +- return 0; ++ goto out; + } + } + deb_rc("repeated key (non repeatable)\n"); + } +- return 0; ++ goto out; + } + + /* hack to pass checksum on the custom field */ +@@ -174,6 +230,9 @@ + + deb_rc("key: %*ph\n", 5, key); + } ++out: ++ kfree(cmd); ++ kfree(key); + return 0; + } + +diff -Naur backports-3.18.1-1.org/drivers/media/usb/dvb-usb/cinergyT2-fe.c backports-3.18.1-1/drivers/media/usb/dvb-usb/cinergyT2-fe.c +--- backports-3.18.1-1.org/drivers/media/usb/dvb-usb/cinergyT2-fe.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/usb/dvb-usb/cinergyT2-fe.c 2014-12-28 14:10:09.532888798 +0100 +@@ -145,103 +145,176 @@ + fe_status_t *status) + { + struct cinergyt2_fe_state *state = fe->demodulator_priv; +- struct dvbt_get_status_msg result; +- u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; ++ struct dvbt_get_status_msg *result; ++ u8 *cmd; + int ret; + +- ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&result, +- sizeof(result), 0); ++ cmd = kmalloc(1, GFP_KERNEL); ++ if (cmd == NULL) ++ return -ENOMEM; ++ result = kmalloc(sizeof(*result), GFP_KERNEL); ++ if (result == NULL) { ++ kfree(cmd); ++ return -ENOMEM; ++ } ++ ++ cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS; ++ ++ ret = dvb_usb_generic_rw(state->d, cmd, 1, (u8 *)result, ++ sizeof(*result), 0); + if (ret < 0) +- return ret; ++ goto out; + + *status = 0; + +- if (0xffff - le16_to_cpu(result.gain) > 30) ++ if (0xffff - le16_to_cpu(result->gain) > 30) + *status |= FE_HAS_SIGNAL; +- if (result.lock_bits & (1 << 6)) ++ if (result->lock_bits & (1 << 6)) + *status |= FE_HAS_LOCK; +- if (result.lock_bits & (1 << 5)) ++ if (result->lock_bits & (1 << 5)) + *status |= FE_HAS_SYNC; +- if (result.lock_bits & (1 << 4)) ++ if (result->lock_bits & (1 << 4)) + *status |= FE_HAS_CARRIER; +- if (result.lock_bits & (1 << 1)) ++ if (result->lock_bits & (1 << 1)) + *status |= FE_HAS_VITERBI; + + if ((*status & (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) != + (FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC)) + *status &= ~FE_HAS_LOCK; + +- return 0; ++out: ++ kfree(cmd); ++ kfree(result); ++ return ret; + } + + static int cinergyt2_fe_read_ber(struct dvb_frontend *fe, u32 *ber) + { + struct cinergyt2_fe_state *state = fe->demodulator_priv; +- struct dvbt_get_status_msg status; +- char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; ++ struct dvbt_get_status_msg *status; ++ char *cmd; + int ret; + +- ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status, +- sizeof(status), 0); ++ cmd = kmalloc(1, GFP_KERNEL); ++ if (cmd == NULL) ++ return -ENOMEM; ++ status = kmalloc(sizeof(*status), GFP_KERNEL); ++ if (status == NULL) { ++ kfree(cmd); ++ return -ENOMEM; ++ } ++ ++ cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS; ++ ++ ret = dvb_usb_generic_rw(state->d, cmd, 1, (char *)status, ++ sizeof(*status), 0); + if (ret < 0) +- return ret; ++ goto out; + +- *ber = le32_to_cpu(status.viterbi_error_rate); ++ *ber = le32_to_cpu(status->viterbi_error_rate); ++out: ++ kfree(cmd); ++ kfree(status); + return 0; + } + + static int cinergyt2_fe_read_unc_blocks(struct dvb_frontend *fe, u32 *unc) + { + struct cinergyt2_fe_state *state = fe->demodulator_priv; +- struct dvbt_get_status_msg status; +- u8 cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; ++ struct dvbt_get_status_msg *status; ++ u8 *cmd; + int ret; + +- ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (u8 *)&status, +- sizeof(status), 0); ++ cmd = kmalloc(1, GFP_KERNEL); ++ if (cmd == NULL) ++ return -ENOMEM; ++ status = kmalloc(sizeof(*status), GFP_KERNEL); ++ if (status == NULL) { ++ kfree(cmd); ++ return -ENOMEM; ++ } ++ ++ cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS; ++ ++ ret = dvb_usb_generic_rw(state->d, cmd, 1, (u8 *)status, ++ sizeof(*status), 0); + if (ret < 0) { + err("cinergyt2_fe_read_unc_blocks() Failed! (Error=%d)\n", + ret); +- return ret; ++ goto out; + } +- *unc = le32_to_cpu(status.uncorrected_block_count); +- return 0; ++ *unc = le32_to_cpu(status->uncorrected_block_count); ++ ++out: ++ kfree(cmd); ++ kfree(status); ++ return ret; + } + + static int cinergyt2_fe_read_signal_strength(struct dvb_frontend *fe, + u16 *strength) + { + struct cinergyt2_fe_state *state = fe->demodulator_priv; +- struct dvbt_get_status_msg status; +- char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; ++ struct dvbt_get_status_msg *status; ++ char *cmd; + int ret; + +- ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status, +- sizeof(status), 0); ++ cmd = kmalloc(1, GFP_KERNEL); ++ if (cmd == NULL) ++ return -ENOMEM; ++ status = kmalloc(sizeof(*status), GFP_KERNEL); ++ if (status == NULL) { ++ kfree(cmd); ++ return -ENOMEM; ++ } ++ ++ cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS; ++ ++ ret = dvb_usb_generic_rw(state->d, cmd, 1, (char *)status, ++ sizeof(*status), 0); + if (ret < 0) { + err("cinergyt2_fe_read_signal_strength() Failed!" + " (Error=%d)\n", ret); +- return ret; ++ goto out; + } +- *strength = (0xffff - le16_to_cpu(status.gain)); ++ *strength = (0xffff - le16_to_cpu(status->gain)); ++ ++out: ++ kfree(cmd); ++ kfree(status); + return 0; + } + + static int cinergyt2_fe_read_snr(struct dvb_frontend *fe, u16 *snr) + { + struct cinergyt2_fe_state *state = fe->demodulator_priv; +- struct dvbt_get_status_msg status; +- char cmd[] = { CINERGYT2_EP1_GET_TUNER_STATUS }; ++ struct dvbt_get_status_msg *status; ++ char *cmd; + int ret; + +- ret = dvb_usb_generic_rw(state->d, cmd, sizeof(cmd), (char *)&status, +- sizeof(status), 0); ++ cmd = kmalloc(1, GFP_KERNEL); ++ if (cmd == NULL) ++ return -ENOMEM; ++ status = kmalloc(sizeof(*status), GFP_KERNEL); ++ if (status == NULL) { ++ kfree(cmd); ++ return -ENOMEM; ++ } ++ ++ cmd[0] = CINERGYT2_EP1_GET_TUNER_STATUS; ++ ++ ret = dvb_usb_generic_rw(state->d, cmd, 1, (char *)status, ++ sizeof(*status), 0); + if (ret < 0) { + err("cinergyt2_fe_read_snr() Failed! (Error=%d)\n", ret); +- return ret; ++ goto out; + } +- *snr = (status.snr << 8) | status.snr; +- return 0; ++ *snr = (status->snr << 8) | status->snr; ++ ++out: ++ kfree(cmd); ++ kfree(status); ++ return ret; + } + + static int cinergyt2_fe_init(struct dvb_frontend *fe) +@@ -266,35 +339,46 @@ + { + struct dtv_frontend_properties *fep = &fe->dtv_property_cache; + struct cinergyt2_fe_state *state = fe->demodulator_priv; +- struct dvbt_set_parameters_msg param; +- char result[2]; ++ struct dvbt_set_parameters_msg *param; ++ char *result; + int err; + +- param.cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS; +- param.tps = cpu_to_le16(compute_tps(fep)); +- param.freq = cpu_to_le32(fep->frequency / 1000); +- param.flags = 0; ++ result = kmalloc(2, GFP_KERNEL); ++ if (result == NULL) ++ return -ENOMEM; ++ param = kmalloc(sizeof(*param), GFP_KERNEL); ++ if (param == NULL) { ++ kfree(result); ++ return -ENOMEM; ++ } ++ ++ param->cmd = CINERGYT2_EP1_SET_TUNER_PARAMETERS; ++ param->tps = cpu_to_le16(compute_tps(fep)); ++ param->freq = cpu_to_le32(fep->frequency / 1000); ++ param->flags = 0; + + switch (fep->bandwidth_hz) { + default: + case 8000000: +- param.bandwidth = 8; ++ param->bandwidth = 8; + break; + case 7000000: +- param.bandwidth = 7; ++ param->bandwidth = 7; + break; + case 6000000: +- param.bandwidth = 6; ++ param->bandwidth = 6; + break; + } + + err = dvb_usb_generic_rw(state->d, +- (char *)¶m, sizeof(param), +- result, sizeof(result), 0); ++ (char *)param, sizeof(*param), ++ result, 2, 0); + if (err < 0) + err("cinergyt2_fe_set_frontend() Failed! err=%d\n", err); + +- return (err < 0) ? err : 0; ++ kfree(result); ++ kfree(param); ++ return err; + } + + static void cinergyt2_fe_release(struct dvb_frontend *fe) +diff -Naur backports-3.18.1-1.org/drivers/media/usb/dvb-usb/dvb-usb-firmware.c backports-3.18.1-1/drivers/media/usb/dvb-usb/dvb-usb-firmware.c +--- backports-3.18.1-1.org/drivers/media/usb/dvb-usb/dvb-usb-firmware.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/usb/dvb-usb/dvb-usb-firmware.c 2014-12-28 14:10:09.532888798 +0100 +@@ -35,42 +35,57 @@ + + int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type) + { +- struct hexline hx; +- u8 reset; ++ struct hexline *hx; ++ u8 *reset; + int ret,pos=0; + ++ reset = kmalloc(1, GFP_KERNEL); ++ if (reset == NULL) ++ return -ENOMEM; ++ ++ hx = kmalloc(sizeof(struct hexline), GFP_KERNEL); ++ if (hx == NULL) { ++ kfree(reset); ++ return -ENOMEM; ++ } ++ + /* stop the CPU */ +- reset = 1; +- if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1) ++ reset[0] = 1; ++ if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1)) != 1) + err("could not stop the USB controller CPU."); + +- while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) { +- deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk); +- ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len); ++ while ((ret = dvb_usb_get_hexline(fw,hx,&pos)) > 0) { ++ deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx->addr,hx->len,hx->chk); ++ ret = usb_cypress_writemem(udev,hx->addr,hx->data,hx->len); + +- if (ret != hx.len) { ++ if (ret != hx->len) { + err("error while transferring firmware " + "(transferred size: %d, block size: %d)", +- ret,hx.len); ++ ret,hx->len); + ret = -EINVAL; + break; + } + } + if (ret < 0) { + err("firmware download failed at %d with %d",pos,ret); ++ kfree(reset); ++ kfree(hx); + return ret; + } + + if (ret == 0) { + /* restart the CPU */ +- reset = 0; +- if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) { ++ reset[0] = 0; ++ if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1) != 1) { + err("could not restart the USB controller CPU."); + ret = -EINVAL; + } + } else + ret = -EIO; + ++ kfree(reset); ++ kfree(hx); ++ + return ret; + } + EXPORT_SYMBOL(usb_cypress_load_firmware); +diff -Naur backports-3.18.1-1.org/drivers/media/usb/dvb-usb/dw2102.c backports-3.18.1-1/drivers/media/usb/dvb-usb/dw2102.c +--- backports-3.18.1-1.org/drivers/media/usb/dvb-usb/dw2102.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/usb/dvb-usb/dw2102.c 2014-12-28 14:10:09.536888811 +0100 +@@ -118,7 +118,7 @@ + + struct s6x0_state { + int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v); +-}; ++} __no_const; + + /* debug */ + static int dvb_usb_dw2102_debug; +diff -Naur backports-3.18.1-1.org/drivers/media/usb/dvb-usb/technisat-usb2.c backports-3.18.1-1/drivers/media/usb/dvb-usb/technisat-usb2.c +--- backports-3.18.1-1.org/drivers/media/usb/dvb-usb/technisat-usb2.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/usb/dvb-usb/technisat-usb2.c 2014-12-28 14:10:09.536888811 +0100 +@@ -87,8 +87,11 @@ + static int technisat_usb2_i2c_access(struct usb_device *udev, + u8 device_addr, u8 *tx, u8 txlen, u8 *rx, u8 rxlen) + { +- u8 b[64]; +- int ret, actual_length; ++ u8 *b = kmalloc(64, GFP_KERNEL); ++ int ret, actual_length, error = 0; ++ ++ if (b == NULL) ++ return -ENOMEM; + + deb_i2c("i2c-access: %02x, tx: ", device_addr); + debug_dump(tx, txlen, deb_i2c); +@@ -121,7 +124,8 @@ + + if (ret < 0) { + err("i2c-error: out failed %02x = %d", device_addr, ret); +- return -ENODEV; ++ error = -ENODEV; ++ goto out; + } + + ret = usb_bulk_msg(udev, +@@ -129,7 +133,8 @@ + b, 64, &actual_length, 1000); + if (ret < 0) { + err("i2c-error: in failed %02x = %d", device_addr, ret); +- return -ENODEV; ++ error = -ENODEV; ++ goto out; + } + + if (b[0] != I2C_STATUS_OK) { +@@ -137,8 +142,10 @@ + /* handle tuner-i2c-nak */ + if (!(b[0] == I2C_STATUS_NAK && + device_addr == 0x60 +- /* && device_is_technisat_usb2 */)) +- return -ENODEV; ++ /* && device_is_technisat_usb2 */)) { ++ error = -ENODEV; ++ goto out; ++ } + } + + deb_i2c("status: %d, ", b[0]); +@@ -152,7 +159,9 @@ + + deb_i2c("\n"); + +- return 0; ++out: ++ kfree(b); ++ return error; + } + + static int technisat_usb2_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, +@@ -224,14 +233,16 @@ + { + int ret; + +- u8 led[8] = { +- red ? SET_RED_LED_VENDOR_REQUEST : SET_GREEN_LED_VENDOR_REQUEST, +- 0 +- }; ++ u8 *led = kzalloc(8, GFP_KERNEL); ++ ++ if (led == NULL) ++ return -ENOMEM; + + if (disable_led_control && state != TECH_LED_OFF) + return 0; + ++ led[0] = red ? SET_RED_LED_VENDOR_REQUEST : SET_GREEN_LED_VENDOR_REQUEST; ++ + switch (state) { + case TECH_LED_ON: + led[1] = 0x82; +@@ -263,16 +274,22 @@ + red ? SET_RED_LED_VENDOR_REQUEST : SET_GREEN_LED_VENDOR_REQUEST, + USB_TYPE_VENDOR | USB_DIR_OUT, + 0, 0, +- led, sizeof(led), 500); ++ led, 8, 500); + + mutex_unlock(&d->i2c_mutex); ++ ++ kfree(led); ++ + return ret; + } + + static int technisat_usb2_set_led_timer(struct dvb_usb_device *d, u8 red, u8 green) + { + int ret; +- u8 b = 0; ++ u8 *b = kzalloc(1, GFP_KERNEL); ++ ++ if (b == NULL) ++ return -ENOMEM; + + if (mutex_lock_interruptible(&d->i2c_mutex) < 0) + return -EAGAIN; +@@ -281,10 +298,12 @@ + SET_LED_TIMER_DIVIDER_VENDOR_REQUEST, + USB_TYPE_VENDOR | USB_DIR_OUT, + (red << 8) | green, 0, +- &b, 1, 500); ++ b, 1, 500); + + mutex_unlock(&d->i2c_mutex); + ++ kfree(b); ++ + return ret; + } + +@@ -328,7 +347,7 @@ + struct dvb_usb_device_description **desc, int *cold) + { + int ret; +- u8 version[3]; ++ u8 *version = kmalloc(3, GFP_KERNEL); + + /* first select the interface */ + if (usb_set_interface(udev, 0, 1) != 0) +@@ -338,11 +357,14 @@ + + *cold = 0; /* by default do not download a firmware - just in case something is wrong */ + ++ if (version == NULL) ++ return 0; ++ + ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + GET_VERSION_INFO_VENDOR_REQUEST, + USB_TYPE_VENDOR | USB_DIR_IN, + 0, 0, +- version, sizeof(version), 500); ++ version, 3, 500); + + if (ret < 0) + *cold = 1; +@@ -351,6 +373,8 @@ + *cold = 0; + } + ++ kfree(version); ++ + return 0; + } + +@@ -591,10 +615,15 @@ + + static int technisat_usb2_get_ir(struct dvb_usb_device *d) + { +- u8 buf[62], *b; ++ u8 *buf, *b; + int ret; + struct ir_raw_event ev; + ++ buf = kmalloc(62, GFP_KERNEL); ++ ++ if (buf == NULL) ++ return -ENOMEM; ++ + buf[0] = GET_IR_DATA_VENDOR_REQUEST; + buf[1] = 0x08; + buf[2] = 0x8f; +@@ -617,16 +646,20 @@ + GET_IR_DATA_VENDOR_REQUEST, + USB_TYPE_VENDOR | USB_DIR_IN, + 0x8080, 0, +- buf, sizeof(buf), 500); ++ buf, 62, 500); + + unlock: + mutex_unlock(&d->i2c_mutex); + +- if (ret < 0) ++ if (ret < 0) { ++ kfree(buf); + return ret; ++ } + +- if (ret == 1) ++ if (ret == 1) { ++ kfree(buf); + return 0; /* no key pressed */ ++ } + + /* decoding */ + b = buf+1; +@@ -653,6 +686,8 @@ + + ir_raw_event_handle(d->rc_dev); + ++ kfree(buf); ++ + return 1; + } + +diff -Naur backports-3.18.1-1.org/drivers/media/v4l2-core/v4l2-device.c backports-3.18.1-1/drivers/media/v4l2-core/v4l2-device.c +--- backports-3.18.1-1.org/drivers/media/v4l2-core/v4l2-device.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/v4l2-core/v4l2-device.c 2014-12-28 14:10:09.536888811 +0100 +@@ -75,9 +75,9 @@ + EXPORT_SYMBOL_GPL(v4l2_device_put); + + int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename, +- atomic_t *instance) ++ atomic_unchecked_t *instance) + { +- int num = atomic_inc_return(instance) - 1; ++ int num = atomic_inc_return_unchecked(instance) - 1; + int len = strlen(basename); + + if (basename[len - 1] >= '0' && basename[len - 1] <= '9') +diff -Naur backports-3.18.1-1.org/drivers/media/v4l2-core/v4l2-ioctl.c backports-3.18.1-1/drivers/media/v4l2-core/v4l2-ioctl.c +--- backports-3.18.1-1.org/drivers/media/v4l2-core/v4l2-ioctl.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/media/v4l2-core/v4l2-ioctl.c 2014-12-28 14:10:09.536888811 +0100 +@@ -2142,7 +2142,8 @@ + struct file *file, void *fh, void *p); + } u; + void (*debug)(const void *arg, bool write_only); +-}; ++} __do_const; ++typedef struct v4l2_ioctl_info __no_const v4l2_ioctl_info_no_const; + + /* This control needs a priority check */ + #define INFO_FL_PRIO (1 << 0) +@@ -2326,7 +2327,7 @@ + struct video_device *vfd = video_devdata(file); + const struct v4l2_ioctl_ops *ops = vfd->ioctl_ops; + bool write_only = false; +- struct v4l2_ioctl_info default_info; ++ v4l2_ioctl_info_no_const default_info; + const struct v4l2_ioctl_info *info; + void *fh = file->private_data; + struct v4l2_fh *vfh = NULL; +@@ -2413,7 +2414,7 @@ + ret = -EINVAL; + break; + } +- *user_ptr = (void __user *)buf->m.planes; ++ *user_ptr = (void __force_user *)buf->m.planes; + *kernel_ptr = (void **)&buf->m.planes; + *array_size = sizeof(struct v4l2_plane) * buf->length; + ret = 1; +@@ -2430,7 +2431,7 @@ + ret = -EINVAL; + break; + } +- *user_ptr = (void __user *)edid->edid; ++ *user_ptr = (void __force_user *)edid->edid; + *kernel_ptr = (void **)&edid->edid; + *array_size = edid->blocks * 128; + ret = 1; +@@ -2448,7 +2449,7 @@ + ret = -EINVAL; + break; + } +- *user_ptr = (void __user *)ctrls->controls; ++ *user_ptr = (void __force_user *)ctrls->controls; + *kernel_ptr = (void **)&ctrls->controls; + *array_size = sizeof(struct v4l2_ext_control) + * ctrls->count; +@@ -2549,7 +2550,7 @@ + } + + if (has_array_args) { +- *kernel_ptr = (void __force *)user_ptr; ++ *kernel_ptr = (void __force_kernel *)user_ptr; + if (copy_to_user(user_ptr, mbuf, array_size)) + err = -EFAULT; + goto out_array_args; +diff -Naur backports-3.18.1-1.org/drivers/net/ieee802154/fakehard.c backports-3.18.1-1/drivers/net/ieee802154/fakehard.c +--- backports-3.18.1-1.org/drivers/net/ieee802154/fakehard.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/ieee802154/fakehard.c 2014-12-28 14:10:09.556888909 +0100 +@@ -365,7 +365,7 @@ + phy->transmit_power = 0xbf; + + dev->netdev_ops = &fake_ops; +- dev->ml_priv = &fake_mlme; ++ dev->ml_priv = (void *)&fake_mlme; + + priv = netdev_priv(dev); + priv->phy = phy; +diff -Naur backports-3.18.1-1.org/drivers/net/usb/sierra_net.c backports-3.18.1-1/drivers/net/usb/sierra_net.c +--- backports-3.18.1-1.org/drivers/net/usb/sierra_net.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/usb/sierra_net.c 2014-12-28 14:10:09.560888936 +0100 +@@ -51,7 +51,7 @@ + /* atomic counter partially included in MAC address to make sure 2 devices + * do not end up with the same MAC - concept breaks in case of > 255 ifaces + */ +-static atomic_t iface_counter = ATOMIC_INIT(0); ++static atomic_unchecked_t iface_counter = ATOMIC_INIT(0); + + /* + * SYNC Timer Delay definition used to set the expiry time +@@ -697,7 +697,7 @@ + dev->net->netdev_ops = &sierra_net_device_ops; + + /* change MAC addr to include, ifacenum, and to be unique */ +- dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter); ++ dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return_unchecked(&iface_counter); + dev->net->dev_addr[ETH_ALEN-1] = ifacenum; + + /* we will have to manufacture ethernet headers, prepare template */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/at76c50x-usb.c backports-3.18.1-1/drivers/net/wireless/at76c50x-usb.c +--- backports-3.18.1-1.org/drivers/net/wireless/at76c50x-usb.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/at76c50x-usb.c 2014-12-28 14:10:09.560888936 +0100 +@@ -353,7 +353,7 @@ + } + + /* Convert timeout from the DFU status to jiffies */ +-static inline unsigned long at76_get_timeout(struct dfu_status *s) ++static inline unsigned long __intentional_overflow(-1) at76_get_timeout(struct dfu_status *s) + { + return msecs_to_jiffies((s->poll_timeout[2] << 16) + | (s->poll_timeout[1] << 8) +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ath/ath10k/htc.c backports-3.18.1-1/drivers/net/wireless/ath/ath10k/htc.c +--- backports-3.18.1-1.org/drivers/net/wireless/ath/ath10k/htc.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ath/ath10k/htc.c 2014-12-28 14:10:09.560888936 +0100 +@@ -848,7 +848,10 @@ + /* registered target arrival callback from the HIF layer */ + int ath10k_htc_init(struct ath10k *ar) + { +- struct ath10k_hif_cb htc_callbacks; ++ static struct ath10k_hif_cb htc_callbacks = { ++ .rx_completion = ath10k_htc_rx_completion_handler, ++ .tx_completion = ath10k_htc_tx_completion_handler, ++ }; + struct ath10k_htc_ep *ep = NULL; + struct ath10k_htc *htc = &ar->htc; + +@@ -857,8 +860,6 @@ + ath10k_htc_reset_endpoint_states(htc); + + /* setup HIF layer callbacks */ +- htc_callbacks.rx_completion = ath10k_htc_rx_completion_handler; +- htc_callbacks.tx_completion = ath10k_htc_tx_completion_handler; + htc->ar = ar; + + /* Get HIF default pipe for HTC message exchange */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ath/ath10k/htc.h backports-3.18.1-1/drivers/net/wireless/ath/ath10k/htc.h +--- backports-3.18.1-1.org/drivers/net/wireless/ath/ath10k/htc.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ath/ath10k/htc.h 2014-12-28 14:10:09.560888936 +0100 +@@ -270,13 +270,13 @@ + + struct ath10k_htc_ops { + void (*target_send_suspend_complete)(struct ath10k *ar); +-}; ++} __no_const; + + struct ath10k_htc_ep_ops { + void (*ep_tx_complete)(struct ath10k *, struct sk_buff *); + void (*ep_rx_complete)(struct ath10k *, struct sk_buff *); + void (*ep_tx_credits)(struct ath10k *); +-}; ++} __no_const; + + /* service connection information */ + struct ath10k_htc_svc_conn_req { +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/ar9002_mac.c backports-3.18.1-1/drivers/net/wireless/ath/ath9k/ar9002_mac.c +--- backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/ar9002_mac.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ath/ath9k/ar9002_mac.c 2014-12-28 14:10:09.560888936 +0100 +@@ -220,8 +220,8 @@ + ads->ds_txstatus6 = ads->ds_txstatus7 = 0; + ads->ds_txstatus8 = ads->ds_txstatus9 = 0; + +- ACCESS_ONCE(ads->ds_link) = i->link; +- ACCESS_ONCE(ads->ds_data) = i->buf_addr[0]; ++ ACCESS_ONCE_RW(ads->ds_link) = i->link; ++ ACCESS_ONCE_RW(ads->ds_data) = i->buf_addr[0]; + + ctl1 = i->buf_len[0] | (i->is_last ? 0 : AR_TxMore); + ctl6 = SM(i->keytype, AR_EncrType); +@@ -235,26 +235,26 @@ + + if ((i->is_first || i->is_last) && + i->aggr != AGGR_BUF_MIDDLE && i->aggr != AGGR_BUF_LAST) { +- ACCESS_ONCE(ads->ds_ctl2) = set11nTries(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ds_ctl2) = set11nTries(i->rates, 0) + | set11nTries(i->rates, 1) + | set11nTries(i->rates, 2) + | set11nTries(i->rates, 3) + | (i->dur_update ? AR_DurUpdateEna : 0) + | SM(0, AR_BurstDur); + +- ACCESS_ONCE(ads->ds_ctl3) = set11nRate(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ds_ctl3) = set11nRate(i->rates, 0) + | set11nRate(i->rates, 1) + | set11nRate(i->rates, 2) + | set11nRate(i->rates, 3); + } else { +- ACCESS_ONCE(ads->ds_ctl2) = 0; +- ACCESS_ONCE(ads->ds_ctl3) = 0; ++ ACCESS_ONCE_RW(ads->ds_ctl2) = 0; ++ ACCESS_ONCE_RW(ads->ds_ctl3) = 0; + } + + if (!i->is_first) { +- ACCESS_ONCE(ads->ds_ctl0) = 0; +- ACCESS_ONCE(ads->ds_ctl1) = ctl1; +- ACCESS_ONCE(ads->ds_ctl6) = ctl6; ++ ACCESS_ONCE_RW(ads->ds_ctl0) = 0; ++ ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1; ++ ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6; + return; + } + +@@ -279,7 +279,7 @@ + break; + } + +- ACCESS_ONCE(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen) ++ ACCESS_ONCE_RW(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen) + | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0) + | SM(i->txpower, AR_XmitPower0) + | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0) +@@ -289,27 +289,27 @@ + | (i->flags & ATH9K_TXDESC_RTSENA ? AR_RTSEnable : + (i->flags & ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0)); + +- ACCESS_ONCE(ads->ds_ctl1) = ctl1; +- ACCESS_ONCE(ads->ds_ctl6) = ctl6; ++ ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1; ++ ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6; + + if (i->aggr == AGGR_BUF_MIDDLE || i->aggr == AGGR_BUF_LAST) + return; + +- ACCESS_ONCE(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0) + | set11nPktDurRTSCTS(i->rates, 1); + +- ACCESS_ONCE(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2) ++ ACCESS_ONCE_RW(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2) + | set11nPktDurRTSCTS(i->rates, 3); + +- ACCESS_ONCE(ads->ds_ctl7) = set11nRateFlags(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ds_ctl7) = set11nRateFlags(i->rates, 0) + | set11nRateFlags(i->rates, 1) + | set11nRateFlags(i->rates, 2) + | set11nRateFlags(i->rates, 3) + | SM(i->rtscts_rate, AR_RTSCTSRate); + +- ACCESS_ONCE(ads->ds_ctl9) = SM(i->txpower, AR_XmitPower1); +- ACCESS_ONCE(ads->ds_ctl10) = SM(i->txpower, AR_XmitPower2); +- ACCESS_ONCE(ads->ds_ctl11) = SM(i->txpower, AR_XmitPower3); ++ ACCESS_ONCE_RW(ads->ds_ctl9) = SM(i->txpower, AR_XmitPower1); ++ ACCESS_ONCE_RW(ads->ds_ctl10) = SM(i->txpower, AR_XmitPower2); ++ ACCESS_ONCE_RW(ads->ds_ctl11) = SM(i->txpower, AR_XmitPower3); + } + + static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds, +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/ar9003_mac.c backports-3.18.1-1/drivers/net/wireless/ath/ath9k/ar9003_mac.c +--- backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/ar9003_mac.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ath/ath9k/ar9003_mac.c 2014-12-28 14:10:09.560888936 +0100 +@@ -39,47 +39,47 @@ + (i->qcu << AR_TxQcuNum_S) | desc_len; + + checksum += val; +- ACCESS_ONCE(ads->info) = val; ++ ACCESS_ONCE_RW(ads->info) = val; + + checksum += i->link; +- ACCESS_ONCE(ads->link) = i->link; ++ ACCESS_ONCE_RW(ads->link) = i->link; + + checksum += i->buf_addr[0]; +- ACCESS_ONCE(ads->data0) = i->buf_addr[0]; ++ ACCESS_ONCE_RW(ads->data0) = i->buf_addr[0]; + checksum += i->buf_addr[1]; +- ACCESS_ONCE(ads->data1) = i->buf_addr[1]; ++ ACCESS_ONCE_RW(ads->data1) = i->buf_addr[1]; + checksum += i->buf_addr[2]; +- ACCESS_ONCE(ads->data2) = i->buf_addr[2]; ++ ACCESS_ONCE_RW(ads->data2) = i->buf_addr[2]; + checksum += i->buf_addr[3]; +- ACCESS_ONCE(ads->data3) = i->buf_addr[3]; ++ ACCESS_ONCE_RW(ads->data3) = i->buf_addr[3]; + + checksum += (val = (i->buf_len[0] << AR_BufLen_S) & AR_BufLen); +- ACCESS_ONCE(ads->ctl3) = val; ++ ACCESS_ONCE_RW(ads->ctl3) = val; + checksum += (val = (i->buf_len[1] << AR_BufLen_S) & AR_BufLen); +- ACCESS_ONCE(ads->ctl5) = val; ++ ACCESS_ONCE_RW(ads->ctl5) = val; + checksum += (val = (i->buf_len[2] << AR_BufLen_S) & AR_BufLen); +- ACCESS_ONCE(ads->ctl7) = val; ++ ACCESS_ONCE_RW(ads->ctl7) = val; + checksum += (val = (i->buf_len[3] << AR_BufLen_S) & AR_BufLen); +- ACCESS_ONCE(ads->ctl9) = val; ++ ACCESS_ONCE_RW(ads->ctl9) = val; + + checksum = (u16) (((checksum & 0xffff) + (checksum >> 16)) & 0xffff); +- ACCESS_ONCE(ads->ctl10) = checksum; ++ ACCESS_ONCE_RW(ads->ctl10) = checksum; + + if (i->is_first || i->is_last) { +- ACCESS_ONCE(ads->ctl13) = set11nTries(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ctl13) = set11nTries(i->rates, 0) + | set11nTries(i->rates, 1) + | set11nTries(i->rates, 2) + | set11nTries(i->rates, 3) + | (i->dur_update ? AR_DurUpdateEna : 0) + | SM(0, AR_BurstDur); + +- ACCESS_ONCE(ads->ctl14) = set11nRate(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ctl14) = set11nRate(i->rates, 0) + | set11nRate(i->rates, 1) + | set11nRate(i->rates, 2) + | set11nRate(i->rates, 3); + } else { +- ACCESS_ONCE(ads->ctl13) = 0; +- ACCESS_ONCE(ads->ctl14) = 0; ++ ACCESS_ONCE_RW(ads->ctl13) = 0; ++ ACCESS_ONCE_RW(ads->ctl14) = 0; + } + + ads->ctl20 = 0; +@@ -89,17 +89,17 @@ + + ctl17 = SM(i->keytype, AR_EncrType); + if (!i->is_first) { +- ACCESS_ONCE(ads->ctl11) = 0; +- ACCESS_ONCE(ads->ctl12) = i->is_last ? 0 : AR_TxMore; +- ACCESS_ONCE(ads->ctl15) = 0; +- ACCESS_ONCE(ads->ctl16) = 0; +- ACCESS_ONCE(ads->ctl17) = ctl17; +- ACCESS_ONCE(ads->ctl18) = 0; +- ACCESS_ONCE(ads->ctl19) = 0; ++ ACCESS_ONCE_RW(ads->ctl11) = 0; ++ ACCESS_ONCE_RW(ads->ctl12) = i->is_last ? 0 : AR_TxMore; ++ ACCESS_ONCE_RW(ads->ctl15) = 0; ++ ACCESS_ONCE_RW(ads->ctl16) = 0; ++ ACCESS_ONCE_RW(ads->ctl17) = ctl17; ++ ACCESS_ONCE_RW(ads->ctl18) = 0; ++ ACCESS_ONCE_RW(ads->ctl19) = 0; + return; + } + +- ACCESS_ONCE(ads->ctl11) = (i->pkt_len & AR_FrameLen) ++ ACCESS_ONCE_RW(ads->ctl11) = (i->pkt_len & AR_FrameLen) + | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0) + | SM(i->txpower, AR_XmitPower0) + | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0) +@@ -135,26 +135,26 @@ + val = (i->flags & ATH9K_TXDESC_PAPRD) >> ATH9K_TXDESC_PAPRD_S; + ctl12 |= SM(val, AR_PAPRDChainMask); + +- ACCESS_ONCE(ads->ctl12) = ctl12; +- ACCESS_ONCE(ads->ctl17) = ctl17; ++ ACCESS_ONCE_RW(ads->ctl12) = ctl12; ++ ACCESS_ONCE_RW(ads->ctl17) = ctl17; + +- ACCESS_ONCE(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0) + | set11nPktDurRTSCTS(i->rates, 1); + +- ACCESS_ONCE(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2) ++ ACCESS_ONCE_RW(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2) + | set11nPktDurRTSCTS(i->rates, 3); + +- ACCESS_ONCE(ads->ctl18) = set11nRateFlags(i->rates, 0) ++ ACCESS_ONCE_RW(ads->ctl18) = set11nRateFlags(i->rates, 0) + | set11nRateFlags(i->rates, 1) + | set11nRateFlags(i->rates, 2) + | set11nRateFlags(i->rates, 3) + | SM(i->rtscts_rate, AR_RTSCTSRate); + +- ACCESS_ONCE(ads->ctl19) = AR_Not_Sounding; ++ ACCESS_ONCE_RW(ads->ctl19) = AR_Not_Sounding; + +- ACCESS_ONCE(ads->ctl20) = SM(i->txpower, AR_XmitPower1); +- ACCESS_ONCE(ads->ctl21) = SM(i->txpower, AR_XmitPower2); +- ACCESS_ONCE(ads->ctl22) = SM(i->txpower, AR_XmitPower3); ++ ACCESS_ONCE_RW(ads->ctl20) = SM(i->txpower, AR_XmitPower1); ++ ACCESS_ONCE_RW(ads->ctl21) = SM(i->txpower, AR_XmitPower2); ++ ACCESS_ONCE_RW(ads->ctl22) = SM(i->txpower, AR_XmitPower3); + } + + static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads) +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/hw.h backports-3.18.1-1/drivers/net/wireless/ath/ath9k/hw.h +--- backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/hw.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ath/ath9k/hw.h 2014-12-28 14:10:09.564888946 +0100 +@@ -630,7 +630,7 @@ + + /* ANI */ + void (*ani_cache_ini_regs)(struct ath_hw *ah); +-}; ++} __no_const; + + /** + * struct ath_spec_scan - parameters for Atheros spectral scan +@@ -708,7 +708,7 @@ + #ifdef CPTCFG_ATH9K_BTCOEX_SUPPORT + void (*set_bt_ant_diversity)(struct ath_hw *hw, bool enable); + #endif +-}; ++} __no_const; + + struct ath_nf_limits { + s16 max; +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/main.c backports-3.18.1-1/drivers/net/wireless/ath/ath9k/main.c +--- backports-3.18.1-1.org/drivers/net/wireless/ath/ath9k/main.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ath/ath9k/main.c 2014-12-28 14:24:49.169250593 +0100 +@@ -2454,16 +2454,18 @@ + if (!ath9k_is_chanctx_enabled()) + return; + +- ath9k_ops.hw_scan = ath9k_hw_scan; +- ath9k_ops.cancel_hw_scan = ath9k_cancel_hw_scan; +- ath9k_ops.remain_on_channel = ath9k_remain_on_channel; +- ath9k_ops.cancel_remain_on_channel = ath9k_cancel_remain_on_channel; +- ath9k_ops.add_chanctx = ath9k_add_chanctx; +- ath9k_ops.remove_chanctx = ath9k_remove_chanctx; +- ath9k_ops.change_chanctx = ath9k_change_chanctx; +- ath9k_ops.assign_vif_chanctx = ath9k_assign_vif_chanctx; +- ath9k_ops.unassign_vif_chanctx = ath9k_unassign_vif_chanctx; +- ath9k_ops.mgd_prepare_tx = ath9k_mgd_prepare_tx; ++ pax_open_kernel(); ++ *(void **)&ath9k_ops.hw_scan = ath9k_hw_scan; ++ *(void **)&ath9k_ops.cancel_hw_scan = ath9k_cancel_hw_scan; ++ *(void **)&ath9k_ops.remain_on_channel = ath9k_remain_on_channel; ++ *(void **)&ath9k_ops.cancel_remain_on_channel = ath9k_cancel_remain_on_channel; ++ *(void **)&ath9k_ops.add_chanctx = ath9k_add_chanctx; ++ *(void **)&ath9k_ops.remove_chanctx = ath9k_remove_chanctx; ++ *(void **)&ath9k_ops.change_chanctx = ath9k_change_chanctx; ++ *(void **)&ath9k_ops.assign_vif_chanctx = ath9k_assign_vif_chanctx; ++ *(void **)&ath9k_ops.unassign_vif_chanctx = ath9k_unassign_vif_chanctx; ++ *(void **)&ath9k_ops.mgd_prepare_tx = ath9k_mgd_prepare_tx; ++ pax_close_kernel(); + } + + #endif +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/b43/phy_lp.c backports-3.18.1-1/drivers/net/wireless/b43/phy_lp.c +--- backports-3.18.1-1.org/drivers/net/wireless/b43/phy_lp.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/b43/phy_lp.c 2014-12-28 14:10:09.564888946 +0100 +@@ -2502,7 +2502,7 @@ + { + struct ssb_bus *bus = dev->dev->sdev->bus; + +- static const struct b206x_channel *chandata = NULL; ++ const struct b206x_channel *chandata = NULL; + u32 crystal_freq = bus->chipco.pmu.crystalfreq * 1000; + u32 freqref, vco_freq, val1, val2, val3, timeout, timeoutref, count; + u16 old_comm15, scale; +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/iwlegacy/3945-mac.c backports-3.18.1-1/drivers/net/wireless/iwlegacy/3945-mac.c +--- backports-3.18.1-1.org/drivers/net/wireless/iwlegacy/3945-mac.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/iwlegacy/3945-mac.c 2014-12-28 14:10:09.564888946 +0100 +@@ -3633,7 +3633,9 @@ + */ + if (il3945_mod_params.disable_hw_scan) { + D_INFO("Disabling hw_scan\n"); +- il3945_mac_ops.hw_scan = NULL; ++ pax_open_kernel(); ++ *(void **)&il3945_mac_ops.hw_scan = NULL; ++ pax_close_kernel(); + } + + D_INFO("*** LOAD DRIVER ***\n"); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/iwlwifi/dvm/debugfs.c backports-3.18.1-1/drivers/net/wireless/iwlwifi/dvm/debugfs.c +--- backports-3.18.1-1.org/drivers/net/wireless/iwlwifi/dvm/debugfs.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/iwlwifi/dvm/debugfs.c 2014-12-28 14:10:09.564888946 +0100 +@@ -188,7 +188,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[64]; +- int buf_size; ++ size_t buf_size; + u32 offset, len; + + memset(buf, 0, sizeof(buf)); +@@ -458,7 +458,7 @@ + struct iwl_priv *priv = file->private_data; + + char buf[8]; +- int buf_size; ++ size_t buf_size; + u32 reset_flag; + + memset(buf, 0, sizeof(buf)); +@@ -539,7 +539,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int ht40; + + memset(buf, 0, sizeof(buf)); +@@ -591,7 +591,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int value; + + memset(buf, 0, sizeof(buf)); +@@ -683,10 +683,10 @@ + DEBUGFS_READ_WRITE_FILE_OPS(sleep_level_override); + DEBUGFS_READ_FILE_OPS(current_sleep_command); + +-static const char *fmt_value = " %-30s %10u\n"; +-static const char *fmt_hex = " %-30s 0x%02X\n"; +-static const char *fmt_table = " %-30s %10u %10u %10u %10u\n"; +-static const char *fmt_header = ++static const char fmt_value[] = " %-30s %10u\n"; ++static const char fmt_hex[] = " %-30s 0x%02X\n"; ++static const char fmt_table[] = " %-30s %10u %10u %10u %10u\n"; ++static const char fmt_header[] = + "%-32s current cumulative delta max\n"; + + static int iwl_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz) +@@ -1856,7 +1856,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int clear; + + memset(buf, 0, sizeof(buf)); +@@ -1901,7 +1901,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int trace; + + memset(buf, 0, sizeof(buf)); +@@ -1972,7 +1972,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int missed; + + memset(buf, 0, sizeof(buf)); +@@ -2013,7 +2013,7 @@ + + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int plcp; + + memset(buf, 0, sizeof(buf)); +@@ -2073,7 +2073,7 @@ + + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int flush; + + memset(buf, 0, sizeof(buf)); +@@ -2163,7 +2163,7 @@ + + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int rts; + + if (!priv->cfg->ht_params) +@@ -2204,7 +2204,7 @@ + { + struct iwl_priv *priv = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + + memset(buf, 0, sizeof(buf)); + buf_size = min(count, sizeof(buf) - 1); +@@ -2238,7 +2238,7 @@ + struct iwl_priv *priv = file->private_data; + u32 event_log_flag; + char buf[8]; +- int buf_size; ++ size_t buf_size; + + /* check that the interface is up */ + if (!iwl_is_ready(priv)) +@@ -2292,7 +2292,7 @@ + struct iwl_priv *priv = file->private_data; + char buf[8]; + u32 calib_disabled; +- int buf_size; ++ size_t buf_size; + + memset(buf, 0, sizeof(buf)); + buf_size = min(count, sizeof(buf) - 1); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/iwlwifi/pcie/trans.c backports-3.18.1-1/drivers/net/wireless/iwlwifi/pcie/trans.c +--- backports-3.18.1-1.org/drivers/net/wireless/iwlwifi/pcie/trans.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/iwlwifi/pcie/trans.c 2014-12-28 14:10:09.564888946 +0100 +@@ -1689,7 +1689,7 @@ + struct isr_statistics *isr_stats = &trans_pcie->isr_stats; + + char buf[8]; +- int buf_size; ++ size_t buf_size; + u32 reset_flag; + + memset(buf, 0, sizeof(buf)); +@@ -1710,7 +1710,7 @@ + { + struct iwl_trans *trans = file->private_data; + char buf[8]; +- int buf_size; ++ size_t buf_size; + int csr; + + memset(buf, 0, sizeof(buf)); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/mac80211_hwsim.c backports-3.18.1-1/drivers/net/wireless/mac80211_hwsim.c +--- backports-3.18.1-1.org/drivers/net/wireless/mac80211_hwsim.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/mac80211_hwsim.c 2014-12-28 14:10:09.568888967 +0100 +@@ -2578,20 +2578,20 @@ + if (channels < 1) + return -EINVAL; + +- mac80211_hwsim_mchan_ops = mac80211_hwsim_ops; +- mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan; +- mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan; +- mac80211_hwsim_mchan_ops.sw_scan_start = NULL; +- mac80211_hwsim_mchan_ops.sw_scan_complete = NULL; +- mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc; +- mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc; +- mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx; +- mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx; +- mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx; +- mac80211_hwsim_mchan_ops.assign_vif_chanctx = +- mac80211_hwsim_assign_vif_chanctx; +- mac80211_hwsim_mchan_ops.unassign_vif_chanctx = +- mac80211_hwsim_unassign_vif_chanctx; ++ pax_open_kernel(); ++ memcpy((void *)&mac80211_hwsim_mchan_ops, &mac80211_hwsim_ops, sizeof mac80211_hwsim_mchan_ops); ++ *(void **)&mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan; ++ *(void **)&mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan; ++ *(void **)&mac80211_hwsim_mchan_ops.sw_scan_start = NULL; ++ *(void **)&mac80211_hwsim_mchan_ops.sw_scan_complete = NULL; ++ *(void **)&mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc; ++ *(void **)&mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc; ++ *(void **)&mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx; ++ *(void **)&mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx; ++ *(void **)&mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx; ++ *(void **)&mac80211_hwsim_mchan_ops.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx; ++ *(void **)&mac80211_hwsim_mchan_ops.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx; ++ pax_close_kernel(); + + spin_lock_init(&hwsim_radio_lock); + INIT_LIST_HEAD(&hwsim_radios); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/rndis_wlan.c backports-3.18.1-1/drivers/net/wireless/rndis_wlan.c +--- backports-3.18.1-1.org/drivers/net/wireless/rndis_wlan.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/rndis_wlan.c 2014-12-28 14:10:09.568888967 +0100 +@@ -1236,7 +1236,7 @@ + + netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold); + +- if (rts_threshold < 0 || rts_threshold > 2347) ++ if (rts_threshold > 2347) + rts_threshold = 2347; + + tmp = cpu_to_le32(rts_threshold); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2x00.h backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2x00.h +--- backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2x00.h 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2x00.h 2014-12-28 14:10:09.568888967 +0100 +@@ -375,7 +375,7 @@ + * for hardware which doesn't support hardware + * sequence counting. + */ +- atomic_t seqno; ++ atomic_unchecked_t seqno; + }; + + static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif) +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2x00queue.c backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2x00queue.c +--- backports-3.18.1-1.org/drivers/net/wireless/rt2x00/rt2x00queue.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/rt2x00/rt2x00queue.c 2014-12-28 14:10:09.568888967 +0100 +@@ -224,9 +224,9 @@ + * sequence counter given by mac80211. + */ + if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags)) +- seqno = atomic_add_return(0x10, &intf->seqno); ++ seqno = atomic_add_return_unchecked(0x10, &intf->seqno); + else +- seqno = atomic_read(&intf->seqno); ++ seqno = atomic_read_unchecked(&intf->seqno); + + hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG); + hdr->seq_ctrl |= cpu_to_le16(seqno); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ti/wl1251/sdio.c backports-3.18.1-1/drivers/net/wireless/ti/wl1251/sdio.c +--- backports-3.18.1-1.org/drivers/net/wireless/ti/wl1251/sdio.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ti/wl1251/sdio.c 2014-12-28 14:10:09.568888967 +0100 +@@ -282,13 +282,17 @@ + + irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING); + +- wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq; +- wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq; ++ pax_open_kernel(); ++ *(void **)&wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq; ++ *(void **)&wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq; ++ pax_close_kernel(); + + wl1251_info("using dedicated interrupt line"); + } else { +- wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq; +- wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq; ++ pax_open_kernel(); ++ *(void **)&wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq; ++ *(void **)&wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq; ++ pax_close_kernel(); + + wl1251_info("using SDIO interrupt"); + } +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ti/wl12xx/main.c backports-3.18.1-1/drivers/net/wireless/ti/wl12xx/main.c +--- backports-3.18.1-1.org/drivers/net/wireless/ti/wl12xx/main.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ti/wl12xx/main.c 2014-12-28 14:10:09.568888967 +0100 +@@ -656,7 +656,9 @@ + sizeof(wl->conf.mem)); + + /* read data preparation is only needed by wl127x */ +- wl->ops->prepare_read = wl127x_prepare_read; ++ pax_open_kernel(); ++ *(void **)&wl->ops->prepare_read = wl127x_prepare_read; ++ pax_close_kernel(); + + wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, + WL127X_IFTYPE_SR_VER, WL127X_MAJOR_SR_VER, +@@ -681,7 +683,9 @@ + sizeof(wl->conf.mem)); + + /* read data preparation is only needed by wl127x */ +- wl->ops->prepare_read = wl127x_prepare_read; ++ pax_open_kernel(); ++ *(void **)&wl->ops->prepare_read = wl127x_prepare_read; ++ pax_close_kernel(); + + wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, + WL127X_IFTYPE_SR_VER, WL127X_MAJOR_SR_VER, +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/ti/wl18xx/main.c backports-3.18.1-1/drivers/net/wireless/ti/wl18xx/main.c +--- backports-3.18.1-1.org/drivers/net/wireless/ti/wl18xx/main.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/ti/wl18xx/main.c 2014-12-28 14:10:09.568888967 +0100 +@@ -1916,8 +1916,10 @@ + } + + if (!checksum_param) { +- wl18xx_ops.set_rx_csum = NULL; +- wl18xx_ops.init_vif = NULL; ++ pax_open_kernel(); ++ *(void **)&wl18xx_ops.set_rx_csum = NULL; ++ *(void **)&wl18xx_ops.init_vif = NULL; ++ pax_close_kernel(); + } + + /* Enable 11a Band only if we have 5G antennas */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/zd1211rw/zd_usb.c backports-3.18.1-1/drivers/net/wireless/zd1211rw/zd_usb.c +--- backports-3.18.1-1.org/drivers/net/wireless/zd1211rw/zd_usb.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/zd1211rw/zd_usb.c 2014-12-28 14:10:09.568888967 +0100 +@@ -385,7 +385,7 @@ + { + struct zd_usb *usb = urb->context; + struct zd_usb_interrupt *intr = &usb->intr; +- int len; ++ unsigned int len; + u16 int_num; + + ZD_ASSERT(in_interrupt()); +diff -Naur backports-3.18.1-1.org/drivers/nfc/nfcwilink.c backports-3.18.1-1/drivers/nfc/nfcwilink.c +--- backports-3.18.1-1.org/drivers/nfc/nfcwilink.c 2014-12-21 22:37:14.000000000 +0100 ++++ backports-3.18.1-1/drivers/nfc/nfcwilink.c 2014-12-28 14:10:09.568888967 +0100 +@@ -497,7 +497,7 @@ + + static int nfcwilink_probe(struct platform_device *pdev) + { +- static struct nfcwilink *drv; ++ struct nfcwilink *drv; + int rc; + __u32 protocols; + +diff -Naur backports-3.18.1-1.org/include/linux/gracl_compat.h backports-3.18.1-1/include/linux/gracl_compat.h +--- backports-3.18.1-1.org/include/linux/gracl_compat.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/gracl_compat.h 2014-12-28 14:10:09.684889542 +0100 +@@ -0,0 +1,156 @@ ++#ifndef GR_ACL_COMPAT_H ++#define GR_ACL_COMPAT_H ++ ++#include <linux/resource.h> ++#include <asm/resource.h> ++ ++struct sprole_pw_compat { ++ compat_uptr_t rolename; ++ unsigned char salt[GR_SALT_LEN]; ++ unsigned char sum[GR_SHA_LEN]; ++}; ++ ++struct gr_hash_struct_compat { ++ compat_uptr_t table; ++ compat_uptr_t nametable; ++ compat_uptr_t first; ++ __u32 table_size; ++ __u32 used_size; ++ int type; ++}; ++ ++struct acl_subject_label_compat { ++ compat_uptr_t filename; ++ compat_ino_t inode; ++ __u32 device; ++ __u32 mode; ++ kernel_cap_t cap_mask; ++ kernel_cap_t cap_lower; ++ kernel_cap_t cap_invert_audit; ++ ++ struct compat_rlimit res[GR_NLIMITS]; ++ __u32 resmask; ++ ++ __u8 user_trans_type; ++ __u8 group_trans_type; ++ compat_uptr_t user_transitions; ++ compat_uptr_t group_transitions; ++ __u16 user_trans_num; ++ __u16 group_trans_num; ++ ++ __u32 sock_families[2]; ++ __u32 ip_proto[8]; ++ __u32 ip_type; ++ compat_uptr_t ips; ++ __u32 ip_num; ++ __u32 inaddr_any_override; ++ ++ __u32 crashes; ++ compat_ulong_t expires; ++ ++ compat_uptr_t parent_subject; ++ compat_uptr_t hash; ++ compat_uptr_t prev; ++ compat_uptr_t next; ++ ++ compat_uptr_t obj_hash; ++ __u32 obj_hash_size; ++ __u16 pax_flags; ++}; ++ ++struct role_allowed_ip_compat { ++ __u32 addr; ++ __u32 netmask; ++ ++ compat_uptr_t prev; ++ compat_uptr_t next; ++}; ++ ++struct role_transition_compat { ++ compat_uptr_t rolename; ++ ++ compat_uptr_t prev; ++ compat_uptr_t next; ++}; ++ ++struct acl_role_label_compat { ++ compat_uptr_t rolename; ++ uid_t uidgid; ++ __u16 roletype; ++ ++ __u16 auth_attempts; ++ compat_ulong_t expires; ++ ++ compat_uptr_t root_label; ++ compat_uptr_t hash; ++ ++ compat_uptr_t prev; ++ compat_uptr_t next; ++ ++ compat_uptr_t transitions; ++ compat_uptr_t allowed_ips; ++ compat_uptr_t domain_children; ++ __u16 domain_child_num; ++ ++ umode_t umask; ++ ++ compat_uptr_t subj_hash; ++ __u32 subj_hash_size; ++}; ++ ++struct user_acl_role_db_compat { ++ compat_uptr_t r_table; ++ __u32 num_pointers; ++ __u32 num_roles; ++ __u32 num_domain_children; ++ __u32 num_subjects; ++ __u32 num_objects; ++}; ++ ++struct acl_object_label_compat { ++ compat_uptr_t filename; ++ compat_ino_t inode; ++ __u32 device; ++ __u32 mode; ++ ++ compat_uptr_t nested; ++ compat_uptr_t globbed; ++ ++ compat_uptr_t prev; ++ compat_uptr_t next; ++}; ++ ++struct acl_ip_label_compat { ++ compat_uptr_t iface; ++ __u32 addr; ++ __u32 netmask; ++ __u16 low, high; ++ __u8 mode; ++ __u32 type; ++ __u32 proto[8]; ++ ++ compat_uptr_t prev; ++ compat_uptr_t next; ++}; ++ ++struct gr_arg_compat { ++ struct user_acl_role_db_compat role_db; ++ unsigned char pw[GR_PW_LEN]; ++ unsigned char salt[GR_SALT_LEN]; ++ unsigned char sum[GR_SHA_LEN]; ++ unsigned char sp_role[GR_SPROLE_LEN]; ++ compat_uptr_t sprole_pws; ++ __u32 segv_device; ++ compat_ino_t segv_inode; ++ uid_t segv_uid; ++ __u16 num_sprole_pws; ++ __u16 mode; ++}; ++ ++struct gr_arg_wrapper_compat { ++ compat_uptr_t arg; ++ __u32 version; ++ __u32 size; ++}; ++ ++#endif +diff -Naur backports-3.18.1-1.org/include/linux/gracl.h backports-3.18.1-1/include/linux/gracl.h +--- backports-3.18.1-1.org/include/linux/gracl.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/gracl.h 2014-12-28 14:10:09.684889542 +0100 +@@ -0,0 +1,340 @@ ++#ifndef GR_ACL_H ++#define GR_ACL_H ++ ++#include <linux/grdefs.h> ++#include <linux/resource.h> ++#include <linux/capability.h> ++#include <linux/dcache.h> ++#include <asm/resource.h> ++ ++/* Major status information */ ++ ++#define GR_VERSION "grsecurity 3.0" ++#define GRSECURITY_VERSION 0x3000 ++ ++enum { ++ GR_SHUTDOWN = 0, ++ GR_ENABLE = 1, ++ GR_SPROLE = 2, ++ GR_OLDRELOAD = 3, ++ GR_SEGVMOD = 4, ++ GR_STATUS = 5, ++ GR_UNSPROLE = 6, ++ GR_PASSSET = 7, ++ GR_SPROLEPAM = 8, ++ GR_RELOAD = 9, ++}; ++ ++/* Password setup definitions ++ * kernel/grhash.c */ ++enum { ++ GR_PW_LEN = 128, ++ GR_SALT_LEN = 16, ++ GR_SHA_LEN = 32, ++}; ++ ++enum { ++ GR_SPROLE_LEN = 64, ++}; ++ ++enum { ++ GR_NO_GLOB = 0, ++ GR_REG_GLOB, ++ GR_CREATE_GLOB ++}; ++ ++#define GR_NLIMITS 32 ++ ++/* Begin Data Structures */ ++ ++struct sprole_pw { ++ unsigned char *rolename; ++ unsigned char salt[GR_SALT_LEN]; ++ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */ ++}; ++ ++struct name_entry { ++ __u32 key; ++ ino_t inode; ++ dev_t device; ++ char *name; ++ __u16 len; ++ __u8 deleted; ++ struct name_entry *prev; ++ struct name_entry *next; ++}; ++ ++struct inodev_entry { ++ struct name_entry *nentry; ++ struct inodev_entry *prev; ++ struct inodev_entry *next; ++}; ++ ++struct acl_role_db { ++ struct acl_role_label **r_hash; ++ __u32 r_size; ++}; ++ ++struct inodev_db { ++ struct inodev_entry **i_hash; ++ __u32 i_size; ++}; ++ ++struct name_db { ++ struct name_entry **n_hash; ++ __u32 n_size; ++}; ++ ++struct crash_uid { ++ uid_t uid; ++ unsigned long expires; ++}; ++ ++struct gr_hash_struct { ++ void **table; ++ void **nametable; ++ void *first; ++ __u32 table_size; ++ __u32 used_size; ++ int type; ++}; ++ ++/* Userspace Grsecurity ACL data structures */ ++ ++struct acl_subject_label { ++ char *filename; ++ ino_t inode; ++ dev_t device; ++ __u32 mode; ++ kernel_cap_t cap_mask; ++ kernel_cap_t cap_lower; ++ kernel_cap_t cap_invert_audit; ++ ++ struct rlimit res[GR_NLIMITS]; ++ __u32 resmask; ++ ++ __u8 user_trans_type; ++ __u8 group_trans_type; ++ uid_t *user_transitions; ++ gid_t *group_transitions; ++ __u16 user_trans_num; ++ __u16 group_trans_num; ++ ++ __u32 sock_families[2]; ++ __u32 ip_proto[8]; ++ __u32 ip_type; ++ struct acl_ip_label **ips; ++ __u32 ip_num; ++ __u32 inaddr_any_override; ++ ++ __u32 crashes; ++ unsigned long expires; ++ ++ struct acl_subject_label *parent_subject; ++ struct gr_hash_struct *hash; ++ struct acl_subject_label *prev; ++ struct acl_subject_label *next; ++ ++ struct acl_object_label **obj_hash; ++ __u32 obj_hash_size; ++ __u16 pax_flags; ++}; ++ ++struct role_allowed_ip { ++ __u32 addr; ++ __u32 netmask; ++ ++ struct role_allowed_ip *prev; ++ struct role_allowed_ip *next; ++}; ++ ++struct role_transition { ++ char *rolename; ++ ++ struct role_transition *prev; ++ struct role_transition *next; ++}; ++ ++struct acl_role_label { ++ char *rolename; ++ uid_t uidgid; ++ __u16 roletype; ++ ++ __u16 auth_attempts; ++ unsigned long expires; ++ ++ struct acl_subject_label *root_label; ++ struct gr_hash_struct *hash; ++ ++ struct acl_role_label *prev; ++ struct acl_role_label *next; ++ ++ struct role_transition *transitions; ++ struct role_allowed_ip *allowed_ips; ++ uid_t *domain_children; ++ __u16 domain_child_num; ++ ++ umode_t umask; ++ ++ struct acl_subject_label **subj_hash; ++ __u32 subj_hash_size; ++}; ++ ++struct user_acl_role_db { ++ struct acl_role_label **r_table; ++ __u32 num_pointers; /* Number of allocations to track */ ++ __u32 num_roles; /* Number of roles */ ++ __u32 num_domain_children; /* Number of domain children */ ++ __u32 num_subjects; /* Number of subjects */ ++ __u32 num_objects; /* Number of objects */ ++}; ++ ++struct acl_object_label { ++ char *filename; ++ ino_t inode; ++ dev_t device; ++ __u32 mode; ++ ++ struct acl_subject_label *nested; ++ struct acl_object_label *globbed; ++ ++ /* next two structures not used */ ++ ++ struct acl_object_label *prev; ++ struct acl_object_label *next; ++}; ++ ++struct acl_ip_label { ++ char *iface; ++ __u32 addr; ++ __u32 netmask; ++ __u16 low, high; ++ __u8 mode; ++ __u32 type; ++ __u32 proto[8]; ++ ++ /* next two structures not used */ ++ ++ struct acl_ip_label *prev; ++ struct acl_ip_label *next; ++}; ++ ++struct gr_arg { ++ struct user_acl_role_db role_db; ++ unsigned char pw[GR_PW_LEN]; ++ unsigned char salt[GR_SALT_LEN]; ++ unsigned char sum[GR_SHA_LEN]; ++ unsigned char sp_role[GR_SPROLE_LEN]; ++ struct sprole_pw *sprole_pws; ++ dev_t segv_device; ++ ino_t segv_inode; ++ uid_t segv_uid; ++ __u16 num_sprole_pws; ++ __u16 mode; ++}; ++ ++struct gr_arg_wrapper { ++ struct gr_arg *arg; ++ __u32 version; ++ __u32 size; ++}; ++ ++struct subject_map { ++ struct acl_subject_label *user; ++ struct acl_subject_label *kernel; ++ struct subject_map *prev; ++ struct subject_map *next; ++}; ++ ++struct acl_subj_map_db { ++ struct subject_map **s_hash; ++ __u32 s_size; ++}; ++ ++struct gr_policy_state { ++ struct sprole_pw **acl_special_roles; ++ __u16 num_sprole_pws; ++ struct acl_role_label *kernel_role; ++ struct acl_role_label *role_list; ++ struct acl_role_label *default_role; ++ struct acl_role_db acl_role_set; ++ struct acl_subj_map_db subj_map_set; ++ struct name_db name_set; ++ struct inodev_db inodev_set; ++}; ++ ++struct gr_alloc_state { ++ unsigned long alloc_stack_next; ++ unsigned long alloc_stack_size; ++ void **alloc_stack; ++}; ++ ++struct gr_reload_state { ++ struct gr_policy_state oldpolicy; ++ struct gr_alloc_state oldalloc; ++ struct gr_policy_state newpolicy; ++ struct gr_alloc_state newalloc; ++ struct gr_policy_state *oldpolicy_ptr; ++ struct gr_alloc_state *oldalloc_ptr; ++ unsigned char oldmode; ++}; ++ ++/* End Data Structures Section */ ++ ++/* Hash functions generated by empirical testing by Brad Spengler ++ Makes good use of the low bits of the inode. Generally 0-1 times ++ in loop for successful match. 0-3 for unsuccessful match. ++ Shift/add algorithm with modulus of table size and an XOR*/ ++ ++static __inline__ unsigned int ++gr_rhash(const uid_t uid, const __u16 type, const unsigned int sz) ++{ ++ return ((((uid + type) << (16 + type)) ^ uid) % sz); ++} ++ ++ static __inline__ unsigned int ++gr_shash(const struct acl_subject_label *userp, const unsigned int sz) ++{ ++ return ((const unsigned long)userp % sz); ++} ++ ++static __inline__ unsigned int ++gr_fhash(const ino_t ino, const dev_t dev, const unsigned int sz) ++{ ++ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz); ++} ++ ++static __inline__ unsigned int ++gr_nhash(const char *name, const __u16 len, const unsigned int sz) ++{ ++ return full_name_hash((const unsigned char *)name, len) % sz; ++} ++ ++#define FOR_EACH_SUBJECT_START(role,subj,iter) \ ++ subj = NULL; \ ++ iter = 0; \ ++ while (iter < role->subj_hash_size) { \ ++ if (subj == NULL) \ ++ subj = role->subj_hash[iter]; \ ++ if (subj == NULL) { \ ++ iter++; \ ++ continue; \ ++ } ++ ++#define FOR_EACH_SUBJECT_END(subj,iter) \ ++ subj = subj->next; \ ++ if (subj == NULL) \ ++ iter++; \ ++ } ++ ++ ++#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \ ++ subj = role->hash->first; \ ++ while (subj != NULL) { ++ ++#define FOR_EACH_NESTED_SUBJECT_END(subj) \ ++ subj = subj->next; \ ++ } ++ ++#endif ++ +diff -Naur backports-3.18.1-1.org/include/linux/gralloc.h backports-3.18.1-1/include/linux/gralloc.h +--- backports-3.18.1-1.org/include/linux/gralloc.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/gralloc.h 2014-12-28 14:10:09.684889542 +0100 +@@ -0,0 +1,9 @@ ++#ifndef __GRALLOC_H ++#define __GRALLOC_H ++ ++void acl_free_all(void); ++int acl_alloc_stack_init(unsigned long size); ++void *acl_alloc(unsigned long len); ++void *acl_alloc_num(unsigned long num, unsigned long len); ++ ++#endif +diff -Naur backports-3.18.1-1.org/include/linux/grdefs.h backports-3.18.1-1/include/linux/grdefs.h +--- backports-3.18.1-1.org/include/linux/grdefs.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/grdefs.h 2014-12-28 14:10:09.688889562 +0100 +@@ -0,0 +1,140 @@ ++#ifndef GRDEFS_H ++#define GRDEFS_H ++ ++/* Begin grsecurity status declarations */ ++ ++enum { ++ GR_READY = 0x01, ++ GR_STATUS_INIT = 0x00 // disabled state ++}; ++ ++/* Begin ACL declarations */ ++ ++/* Role flags */ ++ ++enum { ++ GR_ROLE_USER = 0x0001, ++ GR_ROLE_GROUP = 0x0002, ++ GR_ROLE_DEFAULT = 0x0004, ++ GR_ROLE_SPECIAL = 0x0008, ++ GR_ROLE_AUTH = 0x0010, ++ GR_ROLE_NOPW = 0x0020, ++ GR_ROLE_GOD = 0x0040, ++ GR_ROLE_LEARN = 0x0080, ++ GR_ROLE_TPE = 0x0100, ++ GR_ROLE_DOMAIN = 0x0200, ++ GR_ROLE_PAM = 0x0400, ++ GR_ROLE_PERSIST = 0x0800 ++}; ++ ++/* ACL Subject and Object mode flags */ ++enum { ++ GR_DELETED = 0x80000000 ++}; ++ ++/* ACL Object-only mode flags */ ++enum { ++ GR_READ = 0x00000001, ++ GR_APPEND = 0x00000002, ++ GR_WRITE = 0x00000004, ++ GR_EXEC = 0x00000008, ++ GR_FIND = 0x00000010, ++ GR_INHERIT = 0x00000020, ++ GR_SETID = 0x00000040, ++ GR_CREATE = 0x00000080, ++ GR_DELETE = 0x00000100, ++ GR_LINK = 0x00000200, ++ GR_AUDIT_READ = 0x00000400, ++ GR_AUDIT_APPEND = 0x00000800, ++ GR_AUDIT_WRITE = 0x00001000, ++ GR_AUDIT_EXEC = 0x00002000, ++ GR_AUDIT_FIND = 0x00004000, ++ GR_AUDIT_INHERIT= 0x00008000, ++ GR_AUDIT_SETID = 0x00010000, ++ GR_AUDIT_CREATE = 0x00020000, ++ GR_AUDIT_DELETE = 0x00040000, ++ GR_AUDIT_LINK = 0x00080000, ++ GR_PTRACERD = 0x00100000, ++ GR_NOPTRACE = 0x00200000, ++ GR_SUPPRESS = 0x00400000, ++ GR_NOLEARN = 0x00800000, ++ GR_INIT_TRANSFER= 0x01000000 ++}; ++ ++#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \ ++ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \ ++ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK) ++ ++/* ACL subject-only mode flags */ ++enum { ++ GR_KILL = 0x00000001, ++ GR_VIEW = 0x00000002, ++ GR_PROTECTED = 0x00000004, ++ GR_LEARN = 0x00000008, ++ GR_OVERRIDE = 0x00000010, ++ /* just a placeholder, this mode is only used in userspace */ ++ GR_DUMMY = 0x00000020, ++ GR_PROTSHM = 0x00000040, ++ GR_KILLPROC = 0x00000080, ++ GR_KILLIPPROC = 0x00000100, ++ /* just a placeholder, this mode is only used in userspace */ ++ GR_NOTROJAN = 0x00000200, ++ GR_PROTPROCFD = 0x00000400, ++ GR_PROCACCT = 0x00000800, ++ GR_RELAXPTRACE = 0x00001000, ++ //GR_NESTED = 0x00002000, ++ GR_INHERITLEARN = 0x00004000, ++ GR_PROCFIND = 0x00008000, ++ GR_POVERRIDE = 0x00010000, ++ GR_KERNELAUTH = 0x00020000, ++ GR_ATSECURE = 0x00040000, ++ GR_SHMEXEC = 0x00080000 ++}; ++ ++enum { ++ GR_PAX_ENABLE_SEGMEXEC = 0x0001, ++ GR_PAX_ENABLE_PAGEEXEC = 0x0002, ++ GR_PAX_ENABLE_MPROTECT = 0x0004, ++ GR_PAX_ENABLE_RANDMMAP = 0x0008, ++ GR_PAX_ENABLE_EMUTRAMP = 0x0010, ++ GR_PAX_DISABLE_SEGMEXEC = 0x0100, ++ GR_PAX_DISABLE_PAGEEXEC = 0x0200, ++ GR_PAX_DISABLE_MPROTECT = 0x0400, ++ GR_PAX_DISABLE_RANDMMAP = 0x0800, ++ GR_PAX_DISABLE_EMUTRAMP = 0x1000, ++}; ++ ++enum { ++ GR_ID_USER = 0x01, ++ GR_ID_GROUP = 0x02, ++}; ++ ++enum { ++ GR_ID_ALLOW = 0x01, ++ GR_ID_DENY = 0x02, ++}; ++ ++#define GR_CRASH_RES 31 ++#define GR_UIDTABLE_MAX 500 ++ ++/* begin resource learning section */ ++enum { ++ GR_RLIM_CPU_BUMP = 60, ++ GR_RLIM_FSIZE_BUMP = 50000, ++ GR_RLIM_DATA_BUMP = 10000, ++ GR_RLIM_STACK_BUMP = 1000, ++ GR_RLIM_CORE_BUMP = 10000, ++ GR_RLIM_RSS_BUMP = 500000, ++ GR_RLIM_NPROC_BUMP = 1, ++ GR_RLIM_NOFILE_BUMP = 5, ++ GR_RLIM_MEMLOCK_BUMP = 50000, ++ GR_RLIM_AS_BUMP = 500000, ++ GR_RLIM_LOCKS_BUMP = 2, ++ GR_RLIM_SIGPENDING_BUMP = 5, ++ GR_RLIM_MSGQUEUE_BUMP = 10000, ++ GR_RLIM_NICE_BUMP = 1, ++ GR_RLIM_RTPRIO_BUMP = 1, ++ GR_RLIM_RTTIME_BUMP = 1000000 ++}; ++ ++#endif +diff -Naur backports-3.18.1-1.org/include/linux/grinternal.h backports-3.18.1-1/include/linux/grinternal.h +--- backports-3.18.1-1.org/include/linux/grinternal.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/grinternal.h 2014-12-28 14:10:09.688889562 +0100 +@@ -0,0 +1,229 @@ ++#ifndef __GRINTERNAL_H ++#define __GRINTERNAL_H ++ ++#ifdef CONFIG_GRKERNSEC ++ ++#include <linux/fs.h> ++#include <linux/mnt_namespace.h> ++#include <linux/nsproxy.h> ++#include <linux/gracl.h> ++#include <linux/grdefs.h> ++#include <linux/grmsg.h> ++ ++void gr_add_learn_entry(const char *fmt, ...) ++ __attribute__ ((format (printf, 1, 2))); ++__u32 gr_search_file(const struct dentry *dentry, const __u32 mode, ++ const struct vfsmount *mnt); ++__u32 gr_check_create(const struct dentry *new_dentry, ++ const struct dentry *parent, ++ const struct vfsmount *mnt, const __u32 mode); ++int gr_check_protected_task(const struct task_struct *task); ++__u32 to_gr_audit(const __u32 reqmode); ++int gr_set_acls(const int type); ++int gr_acl_is_enabled(void); ++char gr_roletype_to_char(void); ++ ++void gr_handle_alertkill(struct task_struct *task); ++char *gr_to_filename(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++char *gr_to_filename1(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++char *gr_to_filename2(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++char *gr_to_filename3(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++ ++extern int grsec_enable_ptrace_readexec; ++extern int grsec_enable_harden_ptrace; ++extern int grsec_enable_link; ++extern int grsec_enable_fifo; ++extern int grsec_enable_execve; ++extern int grsec_enable_shm; ++extern int grsec_enable_execlog; ++extern int grsec_enable_signal; ++extern int grsec_enable_audit_ptrace; ++extern int grsec_enable_forkfail; ++extern int grsec_enable_time; ++extern int grsec_enable_rofs; ++extern int grsec_deny_new_usb; ++extern int grsec_enable_chroot_shmat; ++extern int grsec_enable_chroot_mount; ++extern int grsec_enable_chroot_double; ++extern int grsec_enable_chroot_pivot; ++extern int grsec_enable_chroot_chdir; ++extern int grsec_enable_chroot_chmod; ++extern int grsec_enable_chroot_mknod; ++extern int grsec_enable_chroot_fchdir; ++extern int grsec_enable_chroot_nice; ++extern int grsec_enable_chroot_execlog; ++extern int grsec_enable_chroot_caps; ++extern int grsec_enable_chroot_sysctl; ++extern int grsec_enable_chroot_unix; ++extern int grsec_enable_symlinkown; ++extern kgid_t grsec_symlinkown_gid; ++extern int grsec_enable_tpe; ++extern kgid_t grsec_tpe_gid; ++extern int grsec_enable_tpe_all; ++extern int grsec_enable_tpe_invert; ++extern int grsec_enable_socket_all; ++extern kgid_t grsec_socket_all_gid; ++extern int grsec_enable_socket_client; ++extern kgid_t grsec_socket_client_gid; ++extern int grsec_enable_socket_server; ++extern kgid_t grsec_socket_server_gid; ++extern kgid_t grsec_audit_gid; ++extern int grsec_enable_group; ++extern int grsec_enable_log_rwxmaps; ++extern int grsec_enable_mount; ++extern int grsec_enable_chdir; ++extern int grsec_resource_logging; ++extern int grsec_enable_blackhole; ++extern int grsec_lastack_retries; ++extern int grsec_enable_brute; ++extern int grsec_enable_harden_ipc; ++extern int grsec_lock; ++ ++extern spinlock_t grsec_alert_lock; ++extern unsigned long grsec_alert_wtime; ++extern unsigned long grsec_alert_fyet; ++ ++extern spinlock_t grsec_audit_lock; ++ ++extern rwlock_t grsec_exec_file_lock; ++ ++#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \ ++ gr_to_filename2((tsk)->exec_file->f_path.dentry, \ ++ (tsk)->exec_file->f_path.mnt) : "/") ++ ++#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \ ++ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \ ++ (tsk)->real_parent->exec_file->f_path.mnt) : "/") ++ ++#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \ ++ gr_to_filename((tsk)->exec_file->f_path.dentry, \ ++ (tsk)->exec_file->f_path.mnt) : "/") ++ ++#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \ ++ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \ ++ (tsk)->real_parent->exec_file->f_path.mnt) : "/") ++ ++#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted) ++ ++#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry) ++ ++static inline bool gr_is_same_file(const struct file *file1, const struct file *file2) ++{ ++ if (file1 && file2) { ++ const struct inode *inode1 = file1->f_path.dentry->d_inode; ++ const struct inode *inode2 = file2->f_path.dentry->d_inode; ++ if (inode1->i_ino == inode2->i_ino && inode1->i_sb->s_dev == inode2->i_sb->s_dev) ++ return true; ++ } ++ ++ return false; ++} ++ ++#define GR_CHROOT_CAPS {{ \ ++ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \ ++ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \ ++ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \ ++ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \ ++ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \ ++ CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \ ++ CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }} ++ ++#define security_learn(normal_msg,args...) \ ++({ \ ++ read_lock(&grsec_exec_file_lock); \ ++ gr_add_learn_entry(normal_msg "\n", ## args); \ ++ read_unlock(&grsec_exec_file_lock); \ ++}) ++ ++enum { ++ GR_DO_AUDIT, ++ GR_DONT_AUDIT, ++ /* used for non-audit messages that we shouldn't kill the task on */ ++ GR_DONT_AUDIT_GOOD ++}; ++ ++enum { ++ GR_TTYSNIFF, ++ GR_RBAC, ++ GR_RBAC_STR, ++ GR_STR_RBAC, ++ GR_RBAC_MODE2, ++ GR_RBAC_MODE3, ++ GR_FILENAME, ++ GR_SYSCTL_HIDDEN, ++ GR_NOARGS, ++ GR_ONE_INT, ++ GR_ONE_INT_TWO_STR, ++ GR_ONE_STR, ++ GR_STR_INT, ++ GR_TWO_STR_INT, ++ GR_TWO_INT, ++ GR_TWO_U64, ++ GR_THREE_INT, ++ GR_FIVE_INT_TWO_STR, ++ GR_TWO_STR, ++ GR_THREE_STR, ++ GR_FOUR_STR, ++ GR_STR_FILENAME, ++ GR_FILENAME_STR, ++ GR_FILENAME_TWO_INT, ++ GR_FILENAME_TWO_INT_STR, ++ GR_TEXTREL, ++ GR_PTRACE, ++ GR_RESOURCE, ++ GR_CAP, ++ GR_SIG, ++ GR_SIG2, ++ GR_CRASH1, ++ GR_CRASH2, ++ GR_PSACCT, ++ GR_RWXMAP, ++ GR_RWXMAPVMA ++}; ++ ++#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str) ++#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task) ++#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt) ++#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str) ++#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt) ++#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2) ++#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3) ++#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt) ++#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS) ++#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num) ++#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2) ++#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str) ++#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num) ++#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2) ++#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2) ++#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3) ++#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2) ++#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2) ++#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num) ++#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3) ++#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4) ++#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt) ++#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str) ++#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2) ++#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str) ++#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2) ++#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task) ++#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2) ++#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str) ++#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr) ++#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num) ++#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong) ++#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1) ++#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) ++#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str) ++#define gr_log_rwxmap_vma(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAPVMA, str) ++ ++void gr_log_varargs(int audit, const char *msg, int argtypes, ...); ++ ++#endif ++ ++#endif +diff -Naur backports-3.18.1-1.org/include/linux/grmsg.h backports-3.18.1-1/include/linux/grmsg.h +--- backports-3.18.1-1.org/include/linux/grmsg.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/grmsg.h 2014-12-28 14:10:09.688889562 +0100 +@@ -0,0 +1,117 @@ ++#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u" ++#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u" ++#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by " ++#define GR_STOPMOD_MSG "denied modification of module state by " ++#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by " ++#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by " ++#define GR_IOPERM_MSG "denied use of ioperm() by " ++#define GR_IOPL_MSG "denied use of iopl() by " ++#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by " ++#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by " ++#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by " ++#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by " ++#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by " ++#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4" ++#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4" ++#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by " ++#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by " ++#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by " ++#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by " ++#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by " ++#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by " ++#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by " ++#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against " ++#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by " ++#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by " ++#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by " ++#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by " ++#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for " ++#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by " ++#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by " ++#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by " ++#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by " ++#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by " ++#define GR_EXEC_ACL_MSG "%s execution of %.950s by " ++#define GR_EXEC_TPE_MSG "denied untrusted exec (due to %.70s) of %.950s by " ++#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds" ++#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds" ++#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by " ++#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by " ++#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by " ++#define GR_ATIME_ACL_MSG "%s access time change of %.950s by " ++#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by " ++#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by " ++#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by " ++#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by " ++#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by " ++#define GR_CHROOT_FHANDLE_MSG "denied use of file handles inside chroot by " ++#define GR_CHOWN_ACL_MSG "%s chown of %.950s by " ++#define GR_SETXATTR_ACL_MSG "%s setting extended attribute of %.950s by " ++#define GR_REMOVEXATTR_ACL_MSG "%s removing extended attribute of %.950s by " ++#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by " ++#define GR_INITF_ACL_MSG "init_variables() failed %s by " ++#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader" ++#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbage by " ++#define GR_SHUTS_ACL_MSG "shutdown auth success for " ++#define GR_SHUTF_ACL_MSG "shutdown auth failure for " ++#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for " ++#define GR_SEGVMODS_ACL_MSG "segvmod auth success for " ++#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for " ++#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for " ++#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by " ++#define GR_ENABLEF_ACL_MSG "unable to load %s for " ++#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system" ++#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by " ++#define GR_RELOADF_ACL_MSG "failed reload of %s for " ++#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for " ++#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by " ++#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by " ++#define GR_SPROLEF_ACL_MSG "special role %s failure for " ++#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for " ++#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by " ++#define GR_INVMODE_ACL_MSG "invalid mode %d by " ++#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by " ++#define GR_FAILFORK_MSG "failed fork with errno %s by " ++#define GR_NICE_CHROOT_MSG "denied priority change by " ++#define GR_UNISIGLOG_MSG "%.32s occurred at %p in " ++#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by " ++#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by " ++#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by " ++#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by " ++#define GR_TIME_MSG "time set by " ++#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by " ++#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by " ++#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by " ++#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by " ++#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by " ++#define GR_BIND_MSG "denied bind() by " ++#define GR_CONNECT_MSG "denied connect() by " ++#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by " ++#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by " ++#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4" ++#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process " ++#define GR_CAP_ACL_MSG "use of %s denied for " ++#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for " ++#define GR_CAP_ACL_MSG2 "use of %s permitted for " ++#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for " ++#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for " ++#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by " ++#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by " ++#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by " ++#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by " ++#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by " ++#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for " ++#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by " ++#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by " ++#define GR_TEXTREL_AUDIT_MSG "denied text relocation in %.950s, VMA:0x%08lx 0x%08lx by " ++#define GR_PTGNUSTACK_MSG "denied marking stack executable as requested by PT_GNU_STACK marking in %.950s by " ++#define GR_VM86_MSG "denied use of vm86 by " ++#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by " ++#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable binary %.950s by " ++#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by " ++#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by " ++#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by " ++#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds. Please investigate the crash report for " ++#define GR_BRUTE_SUID_MSG "bruteforce prevention initiated due to crash of %.950s against uid %u, banning suid/sgid execs for %u minutes. Please investigate the crash report for " ++#define GR_IPC_DENIED_MSG "denied %s of overly-permissive IPC object with creator uid %u by " ++#define GR_MSRWRITE_MSG "denied write to CPU MSR by " +diff -Naur backports-3.18.1-1.org/include/linux/grsecurity.h backports-3.18.1-1/include/linux/grsecurity.h +--- backports-3.18.1-1.org/include/linux/grsecurity.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/grsecurity.h 2014-12-28 14:10:09.688889562 +0100 +@@ -0,0 +1,254 @@ ++#ifndef GR_SECURITY_H ++#define GR_SECURITY_H ++#include <linux/fs.h> ++#include <linux/fs_struct.h> ++#include <linux/binfmts.h> ++#include <linux/gracl.h> ++ ++/* notify of brain-dead configs */ ++#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP) ++#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled." ++#endif ++#if defined(CONFIG_GRKERNSEC_PROC) && !defined(CONFIG_GRKERNSEC_PROC_USER) && !defined(CONFIG_GRKERNSEC_PROC_USERGROUP) ++#error "CONFIG_GRKERNSEC_PROC enabled, but neither CONFIG_GRKERNSEC_PROC_USER nor CONFIG_GRKERNSEC_PROC_USERGROUP enabled" ++#endif ++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC) ++#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled." ++#endif ++#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP) ++#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled." ++#endif ++#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR) ++#error "CONFIG_PAX enabled, but no PaX options are enabled." ++#endif ++ ++int gr_handle_new_usb(void); ++ ++void gr_handle_brute_attach(int dumpable); ++void gr_handle_brute_check(void); ++void gr_handle_kernel_exploit(void); ++ ++char gr_roletype_to_char(void); ++ ++int gr_proc_is_restricted(void); ++ ++int gr_acl_enable_at_secure(void); ++ ++int gr_check_user_change(kuid_t real, kuid_t effective, kuid_t fs); ++int gr_check_group_change(kgid_t real, kgid_t effective, kgid_t fs); ++ ++int gr_learn_cap(const struct task_struct *task, const struct cred *cred, const int cap); ++ ++void gr_del_task_from_ip_table(struct task_struct *p); ++ ++int gr_pid_is_chrooted(struct task_struct *p); ++int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type); ++int gr_handle_chroot_nice(void); ++int gr_handle_chroot_sysctl(const int op); ++int gr_handle_chroot_setpriority(struct task_struct *p, ++ const int niceval); ++int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt); ++int gr_chroot_fhandle(void); ++int gr_handle_chroot_chroot(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++void gr_handle_chroot_chdir(const struct path *path); ++int gr_handle_chroot_chmod(const struct dentry *dentry, ++ const struct vfsmount *mnt, const int mode); ++int gr_handle_chroot_mknod(const struct dentry *dentry, ++ const struct vfsmount *mnt, const int mode); ++int gr_handle_chroot_mount(const struct dentry *dentry, ++ const struct vfsmount *mnt, ++ const char *dev_name); ++int gr_handle_chroot_pivot(void); ++int gr_handle_chroot_unix(const pid_t pid); ++ ++int gr_handle_rawio(const struct inode *inode); ++ ++void gr_handle_ioperm(void); ++void gr_handle_iopl(void); ++void gr_handle_msr_write(void); ++ ++umode_t gr_acl_umask(void); ++ ++int gr_tpe_allow(const struct file *file); ++ ++void gr_set_chroot_entries(struct task_struct *task, const struct path *path); ++void gr_clear_chroot_entries(struct task_struct *task); ++ ++void gr_log_forkfail(const int retval); ++void gr_log_timechange(void); ++void gr_log_signal(const int sig, const void *addr, const struct task_struct *t); ++void gr_log_chdir(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++void gr_log_chroot_exec(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++void gr_log_remount(const char *devname, const int retval); ++void gr_log_unmount(const char *devname, const int retval); ++void gr_log_mount(const char *from, const char *to, const int retval); ++void gr_log_textrel(struct vm_area_struct *vma); ++void gr_log_ptgnustack(struct file *file); ++void gr_log_rwxmmap(struct file *file); ++void gr_log_rwxmprotect(struct vm_area_struct *vma); ++ ++int gr_handle_follow_link(const struct inode *parent, ++ const struct inode *inode, ++ const struct dentry *dentry, ++ const struct vfsmount *mnt); ++int gr_handle_fifo(const struct dentry *dentry, ++ const struct vfsmount *mnt, ++ const struct dentry *dir, const int flag, ++ const int acc_mode); ++int gr_handle_hardlink(const struct dentry *dentry, ++ const struct vfsmount *mnt, ++ struct inode *inode, ++ const int mode, const struct filename *to); ++ ++int gr_is_capable(const int cap); ++int gr_is_capable_nolog(const int cap); ++int gr_task_is_capable(const struct task_struct *task, const struct cred *cred, const int cap); ++int gr_task_is_capable_nolog(const struct task_struct *task, const int cap); ++ ++void gr_copy_label(struct task_struct *tsk); ++void gr_handle_crash(struct task_struct *task, const int sig); ++int gr_handle_signal(const struct task_struct *p, const int sig); ++int gr_check_crash_uid(const kuid_t uid); ++int gr_check_protected_task(const struct task_struct *task); ++int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type); ++int gr_acl_handle_mmap(const struct file *file, ++ const unsigned long prot); ++int gr_acl_handle_mprotect(const struct file *file, ++ const unsigned long prot); ++int gr_check_hidden_task(const struct task_struct *tsk); ++__u32 gr_acl_handle_truncate(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++__u32 gr_acl_handle_utime(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++__u32 gr_acl_handle_access(const struct dentry *dentry, ++ const struct vfsmount *mnt, const int fmode); ++__u32 gr_acl_handle_chmod(const struct dentry *dentry, ++ const struct vfsmount *mnt, umode_t *mode); ++__u32 gr_acl_handle_chown(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++__u32 gr_acl_handle_setxattr(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++__u32 gr_acl_handle_removexattr(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++int gr_handle_ptrace(struct task_struct *task, const long request); ++int gr_handle_proc_ptrace(struct task_struct *task); ++__u32 gr_acl_handle_execve(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++int gr_check_crash_exec(const struct file *filp); ++int gr_acl_is_enabled(void); ++void gr_set_role_label(struct task_struct *task, const kuid_t uid, ++ const kgid_t gid); ++int gr_set_proc_label(const struct dentry *dentry, ++ const struct vfsmount *mnt, ++ const int unsafe_flags); ++__u32 gr_acl_handle_hidden_file(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++__u32 gr_acl_handle_open(const struct dentry *dentry, ++ const struct vfsmount *mnt, int acc_mode); ++__u32 gr_acl_handle_creat(const struct dentry *dentry, ++ const struct dentry *p_dentry, ++ const struct vfsmount *p_mnt, ++ int open_flags, int acc_mode, const int imode); ++void gr_handle_create(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++void gr_handle_proc_create(const struct dentry *dentry, ++ const struct inode *inode); ++__u32 gr_acl_handle_mknod(const struct dentry *new_dentry, ++ const struct dentry *parent_dentry, ++ const struct vfsmount *parent_mnt, ++ const int mode); ++__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry, ++ const struct dentry *parent_dentry, ++ const struct vfsmount *parent_mnt); ++__u32 gr_acl_handle_rmdir(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++void gr_handle_delete(const ino_t ino, const dev_t dev); ++__u32 gr_acl_handle_unlink(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++__u32 gr_acl_handle_symlink(const struct dentry *new_dentry, ++ const struct dentry *parent_dentry, ++ const struct vfsmount *parent_mnt, ++ const struct filename *from); ++__u32 gr_acl_handle_link(const struct dentry *new_dentry, ++ const struct dentry *parent_dentry, ++ const struct vfsmount *parent_mnt, ++ const struct dentry *old_dentry, ++ const struct vfsmount *old_mnt, const struct filename *to); ++int gr_handle_symlink_owner(const struct path *link, const struct inode *target); ++int gr_acl_handle_rename(struct dentry *new_dentry, ++ struct dentry *parent_dentry, ++ const struct vfsmount *parent_mnt, ++ struct dentry *old_dentry, ++ struct inode *old_parent_inode, ++ struct vfsmount *old_mnt, const struct filename *newname, unsigned int flags); ++void gr_handle_rename(struct inode *old_dir, struct inode *new_dir, ++ struct dentry *old_dentry, ++ struct dentry *new_dentry, ++ struct vfsmount *mnt, const __u8 replace, unsigned int flags); ++__u32 gr_check_link(const struct dentry *new_dentry, ++ const struct dentry *parent_dentry, ++ const struct vfsmount *parent_mnt, ++ const struct dentry *old_dentry, ++ const struct vfsmount *old_mnt); ++int gr_acl_handle_filldir(const struct file *file, const char *name, ++ const unsigned int namelen, const ino_t ino); ++ ++__u32 gr_acl_handle_unix(const struct dentry *dentry, ++ const struct vfsmount *mnt); ++void gr_acl_handle_exit(void); ++void gr_acl_handle_psacct(struct task_struct *task, const long code); ++int gr_acl_handle_procpidmem(const struct task_struct *task); ++int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags); ++int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode); ++void gr_audit_ptrace(struct task_struct *task); ++dev_t gr_get_dev_from_dentry(struct dentry *dentry); ++void gr_put_exec_file(struct task_struct *task); ++ ++int gr_ptrace_readexec(struct file *file, int unsafe_flags); ++ ++#if defined(CONFIG_GRKERNSEC) && (defined(CONFIG_GRKERNSEC_RESLOG) || !defined(CONFIG_GRKERNSEC_NO_RBAC)) ++extern void gr_learn_resource(const struct task_struct *task, const int res, ++ const unsigned long wanted, const int gt); ++#else ++static inline void gr_learn_resource(const struct task_struct *task, const int res, ++ const unsigned long wanted, const int gt) ++{ ++} ++#endif ++ ++#ifdef CONFIG_GRKERNSEC_RESLOG ++extern void gr_log_resource(const struct task_struct *task, const int res, ++ const unsigned long wanted, const int gt); ++#else ++static inline void gr_log_resource(const struct task_struct *task, const int res, ++ const unsigned long wanted, const int gt) ++{ ++} ++#endif ++ ++#ifdef CONFIG_GRKERNSEC ++void task_grsec_rbac(struct seq_file *m, struct task_struct *p); ++void gr_handle_vm86(void); ++void gr_handle_mem_readwrite(u64 from, u64 to); ++ ++void gr_log_badprocpid(const char *entry); ++ ++extern int grsec_enable_dmesg; ++extern int grsec_disable_privio; ++ ++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP ++extern kgid_t grsec_proc_gid; ++#endif ++ ++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK ++extern int grsec_enable_chroot_findtask; ++#endif ++#ifdef CONFIG_GRKERNSEC_SETXID ++extern int grsec_enable_setxid; ++#endif ++#endif ++ ++#endif +diff -Naur backports-3.18.1-1.org/include/linux/grsock.h backports-3.18.1-1/include/linux/grsock.h +--- backports-3.18.1-1.org/include/linux/grsock.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/linux/grsock.h 2014-12-28 14:10:09.688889562 +0100 +@@ -0,0 +1,19 @@ ++#ifndef __GRSOCK_H ++#define __GRSOCK_H ++ ++extern void gr_attach_curr_ip(const struct sock *sk); ++extern int gr_handle_sock_all(const int family, const int type, ++ const int protocol); ++extern int gr_handle_sock_server(const struct sockaddr *sck); ++extern int gr_handle_sock_server_other(const struct sock *sck); ++extern int gr_handle_sock_client(const struct sockaddr *sck); ++extern int gr_search_connect(struct socket * sock, ++ struct sockaddr_in * addr); ++extern int gr_search_bind(struct socket * sock, ++ struct sockaddr_in * addr); ++extern int gr_search_listen(struct socket * sock); ++extern int gr_search_accept(struct socket * sock); ++extern int gr_search_socket(const int domain, const int type, ++ const int protocol); ++ ++#endif +diff -Naur backports-3.18.1-1.org/include/linux/unaligned/access_ok.h backports-3.18.1-1/include/linux/unaligned/access_ok.h +--- backports-3.18.1-1.org/include/linux/unaligned/access_ok.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/include/linux/unaligned/access_ok.h 2014-12-28 14:10:09.712889681 +0100 +@@ -4,34 +4,34 @@ + #include <linux/kernel.h> + #include <asm/byteorder.h> + +-static inline u16 get_unaligned_le16(const void *p) ++static inline u16 __intentional_overflow(-1) get_unaligned_le16(const void *p) + { +- return le16_to_cpup((__le16 *)p); ++ return le16_to_cpup((const __le16 *)p); + } + +-static inline u32 get_unaligned_le32(const void *p) ++static inline u32 __intentional_overflow(-1) get_unaligned_le32(const void *p) + { +- return le32_to_cpup((__le32 *)p); ++ return le32_to_cpup((const __le32 *)p); + } + +-static inline u64 get_unaligned_le64(const void *p) ++static inline u64 __intentional_overflow(-1) get_unaligned_le64(const void *p) + { +- return le64_to_cpup((__le64 *)p); ++ return le64_to_cpup((const __le64 *)p); + } + +-static inline u16 get_unaligned_be16(const void *p) ++static inline u16 __intentional_overflow(-1) get_unaligned_be16(const void *p) + { +- return be16_to_cpup((__be16 *)p); ++ return be16_to_cpup((const __be16 *)p); + } + +-static inline u32 get_unaligned_be32(const void *p) ++static inline u32 __intentional_overflow(-1) get_unaligned_be32(const void *p) + { +- return be32_to_cpup((__be32 *)p); ++ return be32_to_cpup((const __be32 *)p); + } + +-static inline u64 get_unaligned_be64(const void *p) ++static inline u64 __intentional_overflow(-1) get_unaligned_be64(const void *p) + { +- return be64_to_cpup((__be64 *)p); ++ return be64_to_cpup((const __be64 *)p); + } + + static inline void put_unaligned_le16(u16 val, void *p) +diff -Naur backports-3.18.1-1.org/include/media/v4l2-dev.h backports-3.18.1-1/include/media/v4l2-dev.h +--- backports-3.18.1-1.org/include/media/v4l2-dev.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/include/media/v4l2-dev.h 2014-12-28 14:10:09.716889709 +0100 +@@ -75,7 +75,7 @@ + int (*mmap) (struct file *, struct vm_area_struct *); + int (*open) (struct file *); + int (*release) (struct file *); +-}; ++} __do_const; + + /* + * Newer version of video_device, handled by videodev2.c +diff -Naur backports-3.18.1-1.org/include/media/v4l2-device.h backports-3.18.1-1/include/media/v4l2-device.h +--- backports-3.18.1-1.org/include/media/v4l2-device.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/include/media/v4l2-device.h 2014-12-28 14:10:09.716889709 +0100 +@@ -95,7 +95,7 @@ + this function returns 0. If the name ends with a digit (e.g. cx18), + then the name will be set to cx18-0 since cx180 looks really odd. */ + int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename, +- atomic_t *instance); ++ atomic_unchecked_t *instance); + + /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects. + Since the parent disappears this ensures that v4l2_dev doesn't have an +diff -Naur backports-3.18.1-1.org/include/net/bluetooth/l2cap.h backports-3.18.1-1/include/net/bluetooth/l2cap.h +--- backports-3.18.1-1.org/include/net/bluetooth/l2cap.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/include/net/bluetooth/l2cap.h 2014-12-28 14:10:09.716889709 +0100 +@@ -608,7 +608,7 @@ + unsigned char *kdata, + struct iovec *iov, + int len); +-}; ++} __do_const; + + struct l2cap_conn { + struct hci_conn *hcon; +diff -Naur backports-3.18.1-1.org/include/net/mac80211.h backports-3.18.1-1/include/net/mac80211.h +--- backports-3.18.1-1.org/include/net/mac80211.h 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/include/net/mac80211.h 2014-12-28 14:10:09.724889743 +0100 +@@ -4648,7 +4648,7 @@ + void (*remove_sta_debugfs)(void *priv, void *priv_sta); + + u32 (*get_expected_throughput)(void *priv_sta); +-}; ++} __do_const; + + static inline int rate_supported(struct ieee80211_sta *sta, + enum ieee80211_band band, +diff -Naur backports-3.18.1-1.org/include/trace/events/fs.h backports-3.18.1-1/include/trace/events/fs.h +--- backports-3.18.1-1.org/include/trace/events/fs.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/include/trace/events/fs.h 2014-12-28 14:10:09.728889769 +0100 +@@ -0,0 +1,53 @@ ++#undef TRACE_SYSTEM ++#define TRACE_SYSTEM fs ++ ++#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ) ++#define _TRACE_FS_H ++ ++#include <linux/fs.h> ++#include <linux/tracepoint.h> ++ ++TRACE_EVENT(do_sys_open, ++ ++ TP_PROTO(const char *filename, int flags, int mode), ++ ++ TP_ARGS(filename, flags, mode), ++ ++ TP_STRUCT__entry( ++ __string( filename, filename ) ++ __field( int, flags ) ++ __field( int, mode ) ++ ), ++ ++ TP_fast_assign( ++ __assign_str(filename, filename); ++ __entry->flags = flags; ++ __entry->mode = mode; ++ ), ++ ++ TP_printk(""%s" %x %o", ++ __get_str(filename), __entry->flags, __entry->mode) ++); ++ ++TRACE_EVENT(open_exec, ++ ++ TP_PROTO(const char *filename), ++ ++ TP_ARGS(filename), ++ ++ TP_STRUCT__entry( ++ __string( filename, filename ) ++ ), ++ ++ TP_fast_assign( ++ __assign_str(filename, filename); ++ ), ++ ++ TP_printk(""%s"", ++ __get_str(filename)) ++); ++ ++#endif /* _TRACE_FS_H */ ++ ++/* This part must be outside protection */ ++#include <trace/define_trace.h> +diff -Naur backports-3.18.1-1.org/net/bluetooth/6lowpan.c backports-3.18.1-1/net/bluetooth/6lowpan.c +--- backports-3.18.1-1.org/net/bluetooth/6lowpan.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/6lowpan.c 2014-12-28 14:10:09.784890034 +0100 +@@ -367,7 +367,6 @@ + + drop: + dev->stats.rx_dropped++; +- kfree_skb(skb); + return NET_RX_DROP; + } + +diff -Naur backports-3.18.1-1.org/net/bluetooth/bnep/core.c backports-3.18.1-1/net/bluetooth/bnep/core.c +--- backports-3.18.1-1.org/net/bluetooth/bnep/core.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/bnep/core.c 2014-12-28 14:10:09.784890034 +0100 +@@ -533,6 +533,9 @@ + + BT_DBG(""); + ++ if (!l2cap_is_socket(sock)) ++ return -EBADFD; ++ + baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst); + baswap((void *) src, &l2cap_pi(sock->sk)->chan->src); + +diff -Naur backports-3.18.1-1.org/net/bluetooth/cmtp/core.c backports-3.18.1-1/net/bluetooth/cmtp/core.c +--- backports-3.18.1-1.org/net/bluetooth/cmtp/core.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/cmtp/core.c 2014-12-28 14:10:09.784890034 +0100 +@@ -334,6 +334,9 @@ + + BT_DBG(""); + ++ if (!l2cap_is_socket(sock)) ++ return -EBADFD; ++ + session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL); + if (!session) + return -ENOMEM; +diff -Naur backports-3.18.1-1.org/net/bluetooth/hci_sock.c backports-3.18.1-1/net/bluetooth/hci_sock.c +--- backports-3.18.1-1.org/net/bluetooth/hci_sock.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/hci_sock.c 2014-12-28 14:10:09.784890034 +0100 +@@ -1067,7 +1067,7 @@ + uf.event_mask[1] = *((u32 *) f->event_mask + 1); + } + +- len = min_t(unsigned int, len, sizeof(uf)); ++ len = min((size_t)len, sizeof(uf)); + if (copy_from_user(&uf, optval, len)) { + err = -EFAULT; + break; +diff -Naur backports-3.18.1-1.org/net/bluetooth/hidp/core.c backports-3.18.1-1/net/bluetooth/hidp/core.c +--- backports-3.18.1-1.org/net/bluetooth/hidp/core.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/hidp/core.c 2014-12-28 14:10:09.784890034 +0100 +@@ -1322,13 +1322,14 @@ + { + struct hidp_session *session; + struct l2cap_conn *conn; +- struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan; ++ struct l2cap_chan *chan; + int ret; + + ret = hidp_verify_sockets(ctrl_sock, intr_sock); + if (ret) + return ret; + ++ chan = l2cap_pi(ctrl_sock->sk)->chan; + conn = NULL; + l2cap_chan_lock(chan); + if (chan->conn) +diff -Naur backports-3.18.1-1.org/net/bluetooth/l2cap_core.c backports-3.18.1-1/net/bluetooth/l2cap_core.c +--- backports-3.18.1-1.org/net/bluetooth/l2cap_core.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/l2cap_core.c 2014-12-28 14:10:09.784890034 +0100 +@@ -3512,8 +3512,10 @@ + break; + + case L2CAP_CONF_RFC: +- if (olen == sizeof(rfc)) +- memcpy(&rfc, (void *)val, olen); ++ if (olen != sizeof(rfc)) ++ break; ++ ++ memcpy(&rfc, (void *)val, olen); + + if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && + rfc.mode != chan->mode) +diff -Naur backports-3.18.1-1.org/net/bluetooth/l2cap_sock.c backports-3.18.1-1/net/bluetooth/l2cap_sock.c +--- backports-3.18.1-1.org/net/bluetooth/l2cap_sock.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/l2cap_sock.c 2014-12-28 14:10:09.788890064 +0100 +@@ -628,7 +628,8 @@ + struct sock *sk = sock->sk; + struct l2cap_chan *chan = l2cap_pi(sk)->chan; + struct l2cap_options opts; +- int len, err = 0; ++ int err = 0; ++ size_t len = optlen; + u32 opt; + + BT_DBG("sk %p", sk); +@@ -655,7 +656,7 @@ + opts.max_tx = chan->max_tx; + opts.txwin_size = chan->tx_win; + +- len = min_t(unsigned int, sizeof(opts), optlen); ++ len = min(sizeof(opts), len); + if (copy_from_user((char *) &opts, optval, len)) { + err = -EFAULT; + break; +@@ -742,7 +743,8 @@ + struct bt_security sec; + struct bt_power pwr; + struct l2cap_conn *conn; +- int len, err = 0; ++ int err = 0; ++ size_t len = optlen; + u32 opt; + + BT_DBG("sk %p", sk); +@@ -766,7 +768,7 @@ + + sec.level = BT_SECURITY_LOW; + +- len = min_t(unsigned int, sizeof(sec), optlen); ++ len = min(sizeof(sec), len); + if (copy_from_user((char *) &sec, optval, len)) { + err = -EFAULT; + break; +@@ -862,7 +864,7 @@ + + pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; + +- len = min_t(unsigned int, sizeof(pwr), optlen); ++ len = min(sizeof(pwr), len); + if (copy_from_user((char *) &pwr, optval, len)) { + err = -EFAULT; + break; +diff -Naur backports-3.18.1-1.org/net/bluetooth/rfcomm/sock.c backports-3.18.1-1/net/bluetooth/rfcomm/sock.c +--- backports-3.18.1-1.org/net/bluetooth/rfcomm/sock.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/rfcomm/sock.c 2014-12-28 14:10:09.788890064 +0100 +@@ -695,7 +695,7 @@ + struct sock *sk = sock->sk; + struct bt_security sec; + int err = 0; +- size_t len; ++ size_t len = optlen; + u32 opt; + + BT_DBG("sk %p", sk); +@@ -717,7 +717,7 @@ + + sec.level = BT_SECURITY_LOW; + +- len = min_t(unsigned int, sizeof(sec), optlen); ++ len = min(sizeof(sec), len); + if (copy_from_user((char *) &sec, optval, len)) { + err = -EFAULT; + break; +diff -Naur backports-3.18.1-1.org/net/bluetooth/rfcomm/tty.c backports-3.18.1-1/net/bluetooth/rfcomm/tty.c +--- backports-3.18.1-1.org/net/bluetooth/rfcomm/tty.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/bluetooth/rfcomm/tty.c 2014-12-28 14:10:09.788890064 +0100 +@@ -752,7 +752,7 @@ + BT_DBG("tty %p id %d", tty, tty->index); + + BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst, +- dev->channel, dev->port.count); ++ dev->channel, atomic_read(&dev->port.count)); + + err = tty_port_open(&dev->port, tty, filp); + if (err) +@@ -775,7 +775,7 @@ + struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; + + BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, +- dev->port.count); ++ atomic_read(&dev->port.count)); + + tty_port_close(&dev->port, tty, filp); + } +diff -Naur backports-3.18.1-1.org/net/ieee802154/6lowpan_rtnl.c backports-3.18.1-1/net/ieee802154/6lowpan_rtnl.c +--- backports-3.18.1-1.org/net/ieee802154/6lowpan_rtnl.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/ieee802154/6lowpan_rtnl.c 2014-12-28 14:10:09.796890100 +0100 +@@ -639,7 +639,7 @@ + dev_put(real_dev); + } + +-static struct rtnl_link_ops lowpan_link_ops __read_mostly = { ++static struct rtnl_link_ops lowpan_link_ops = { + .kind = "lowpan", + .priv_size = sizeof(struct lowpan_dev_info), + .setup = lowpan_setup, +diff -Naur backports-3.18.1-1.org/net/ieee802154/reassembly.c backports-3.18.1-1/net/ieee802154/reassembly.c +--- backports-3.18.1-1.org/net/ieee802154/reassembly.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/ieee802154/reassembly.c 2014-12-28 14:10:09.796890100 +0100 +@@ -460,14 +460,13 @@ + + static int __net_init lowpan_frags_ns_sysctl_register(struct net *net) + { +- struct ctl_table *table; ++ ctl_table_no_const *table = NULL; + struct ctl_table_header *hdr; + struct netns_ieee802154_lowpan *ieee802154_lowpan = + net_ieee802154_lowpan(net); + +- table = lowpan_frags_ns_ctl_table; + if (!net_eq(net, &init_net)) { +- table = kmemdup(table, sizeof(lowpan_frags_ns_ctl_table), ++ table = kmemdup(lowpan_frags_ns_ctl_table, sizeof(lowpan_frags_ns_ctl_table), + GFP_KERNEL); + if (table == NULL) + goto err_alloc; +@@ -494,8 +493,7 @@ + return 0; + + err_reg: +- if (!net_eq(net, &init_net)) +- kfree(table); ++ kfree(table); + err_alloc: + return -ENOMEM; + } +diff -Naur backports-3.18.1-1.org/net/mac80211/cfg.c backports-3.18.1-1/net/mac80211/cfg.c +--- backports-3.18.1-1.org/net/mac80211/cfg.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/cfg.c 2014-12-28 14:10:09.812890175 +0100 +@@ -541,7 +541,7 @@ + ret = ieee80211_vif_use_channel(sdata, chandef, + IEEE80211_CHANCTX_EXCLUSIVE); + } +- } else if (local->open_count == local->monitors) { ++ } else if (local_read(&local->open_count) == local->monitors) { + local->_oper_chandef = *chandef; + ieee80211_hw_config(local, 0); + } +@@ -3326,7 +3326,7 @@ + else + local->probe_req_reg--; + +- if (!local->open_count) ++ if (!local_read(&local->open_count)) + break; + + ieee80211_queue_work(&local->hw, &local->reconfig_filter); +@@ -3460,8 +3460,8 @@ + if (chanctx_conf) { + *chandef = sdata->vif.bss_conf.chandef; + ret = 0; +- } else if (local->open_count > 0 && +- local->open_count == local->monitors && ++ } else if (local_read(&local->open_count) > 0 && ++ local_read(&local->open_count) == local->monitors && + sdata->vif.type == NL80211_IFTYPE_MONITOR) { + if (local->use_chanctx) + *chandef = local->monitor_chandef; +diff -Naur backports-3.18.1-1.org/net/mac80211/ieee80211_i.h backports-3.18.1-1/net/mac80211/ieee80211_i.h +--- backports-3.18.1-1.org/net/mac80211/ieee80211_i.h 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/ieee80211_i.h 2014-12-28 14:10:09.812890175 +0100 +@@ -29,6 +29,7 @@ + #include <net/ieee80211_radiotap.h> + #include <net/cfg80211.h> + #include <net/mac80211.h> ++#include <asm/local.h> + #include "key.h" + #include "sta_info.h" + #include "debug.h" +@@ -1057,7 +1058,7 @@ + /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */ + spinlock_t queue_stop_reason_lock; + +- int open_count; ++ local_t open_count; + int monitors, cooked_mntrs; + /* number of interfaces with corresponding FIF_ flags */ + int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, +diff -Naur backports-3.18.1-1.org/net/mac80211/iface.c backports-3.18.1-1/net/mac80211/iface.c +--- backports-3.18.1-1.org/net/mac80211/iface.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/iface.c 2014-12-28 14:10:09.812890175 +0100 +@@ -532,7 +532,7 @@ + break; + } + +- if (local->open_count == 0) { ++ if (local_read(&local->open_count) == 0) { + res = drv_start(local); + if (res) + goto err_del_bss; +@@ -579,7 +579,7 @@ + res = drv_add_interface(local, sdata); + if (res) + goto err_stop; +- } else if (local->monitors == 0 && local->open_count == 0) { ++ } else if (local->monitors == 0 && local_read(&local->open_count) == 0) { + res = ieee80211_add_virtual_monitor(local); + if (res) + goto err_stop; +@@ -688,7 +688,7 @@ + atomic_inc(&local->iff_promiscs); + + if (coming_up) +- local->open_count++; ++ local_inc(&local->open_count); + + if (hw_reconf_flags) + ieee80211_hw_config(local, hw_reconf_flags); +@@ -726,7 +726,7 @@ + err_del_interface: + drv_remove_interface(local, sdata); + err_stop: +- if (!local->open_count) ++ if (!local_read(&local->open_count)) + drv_stop(local); + err_del_bss: + sdata->bss = NULL; +@@ -892,7 +892,7 @@ + } + + if (going_down) +- local->open_count--; ++ local_dec(&local->open_count); + + switch (sdata->vif.type) { + case NL80211_IFTYPE_AP_VLAN: +@@ -954,7 +954,7 @@ + } + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + +- if (local->open_count == 0) ++ if (local_read(&local->open_count) == 0) + ieee80211_clear_tx_pending(local); + + /* +@@ -997,7 +997,7 @@ + if (cancel_scan) + flush_delayed_work(&local->scan_work); + +- if (local->open_count == 0) { ++ if (local_read(&local->open_count) == 0) { + ieee80211_stop_device(local); + + /* no reconfiguring after stop! */ +@@ -1008,7 +1008,7 @@ + ieee80211_configure_filter(local); + ieee80211_hw_config(local, hw_reconf_flags); + +- if (local->monitors == local->open_count) ++ if (local->monitors == local_read(&local->open_count)) + ieee80211_add_virtual_monitor(local); + } + +diff -Naur backports-3.18.1-1.org/net/mac80211/main.c backports-3.18.1-1/net/mac80211/main.c +--- backports-3.18.1-1.org/net/mac80211/main.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/main.c 2014-12-28 14:10:09.812890175 +0100 +@@ -175,7 +175,7 @@ + changed &= ~(IEEE80211_CONF_CHANGE_CHANNEL | + IEEE80211_CONF_CHANGE_POWER); + +- if (changed && local->open_count) { ++ if (changed && local_read(&local->open_count)) { + ret = drv_config(local, changed); + /* + * Goal: +diff -Naur backports-3.18.1-1.org/net/mac80211/pm.c backports-3.18.1-1/net/mac80211/pm.c +--- backports-3.18.1-1.org/net/mac80211/pm.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/pm.c 2014-12-28 14:10:09.812890175 +0100 +@@ -12,7 +12,7 @@ + struct ieee80211_sub_if_data *sdata; + struct sta_info *sta; + +- if (!local->open_count) ++ if (!local_read(&local->open_count)) + goto suspend; + + ieee80211_scan_cancel(local); +@@ -59,7 +59,7 @@ + cancel_work_sync(&local->dynamic_ps_enable_work); + del_timer_sync(&local->dynamic_ps_timer); + +- local->wowlan = wowlan && local->open_count; ++ local->wowlan = wowlan && local_read(&local->open_count); + if (local->wowlan) { + int err = drv_suspend(local, wowlan); + if (err < 0) { +@@ -125,7 +125,7 @@ + WARN_ON(!list_empty(&local->chanctx_list)); + + /* stop hardware - this must stop RX */ +- if (local->open_count) ++ if (local_read(&local->open_count)) + ieee80211_stop_device(local); + + suspend: +diff -Naur backports-3.18.1-1.org/net/mac80211/rate.c backports-3.18.1-1/net/mac80211/rate.c +--- backports-3.18.1-1.org/net/mac80211/rate.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/rate.c 2014-12-28 14:10:09.812890175 +0100 +@@ -720,7 +720,7 @@ + + ASSERT_RTNL(); + +- if (local->open_count) ++ if (local_read(&local->open_count)) + return -EBUSY; + + if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) { +diff -Naur backports-3.18.1-1.org/net/mac80211/util.c backports-3.18.1-1/net/mac80211/util.c +--- backports-3.18.1-1.org/net/mac80211/util.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/mac80211/util.c 2014-12-28 14:10:09.816890209 +0100 +@@ -1669,7 +1669,7 @@ + } + #endif + /* everything else happens only if HW was up & running */ +- if (!local->open_count) ++ if (!local_read(&local->open_count)) + goto wake_up; + + /* +@@ -1895,7 +1895,7 @@ + local->in_reconfig = false; + barrier(); + +- if (local->monitors == local->open_count && local->monitors > 0) ++ if (local->monitors == local_read(&local->open_count) && local->monitors > 0) + ieee80211_add_virtual_monitor(local); + + /* +diff -Naur backports-3.18.1-1.org/net/wireless/wext-core.c backports-3.18.1-1/net/wireless/wext-core.c +--- backports-3.18.1-1.org/net/wireless/wext-core.c 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/net/wireless/wext-core.c 2014-12-28 14:10:09.832890290 +0100 +@@ -748,8 +748,7 @@ + */ + + /* Support for very large requests */ +- if ((descr->flags & IW_DESCR_FLAG_NOMAX) && +- (user_length > descr->max_tokens)) { ++ if (user_length > descr->max_tokens) { + /* Allow userspace to GET more than max so + * we can support any size GET requests. + * There is still a limit : -ENOMEM. +@@ -788,22 +787,6 @@ + } + } + +- if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) { +- /* +- * If this is a GET, but not NOMAX, it means that the extra +- * data is not bounded by userspace, but by max_tokens. Thus +- * set the length to max_tokens. This matches the extra data +- * allocation. +- * The driver should fill it with the number of tokens it +- * provided, and it may check iwp->length rather than having +- * knowledge of max_tokens. If the driver doesn't change the +- * iwp->length, this ioctl just copies back max_token tokens +- * filled with zeroes. Hopefully the driver isn't claiming +- * them to be valid data. +- */ +- iwp->length = descr->max_tokens; +- } +- + err = handler(dev, info, (union iwreq_data *) iwp, extra); + + iwp->length += essid_compat; diff --git a/src/patches/backports-3.18.1-1-ipfire-build.patch b/src/patches/backports-3.18.1-1-ipfire-build.patch new file mode 100644 index 0000000..0b2998e --- /dev/null +++ b/src/patches/backports-3.18.1-1-ipfire-build.patch @@ -0,0 +1,34 @@ +diff -Naur backports-3.18.1-1.org/Makefile backports-3.18.1-1/Makefile +--- backports-3.18.1-1.org/Makefile 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/Makefile 2014-12-29 15:51:19.358111370 +0100 +@@ -8,9 +8,9 @@ + SHELL := /bin/bash + BACKPORT_PWD := $(shell pwd) + +-KMODDIR ?= updates ++KMODDIR ?= kernel + ifneq ($(origin KLIB), undefined) +-KMODPATH_ARG := "INSTALL_MOD_PATH=$(KLIB)" ++KMODPATH_ARG := + else + KLIB := /lib/modules/$(shell uname -r)/ + KMODPATH_ARG := +diff -Naur backports-3.18.1-1.org/Makefile.real backports-3.18.1-1/Makefile.real +--- backports-3.18.1-1.org/Makefile.real 2014-12-21 22:37:13.000000000 +0100 ++++ backports-3.18.1-1/Makefile.real 2014-12-29 15:51:40.934780933 +0100 +@@ -92,11 +92,11 @@ + @$(MAKE) -C $(KLIB_BUILD) M=$(BACKPORT_PWD) \ + INSTALL_MOD_DIR=$(KMODDIR) $(KMODPATH_ARG) \ + modules_install +- @./scripts/blacklist.sh $(KLIB)/ $(KLIB)/$(KMODDIR) ++# @./scripts/blacklist.sh $(KLIB)/ $(KLIB)/$(KMODDIR) + @./scripts/compress_modules.sh $(KLIB)/$(KMODDIR) +- @./scripts/check_depmod.sh +- @/sbin/depmod -a +- @./scripts/update-initramfs.sh $(KLIB) ++# @./scripts/check_depmod.sh ++# @/sbin/depmod -a ++# @./scripts/update-initramfs.sh $(KLIB) + @echo + @echo Your backported driver modules should be installed now. + @echo Reboot. diff --git a/src/patches/backports-3.18.1-1_add_libertas_uap.patch b/src/patches/backports-3.18.1-1_add_libertas_uap.patch new file mode 100644 index 0000000..9a5b01b --- /dev/null +++ b/src/patches/backports-3.18.1-1_add_libertas_uap.patch @@ -0,0 +1,5058 @@ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/Kconfig backports-3.18.1-1/drivers/net/wireless/Kconfig +--- backports-3.18.1-1.org/drivers/net/wireless/Kconfig 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/Kconfig 2014-12-29 20:37:43.945764119 +0100 +@@ -55,6 +55,14 @@ + ---help--- + A driver for Marvell Libertas 8388 USB devices using thinfirm. + ++config LIBERTAS_UAP ++ tristate "Marvell 8xxx Libertas UAP" ++ depends on MAC80211 ++ depends on MMC ++ select FW_LOADER ++ ---help--- ++ Driver for Marvell Libertas 8xxx micro AP. ++ + config AIRO + depends on n + tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards" +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/Makefile backports-3.18.1-1/drivers/net/wireless/libertas_uap/Makefile +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/Makefile 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/Makefile 2014-12-29 20:41:50.975778546 +0100 +@@ -0,0 +1,6 @@ ++obj-$(CPTCFG_LIBERTAS_UAP) += uap8xxx.o ++ ++uap8xxx-y += uap_main.o uap_sdio_mmc.o ++uap8xxx-$(CPTCFG_PROC_FS) += uap_proc.o uap_debug.o ++ ++EXTRA_CFLAGS += -DFPNUM='"52"' -DPXA3XX_DMA_ALIGN -DDEBUG_LEVEL1 +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_debug.c backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_debug.c +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_debug.c 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_debug.c 2014-12-29 20:37:43.949097590 +0100 +@@ -0,0 +1,260 @@ ++/** @file uap_debug.c ++ * @brief This file contains functions for debug proc file. ++ * ++ * Copyright (C) 2008-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++#ifdef CONFIG_PROC_FS ++#include "uap_headers.h" ++ ++/******************************************************** ++ Local Variables ++********************************************************/ ++ ++#define item_size(n) (sizeof ((uap_adapter *)0)->n) ++#define item_addr(n) ((u32) &((uap_adapter *)0)->n) ++ ++#define item_dbg_size(n) (sizeof (((uap_adapter *)0)->dbg.n)) ++#define item_dbg_addr(n) ((u32) &(((uap_adapter *)0)->dbg.n)) ++ ++#define item_dev_size(n) (sizeof ((uap_dev_t *)0)->n) ++#define item_dev_addr(n) ((u32) &((uap_dev_t *)0)->n) ++ ++/** MicroAp device offset */ ++#define OFFSET_UAP_DEV 0x01 ++/** Bluetooth adapter offset */ ++#define OFFSET_UAP_ADAPTER 0x02 ++ ++struct debug_data ++{ ++ /** Name */ ++ char name[32]; ++ /** Size */ ++ u32 size; ++ /** Address */ ++ u32 addr; ++ /** Offset */ ++ u32 offset; ++ /** Flag */ ++ u32 flag; ++}; ++ ++/* To debug any member of uap_adapter, simply add one line here. ++ */ ++static struct debug_data items[] = { ++ {"cmd_sent", item_dev_size(cmd_sent), 0, item_dev_addr(cmd_sent), ++ OFFSET_UAP_DEV}, ++ {"data_sent", item_dev_size(data_sent), 0, item_dev_addr(data_sent), ++ OFFSET_UAP_DEV}, ++ {"IntCounter", item_size(IntCounter), 0, item_addr(IntCounter), ++ OFFSET_UAP_ADAPTER}, ++ {"cmd_pending", item_size(cmd_pending), 0, item_addr(cmd_pending), ++ OFFSET_UAP_ADAPTER}, ++ {"num_cmd_h2c_fail", item_dbg_size(num_cmd_host_to_card_failure), 0, ++ item_dbg_addr(num_cmd_host_to_card_failure), OFFSET_UAP_ADAPTER}, ++ {"num_tx_h2c_fail", item_dbg_size(num_tx_host_to_card_failure), 0, ++ item_dbg_addr(num_tx_host_to_card_failure), OFFSET_UAP_ADAPTER}, ++ {"psmode", item_size(psmode), 0, item_addr(psmode), OFFSET_UAP_ADAPTER}, ++ {"ps_state", item_size(ps_state), 0, item_addr(ps_state), ++ OFFSET_UAP_ADAPTER}, ++#ifdef DEBUG_LEVEL1 ++ {"drvdbg", sizeof(drvdbg), (u32) & drvdbg, 0, 0} ++#endif ++}; ++ ++static int num_of_items = sizeof(items) / sizeof(items[0]); ++ ++/******************************************************** ++ Global Variables ++********************************************************/ ++ ++/******************************************************** ++ Local Functions ++********************************************************/ ++/** ++ * @brief proc read function ++ * ++ * @param page pointer to buffer ++ * @param s read data starting position ++ * @param off offset ++ * @param cnt counter ++ * @param eof end of file flag ++ * @param data data to output ++ * @return number of output data ++ */ ++static int uap_debug_proc_show(struct seq_file *s, void *data) { ++ int val = 0; ++ int i; ++ ++ struct debug_data *d = (struct debug_data *)s->private; ++ ++ if (MODULE_GET == 0) ++ return UAP_STATUS_FAILURE; ++ ++ for (i = 0; i < num_of_items; i++) { ++ if (d[i].size == 1) ++ val = *((u8 *) d[i].addr); ++ else if (d[i].size == 2) ++ val = *((u16 *) d[i].addr); ++ else if (d[i].size == 4) ++ val = *((u32 *) d[i].addr); ++ ++ seq_printf(s, "%s=%d\n", d[i].name, val); ++ } ++ MODULE_PUT; ++ return 0; ++} ++ ++static int uap_debug_proc_open(struct inode* inode, struct file* file) { ++ return single_open(file, uap_debug_proc_show, PDE_DATA(inode)); ++} ++ ++/** ++ * @brief proc write function ++ * ++ * @param f file pointer ++ * @param buf pointer to data buffer ++ * @param cnt data number to write ++ * @param data data to write ++ * @return number of data ++ */ ++static ssize_t uap_debug_proc_write(struct file *f, const char __user *buf, size_t cnt, loff_t *data) { ++ int r, i; ++ char *pdata; ++ char *p; ++ char *p0; ++ char *p1; ++ char *p2; ++ struct debug_data *d = (struct debug_data *)PDE_DATA(file_inode(f)); ++ ++ if (MODULE_GET == 0) ++ return UAP_STATUS_FAILURE; ++ ++ pdata = (char *) kmalloc(cnt, GFP_KERNEL); ++ if (pdata == NULL) { ++ MODULE_PUT; ++ return 0; ++ } ++ ++ if (copy_from_user(pdata, buf, cnt)) { ++ PRINTM(INFO, "Copy from user failed\n"); ++ kfree(pdata); ++ MODULE_PUT; ++ return 0; ++ } ++ ++ p0 = pdata; ++ for (i = 0; i < num_of_items; i++) { ++ do { ++ p = strstr(p0, d[i].name); ++ if (p == NULL) ++ break; ++ p1 = strchr(p, '\n'); ++ if (p1 == NULL) ++ break; ++ p0 = p1++; ++ p2 = strchr(p, '='); ++ if (!p2) ++ break; ++ p2++; ++ r = string_to_number(p2); ++ if (d[i].size == 1) ++ *((u8 *) d[i].addr) = (u8) r; ++ else if (d[i].size == 2) ++ *((u16 *) d[i].addr) = (u16) r; ++ else if (d[i].size == 4) ++ *((u32 *) d[i].addr) = (u32) r; ++ break; ++ } while (TRUE); ++ } ++ kfree(pdata); ++#ifdef DEBUG_LEVEL1 ++ printk(KERN_ALERT "drvdbg = 0x%x\n", drvdbg); ++ printk(KERN_ALERT "INFO (%08lx) %s\n", DBG_INFO, ++ (drvdbg & DBG_INFO) ? "X" : ""); ++ printk(KERN_ALERT "WARN (%08lx) %s\n", DBG_WARN, ++ (drvdbg & DBG_WARN) ? "X" : ""); ++ printk(KERN_ALERT "ENTRY (%08lx) %s\n", DBG_ENTRY, ++ (drvdbg & DBG_ENTRY) ? "X" : ""); ++ printk(KERN_ALERT "CMD_D (%08lx) %s\n", DBG_CMD_D, ++ (drvdbg & DBG_CMD_D) ? "X" : ""); ++ printk(KERN_ALERT "DAT_D (%08lx) %s\n", DBG_DAT_D, ++ (drvdbg & DBG_DAT_D) ? "X" : ""); ++ printk(KERN_ALERT "CMND (%08lx) %s\n", DBG_CMND, ++ (drvdbg & DBG_CMND) ? "X" : ""); ++ printk(KERN_ALERT "DATA (%08lx) %s\n", DBG_DATA, ++ (drvdbg & DBG_DATA) ? "X" : ""); ++ printk(KERN_ALERT "ERROR (%08lx) %s\n", DBG_ERROR, ++ (drvdbg & DBG_ERROR) ? "X" : ""); ++ printk(KERN_ALERT "FATAL (%08lx) %s\n", DBG_FATAL, ++ (drvdbg & DBG_FATAL) ? "X" : ""); ++ printk(KERN_ALERT "MSG (%08lx) %s\n", DBG_MSG, ++ (drvdbg & DBG_MSG) ? "X" : ""); ++#endif ++ MODULE_PUT; ++ return cnt; ++} ++ ++static const struct file_operations uap_debug_proc_fops = { ++ .owner = THIS_MODULE, ++ .open = uap_debug_proc_open, ++ .read = seq_read, ++ .llseek = seq_lseek, ++ .release = single_release, ++ .write = uap_debug_proc_write, ++}; ++ ++/******************************************************** ++ Global Functions ++********************************************************/ ++/** ++ * @brief create debug proc file ++ * ++ * @param priv pointer uap_private ++ * @param dev pointer net_device ++ * @return N/A ++ */ ++void ++uap_debug_entry(uap_private * priv, struct net_device *dev) ++{ ++ int i; ++ ++ if (priv->proc_entry == NULL) ++ return; ++ ++ for (i = 0; i < num_of_items; i++) { ++ if (items[i].flag & OFFSET_UAP_ADAPTER) ++ items[i].addr = items[i].offset + (u32) priv->adapter; ++ if (items[i].flag & OFFSET_UAP_DEV) ++ items[i].addr = items[i].offset + (u32) & priv->uap_dev; ++ } ++ proc_create_data("debug", 0644, priv->proc_entry, &uap_debug_proc_fops, ++ &items[0]); ++} ++ ++/** ++ * @brief remove proc file ++ * ++ * @param priv pointer uap_private ++ * @return N/A ++ */ ++void ++uap_debug_remove(uap_private * priv) ++{ ++ remove_proc_entry("debug", priv->proc_entry); ++} ++ ++#endif +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_drv.h backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_drv.h +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_drv.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_drv.h 2014-12-29 20:37:43.949097590 +0100 +@@ -0,0 +1,667 @@ ++/** @file uap_drv.h ++ * @brief This file contains Linux OS related definitions and ++ * declarations, uAP driver ++ * ++ * Copyright (C) 2008-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++ ++#ifndef _UAP_DRV_H ++#define _UAP_DRV_H ++ ++/** Driver release version */ ++#define DRIVER_VERSION "26146" ++ ++/** True */ ++#ifndef TRUE ++#define TRUE 1 ++#endif ++/** False */ ++#ifndef FALSE ++#define FALSE 0 ++#endif ++ ++/** Bit definitions */ ++#ifndef BIT ++#define BIT(x) (1UL << (x)) ++#endif ++ ++/** Dma addresses are 32-bits wide. */ ++#ifndef __ATTRIB_ALIGN__ ++#define __ATTRIB_ALIGN__ __attribute__((aligned(4))) ++#endif ++ ++/** attribute pack */ ++#ifndef __ATTRIB_PACK__ ++#define __ATTRIB_PACK__ __attribute__ ((packed)) ++#endif ++ ++/** Debug Macro definition*/ ++#ifdef DEBUG_LEVEL1 ++ ++extern u32 drvdbg; ++ ++/** Debug message control bit definition for drvdbg */ ++/** Debug message */ ++#define DBG_MSG BIT(0) ++/** Debug fatal message */ ++#define DBG_FATAL BIT(1) ++/** Debug error message */ ++#define DBG_ERROR BIT(2) ++/** Debug data message */ ++#define DBG_DATA BIT(3) ++/** Debug command message */ ++#define DBG_CMND BIT(4) ++ ++/** Debug data */ ++#define DBG_DAT_D BIT(16) ++/** Debug command */ ++#define DBG_CMD_D BIT(17) ++ ++/** Debug entry */ ++#define DBG_ENTRY BIT(28) ++/** Debug warning */ ++#define DBG_WARN BIT(29) ++/** Debug info */ ++#define DBG_INFO BIT(30) ++ ++/** Print info */ ++#define PRINTM_INFO(msg...) {if (drvdbg & DBG_INFO) printk(KERN_DEBUG msg);} ++/** Print warn message */ ++#define PRINTM_WARN(msg...) {if (drvdbg & DBG_WARN) printk(KERN_DEBUG msg);} ++/** Print entry */ ++#define PRINTM_ENTRY(msg...) {if (drvdbg & DBG_ENTRY) printk(KERN_DEBUG msg);} ++/** Print cmd_d */ ++#define PRINTM_CMD_D(msg...) {if (drvdbg & DBG_CMD_D) printk(KERN_DEBUG msg);} ++/** Print data_d */ ++#define PRINTM_DAT_D(msg...) {if (drvdbg & DBG_DAT_D) printk(KERN_DEBUG msg);} ++/** Print command */ ++#define PRINTM_CMND(msg...) {if (drvdbg & DBG_CMND) printk(KERN_DEBUG msg);} ++/** Print data */ ++#define PRINTM_DATA(msg...) {if (drvdbg & DBG_DATA) printk(KERN_DEBUG msg);} ++/** Print error message */ ++#define PRINTM_ERROR(msg...) {if (drvdbg & DBG_ERROR) printk(KERN_DEBUG msg);} ++/** Print fatal message */ ++#define PRINTM_FATAL(msg...) {if (drvdbg & DBG_FATAL) printk(KERN_DEBUG msg);} ++/** Print message */ ++#define PRINTM_MSG(msg...) {if (drvdbg & DBG_MSG) printk(KERN_ALERT msg);} ++/** Print level */ ++#define PRINTM(level,msg...) PRINTM_##level(msg) ++ ++#else ++ ++#define PRINTM(level,msg...) do {} while (0) ++ ++#endif /* DEBUG_LEVEL1 */ ++ ++/** Wait until a condition becomes true */ ++#define ASSERT(cond) \ ++do { \ ++ if (!(cond)) \ ++ PRINTM(INFO, "ASSERT: %s, %s:%i\n", \ ++ __FUNCTION__, __FILE__, __LINE__); \ ++} while(0) ++ ++/** Log enrty point for debugging */ ++#define ENTER() PRINTM(ENTRY, "Enter: %s, %s:%i\n", __FUNCTION__, \ ++ __FILE__, __LINE__) ++/** Log exit point for debugging */ ++#define LEAVE() PRINTM(ENTRY, "Leave: %s, %s:%i\n", __FUNCTION__, \ ++ __FILE__, __LINE__) ++ ++#ifdef DEBUG_LEVEL1 ++/** Dump buffer length */ ++#define DBG_DUMP_BUF_LEN 64 ++/** Maximum dump per line */ ++#define MAX_DUMP_PER_LINE 16 ++/** Data dump length */ ++#define DATA_DUMP_LEN 32 ++ ++static inline void ++hexdump(char *prompt, u8 * buf, int len) ++{ ++ int i; ++ char dbgdumpbuf[DBG_DUMP_BUF_LEN]; ++ char *ptr = dbgdumpbuf; ++ ++ printk(KERN_DEBUG "%s:\n", prompt); ++ for (i = 1; i <= len; i++) { ++ ptr += sprintf(ptr, "%02x ", *buf); ++ buf++; ++ if (i % MAX_DUMP_PER_LINE == 0) { ++ *ptr = 0; ++ printk(KERN_DEBUG "%s\n", dbgdumpbuf); ++ ptr = dbgdumpbuf; ++ } ++ } ++ if (len % MAX_DUMP_PER_LINE) { ++ *ptr = 0; ++ printk(KERN_DEBUG "%s\n", dbgdumpbuf); ++ } ++} ++ ++/** Debug command */ ++#define DBG_HEXDUMP_CMD_D(x,y,z) {if (drvdbg & DBG_CMD_D) hexdump(x,y,z);} ++/** Debug data */ ++#define DBG_HEXDUMP_DAT_D(x,y,z) {if (drvdbg & DBG_DAT_D) hexdump(x,y,z);} ++/** Debug hexdump */ ++#define DBG_HEXDUMP(level,x,y,z) DBG_HEXDUMP_##level(x,y,z) ++/** hexdump */ ++#define HEXDUMP(x,y,z) {if (drvdbg & DBG_INFO) hexdump(x,y,z);} ++#else ++/** Do nothing since debugging is not turned on */ ++#define DBG_HEXDUMP(level,x,y,z) do {} while (0) ++/** Do nothing since debugging is not turned on */ ++#define HEXDUMP(x,y,z) do {} while (0) ++#endif ++ ++/** ++ * Typedefs ++ */ ++/** Unsigned char */ ++typedef u8 BOOLEAN; ++ ++/* ++ * OS macro definitions ++ */ ++/** OS macro to get time */ ++#define os_time_get() jiffies ++ ++/** OS macro to update transfer start time */ ++#define UpdateTransStart(dev) { \ ++ dev->trans_start = jiffies; \ ++} ++ ++/** Try to get a reference to the module */ ++#define MODULE_GET try_module_get(THIS_MODULE) ++/** Decrease module reference count */ ++#define MODULE_PUT module_put(THIS_MODULE) ++ ++/** OS macro to initialize semaphore */ ++#define OS_INIT_SEMAPHORE(x) sema_init(x,1) ++/** OS macro to acquire blocking semaphore */ ++#define OS_ACQ_SEMAPHORE_BLOCK(x) down_interruptible(x) ++/** OS macro to acquire non-blocking semaphore */ ++#define OS_ACQ_SEMAPHORE_NOBLOCK(x) down_trylock(x) ++/** OS macro to release semaphore */ ++#define OS_REL_SEMAPHORE(x) up(x) ++ ++static inline void ++os_sched_timeout(u32 millisec) ++{ ++ set_current_state(TASK_INTERRUPTIBLE); ++ schedule_timeout((millisec * HZ) / 1000); ++} ++ ++/** Maximum size of ethernet packet */ ++#define MRVDRV_MAXIMUM_ETH_PACKET_SIZE 1514 ++ ++/** Maximum size of multicast list */ ++#define MRVDRV_MAX_MULTICAST_LIST_SIZE 32 ++ ++/** Find minimum */ ++#ifndef MIN ++#define MIN(a,b) ((a) < (b) ? (a) : (b)) ++#endif ++ ++/** Find maximum */ ++#ifndef MAX ++#define MAX(a,b) ((a) > (b) ? (a) : (b)) ++#endif ++ ++/** Find number of elements */ ++#ifndef NELEMENTS ++#define NELEMENTS(x) (sizeof(x)/sizeof(x[0])) ++#endif ++ ++/** Buffer Constants */ ++ ++/** Size of command buffer */ ++#define MRVDRV_SIZE_OF_CMD_BUFFER (2 * 1024) ++ ++/** Length of device length */ ++#define DEV_NAME_LEN 32 ++ ++/** Length of ethernet address */ ++#ifndef ETH_ALEN ++#define ETH_ALEN 6 ++#endif ++ ++/** Default watchdog timeout */ ++#define MRVDRV_DEFAULT_WATCHDOG_TIMEOUT (2 * HZ) ++ ++/** Success */ ++#define UAP_STATUS_SUCCESS (0) ++/** Failure */ ++#define UAP_STATUS_FAILURE (-1) ++/** Not accepted */ ++#define UAP_STATUS_NOT_ACCEPTED (-2) ++ ++/** Max loop count (* 100ms) for waiting device ready at init time */ ++#define MAX_WAIT_DEVICE_READY_COUNT 50 ++ ++/** Tx high watermark. Stop Tx queue after this is crossed */ ++#define TX_HIGH_WATERMARK 4 ++/** Tx low watermark. Restart Tx queue after this is crossed */ ++#define TX_LOW_WATERMARK 2 ++ ++/** Netlink protocol number */ ++#define NETLINK_MARVELL (MAX_LINKS - 1) ++/** Netlink maximum payload size */ ++#define NL_MAX_PAYLOAD 1024 ++/** Netlink multicast group number */ ++#define NL_MULTICAST_GROUP 1 ++ ++/** 20 seconds */ ++#define MRVDRV_TIMER_20S 20000 ++ ++/** Host Command option for wait till Send */ ++#define HostCmd_OPTION_WAITFORSEND 0x0001 ++/** Host Command option for wait for RSP */ ++#define HostCmd_OPTION_WAITFORRSP 0x0002 ++/** Host Command option for wait for RSP or Timeout */ ++#define HostCmd_OPTION_WAITFORRSP_TIMEOUT 0x0003 ++/** Host Command option for wait for RSP of sleep confirm */ ++#define HostCmd_OPTION_WAITFORRSP_SLEEPCONFIRM 0x0004 ++ ++/** Sleep until a condition gets true or a timeout elapses */ ++#define os_wait_interruptible_timeout(waitq, cond, timeout) \ ++ wait_event_interruptible_timeout(waitq, cond, ((timeout) * HZ / 1000)) ++ ++/** Private command ID to Host command */ ++#define UAPHOSTCMD (SIOCDEVPRIVATE + 1) ++ ++/** Private command ID to Power Mode */ ++#define UAP_POWER_MODE (SIOCDEVPRIVATE + 3) ++/** sleep_param */ ++typedef struct _ps_sleep_param ++{ ++ /** control bitmap */ ++ u32 ctrl_bitmap; ++ /** minimum sleep period (micro second) */ ++ u32 min_sleep; ++ /** maximum sleep period (micro second) */ ++ u32 max_sleep; ++} ps_sleep_param; ++ ++/** inactivity sleep_param */ ++typedef struct _inact_sleep_param ++{ ++ /** inactivity timeout (micro second) */ ++ u32 inactivity_to; ++ /** miniumu awake period (micro second) */ ++ u32 min_awake; ++ /** maximum awake period (micro second) */ ++ u32 max_awake; ++} inact_sleep_param; ++ ++/** flag for ps mode */ ++#define PS_FLAG_PS_MODE 1 ++/** flag for sleep param */ ++#define PS_FLAG_SLEEP_PARAM 2 ++/** flag for inactivity sleep param */ ++#define PS_FLAG_INACT_SLEEP_PARAM 4 ++ ++/** Disable power mode */ ++#define PS_MODE_DISABLE 0 ++/** Enable periodic dtim ps */ ++#define PS_MODE_PERIODIC_DTIM 1 ++/** Enable inactivity ps */ ++#define PS_MODE_INACTIVITY 2 ++ ++/** sleep parameter */ ++#define SLEEP_PARAMETER 1 ++/** inactivity sleep parameter */ ++#define INACTIVITY_SLEEP_PARAMETER 2 ++/** ps_mgmt */ ++typedef struct _ps_mgmt ++{ ++ /** flags for valid field */ ++ u16 flags; ++ /** power mode */ ++ u16 ps_mode; ++ /** sleep param */ ++ ps_sleep_param sleep_param; ++ /** inactivity sleep param */ ++ inact_sleep_param inact_param; ++} ps_mgmt; ++ ++/** Semaphore structure */ ++typedef struct semaphore SEMAPHORE; ++ ++/** Global Varibale Declaration */ ++/** Private data structure of the device */ ++typedef struct _uap_private uap_private; ++/** Adapter data structure of the device */ ++typedef struct _uap_adapter uap_adapter; ++/** private structure */ ++extern uap_private *uappriv; ++ ++/** ENUM definition*/ ++ ++/** Hardware status codes */ ++typedef enum _HARDWARE_STATUS ++{ ++ HWReady, ++ HWInitializing, ++ HWReset, ++ HWClosing, ++ HWNotReady ++} HARDWARE_STATUS; ++ ++/** info for debug purpose */ ++typedef struct _uap_dbg ++{ ++ /** Number of host to card command failures */ ++ u32 num_cmd_host_to_card_failure; ++ /** Number of host to card Tx failures */ ++ u32 num_tx_host_to_card_failure; ++} uap_dbg; ++ ++/** Set thread state */ ++#define OS_SET_THREAD_STATE(x) set_current_state(x) ++ ++typedef struct ++{ ++ /** Task */ ++ struct task_struct *task; ++ /** Queue */ ++ wait_queue_head_t waitQ; ++ /** PID */ ++ pid_t pid; ++ /** Private structure */ ++ void *priv; ++} uap_thread; ++ ++static inline void ++uap_activate_thread(uap_thread * thr) ++{ ++ /** Record the thread pid */ ++ thr->pid = current->pid; ++ ++ /** Initialize the wait queue */ ++ init_waitqueue_head(&thr->waitQ); ++} ++ ++static inline void ++uap_deactivate_thread(uap_thread * thr) ++{ ++ thr->pid = 0; ++ return; ++} ++ ++static inline void ++uap_create_thread(int (*uapfunc) (void *), uap_thread * thr, char *name) ++{ ++ thr->task = kthread_run(uapfunc, thr, "%s", name); ++} ++ ++static inline int ++uap_terminate_thread(uap_thread * thr) ++{ ++ /* Check if the thread is active or not */ ++ if (!thr->pid) ++ return -1; ++ kthread_stop(thr->task); ++ return 0; ++} ++ ++/** Data structure for the Marvell uAP device */ ++typedef struct _uap_dev ++{ ++ /** device name */ ++ char name[DEV_NAME_LEN]; ++ /** card pointer */ ++ void *card; ++ /** IO port */ ++ u32 ioport; ++ /** Rx unit */ ++ u8 rx_unit; ++ /** Data sent: ++ TRUE - Data is sent to fw, no Tx Done received ++ FALSE - Tx done received for previous Tx */ ++ BOOLEAN data_sent; ++ /** CMD sent: ++ TRUE - CMD is sent to fw, no CMD Done received ++ FALSE - CMD done received for previous CMD */ ++ BOOLEAN cmd_sent; ++ /** netdev pointer */ ++ struct net_device *netdev; ++} uap_dev_t, *puap_dev_t; ++ ++/** Private structure for the MV device */ ++struct _uap_private ++{ ++ /** Device open */ ++ int open; ++ ++ /** Device adapter structure */ ++ uap_adapter *adapter; ++ /** Device structure */ ++ uap_dev_t uap_dev; ++ ++ /** Net device statistics structure */ ++ struct net_device_stats stats; ++ ++ /** Number of Tx timeouts */ ++ u32 num_tx_timeout; ++ ++ /** Media connection status */ ++ BOOLEAN MediaConnected; ++ ++#ifdef CONFIG_PROC_FS ++ struct proc_dir_entry *proc_uap; ++ struct proc_dir_entry *proc_entry; ++#endif /* CONFIG_PROC_FS */ ++ ++ /** Firmware helper */ ++ const struct firmware *fw_helper; ++ /** Firmware */ ++ const struct firmware *firmware; ++ /** Hotplug device */ ++ struct device *hotplug_device; ++ /** thread to service interrupts */ ++ uap_thread MainThread; ++ /** Driver lock */ ++ spinlock_t driver_lock; ++ /** Driver lock flags */ ++ ulong driver_flags; ++ ++}; ++ ++/** PS_CMD_ConfirmSleep */ ++typedef struct _PS_CMD_ConfirmSleep ++{ ++ /** SDIO Length */ ++ u16 SDLen; ++ /** SDIO Type */ ++ u16 SDType; ++ /** Command */ ++ u16 Command; ++ /** Size */ ++ u16 Size; ++ /** Sequence number */ ++ u16 SeqNum; ++ /** Result */ ++ u16 Result; ++} __ATTRIB_PACK__ PS_CMD_ConfirmSleep, *PPS_CMD_ConfirmSleep; ++ ++/** Wlan Adapter data structure*/ ++struct _uap_adapter ++{ ++ /** Power save confirm sleep command */ ++ PS_CMD_ConfirmSleep PSConfirmSleep; ++ /** Device status */ ++ HARDWARE_STATUS HardwareStatus; ++ /** Interrupt counter */ ++ u32 IntCounter; ++ /** Tx packet queue */ ++ struct sk_buff_head tx_queue; ++ /** Cmd packet queue */ ++ struct sk_buff_head cmd_queue; ++ /** Command sequence number */ ++ u16 SeqNum; ++ /** Command buffer */ ++ u8 *CmdBuf; ++ /** cmd pending flag */ ++ u8 cmd_pending; ++ /** cmd wait option */ ++ u8 cmd_wait_option; ++ /** Command buffer length */ ++ u32 CmdSize; ++ /** Command wait queue */ ++ wait_queue_head_t cmdwait_q __ATTRIB_ALIGN__; ++ /** Command wait queue state flag */ ++ u8 CmdWaitQWoken; ++ /** PnP support */ ++ BOOLEAN SurpriseRemoved; ++ /** Debug */ ++ uap_dbg dbg; ++ /** Netlink kernel socket */ ++ struct sock *nl_sk; ++ /** Semaphore for CMD */ ++ SEMAPHORE CmdSem; ++ /** Power Save mode */ ++ u8 psmode; ++ /** Power Save state */ ++ u8 ps_state; ++ /** Number of wakeup tries */ ++ u32 WakeupTries; ++}; ++ ++static inline int ++os_upload_rx_packet(uap_private * priv, struct sk_buff *skb) ++{ ++ skb->dev = priv->uap_dev.netdev; ++ skb->protocol = eth_type_trans(skb, priv->uap_dev.netdev); ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ if (in_interrupt()) ++ netif_rx(skb); ++ else ++ netif_rx_ni(skb); ++ return 0; ++} ++ ++/* ++ * netif carrier_on/off and start(wake)/stop_queue handling ++ */ ++static inline void ++os_carrier_on(uap_private * priv) ++{ ++ if (!netif_carrier_ok(priv->uap_dev.netdev) && ++ (priv->MediaConnected == TRUE)) { ++ netif_carrier_on(priv->uap_dev.netdev); ++ } ++} ++ ++static inline void ++os_carrier_off(uap_private * priv) ++{ ++ if (netif_carrier_ok(priv->uap_dev.netdev)) { ++ netif_carrier_off(priv->uap_dev.netdev); ++ } ++} ++ ++static inline void ++os_start_queue(uap_private * priv) ++{ ++ if (netif_queue_stopped(priv->uap_dev.netdev) && ++ (priv->MediaConnected == TRUE)) { ++ netif_wake_queue(priv->uap_dev.netdev); ++ } ++} ++ ++static inline void ++os_stop_queue(uap_private * priv) ++{ ++ if (!netif_queue_stopped(priv->uap_dev.netdev)) { ++ netif_stop_queue(priv->uap_dev.netdev); ++ } ++} ++ ++/** Interface specific header */ ++#define INTF_HEADER_LEN 4 ++ ++/** headroom alignment for tx packet */ ++#define HEADER_ALIGNMENT 8 ++ ++/** The number of times to try when polling for status bits */ ++#define MAX_POLL_TRIES 100 ++ ++/** Length of SNAP header */ ++#define MRVDRV_SNAP_HEADER_LEN 8 ++ ++/** Extra length of Tx packet buffer */ ++#define EXTRA_LEN 36 ++ ++/** Buffer size for ethernet Tx packets */ ++#define MRVDRV_ETH_TX_PACKET_BUFFER_SIZE \ ++ (ETH_FRAME_LEN + sizeof(TxPD) + EXTRA_LEN) ++ ++/** Buffer size for ethernet Rx packets */ ++#define MRVDRV_ETH_RX_PACKET_BUFFER_SIZE \ ++ (ETH_FRAME_LEN + sizeof(RxPD) \ ++ + MRVDRV_SNAP_HEADER_LEN + EXTRA_LEN) ++ ++/** Packet type: data, command & event */ ++typedef enum _mv_type ++{ ++ MV_TYPE_DAT = 0, ++ MV_TYPE_CMD = 1, ++ MV_TYPE_EVENT = 3 ++} mv_type; ++ ++/** Disable interrupt */ ++#define OS_INT_DISABLE spin_lock_irqsave(&priv->driver_lock, priv->driver_flags) ++/** Enable interrupt */ ++#define OS_INT_RESTORE spin_unlock_irqrestore(&priv->driver_lock, priv->driver_flags) ++ ++int uap_process_rx_packet(uap_private * priv, struct sk_buff *skb); ++void uap_interrupt(uap_private * priv); ++uap_private *uap_add_card(void *card); ++int uap_remove_card(void *card); ++int uap_process_event(uap_private * priv, u8 * payload, uint len); ++int uap_soft_reset(uap_private * priv); ++int uap_process_sleep_confirm_resp(uap_private * priv, u8 * resp, int resp_len); ++ ++#ifdef CONFIG_PROC_FS ++/** The proc fs interface */ ++void uap_proc_entry(uap_private * priv, struct net_device *dev); ++void uap_proc_remove(uap_private * priv); ++int string_to_number(char *s); ++void uap_debug_entry(uap_private * priv, struct net_device *dev); ++void uap_debug_remove(uap_private * priv); ++#endif /* CONFIG_PROC_FS */ ++ ++int sbi_register(void); ++ ++void sbi_unregister(void); ++int sbi_register_dev(uap_private * priv); ++int sbi_unregister_dev(uap_private * priv); ++int sbi_prog_fw_w_helper(uap_private *); ++ ++int sbi_host_to_card(uap_private * priv, u8 * payload, u16 nb); ++int sbi_enable_host_int(uap_private * priv); ++int sbi_disable_host_int(uap_private * priv); ++ ++int sbi_get_int_status(uap_private * priv, u8 * ireg); ++/** Check firmware status */ ++int sbi_check_fw_status(uap_private *, int); ++int sbi_prog_helper(uap_private *); ++ ++int sbi_wakeup_firmware(uap_private * priv); ++ ++#endif /* _UAP_DRV_H */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_fw.h backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_fw.h +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_fw.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_fw.h 2014-12-29 20:37:43.949097590 +0100 +@@ -0,0 +1,359 @@ ++/** @file uap_fw.h ++ * ++ * @brief This file contains firmware specific defines. ++ * ++ * Copyright (C) 2008-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++/******************************************************** ++Change log: ++ 02/26/08: Initial creation ++********************************************************/ ++ ++#ifndef _UAP_FW_H ++#define _UAP_FW_H ++ ++/** uap upload size */ ++#define UAP_UPLD_SIZE 2312 ++/** Packet type Micro AP */ ++#define PKT_TYPE_MICROAP 1 ++/** Packet type client */ ++#define PKT_TYPE_CLIENT 0 ++ ++/** TxPD descriptor */ ++typedef struct _TxPD ++{ ++ /** Bss Type */ ++ u8 BssType; ++ /** Bss num */ ++ u8 BssNum; ++ /** Tx packet length */ ++ u16 TxPktLength; ++ /** Tx packet offset */ ++ u16 TxPktOffset; ++ /** Tx packet type */ ++ u16 TxPktType; ++ /** Tx Control */ ++ u32 TxControl; ++ /** reserved */ ++ u32 reserved[2]; ++} __ATTRIB_PACK__ TxPD, *PTxPD; ++ ++/** RxPD Descriptor */ ++typedef struct _RxPD ++{ ++ /** Bss Type */ ++ u8 BssType; ++ /** Bss Num */ ++ u8 BssNum; ++ /** Tx packet length */ ++ u16 RxPktLength; ++ /** Tx packet offset */ ++ u16 RxPktOffset; ++} __ATTRIB_PACK__ RxPD, *PRxPD; ++ ++#ifdef BIG_ENDIAN ++/** Convert from 16 bit little endian format to CPU format */ ++#define uap_le16_to_cpu(x) le16_to_cpu(x) ++/** Convert from 32 bit little endian format to CPU format */ ++#define uap_le32_to_cpu(x) le32_to_cpu(x) ++/** Convert from 64 bit little endian format to CPU format */ ++#define uap_le64_to_cpu(x) le64_to_cpu(x) ++/** Convert to 16 bit little endian format from CPU format */ ++#define uap_cpu_to_le16(x) cpu_to_le16(x) ++/** Convert to 32 bit little endian format from CPU format */ ++#define uap_cpu_to_le32(x) cpu_to_le32(x) ++/** Convert to 64 bit little endian format from CPU format */ ++#define uap_cpu_to_le64(x) cpu_to_le64(x) ++ ++/** Convert TxPD to little endian format from CPU format */ ++#define endian_convert_TxPD(x); \ ++ { \ ++ (x)->TxPktLength = uap_cpu_to_le16((x)->TxPktLength); \ ++ (x)->TxPktOffset = uap_cpu_to_le32((x)->TxPktOffset); \ ++ (x)->TxControl = uap_cpu_to_le32((x)->TxControl); \ ++ (x)->TxPktType = uap_cpu_to_le32((x)->TxPktType); \ ++ } ++ ++/** Convert RxPD from little endian format to CPU format */ ++#define endian_convert_RxPD(x); \ ++ { \ ++ (x)->RxPktLength = uap_le16_to_cpu((x)->RxPktLength); \ ++ (x)->RxPktOffset = uap_le32_to_cpu((x)->RxPktOffset); \ ++ } ++#else /* BIG_ENDIAN */ ++/** Do nothing */ ++#define uap_le16_to_cpu(x) x ++/** Do nothing */ ++#define uap_le32_to_cpu(x) x ++/** Do nothing */ ++#define uap_le64_to_cpu(x) x ++/** Do nothing */ ++#define uap_cpu_to_le16(x) x ++/** Do nothing */ ++#define uap_cpu_to_le32(x) x ++/** Do nothing */ ++#define uap_cpu_to_le64(x) x ++ ++/** Do nothing */ ++#define endian_convert_TxPD(x) ++/** Do nothing */ ++#define endian_convert_RxPD(x) ++#endif /* BIG_ENDIAN */ ++ ++/** Host Command ID : Function initialization */ ++#define HostCmd_CMD_FUNC_INIT 0x00a9 ++/** Host Command ID : Function shutdown */ ++#define HostCmd_CMD_FUNC_SHUTDOWN 0x00aa ++ ++/** Host Command id: SYS_INFO */ ++#define HOST_CMD_APCMD_SYS_INFO 0x00ae ++/** Host Command id: SYS_RESET */ ++#define HOST_CMD_APCMD_SYS_RESET 0x00af ++/** Host Command id: SYS_CONFIGURE */ ++#define HOST_CMD_APCMD_SYS_CONFIGURE 0x00b0 ++/** Host Command id: BSS_START */ ++#define HOST_CMD_APCMD_BSS_START 0x00b1 ++/** Host Command id: SYS_STOP */ ++#define HOST_CMD_APCMD_BSS_STOP 0x00b2 ++/** Host Command id: STA_LIST */ ++#define HOST_CMD_APCMD_STA_LIST 0x00b3 ++/** Host Command id: STA_FILTER_TABLE */ ++#define HOST_CMD_APCMD_STA_FILTER_TABLE 0x00b4 ++/** Host Command id: STA_DEAUTH */ ++#define HOST_CMD_APCMD_STA_DEAUTH 0x00b5 ++/** Host Command id: SOFT_RESET */ ++#define HOST_CMD_APCMD_SOFT_RESET 0x00d5 ++/** Host Command id: POWER_MGMT_EXT */ ++#define HOST_CMD_POWER_MGMT_EXT 0x00ef ++/** Host Command id: SLEEP_CONFIRM*/ ++#define HOST_CMD_SLEEP_CONFIRM 0x00d8 ++ ++/** TLV type : SSID */ ++#define TLV_TYPE_SSID 0x0000 ++/** TLV type : Rates */ ++#define TLV_TYPE_RATES 0x0001 ++/** TLV type : PHY DS */ ++#define TLV_TYPE_PHY_DS 0x0003 ++ ++/** TLV Id : Base id */ ++#define PROPRIETARY_TLV_BASE_ID 0x0100 ++/** TLV Id : AP_MAC_ADDRESS */ ++#define MRVL_AP_MAC_ADDRESS_TLV_ID (PROPRIETARY_TLV_BASE_ID + 43) ++/** TLV Id : Beacon period */ ++#define MRVL_BEACON_PERIOD_TLV_ID (PROPRIETARY_TLV_BASE_ID + 44) ++/** TLV Id : Dtim period */ ++#define MRVL_DTIM_PERIOD_TLV_ID (PROPRIETARY_TLV_BASE_ID + 45) ++/** TLV Id : Basic rates */ ++#define MRVL_BASIC_RATES_TLV_ID (PROPRIETARY_TLV_BASE_ID + 46) ++/** TLV Id : Tx Power */ ++#define MRVL_TX_POWER_TLV_ID (PROPRIETARY_TLV_BASE_ID + 47) ++/** TLV Id : Broadcast SSID control */ ++#define MRVL_BCAST_SSID_CTL_TLV_ID (PROPRIETARY_TLV_BASE_ID + 48) ++/** TLV Id : Preamble control */ ++#define MRVL_PREAMBLE_CTL_TLV_ID (PROPRIETARY_TLV_BASE_ID + 49) ++/** TLV Id : Antenna control */ ++#define MRVL_ANTENNA_CTL_TLV_ID (PROPRIETARY_TLV_BASE_ID + 50) ++/** TLV Id : RTS threshold */ ++#define MRVL_RTS_THRESHOLD_TLV_ID (PROPRIETARY_TLV_BASE_ID + 51) ++/** TLV Id : Radio control */ ++#define MRVL_RADIO_CTL_TLV_ID (PROPRIETARY_TLV_BASE_ID + 52) ++/** TLV Id : TX data rate */ ++#define MRVL_TX_DATA_RATE_TLV_ID (PROPRIETARY_TLV_BASE_ID + 53) ++/** TLV Id : Packet forward control */ ++#define MRVL_PKT_FWD_CTL_TLV_ID (PROPRIETARY_TLV_BASE_ID + 54) ++/** TLV Id : STA info */ ++#define MRVL_STA_INFO_TLV_ID (PROPRIETARY_TLV_BASE_ID + 55) ++/** TLV Id : STA MAC address filter */ ++#define MRVL_STA_MAC_ADDR_FILTER_TLV_ID (PROPRIETARY_TLV_BASE_ID + 56) ++/** TLV Id : STA ageout timer */ ++#define MRVL_STA_AGEOUT_TIMER_TLV_ID (PROPRIETARY_TLV_BASE_ID + 57) ++/** TLV Id : Security config */ ++#define MRVL_SECURITY_CFG_TLV_ID (PROPRIETARY_TLV_BASE_ID + 58) ++/** TLV Id : WEP KEY */ ++#define MRVL_WEP_KEY_TLV_ID (PROPRIETARY_TLV_BASE_ID + 59) ++/** TLV Id : WPA Passphrase */ ++#define MRVL_WPA_PASSPHRASE_TLV_ID (PROPRIETARY_TLV_BASE_ID + 60) ++ ++/** Action get */ ++#define ACTION_GET 0 ++/** Action set */ ++#define ACTION_SET 1 ++/** Length of ethernet address */ ++#ifndef ETH_ALEN ++#define ETH_ALEN 6 ++#endif ++ ++/** HostCmd_DS_GEN */ ++typedef struct ++{ ++ /** Command */ ++ u16 Command; ++ /** Size */ ++ u16 Size; ++ /** Sequence number */ ++ u16 SeqNum; ++ /** Result */ ++ u16 Result; ++} __ATTRIB_PACK__ HostCmd_DS_GEN; ++ ++/** Size of HostCmd_DS_GEN */ ++#define S_DS_GEN sizeof(HostCmd_DS_GEN) ++ ++/** _HostCmd_HEADER*/ ++typedef struct ++{ ++ /** Command Header : Command */ ++ u16 Command; ++ /** Command Header : Size */ ++ u16 Size; ++} __ATTRIB_PACK__ HostCmd_HEADER; ++ ++/** HostCmd_SYS_CONFIG */ ++typedef struct _HostCmd_SYS_CONFIG ++{ ++ /** CMD Action GET/SET*/ ++ u16 Action; ++ /** Tlv buffer */ ++ u8 TlvBuffer[0]; ++} __ATTRIB_PACK__ HostCmd_SYS_CONFIG; ++ ++/** HostCmd_DS_POWER_MGMT_EXT */ ++typedef struct _HostCmd_DS_POWER_MGMT_EXT ++{ ++ /** CMD Action Get/Set*/ ++ u16 action; ++ /** power mode */ ++ u16 power_mode; ++} __ATTRIB_PACK__ HostCmd_DS_POWER_MGMT_EXT; ++ ++/** _HostCmd_DS_COMMAND*/ ++typedef struct _HostCmd_DS_COMMAND ++{ ++ ++ /** Command Header : Command */ ++ u16 Command; ++ /** Command Header : Size */ ++ u16 Size; ++ /** Command Header : Sequence number */ ++ u16 SeqNum; ++ /** Command Header : Result */ ++ u16 Result; ++ /** Command Body */ ++ union ++ { ++ HostCmd_SYS_CONFIG sys_config; ++ HostCmd_DS_POWER_MGMT_EXT pm_cfg; ++ ++ } params; ++} __ATTRIB_PACK__ HostCmd_DS_COMMAND; ++ ++/** MrvlIEtypesHeader_*/ ++typedef struct _MrvlIEtypesHeader ++{ ++ /** Header type */ ++ u16 Type; ++ /** Header length */ ++ u16 Len; ++} __ATTRIB_PACK__ MrvlIEtypesHeader_t; ++ ++/** MrvlIEtypes_Data_t */ ++typedef struct _MrvlIEtypes_Data_t ++{ ++ /** Header */ ++ MrvlIEtypesHeader_t Header; ++ /** Data */ ++ u8 Data[1]; ++} __ATTRIB_PACK__ MrvlIEtypes_Data_t; ++ ++/** MrvlIEtypes_ChanListParamSet_t */ ++typedef struct _MrvlIEtypes_MacAddr_t ++{ ++ /** Header */ ++ MrvlIEtypesHeader_t Header; ++ /** AP MAC address */ ++ u8 ApMacAddr[ETH_ALEN]; ++} __ATTRIB_PACK__ MrvlIEtypes_MacAddr_t; ++ ++/** Event ID: BSS started */ ++#define MICRO_AP_EV_ID_BSS_START 46 ++ ++/** Event ID: BSS idle event */ ++#define MICRO_AP_EV_BSS_IDLE 67 ++ ++/** Event ID: BSS active event */ ++#define MICRO_AP_EV_BSS_ACTIVE 68 ++ ++/** Event ID: PS_AWAKE */ ++#define EVENT_PS_AWAKE 0x0a ++ ++/** Event ID: PS_SLEEP */ ++#define EVENT_PS_SLEEP 0x0b ++ ++/** PS_STATE */ ++typedef enum _PS_STATE ++{ ++ PS_STATE_AWAKE, ++ PS_STATE_PRE_SLEEP, ++ PS_STATE_SLEEP ++} PS_STATE; ++ ++/** TLV type: AP Sleep param */ ++#define TLV_TYPE_AP_SLEEP_PARAM (PROPRIETARY_TLV_BASE_ID + 106) ++/** TLV type: AP Inactivity Sleep param */ ++#define TLV_TYPE_AP_INACT_SLEEP_PARAM (PROPRIETARY_TLV_BASE_ID + 107) ++ ++/** MrvlIEtypes_sleep_param_t */ ++typedef struct _MrvlIEtypes_sleep_param_t ++{ ++ /** Header */ ++ MrvlIEtypesHeader_t header; ++ /** control bitmap */ ++ u32 ctrl_bitmap; ++ /** min_sleep */ ++ u32 min_sleep; ++ /** max_sleep */ ++ u32 max_sleep; ++} __ATTRIB_PACK__ MrvlIEtypes_sleep_param_t; ++ ++/** MrvlIEtypes_inact_sleep_param_t */ ++typedef struct _MrvlIEtypes_inact_sleep_param_t ++{ ++ /** Header */ ++ MrvlIEtypesHeader_t header; ++ /** inactivity timeout */ ++ u32 inactivity_to; ++ /** min_awake */ ++ u32 min_awake; ++ /** max_awake */ ++ u32 max_awake; ++} __ATTRIB_PACK__ MrvlIEtypes_inact_sleep_param_t; ++ ++/** AP_Event */ ++typedef struct _AP_Event ++{ ++ /** Event ID */ ++ u32 EventId; ++ /* ++ * Reserved for STA_ASSOCIATED event and contains ++ * status information for the MIC_COUNTERMEASURES event. ++ */ ++ /** Reserved/status */ ++ u16 status; ++ /** AP MAC address */ ++ u8 MacAddr[ETH_ALEN]; ++} __ATTRIB_PACK__ AP_Event; ++#endif /* _UAP_FW_H */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_headers.h backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_headers.h +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_headers.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_headers.h 2014-12-29 20:37:43.949097590 +0100 +@@ -0,0 +1,64 @@ ++/** @file uap_headers.h ++ * ++ * @brief This file contains all the necessary include file. ++ * ++ * Copyright (C) 2008-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++#ifndef _UAP_HEADERS_H ++#define _UAP_HEADERS_H ++ ++/* Linux header files */ ++#include <linux/kernel.h> ++#include <linux/module.h> ++#include <linux/init.h> ++#include <linux/version.h> ++#include <linux/param.h> ++#include <linux/types.h> ++#include <linux/interrupt.h> ++#include <linux/proc_fs.h> ++#include <linux/kthread.h> ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27) ++#include <linux/semaphore.h> ++#else ++#include <asm/semaphore.h> ++#endif ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18) ++#include <linux/config.h> ++#endif ++ ++/* Net header files */ ++#include <linux/netdevice.h> ++#include <linux/net.h> ++#include <linux/skbuff.h> ++#include <linux/if_ether.h> ++#include <linux/etherdevice.h> ++#include <net/sock.h> ++#include <linux/netlink.h> ++#include <linux/firmware.h> ++#include <linux/delay.h> ++ ++#include "uap_drv.h" ++#include "uap_fw.h" ++ ++#include <linux/mmc/sdio.h> ++#include <linux/mmc/sdio_ids.h> ++#include <linux/mmc/sdio_func.h> ++#include <linux/mmc/card.h> ++#include "uap_sdio_mmc.h" ++ ++#endif /* _UAP_HEADERS_H */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_main.c backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_main.c +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_main.c 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_main.c 2014-12-29 20:37:43.952431125 +0100 +@@ -0,0 +1,1817 @@ ++/** @file uap_main.c ++ * @brief This file contains the major functions in uAP ++ * driver. It includes init, exit etc.. ++ * This file also contains the initialization for SW, ++ * FW and HW ++ * ++ * Copyright (C) 2008-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++/** ++ * @mainpage uAP Linux Driver ++ * ++ * @section overview_sec Overview ++ * ++ * This is Linux reference driver for Marvell uAP. ++ * ++ * @section copyright_sec Copyright ++ * ++ * Copyright (C) 2008, Marvell International Ltd. ++ * ++ */ ++ ++#include "uap_headers.h" ++ ++/** ++ * the global variable of a pointer to uap_private ++ * structure variable ++ */ ++uap_private *uappriv = NULL; ++#ifdef DEBUG_LEVEL1 ++#define DEFAULT_DEBUG_MASK (DBG_MSG | DBG_FATAL | DBG_ERROR) ++u32 drvdbg = DEFAULT_DEBUG_MASK; ++#endif ++/** Helper name */ ++char *helper_name = NULL; ++/** Firmware name */ ++char *fw_name = NULL; ++ ++/** Semaphore for add/remove card */ ++SEMAPHORE AddRemoveCardSem; ++ ++/******************************************************** ++ Local Functions ++********************************************************/ ++/** ++ * @brief This function send sleep confirm command to firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS for success otherwise UAP_STATUS_FAILURE ++ */ ++static int ++uap_dnld_sleep_confirm_cmd(uap_private * priv) ++{ ++ uap_adapter *Adapter = priv->adapter; ++ int ret = UAP_STATUS_SUCCESS; ++ ENTER(); ++ PRINTM(CMND, "Sleep confirm\n"); ++ Adapter->cmd_pending = TRUE; ++ Adapter->cmd_wait_option = HostCmd_OPTION_WAITFORRSP_SLEEPCONFIRM; ++ ret = ++ sbi_host_to_card(priv, (u8 *) & Adapter->PSConfirmSleep, ++ sizeof(PS_CMD_ConfirmSleep)); ++ if (ret != UAP_STATUS_SUCCESS) { ++ Adapter->ps_state = PS_STATE_AWAKE; ++ Adapter->cmd_pending = FALSE; ++ Adapter->cmd_wait_option = FALSE; ++ } ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function process sleep confirm resp from firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @param resp A pointer to resp buf ++ * @param resp_len resp buf len ++ * @return UAP_STATUS_SUCCESS for success otherwise UAP_STATUS_FAILURE ++ */ ++int ++uap_process_sleep_confirm_resp(uap_private * priv, u8 * resp, int resp_len) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ HostCmd_DS_COMMAND *cmd; ++ uap_adapter *Adapter = priv->adapter; ++ ENTER(); ++ PRINTM(CMND, "Sleep confirm resp\n"); ++ if (!resp_len) { ++ PRINTM(ERROR, "Cmd Size is 0\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ cmd = (HostCmd_DS_COMMAND *) resp; ++ cmd->Result = uap_le16_to_cpu(cmd->Result); ++ if (cmd->Result != UAP_STATUS_SUCCESS) { ++ PRINTM(ERROR, "HOST_CMD_APCMD_PS_SLEEP_CONFIRM fail=%x\n", cmd->Result); ++ ret = -EFAULT; ++ } ++ done: ++ if (ret == UAP_STATUS_SUCCESS) ++ Adapter->ps_state = PS_STATE_SLEEP; ++ else ++ Adapter->ps_state = PS_STATE_AWAKE; ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function checks condition and prepares to ++ * send sleep confirm command to firmware if OK. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return n/a ++ */ ++static void ++uap_ps_cond_check(uap_private * priv) ++{ ++ uap_adapter *Adapter = priv->adapter; ++ ++ ENTER(); ++ if (!priv->uap_dev.cmd_sent && ++ !Adapter->cmd_pending && !Adapter->IntCounter) { ++ uap_dnld_sleep_confirm_cmd(priv); ++ } else { ++ PRINTM(INFO, "Delay Sleep Confirm (%s%s%s)\n", ++ (priv->uap_dev.cmd_sent) ? "D" : "", ++ (Adapter->cmd_pending) ? "C" : "", ++ (Adapter->IntCounter) ? "I" : ""); ++ } ++ LEAVE(); ++} ++ ++/** ++ * @brief This function add cmd to cmdQ and waiting for response ++ * ++ * @param priv A pointer to uap_private structure ++ * @param skb A pointer to the skb for process ++ * @param wait_option Wait option ++ * @return UAP_STATUS_SUCCESS for success otherwise UAP_STATUS_FAILURE ++ */ ++static int ++uap_process_cmd(uap_private * priv, struct sk_buff *skb, u8 wait_option) ++{ ++ uap_adapter *Adapter = priv->adapter; ++ int ret = UAP_STATUS_SUCCESS; ++ HostCmd_DS_COMMAND *cmd; ++ u8 *headptr; ++ ENTER(); ++ if (Adapter->HardwareStatus != HWReady) { ++ PRINTM(ERROR, "Hw not ready, uap_process_cmd\n"); ++ kfree(skb); ++ LEAVE(); ++ return -EFAULT; ++ } ++ skb->cb[0] = wait_option; ++ headptr = skb->data; ++ *(u16 *) & headptr[0] = uap_cpu_to_le16(skb->len); ++ *(u16 *) & headptr[2] = uap_cpu_to_le16(MV_TYPE_CMD); ++ cmd = (HostCmd_DS_COMMAND *) (skb->data + INTF_HEADER_LEN); ++ Adapter->SeqNum++; ++ cmd->SeqNum = uap_cpu_to_le16(Adapter->SeqNum); ++ PRINTM(CMND, "process_cmd: %x\n", cmd->Command); ++ DBG_HEXDUMP(CMD_D, "process_cmd", (u8 *) cmd, cmd->Size); ++ if (!wait_option) { ++ skb_queue_tail(&priv->adapter->cmd_queue, skb); ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ LEAVE(); ++ return ret; ++ } ++ if (OS_ACQ_SEMAPHORE_BLOCK(&Adapter->CmdSem)) { ++ PRINTM(ERROR, "Acquire semaphore error, uap_prepare_cmd\n"); ++ kfree(skb); ++ LEAVE(); ++ return -EBUSY; ++ } ++ skb_queue_tail(&priv->adapter->cmd_queue, skb); ++ Adapter->CmdWaitQWoken = FALSE; ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ /* Sleep until response is generated by FW */ ++ if (wait_option == HostCmd_OPTION_WAITFORRSP_TIMEOUT) { ++ if (!os_wait_interruptible_timeout ++ (Adapter->cmdwait_q, Adapter->CmdWaitQWoken, MRVDRV_TIMER_20S)) { ++ PRINTM(ERROR, "Cmd timeout\n"); ++ Adapter->cmd_pending = FALSE; ++ ret = -EFAULT; ++ } ++ } else ++ wait_event_interruptible(Adapter->cmdwait_q, Adapter->CmdWaitQWoken); ++ OS_REL_SEMAPHORE(&Adapter->CmdSem); ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief Inspect the response buffer for pointers to expected TLVs ++ * ++ * ++ * @param pTlv Pointer to the start of the TLV buffer to parse ++ * @param tlvBufSize Size of the TLV buffer ++ * @param reqTlvType request tlv's tlvtype ++ * @param ppTlv Output parameter: Pointer to the request TLV if found ++ * ++ * @return void ++ */ ++static void ++uap_get_tlv_ptrs(MrvlIEtypes_Data_t * pTlv, int tlvBufSize, ++ u16 reqTlvType, MrvlIEtypes_Data_t ** ppTlv) ++{ ++ MrvlIEtypes_Data_t *pCurrentTlv; ++ int tlvBufLeft; ++ u16 tlvType; ++ u16 tlvLen; ++ ++ ENTER(); ++ pCurrentTlv = pTlv; ++ tlvBufLeft = tlvBufSize; ++ *ppTlv = NULL; ++ PRINTM(INFO, "uap_get_tlv: tlvBufSize = %d, reqTlvType=%x\n", tlvBufSize, ++ reqTlvType); ++ while (tlvBufLeft >= sizeof(MrvlIEtypesHeader_t)) { ++ tlvType = uap_le16_to_cpu(pCurrentTlv->Header.Type); ++ tlvLen = uap_le16_to_cpu(pCurrentTlv->Header.Len); ++ if (reqTlvType == tlvType) ++ *ppTlv = (MrvlIEtypes_Data_t *) pCurrentTlv; ++ if (*ppTlv) { ++ HEXDUMP("TLV Buf", (u8 *) * ppTlv, tlvLen); ++ break; ++ } ++ tlvBufLeft -= (sizeof(pTlv->Header) + tlvLen); ++ pCurrentTlv = (MrvlIEtypes_Data_t *) (pCurrentTlv->Data + tlvLen); ++ } /* while */ ++ LEAVE(); ++} ++ ++/** ++ * @brief This function get mac ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS on success, otherwise failure code ++ */ ++static int ++uap_get_mac_address(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u32 CmdSize; ++ HostCmd_DS_COMMAND *cmd; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb; ++ MrvlIEtypes_MacAddr_t *pMacAddrTlv; ++ MrvlIEtypes_Data_t *pTlv; ++ u16 tlvBufSize; ++ ENTER(); ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ ret = -ENOMEM; ++ goto done; ++ } ++ CmdSize = ++ S_DS_GEN + sizeof(HostCmd_SYS_CONFIG) + sizeof(MrvlIEtypes_MacAddr_t); ++ cmd = (HostCmd_DS_COMMAND *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HOST_CMD_APCMD_SYS_CONFIGURE); ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ cmd->params.sys_config.Action = uap_cpu_to_le16(ACTION_GET); ++ pMacAddrTlv = ++ (MrvlIEtypes_MacAddr_t *) (skb->data + INTF_HEADER_LEN + S_DS_GEN + ++ sizeof(HostCmd_SYS_CONFIG)); ++ pMacAddrTlv->Header.Type = uap_cpu_to_le16(MRVL_AP_MAC_ADDRESS_TLV_ID); ++ pMacAddrTlv->Header.Len = uap_cpu_to_le16(ETH_ALEN); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP_TIMEOUT)) { ++ PRINTM(ERROR, "Fail to process cmd SYS_CONFIGURE Query\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ if (!Adapter->CmdSize) { ++ PRINTM(ERROR, "Cmd Size is 0\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ cmd = (HostCmd_DS_COMMAND *) Adapter->CmdBuf; ++ cmd->Result = uap_le16_to_cpu(cmd->Result); ++ if (cmd->Result != UAP_STATUS_SUCCESS) { ++ PRINTM(ERROR, "uap_get_mac_address fail=%x\n", cmd->Result); ++ ret = -EFAULT; ++ goto done; ++ } ++ pTlv = ++ (MrvlIEtypes_Data_t *) (Adapter->CmdBuf + S_DS_GEN + ++ sizeof(HostCmd_SYS_CONFIG)); ++ tlvBufSize = Adapter->CmdSize - S_DS_GEN - sizeof(HostCmd_SYS_CONFIG); ++ uap_get_tlv_ptrs(pTlv, tlvBufSize, MRVL_AP_MAC_ADDRESS_TLV_ID, ++ (MrvlIEtypes_Data_t **) & pMacAddrTlv); ++ if (pMacAddrTlv) { ++ memcpy(priv->uap_dev.netdev->dev_addr, pMacAddrTlv->ApMacAddr, ++ ETH_ALEN); ++ HEXDUMP("Original MAC addr", priv->uap_dev.netdev->dev_addr, ETH_ALEN); ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function checks the conditions and sends packet to device ++ * ++ * @param priv A pointer to uap_private structure ++ * @param skb A pointer to the skb for process ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++uap_process_tx(uap_private * priv, struct sk_buff *skb) ++{ ++ uap_adapter *Adapter = priv->adapter; ++ int ret = UAP_STATUS_SUCCESS; ++ TxPD *pLocalTxPD; ++ u8 *headptr; ++ struct sk_buff *newskb; ++ int newheadlen; ++ ENTER(); ++ ASSERT(skb); ++ if (!skb) { ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ if (skb_headroom(skb) < (sizeof(TxPD) + INTF_HEADER_LEN + HEADER_ALIGNMENT)) { ++ newheadlen = sizeof(TxPD) + INTF_HEADER_LEN + HEADER_ALIGNMENT; ++ PRINTM(WARN, "Tx: Insufficient skb headroom %d\n", skb_headroom(skb)); ++ /* Insufficient skb headroom - allocate a new skb */ ++ newskb = skb_realloc_headroom(skb, newheadlen); ++ if (unlikely(newskb == NULL)) { ++ PRINTM(ERROR, "Tx: Cannot allocate skb\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ kfree_skb(skb); ++ skb = newskb; ++ PRINTM(INFO, "new skb headroom %d\n", skb_headroom(skb)); ++ } ++ /* headptr should be aligned */ ++ headptr = skb->data - sizeof(TxPD) - INTF_HEADER_LEN; ++ headptr = (u8 *) ((u32) headptr & ~((u32) (HEADER_ALIGNMENT - 1))); ++ ++ pLocalTxPD = (TxPD *) (headptr + INTF_HEADER_LEN); ++ memset(pLocalTxPD, 0, sizeof(TxPD)); ++ pLocalTxPD->BssType = PKT_TYPE_MICROAP; ++ pLocalTxPD->TxPktLength = skb->len; ++ /* offset of actual data */ ++ pLocalTxPD->TxPktOffset = (long) skb->data - (long) pLocalTxPD; ++ endian_convert_TxPD(pLocalTxPD); ++ *(u16 *) & headptr[0] = ++ uap_cpu_to_le16(skb->len + ((long) skb->data - (long) headptr)); ++ *(u16 *) & headptr[2] = uap_cpu_to_le16(MV_TYPE_DAT); ++ ret = ++ sbi_host_to_card(priv, headptr, ++ skb->len + ((long) skb->data - (long) headptr)); ++ if (ret) { ++ PRINTM(ERROR, "uap_process_tx Error: sbi_host_to_card failed: 0x%X\n", ++ ret); ++ Adapter->dbg.num_tx_host_to_card_failure++; ++ goto done; ++ } ++ PRINTM(DATA, "Data => FW\n"); ++ DBG_HEXDUMP(DAT_D, "Tx", headptr, ++ MIN(skb->len + sizeof(TxPD), DATA_DUMP_LEN)); ++ done: ++ /* Freed skb */ ++ kfree_skb(skb); ++ LEAVE(); ++ return ret; ++} ++ ++static struct netlink_kernel_cfg cfg = { ++ .groups = NL_MULTICAST_GROUP, ++}; ++ ++/** ++ * @brief This function initializes the adapter structure ++ * and set default value to the member of adapter. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++uap_init_sw(uap_private * priv) ++{ ++ uap_adapter *Adapter = priv->adapter; ++ ++ ENTER(); ++ ++ if (!(Adapter->CmdBuf = kmalloc(MRVDRV_SIZE_OF_CMD_BUFFER, GFP_KERNEL))) { ++ PRINTM(INFO, "Failed to allocate command buffer!\n"); ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ ++ Adapter->cmd_pending = FALSE; ++ Adapter->CmdWaitQWoken = FALSE; ++ Adapter->ps_state = PS_STATE_AWAKE; ++ Adapter->WakeupTries = 0; ++ ++ memset(&Adapter->PSConfirmSleep, 0, sizeof(PS_CMD_ConfirmSleep)); ++ /** SDIO header */ ++ Adapter->PSConfirmSleep.SDLen = ++ uap_cpu_to_le16(sizeof(PS_CMD_ConfirmSleep)); ++ Adapter->PSConfirmSleep.SDType = uap_cpu_to_le16(MV_TYPE_CMD); ++ Adapter->PSConfirmSleep.SeqNum = 0; ++ Adapter->PSConfirmSleep.Command = uap_cpu_to_le16(HOST_CMD_SLEEP_CONFIRM); ++ Adapter->PSConfirmSleep.Size = uap_cpu_to_le16(sizeof(HostCmd_DS_GEN)); ++ Adapter->PSConfirmSleep.Result = 0; ++ ++ init_waitqueue_head(&Adapter->cmdwait_q); ++ OS_INIT_SEMAPHORE(&Adapter->CmdSem); ++ ++ skb_queue_head_init(&Adapter->tx_queue); ++ skb_queue_head_init(&Adapter->cmd_queue); ++ ++ /* Status variable */ ++ Adapter->HardwareStatus = HWInitializing; ++ ++ /* PnP support */ ++ Adapter->SurpriseRemoved = FALSE; ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22) ++ Adapter->nl_sk = netlink_kernel_create(NETLINK_MARVELL, ++ NL_MULTICAST_GROUP, NULL, ++ THIS_MODULE); ++#else ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24) ++ Adapter->nl_sk = netlink_kernel_create(NETLINK_MARVELL, ++ NL_MULTICAST_GROUP, NULL, NULL, ++ THIS_MODULE); ++#else ++ Adapter->nl_sk = netlink_kernel_create(&init_net, NETLINK_MARVELL, &cfg); ++#endif ++#endif ++ if (!Adapter->nl_sk) { ++ PRINTM(ERROR, ++ "Could not initialize netlink event passing mechanism!\n"); ++ } ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief This function sends FUNC_INIT command to firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS on success, otherwise failure code ++ */ ++static int ++uap_func_init(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u32 CmdSize; ++ HostCmd_DS_GEN *cmd; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb; ++ ENTER(); ++ if (Adapter->HardwareStatus != HWReady) { ++ PRINTM(ERROR, "uap_func_init:Hardware is not ready!\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ ret = -ENOMEM; ++ goto done; ++ } ++ CmdSize = sizeof(HostCmd_DS_GEN); ++ cmd = (HostCmd_DS_GEN *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HostCmd_CMD_FUNC_INIT); ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ PRINTM(CMND, "HostCmd_CMD_FUNC_INIT\n"); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP_TIMEOUT)) { ++ PRINTM(ERROR, "Fail to process cmd HostCmd_CMD_FUNC_INIT\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function sends FUNC_SHUTDOWN command to firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS on success, otherwise failure code ++ */ ++static int __exit ++uap_func_shutdown(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u32 CmdSize; ++ HostCmd_DS_GEN *cmd; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb; ++ ENTER(); ++ if (Adapter->HardwareStatus != HWReady) { ++ PRINTM(ERROR, "uap_func_shutdown:Hardware is not ready!\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ ret = -ENOMEM; ++ goto done; ++ } ++ CmdSize = sizeof(HostCmd_DS_GEN); ++ cmd = (HostCmd_DS_GEN *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HostCmd_CMD_FUNC_SHUTDOWN); ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ PRINTM(CMND, "HostCmd_CMD_FUNC_SHUTDOWN\n"); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP_TIMEOUT)) { ++ PRINTM(ERROR, "Fail to process cmd HostCmd_CMD_FUNC_SHUTDOWN\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function initializes firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++uap_init_fw(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ ENTER(); ++ sbi_disable_host_int(priv); ++ /* Check if firmware is already running */ ++ if (sbi_check_fw_status(priv, 1) == UAP_STATUS_SUCCESS) { ++ PRINTM(MSG, "UAP FW already running! Skip FW download\n"); ++ } else { ++ if ((ret = request_firmware(&priv->fw_helper, helper_name, ++ priv->hotplug_device)) < 0) { ++ PRINTM(FATAL, ++ "request_firmware() failed (helper), error code = %#x\n", ++ ret); ++ goto done; ++ } ++ ++ /* Download the helper */ ++ ret = sbi_prog_helper(priv); ++ ++ if (ret) { ++ PRINTM(FATAL, ++ "Bootloader in invalid state! Helper download failed!\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ if ((ret = request_firmware(&priv->firmware, fw_name, ++ priv->hotplug_device)) < 0) { ++ PRINTM(FATAL, "request_firmware() failed, error code = %#x\n", ret); ++ goto done; ++ } ++ ++ /* Download the main firmware via the helper firmware */ ++ if (sbi_prog_fw_w_helper(priv)) { ++ PRINTM(FATAL, "UAP FW download failed!\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ /* Check if the firmware is downloaded successfully or not */ ++ if (sbi_check_fw_status(priv, MAX_FIRMWARE_POLL_TRIES) == ++ UAP_STATUS_FAILURE) { ++ PRINTM(FATAL, "FW failed to be active in time!\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ PRINTM(MSG, "UAP FW is active\n"); ++ } ++ sbi_enable_host_int(priv); ++ priv->adapter->HardwareStatus = HWReady; ++ if (uap_func_init(priv) != UAP_STATUS_SUCCESS) { ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ done: ++ if (priv->fw_helper) ++ release_firmware(priv->fw_helper); ++ if (priv->firmware) ++ release_firmware(priv->firmware); ++ LEAVE(); ++ return ret; ++ ++} ++ ++/** ++ * @brief This function frees the structure of adapter ++ * ++ * @param priv A pointer to uap_private structure ++ * @return n/a ++ */ ++static void ++uap_free_adapter(uap_private * priv) ++{ ++ uap_adapter *Adapter = priv->adapter; ++ ++ ENTER(); ++ ++ if (Adapter) { ++ if ((Adapter->nl_sk) && ((Adapter->nl_sk)->sk_socket)) { ++ sock_release((Adapter->nl_sk)->sk_socket); ++ Adapter->nl_sk = NULL; ++ } ++ if (Adapter->CmdBuf) ++ kfree(Adapter->CmdBuf); ++ skb_queue_purge(&priv->adapter->tx_queue); ++ skb_queue_purge(&priv->adapter->cmd_queue); ++ /* Free the adapter object itself */ ++ kfree(Adapter); ++ priv->adapter = NULL; ++ } ++ ++ LEAVE(); ++} ++ ++/** ++ * @brief This function handles the major job in uap driver. ++ * it handles the event generated by firmware, rx data received ++ * from firmware and tx data sent from kernel. ++ * ++ * @param data A pointer to uap_thread structure ++ * @return BT_STATUS_SUCCESS ++ */ ++static int ++uap_service_main_thread(void *data) ++{ ++ uap_thread *thread = data; ++ uap_private *priv = thread->priv; ++ uap_adapter *Adapter = priv->adapter; ++ wait_queue_t wait; ++ u8 ireg = 0; ++ struct sk_buff *skb; ++ ENTER(); ++ uap_activate_thread(thread); ++ init_waitqueue_entry(&wait, current); ++ current->flags |= PF_NOFREEZE; ++ ++ for (;;) { ++ add_wait_queue(&thread->waitQ, &wait); ++ OS_SET_THREAD_STATE(TASK_INTERRUPTIBLE); ++ if ((Adapter->WakeupTries) || ++ (!Adapter->IntCounter && Adapter->ps_state == PS_STATE_PRE_SLEEP) || ++ (!priv->adapter->IntCounter ++ && (priv->uap_dev.data_sent || ++ skb_queue_empty(&priv->adapter->tx_queue)) ++ && (priv->uap_dev.cmd_sent || Adapter->cmd_pending || ++ skb_queue_empty(&priv->adapter->cmd_queue)) ++ )) { ++ PRINTM(INFO, "Main: Thread sleeping...\n"); ++ schedule(); ++ } ++ OS_SET_THREAD_STATE(TASK_RUNNING); ++ remove_wait_queue(&thread->waitQ, &wait); ++ if (kthread_should_stop() || Adapter->SurpriseRemoved) { ++ PRINTM(INFO, "main-thread: break from main thread: " ++ "SurpriseRemoved=0x%x\n", Adapter->SurpriseRemoved); ++ /* Cancel pending command */ ++ if (Adapter->cmd_pending == TRUE) { ++ /* Wake up cmd Q */ ++ Adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&Adapter->cmdwait_q); ++ } ++ break; ++ } ++ ++ PRINTM(INFO, "Main: Thread waking up...\n"); ++ if (priv->adapter->IntCounter) { ++ OS_INT_DISABLE; ++ Adapter->IntCounter = 0; ++ OS_INT_RESTORE; ++ sbi_get_int_status(priv, &ireg); ++ } else if ((priv->adapter->ps_state == PS_STATE_SLEEP) && ++ (!skb_queue_empty(&priv->adapter->cmd_queue) || ++ !skb_queue_empty(&priv->adapter->tx_queue))) { ++ priv->adapter->WakeupTries++; ++ PRINTM(CMND, "%lu : Wakeup device...\n", os_time_get()); ++ sbi_wakeup_firmware(priv); ++ continue; ++ } ++ if (Adapter->ps_state == PS_STATE_PRE_SLEEP) ++ uap_ps_cond_check(priv); ++ ++ /* The PS state is changed during processing of Sleep Request event ++ above */ ++ if ((Adapter->ps_state == PS_STATE_SLEEP) || ++ (Adapter->ps_state == PS_STATE_PRE_SLEEP)) ++ continue; ++ /* Execute the next command */ ++ if (!priv->uap_dev.cmd_sent && !Adapter->cmd_pending && ++ (Adapter->HardwareStatus == HWReady)) { ++ if (!skb_queue_empty(&priv->adapter->cmd_queue)) { ++ skb = skb_dequeue(&priv->adapter->cmd_queue); ++ if (skb) { ++ Adapter->CmdSize = 0; ++ Adapter->cmd_pending = TRUE; ++ Adapter->cmd_wait_option = skb->cb[0]; ++ if (sbi_host_to_card(priv, skb->data, skb->len)) { ++ PRINTM(ERROR, "Cmd:sbi_host_to_card failed!\n"); ++ Adapter->cmd_pending = FALSE; ++ Adapter->dbg.num_cmd_host_to_card_failure++; ++ /* Wake up cmd Q */ ++ Adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&Adapter->cmdwait_q); ++ } else { ++ if (Adapter->cmd_wait_option == ++ HostCmd_OPTION_WAITFORSEND) { ++ /* Wake up cmd Q */ ++ Adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&Adapter->cmdwait_q); ++ Adapter->cmd_wait_option = FALSE; ++ } ++ } ++ kfree_skb(skb); ++ } ++ } ++ } ++ if (!priv->uap_dev.data_sent && (Adapter->HardwareStatus == HWReady)) { ++ if (!skb_queue_empty(&priv->adapter->tx_queue)) { ++ skb = skb_dequeue(&priv->adapter->tx_queue); ++ if (skb) { ++ if (uap_process_tx(priv, skb)) { ++ priv->stats.tx_dropped++; ++ priv->stats.tx_errors++; ++ os_start_queue(priv); ++ } else { ++ priv->stats.tx_packets++; ++ priv->stats.tx_bytes += skb->len; ++ } ++ ++ } ++ } ++ } ++ } ++ uap_deactivate_thread(thread); ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief uap hostcmd ioctl handler ++ * ++ * @param dev A pointer to net_device structure ++ * @param req A pointer to ifreq structure ++ * @return UAP_STATUS_SUCCESS --success, otherwise fail ++ */ ++/********* format of ifr_data *************/ ++/* buf_len + Hostcmd_body */ ++/* buf_len: 4 bytes */ ++/* the length of the buf which */ ++/* can be used to return data */ ++/* to application */ ++/* Hostcmd_body */ ++/*******************************************/ ++static int ++uap_hostcmd_ioctl(struct net_device *dev, struct ifreq *req) ++{ ++ u32 buf_len; ++ HostCmd_HEADER head; ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ uap_adapter *Adapter = priv->adapter; ++ int ret = UAP_STATUS_SUCCESS; ++ struct sk_buff *skb; ++ ++ ENTER(); ++ ++ /* Sanity check */ ++ if (req->ifr_data == NULL) { ++ PRINTM(ERROR, "uap_hostcmd_ioctl() corrupt data\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ if (copy_from_user(&buf_len, req->ifr_data, sizeof(buf_len))) { ++ PRINTM(ERROR, "Copy from user failed\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ memset(&head, 0, sizeof(HostCmd_HEADER)); ++ /* Get the command size from user space */ ++ if (copy_from_user ++ (&head, req->ifr_data + sizeof(buf_len), sizeof(HostCmd_HEADER))) { ++ PRINTM(ERROR, "Copy from user failed\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ head.Size = uap_le16_to_cpu(head.Size); ++ if (head.Size > MRVDRV_SIZE_OF_CMD_BUFFER) { ++ PRINTM(ERROR, "CmdSize too big=%d\n", head.Size); ++ LEAVE(); ++ return -EFAULT; ++ } ++ PRINTM(CMND, "ioctl: hostcmd=%x, size=%d,buf_len=%d\n", head.Command, ++ head.Size, buf_len); ++ skb = dev_alloc_skb(head.Size + INTF_HEADER_LEN); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ LEAVE(); ++ return -ENOMEM; ++ } ++ ++ /* Get the command from user space */ ++ if (copy_from_user ++ (skb->data + INTF_HEADER_LEN, req->ifr_data + sizeof(buf_len), ++ head.Size)) { ++ PRINTM(ERROR, "Copy from user failed\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ skb_put(skb, head.Size + INTF_HEADER_LEN); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP)) { ++ PRINTM(ERROR, "Fail to process cmd\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ if (!Adapter->CmdSize) { ++ PRINTM(ERROR, "Cmd Size is 0\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ if (Adapter->CmdSize > buf_len) { ++ PRINTM(ERROR, "buf_len is too small\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ /* Copy to user */ ++ if (copy_to_user ++ (req->ifr_data + sizeof(buf_len), Adapter->CmdBuf, Adapter->CmdSize)) { ++ PRINTM(ERROR, "Copy to user failed!\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief uap power mode ioctl handler ++ * ++ * @param dev A pointer to net_device structure ++ * @param req A pointer to ifreq structure ++ * @return UAP_STATUS_SUCCESS --success, otherwise fail ++ */ ++static int ++uap_power_mode_ioctl(struct net_device *dev, struct ifreq *req) ++{ ++ ps_mgmt pm_cfg; ++ int ret = UAP_STATUS_SUCCESS; ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb = NULL; ++ HostCmd_DS_COMMAND *cmd; ++ u32 CmdSize; ++ u8 *tlv = NULL; ++ MrvlIEtypes_sleep_param_t *sleep_tlv = NULL; ++ MrvlIEtypes_inact_sleep_param_t *inact_tlv = NULL; ++ u16 tlv_buf_left = 0; ++ MrvlIEtypesHeader_t *tlvbuf = NULL; ++ u16 tlv_type = 0; ++ u16 tlv_len = 0; ++ ++ ENTER(); ++ ++ /* Sanity check */ ++ if (req->ifr_data == NULL) { ++ PRINTM(ERROR, "uap_power_mode_ioctl() corrupt data\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ ++ memset(&pm_cfg, 0, sizeof(ps_mgmt)); ++ if (copy_from_user(&pm_cfg, req->ifr_data, sizeof(ps_mgmt))) { ++ PRINTM(ERROR, "Copy from user failed\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ PRINTM(CMND, ++ "ioctl power: flag=0x%x ps_mode=%d ctrl_bitmap=%d min_sleep=%d max_sleep=%d " ++ "inact_to=%d min_awake=%d max_awake=%d\n", pm_cfg.flags, ++ (int) pm_cfg.ps_mode, (int) pm_cfg.sleep_param.ctrl_bitmap, ++ (int) pm_cfg.sleep_param.min_sleep, ++ (int) pm_cfg.sleep_param.max_sleep, ++ (int) pm_cfg.inact_param.inactivity_to, ++ (int) pm_cfg.inact_param.min_awake, ++ (int) pm_cfg.inact_param.max_awake); ++ ++ if (pm_cfg. ++ flags & ~(PS_FLAG_PS_MODE | PS_FLAG_SLEEP_PARAM | ++ PS_FLAG_INACT_SLEEP_PARAM)) { ++ PRINTM(ERROR, "Invalid parameter: flags = 0x%x\n", pm_cfg.flags); ++ ret = -EINVAL; ++ goto done; ++ } ++ if (pm_cfg.ps_mode > PS_MODE_INACTIVITY) { ++ PRINTM(ERROR, "Invalid parameter: ps_mode = %d\n", (int) pm_cfg.flags); ++ ret = -EINVAL; ++ goto done; ++ } ++ ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(INFO, "No free skb\n"); ++ ret = -ENOMEM; ++ goto done; ++ } ++ ++ CmdSize = S_DS_GEN + sizeof(HostCmd_DS_POWER_MGMT_EXT); ++ ++ cmd = (HostCmd_DS_COMMAND *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HOST_CMD_POWER_MGMT_EXT); ++ if (!pm_cfg.flags) { ++ cmd->params.pm_cfg.action = uap_cpu_to_le16(ACTION_GET); ++ } else { ++ cmd->params.pm_cfg.action = uap_cpu_to_le16(ACTION_SET); ++ cmd->params.pm_cfg.power_mode = uap_cpu_to_le16(pm_cfg.ps_mode); ++ tlv = (u8 *) & cmd->params.pm_cfg + sizeof(HostCmd_DS_POWER_MGMT_EXT); ++ ++ if ((pm_cfg.ps_mode) && (pm_cfg.flags & PS_FLAG_SLEEP_PARAM)) { ++ sleep_tlv = (MrvlIEtypes_sleep_param_t *) tlv; ++ sleep_tlv->header.Type = uap_cpu_to_le16(TLV_TYPE_AP_SLEEP_PARAM); ++ sleep_tlv->header.Len = ++ uap_cpu_to_le16(sizeof(MrvlIEtypes_sleep_param_t) - ++ sizeof(MrvlIEtypesHeader_t)); ++ sleep_tlv->ctrl_bitmap = ++ uap_cpu_to_le32(pm_cfg.sleep_param.ctrl_bitmap); ++ sleep_tlv->min_sleep = ++ uap_cpu_to_le32(pm_cfg.sleep_param.min_sleep); ++ sleep_tlv->max_sleep = ++ uap_cpu_to_le32(pm_cfg.sleep_param.max_sleep); ++ CmdSize += sizeof(MrvlIEtypes_sleep_param_t); ++ tlv += sizeof(MrvlIEtypes_sleep_param_t); ++ } ++ if ((pm_cfg.ps_mode == PS_MODE_INACTIVITY) && ++ (pm_cfg.flags & PS_FLAG_INACT_SLEEP_PARAM)) { ++ inact_tlv = (MrvlIEtypes_inact_sleep_param_t *) tlv; ++ inact_tlv->header.Type = ++ uap_cpu_to_le16(TLV_TYPE_AP_INACT_SLEEP_PARAM); ++ inact_tlv->header.Len = ++ uap_cpu_to_le16(sizeof(MrvlIEtypes_inact_sleep_param_t) - ++ sizeof(MrvlIEtypesHeader_t)); ++ inact_tlv->inactivity_to = ++ uap_cpu_to_le32(pm_cfg.inact_param.inactivity_to); ++ inact_tlv->min_awake = ++ uap_cpu_to_le32(pm_cfg.inact_param.min_awake); ++ inact_tlv->max_awake = ++ uap_cpu_to_le32(pm_cfg.inact_param.max_awake); ++ CmdSize += sizeof(MrvlIEtypes_inact_sleep_param_t); ++ tlv += sizeof(MrvlIEtypes_inact_sleep_param_t); ++ } ++ } ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP)) { ++ PRINTM(ERROR, "Fail to process cmd POWER_MODE\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ if (!Adapter->CmdSize) { ++ PRINTM(ERROR, "Cmd Size is 0\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ cmd = (HostCmd_DS_COMMAND *) Adapter->CmdBuf; ++ cmd->Result = uap_le16_to_cpu(cmd->Result); ++ if (cmd->Result != UAP_STATUS_SUCCESS) { ++ PRINTM(ERROR, "HOST_CMD_APCMD_POWER_MODE fail=%x\n", cmd->Result); ++ ret = -EFAULT; ++ goto done; ++ } ++ if (pm_cfg.flags) { ++ Adapter->psmode = uap_le16_to_cpu(cmd->params.pm_cfg.power_mode); ++ } else { ++ pm_cfg.flags = PS_FLAG_PS_MODE; ++ pm_cfg.ps_mode = uap_le16_to_cpu(cmd->params.pm_cfg.power_mode); ++ tlv_buf_left = ++ cmd->Size - (sizeof(HostCmd_DS_POWER_MGMT_EXT) + S_DS_GEN); ++ tlvbuf = ++ (MrvlIEtypesHeader_t *) ((u8 *) & cmd->params.pm_cfg + ++ sizeof(HostCmd_DS_POWER_MGMT_EXT)); ++ while (tlv_buf_left >= sizeof(MrvlIEtypesHeader_t)) { ++ tlv_type = uap_le16_to_cpu(tlvbuf->Type); ++ tlv_len = uap_le16_to_cpu(tlvbuf->Len); ++ switch (tlv_type) { ++ case TLV_TYPE_AP_SLEEP_PARAM: ++ sleep_tlv = (MrvlIEtypes_sleep_param_t *) tlvbuf; ++ pm_cfg.flags |= PS_FLAG_SLEEP_PARAM; ++ pm_cfg.sleep_param.ctrl_bitmap = ++ uap_le32_to_cpu(sleep_tlv->ctrl_bitmap); ++ pm_cfg.sleep_param.min_sleep = ++ uap_le32_to_cpu(sleep_tlv->min_sleep); ++ pm_cfg.sleep_param.max_sleep = ++ uap_le32_to_cpu(sleep_tlv->max_sleep); ++ break; ++ case TLV_TYPE_AP_INACT_SLEEP_PARAM: ++ inact_tlv = (MrvlIEtypes_inact_sleep_param_t *) tlvbuf; ++ pm_cfg.flags |= PS_FLAG_INACT_SLEEP_PARAM; ++ pm_cfg.inact_param.inactivity_to = ++ uap_le32_to_cpu(inact_tlv->inactivity_to); ++ pm_cfg.inact_param.min_awake = ++ uap_le32_to_cpu(inact_tlv->min_awake); ++ pm_cfg.inact_param.max_awake = ++ uap_le32_to_cpu(inact_tlv->max_awake); ++ break; ++ } ++ tlv_buf_left -= tlv_len + sizeof(MrvlIEtypesHeader_t); ++ tlvbuf = ++ (MrvlIEtypesHeader_t *) ((u8 *) tlvbuf + tlv_len + ++ sizeof(MrvlIEtypesHeader_t)); ++ } ++ /* Copy to user */ ++ if (copy_to_user(req->ifr_data, &pm_cfg, sizeof(ps_mgmt))) { ++ PRINTM(ERROR, "Copy to user failed!\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function send bss_stop command to firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS on success, otherwise failure code ++ */ ++static int ++uap_bss_stop(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u32 CmdSize; ++ HostCmd_DS_GEN *cmd; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb; ++ ENTER(); ++ if (Adapter->HardwareStatus != HWReady) { ++ PRINTM(ERROR, "uap_bss_stop:Hardware is not ready!\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ ret = -ENOMEM; ++ goto done; ++ } ++ CmdSize = sizeof(HostCmd_DS_GEN); ++ cmd = (HostCmd_DS_GEN *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HOST_CMD_APCMD_BSS_STOP); ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ PRINTM(CMND, "APCMD_BSS_STOP\n"); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP_TIMEOUT)) { ++ PRINTM(ERROR, "Fail to process cmd BSS_STOP\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/******************************************************** ++ Global Functions ++********************************************************/ ++/** ++ * @brief This function send soft_reset command to firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS on success, otherwise failure code ++ */ ++int ++uap_soft_reset(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u32 CmdSize; ++ HostCmd_DS_GEN *cmd; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb; ++ ENTER(); ++ ret = uap_bss_stop(priv); ++ if (ret != UAP_STATUS_SUCCESS) ++ goto done; ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ ret = -ENOMEM; ++ goto done; ++ } ++ CmdSize = sizeof(HostCmd_DS_GEN); ++ cmd = (HostCmd_DS_GEN *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HOST_CMD_APCMD_SOFT_RESET); ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ PRINTM(CMND, "APCMD_SOFT_RESET\n"); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORSEND)) { ++ PRINTM(ERROR, "Fail to process cmd SOFT_RESET\n"); ++ ret = -EFAULT; ++ goto done; ++ } ++ Adapter->SurpriseRemoved = TRUE; ++ /* delay to allow hardware complete reset */ ++ os_sched_timeout(5); ++ if (priv->MediaConnected == TRUE) { ++ os_stop_queue(priv); ++ os_carrier_off(priv); ++ priv->MediaConnected = FALSE; ++ } ++ Adapter->CmdSize = 0; ++ Adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&Adapter->cmdwait_q); ++ skb_queue_purge(&priv->adapter->tx_queue); ++ skb_queue_purge(&priv->adapter->cmd_queue); ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function processes received packet and forwards it ++ * to kernel/upper layer ++ * ++ * @param priv A pointer to uap_private ++ * @param skb A pointer to skb which includes the received packet ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++uap_process_rx_packet(uap_private * priv, struct sk_buff *skb) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ RxPD *pRxPD; ++ ENTER(); ++ priv->adapter->ps_state = PS_STATE_AWAKE; ++ pRxPD = (RxPD *) skb->data; ++ endian_convert_RxPD(pRxPD); ++ DBG_HEXDUMP(DAT_D, "Rx", skb->data, MIN(skb->len, DATA_DUMP_LEN)); ++ skb_pull(skb, pRxPD->RxPktOffset); ++ priv->stats.rx_packets++; ++ priv->stats.rx_bytes += skb->len; ++ os_upload_rx_packet(priv, skb); ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function opens the network device ++ * ++ * @param dev A pointer to net_device structure ++ * @return UAP_STATUS_SUCCESS ++ */ ++static int ++uap_open(struct net_device *dev) ++{ ++ uap_private *priv = (uap_private *) (uap_private *) netdev_priv(dev); ++ uap_adapter *Adapter = priv->adapter; ++ int i = 0; ++ ++ ENTER(); ++ ++ /* On some systems the device open handler will be called before HW ready. */ ++ /* Use the following flag check and wait function to work around the issue. */ ++ while ((Adapter->HardwareStatus != HWReady) && ++ (i < MAX_WAIT_DEVICE_READY_COUNT)) { ++ i++; ++ os_sched_timeout(100); ++ } ++ if (i >= MAX_WAIT_DEVICE_READY_COUNT) { ++ PRINTM(FATAL, "HW not ready, uap_open() return failure\n"); ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ ++ if (MODULE_GET == 0) ++ return UAP_STATUS_FAILURE; ++ ++ priv->open = TRUE; ++ if (priv->MediaConnected == TRUE) { ++ os_carrier_on(priv); ++ os_start_queue(priv); ++ } else { ++ os_stop_queue(priv); ++ os_carrier_off(priv); ++ } ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief This function closes the network device ++ * ++ * @param dev A pointer to net_device structure ++ * @return UAP_STATUS_SUCCESS ++ */ ++static int ++uap_close(struct net_device *dev) ++{ ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ ++ ENTER(); ++ skb_queue_purge(&priv->adapter->tx_queue); ++ os_stop_queue(priv); ++ os_carrier_off(priv); ++ ++ MODULE_PUT; ++ priv->open = FALSE; ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief This function returns the network statistics ++ * ++ * @param dev A pointer to uap_private structure ++ * @return A pointer to net_device_stats structure ++ */ ++static struct net_device_stats * ++uap_get_stats(struct net_device *dev) ++{ ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ ++ return &priv->stats; ++} ++ ++/** ++ * @brief This function sets the MAC address to firmware. ++ * ++ * @param dev A pointer to uap_private structure ++ * @param addr MAC address to set ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++uap_set_mac_address(struct net_device *dev, void *addr) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ struct sockaddr *pHwAddr = (struct sockaddr *) addr; ++ u32 CmdSize; ++ HostCmd_DS_COMMAND *cmd; ++ MrvlIEtypes_MacAddr_t *pMacAddrTlv; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb; ++ ++ ENTER(); ++ ++ /* Dump MAC address */ ++ DBG_HEXDUMP(CMD_D, "Original MAC addr", dev->dev_addr, ETH_ALEN); ++ DBG_HEXDUMP(CMD_D, "New MAC addr", pHwAddr->sa_data, ETH_ALEN); ++ if (priv->open && (priv->MediaConnected == TRUE)) { ++ os_carrier_on(priv); ++ os_start_queue(priv); ++ } ++ skb = dev_alloc_skb(MRVDRV_SIZE_OF_CMD_BUFFER); ++ if (!skb) { ++ PRINTM(ERROR, "No free skb\n"); ++ LEAVE(); ++ return -ENOMEM; ++ } ++ CmdSize = ++ S_DS_GEN + sizeof(HostCmd_SYS_CONFIG) + sizeof(MrvlIEtypes_MacAddr_t); ++ cmd = (HostCmd_DS_COMMAND *) (skb->data + INTF_HEADER_LEN); ++ cmd->Command = uap_cpu_to_le16(HOST_CMD_APCMD_SYS_CONFIGURE); ++ cmd->Size = uap_cpu_to_le16(CmdSize); ++ cmd->params.sys_config.Action = uap_cpu_to_le16(ACTION_SET); ++ pMacAddrTlv = ++ (MrvlIEtypes_MacAddr_t *) ((u8 *) cmd + S_DS_GEN + ++ sizeof(HostCmd_SYS_CONFIG)); ++ pMacAddrTlv->Header.Type = uap_cpu_to_le16(MRVL_AP_MAC_ADDRESS_TLV_ID); ++ pMacAddrTlv->Header.Len = uap_cpu_to_le16(ETH_ALEN); ++ memcpy(pMacAddrTlv->ApMacAddr, pHwAddr->sa_data, ETH_ALEN); ++ skb_put(skb, CmdSize + INTF_HEADER_LEN); ++ PRINTM(CMND, "set_mac_address\n"); ++ if (UAP_STATUS_SUCCESS != ++ uap_process_cmd(priv, skb, HostCmd_OPTION_WAITFORRSP_TIMEOUT)) { ++ PRINTM(ERROR, "Fail to set mac address\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ if (!Adapter->CmdSize) { ++ PRINTM(ERROR, "Cmd Size is 0\n"); ++ LEAVE(); ++ return -EFAULT; ++ } ++ cmd = (HostCmd_DS_COMMAND *) Adapter->CmdBuf; ++ cmd->Result = uap_cpu_to_le16(cmd->Result); ++ if (cmd->Result != UAP_STATUS_SUCCESS) { ++ PRINTM(ERROR, "set mac addrress fail,cmd result=%x\n", cmd->Result); ++ ret = -EFAULT; ++ } else ++ memcpy(dev->dev_addr, pHwAddr->sa_data, ETH_ALEN); ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function handles the timeout of packet ++ * transmission ++ * ++ * @param dev A pointer to net_device structure ++ * @return n/a ++ */ ++static void ++uap_tx_timeout(struct net_device *dev) ++{ ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ ++ ENTER(); ++ ++ PRINTM(DATA, "Tx timeout\n"); ++ UpdateTransStart(dev); ++ priv->num_tx_timeout++; ++ priv->adapter->IntCounter++; ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ ++ LEAVE(); ++} ++ ++/** ++ * @brief This function handles packet transmission ++ * ++ * @param skb A pointer to sk_buff structure ++ * @param dev A pointer to net_device structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++uap_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++{ ++ uap_private *priv = (uap_private *) netdev_priv(dev); ++ int ret = UAP_STATUS_SUCCESS; ++ ++ ENTER(); ++ PRINTM(DATA, "Data <= kernel\n"); ++ DBG_HEXDUMP(DAT_D, "Tx", skb->data, MIN(skb->len, DATA_DUMP_LEN)); ++ /* skb sanity check */ ++ if (!skb->len || (skb->len > MRVDRV_MAXIMUM_ETH_PACKET_SIZE)) { ++ PRINTM(ERROR, "Tx Error: Bad skb length %d : %d\n", skb->len, ++ MRVDRV_MAXIMUM_ETH_PACKET_SIZE); ++ priv->stats.tx_dropped++; ++ kfree(skb); ++ goto done; ++ } ++ skb_queue_tail(&priv->adapter->tx_queue, skb); ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ if (skb_queue_len(&priv->adapter->tx_queue) > TX_HIGH_WATERMARK) { ++ UpdateTransStart(dev); ++ os_stop_queue(priv); ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief ioctl function - entry point ++ * ++ * @param dev A pointer to net_device structure ++ * @param req A pointer to ifreq structure ++ * @param cmd command ++ * @return UAP_STATUS_SUCCESS--success, otherwise fail ++ */ ++static int ++uap_do_ioctl(struct net_device *dev, struct ifreq *req, int cmd) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ ++ ENTER(); ++ ++ PRINTM(CMND, "uap_do_ioctl: ioctl cmd = 0x%x\n", cmd); ++ ++ switch (cmd) { ++ case UAPHOSTCMD: ++ ret = uap_hostcmd_ioctl(dev, req); ++ break; ++ case UAP_POWER_MODE: ++ ret = uap_power_mode_ioctl(dev, req); ++ break; ++ default: ++ ret = -EINVAL; ++ break; ++ } ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function handles events generated by firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @param payload A pointer to payload buffer ++ * @param len Length of the payload ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++uap_process_event(uap_private * priv, u8 * payload, uint len) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ uap_adapter *Adapter = priv->adapter; ++ struct sk_buff *skb = NULL; ++ struct nlmsghdr *nlh = NULL; ++ struct sock *sk = Adapter->nl_sk; ++ AP_Event *pEvent; ++ ++ ENTER(); ++ Adapter->ps_state = PS_STATE_AWAKE; ++ if (len > NL_MAX_PAYLOAD) { ++ PRINTM(ERROR, "event size is too big!!! len=%d\n", len); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ pEvent = (AP_Event *) payload; ++ PRINTM(CMND, "Event: %d\n", pEvent->EventId); ++ switch (pEvent->EventId) { ++ case MICRO_AP_EV_ID_BSS_START: ++ memcpy(priv->uap_dev.netdev->dev_addr, pEvent->MacAddr, ETH_ALEN); ++ DBG_HEXDUMP(CMD_D, "BSS MAC addr", priv->uap_dev.netdev->dev_addr, ++ ETH_ALEN); ++ break; ++ case MICRO_AP_EV_BSS_ACTIVE: ++ // carrier on ++ priv->MediaConnected = TRUE; ++ os_carrier_on(priv); ++ os_start_queue(priv); ++ break; ++ case MICRO_AP_EV_BSS_IDLE: ++ os_stop_queue(priv); ++ os_carrier_off(priv); ++ priv->MediaConnected = FALSE; ++ break; ++ case EVENT_PS_AWAKE: ++ PRINTM(CMND, "UAP: PS_AWAKE\n"); ++ Adapter->ps_state = PS_STATE_AWAKE; ++ Adapter->WakeupTries = 0; ++ break; ++ case EVENT_PS_SLEEP: ++ PRINTM(CMND, "UAP: PS_SLEEP\n"); ++ Adapter->ps_state = PS_STATE_PRE_SLEEP; ++ break; ++ default: ++ break; ++ } ++ if ((pEvent->EventId == EVENT_PS_AWAKE) || ++ (pEvent->EventId == EVENT_PS_SLEEP)) ++ goto done; ++ if (sk) { ++ /* Allocate skb */ ++ if (!(skb = alloc_skb(NLMSG_SPACE(NL_MAX_PAYLOAD), GFP_ATOMIC))) { ++ PRINTM(ERROR, "Could not allocate skb for netlink.\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ nlh = (struct nlmsghdr *) skb->data; ++ nlh->nlmsg_len = NLMSG_SPACE(len); ++ ++ /* From kernel */ ++ nlh->nlmsg_pid = 0; ++ nlh->nlmsg_flags = 0; ++ ++ /* Data */ ++ skb_put(skb, nlh->nlmsg_len); ++ memcpy(NLMSG_DATA(nlh), payload, len); ++ ++ /* From Kernel */ ++ NETLINK_CB(skb).portid = 0; ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20) ++ /* Multicast message */ ++ NETLINK_CB(skb).dst_pid = 0; ++#endif ++ ++ /* Multicast group number */ ++ NETLINK_CB(skb).dst_group = NL_MULTICAST_GROUP; ++ ++ /* Send message */ ++ netlink_broadcast(sk, skb, 0, NL_MULTICAST_GROUP, GFP_KERNEL); ++ ++ ret = UAP_STATUS_SUCCESS; ++ } else { ++ PRINTM(ERROR, "Could not send event through NETLINK. Link down.\n"); ++ ret = UAP_STATUS_FAILURE; ++ } ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function handles the interrupt. it will change PS ++ * state if applicable. it will wake up main_thread to handle ++ * the interrupt event as well. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return n/a ++ */ ++void ++uap_interrupt(uap_private * priv) ++{ ++ ENTER(); ++ priv->adapter->IntCounter++; ++ priv->adapter->WakeupTries = 0; ++ PRINTM(INFO, "*\n"); ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ ++ LEAVE(); ++ ++} ++ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,29) ++/** Network device handlers */ ++static const struct net_device_ops uap_netdev_ops = { ++ .ndo_open = uap_open, ++ .ndo_start_xmit = uap_hard_start_xmit, ++ .ndo_stop = uap_close, ++ .ndo_do_ioctl = uap_do_ioctl, ++ .ndo_set_mac_address = uap_set_mac_address, ++ .ndo_tx_timeout = uap_tx_timeout, ++ .ndo_get_stats = uap_get_stats, ++}; ++#endif ++ ++/** ++ * @brief This function adds the card. it will probe the ++ * card, allocate the uap_priv and initialize the device. ++ * ++ * @param card A pointer to card ++ * @return A pointer to uap_private structure ++ */ ++uap_private * ++uap_add_card(void *card) ++{ ++ struct net_device *dev = NULL; ++ uap_private *priv = NULL; ++ ++ ENTER(); ++ ++ if (OS_ACQ_SEMAPHORE_BLOCK(&AddRemoveCardSem)) ++ goto exit_sem_err; ++ ++ /* Allocate an Ethernet device */ ++ if (!(dev = alloc_etherdev(sizeof(uap_private)))) { ++ PRINTM(FATAL, "Init ethernet device failed!\n"); ++ goto error; ++ } ++ priv = (uap_private *) netdev_priv(dev); ++ ++ /* Allocate name */ ++ if (dev_alloc_name(dev, "uap%d") < 0) { ++ PRINTM(ERROR, "Could not allocate device name!\n"); ++ goto error; ++ } ++ ++ /* Allocate buffer for uap_adapter */ ++ if (!(priv->adapter = kmalloc(sizeof(uap_adapter), GFP_KERNEL))) { ++ PRINTM(FATAL, "Allocate buffer for uap_adapter failed!\n"); ++ goto error; ++ } ++ memset(priv->adapter, 0, sizeof(uap_adapter)); ++ ++ priv->uap_dev.netdev = dev; ++ priv->uap_dev.card = card; ++ priv->MediaConnected = FALSE; ++ uappriv = priv; ++ ((struct sdio_mmc_card *) card)->priv = priv; ++ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24) ++ SET_MODULE_OWNER(dev); ++#endif ++ ++ /* Setup the OS Interface to our functions */ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29) ++ dev->open = uap_open; ++ dev->stop = uap_close; ++ dev->hard_start_xmit = uap_hard_start_xmit; ++ dev->tx_timeout = uap_tx_timeout; ++ dev->get_stats = uap_get_stats; ++ dev->do_ioctl = uap_do_ioctl; ++ dev->set_mac_address = uap_set_mac_address; ++ dev->set_multicast_list = uap_set_multicast_list; ++#else ++ dev->netdev_ops = &uap_netdev_ops; ++#endif ++ dev->watchdog_timeo = MRVDRV_DEFAULT_WATCHDOG_TIMEOUT; ++ dev->hard_header_len += sizeof(TxPD) + INTF_HEADER_LEN; ++ dev->hard_header_len += HEADER_ALIGNMENT; ++#define NETIF_F_DYNALLOC 16 ++ dev->features |= NETIF_F_DYNALLOC; ++ dev->flags |= IFF_BROADCAST | IFF_MULTICAST; ++ ++ /* Init SW */ ++ if (uap_init_sw(priv)) { ++ PRINTM(FATAL, "Software Init Failed\n"); ++ goto error; ++ } ++ ++ PRINTM(INFO, "Starting kthread...\n"); ++ priv->MainThread.priv = priv; ++ spin_lock_init(&priv->driver_lock); ++ uap_create_thread(uap_service_main_thread, &priv->MainThread, ++ "uap_main_service"); ++ while (priv->MainThread.pid == 0) { ++ os_sched_timeout(2); ++ } ++ ++ /* Register the device */ ++ if (sbi_register_dev(priv) < 0) { ++ PRINTM(FATAL, "Failed to register uap device!\n"); ++ goto err_registerdev; ++ } ++#ifdef FW_DNLD_NEEDED ++ SET_NETDEV_DEV(dev, priv->hotplug_device); ++#endif ++ ++ /* Init FW and HW */ ++ if (uap_init_fw(priv)) { ++ PRINTM(FATAL, "Firmware Init Failed\n"); ++ goto err_init_fw; ++ } ++ ++ priv->uap_dev.cmd_sent = FALSE; ++ priv->uap_dev.data_sent = FALSE; ++ ++ /* Get mac address from firmware */ ++ if (uap_get_mac_address(priv)) { ++ PRINTM(FATAL, "Fail to get mac address\n"); ++ goto err_init_fw; ++ } ++ /* Register network device */ ++ if (register_netdev(dev)) { ++ printk(KERN_ERR "Cannot register network device!\n"); ++ goto err_init_fw; ++ } ++#ifdef CONFIG_PROC_FS ++ uap_proc_entry(priv, dev); ++ uap_debug_entry(priv, dev); ++#endif /* CPNFIG_PROC_FS */ ++ OS_REL_SEMAPHORE(&AddRemoveCardSem); ++ ++ LEAVE(); ++ return priv; ++ err_init_fw: ++ sbi_unregister_dev(priv); ++ err_registerdev: ++ ((struct sdio_mmc_card *) card)->priv = NULL; ++ /* Stop the thread servicing the interrupts */ ++ priv->adapter->SurpriseRemoved = TRUE; ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ while (priv->MainThread.pid) { ++ os_sched_timeout(1); ++ } ++ error: ++ if (dev) { ++ if (dev->reg_state == NETREG_REGISTERED) ++ unregister_netdev(dev); ++ if (priv->adapter) ++ uap_free_adapter(priv); ++ free_netdev(dev); ++ uappriv = NULL; ++ } ++ OS_REL_SEMAPHORE(&AddRemoveCardSem); ++ exit_sem_err: ++ LEAVE(); ++ return NULL; ++} ++ ++/** ++ * @brief This function removes the card. ++ * ++ * @param card A pointer to card ++ * @return UAP_STATUS_SUCCESS ++ */ ++int ++uap_remove_card(void *card) ++{ ++ uap_private *priv = uappriv; ++ uap_adapter *Adapter; ++ struct net_device *dev; ++ ++ ENTER(); ++ ++ if (OS_ACQ_SEMAPHORE_BLOCK(&AddRemoveCardSem)) ++ goto exit_sem_err; ++ ++ if (!priv || !(Adapter = priv->adapter)) { ++ goto exit_remove; ++ } ++ Adapter->SurpriseRemoved = TRUE; ++ if (Adapter->cmd_pending == TRUE) { ++ /* Wake up cmd Q */ ++ Adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&Adapter->cmdwait_q); ++ } ++ dev = priv->uap_dev.netdev; ++ if (priv->MediaConnected == TRUE) { ++ os_stop_queue(priv); ++ os_carrier_off(priv); ++ priv->MediaConnected = FALSE; ++ } ++ Adapter->CmdSize = 0; ++ Adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&Adapter->cmdwait_q); ++ skb_queue_purge(&priv->adapter->tx_queue); ++ skb_queue_purge(&priv->adapter->cmd_queue); ++ ++ /* Disable interrupts on the card */ ++ sbi_disable_host_int(priv); ++ PRINTM(INFO, "netdev_finish_unregister: %s%s.\n", dev->name, ++ (dev->features & NETIF_F_DYNALLOC) ? "" : ", old style"); ++ unregister_netdev(dev); ++ PRINTM(INFO, "Unregister finish\n"); ++ wake_up_interruptible(&priv->MainThread.waitQ); ++ while (priv->MainThread.pid) { ++ os_sched_timeout(1); ++ } ++ ++ if ((Adapter->nl_sk) && ((Adapter->nl_sk)->sk_socket)) { ++ sock_release((Adapter->nl_sk)->sk_socket); ++ Adapter->nl_sk = NULL; ++ } ++#ifdef CONFIG_PROC_FS ++ uap_debug_remove(priv); ++ uap_proc_remove(priv); ++#endif ++ sbi_unregister_dev(priv); ++ PRINTM(INFO, "Free Adapter\n"); ++ uap_free_adapter(priv); ++ priv->uap_dev.netdev = NULL; ++ free_netdev(dev); ++ uappriv = NULL; ++ ++ exit_remove: ++ OS_REL_SEMAPHORE(&AddRemoveCardSem); ++ exit_sem_err: ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief This function initializes module. ++ * ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int __init ++uap_init_module(void) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ ENTER(); ++ ++ OS_INIT_SEMAPHORE(&AddRemoveCardSem); ++ ret = sbi_register(); ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function cleans module ++ * ++ * @return n/a ++ */ ++static void __exit ++uap_cleanup_module(void) ++{ ++ ENTER(); ++ ++ if (OS_ACQ_SEMAPHORE_BLOCK(&AddRemoveCardSem)) ++ goto exit_sem_err; ++ ++ if ((uappriv) && (uappriv->adapter)) { ++ uap_func_shutdown(uappriv); ++ } ++ OS_REL_SEMAPHORE(&AddRemoveCardSem); ++ exit_sem_err: ++ sbi_unregister(); ++ LEAVE(); ++} ++ ++module_init(uap_init_module); ++module_exit(uap_cleanup_module); ++module_param(helper_name, charp, 0); ++MODULE_PARM_DESC(helper_name, "Helper name"); ++module_param(fw_name, charp, 0); ++MODULE_PARM_DESC(fw_name, "Firmware name"); ++ ++MODULE_DESCRIPTION("M-UAP Driver"); ++MODULE_AUTHOR("Marvell International Ltd."); ++MODULE_VERSION(DRIVER_VERSION); ++MODULE_LICENSE("GPL"); +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_proc.c backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_proc.c +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_proc.c 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_proc.c 2014-12-29 20:37:43.952431125 +0100 +@@ -0,0 +1,258 @@ ++/** @file uap_proc.c ++ * @brief This file contains functions for proc file. ++ * ++ * Copyright (C) 2008-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++#ifdef CONFIG_PROC_FS ++#include <linux/proc_fs.h> ++#include <linux/seq_file.h> ++#include "uap_headers.h" ++ ++/** /proc directory root */ ++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26) ++#define PROC_DIR NULL ++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24) ++#define PROC_DIR &proc_root ++#else ++#define PROC_DIR proc_net ++#endif ++ ++/******************************************************** ++ Local Variables ++********************************************************/ ++ ++/******************************************************** ++ Global Variables ++********************************************************/ ++ ++/******************************************************** ++ Local Functions ++********************************************************/ ++ ++static int uap_info_proc_show(struct seq_file *s, void *data) { ++ int i; ++ struct net_device *netdev = (struct net_device*)s->private; ++ struct netdev_hw_addr *ha; ++ uap_private *priv = (uap_private *) netdev_priv(netdev); ++ ++ seq_printf(s, "driver_name = " ""uap"\n"); ++ seq_printf(s, "driver_version = %s-(FP%s)", DRIVER_VERSION, FPNUM); ++ seq_printf(s, "\nInterfaceName="%s"\n", netdev->name); ++ ++ seq_printf(s, "State="%s"\n", ++ ((priv->MediaConnected == ++ FALSE) ? "Disconnected" : "Connected")); ++ seq_printf(s, "MACAddress="%02x:%02x:%02x:%02x:%02x:%02x"\n", ++ netdev->dev_addr[0], netdev->dev_addr[1], netdev->dev_addr[2], ++ netdev->dev_addr[3], netdev->dev_addr[4], netdev->dev_addr[5]); ++ i = 0; ++ netdev_for_each_mc_addr(ha, netdev) { ++ ++i; ++ } ++ seq_printf(s, "MCCount="%d"\n", i); ++ ++ /* ++ * Put out the multicast list ++ */ ++ i = 0; ++ netdev_for_each_mc_addr(ha, netdev) { ++ seq_printf(s, ++ "MCAddr[%d]="%02x:%02x:%02x:%02x:%02x:%02x"\n", ++ i++, ++ ha->addr[0], ha->addr[1], ++ ha->addr[2], ha->addr[3], ++ ha->addr[4], ha->addr[5]); ++ } ++ ++ seq_printf(s, "num_tx_bytes = %lu\n", priv->stats.tx_bytes); ++ seq_printf(s, "num_rx_bytes = %lu\n", priv->stats.rx_bytes); ++ seq_printf(s, "num_tx_pkts = %lu\n", priv->stats.tx_packets); ++ seq_printf(s, "num_rx_pkts = %lu\n", priv->stats.rx_packets); ++ seq_printf(s, "num_tx_pkts_dropped = %lu\n", priv->stats.tx_dropped); ++ seq_printf(s, "num_rx_pkts_dropped = %lu\n", priv->stats.rx_dropped); ++ seq_printf(s, "num_tx_pkts_err = %lu\n", priv->stats.tx_errors); ++ seq_printf(s, "num_rx_pkts_err = %lu\n", priv->stats.rx_errors); ++ seq_printf(s, "num_tx_timeout = %u\n", priv->num_tx_timeout); ++ seq_printf(s, "carrier %s\n", ++ ((netif_carrier_ok(priv->uap_dev.netdev)) ? "on" : "off")); ++ seq_printf(s, "tx queue %s\n", ++ ((netif_queue_stopped(priv->uap_dev.netdev)) ? "stopped" : ++ "started")); ++ ++ return 0; ++} ++ ++static int uap_info_proc_open(struct inode *inode, struct file *file) { ++ return single_open(file, uap_info_proc_show, PDE_DATA(inode)); ++} ++ ++static int uap_hwstatus_proc_show(struct seq_file *s, void *data) { ++ struct net_device *netdev = (struct net_device*)s->private; ++ uap_private *priv = (uap_private *) netdev_priv(netdev); ++ ++ MODULE_GET; ++ seq_printf(s, "%d\n", priv->adapter->HardwareStatus); ++ MODULE_PUT; ++ ++ return 0; ++} ++ ++static int uap_hwstatus_proc_open(struct inode *inode, struct file *file) { ++ return single_open(file, uap_hwstatus_proc_show, PDE_DATA(inode)); ++} ++ ++static ssize_t uap_hwstatus_proc_write(struct file *file, const char __user *buffer, size_t count, loff_t *data) { ++ struct net_device *netdev = (struct net_device *)PDE_DATA(file_inode(file)); ++ uap_private *priv = (uap_private *) netdev_priv(netdev); ++ ++ int hwstatus; ++ char value[10]; ++ ++ if (count > sizeof(value)) ++ return count; ++ ++ if (copy_from_user(&value, buffer, count)) ++ return -EFAULT; ++ ++ hwstatus = string_to_number(value); ++ switch (hwstatus) { ++ case HWReset: ++ PRINTM(MSG, "reset hw\n"); ++ uap_soft_reset(priv); ++ priv->adapter->HardwareStatus = HWReset; ++ break; ++ default: ++ break; ++ } ++ ++ MODULE_PUT; ++ return count; ++} ++ ++static const struct file_operations uap_info_proc_fops = { ++ .owner = THIS_MODULE, ++ .open = uap_info_proc_open, ++ .read = seq_read, ++ .llseek = seq_lseek, ++ .release = single_release, ++}; ++ ++static const struct file_operations uap_hwstatus_proc_fops = { ++ .owner = THIS_MODULE, ++ .open = uap_hwstatus_proc_open, ++ .read = seq_read, ++ .llseek = seq_lseek, ++ .release = single_release, ++ .write = uap_hwstatus_proc_write, ++}; ++ ++/******************************************************** ++ Global Functions ++********************************************************/ ++/** ++ * @brief create uap proc file ++ * ++ * @param priv pointer uap_private ++ * @param dev pointer net_device ++ * @return N/A ++ */ ++void ++uap_proc_entry(uap_private * priv, struct net_device *dev) ++{ ++ PRINTM(INFO, "Creating Proc Interface\n"); ++ /* Check if uap directory already exists */ ++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26) ++ struct proc_dir_entry *r = PROC_DIR; ++ ++ for (r = r->subdir; r; r = r->next) { ++ if (r->namelen && !strcmp("uap", r->name)) { ++ /* Directory exists */ ++ PRINTM(WARN, "proc directory already exists!\n"); ++ priv->proc_uap = r; ++ break; ++ } ++ } ++#endif ++ if (!priv->proc_uap) { ++ priv->proc_uap = proc_mkdir("uap", PROC_DIR); ++ if (!priv->proc_uap) ++ return; ++ } ++ priv->proc_entry = proc_mkdir(dev->name, priv->proc_uap); ++ ++ if (priv->proc_entry) { ++ proc_create_data("info", 0644, priv->proc_entry, &uap_info_proc_fops, dev); ++ proc_create_data("hwinfo", 0644, priv->proc_entry, &uap_hwstatus_proc_fops, dev); ++ } ++} ++ ++/** ++ * @brief remove proc file ++ * ++ * @param priv pointer uap_private ++ * @return N/A ++ */ ++void ++uap_proc_remove(uap_private * priv) ++{ ++ if (priv->proc_uap) { ++ if (priv->proc_entry) { ++ remove_proc_entry("info", priv->proc_entry); ++ remove_proc_entry("hwstatus", priv->proc_entry); ++ } ++ remove_proc_entry(priv->uap_dev.netdev->name, priv->proc_uap); ++ } ++} ++ ++/** ++ * @brief convert string to number ++ * ++ * @param s pointer to numbered string ++ * @return converted number from string s ++ */ ++int ++string_to_number(char *s) ++{ ++ int r = 0; ++ int base = 0; ++ int pn = 1; ++ ++ if (strncmp(s, "-", 1) == 0) { ++ pn = -1; ++ s++; ++ } ++ if ((strncmp(s, "0x", 2) == 0) || (strncmp(s, "0X", 2) == 0)) { ++ base = 16; ++ s += 2; ++ } else ++ base = 10; ++ ++ for (s = s; *s != 0; s++) { ++ if ((*s >= '0') && (*s <= '9')) ++ r = (r * base) + (*s - '0'); ++ else if ((*s >= 'A') && (*s <= 'F')) ++ r = (r * base) + (*s - 'A' + 10); ++ else if ((*s >= 'a') && (*s <= 'f')) ++ r = (r * base) + (*s - 'a' + 10); ++ else ++ break; ++ } ++ ++ return (r * pn); ++} ++ ++#endif +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_sdio_mmc.c backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_sdio_mmc.c +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_sdio_mmc.c 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_sdio_mmc.c 2014-12-29 20:37:43.955764567 +0100 +@@ -0,0 +1,1428 @@ ++/** @file uap_sdio_mmc.c ++ * @brief This file contains SDIO IF (interface) module ++ * related functions. ++ * ++ * Copyright (C) 2007-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++/**************************************************** ++Change log: ++****************************************************/ ++ ++#include "uap_sdio_mmc.h" ++ ++#include <linux/firmware.h> ++ ++/** define SDIO block size */ ++/* We support up to 480-byte block size due to FW buffer limitation. */ ++#define SD_BLOCK_SIZE 256 ++ ++/** define allocated buffer size */ ++#define ALLOC_BUF_SIZE (((MAX(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, \ ++ MRVDRV_SIZE_OF_CMD_BUFFER) + INTF_HEADER_LEN \ ++ + SD_BLOCK_SIZE - 1) / SD_BLOCK_SIZE) * SD_BLOCK_SIZE) ++ ++/** Max retry number of CMD53 write */ ++#define MAX_WRITE_IOMEM_RETRY 2 ++ ++/******************************************************** ++ Local Variables ++********************************************************/ ++ ++/** SDIO Rx unit */ ++static u8 sdio_rx_unit = 0; ++ ++/**Interrupt status */ ++static u8 sd_ireg = 0; ++/******************************************************** ++ Global Variables ++********************************************************/ ++extern u8 *helper_name; ++extern u8 *fw_name; ++/** Default helper name */ ++#define DEFAULT_HELPER_NAME "mrvl/helper_sd.bin" ++/** Default firmware name */ ++#define DEFAULT_FW_NAME "mrvl/sd8688_ap.bin" ++ ++/******************************************************** ++ Local Functions ++********************************************************/ ++/** ++ * @brief This function reads the IO register. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param reg register to be read ++ * @param dat A pointer to variable that keeps returned value ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++sbi_read_ioreg(uap_private * priv, u32 reg, u8 * dat) ++{ ++ struct sdio_mmc_card *card; ++ int ret = UAP_STATUS_FAILURE; ++ ++ ENTER(); ++ ++ card = priv->uap_dev.card; ++ if (!card || !card->func) { ++ PRINTM(ERROR, "sbi_read_ioreg(): card or function is NULL!\n"); ++ goto done; ++ } ++ ++ *dat = sdio_readb(card->func, reg, &ret); ++ if (ret) { ++ PRINTM(ERROR, "sbi_read_ioreg(): sdio_readb failed! ret=%d\n", ret); ++ goto done; ++ } ++ ++ PRINTM(INFO, "sbi_read_ioreg() priv=%p func=%d reg=%#x dat=%#x\n", priv, ++ card->func->num, reg, *dat); ++ ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function writes the IO register. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param reg register to be written ++ * @param dat the value to be written ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++sbi_write_ioreg(uap_private * priv, u32 reg, u8 dat) ++{ ++ struct sdio_mmc_card *card; ++ int ret = UAP_STATUS_FAILURE; ++ ++ ENTER(); ++ ++ card = priv->uap_dev.card; ++ if (!card || !card->func) { ++ PRINTM(ERROR, "sbi_write_ioreg(): card or function is NULL!\n"); ++ goto done; ++ } ++ ++ PRINTM(INFO, "sbi_write_ioreg() priv=%p func=%d reg=%#x dat=%#x\n", priv, ++ card->func->num, reg, dat); ++ ++ sdio_writeb(card->func, dat, reg, &ret); ++ if (ret) { ++ PRINTM(ERROR, "sbi_write_ioreg(): sdio_readb failed! ret=%d\n", ret); ++ goto done; ++ } ++ ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function get rx_unit value ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++sd_get_rx_unit(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u8 reg; ++ ++ ENTER(); ++ ++ ret = sbi_read_ioreg(priv, CARD_RX_UNIT_REG, ®); ++ if (ret == UAP_STATUS_SUCCESS) ++ sdio_rx_unit = reg; ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function reads rx length ++ * ++ * @param priv A pointer to uap_private structure ++ * @param dat A pointer to keep returned data ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++sd_read_rx_len(uap_private * priv, u16 * dat) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u8 reg; ++ ++ ENTER(); ++ ++ ret = sbi_read_ioreg(priv, CARD_RX_LEN_REG, ®); ++ if (ret == UAP_STATUS_SUCCESS) ++ *dat = (u16) reg << sdio_rx_unit; ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function reads fw status registers ++ * ++ * @param priv A pointer to uap_private structure ++ * @param dat A pointer to keep returned data ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++sd_read_firmware_status(uap_private * priv, u16 * dat) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u8 fws0; ++ u8 fws1; ++ ++ ENTER(); ++ ++ ret = sbi_read_ioreg(priv, CARD_FW_STATUS0_REG, &fws0); ++ if (ret < 0) { ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ ++ ret = sbi_read_ioreg(priv, CARD_FW_STATUS1_REG, &fws1); ++ if (ret < 0) { ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ ++ *dat = (((u16) fws1) << 8) | fws0; ++ ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief This function polls the card status register. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param bits the bit mask ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++mv_sdio_poll_card_status(uap_private * priv, u8 bits) ++{ ++ int tries; ++ u8 cs; ++ ++ ENTER(); ++ ++ for (tries = 0; tries < MAX_POLL_TRIES; tries++) { ++ if (sbi_read_ioreg(priv, CARD_STATUS_REG, &cs) < 0) ++ break; ++ else if ((cs & bits) == bits) { ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++ } ++ udelay(10); ++ } ++ ++ PRINTM(WARN, "mv_sdio_poll_card_status failed, tries = %d\n", tries); ++ ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++} ++ ++/** ++ * @brief This function set the sdio bus width. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param mode 1--1 bit mode, 4--4 bit mode ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++#if 0 ++static int ++sdio_set_bus_width(uap_private * priv, u8 mode) ++{ ++ ENTER(); ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++#endif ++ ++/** ++ * @brief This function reads data from the card. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++sd_card_to_host(uap_private * priv) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u16 buf_len = 0; ++ int buf_block_len; ++ int blksz; ++ struct sk_buff *skb = NULL; ++ u16 type; ++ u8 *payload = NULL; ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "card or function is NULL!\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto exit; ++ } ++ ++ /* Read the length of data to be transferred */ ++ ret = sd_read_rx_len(priv, &buf_len); ++ if (ret < 0) { ++ PRINTM(ERROR, "card_to_host, read scratch reg failed\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto exit; ++ } ++ ++ /* Allocate buffer */ ++ blksz = SD_BLOCK_SIZE; ++ buf_block_len = (buf_len + blksz - 1) / blksz; ++ if (buf_len <= INTF_HEADER_LEN || (buf_block_len * blksz) > ALLOC_BUF_SIZE) { ++ PRINTM(ERROR, "card_to_host, invalid packet length: %d\n", buf_len); ++ ret = UAP_STATUS_FAILURE; ++ goto exit; ++ } ++#ifdef PXA3XX_DMA_ALIGN ++ skb = dev_alloc_skb(buf_block_len * blksz + PXA3XX_DMA_ALIGNMENT); ++#else ++ skb = dev_alloc_skb(buf_block_len * blksz); ++#endif ++ if (skb == NULL) { ++ PRINTM(WARN, "No free skb\n"); ++ goto exit; ++ } ++#ifdef PXA3XX_DMA_ALIGN ++ if ((u32) skb->data & (PXA3XX_DMA_ALIGNMENT - 1)) { ++ skb_put(skb, (u32) skb->data & (PXA3XX_DMA_ALIGNMENT - 1)); ++ skb_pull(skb, (u32) skb->data & (PXA3XX_DMA_ALIGNMENT - 1)); ++ } ++#endif /* PXA3XX_DMA_ALIGN */ ++ ++ payload = skb->tail; ++ ret = sdio_readsb(card->func, payload, priv->uap_dev.ioport, ++ buf_block_len * blksz); ++ if (ret < 0) { ++ PRINTM(ERROR, "card_to_host, read iomem failed: %d\n", ret); ++ ret = UAP_STATUS_FAILURE; ++ goto exit; ++ } ++ HEXDUMP("SDIO Blk Rd", payload, blksz * buf_block_len); ++ /* ++ * This is SDIO specific header ++ * u16 length, ++ * u16 type (MV_TYPE_DAT = 0, MV_TYPE_CMD = 1, MV_TYPE_EVENT = 3) ++ */ ++ buf_len = uap_le16_to_cpu(*(u16 *) & payload[0]); ++ type = uap_le16_to_cpu(*(u16 *) & payload[2]); ++ switch (type) { ++ case MV_TYPE_EVENT: ++ skb_put(skb, buf_len); ++ skb_pull(skb, INTF_HEADER_LEN); ++ uap_process_event(priv, skb->data, skb->len); ++ kfree_skb(skb); ++ skb = NULL; ++ break; ++ case MV_TYPE_CMD: ++ skb_put(skb, buf_len); ++ skb_pull(skb, INTF_HEADER_LEN); ++ priv->adapter->cmd_pending = FALSE; ++ if (priv->adapter->cmd_wait_option == ++ HostCmd_OPTION_WAITFORRSP_SLEEPCONFIRM) { ++ priv->adapter->cmd_wait_option = FALSE; ++ uap_process_sleep_confirm_resp(priv, skb->data, skb->len); ++ } else if (priv->adapter->cmd_wait_option) { ++ memcpy(priv->adapter->CmdBuf, skb->data, skb->len); ++ priv->adapter->CmdSize = skb->len; ++ priv->adapter->cmd_wait_option = FALSE; ++ priv->adapter->CmdWaitQWoken = TRUE; ++ wake_up_interruptible(&priv->adapter->cmdwait_q); ++ } ++ kfree_skb(skb); ++ skb = NULL; ++ break; ++ case MV_TYPE_DAT: ++ skb_put(skb, buf_len); ++ skb_pull(skb, INTF_HEADER_LEN); ++ uap_process_rx_packet(priv, skb); ++ break; ++ default: ++ priv->stats.rx_errors++; ++ priv->stats.rx_dropped++; ++ /* Driver specified event and command resp should be handle here */ ++ PRINTM(INFO, "Unknown PKT type:%d\n", type); ++ kfree_skb(skb); ++ skb = NULL; ++ break; ++ } ++ exit: ++ if (ret) { ++ if (skb) ++ kfree_skb(skb); ++ } ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function enables the host interrupts mask ++ * ++ * @param priv A pointer to uap_private structure ++ * @param mask the interrupt mask ++ * @return UAP_STATUS_SUCCESS ++ */ ++static int ++enable_host_int_mask(uap_private * priv, u8 mask) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ ++ ENTER(); ++ ++ /* Simply write the mask to the register */ ++ ret = sbi_write_ioreg(priv, HOST_INT_MASK_REG, mask); ++ ++ if (ret) { ++ PRINTM(WARN, "Unable to enable the host interrupt!\n"); ++ ret = UAP_STATUS_FAILURE; ++ } ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** @brief This function disables the host interrupts mask. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param mask the interrupt mask ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++disable_host_int_mask(uap_private * priv, u8 mask) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u8 host_int_mask; ++ ++ ENTER(); ++ ++ /* Read back the host_int_mask register */ ++ ret = sbi_read_ioreg(priv, HOST_INT_MASK_REG, &host_int_mask); ++ if (ret) { ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ ++ /* Update with the mask and write back to the register */ ++ host_int_mask &= ~mask; ++ ret = sbi_write_ioreg(priv, HOST_INT_MASK_REG, host_int_mask); ++ if (ret < 0) { ++ PRINTM(WARN, "Unable to diable the host interrupt!\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/******************************************************** ++ Global Functions ++********************************************************/ ++ ++/** ++ * @brief This function handles the interrupt. ++ * ++ * @param func A pointer to sdio_func structure. ++ * @return n/a ++ */ ++static void ++sbi_interrupt(struct sdio_func *func) ++{ ++ struct sdio_mmc_card *card; ++ uap_private *priv; ++ u8 ireg = 0; ++ int ret = UAP_STATUS_SUCCESS; ++ ++ ENTER(); ++ ++ card = sdio_get_drvdata(func); ++ if (!card || !card->priv) { ++ PRINTM(MSG, "%s: sbi_interrupt(%p) card or priv is NULL, card=%p\n", ++ __FUNCTION__, func, card); ++ LEAVE(); ++ return; ++ } ++ priv = card->priv; ++#ifdef FW_WAKEUP_TIME ++ if ((priv->adapter->wt_pwrup_sending != 0L) && ++ (priv->adapter->wt_int == 0L)) ++ priv->adapter->wt_int = get_utimeofday(); ++#endif ++ ++ ireg = sdio_readb(card->func, HOST_INTSTATUS_REG, &ret); ++ if (ret) { ++ PRINTM(WARN, "sdio_read_ioreg: read int status register failed\n"); ++ goto done; ++ } ++ if (ireg != 0) { ++ /* ++ * DN_LD_HOST_INT_STATUS and/or UP_LD_HOST_INT_STATUS ++ * Clear the interrupt status register and re-enable the interrupt ++ */ ++ PRINTM(INFO, "sdio_ireg = 0x%x\n", ireg); ++ sdio_writeb(card->func, ++ ~(ireg) & (DN_LD_HOST_INT_STATUS | UP_LD_HOST_INT_STATUS), ++ HOST_INTSTATUS_REG, &ret); ++ if (ret) { ++ PRINTM(WARN, ++ "sdio_write_ioreg: clear int status register failed\n"); ++ goto done; ++ } ++ } ++ OS_INT_DISABLE; ++ sd_ireg |= ireg; ++ OS_INT_RESTORE; ++ ++ uap_interrupt(priv); ++ done: ++ LEAVE(); ++} ++ ++/** ++ * @brief This function probe the card ++ * ++ * @param func A pointer to sdio_func structure ++ * @param id A pointer to structure sd_device_id ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++static int ++uap_probe(struct sdio_func *func, const struct sdio_device_id *id) ++{ ++ int ret = UAP_STATUS_FAILURE; ++ struct sdio_mmc_card *card = NULL; ++ ++ ENTER(); ++ ++ PRINTM(MSG, "%s: vendor=0x%4.04X device=0x%4.04X class=%d function=%d\n", ++ __FUNCTION__, func->vendor, func->device, func->class, func->num); ++ ++ card = kzalloc(sizeof(struct sdio_mmc_card), GFP_KERNEL); ++ if (!card) { ++ ret = -ENOMEM; ++ goto done; ++ } ++ ++ card->func = func; ++ ++ if (!uap_add_card(card)) { ++ PRINTM(ERROR, "%s: uap_add_callback failed\n", __FUNCTION__); ++ kfree(card); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ ++ ret = UAP_STATUS_SUCCESS; ++ ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function removes the card ++ * ++ * @param func A pointer to sdio_func structure ++ * @return N/A ++ */ ++static void ++uap_remove(struct sdio_func *func) ++{ ++ struct sdio_mmc_card *card; ++ ++ ENTER(); ++ ++ if (func) { ++ card = sdio_get_drvdata(func); ++ if (card) { ++ uap_remove_card(card); ++ kfree(card); ++ } ++ } ++ ++ LEAVE(); ++} ++ ++#ifdef CONFIG_PM ++/** ++ * @brief This function handles client driver suspend ++ * ++ * @param func A pointer to sdio_func structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++uap_suspend(struct sdio_func *func) ++{ ++ ENTER(); ++ LEAVE(); ++ return 0; ++} ++ ++/** ++ * @brief This function handles client driver resume ++ * ++ * @param func A pointer to sdio_func structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++uap_resume(struct sdio_func *func) ++{ ++ ENTER(); ++ LEAVE(); ++ return 0; ++} ++#endif ++ ++/** Device ID for SD8688 */ ++#define SD_DEVICE_ID_8688_UAP 0x9104 ++/** UAP IDs */ ++static const struct sdio_device_id uap_ids[] = { ++ {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SD_DEVICE_ID_8688_UAP)}, ++ {}, ++}; ++ ++MODULE_DEVICE_TABLE(sdio, uap_ids); ++ ++static struct sdio_driver uap_sdio = { ++ .name = "uap_sdio", ++ .id_table = uap_ids, ++ .probe = uap_probe, ++ .remove = uap_remove, ++#ifdef CONFIG_PM ++/* .suspend = uap_suspend, */ ++/* .resume = uap_resume, */ ++#endif ++ ++}; ++ ++/** ++ * @brief This function registers the IF module in bus driver. ++ * ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int __init ++sbi_register() ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ ++ ENTER(); ++ ++ /* SDIO Driver Registration */ ++ if (sdio_register_driver(&uap_sdio) != 0) { ++ PRINTM(FATAL, "SDIO Driver Registration Failed \n"); ++ ret = UAP_STATUS_FAILURE; ++ } ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function de-registers the IF module in bus driver. ++ * ++ * @return n/a ++ */ ++void __exit ++sbi_unregister(void) ++{ ++ ENTER(); ++ ++ /* SDIO Driver Unregistration */ ++ sdio_unregister_driver(&uap_sdio); ++ ++ LEAVE(); ++} ++ ++/** ++ * @brief This function checks the interrupt status and handle it accordingly. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param ireg A pointer to variable that keeps returned value ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_get_int_status(uap_private * priv, u8 * ireg) ++{ ++ int ret = UAP_STATUS_SUCCESS; ++ u8 sdio_ireg = 0; ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ ++ ENTER(); ++ ++ *ireg = 0; ++ OS_INT_DISABLE; ++ sdio_ireg = sd_ireg; ++ sd_ireg = 0; ++ OS_INT_RESTORE; ++ ++ sdio_claim_host(card->func); ++ ++ if (sdio_ireg & DN_LD_HOST_INT_STATUS) { /* tx_done INT */ ++ if (!priv->uap_dev.cmd_sent) { /* tx_done already received */ ++ PRINTM(INFO, ++ "warning: tx_done already received: tx_dnld_rdy=0x%x int status=0x%x\n", ++ priv->uap_dev.cmd_sent, sdio_ireg); ++ } else { ++ priv->uap_dev.cmd_sent = FALSE; ++ priv->uap_dev.data_sent = FALSE; ++ if ( (priv->uap_dev.netdev->reg_state == NETREG_REGISTERED) && (skb_queue_len(&priv->adapter->tx_queue) < TX_LOW_WATERMARK)) { ++ os_start_queue(priv); ++ } ++ } ++ } ++ if (sdio_ireg & UP_LD_HOST_INT_STATUS) { ++ sd_card_to_host(priv); ++ } ++ ++ *ireg = sdio_ireg; ++ ret = UAP_STATUS_SUCCESS; ++ sdio_release_host(card->func); ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function disables the host interrupts. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_disable_host_int(uap_private * priv) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ int ret; ++ ++ ENTER(); ++ ++ sdio_claim_host(card->func); ++ ret = disable_host_int_mask(priv, HIM_DISABLE); ++ sdio_release_host(card->func); ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function enables the host interrupts. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS ++ */ ++int ++sbi_enable_host_int(uap_private * priv) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ int ret; ++ ++ ENTER(); ++ ++ sdio_claim_host(card->func); ++ ret = enable_host_int_mask(priv, HIM_ENABLE); ++ sdio_release_host(card->func); ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function de-registers the device. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS ++ */ ++int ++sbi_unregister_dev(uap_private * priv) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "Error: card or function is NULL!\n"); ++ goto done; ++ } ++ ++ sdio_claim_host(card->func); ++ sdio_release_irq(card->func); ++ sdio_disable_func(card->func); ++ sdio_release_host(card->func); ++ ++ sdio_set_drvdata(card->func, NULL); ++ ++ done: ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++ ++/** ++ * @brief This function registers the device. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_register_dev(uap_private * priv) ++{ ++ int ret = UAP_STATUS_FAILURE; ++ u8 reg; ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ struct sdio_func *func; ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "Error: card or function is NULL!\n"); ++ goto done; ++ } ++ ++ func = card->func; ++ ++ /* Initialize the private structure */ ++ priv->uap_dev.ioport = 0; ++ ++ sdio_claim_host(func); ++ ++ ret = sdio_enable_func(func); ++ if (ret) { ++ PRINTM(FATAL, "sdio_enable_func() failed: ret=%d\n", ret); ++ goto release_host; ++ } ++ ++ ret = sdio_claim_irq(func, sbi_interrupt); ++ if (ret) { ++ PRINTM(FATAL, "sdio_claim_irq failed: ret=%d\n", ret); ++ goto disable_func; ++ } ++ ++ /* Read the IO port */ ++ ret = sbi_read_ioreg(priv, IO_PORT_0_REG, ®); ++ if (ret) ++ goto release_irq; ++ else ++ priv->uap_dev.ioport |= reg; ++ ++ ret = sbi_read_ioreg(priv, IO_PORT_1_REG, ®); ++ if (ret) ++ goto release_irq; ++ else ++ priv->uap_dev.ioport |= (reg << 8); ++ ++ ret = sbi_read_ioreg(priv, IO_PORT_2_REG, ®); ++ if (ret) ++ goto release_irq; ++ else ++ priv->uap_dev.ioport |= (reg << 16); ++ ++ PRINTM(INFO, "SDIO FUNC #%d IO port: 0x%x\n", func->num, ++ priv->uap_dev.ioport); ++ ++ ret = sdio_set_block_size(card->func, SD_BLOCK_SIZE); ++ if (ret) { ++ PRINTM(ERROR, "%s: cannot set SDIO block size\n", __FUNCTION__); ++ ret = UAP_STATUS_FAILURE; ++ goto release_irq; ++ } ++ priv->hotplug_device = &func->dev; ++ ++ if (helper_name == NULL) { ++ helper_name = DEFAULT_HELPER_NAME; ++ } ++ if (fw_name == NULL) { ++ fw_name = DEFAULT_FW_NAME; ++ } ++ sdio_release_host(func); ++ ++ sdio_set_drvdata(func, card); ++ ++ ret = UAP_STATUS_SUCCESS; ++ goto done; ++ ++ release_irq: ++ sdio_release_irq(func); ++ disable_func: ++ sdio_disable_func(func); ++ release_host: ++ sdio_release_host(func); ++ ++ done: ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function sends data to the card. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param payload A pointer to the data/cmd buffer ++ * @param nb the length of data/cmd ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_host_to_card(uap_private * priv, u8 * payload, u16 nb) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ int ret = UAP_STATUS_SUCCESS; ++ int buf_block_len; ++ int blksz; ++ int i = 0; ++ u8 *buf = NULL; ++#ifdef PXA3XX_DMA_ALIGN ++ void *tmpbuf = NULL; ++ int tmpbufsz; ++#endif ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "card or function is NULL!\n"); ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ buf = payload; ++#ifdef PXA3XX_DMA_ALIGN ++ if ((u32) payload & (PXA3XX_DMA_ALIGNMENT - 1)) { ++ tmpbufsz = ALIGN_SZ(nb, PXA3XX_DMA_ALIGNMENT); ++ tmpbuf = kmalloc(tmpbufsz, GFP_KERNEL); ++ memset(tmpbuf, 0, tmpbufsz); ++ /* Ensure 8-byte aligned CMD buffer */ ++ buf = (u8 *) ALIGN_ADDR(tmpbuf, PXA3XX_DMA_ALIGNMENT); ++ memcpy(buf, payload, nb); ++ } ++#endif ++ /* Allocate buffer and copy payload */ ++ blksz = SD_BLOCK_SIZE; ++ buf_block_len = (nb + blksz - 1) / blksz; ++ sdio_claim_host(card->func); ++#define MAX_WRITE_IOMEM_RETRY 2 ++ priv->uap_dev.cmd_sent = TRUE; ++ priv->uap_dev.data_sent = TRUE; ++ do { ++ /* Transfer data to card */ ++ ret = sdio_writesb(card->func, priv->uap_dev.ioport, buf, ++ buf_block_len * blksz); ++ if (ret < 0) { ++ i++; ++ PRINTM(ERROR, "host_to_card, write iomem (%d) failed: %d\n", i, ++ ret); ++ ret = UAP_STATUS_FAILURE; ++ if (i > MAX_WRITE_IOMEM_RETRY) ++ goto exit; ++ } else { ++ HEXDUMP("SDIO Blk Wr", payload, nb); ++ } ++ } while (ret == UAP_STATUS_FAILURE); ++ exit: ++ sdio_release_host(card->func); ++#ifdef PXA3XX_DMA_ALIGN ++ if (tmpbuf) ++ kfree(tmpbuf); ++#endif ++ if (ret == UAP_STATUS_FAILURE) { ++ priv->uap_dev.cmd_sent = FALSE; ++ priv->uap_dev.data_sent = FALSE; ++ } ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function reads CIS information. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param cisinfo A pointer to CIS information output buffer ++ * @param cislen A pointer to length of CIS info output buffer ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++#if 0 ++static int ++sbi_get_cis_info(uap_private * priv, void *cisinfo, int *cislen) ++{ ++#define CIS_PTR (0x8000) ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ unsigned int i, cis_ptr = CIS_PTR; ++ int ret = UAP_STATUS_FAILURE; ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "sbi_get_cis_info(): card or function is NULL!\n"); ++ goto exit; ++ } ++#define MAX_SDIO_CIS_INFO_LEN (256) ++ if (!cisinfo || (*cislen < MAX_SDIO_CIS_INFO_LEN)) { ++ PRINTM(WARN, "ERROR! get_cis_info: insufficient buffer passed\n"); ++ goto exit; ++ } ++ ++ *cislen = MAX_SDIO_CIS_INFO_LEN; ++ ++ sdio_claim_host(card->func); ++ ++ PRINTM(INFO, "cis_ptr=%#x\n", cis_ptr); ++ ++ /* Read the Tuple Data */ ++ for (i = 0; i < *cislen; i++) { ++ ((unsigned char *) cisinfo)[i] = ++ sdio_readb(card->func, cis_ptr + i, &ret); ++ if (ret) { ++ PRINTM(WARN, "get_cis_info error: ret=%d\n", ret); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ PRINTM(INFO, "cisinfo[%d]=%#x\n", i, ((unsigned char *) cisinfo)[i]); ++ } ++ ++ done: ++ sdio_release_host(card->func); ++ exit: ++ LEAVE(); ++ return ret; ++} ++#endif ++/** ++ * @brief This function downloads helper image to the card. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_prog_helper(uap_private * priv) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ u8 *helper = NULL; ++ int helperlen; ++ int ret = UAP_STATUS_SUCCESS; ++ void *tmphlprbuf = NULL; ++ int tmphlprbufsz; ++ u8 *hlprbuf; ++ int hlprblknow; ++ u32 tx_len; ++#ifdef FW_DOWNLOAD_SPEED ++ u32 tv1, tv2; ++#endif ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "sbi_prog_helper(): card or function is NULL!\n"); ++ goto done; ++ } ++ ++ if (priv->fw_helper) { ++ helper = (u8 *) priv->fw_helper->data; ++ helperlen = priv->fw_helper->size; ++ } else { ++ PRINTM(MSG, "No helper image found! Terminating download.\n"); ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ ++ PRINTM(INFO, "Downloading helper image (%d bytes), block size %d bytes\n", ++ helperlen, SD_BLOCK_SIZE); ++ ++#ifdef FW_DOWNLOAD_SPEED ++ tv1 = get_utimeofday(); ++#endif ++ ++#ifdef PXA3XX_DMA_ALIGN ++ tmphlprbufsz = ALIGN_SZ(UAP_UPLD_SIZE, PXA3XX_DMA_ALIGNMENT); ++#else /* !PXA3XX_DMA_ALIGN */ ++ tmphlprbufsz = UAP_UPLD_SIZE; ++#endif /* !PXA3XX_DMA_ALIGN */ ++ tmphlprbuf = kmalloc(tmphlprbufsz, GFP_KERNEL); ++ if (!tmphlprbuf) { ++ PRINTM(ERROR, ++ "Unable to allocate buffer for helper. Terminating download\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ memset(tmphlprbuf, 0, tmphlprbufsz); ++#ifdef PXA3XX_DMA_ALIGN ++ hlprbuf = (u8 *) ALIGN_ADDR(tmphlprbuf, PXA3XX_DMA_ALIGNMENT); ++#else /* !PXA3XX_DMA_ALIGN */ ++ hlprbuf = (u8 *) tmphlprbuf; ++#endif /* !PXA3XX_DMA_ALIGN */ ++ ++ sdio_claim_host(card->func); ++ ++ /* Perform helper data transfer */ ++ tx_len = (FIRMWARE_TRANSFER_NBLOCK * SD_BLOCK_SIZE) - INTF_HEADER_LEN; ++ hlprblknow = 0; ++ do { ++ /* The host polls for the DN_LD_CARD_RDY and CARD_IO_READY bits */ ++ ret = mv_sdio_poll_card_status(priv, CARD_IO_READY | DN_LD_CARD_RDY); ++ if (ret < 0) { ++ PRINTM(FATAL, "Helper download poll status timeout @ %d\n", ++ hlprblknow); ++ goto done; ++ } ++ ++ /* More data? */ ++ if (hlprblknow >= helperlen) ++ break; ++ ++ /* Set blocksize to transfer - checking for last block */ ++ if (helperlen - hlprblknow < tx_len) ++ tx_len = helperlen - hlprblknow; ++ ++ /* Set length to the 4-byte header */ ++ *(u32 *) hlprbuf = uap_cpu_to_le32(tx_len); ++ ++ /* Copy payload to buffer */ ++ memcpy(&hlprbuf[INTF_HEADER_LEN], &helper[hlprblknow], tx_len); ++ ++ PRINTM(INFO, "."); ++ ++ /* Send data */ ++ ret = sdio_writesb(card->func, priv->uap_dev.ioport, ++ hlprbuf, FIRMWARE_TRANSFER_NBLOCK * SD_BLOCK_SIZE); ++ ++ if (ret < 0) { ++ PRINTM(FATAL, "IO error during helper download @ %d\n", hlprblknow); ++ goto done; ++ } ++ ++ hlprblknow += tx_len; ++ } while (TRUE); ++ ++#ifdef FW_DOWNLOAD_SPEED ++ tv2 = get_utimeofday(); ++ PRINTM(INFO, "helper: %ld.%03ld.%03ld ", tv1 / 1000000, ++ (tv1 % 1000000) / 1000, tv1 % 1000); ++ PRINTM(INFO, " -> %ld.%03ld.%03ld ", tv2 / 1000000, (tv2 % 1000000) / 1000, ++ tv2 % 1000); ++ tv2 -= tv1; ++ PRINTM(INFO, " == %ld.%03ld.%03ld\n", tv2 / 1000000, (tv2 % 1000000) / 1000, ++ tv2 % 1000); ++#endif ++ ++ /* Write last EOF data */ ++ PRINTM(INFO, "\nTransferring helper image EOF block\n"); ++ memset(hlprbuf, 0x0, SD_BLOCK_SIZE); ++ ret = sdio_writesb(card->func, priv->uap_dev.ioport, ++ hlprbuf, SD_BLOCK_SIZE); ++ ++ if (ret < 0) { ++ PRINTM(FATAL, "IO error in writing helper image EOF block\n"); ++ goto done; ++ } ++ ++ ret = UAP_STATUS_SUCCESS; ++ ++ done: ++ sdio_release_host(card->func); ++ if (tmphlprbuf) ++ kfree(tmphlprbuf); ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function downloads firmware image to the card. ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_prog_fw_w_helper(uap_private * priv) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ u8 *firmware = NULL; ++ int firmwarelen; ++ u8 base0; ++ u8 base1; ++ int ret = UAP_STATUS_SUCCESS; ++ int offset; ++ void *tmpfwbuf = NULL; ++ int tmpfwbufsz; ++ u8 *fwbuf; ++ u16 len; ++ int txlen = 0; ++ int tx_blocks = 0; ++ int i = 0; ++ int tries = 0; ++#ifdef FW_DOWNLOAD_SPEED ++ u32 tv1, tv2; ++#endif ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "sbi_prog_fw_w_helper(): card or function is NULL!\n"); ++ goto done; ++ } ++ ++ if (priv->firmware) { ++ firmware = (u8 *) priv->firmware->data; ++ firmwarelen = priv->firmware->size; ++ } else { ++ PRINTM(MSG, "No firmware image found! Terminating download.\n"); ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ ++ PRINTM(INFO, "Downloading FW image (%d bytes)\n", firmwarelen); ++ ++#ifdef FW_DOWNLOAD_SPEED ++ tv1 = get_utimeofday(); ++#endif ++ ++#ifdef PXA3XX_DMA_ALIGN ++ tmpfwbufsz = ALIGN_SZ(UAP_UPLD_SIZE, PXA3XX_DMA_ALIGNMENT); ++#else /* PXA3XX_DMA_ALIGN */ ++ tmpfwbufsz = UAP_UPLD_SIZE; ++#endif /* PXA3XX_DMA_ALIGN */ ++ tmpfwbuf = kmalloc(tmpfwbufsz, GFP_KERNEL); ++ if (!tmpfwbuf) { ++ PRINTM(ERROR, ++ "Unable to allocate buffer for firmware. Terminating download.\n"); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ memset(tmpfwbuf, 0, tmpfwbufsz); ++#ifdef PXA3XX_DMA_ALIGN ++ /* Ensure 8-byte aligned firmware buffer */ ++ fwbuf = (u8 *) ALIGN_ADDR(tmpfwbuf, PXA3XX_DMA_ALIGNMENT); ++#else /* PXA3XX_DMA_ALIGN */ ++ fwbuf = (u8 *) tmpfwbuf; ++#endif /* PXA3XX_DMA_ALIGN */ ++ ++ sdio_claim_host(card->func); ++ ++ /* Perform firmware data transfer */ ++ offset = 0; ++ do { ++ /* The host polls for the DN_LD_CARD_RDY and CARD_IO_READY bits */ ++ ret = mv_sdio_poll_card_status(priv, CARD_IO_READY | DN_LD_CARD_RDY); ++ if (ret < 0) { ++ PRINTM(FATAL, "FW download with helper poll status timeout @ %d\n", ++ offset); ++ goto done; ++ } ++ ++ /* More data? */ ++ if (offset >= firmwarelen) ++ break; ++ ++ for (tries = 0; tries < MAX_POLL_TRIES; tries++) { ++ if ((ret = sbi_read_ioreg(priv, HOST_F1_RD_BASE_0, &base0)) < 0) { ++ PRINTM(WARN, "Dev BASE0 register read failed:" ++ " base0=0x%04X(%d). Terminating download.\n", base0, ++ base0); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ if ((ret = sbi_read_ioreg(priv, HOST_F1_RD_BASE_1, &base1)) < 0) { ++ PRINTM(WARN, "Dev BASE1 register read failed:" ++ " base1=0x%04X(%d). Terminating download.\n", base1, ++ base1); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ len = (((u16) base1) << 8) | base0; ++ ++ /* For SD8688 wait until the length is not 0, 1 or 2 before ++ downloading the first FW block, since BOOT code writes the ++ register to indicate the helper/FW download winner, the value ++ could be 1 or 2 (Func1 or Func2). */ ++ if ((len && offset) || (len > 2)) ++ break; ++ udelay(10); ++ } ++ ++ if (len == 0) ++ break; ++ else if (len > UAP_UPLD_SIZE) { ++ PRINTM(FATAL, "FW download failure @ %d, invalid length %d\n", ++ offset, len); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ ++ txlen = len; ++ ++ if (len & BIT(0)) { ++ i++; ++ if (i > MAX_WRITE_IOMEM_RETRY) { ++ PRINTM(FATAL, ++ "FW download failure @ %d, over max retry count\n", ++ offset); ++ ret = UAP_STATUS_FAILURE; ++ goto done; ++ } ++ PRINTM(ERROR, "FW CRC error indicated by the helper:" ++ " len = 0x%04X, txlen = %d\n", len, txlen); ++ len &= ~BIT(0); ++ /* Setting this to 0 to resend from same offset */ ++ txlen = 0; ++ } else { ++ i = 0; ++ ++ /* Set blocksize to transfer - checking for last block */ ++ if (firmwarelen - offset < txlen) { ++ txlen = firmwarelen - offset; ++ } ++ PRINTM(INFO, "."); ++ ++ tx_blocks = (txlen + SD_BLOCK_SIZE - 1) / SD_BLOCK_SIZE; ++ ++ /* Copy payload to buffer */ ++ memcpy(fwbuf, &firmware[offset], txlen); ++ } ++ ++ /* Send data */ ++ ret = sdio_writesb(card->func, priv->uap_dev.ioport, ++ fwbuf, tx_blocks * SD_BLOCK_SIZE); ++ ++ if (ret < 0) { ++ PRINTM(ERROR, "FW download, write iomem (%d) failed @ %d\n", i, ++ offset); ++ if (sbi_write_ioreg(priv, CONFIGURATION_REG, 0x04) < 0) { ++ PRINTM(ERROR, "write ioreg failed (CFG)\n"); ++ } ++ } ++ ++ offset += txlen; ++ } while (TRUE); ++ ++ PRINTM(INFO, "\nFW download over, size %d bytes\n", offset); ++ ++ ret = UAP_STATUS_SUCCESS; ++ done: ++#ifdef FW_DOWNLOAD_SPEED ++ tv2 = get_utimeofday(); ++ PRINTM(INFO, "FW: %ld.%03ld.%03ld ", tv1 / 1000000, ++ (tv1 % 1000000) / 1000, tv1 % 1000); ++ PRINTM(INFO, " -> %ld.%03ld.%03ld ", tv2 / 1000000, ++ (tv2 % 1000000) / 1000, tv2 % 1000); ++ tv2 -= tv1; ++ PRINTM(INFO, " == %ld.%03ld.%03ld\n", tv2 / 1000000, ++ (tv2 % 1000000) / 1000, tv2 % 1000); ++#endif ++ sdio_release_host(card->func); ++ if (tmpfwbuf) ++ kfree(tmpfwbuf); ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function checks if the firmware is ready to accept ++ * command or not. ++ * ++ * @param priv A pointer to uap_private structure ++ * @param pollnum Poll number ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_check_fw_status(uap_private * priv, int pollnum) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ int ret = UAP_STATUS_SUCCESS; ++ u16 firmwarestat; ++ int tries; ++ ++ ENTER(); ++ ++ sdio_claim_host(card->func); ++ ++ /* Wait for firmware initialization event */ ++ for (tries = 0; tries < pollnum; tries++) { ++ if ((ret = sd_read_firmware_status(priv, &firmwarestat)) < 0) ++ continue; ++ if (firmwarestat == FIRMWARE_READY) { ++ ret = UAP_STATUS_SUCCESS; ++ break; ++ } else { ++ mdelay(10); ++ ret = UAP_STATUS_FAILURE; ++ } ++ } ++ ++ if (ret < 0) ++ goto done; ++ ++ ret = UAP_STATUS_SUCCESS; ++ sd_get_rx_unit(priv); ++ ++ done: ++ sdio_release_host(card->func); ++ ++ LEAVE(); ++ return ret; ++} ++ ++/** ++ * @brief This function set bus clock on/off ++ * ++ * @param priv A pointer to uap_private structure ++ * @param option TRUE--on , FALSE--off ++ * @return UAP_STATUS_SUCCESS ++ */ ++#if 0 ++static int ++sbi_set_bus_clock(uap_private * priv, u8 option) ++{ ++ ENTER(); ++ LEAVE(); ++ return UAP_STATUS_SUCCESS; ++} ++#endif ++ ++/** ++ * @brief This function wakeup firmware ++ * ++ * @param priv A pointer to uap_private structure ++ * @return UAP_STATUS_SUCCESS or UAP_STATUS_FAILURE ++ */ ++int ++sbi_wakeup_firmware(uap_private * priv) ++{ ++ struct sdio_mmc_card *card = priv->uap_dev.card; ++ int ret = UAP_STATUS_SUCCESS; ++ ++ ENTER(); ++ ++ if (!card || !card->func) { ++ PRINTM(ERROR, "card or function is NULL!\n"); ++ LEAVE(); ++ return UAP_STATUS_FAILURE; ++ } ++ sdio_claim_host(card->func); ++ sdio_writeb(card->func, HOST_POWER_UP, CONFIGURATION_REG, &ret); ++ sdio_release_host(card->func); ++ LEAVE(); ++ return ret; ++} +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_sdio_mmc.h backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_sdio_mmc.h +--- backports-3.18.1-1.org/drivers/net/wireless/libertas_uap/uap_sdio_mmc.h 1970-01-01 01:00:00.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/libertas_uap/uap_sdio_mmc.h 2014-12-29 20:37:43.955764567 +0100 +@@ -0,0 +1,136 @@ ++/** @file uap_sdio_mmc.h ++ * @brief This file contains SDIO IF (interface) module ++ * related macros, enum, and structure. ++ * ++ * Copyright (C) 2007-2009, Marvell International Ltd. ++ * ++ * This software file (the "File") is distributed by Marvell International ++ * Ltd. under the terms of the GNU General Public License Version 2, June 1991 ++ * (the "License"). You may use, redistribute and/or modify this File in ++ * accordance with the terms and conditions of the License, a copy of which ++ * is available along with the File in the gpl.txt file or by writing to ++ * the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA ++ * 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt. ++ * ++ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE ++ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ++ * ARE EXPRESSLY DISCLAIMED. The License provides additional details about ++ * this warranty disclaimer. ++ * ++ */ ++/**************************************************** ++Change log: ++ 10/10/07: initial version ++****************************************************/ ++ ++#ifndef _UAP_SDIO_MMC_H ++#define _UAP_SDIO_MMC_H ++ ++#include <linux/mmc/sdio.h> ++#include <linux/mmc/sdio_ids.h> ++#include <linux/mmc/sdio_func.h> ++#include <linux/mmc/card.h> ++ ++#include "uap_headers.h" ++ ++/** The number of times to try when waiting for downloaded firmware to ++ become active. (polling the scratch register). */ ++#define MAX_FIRMWARE_POLL_TRIES 100 ++ ++/** Firmware ready */ ++#define FIRMWARE_READY 0xfedc ++ ++/** Number of firmware blocks to transfer */ ++#define FIRMWARE_TRANSFER_NBLOCK 2 ++ ++/* Host Control Registers */ ++/** Host Control Registers : I/O port 0 */ ++#define IO_PORT_0_REG 0x00 ++/** Host Control Registers : I/O port 1 */ ++#define IO_PORT_1_REG 0x01 ++/** Host Control Registers : I/O port 2 */ ++#define IO_PORT_2_REG 0x02 ++ ++/** Host Control Registers : Configuration */ ++#define CONFIGURATION_REG 0x03 ++/** Host Control Registers : Host without Command 53 finish host */ ++#define HOST_WO_CMD53_FINISH_HOST (0x1U << 2) ++/** Host Control Registers : Host power up */ ++#define HOST_POWER_UP (0x1U << 1) ++/** Host Control Registers : Host power down */ ++#define HOST_POWER_DOWN (0x1U << 0) ++ ++/** Host Control Registers : Host interrupt mask */ ++#define HOST_INT_MASK_REG 0x04 ++/** Host Control Registers : Upload host interrupt mask */ ++#define UP_LD_HOST_INT_MASK (0x1U) ++/** Host Control Registers : Download host interrupt mask */ ++#define DN_LD_HOST_INT_MASK (0x2U) ++/** Enable Host interrupt mask */ ++#define HIM_ENABLE (UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK) ++/** Disable Host interrupt mask */ ++#define HIM_DISABLE 0xff ++ ++/** Host Control Registers : Host interrupt status */ ++#define HOST_INTSTATUS_REG 0x05 ++/** Host Control Registers : Upload host interrupt status */ ++#define UP_LD_HOST_INT_STATUS (0x1U) ++/** Host Control Registers : Download host interrupt status */ ++#define DN_LD_HOST_INT_STATUS (0x2U) ++ ++/** Host F1 read base 0 */ ++#define HOST_F1_RD_BASE_0 0x10 ++/** Host F1 read base 1 */ ++#define HOST_F1_RD_BASE_1 0x11 ++ ++/** Card Control Registers : Card status register */ ++#define CARD_STATUS_REG 0x20 ++/** Card Control Registers : Card I/O ready */ ++#define CARD_IO_READY (0x1U << 3) ++/** Card Control Registers : CIS card ready */ ++#define CIS_CARD_RDY (0x1U << 2) ++/** Card Control Registers : Upload card ready */ ++#define UP_LD_CARD_RDY (0x1U << 1) ++/** Card Control Registers : Download card ready */ ++#define DN_LD_CARD_RDY (0x1U << 0) ++ ++/** Card Control Registers : Card OCR 0 register */ ++#define CARD_OCR_0_REG 0x34 ++/** Card Control Registers : Card OCR 1 register */ ++#define CARD_OCR_1_REG 0x35 ++ ++/** Firmware status 0 register */ ++#define CARD_FW_STATUS0_REG 0x40 ++/** Firmware status 1 register */ ++#define CARD_FW_STATUS1_REG 0x41 ++/** Rx length register */ ++#define CARD_RX_LEN_REG 0x42 ++/** Rx unit register */ ++#define CARD_RX_UNIT_REG 0x43 ++ ++/** Chip Id Register 0 */ ++#define CARD_CHIP_ID_0_REG 0x801c ++/** Chip Id Register 1 */ ++#define CARD_CHIP_ID_1_REG 0x801d ++ ++#ifdef PXA3XX_DMA_ALIGN ++/** DMA alignment value for PXA3XX platforms */ ++#define PXA3XX_DMA_ALIGNMENT 8 ++/** Macros for Data Alignment : size */ ++#define ALIGN_SZ(p, a) \ ++ (((p) + ((a) - 1)) & ~((a) - 1)) ++ ++/** Macros for Data Alignment : address */ ++#define ALIGN_ADDR(p, a) \ ++ ((((u32)(p)) + (((u32)(a)) - 1)) & ~(((u32)(a)) - 1)) ++#endif /* PXA3XX_DMA_ALIGN */ ++ ++struct sdio_mmc_card ++{ ++ /** sdio_func structure pointer */ ++ struct sdio_func *func; ++ /** uap_private structure pointer */ ++ uap_private *priv; ++}; ++ ++#endif /* _UAP_SDIO_MMC_H */ +diff -Naur backports-3.18.1-1.org/drivers/net/wireless/Makefile backports-3.18.1-1/drivers/net/wireless/Makefile +--- backports-3.18.1-1.org/drivers/net/wireless/Makefile 2014-12-21 22:37:15.000000000 +0100 ++++ backports-3.18.1-1/drivers/net/wireless/Makefile 2014-12-29 20:40:33.632440784 +0100 +@@ -60,3 +60,5 @@ + + obj-$(CPTCFG_CW1200) += cw1200/ + obj-$(CPTCFG_RSI_91X) += rsi/ ++ ++obj-$(CPTCFG_LIBERTAS_UAP) += libertas_uap/
hooks/post-receive -- IPFire 2.x development tree