Stanislaw Gruszka [Tue, 19 Mar 2019 10:37:36 +0000 (11:37 +0100)]
mt76x02: introduce mt76x02_beacon.c
Move most of beaconing code into separate file and separate beacon
initialization for USB and MMIO as pre TBTT implementation for USB
will be different.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Mon, 4 Mar 2019 12:59:49 +0000 (13:59 +0100)]
mt76: usb: reduce code indentation in mt76u_alloc_tx
Improve code readability reducing code indentation in
mt76u_alloc_tx
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 16 Mar 2019 15:45:36 +0000 (16:45 +0100)]
mt7603: core: do not use magic numbers in mt7603_reg_map
Use register definitions instead of magic numbers in mt7603_reg_map
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 16 Mar 2019 14:32:53 +0000 (15:32 +0100)]
mt7603: remove mt7603_mcu_init routine
Remove mt7603_mcu_init since mcu.mutex has been already initialized
in mt76_mmio_init. Run mt7603_load_firmware directly in
mt7603_init_hardware
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 7 Mar 2019 14:45:43 +0000 (15:45 +0100)]
mt76: dma: add static qualifier to mt76_dma_tx_queue_skb
As already done for mt76_dma_tx_queue_skb_raw, add static qualifier to
mt76_dma_tx_queue_skb and introduce mt76_tx_queue_skb in order to run
mt76_dma_tx_queue_skb in driver code
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 14 Mar 2019 13:54:12 +0000 (14:54 +0100)]
mt76: introduce mt76_tx_info data structure
Add mt76_tx_info as auxiliary data structure to pass values
to tx_prepare_skb pointer. This is a preliminary patch to add
support for new chipsets (e.g. mt7615)
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 14 Mar 2019 13:54:11 +0000 (14:54 +0100)]
mt76: move skb dma mapping before running tx_prepare_skb
Move skb dma mapping before configuring txwi since new chipsets (mt7615)
will need skb dma addresses in order to properly configure txwi
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 14 Mar 2019 13:54:10 +0000 (14:54 +0100)]
mt76: mmio: move mt76_insert_hdr_pad in mt76_dma_tx_queue_skb
Introduce tx_aligned4_skbs in mt76_driver_ops and move
mt76_insert_hdr_pad in mt76_dma_tx_queue_skb. This is a preliminary
patch in order to unify tx dma mapping for mt76x02 and new chipsets
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 14 Mar 2019 13:54:09 +0000 (14:54 +0100)]
mt76: move mt76x02_insert_hdr_pad in mt76-core module
Move mt76x02_insert_hdr_pad in m76-core and rename it in
mt76_insert_hdr_pad in order to be used in mt76_dma_tx_queue_skb.
This is a preliminary patch in order to properly support tx dma
mapping for new chipsets (e.g. mt7615)
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 2 Mar 2019 13:47:42 +0000 (14:47 +0100)]
mt76: introduce mt76_txq_id field in mt76_queue_entry
Add mt76_txq_id field to mt76_queue_entry in order to properly
track outstanding frames for mt7615 that relies on a single hw queue
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 2 Mar 2019 13:47:41 +0000 (14:47 +0100)]
mt76: introduce mt76_sw_queue data structure
Introduce mt76_sw_queue data structure in order to support new
chipsets (e.g. mt7615) that have a shared hardware queue for all traffic
identifiers. mt76_sw_queue will be used to track outstanding packets
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 2 Mar 2019 13:47:40 +0000 (14:47 +0100)]
mt76: remove mt76_queue dependency from tx_complete_skb function pointer
Remove mt76_queue dependency from tx_complete_skb function pointer and
rely on mt76_tx_qid instead. Remove flush from tx_complete_skb
signature. This is a preliminary patch to introduce mt76_sw_queue
support
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 2 Mar 2019 13:47:39 +0000 (14:47 +0100)]
mt76: remove mt76_queue dependency from tx_prepare_skb function pointer
Remove mt76_queue dependency from tx_prepare_skb function pointer and
rely on mt76_tx_qid instead. This is a preliminary patch to introduce
mt76_sw_queue support
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 2 Mar 2019 13:47:38 +0000 (14:47 +0100)]
mt76: remove mt76_queue dependency from tx_queue_skb function pointer
Remove mt76_queue dependency from tx_queue_skb function pointer and
rely on mt76_tx_qid instead. This is a preliminary patch to introduce
mt76_sw_queue support
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 28 Feb 2019 16:54:32 +0000 (17:54 +0100)]
mt76: dma: move mt76x02_init_{tx,rx}_queue in mt76 module
Move mt76x02_init_tx_queue and mt76x02_init_rx_queue in mt76
module in order to be reused adding support for mt7603 driver
and remove duplicated code.
Squash mt76x02_init_tx_queue and mt76x02_init_rx_queue in
mt76_dma_alloc_queue
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 28 Feb 2019 16:54:31 +0000 (17:54 +0100)]
mt76: mmio: move mt76x02_set_irq_mask in mt76 module
Move mt76x02_set_irq_mask in mt76 module in order to be reused
adding support for mt7603 driver and remove duplicated code
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Yan-Hsuan Chuang [Fri, 26 Apr 2019 12:17:37 +0000 (15:17 +0300)]
rtw88: new Realtek 802.11ac driver
This is a new mac80211 driver for Realtek 802.11ac wireless network chips.
rtw88 now supports RTL8822BE/RTL8822CE now, with basic station mode
functionalities. The firmware for both can be found at linux-firmware.
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
For RTL8822BE: rtw88/rtw8822b_fw.bin
For RTL8822CE: rtw88/rtw8822c_fw.bin
And for now, only PCI buses (RTL8xxxE) are supported. We will add support
for USB and SDIO in the future. The bus interface abstraction can be seen
in this driver such as hci.h. Most of the hardware setting are the same
except for some TRX path or probing setup should be separated.
Supported:
* Basic STA/AP/ADHOC mode, and TDLS (STA is well tested)
Missing feature:
* WOW/PNO
* USB & SDIO bus (such as RTL8xxxU/RTL8xxxS)
* BT coexistence (8822B/8822C are combo ICs)
* Multiple interfaces (for now single STA is better supported)
* Dynamic hardware calibrations (to improve/stabilize performance)
Potential problems:
* static calibration spends too much time, and it is painful for
driver to leave IDLE state. And slows down associate process.
But reload function are under development, will be added soon!
* TRX statictics misleading, as we are not reporting status correctly,
or say, not reporting for "every" packet.
The next patch set should have BT coexistence code since RTL8822B/C are
combo ICs, and the driver for BT can be found after Linux Kernel v4.20.
So it is better to add it first to make WiFi + BT work concurrently.
Although now rtw88 is simple but we are developing more features for it.
Even we want to add support for more chips such as RTL8821C/RTL8814B.
Finally, rtw88 has many authors, listed alphabetically:
Ping-Ke Shih <pkshih@realtek.com>
Tzu-En Huang <tehuang@realtek.com>
Yan-Hsuan Chuang <yhchuang@realtek.com>
Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Kalle Valo [Mon, 29 Apr 2019 17:50:44 +0000 (20:50 +0300)]
Merge tag 'iwlwifi-next-for-kalle-2019-04-29' of git://git./linux/kernel/git/iwlwifi/iwlwifi-next
Fourth batch of patches intended for v5.2
* Fix a bug we introduced in the RX path in a previous patch;
* Add command version parsing from the FW TLVs;
* Some fixes and improvements in the new debugging framework;
* Bump the FW API supported for 22000 series;
* Small improvement in FTM;
* Some RF-Kill interrupt handling fixes;
* Support for a new WoWLAN patterns FW API;
* Other small fixes and improvements;
Shahar S Matityahu [Sun, 7 Apr 2019 07:46:08 +0000 (10:46 +0300)]
iwlwifi: dbg_ini: check for valid region type during regions parsing
Add region type checking during regions parsing to avoid attempts to
parse unsupported or illegal region types.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Mon, 8 Apr 2019 13:59:53 +0000 (16:59 +0300)]
iwlwifi: avoid allocating memory for region with disabled domain
In iwl_fw_ini_get_trigger_len the driver allocates space for memory
regions regardless of their domain and in iwl_fw_ini_dump_trigger the
driver aborts trigger collection of disabled domain. This diff causes
unneeded memory allocation and traling zeros in the dump file.
Solve this behavior by enforcing domain checking in
iwl_fw_ini_get_trigger_len
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Thu, 4 Apr 2019 11:31:30 +0000 (14:31 +0300)]
iwlwifi: dbg: replace dump info device family with HW type
In the dump info, the driver sets device_family to
IWL_FW_ERROR_DUMP_FAMILY_7 in case IWL_FW_ERROR_DUMP_FAMILY_7 is used or
IWL_FW_ERROR_DUMP_FAMILY_8 otherwise. This information is misleading and
incorrect since the driver sets the device family to 8 to any device that
is from family 8 and later, e.g. device family 9 is represented as 8 in
the dump.
Also, the device family enum is known only to the driver and
does not give any information to the FW developer
Change the device family to HW type to give propper data about the nic
in use.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Tue, 19 Mar 2019 14:40:15 +0000 (16:40 +0200)]
iwlwifi: dbg_ini: add periodic trigger support
Allows to configure a periodic data collection
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Sun, 7 Apr 2019 07:41:20 +0000 (10:41 +0300)]
iwlwifi: dbg_ini: add lmac and umac error tables dumping support
Add LMAC_ERROR_TABLE and UMAC_ERROR_TABLE region types and handle them
in the same way as we handle DEVICE_MEMORY.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Johannes Berg [Mon, 1 Apr 2019 08:57:32 +0000 (10:57 +0200)]
iwlwifi: parse command version TLV
In newer firmware images there's a command version TLV that
states, for each listed command or notification, which version
of the command and/or notification structure is used. Read and
keep this data to be able to use it in the future.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Luca Coelho [Wed, 10 Apr 2019 07:15:02 +0000 (10:15 +0300)]
iwlwifi: pcie: remove stray character in iwl_pcie_rx_alloc_page()
We have a solitary and inconspicous ` in the middle of a comment in
this function, which should not be there. Remove it.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Andrei Otcheretianski [Wed, 10 Apr 2019 12:31:28 +0000 (15:31 +0300)]
iwlwifi: mvm: Don't sleep in RX path
Don't use cancel_delayed_work_sync() inside the channel switch
notifications as they are handled synchronously as part of the RX path.
Fix that by replacing it with cancel_delayed_work(). This should be safe
as we don't really care whether the work is already started and in such
case we would disconnect anyway.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Luca Coelho [Thu, 10 Jan 2019 15:13:12 +0000 (17:13 +0200)]
iwlwifi: bump FW API to 48 for 22000 series
Start supporting API version 48 for 22000 series.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Liad Kaufman [Tue, 26 Mar 2019 16:11:19 +0000 (18:11 +0200)]
iwlwifi: mvm: limit TLC according to our HE capabilities
Instead of setting the TLC config command according to the
rates the peer supports, make sure that we aren't also
limited by our own rates, so take the minimum between the
peer's supported RX rates and our supported TX rates.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Wed, 20 Mar 2019 07:20:58 +0000 (09:20 +0200)]
iwlwifi: support fseq tlv and print fseq version
Support fseq tlv and print fseq version to dmesg.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Avraham Stern [Tue, 12 Mar 2019 09:48:56 +0000 (11:48 +0200)]
iwlwifi: mvm: report FTM start time TSF when applicable
When the interface that is requesting an FTM measurement is connected
to a BSS, it is possible that the FTM request was originated by an
RRM request from the AP. In this case the station needs to report
the measurement start time in terms of the TSF of the AP.
Since there is no indication in the FTM request itself if the TSF
is needed, always report the TSF if the station is associated.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Luca Coelho [Tue, 12 Mar 2019 14:01:24 +0000 (16:01 +0200)]
iwlwifi: mvm: support v2 of the WoWLAN patterns command
Add new definitions for the WoWLAN patterns API version 2 and support
for version 2 of the WoWLAN patterns command without implementing the
new features. With this commit we only supporting the existing
bitmask pattern match. Use the new version only if the TLV is set.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Johannes Berg [Tue, 5 Mar 2019 09:31:11 +0000 (10:31 +0100)]
iwlwifi: pcie: don't crash on invalid RX interrupt
If for some reason the device gives us an RX interrupt before we're
ready for it, perhaps during device power-on with misconfigured IRQ
causes mapping or so, we can crash trying to access the queues.
Prevent that by checking that we actually have RXQs and that they
were properly allocated.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Johannes Berg [Mon, 25 Mar 2019 12:19:56 +0000 (13:19 +0100)]
iwlwifi: pcie: initialize debug_rfkill to -1
This will let us introduce a mechanism to start with rfkill
faked, and put 0 here to override it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
YueHaibing [Wed, 17 Apr 2019 03:24:09 +0000 (11:24 +0800)]
iwlwifi: Use correct channel_profile iniwl_get_nvm
commit
2785ce008e3b ("iwlwifi: support new NVM response API")
seems forgot use correct channel_profile in iwl_get_nvm when call
iwl_init_sbands().
Fixes:
2785ce008e3b ("iwlwifi: support new NVM response API")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Wright Feng [Fri, 26 Apr 2019 03:12:32 +0000 (03:12 +0000)]
brcmfmac: send mailbox interrupt twice for specific hardware device
For PCIE wireless device with core revision less than 14, device may miss
PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
mail box interrupt twice as a hardware workaround.
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Tue, 23 Apr 2019 14:32:14 +0000 (22:32 +0800)]
rtlwifi: rtl8192cu: remove set but not used variable 'turbo_scanoff'
Fixes gcc '-Wunused-but-set-variable' warning:
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c: In function 'rtl92cu_phy_rf6052_set_cck_txpower':
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c:45:7: warning: variable 'turbo_scanoff' set but not used [-Wunused-but-set-variable]
It is not used any more since
commit
e9b0784bb9de ("rtlwifi: rtl8192cu: Fix some code in RF handling")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Jeff Xie [Tue, 19 Mar 2019 16:24:05 +0000 (00:24 +0800)]
mwl8k: move spin_lock_bh to spin_lock in tasklet
It is unnecessary to call spin_lock_bh in a tasklet.
Signed-off-by: Jeff Xie <chongguiguzi@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Sergey Matyukevich [Tue, 9 Apr 2019 07:35:12 +0000 (07:35 +0000)]
qtnfmac: modify debugfs to support multiple cards
This patch modifies location of debugfs entries and their naming
conventions to support multiple wireless cards on pcie host.
Selected approach is to use separate directories for different
wireless cards in top-level qtnfmac debugfs directory.
Here is an example that clarifies the chosen naming conventions:
$ sudo ls /sys/kernel/debug/qtnfmac/
qtnfmac_pcie:0000:01:00.0
Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Igor Mitsyanko [Tue, 9 Apr 2019 07:35:10 +0000 (07:35 +0000)]
qtnfmac: allow to control DFS slave radar detection
In ETSI region DFS slave device can operate in two modes on DFS channels:
- do on-channel radar detection and use higher Tx power
- don't do radar detection and use lower Tx power as a consequence
Allow user to control that behavior through qtnfmac module parameter.
Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Sergey Matyukevich [Tue, 9 Apr 2019 07:35:08 +0000 (07:35 +0000)]
qtnfmac: handle channel switch events for connected stations only
Channel switch events from firmware should be processed only when STA
is already connected to BSS. On connect this notification is not needed
since full BSS info will be supplied by cfg80211_connect_result.
Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Paolo Bonzini [Wed, 24 Apr 2019 19:32:50 +0000 (12:32 -0700)]
wlcore: simplify/fix/optimize reg_ch_conf_pending operations
Bitmaps are defined on unsigned longs, so the usage of u32[2] in the
wlcore driver is incorrect. As noted by Peter Zijlstra, casting arrays
to a bitmap is incorrect for big-endian architectures.
When looking at it I observed that:
- operations on reg_ch_conf_pending is always under the wl_lock mutex,
so set_bit is overkill
- the only case where reg_ch_conf_pending is accessed a u32 at a time is
unnecessary too.
This patch cleans up everything in this area, and changes tmp_ch_bitmap
to have the proper alignment.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Kalle Valo [Thu, 25 Apr 2019 17:08:31 +0000 (20:08 +0300)]
Revert "brcmfmac: send mailbox interrupt twice for specific hardware device"
This reverts commit
99d94ef367af67f630b38c93ff46c5819b7d06b6. I accidentally
applied this broken (failed to compile) patch due to a bug in my patchwork
script.
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Wright Feng [Thu, 25 Apr 2019 07:05:46 +0000 (07:05 +0000)]
brcmfmac: send mailbox interrupt twice for specific hardware device
For PCIE wireless device with core revision less than 14, device may miss
PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
mail box interrupt twice as a hardware workaround.
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Gabor Juhos [Wed, 24 Apr 2019 07:49:24 +0000 (09:49 +0200)]
rt2x00: add RT3883 support
Patch add support for RT3883 chip. Code was taken direclty
from openwrt project and merge into one patch.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Hans de Goede [Mon, 22 Apr 2019 20:41:23 +0000 (22:41 +0200)]
brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 mini PCs
The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
and product_name DMI strings, without this patch brcmfmac will try to load:
"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
is way too generic.
The DMI strings on which we are matching are somewhat generic too, but
"To be filled by O.E.M." is less common then "Default string" and the
system-sku and bios-version strings are pretty unique. Beside the DMI
strings we also check the wifi-module chip-id and revision. I'm confident
that the combination of all this is unique.
Both the T8 and T11 use the same wifi-module, this commit adds DMI
quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Pan Bian [Wed, 17 Apr 2019 09:41:23 +0000 (17:41 +0800)]
p54: drop device reference count if fails to enable device
The function p54p_probe takes an extra reference count of the PCI
device. However, the extra reference count is not dropped when it fails
to enable the PCI device. This patch fixes the bug.
Cc: stable@vger.kernel.org
Signed-off-by: Pan Bian <bianpan2016@163.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Gustavo A. R. Silva [Tue, 16 Apr 2019 15:17:22 +0000 (10:17 -0500)]
rtlwifi: rtl8723ae: Fix missing break in switch statement
Add missing break statement in order to prevent the code from falling
through to case 0x1025, and erroneously setting rtlhal->oem_id to
RT_CID_819X_ACER when rtlefuse->eeprom_svid is equal to 0x10EC and
none of the cases in switch (rtlefuse->eeprom_smid) match.
This bug was found thanks to the ongoing efforts to enable
-Wimplicit-fallthrough.
Fixes:
238ad2ddf34b ("rtlwifi: rtl8723ae: Clean up the hardware info routine")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Colin Ian King [Mon, 15 Apr 2019 14:26:49 +0000 (15:26 +0100)]
mwifiex: fix spelling mistake "capabilties" -> "capabilities"
There various spelling mistakes in function names and in message
text. Fix these.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Colin Ian King [Mon, 15 Apr 2019 10:37:03 +0000 (11:37 +0100)]
iwlegacy: fix spelling mistake "acumulative" -> "accumulative"
Fix spelling mistakes in rx stats text. I missed these from an earlier
round of fixing the same spelling mistake.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Tamás Szűcs [Sun, 14 Apr 2019 18:36:41 +0000 (20:36 +0200)]
mwifiex: add support for SD8987 chipset
This patch adds support for Marvell 88W8987 chipset with SDIO interface.
Register offsets and supported feature flags are updated. The corresponding
firmware image file shall be "mrvl/sd8987_uapsta.bin".
Signed-off-by: Tamás Szűcs <tszucs@protonmail.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Petr Štetiar [Thu, 11 Apr 2019 18:13:30 +0000 (20:13 +0200)]
mwl8k: Fix rate_idx underflow
It was reported on OpenWrt bug tracking system[1], that several users
are affected by the endless reboot of their routers if they configure
5GHz interface with channel 44 or 48.
The reboot loop is caused by the following excessive number of WARN_ON
messages:
WARNING: CPU: 0 PID: 0 at backports-4.19.23-1/net/mac80211/rx.c:4516
ieee80211_rx_napi+0x1fc/0xa54 [mac80211]
as the messages are being correctly emitted by the following guard:
case RX_ENC_LEGACY:
if (WARN_ON(status->rate_idx >= sband->n_bitrates))
as the rate_idx is in this case erroneously set to 251 (0xfb). This fix
simply converts previously used magic number to proper constant and
guards against substraction which is leading to the currently observed
underflow.
1. https://bugs.openwrt.org/index.php?do=details&task_id=2218
Fixes:
854783444bab ("mwl8k: properly set receive status rate index on 5 GHz receive")
Cc: <stable@vger.kernel.org>
Tested-by: Eubert Bao <bunnier@gmail.com>
Reported-by: Eubert Bao <bunnier@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Mon, 8 Apr 2019 03:45:29 +0000 (11:45 +0800)]
at76c50x-usb: Don't register led_trigger if usb_register_driver failed
Syzkaller report this:
[ 1213.468581] BUG: unable to handle kernel paging request at
fffffbfff83bf338
[ 1213.469530] #PF error: [normal kernel read fault]
[ 1213.469530] PGD
237fe4067 P4D
237fe4067 PUD
237e60067 PMD
1c868b067 PTE 0
[ 1213.473514] Oops: 0000 [#1] SMP KASAN PTI
[ 1213.473514] CPU: 0 PID: 6321 Comm: syz-executor.0 Tainted: G C 5.1.0-rc3+ #8
[ 1213.473514] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 1213.473514] RIP: 0010:strcmp+0x31/0xa0
[ 1213.473514] Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
[ 1213.473514] RSP: 0018:
ffff8881f2b7f950 EFLAGS:
00010246
[ 1213.473514] RAX:
1ffffffff83bf338 RBX:
ffff8881ea6f7240 RCX:
ffffffff825350c6
[ 1213.473514] RDX:
0000000000000000 RSI:
ffffffffc1ee19c0 RDI:
ffffffffc1df99c0
[ 1213.473514] RBP:
ffffffffc1df99c1 R08:
0000000000000001 R09:
0000000000000004
[ 1213.473514] R10:
0000000000000000 R11:
ffff8881de353f00 R12:
ffff8881ee727900
[ 1213.473514] R13:
dffffc0000000000 R14:
0000000000000001 R15:
ffffffffc1eeaaf0
[ 1213.473514] FS:
00007fa66fa01700(0000) GS:
ffff8881f7200000(0000) knlGS:
0000000000000000
[ 1213.473514] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 1213.473514] CR2:
fffffbfff83bf338 CR3:
00000001ebb9e005 CR4:
00000000007606f0
[ 1213.473514] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 1213.473514] DR3:
0000000000000000 DR6:
00000000fffe0ff0 DR7:
0000000000000400
[ 1213.473514] PKRU:
55555554
[ 1213.473514] Call Trace:
[ 1213.473514] led_trigger_register+0x112/0x3f0
[ 1213.473514] led_trigger_register_simple+0x7a/0x110
[ 1213.473514] ? 0xffffffffc1c10000
[ 1213.473514] at76_mod_init+0x77/0x1000 [at76c50x_usb]
[ 1213.473514] do_one_initcall+0xbc/0x47d
[ 1213.473514] ? perf_trace_initcall_level+0x3a0/0x3a0
[ 1213.473514] ? kasan_unpoison_shadow+0x30/0x40
[ 1213.473514] ? kasan_unpoison_shadow+0x30/0x40
[ 1213.473514] do_init_module+0x1b5/0x547
[ 1213.473514] load_module+0x6405/0x8c10
[ 1213.473514] ? module_frob_arch_sections+0x20/0x20
[ 1213.473514] ? kernel_read_file+0x1e6/0x5d0
[ 1213.473514] ? find_held_lock+0x32/0x1c0
[ 1213.473514] ? cap_capable+0x1ae/0x210
[ 1213.473514] ? __do_sys_finit_module+0x162/0x190
[ 1213.473514] __do_sys_finit_module+0x162/0x190
[ 1213.473514] ? __ia32_sys_init_module+0xa0/0xa0
[ 1213.473514] ? __mutex_unlock_slowpath+0xdc/0x690
[ 1213.473514] ? wait_for_completion+0x370/0x370
[ 1213.473514] ? vfs_write+0x204/0x4a0
[ 1213.473514] ? do_syscall_64+0x18/0x450
[ 1213.473514] do_syscall_64+0x9f/0x450
[ 1213.473514] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1213.473514] RIP: 0033:0x462e99
[ 1213.473514] Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1213.473514] RSP: 002b:
00007fa66fa00c58 EFLAGS:
00000246 ORIG_RAX:
0000000000000139
[ 1213.473514] RAX:
ffffffffffffffda RBX:
000000000073bf00 RCX:
0000000000462e99
[ 1213.473514] RDX:
0000000000000000 RSI:
0000000020000300 RDI:
0000000000000003
[ 1213.473514] RBP:
00007fa66fa00c70 R08:
0000000000000000 R09:
0000000000000000
[ 1213.473514] R10:
0000000000000000 R11:
0000000000000246 R12:
00007fa66fa016bc
[ 1213.473514] R13:
00000000004bcefa R14:
00000000006f6fb0 R15:
0000000000000004
If usb_register failed, no need to call led_trigger_register_simple.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes:
1264b951463a ("at76c50x-usb: add driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Alexey Khoroshilov [Fri, 5 Apr 2019 21:26:38 +0000 (00:26 +0300)]
mwl8k: fix error handling in mwl8k_post_cmd()
If pci_map_single() fails in mwl8k_post_cmd(),
it returns -ENOMEM immediately, while cleanup is required.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Larry Finger [Thu, 4 Apr 2019 18:49:14 +0000 (13:49 -0500)]
b43: Remove empty function lpphy_papd_cal()
In commit
d825db346270e ("b43: shut up clang -Wuninitialized variable
warning"), the message noted that function lpphy_papd_cal() was empty
and had an old TODO regarding its implementation. As the reverse
engineering project that created the LP-PHY version of this driver
has not been active for some time, it is safe to remove this empty
function.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Dan Carpenter [Thu, 4 Apr 2019 08:44:23 +0000 (11:44 +0300)]
mwifiex: prevent an array overflow
The "rate_index" is only used as an index into the phist_data->rx_rate[]
array in the mwifiex_hist_data_set() function. That array has
MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some
debugfs information. The "rate_index" variable comes from the network
skb->data[] and it is a u8 so it's in the 0-255 range. We need to cap
it to prevent an array overflow.
Fixes:
cbf6e05527a7 ("mwifiex: add rx histogram statistics support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Gustavo A. R. Silva [Wed, 3 Apr 2019 18:59:05 +0000 (13:59 -0500)]
zd1211rw: use struct_size() helper
Make use of the struct_size() helper instead of an open-coded version
in order to avoid any potential type mistakes, in particular in the
context in which this code is being used.
So, replace code of the following form:
sizeof(struct usb_req_write_regs) + count * sizeof(struct reg_data)
with:
struct_size(req, reg_writes, count)
This code was detected with the help of Coccinelle.
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Gustavo A. R. Silva [Wed, 3 Apr 2019 16:40:52 +0000 (11:40 -0500)]
mwifiex: use struct_size() in kzalloc()
One of the more common cases of allocation size calculations is finding
the size of a structure that has a zero-sized array at the end, along
with memory for some number of elements for that array. For example:
struct foo {
int stuff;
struct boo entry[];
};
size = sizeof(struct foo) + count * sizeof(struct boo);
instance = kzalloc(size, GFP_KERNEL)
Instead of leaving these open-coded and prone to type mistakes, we can
now use the new struct_size() helper:
instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL)
Notice that, in this case, variable regd_size is not necessary,
hence it is removed.
This code was detected with the help of Coccinelle.
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:09 +0000 (09:43 +0530)]
rsi: miscallaneous changes for 9116 and common
Below changes are done:
* Device 80MHz clock should be disabled for 9116 in 20MHz band.
* Default edca parameters should be used initially before
connection.
* Default TA aggregation is 3 for 9116.
* Bootup parameters should be loaded first when channel is
changed.
* 4 byte register writes are possible for 9116.
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:08 +0000 (09:43 +0530)]
rsi: reset device changes for 9116
Device reset register(watchdog timer related) addresses and
values are different for 9116.
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:07 +0000 (09:43 +0530)]
rsi: send new tx command frame wlan9116 features
For 9116 device, we have introduced w9116 features frame, which shall be
send when radio capabilities confirm is received.
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:06 +0000 (09:43 +0530)]
rsi: new bootup parameters for 9116
Bootup parameters are different for 9116 device. Check added for device
model where-ever bootup parameters are being send.
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:05 +0000 (09:43 +0530)]
rsi: change in device init frame sequence for 9116
Initial frame exchange sequence has been changed for 9116 chip. Getting MAC
address using EEPROM read frame will be once common device configuration is
done and RESET_MAC frame is sending after bootup parameters confirmation is
received, which are different from RS9113 device
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:04 +0000 (09:43 +0530)]
rsi: add firmware loading for 9116 device
New firmware files and firmware loading method are added for 9116.
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:03 +0000 (09:43 +0530)]
rsi: move common part of firmware load to separate function
Till software bootloader ready state, communication with device is common
for 9113 and 9116. Hence moved that part of firmware loading to separate
function rsi_prepare_fw_load(). Also LMAC_VER_OFFSET is different for 9113
and 9116, so renamed existing macro to LMAC_VER_OFFSET_9113
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Siva Rebbagondla [Wed, 3 Apr 2019 04:13:02 +0000 (09:43 +0530)]
rsi: add new device model for 9116
9116 device id entry is added in both SDIO and USB interfaces.
New enumberation value taken for the device model. Based on the
device model detected run time, few device specific operations
needs to be performed.
adding rsi_dev_model to get device type in run time, as we can use
same driver for 9113 and 9116 except few firmware load changes.
Signed-off-by: Siva Rebbagondla <siva8118@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:31 +0000 (10:58 +0100)]
rt2x00mmio: remove legacy comment
Remove comment about fields that were removed.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:30 +0000 (10:58 +0100)]
rt2x00: remove not used entry field
Remove not used any longer queue_entry field and flag.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:29 +0000 (10:58 +0100)]
rt2x00: remove last_nostatus_check
We do not any longer check txstatus timeout from tasklet, so do not need
this optimization.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:28 +0000 (10:58 +0100)]
rt2800mmio: use timer and work for handling tx statuses timeouts
Sometimes we can get into situation when there are pending statuses,
but we do not get INT_SOURCE_CSR_TX_FIFO_STATUS. Handle this situation
by arming timeout timer and read statuses (it will fix case when
we just do not have irq) and queue work to handle case we missed
statues from hardware FIFO.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:27 +0000 (10:58 +0100)]
rt2800mmio: fetch tx status changes
Prepare to use rt2800mmio_fetch_txstatus() in concurrent manner and drop
return value since is not longer needed.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:26 +0000 (10:58 +0100)]
rt2800: move txstatus pending routine
Move rt2800usb_txstatus_pending routine to rt2800lib. It will be reused
by rt2800mmio code.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:25 +0000 (10:58 +0100)]
rt2800: new flush implementation for SoC devices
Use new flush_queue() callback for SoC devices, what was already done for
PCIe devices.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Wed, 27 Mar 2019 09:58:24 +0000 (10:58 +0100)]
rt2800: partially restore old mmio txstatus behaviour
Do not disable txstatus interrupt and add quota of processed tx statuses in
one tasklet. Quota is needed to allow to fed device with new frames during
processing of tx statuses.
Patch fixes about 15% performance degradation on some scenarios caused by
0b0d556e0ebb ("rt2800mmio: use txdone/txstatus routines from lib").
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Aditya Pakki [Sat, 23 Mar 2019 20:49:16 +0000 (15:49 -0500)]
rsi: Fix NULL pointer dereference in kmalloc
kmalloc can fail in rsi_register_rates_channels but memcpy still attempts
to write to channels. The patch replaces these calls with kmemdup and
passes the error upstream.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Tomislav Požega [Thu, 14 Mar 2019 14:19:20 +0000 (15:19 +0100)]
rt2x00: code-style fix in rt2800usb.c
Remove space leftovers.
Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Tue, 12 Mar 2019 09:51:43 +0000 (10:51 +0100)]
rt2x00: do not print error when queue is full
For unknown reasons printk() on some context can cause CPU hung on
embedded MT7620 AP/router MIPS platforms. What can result on wifi
disconnects.
This patch move queue full messages to debug level what is consistent
with other mac80211 drivers which drop packet silently if tx queue is
full. This make MT7620 OpenWRT routers more stable, what was reported
by various users.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Tue, 12 Mar 2019 09:51:42 +0000 (10:51 +0100)]
rt2x00: check number of EPROTO errors
Some USB host devices/drivers on some conditions can always return
EPROTO error on submitted URBs. That can cause infinity loop in the
rt2x00 driver.
Since we can have single EPROTO errors we can not mark as device as
removed to avoid infinity loop. However we can count consecutive
EPROTO errors and mark device as removed if get lot of it.
I choose number 10 as threshold.
Reported-and-tested-by: Randy Oostdyk <linux-kernel@oostdyk.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Tue, 12 Mar 2019 09:51:41 +0000 (10:51 +0100)]
rt2x00: use ratelimited variants dev_warn/dev_err
As reported by Randy we can overwhelm logs on some USB error conditions.
To avoid that use dev_warn_ratelimited() and dev_err_ratelimitd().
Reported-and-tested-by: Randy Oostdyk <linux-kernel@oostdyk.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Kangjie Lu [Tue, 12 Mar 2019 08:05:02 +0000 (03:05 -0500)]
net: cw1200: fix a NULL pointer dereference
In case create_singlethread_workqueue fails, the fix free the
hardware and returns NULL to avoid NULL pointer dereference.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Wed, 6 Mar 2019 11:56:58 +0000 (19:56 +0800)]
ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
Syzkaller report this:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 0 PID: 4492 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
RIP: 0010:sysfs_remove_file_ns+0x27/0x70 fs/sysfs/file.c:468
Code: 00 00 00 41 54 55 48 89 fd 53 49 89 d4 48 89 f3 e8 ee 76 9c ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 2d 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 8b 6d
RSP: 0018:
ffff8881e9d9fc00 EFLAGS:
00010206
RAX:
dffffc0000000000 RBX:
ffffffff900367e0 RCX:
ffffffff81a95952
RDX:
0000000000000006 RSI:
ffffc90001405000 RDI:
0000000000000030
RBP:
0000000000000000 R08:
fffffbfff1fa22ed R09:
fffffbfff1fa22ed
R10:
0000000000000001 R11:
fffffbfff1fa22ec R12:
0000000000000000
R13:
ffffffffc1abdac0 R14:
1ffff1103d3b3f8b R15:
0000000000000000
FS:
00007fe409dc1700(0000) GS:
ffff8881f1200000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000001b2d721000 CR3:
00000001e98b6005 CR4:
00000000007606f0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000fffe0ff0 DR7:
0000000000000400
PKRU:
55555554
Call Trace:
sysfs_remove_file include/linux/sysfs.h:519 [inline]
driver_remove_file+0x40/0x50 drivers/base/driver.c:122
pcmcia_remove_newid_file drivers/pcmcia/ds.c:163 [inline]
pcmcia_unregister_driver+0x7d/0x2b0 drivers/pcmcia/ds.c:209
ssb_modexit+0xa/0x1b [ssb]
__do_sys_delete_module kernel/module.c:1018 [inline]
__se_sys_delete_module kernel/module.c:961 [inline]
__x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:
00007fe409dc0c58 EFLAGS:
00000246 ORIG_RAX:
00000000000000b0
RAX:
ffffffffffffffda RBX:
000000000073bf00 RCX:
0000000000462e99
RDX:
0000000000000000 RSI:
0000000000000000 RDI:
00000000200000c0
RBP:
0000000000000002 R08:
0000000000000000 R09:
0000000000000000
R10:
0000000000000000 R11:
0000000000000246 R12:
00007fe409dc16bc
R13:
00000000004bccaa R14:
00000000006f6bc8 R15:
00000000ffffffff
Modules linked in: ssb(-) 3c59x nvme_core macvlan tap pata_hpt3x3 rt2x00pci null_blk tsc40 pm_notifier_error_inject notifier_error_inject mdio cdc_wdm nf_reject_ipv4 ath9k_common ath9k_hw ath pppox ppp_generic slhc ehci_platform wl12xx wlcore tps6507x_ts ioc4 nf_synproxy_core ide_gd_mod ax25 can_dev iwlwifi can_raw atm tm2_touchkey can_gw can sundance adp5588_keys rt2800mmio rt2800lib rt2x00mmio rt2x00lib eeprom_93cx6 pn533 lru_cache elants_i2c ip_set nfnetlink gameport tipc hampshire nhc_ipv6 nhc_hop nhc_udp nhc_fragment nhc_routing nhc_mobility nhc_dest 6lowpan silead brcmutil nfc mt76_usb mt76 mac80211 iptable_security iptable_raw iptable_mangle iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_gre sit hsr veth vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon vcan bridge stp llc ip6_gre ip6_tunnel tunnel6 tun joydev mousedev serio_raw ide_pci_generic piix floppy ide_core sch_fq_codel ip_tables x_tables ipv6
[last unloaded: 3c59x]
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace
3913cbf8011e1c05 ]---
In ssb_modinit, it does not fail SSB init when ssb_host_pcmcia_init failed,
however in ssb_modexit, ssb_host_pcmcia_exit calls pcmcia_unregister_driver
unconditionally, which may tigger a NULL pointer dereference issue as above.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes:
399500da18f7 ("ssb: pick PCMCIA host code support from b43 driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Wed, 6 Mar 2019 11:48:12 +0000 (19:48 +0800)]
ray_cs: use remove_proc_subtree to simplify procfs code
Use remove_proc_subtree to remove the whole subtree
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Wed, 6 Mar 2019 11:46:14 +0000 (19:46 +0800)]
ray_cs: Check return value of pcmcia_register_driver
init_ray_cs does not check value of pcmcia_register_driver,
if it fails, there maybe cause a NULL pointer dereference in
exit_ray_cs.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Gustavo A. R. Silva [Wed, 3 Apr 2019 18:23:34 +0000 (13:23 -0500)]
rndis_wlan: use struct_size() helper
Make use of the struct_size() helper instead of an open-coded version
in order to avoid any potential type mistakes, in particular in the
context in which this code is being used.
So, replace code of the following form:
sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0])
with:
struct_size(pmkids, bssid_info, num_pmkids)
This code was detected with the help of Coccinelle.
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Kalle Valo [Thu, 25 Apr 2019 15:26:23 +0000 (18:26 +0300)]
Merge tag 'iwlwifi-next-for-kalle-2019-04-18-2' of git://git./linux/kernel/git/iwlwifi/iwlwifi-next
Third batch of patches intended for v5.2
* Bump the 20000-series FW API version supported;
* Work on the new debugging infra continues;
* One clean-up to prevent a bogus warning with clang;
* A small cleanup in the PCI ID list;
* Work on new hardware continues;
* RTT confidence indication support for FTM;
* An improvement in HE rate-scaling;
Shahar S Matityahu [Tue, 19 Mar 2019 07:35:29 +0000 (09:35 +0200)]
iwlwifi: dbg_ini: set dump bit only when trigger collection is certain
In case the the trigger occurrences is zero or force_restart is set, the
driver sets IWL_FWRT_STATUS_DUMPING without actually scheduling trigger
collection. At this point no other dump collection can be performed.
Solve this by setting IWL_FWRT_STATUS_DUMPING bit only when the driver
is surely going to schedule dump collection
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Nathan Chancellor [Fri, 8 Mar 2019 00:03:22 +0000 (17:03 -0700)]
iwlwifi: mvm: Change an 'else if' into an 'else' in iwl_mvm_send_add_bcast_sta
When building with -Wsometimes-uninitialized, Clang warns:
drivers/net/wireless/intel/iwlwifi/mvm/sta.c:2114:12: warning: variable
'queue' is used uninitialized whenever 'if' condition is false
[-Wsometimes-uninitialized]
Clang can't evaluate at this point that WARN(1, ...) always returns true
because __ret_warn_on is defined as !!(condition), which isn't
immediately evaluated as 1. Change this branch to else so that it's
clear to Clang that we intend to bail out here.
Link: https://github.com/ClangBuiltLinux/linux/issues/399
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
[added a few more braces]
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Luca Coelho [Thu, 14 Mar 2019 10:54:34 +0000 (12:54 +0200)]
iwlwifi: remove unused 0x40C0 PCI device IDs
This device ID and device type was never released, so we can remove it
from the PCI IDs list.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Avraham Stern [Mon, 25 Feb 2019 13:12:26 +0000 (15:12 +0200)]
iwlwifi: mvm: support rtt confidence indication
The range response notification API has changed to add a value that
indicates the confidence of the rtt result.
Support the new API and print the rtt confidence for debug.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Thu, 14 Mar 2019 08:05:25 +0000 (10:05 +0200)]
iwlwifi: dbg: add lmac and umac PC registers to periphery dump
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Wed, 6 Mar 2019 13:24:20 +0000 (15:24 +0200)]
iwlwifi: dbg: add periphery memory dumping support to ax210 device family
Allows to dump periphery memory on ax210 devices.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Gregory Greenman [Wed, 20 Feb 2019 09:31:10 +0000 (11:31 +0200)]
iwlwifi: rs: consider LDPC capability in case of HE
When building TLC configuration command, consider in case of HE,
if LDPC support is turned on in our capabilities.
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Mon, 4 Mar 2019 10:14:37 +0000 (12:14 +0200)]
iwlwifi: dbg_ini: add debug prints to the ini flows
Add debug prints to the ini flow and rewrite existing prints to provide
more information
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Mon, 4 Mar 2019 11:44:43 +0000 (13:44 +0200)]
iwlwifi: add FW_INFO debug level
Add FW_INFO debug level. This level is enabled if INFO or FW debug
levels are set.
Also, set fw request and callback prints under this debug level.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shahar S Matityahu [Sun, 3 Mar 2019 15:29:23 +0000 (17:29 +0200)]
iwlwifi: dbg_ini: support notification and dhc regions type parsing
IWL_FW_INI_REGION_CSR and IWL_FW_INI_REGION_NOTIFICATION does not have
memory addresses attached to them so the driver should skip them when
parsing the region tlv.
Also, instead of declearing what region types should skip the addition of
the memory addresses, declare what regions have addition of memory
addresses.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shaul Triebitz [Tue, 5 Mar 2019 07:48:16 +0000 (09:48 +0200)]
iwlwifi: unite macros with same meaning
TFD_*_SLOTS and IWL_*_QUEUE_SIZE both define the TX queue
size (number of TFDs).
Get rid of TFD_*_SLOTS and use only IWL_*_QUEUE_SIZE.
Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Shaul Triebitz [Thu, 28 Feb 2019 15:17:58 +0000 (17:17 +0200)]
iwlwifi: mvm: set 512 TX queue slots for AX210 devices
AX210 devices support 256 BA (256 MPDUs in an AMPDU).
The firmware requires that the number of TFDs will be
minimum twice as big as the BA size (2 * 256 = 512).
Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Luca Coelho [Thu, 10 Jan 2019 15:13:12 +0000 (17:13 +0200)]
iwlwifi: bump FW API to 47 for 22000 series
Start supporting API version 47 for 22000 series. The 9000 series is
now frozen on version 46.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Kalle Valo [Fri, 19 Apr 2019 07:20:10 +0000 (10:20 +0300)]
Merge ath-next from git://git./linux/kernel/git/kvalo/ath.git
ath.git patches for 5.2. No major changes.
David S. Miller [Fri, 19 Apr 2019 00:43:11 +0000 (17:43 -0700)]
Merge branch 'net-add-reset-controller-driven-PHY-reset'
David Bauer says:
====================
net: add reset-controller driven PHY reset
This patchset adds support for a PHY reset driven by a reset-controller.
Currently, only GPIO driven resets are supported by the PHY subsystem.
It also renames the reset-gpio from 'reset' to 'reset_gpio' to
better differentiate between resets wired to a GPIO and resets wired to
a reset-controller driven pin.
Some systems have the PHY reset-line wired to a pin controlled by a
reset-controller (eg. some Atheros AR9132 based boards). In case the
bootloader asserts reset before loading the kernel, we currently do not
have a clean way of deasserting reset to probe the PHY.
v3:
- add missing newline in mdio_bus.c
v2:
- fixed missed rename of "reset" in at803x.c
- move initial reset to mdio_device_reset
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
David Bauer [Wed, 17 Apr 2019 21:59:22 +0000 (23:59 +0200)]
net: mdio: rename mdio_device reset to reset_gpio
This renames the GPIO reset of mdio devices from 'reset' to
'reset_gpio' to better differentiate between GPIO and
reset-controller driven reset line.
Signed-off-by: David Bauer <mail@david-bauer.net>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>