Ryder Lee [Mon, 3 Jun 2019 06:08:44 +0000 (14:08 +0800)]
mt76: mt7615: fix slow performance when enable encryption
Fix wrong WCID assignment and add RKV (RX Key of this entry is valid)
flag to check if peer uses the same configuration with previous
handshaking.
If the configuration is mismatch, WTBL indicates a “cipher mismatch”
to stop SEC decryption to prevent the packet from damage.
Suggested-by: YF Luo <yf.luo@mediatek.com>
Suggested-by: Yiwei Chung <yiwei.chung@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Ryder Lee [Mon, 3 Jun 2019 06:08:43 +0000 (14:08 +0800)]
mt76: mt7615: enable support for mesh
Enable NL80211_IFTYPE_MESH_POINT and update its path.
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
YueHaibing [Wed, 29 May 2019 14:53:56 +0000 (22:53 +0800)]
mt76: Remove set but not used variables 'pid' and 'final_mpdu'
Fixes gcc '-Wunused-but-set-variable' warnings:
drivers/net/wireless/mediatek/mt76/mt7603/mac.c: In function mt7603_fill_txs:
drivers/net/wireless/mediatek/mt76/mt7603/mac.c:969:5: warning: variable pid set but not used [-Wunused-but-set-variable]
drivers/net/wireless/mediatek/mt76/mt7603/mac.c:961:7: warning: variable final_mpdu set but not used [-Wunused-but-set-variable]
drivers/net/wireless/mediatek/mt76/mt7615/mac.c: In function mt7615_fill_txs:
drivers/net/wireless/mediatek/mt76/mt7615/mac.c:555:5: warning: variable pid set but not used [-Wunused-but-set-variable]
drivers/net/wireless/mediatek/mt76/mt7615/mac.c:552:19: warning: variable final_mpdu set but not used [-Wunused-but-set-variable]
They are never used, so can be removed.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Wed, 29 May 2019 08:25:55 +0000 (10:25 +0200)]
mt76: move mt76_get_rate in mt76-module
Move mt7603_get_rate in mac80211.c and rename it to mt76_get_rate
since it is shared between mt7603 and mt7615 drivers
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sun, 26 May 2019 14:05:13 +0000 (16:05 +0200)]
mt76: mt7615: rearrange locking in mt7615_config
Since all the routines in mt7615_config grub mt76.mutex moves
mutex_lock/mutex_unlock at the beginning/end of mt7615_config
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sun, 26 May 2019 14:05:12 +0000 (16:05 +0200)]
mt76: mt7615: init get_txpower mac80211 callback
Initialize get_txpower mac80211 callback to mt76_get_txpower
in order to report the configured tx power to mac80211
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sun, 26 May 2019 14:05:11 +0000 (16:05 +0200)]
mt76: mt7615: add the capability to configure tx power
Introduce mt7615_mcu_set_tx_power routine in order to cap tx power
according to the value configured by the user
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sun, 26 May 2019 14:05:10 +0000 (16:05 +0200)]
mt76: generalize mt76_get_txpower for 4x4:4 devices
Genralize mt76_get_txpower routine for 4x4:4 capable devices
in order to be reused in mt7615 driver
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Fri, 17 May 2019 21:32:56 +0000 (23:32 +0200)]
mt76: mt7615: select wifi band according to eeprom
Select supported band according to the value read from
eeprom mtd/otp partition
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Fri, 17 May 2019 06:26:05 +0000 (08:26 +0200)]
mt76: mt7615: add support for mtd eeprom parsing
Calibration data are often available on a specific mtd partition on
embedded devices. Take into account eeprom calibration data if
available.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Tue, 14 May 2019 12:48:31 +0000 (14:48 +0200)]
mt76: move mt76_insert_ccmp_hdr in mt76-module
Move mt7615_insert_ccmp_hdr in mac80211.c and rename it in
mt76_insert_ccmp_hdr since it is shared between mt7603 and mt7615
drivers
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Felix Fietkau [Thu, 6 Jun 2019 07:22:15 +0000 (09:22 +0200)]
mt76: mt76x02: fix tx reordering on rate control probing without a-mpdu
To avoid aggregating rate control probing packets with other traffic, and to
ensure that the probing rate gets used, probing packets get assigned a different
internal queueing priority.
This causes packets to be transmitted in a different order, which is compensated
by the receiver side reordering.
However, if A-MPDU is disabled, this reordering can become visible to upper
layers on the receiver side. Disable the priority change if A-MPDU is disabled.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Felix Fietkau [Wed, 5 Jun 2019 18:50:52 +0000 (20:50 +0200)]
mt76: mt76x02: fix tx status reporting issues
When the hardware falls back to lower rates for a transmit attempt, only the
first status report will show the number of retries correctly. The frames
that follow will report the correct final rate, but number of retries set to 0.
This can cause the rate control module to vastly underestimate the number of
retransmissions per rate.
To fix this, we need to keep track of the initial requested tx rate per packet
and pass it to the status information.
For frames with tx status requested, this is simple: use the rate configured
in info->control.rates[0] as reference.
For no-skb tx status information, we have to encode the requested tx rate in
the packet id (and make it possible to distinguish it from real packet ids).
To do that, reduce the packet id field size by one bit, and use that bit to
indicate packet id vs rate.
This change also improves reporting by filling the status rate array with
rates from first rate to final rate, taking the same steps as the hardware
fallback table. This matters in corner cases like MCS8 on HT, where the
fallback target is MCS0, not MCS7.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Felix Fietkau [Fri, 31 May 2019 20:03:11 +0000 (22:03 +0200)]
mt76: fix setting chan->max_power
When setting chan->max_power after registering the wiphy, chan->max_reg_power
needs to be used as a limit
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Felix Fietkau [Fri, 31 May 2019 20:02:17 +0000 (22:02 +0200)]
mt76: mt7603: fix reading target tx power from eeprom
For the external PA (TSSI OFF) case, the target power needs to be read
from a different location in EEPROM
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Tue, 14 May 2019 09:18:52 +0000 (11:18 +0200)]
mt76: mt7615: do not process rx packets if the device is not initialized
Fix following crash that occurs when the driver is processing rx packets
while the device is not initialized yet
$ rmmod mt7615e
[ 67.210261] mt7615e 0000:01:00.0: Message -239 (seq 2) timeout
$ modprobe mt7615e
[ 72.406937] bus=0x1, slot = 0x0, irq=0x16
[ 72.436590] CPU 0 Unable to handle kernel paging request at virtual address
00000004, epc ==
8eec4240, ra ==
8eec41e0
[ 72.450291] mt7615e 0000:01:00.0: Firmware is not ready for download
[ 72.457724] Oops[#1]:
[ 72.470494] mt7615e: probe of 0000:01:00.0 failed with error -5
[ 72.474829] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.114 #0
[ 72.498702] task:
805769e0 task.stack:
80564000
[ 72.507709] $ 0 :
00000000 00000001 00000000 00000001
[ 72.518106] $ 4 :
8f704dbc 00000000 00000000 8f7046c0
[ 72.528500] $ 8 :
00000024 8045e98c 81210008 11000000
[ 72.538895] $12 :
8fc09f60 00000008 00000019 00000033
[ 72.549289] $16 :
8f704d80 e00000ff 8f0c7800 3c182406
[ 72.559684] $20 :
00000006 8ee615a0 4e000108 00000000
[ 72.570078] $24 :
0000004c 8000cf94
[ 72.580474] $28 :
80564000 8fc09e38 00000001 8eec41e0
[ 72.590869] Hi :
00000001
[ 72.596582] Lo :
00000000
[ 72.602319] epc :
8eec4240 mt7615_mac_fill_rx+0xac/0x494 [mt7615e]
[ 72.614953] ra :
8eec41e0 mt7615_mac_fill_rx+0x4c/0x494 [mt7615e]
[ 72.627580] Status:
11008403 KERNEL EXL IE
[ 72.635899] Cause :
40800008 (ExcCode 02)
[ 72.643860] BadVA :
00000004
[ 72.649573] PrId :
0001992f (MIPS 1004Kc)
[ 72.657704] Modules linked in: mt7615e pppoe ppp_async pppox ppp_generic nf_conntrack_ipv6 mt76x2e mt76x2_common mt76x02_lib mt7603e mt76 mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_mu]
[ 72.792717] Process swapper/0 (pid: 0, threadinfo=
80564000, task=
805769e0, tls=
00000000)
[ 72.808799] Stack :
8f0c7800 00000800 8f0c7800 8032b874 00000000 40000000 8f704d80 8ee615a0
[ 72.825428]
8dc88010 00000001 8ee615e0 8eec09b0 8dc88010 8032b914 8f3aee80 80567d20
[ 72.842055]
00000000 8ee615e0 40000000 8f0c7800 00000108 8eec9944 00000000 00000000
[ 72.858682]
80508f10 80510000 00000001 80567d20 8ee615a0 00000000 00000000 8ee61c00
[ 72.875308]
8ee61c40 00000040 80610000 80580000 00000000 8ee615dc 8ee61a68 00000001
[ 72.891936] ...
[ 72.896793] Call Trace:
[ 72.901649] [<
8eec4240>] mt7615_mac_fill_rx+0xac/0x494 [mt7615e]
[ 72.913602] [<
8eec09b0>] mt7615_queue_rx_skb+0xe4/0x12c [mt7615e]
[ 72.925734] [<
8eec9944>] mt76_dma_cleanup+0x390/0x42c [mt76]
[ 72.936988] Code:
ae020018 8ea20004 24030001 <
94420004>
a602002a 8ea20004 90420000 14430003 a2020034
[ 72.956390]
[ 72.959676] ---[ end trace
f176967739edb19f ]---
Fixes:
04b8e65922f6 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Mon, 13 May 2019 10:23:29 +0000 (12:23 +0200)]
mt76: mt76x02: fix edcca file permission
Use 0600 as edcca file permission in mt76x02 debugfs
Fixes:
643749d4a82b ("mt76: mt76x02: disable ED/CCA by default")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Mon, 13 May 2019 10:19:35 +0000 (12:19 +0200)]
mt76: mt7603: add debugfs knob to enable/disable edcca
Introduce a knob in mt7603 debugfs in order to enable/disable
energy detection based on CCA thresholds
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 11 May 2019 15:30:10 +0000 (17:30 +0200)]
mt76: mt76x02: run mt76x02_edcca_init atomically in mt76_edcca_set
Run mt76x02_edcca_init atomically in mt76_edcca_set since it runs
concurrently with calibration work and mt76x2_set_channel.
Moreover perform phy calibration atomically
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 11 May 2019 10:17:53 +0000 (12:17 +0200)]
mt76: mt76x2: move mutex_lock inside mt76x2_set_channel
This is a preliminary patch to run mt76x02_edcca_init atomically
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 11 May 2019 10:17:52 +0000 (12:17 +0200)]
mt76: mt76x2u: remove mt76x02_edcca_init in mt76x2u_set_channel
Remove mt76x02_edcca_init in mt76x2u_set_channel since it is already
run by mt76x2u_phy_channel_calibrate performing channel calibration
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 11 May 2019 10:17:51 +0000 (12:17 +0200)]
mt76: mt76x02: remove enable from mt76x02_edcca_init signature
Remove enable parameter from mt76x02_edcca_init routine signature since
it is always true
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Tue, 7 May 2019 09:03:33 +0000 (11:03 +0200)]
mt76: mt7615: add static qualifier to mt7615_rx_poll_complete
Make mt7615_rx_poll_complete static since it is used just in pci.c
to initialize rx_poll_complete function pointer
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sun, 5 May 2019 15:17:00 +0000 (17:17 +0200)]
mt76: mt7615: rearrange cleanup operations in mt7615_unregister_device
Cleanup tx/rx napi before releasing pending idrs.
Moreover unmap txwi_cache running mt76_free_device routine
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sun, 5 May 2019 00:53:32 +0000 (02:53 +0200)]
mt76: mt7603: stop mac80211 queues before setting the channel
Suspend data transmission during channel switch
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:09 +0000 (17:29 +0200)]
mt7615: mcu: run __mt76_mcu_send_msg in mt7615_mcu_send_firmware
Run __mt76_mcu_send_msg instead of __mt7615_mcu_msg_send and remove
duplicated code.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:08 +0000 (17:29 +0200)]
mt7615: mcu: init mcu_restart function pointer
Use common function wrapper in mt7615_mcu_exit since the code is shared
with m7603 driver
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:07 +0000 (17:29 +0200)]
mt7615: initialize mt76_mcu_ops data structure
Use __mt76_mcu_send_msg wrapper instead of mt7615_mcu_msg_send.
This is a preliminary patch for mt7615-mt7603 mcu code unification
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:06 +0000 (17:29 +0200)]
mt7615: mcu: use standard signature for mt7615_mcu_msg_send
Use mt76 common signature for mt7615_mcu_msg_send. Move skb allocation
in mt7615_mcu_msg_send and remove duplicated code. Remove
__mt7615_mcu_set_wtbl and __mt7615_mcu_set_sta_rec since now are used
just to send mcu msgs. This is a preliminary patch for mt7615-mt7603 mcu
code unification
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:05 +0000 (17:29 +0200)]
mt7615: mcu: remove unused structure in mcu.h
Remove following struct no longer used:
- dev_info
- bss_info
- bss_info_tag_handler
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Thu, 9 May 2019 07:54:00 +0000 (09:54 +0200)]
mt7615: mcu: do not use function pointers whenever possible
Remove function pointers in mt7615_mcu_set_bss_info and run function
directly. Moreover remove __mt7615_mcu_set_bss_info since it is run just
by mt7615_mcu_set_bss_info and remove duplicated istructions
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:03 +0000 (17:29 +0200)]
mt7615: mcu: unify __mt7615_mcu_set_dev_info and mt7615_mcu_set_dev_info
Unify mt7615_mcu_set_dev_info and __mt7615_mcu_set_dev_info since the
latter is run just by mt7615_mcu_set_dev_info
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:02 +0000 (17:29 +0200)]
mt7615: mcu: remove skb_ret from mt7615_mcu_msg_send
Remove skb_ret parameter from mt7615_mcu_msg_send signature since it is
actually used just by mt7615_mcu_patch_sem_ctrl. This is a prelimanry
patch to use mt76 common mcu API
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:01 +0000 (17:29 +0200)]
mt7615: remove dest from mt7615_mcu_msg_send signature
Remove dest parameter from mt7615_mcu_msg_send/__mt7615_mcu_msg_send
routine signature since it can is always set to MCU_S2D_H2N
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:29:00 +0000 (17:29 +0200)]
mt7615: remove query from mt7615_mcu_msg_send signature
Remove query parameter from mt7615_mcu_msg_send routine signature since
it can be obtained from cmd value
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:59 +0000 (17:28 +0200)]
mt7615: mcu: remove unused parameter in mt7615_mcu_del_wtbl
Remove unused vif parameter in mt7615_mcu_del_wtbl signature
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:58 +0000 (17:28 +0200)]
mt7615: mcu: unify mt7615_mcu_add_wtbl_bmc and mt7615_mcu_del_wtbl_bmc
Remove duplicated code in mt7615_bss_info_changed
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:57 +0000 (17:28 +0200)]
mt7615: mcu: use proper msg size in mt7615_mcu_add_wtbl
Use proper mcu message size in mt7615_mcu_add_wtbl and do not
allocate a huge buffer. Moreover use stack memory instead of heap one
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:56 +0000 (17:28 +0200)]
mt7615: mcu: use proper msg size in mt7615_mcu_add_wtbl_bmc
Use proper mcu message size in mt7615_mcu_add_wtbl_bmc and do not
allocate a huge buffer. Moreover use stack memory instead of heap one
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:55 +0000 (17:28 +0200)]
mt7615: mcu: remove bss_info_convert_vif_type routine
Remove bss_info_convert_vif_type routine since it is run just in
mt7615_mcu_set_bss_info and the switch over vif->type is already there.
Simplify mt7615_mcu_set_bss_info routine
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:54 +0000 (17:28 +0200)]
mt7615: mcu: simplify __mt7615_mcu_set_sta_rec
Do not loop over cmd payload in __mt7615_mcu_set_sta_rec since it is
already done in before running __mt7615_mcu_set_sta_rec (e.g.
mt7615_mcu_set_sta_rec)
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Sat, 4 May 2019 15:28:53 +0000 (17:28 +0200)]
mt7615: mcu: simplify __mt7615_mcu_set_wtbl
Do not loop over cmd payload in __mt7615_mcu_set_wtbl since it is
already done in before running __mt7615_mcu_set_wtbl (e.g.
mt7615_mcu_set_wtbl_key)
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
YueHaibing [Sat, 4 May 2019 10:22:47 +0000 (18:22 +0800)]
mt76: mt7615: Make mt7615_irq_handler static
Fix sparse warning:
drivers/net/wireless/mediatek/mt76/mt7615/pci.c:37:13:
warning: symbol 'mt7615_irq_handler' was not declared. Should it be static?
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Dan Carpenter [Fri, 3 May 2019 13:09:13 +0000 (16:09 +0300)]
mt76: mt7615: Use after free in mt7615_mcu_set_bcn()
We dereference "skb" when we assign:
req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
^^^^^^^^
So this patch just moves the dev_kfree_skb() down a bit to avoid the
use after free.
Fixes:
04b8e65922f6 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Dan Carpenter [Fri, 3 May 2019 12:54:36 +0000 (15:54 +0300)]
mt76: Fix a signedness bug in mt7615_add_interface()
The problem is that "mvif->omac_idx" is a u8 so it can't be negative
and the error handling won't work. The get_omac_idx() function returns
-1 on error.
Fixes:
04b8e65922f6 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Wed, 1 May 2019 14:06:23 +0000 (16:06 +0200)]
mt76: move netif_napi_del in mt76_dma_cleanup
Move netif_napi_del in mt76_dma_cleanup routine since it is done
by all drivers
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Wed, 1 May 2019 14:06:22 +0000 (16:06 +0200)]
mt76: mt7615: use napi polling for tx cleanup
This allows tx scheduling and tx cleanup to run concurrently
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Wed, 1 May 2019 14:06:21 +0000 (16:06 +0200)]
mt76: mt7603: use napi polling for tx cleanup
This allows tx scheduling and tx cleanup to run concurrently
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Wed, 1 May 2019 14:06:20 +0000 (16:06 +0200)]
mt76: move tx_napi in mt76_dev
Move tx_napi in mt76_dev data structure in order to implement
concurrency between tx scheduling and tx cleanup in mt7603 and mt7615
drivers
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi [Wed, 1 May 2019 13:44:25 +0000 (15:44 +0200)]
mt76: mt76x02: remove useless return in mt76x02_resync_beacon_timer
Remove useless return statment in mt76x02_resync_beacon_timer routine
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Ard Biesheuvel [Mon, 17 Jun 2019 08:43:38 +0000 (10:43 +0200)]
airo: switch to skcipher interface
The AIRO driver applies a ctr(aes) on a buffer of considerable size
(2400 bytes), and instead of invoking the crypto API to handle this
in its entirety, it open codes the counter manipulation and invokes
the AES block cipher directly.
Let's fix this, by switching to the sync skcipher API instead.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:01:00 +0000 (12:01 +0200)]
rt2800: do not enable watchdog by default
Make watchdog disabled by default and add module parameter to enable it.
User will have to create file in /etc/modprobe.d/ with
options rt2800lib watchdog=1
to enable the watchdog or load "rt2800lib watchdog=1" module manually
before loading rt2800{soc,pci,usb} module.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:00:59 +0000 (12:00 +0200)]
rt2x00: add restart hw
Add ieee80211_restart_hw() to watchdog and debugfs file for testing
if restart works as expected.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:00:58 +0000 (12:00 +0200)]
rt2800: do not nullify initialization vector data
If we restart hw we should keep existing IV (initialization vector)
otherwise HW encryption will be broken after restart.
Also fix some coding style issues on the way.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:00:57 +0000 (12:00 +0200)]
rt2800: add pre_reset_hw callback
Add routine to cleanup interfaces data before hw reset as
ieee80211_restart_hw() will do setup interfaces again.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:00:56 +0000 (12:00 +0200)]
rt2800: initial watchdog implementation
Add watchdog for rt2800 devices. For now it only detect hung
and print error.
[Note: I verified that printing messages from process context is
fine on MT7620 (WT3020) platform that have problem when printk
is called from interrupt context].
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:00:55 +0000 (12:00 +0200)]
rt2800: add helpers for reading dma done index
For mmio we do not properlly trace dma done Q_INDEX_DMA_DONE index
for TX queues. That would require implementing INT_SOURCE_CSR_*_DMA_DONE
interrupts, what is rather not worth to do due to adding extra
CPU load (small but still somewhat not necessary otherwise).
We can just read TX DMA done indexes from registers directly. What
will be used by watchdog.
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Stanislaw Gruszka [Sat, 15 Jun 2019 10:00:54 +0000 (12:00 +0200)]
rt2x00: allow to specify watchdog interval
Allow subdriver to change watchdog interval by intialize
link->watchdog_interval value before rt2x00link_register().
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Christian Lamparter [Sat, 15 Jun 2019 10:00:09 +0000 (12:00 +0200)]
p54: remove dead branch in op_conf_tx callback
This patch removes the error branch for (queue > dev->queues).
It is no longer needed anymore as the "queue" value is validated by
cfg80211's parse_txq_params() before the driver code gets called.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Tzu-En Huang [Fri, 14 Jun 2019 07:24:15 +0000 (15:24 +0800)]
rtw88: fix typo rtw_writ16_set
rtw_writ16_set should be rtw_write16_set
Signed-off-by: Tzu-En Huang <tehuang@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:14 +0000 (15:24 +0800)]
rtw88: rsvd page should go though management queue
The hardware default uses management queue to transmit frames that are
downloaded into reserved page, so we need to clearly assign the frames
to use qsel in TX_DESC_QSEL_MGMT to avoid using wrong queue.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:13 +0000 (15:24 +0800)]
rtw88: restore DACK results to save time
DACK is done right after the hardware has been turned on, which
means it will be done every time we leave the IDLE state.
But it takes ~2 seconds to finish DACK.
We can back up the results and restore them. And it only takes a few
milliseconds to restore the results to the hardware, saving a lot of
time.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:12 +0000 (15:24 +0800)]
rtw88: power on again if it was already on
We could fail to power on because it was already on. If the return
value is -EALREADY, power off and then power on again to turn on the
hardware as expected.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:11 +0000 (15:24 +0800)]
rtw88: 8822c: use more accurate ofdm fa counting
8822c used to count OFDM FA count by subtracting tx count from FA count.
But it need to substract more counters to be accurate.
However, we can count it by adding up all of the FA counters we want.
And it is simpler to add than list all of the components to substract.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:10 +0000 (15:24 +0800)]
rtw88: 8822c: disable rx clock gating before counter reset
Driver Could fail to reset counter if rx clock gating is not disabled.
So we need to disable rx clock gating before resetting counters.
Otherwise counters may increase unexpected.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Chien-Hsun Liao [Fri, 14 Jun 2019 07:24:09 +0000 (15:24 +0800)]
rtw88: 8822c: update channel and bandwidth BB setting
In 2G channels, the cck source and rxagc should be set to different
values based on different bandwidth to increase the performance of rx
sensitivity.
To improve rx throughput performance, the values of sbd subtune and
pt_opt should be changed in different bandwidth.
Signed-off-by: Chien-Hsun Liao <ben.liao@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Chien-Hsun Liao [Fri, 14 Jun 2019 07:24:08 +0000 (15:24 +0800)]
rtw88: 8822c: add rf write protection when switching channel
Collision of writing rf registers could occur if the driver writes
rf registers by direct write while the hardware is writing other rf
registers by pi write simultaneously.
Hardware pi write can be triggered by rf calibrations sometimes, so
the driver can not always write rf registers by direct write
protection. Direct write protection can make sure that there is no
hardware pi write during the direct write.
According to some experiments, if we add direct write protection
when switching channel, the performance of rf calibration will not
be affected.
Signed-off-by: Chien-Hsun Liao <ben.liao@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Chin-Yen Lee [Fri, 14 Jun 2019 07:24:07 +0000 (15:24 +0800)]
rtw88: add beacon function setting
Add beacon function setting routines for each hardware port.
If beacon function is not enabled, the hardware is not able
to synchronize with AP's beacon and can miss the beacons
under some scenarios such as PS mode.
For AP and Adhoc modes that require to send beacons, do not
update the TSF, otherwise the beacon interval may be affected.
Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:06 +0000 (15:24 +0800)]
rtw88: add support for random mac scan
When driver uses random mac address to scan, the unicast probe response
will not be received because the addr1 is not matched. Configure port
address by requested mac address to receive probe response from AP.
To support random mac scan, we need to configure the mac address during
scan period to receive unicast prop_resp. After scan is completed,
configure the mac address back to the original one that the port used.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Yan-Hsuan Chuang [Fri, 14 Jun 2019 07:24:05 +0000 (15:24 +0800)]
rtw88: add fast xmit support
With dynamic power save support, rtw88 is able to support fast tx
path, claim it to mac80211.
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Greg Kroah-Hartman [Wed, 12 Jun 2019 14:26:55 +0000 (16:26 +0200)]
iwlegacy: 4965: no need to check return value of debugfs_create functions
When calling debugfs functions, there is no need to ever check the
return value. This driver was saving the debugfs file away to be
removed at a later time. However, the 80211 core would delete the whole
directory that the debugfs files are created in, after it asks the
driver to do the deletion, so just rely on the 80211 core to do all of
the cleanup for us, making us not need to keep a pointer to the dentries
around at all.
This cleans up the structure of the driver data a bit and makes the code
a tiny bit smaller.
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Greg Kroah-Hartman [Wed, 12 Jun 2019 14:26:54 +0000 (16:26 +0200)]
iwlegacy: 3945: no need to check return value of debugfs_create functions
When calling debugfs functions, there is no need to ever check the
return value. This driver was saving the debugfs file away to be
removed at a later time. However, the 80211 core would delete the whole
directory that the debugfs files are created in, after it asks the
driver to do the deletion, so just rely on the 80211 core to do all of
the cleanup for us, making us not need to keep a pointer to the dentries
around at all.
This cleans up the structure of the driver data a bit and makes the code
a tiny bit smaller.
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Michael Büsch [Mon, 10 Jun 2019 18:49:27 +0000 (20:49 +0200)]
ssb/gpio: Remove unnecessary WARN_ON from driver_gpio
The WARN_ON triggers on older BCM4401-B0 100Base-TX ethernet controllers.
The warning serves no purpose. So let's just remove it.
Reported-by: H Buus <ubuntu@hbuus.com>
Signed-off-by: Michael Büsch <m@bues.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Colin Ian King [Sat, 8 Jun 2019 10:58:00 +0000 (11:58 +0100)]
rtlwifi: rtl8188ee: remove redundant assignment to rtstatus
Variable rtstatus is being initialized with a value that is never read
as rtstatus is being re-assigned a little later on. The assignment is
redundant and hence can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Gustavo A. R. Silva [Fri, 7 Jun 2019 19:17:45 +0000 (14:17 -0500)]
qtnfmac: Use struct_size() in kzalloc()
One of the more common cases of allocation size calculations is finding
the size of a structure that has a zero-sized array at the end, along
with memory for some number of elements for that array. For example:
struct ieee80211_regdomain {
...
struct ieee80211_reg_rule reg_rules[];
};
instance = kzalloc(sizeof(*mac->rd) +
sizeof(struct ieee80211_reg_rule) *
count, GFP_KERNEL);
Instead of leaving these open-coded and prone to type mistakes, we can
now use the new struct_size() helper:
instance = kzalloc(struct_size(instance, reg_rules, count), GFP_KERNEL);
This code was detected with the help of Coccinelle.
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Lorenzo Bianconi [Fri, 7 Jun 2019 11:48:10 +0000 (13:48 +0200)]
mt7601u: fix possible memory leak when the device is disconnected
When the device is disconnected while passing traffic it is possible
to receive out of order urbs causing a memory leak since the skb linked
to the current tx urb is not removed. Fix the issue deallocating the skb
cleaning up the tx ring. Moreover this patch fixes the following kernel
warning
[ 57.480771] usb 1-1: USB disconnect, device number 2
[ 57.483451] ------------[ cut here ]------------
[ 57.483462] TX urb mismatch
[ 57.483481] WARNING: CPU: 1 PID: 32 at drivers/net/wireless/mediatek/mt7601u/dma.c:245 mt7601u_complete_tx+0x165/00
[ 57.483483] Modules linked in:
[ 57.483496] CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.2.0-rc1+ #72
[ 57.483498] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014
[ 57.483502] Workqueue: usb_hub_wq hub_event
[ 57.483507] RIP: 0010:mt7601u_complete_tx+0x165/0x1e0
[ 57.483510] Code: 8b b5 10 04 00 00 8b 8d 14 04 00 00 eb 8b 80 3d b1 cb e1 00 00 75 9e 48 c7 c7 a4 ea 05 82 c6 05 f
[ 57.483513] RSP: 0000:
ffffc900000a0d28 EFLAGS:
00010092
[ 57.483516] RAX:
000000000000000f RBX:
ffff88802c0a62c0 RCX:
ffffc900000a0c2c
[ 57.483518] RDX:
0000000000000000 RSI:
0000000000000000 RDI:
ffffffff810a8371
[ 57.483520] RBP:
ffff88803ced6858 R08:
0000000000000000 R09:
0000000000000001
[ 57.483540] R10:
0000000000000002 R11:
0000000000000000 R12:
0000000000000046
[ 57.483542] R13:
ffff88802c0a6c88 R14:
ffff88803baab540 R15:
ffff88803a0cc078
[ 57.483548] FS:
0000000000000000(0000) GS:
ffff88803eb00000(0000) knlGS:
0000000000000000
[ 57.483550] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 57.483552] CR2:
000055e7f6780100 CR3:
0000000028c86000 CR4:
00000000000006a0
[ 57.483554] DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
[ 57.483556] DR3:
0000000000000000 DR6:
00000000fffe0ff0 DR7:
0000000000000400
[ 57.483559] Call Trace:
[ 57.483561] <IRQ>
[ 57.483565] __usb_hcd_giveback_urb+0x77/0xe0
[ 57.483570] xhci_giveback_urb_in_irq.isra.0+0x8b/0x140
[ 57.483574] handle_cmd_completion+0xf5b/0x12c0
[ 57.483577] xhci_irq+0x1f6/0x1810
[ 57.483581] ? lockdep_hardirqs_on+0x9e/0x180
[ 57.483584] ? _raw_spin_unlock_irq+0x24/0x30
[ 57.483588] __handle_irq_event_percpu+0x3a/0x260
[ 57.483592] handle_irq_event_percpu+0x1c/0x60
[ 57.483595] handle_irq_event+0x2f/0x4c
[ 57.483599] handle_edge_irq+0x7e/0x1a0
[ 57.483603] handle_irq+0x17/0x20
[ 57.483607] do_IRQ+0x54/0x110
[ 57.483610] common_interrupt+0xf/0xf
[ 57.483612] </IRQ>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Lorenzo Bianconi [Fri, 7 Jun 2019 11:48:09 +0000 (13:48 +0200)]
mt7601u: do not schedule rx_tasklet when the device has been disconnected
Do not schedule rx_tasklet when the usb dongle is disconnected.
Moreover do not grub rx_lock in mt7601u_kill_rx since usb_poison_urb
can run concurrently with urb completion and we can unlink urbs from rx
ring in any order.
This patch fixes the common kernel warning reported when
the device is removed.
[ 24.921354] usb 3-14: USB disconnect, device number 7
[ 24.921593] ------------[ cut here ]------------
[ 24.921594] RX urb mismatch
[ 24.921675] WARNING: CPU: 4 PID: 163 at drivers/net/wireless/mediatek/mt7601u/dma.c:200 mt7601u_complete_rx+0xcb/0xd0 [mt7601u]
[ 24.921769] CPU: 4 PID: 163 Comm: kworker/4:2 Tainted: G OE 4.19.31-041931-generic #
201903231635
[ 24.921770] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P1.30 05/23/2014
[ 24.921782] Workqueue: usb_hub_wq hub_event
[ 24.921797] RIP: 0010:mt7601u_complete_rx+0xcb/0xd0 [mt7601u]
[ 24.921800] RSP: 0018:
ffff9bd9cfd03d08 EFLAGS:
00010086
[ 24.921802] RAX:
0000000000000000 RBX:
ffff9bd9bf043540 RCX:
0000000000000006
[ 24.921803] RDX:
0000000000000007 RSI:
0000000000000096 RDI:
ffff9bd9cfd16420
[ 24.921804] RBP:
ffff9bd9cfd03d28 R08:
0000000000000002 R09:
00000000000003a8
[ 24.921805] R10:
0000002f485fca34 R11:
0000000000000000 R12:
ffff9bd9bf043c1c
[ 24.921806] R13:
ffff9bd9c62fa3c0 R14:
0000000000000082 R15:
0000000000000000
[ 24.921807] FS:
0000000000000000(0000) GS:
ffff9bd9cfd00000(0000) knlGS:
0000000000000000
[ 24.921808] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
[ 24.921808] CR2:
00007fb2648b0000 CR3:
0000000142c0a004 CR4:
00000000001606e0
[ 24.921809] Call Trace:
[ 24.921812] <IRQ>
[ 24.921819] __usb_hcd_giveback_urb+0x8b/0x140
[ 24.921821] usb_hcd_giveback_urb+0xca/0xe0
[ 24.921828] xhci_giveback_urb_in_irq.isra.42+0x82/0xf0
[ 24.921834] handle_cmd_completion+0xe02/0x10d0
[ 24.921837] xhci_irq+0x274/0x4a0
[ 24.921838] xhci_msi_irq+0x11/0x20
[ 24.921851] __handle_irq_event_percpu+0x44/0x190
[ 24.921856] handle_irq_event_percpu+0x32/0x80
[ 24.921861] handle_irq_event+0x3b/0x5a
[ 24.921867] handle_edge_irq+0x80/0x190
[ 24.921874] handle_irq+0x20/0x30
[ 24.921889] do_IRQ+0x4e/0xe0
[ 24.921891] common_interrupt+0xf/0xf
[ 24.921892] </IRQ>
[ 24.921900] RIP: 0010:usb_hcd_flush_endpoint+0x78/0x180
[ 24.921354] usb 3-14: USB disconnect, device number 7
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Colin Ian King [Fri, 31 May 2019 14:14:12 +0000 (15:14 +0100)]
rtlwifi: remove redundant assignment to variable k
The assignment of 0 to variable k is never read once we break out of
the loop, so the assignment is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Colin Ian King [Thu, 30 May 2019 18:40:44 +0000 (19:40 +0100)]
rtlwifi: remove redundant assignment to variable badworden
The variable badworden is assigned with a value that is never read and
it is re-assigned a new value immediately afterwards. The assignment is
redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Ping-Ke Shih [Wed, 29 May 2019 06:57:30 +0000 (14:57 +0800)]
rtlwifi: rtl8192cu: fix error handle when usb probe failed
rtl_usb_probe() must do error handle rtl_deinit_core() only if
rtl_init_core() is done, otherwise goto error_out2.
| usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
| rtl_usb: reg 0xf0, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0
| rtl8192cu: Chip version 0x10
| rtl_usb: reg 0xa, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0
| rtl_usb: Too few input end points found
| INFO: trying to register non-static key.
| the code is fine but needs lockdep annotation.
| turning off the locking correctness validator.
| CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
| Google 01/01/2011
| Workqueue: usb_hub_wq hub_event
| Call Trace:
| __dump_stack lib/dump_stack.c:77 [inline]
| dump_stack+0xe8/0x16e lib/dump_stack.c:113
| assign_lock_key kernel/locking/lockdep.c:786 [inline]
| register_lock_class+0x11b8/0x1250 kernel/locking/lockdep.c:1095
| __lock_acquire+0xfb/0x37c0 kernel/locking/lockdep.c:3582
| lock_acquire+0x10d/0x2f0 kernel/locking/lockdep.c:4211
| __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
| _raw_spin_lock_irqsave+0x44/0x60 kernel/locking/spinlock.c:152
| rtl_c2hcmd_launcher+0xd1/0x390
| drivers/net/wireless/realtek/rtlwifi/base.c:2344
| rtl_deinit_core+0x25/0x2d0 drivers/net/wireless/realtek/rtlwifi/base.c:574
| rtl_usb_probe.cold+0x861/0xa70
| drivers/net/wireless/realtek/rtlwifi/usb.c:1093
| usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361
| really_probe+0x2da/0xb10 drivers/base/dd.c:509
| driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
| __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
| bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
| __device_attach+0x223/0x3a0 drivers/base/dd.c:844
| bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
| device_add+0xad2/0x16e0 drivers/base/core.c:2106
| usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
| generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
| usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
| really_probe+0x2da/0xb10 drivers/base/dd.c:509
| driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
| __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
| bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
| __device_attach+0x223/0x3a0 drivers/base/dd.c:844
| bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
| device_add+0xad2/0x16e0 drivers/base/core.c:2106
| usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
| hub_port_connect drivers/usb/core/hub.c:5089 [inline]
| hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
| port_event drivers/usb/core/hub.c:5350 [inline]
| hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
| process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
| worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
| kthread+0x313/0x420 kernel/kthread.c:253
| ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Reported-by: syzbot+1fcc5ef45175fc774231@syzkaller.appspotmail.com
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Swati Kushwaha [Fri, 21 Jun 2019 14:14:44 +0000 (19:44 +0530)]
mwifiex: ignore processing invalid command response
Firmware can send invalid command response, the processing of
which can attempt to modify unexpected context and cause issues.
To fix this, driver should check that the command response ID is
same as the one it downloaded, and ignore processing of invalid
response.
Signed-off-by: Swati Kushwaha <swatiuma@marvell.com>
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Sharvari Harisangam [Wed, 12 Jun 2019 15:12:11 +0000 (20:42 +0530)]
mwifiex: update set_mac_address logic
In set_mac_address, driver check for interfaces with same bss_type
For first STA entry, this would return 3 interfaces since all priv's have
bss_type as 0 due to kzalloc. Thus mac address gets changed for STA
unexpected. This patch adds check for first STA and avoids mac address
change. This patch also adds mac_address change for p2p based on bss_num
type.
Signed-off-by: Sharvari Harisangam <sharvari@marvell.com>
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Brian Norris [Tue, 4 Jun 2019 17:31:44 +0000 (10:31 -0700)]
mwifiex: print PCI mmap with %pK
Unadorned '%p' has restrictive policies these days, such that it usually
just prints garbage at early boot (see
Documentation/core-api/printk-formats.rst, "kernel will print
``(ptrval)`` until it gathers enough entropy"). Annotating with %pK
(for "kernel pointer") allows the kptr_restrict sysctl to control
printing policy better.
We might just as well drop this message entirely, but this fix was easy
enough for now.
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Brian Norris [Tue, 4 Jun 2019 17:28:58 +0000 (10:28 -0700)]
mwifiex: drop 'set_consistent_dma_mask' log message
This message is pointless.
While we're at it, include the error code in the error message, which is
not pointless.
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Alan Stern [Mon, 20 May 2019 14:44:21 +0000 (10:44 -0400)]
p54usb: Fix race between disconnect and firmware loading
The syzbot fuzzer found a bug in the p54 USB wireless driver. The
issue involves a race between disconnect and the firmware-loader
callback routine, and it has several aspects.
One big problem is that when the firmware can't be loaded, the
callback routine tries to unbind the driver from the USB _device_ (by
calling device_release_driver) instead of from the USB _interface_ to
which it is actually bound (by calling usb_driver_release_interface).
The race involves access to the private data structure. The driver's
disconnect handler waits for a completion that is signalled by the
firmware-loader callback routine. As soon as the completion is
signalled, you have to assume that the private data structure may have
been deallocated by the disconnect handler -- even if the firmware was
loaded without errors. However, the callback routine does access the
private data several times after that point.
Another problem is that, in order to ensure that the USB device
structure hasn't been freed when the callback routine runs, the driver
takes a reference to it. This isn't good enough any more, because now
that the callback routine calls usb_driver_release_interface, it has
to ensure that the interface structure hasn't been freed.
Finally, the driver takes an unnecessary reference to the USB device
structure in the probe function and drops the reference in the
disconnect handler. This extra reference doesn't accomplish anything,
because the USB core already guarantees that a device structure won't
be deallocated while a driver is still bound to any of its interfaces.
To fix these problems, this patch makes the following changes:
Call usb_driver_release_interface() rather than
device_release_driver().
Don't signal the completion until after the important
information has been copied out of the private data structure,
and don't refer to the private data at all thereafter.
Lock udev (the interface's parent) before unbinding the driver
instead of locking udev->parent.
During the firmware loading process, take a reference to the
USB interface instead of the USB device.
Don't take an unnecessary reference to the device during probe
(and then don't drop it during disconnect).
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Jia-Ju Bai [Sat, 4 May 2019 09:10:00 +0000 (17:10 +0800)]
b43: Avoid possible double calls to b43_one_core_detach()
In b43_request_firmware(), when ieee80211_register_hw() fails,
b43_one_core_detach() is called. In b43_bcma_remove() and
b43_ssb_remove(), b43_one_core_detach() is called again. In this case,
null-pointer dereferences and double-free problems can occur when
the driver is removed.
To fix this bug, the call to b43_one_core_detach() in
b43_request_firmware() is deleted.
This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Colin Ian King [Tue, 14 May 2019 21:14:06 +0000 (22:14 +0100)]
libertas: fix spelling mistake "Donwloading" -> "Downloading"
There is are two spelling mistakes in lbtf_deb_usb2 messages, fix these.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Sat, 25 May 2019 14:48:44 +0000 (22:48 +0800)]
rtlwifi: btcoex: remove unused function exhalbtc_stack_operation_notify
There is no callers in tree, so can be removed.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Sat, 25 May 2019 14:46:34 +0000 (22:46 +0800)]
rtlwifi: btcoex: Remove set but not used variable 'len' and 'asso_type_v2'
Fixes gcc '-Wunused-but-set-variable' warning:
drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c: In function rtl_btc_btmpinfo_notify:
drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c:319:17: warning: variable len set but not used [-Wunused-but-set-variable]
drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c: In function exhalbtc_connect_notify:
drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c:1581:16: warning: variable asso_type_v2 set but not used [-Wunused-but-set-variable]
'len' is never used since commit
6aad6075ccd5 ("rtlwifi:
Add BT_MP_INFO to c2h handler.") so can be removed.
'asso_type_v2' is not used since introduction in
commit
0843e98a3b9a ("rtlwifi: btcoex: add assoc
type v2 to connection notify")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
YueHaibing [Sat, 25 May 2019 14:43:32 +0000 (22:43 +0800)]
rtlwifi: rtl8821ae: Remove set but not used variables 'cur_txokcnt' and 'b_last_is_cur_rdl_state'
Fixes gcc '-Wunused-but-set-variable' warning:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c: In function rtl8821ae_dm_check_rssi_monitor:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:658:6: warning: variable cur_txokcnt set but not used [-Wunused-but-set-variable]
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c: In function rtl8821ae_dm_check_edca_turbo:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:2657:7: warning: variable b_last_is_cur_rdl_state set but not used [-Wunused-but-set-variable]
They are never used so can be removed.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Larry Finger [Mon, 20 May 2019 17:23:59 +0000 (12:23 -0500)]
rtlwifi: rtl8821ae: Convert inline routines to little-endian words
In this step, the read/write routines for the descriptors are converted
to use __le32 quantities, thus a lot of casts can be removed. Callback
routines still use the 8-bit arrays, but these are changed within the
specified routine.
The macro that cleared a descriptor has now been converted into an inline
routine.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Larry Finger [Mon, 20 May 2019 17:23:58 +0000 (12:23 -0500)]
rtlwifi: rtl8821ae: Convert macros that set descriptor
As a first step in the conversion, the macros that set the RX and TX
descriptors are converted to static inline routines, and the names are
changed from upper to lower case. To minimize the changes in a given
step, the input descriptor information is left as as a byte array
(u8 *), even though it should be a little-endian word array (__le32 *).
That will be changed later.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Larry Finger [Mon, 20 May 2019 17:23:57 +0000 (12:23 -0500)]
rtlwifi: rtl8821ae: Replace local bit manipulation macros
This driver uses a set of local macros to manipulate the RX and TX
descriptors, which are all little-endian quantities. These macros
are replaced by the bitfield macros le32p_replace_bits() and
le32_get_bits(). In several places, the macros operated on an entire
32-bit word. In these cases, a direct read or replacement is used.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Larry Finger [Mon, 20 May 2019 17:23:56 +0000 (12:23 -0500)]
rtlwifi: rtl8821ae: Remove unused GET_XXX and SET_XXX descriptor macros
As the first step in converting from macros that get/set information
in the RX and TX descriptors, unused macros are being removed.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Ping-Ke Shih [Fri, 10 May 2019 08:03:33 +0000 (16:03 +0800)]
rtlwifi: 8192de: use le32 to access cckswing tables
The cckswing tables cckswing_table_ch1ch13 and cckswing_table_ch14 are
u8 array in little-endian order. To compare four u8 value with register
u32 value, cast the value to cpu order.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Ping-Ke Shih [Fri, 10 May 2019 08:03:32 +0000 (16:03 +0800)]
rtlwifi: 8192de: Fix used uninitialized variables in power tracking
ofdm_index_old[] is the index of ofdmswing_table[], and used to indicate
initial value of ROFDM0_X{A,B}TXIQIMBALANCE in rtl8192de_phy_reg_2tarray[]
table, and the initial value is corresponding to calibration thermal value
written in efuse, namely rtlefuse->eeprom_thermalmeter. Then, local
variable ofdm_index_old[] save to rtlpriv->dm.ofdm_index[] for operational
use.
If thermal value (temperature) is increasing, output TX power is lower.
So, we calculate the delta between current and calibration thermal value,
then add power to yield expected and the same output TX power.
Thus, ofdm_index[] should be initialized as rtlpriv->dm.ofdm_index[], and
shift to proper index depends on delta of thermal value. Then, new power
value ofdmswing_table[ofdm_index[]] is written to register.
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Ping-Ke Shih [Fri, 10 May 2019 08:03:31 +0000 (16:03 +0800)]
rtlwifi: 8192de: make tables to be 'static const'
This can reduce code size 264 bytes, and make code more readable.
text data bss dec hex filename
Before: 13586 0 16 13602 3522 rtl8192de/dm.o
After: 13322 0 16 13338 341a rtl8192de/dm.o
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Ping-Ke Shih [Fri, 10 May 2019 08:03:30 +0000 (16:03 +0800)]
rtlwifi: 8192de: Reduce indentation and fix coding style
This commit doesn't change logic at all. Since indentation is lower, the
wrapped statements can be put in single line that will become more
readable.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Christian Lamparter [Fri, 24 May 2019 21:33:08 +0000 (23:33 +0200)]
p54: Support boottime in scan results
This patch fixes an issue with wpa_supplicant dropping all scan
results because their where considered to be "too old" (e.g.:
"skip - scan result not recent enough (121056.086325 seconds too old)")
which is very weird because this looks like that the scan results have
been received before a scan started. This is due to the inaccuracy of
the default timing mechanism for calculating the BSS entry age.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Christian Lamparter [Sat, 18 May 2019 20:05:48 +0000 (22:05 +0200)]
p54: fix crash during initialization
This patch fixes a crash that got introduced when the
mentioned patch replaced the direct list_head access
with skb_peek_tail(). When the device is starting up,
there are no entries in the queue, so previously to
"Use skb_peek_tail() instead..." the target_skb would
end up as the tail and head pointer which then could
be used by __skb_queue_after to fill the empty queue.
With skb_peek_tail() in its place will instead just
return NULL which then causes a crash in the
__skb_queue_after().
| BUG: unable to handle kernel NULL pointer dereference at 000000
| #PF error: [normal kernel read fault]
| PGD 0 P4D 0
| Oops: 0000 [#1] SMP PTI
| CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: GO 5.1.0-rc7-wt+ #218
| Hardware name: MSI MS-7816/Z87-G43 (MS-7816), BIOS V1.11 05/09/2015
| Workqueue: events request_firmware_work_func
| RIP: 0010:p54_tx_pending+0x10f/0x1b0 [p54common]
| Code: 78 06 80 78 28 00 74 6d <48> 8b 07 49 89 7c 24 08 49 89 04 24 4
| RSP: 0018:
ffffa81c81927d90 EFLAGS:
00010086
| RAX:
ffff9bbaaf131048 RBX:
0000000000020670 RCX:
0000000000020264
| RDX:
ffff9bbaa976d660 RSI:
0000000000000202 RDI:
0000000000000000
| RBP:
ffff9bbaa976d620 R08:
00000000000006c0 R09:
ffff9bbaa976d660
| R10:
0000000000000000 R11:
ffffe8480dbc5900 R12:
ffff9bbb45e87700
| R13:
ffff9bbaa976d648 R14:
ffff9bbaa976d674 R15:
ffff9bbaaf131048
| FS:
0000000000000000(0000) GS:
ffff9bbb5ec00000(0000) knlGS:00000
| CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
| CR2:
0000000000000000 CR3:
00000003695fc003 CR4:
00000000001606f0
| Call Trace:
| p54_download_eeprom+0xbe/0x120 [p54common]
| p54_read_eeprom+0x7f/0xc0 [p54common]
| p54u_load_firmware_cb+0xe0/0x160 [p54usb]
| request_firmware_work_func+0x42/0x80
| process_one_work+0x1f5/0x3f0
| worker_thread+0x28/0x3c0
Cc: stable@vger.kernel.org
Fixes:
e3554197fc8f ("p54: Use skb_peek_tail() instead of direct head pointer accesses.")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>