summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* rt2x00: add restart hwStanislaw Gruszka2019-06-254-2/+54
| | | | | | | | Add ieee80211_restart_hw() to watchdog and debugfs file for testing if restart works as expected. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2800: do not nullify initialization vector dataStanislaw Gruszka2019-06-251-5/+4
| | | | | | | | | | If we restart hw we should keep existing IV (initialization vector) otherwise HW encryption will be broken after restart. Also fix some coding style issues on the way. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2800: add pre_reset_hw callbackStanislaw Gruszka2019-06-256-0/+24
| | | | | | | | Add routine to cleanup interfaces data before hw reset as ieee80211_restart_hw() will do setup interfaces again. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2800: initial watchdog implementationStanislaw Gruszka2019-06-256-0/+67
| | | | | | | | | | | | Add watchdog for rt2800 devices. For now it only detect hung and print error. [Note: I verified that printing messages from process context is fine on MT7620 (WT3020) platform that have problem when printk is called from interrupt context]. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2800: add helpers for reading dma done indexStanislaw Gruszka2019-06-256-0/+52
| | | | | | | | | | | | | For mmio we do not properlly trace dma done Q_INDEX_DMA_DONE index for TX queues. That would require implementing INT_SOURCE_CSR_*_DMA_DONE interrupts, what is rather not worth to do due to adding extra CPU load (small but still somewhat not necessary otherwise). We can just read TX DMA done indexes from registers directly. What will be used by watchdog. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rt2x00: allow to specify watchdog intervalStanislaw Gruszka2019-06-252-4/+10
| | | | | | | | Allow subdriver to change watchdog interval by intialize link->watchdog_interval value before rt2x00link_register(). Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* p54: remove dead branch in op_conf_tx callbackChristian Lamparter2019-06-251-6/+3
| | | | | | | | | This patch removes the error branch for (queue > dev->queues). It is no longer needed anymore as the "queue" value is validated by cfg80211's parse_txq_params() before the driver code gets called. Signed-off-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: fix typo rtw_writ16_setTzu-En Huang2019-06-251-1/+1
| | | | | | | | rtw_writ16_set should be rtw_write16_set Signed-off-by: Tzu-En Huang <tehuang@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: rsvd page should go though management queueYan-Hsuan Chuang2019-06-251-1/+1
| | | | | | | | | The hardware default uses management queue to transmit frames that are downloaded into reserved page, so we need to clearly assign the frames to use qsel in TX_DESC_QSEL_MGMT to avoid using wrong queue. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: restore DACK results to save timeYan-Hsuan Chuang2019-06-253-12/+355
| | | | | | | | | | | | | DACK is done right after the hardware has been turned on, which means it will be done every time we leave the IDLE state. But it takes ~2 seconds to finish DACK. We can back up the results and restore them. And it only takes a few milliseconds to restore the results to the hardware, saving a lot of time. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: power on again if it was already onYan-Hsuan Chuang2019-06-251-1/+7
| | | | | | | | | We could fail to power on because it was already on. If the return value is -EALREADY, power off and then power on again to turn on the hardware as expected. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: 8822c: use more accurate ofdm fa countingYan-Hsuan Chuang2019-06-252-4/+26
| | | | | | | | | | | 8822c used to count OFDM FA count by subtracting tx count from FA count. But it need to substract more counters to be accurate. However, we can count it by adding up all of the FA counters we want. And it is simpler to add than list all of the components to substract. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: 8822c: disable rx clock gating before counter resetYan-Hsuan Chuang2019-06-252-0/+6
| | | | | | | | | Driver Could fail to reset counter if rx clock gating is not disabled. So we need to disable rx clock gating before resetting counters. Otherwise counters may increase unexpected. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: 8822c: update channel and bandwidth BB settingChien-Hsun Liao2019-06-252-8/+56
| | | | | | | | | | | | | In 2G channels, the cck source and rxagc should be set to different values based on different bandwidth to increase the performance of rx sensitivity. To improve rx throughput performance, the values of sbd subtune and pt_opt should be changed in different bandwidth. Signed-off-by: Chien-Hsun Liao <ben.liao@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: 8822c: add rf write protection when switching channelChien-Hsun Liao2019-06-251-4/+9
| | | | | | | | | | | | | | | | | | | Collision of writing rf registers could occur if the driver writes rf registers by direct write while the hardware is writing other rf registers by pi write simultaneously. Hardware pi write can be triggered by rf calibrations sometimes, so the driver can not always write rf registers by direct write protection. Direct write protection can make sure that there is no hardware pi write during the direct write. According to some experiments, if we add direct write protection when switching channel, the performance of rf calibration will not be affected. Signed-off-by: Chien-Hsun Liao <ben.liao@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: add beacon function settingChin-Yen Lee2019-06-253-0/+21
| | | | | | | | | | | | | | Add beacon function setting routines for each hardware port. If beacon function is not enabled, the hardware is not able to synchronize with AP's beacon and can miss the beacons under some scenarios such as PS mode. For AP and Adhoc modes that require to send beacons, do not update the TSF, otherwise the beacon interval may be affected. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: add support for random mac scanYan-Hsuan Chuang2019-06-252-0/+21
| | | | | | | | | | | | | When driver uses random mac address to scan, the unicast probe response will not be received because the addr1 is not matched. Configure port address by requested mac address to receive probe response from AP. To support random mac scan, we need to configure the mac address during scan period to receive unicast prop_resp. After scan is completed, configure the mac address back to the original one that the port used. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtw88: add fast xmit supportYan-Hsuan Chuang2019-06-251-0/+1
| | | | | | | | With dynamic power save support, rtw88 is able to support fast tx path, claim it to mac80211. Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* iwlegacy: 4965: no need to check return value of debugfs_create functionsGreg Kroah-Hartman2019-06-252-27/+8
| | | | | | | | | | | | | | | | | | | | | When calling debugfs functions, there is no need to ever check the return value. This driver was saving the debugfs file away to be removed at a later time. However, the 80211 core would delete the whole directory that the debugfs files are created in, after it asks the driver to do the deletion, so just rely on the 80211 core to do all of the cleanup for us, making us not need to keep a pointer to the dentries around at all. This cleans up the structure of the driver data a bit and makes the code a tiny bit smaller. Cc: Stanislaw Gruszka <sgruszka@redhat.com> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* iwlegacy: 3945: no need to check return value of debugfs_create functionsGreg Kroah-Hartman2019-06-252-15/+2
| | | | | | | | | | | | | | | | | | | | | When calling debugfs functions, there is no need to ever check the return value. This driver was saving the debugfs file away to be removed at a later time. However, the 80211 core would delete the whole directory that the debugfs files are created in, after it asks the driver to do the deletion, so just rely on the 80211 core to do all of the cleanup for us, making us not need to keep a pointer to the dentries around at all. This cleans up the structure of the driver data a bit and makes the code a tiny bit smaller. Cc: Stanislaw Gruszka <sgruszka@redhat.com> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* ssb/gpio: Remove unnecessary WARN_ON from driver_gpioMichael Büsch2019-06-251-6/+0
| | | | | | | | | The WARN_ON triggers on older BCM4401-B0 100Base-TX ethernet controllers. The warning serves no purpose. So let's just remove it. Reported-by: H Buus <ubuntu@hbuus.com> Signed-off-by: Michael Büsch <m@bues.ch> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8188ee: remove redundant assignment to rtstatusColin Ian King2019-06-251-1/+1
| | | | | | | | | | Variable rtstatus is being initialized with a value that is never read as rtstatus is being re-assigned a little later on. The assignment is redundant and hence can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* qtnfmac: Use struct_size() in kzalloc()Gustavo A. R. Silva2019-06-251-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct ieee80211_regdomain { ... struct ieee80211_reg_rule reg_rules[]; }; instance = kzalloc(sizeof(*mac->rd) + sizeof(struct ieee80211_reg_rule) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kzalloc(struct_size(instance, reg_rules, count), GFP_KERNEL); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mt7601u: fix possible memory leak when the device is disconnectedLorenzo Bianconi2019-06-252-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the device is disconnected while passing traffic it is possible to receive out of order urbs causing a memory leak since the skb linked to the current tx urb is not removed. Fix the issue deallocating the skb cleaning up the tx ring. Moreover this patch fixes the following kernel warning [ 57.480771] usb 1-1: USB disconnect, device number 2 [ 57.483451] ------------[ cut here ]------------ [ 57.483462] TX urb mismatch [ 57.483481] WARNING: CPU: 1 PID: 32 at drivers/net/wireless/mediatek/mt7601u/dma.c:245 mt7601u_complete_tx+0x165/00 [ 57.483483] Modules linked in: [ 57.483496] CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.2.0-rc1+ #72 [ 57.483498] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014 [ 57.483502] Workqueue: usb_hub_wq hub_event [ 57.483507] RIP: 0010:mt7601u_complete_tx+0x165/0x1e0 [ 57.483510] Code: 8b b5 10 04 00 00 8b 8d 14 04 00 00 eb 8b 80 3d b1 cb e1 00 00 75 9e 48 c7 c7 a4 ea 05 82 c6 05 f [ 57.483513] RSP: 0000:ffffc900000a0d28 EFLAGS: 00010092 [ 57.483516] RAX: 000000000000000f RBX: ffff88802c0a62c0 RCX: ffffc900000a0c2c [ 57.483518] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff810a8371 [ 57.483520] RBP: ffff88803ced6858 R08: 0000000000000000 R09: 0000000000000001 [ 57.483540] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000046 [ 57.483542] R13: ffff88802c0a6c88 R14: ffff88803baab540 R15: ffff88803a0cc078 [ 57.483548] FS: 0000000000000000(0000) GS:ffff88803eb00000(0000) knlGS:0000000000000000 [ 57.483550] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.483552] CR2: 000055e7f6780100 CR3: 0000000028c86000 CR4: 00000000000006a0 [ 57.483554] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.483556] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.483559] Call Trace: [ 57.483561] <IRQ> [ 57.483565] __usb_hcd_giveback_urb+0x77/0xe0 [ 57.483570] xhci_giveback_urb_in_irq.isra.0+0x8b/0x140 [ 57.483574] handle_cmd_completion+0xf5b/0x12c0 [ 57.483577] xhci_irq+0x1f6/0x1810 [ 57.483581] ? lockdep_hardirqs_on+0x9e/0x180 [ 57.483584] ? _raw_spin_unlock_irq+0x24/0x30 [ 57.483588] __handle_irq_event_percpu+0x3a/0x260 [ 57.483592] handle_irq_event_percpu+0x1c/0x60 [ 57.483595] handle_irq_event+0x2f/0x4c [ 57.483599] handle_edge_irq+0x7e/0x1a0 [ 57.483603] handle_irq+0x17/0x20 [ 57.483607] do_IRQ+0x54/0x110 [ 57.483610] common_interrupt+0xf/0xf [ 57.483612] </IRQ> Acked-by: Jakub Kicinski <kubakici@wp.pl> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mt7601u: do not schedule rx_tasklet when the device has been disconnectedLorenzo Bianconi2019-06-251-15/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not schedule rx_tasklet when the usb dongle is disconnected. Moreover do not grub rx_lock in mt7601u_kill_rx since usb_poison_urb can run concurrently with urb completion and we can unlink urbs from rx ring in any order. This patch fixes the common kernel warning reported when the device is removed. [ 24.921354] usb 3-14: USB disconnect, device number 7 [ 24.921593] ------------[ cut here ]------------ [ 24.921594] RX urb mismatch [ 24.921675] WARNING: CPU: 4 PID: 163 at drivers/net/wireless/mediatek/mt7601u/dma.c:200 mt7601u_complete_rx+0xcb/0xd0 [mt7601u] [ 24.921769] CPU: 4 PID: 163 Comm: kworker/4:2 Tainted: G OE 4.19.31-041931-generic #201903231635 [ 24.921770] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P1.30 05/23/2014 [ 24.921782] Workqueue: usb_hub_wq hub_event [ 24.921797] RIP: 0010:mt7601u_complete_rx+0xcb/0xd0 [mt7601u] [ 24.921800] RSP: 0018:ffff9bd9cfd03d08 EFLAGS: 00010086 [ 24.921802] RAX: 0000000000000000 RBX: ffff9bd9bf043540 RCX: 0000000000000006 [ 24.921803] RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9bd9cfd16420 [ 24.921804] RBP: ffff9bd9cfd03d28 R08: 0000000000000002 R09: 00000000000003a8 [ 24.921805] R10: 0000002f485fca34 R11: 0000000000000000 R12: ffff9bd9bf043c1c [ 24.921806] R13: ffff9bd9c62fa3c0 R14: 0000000000000082 R15: 0000000000000000 [ 24.921807] FS: 0000000000000000(0000) GS:ffff9bd9cfd00000(0000) knlGS:0000000000000000 [ 24.921808] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.921808] CR2: 00007fb2648b0000 CR3: 0000000142c0a004 CR4: 00000000001606e0 [ 24.921809] Call Trace: [ 24.921812] <IRQ> [ 24.921819] __usb_hcd_giveback_urb+0x8b/0x140 [ 24.921821] usb_hcd_giveback_urb+0xca/0xe0 [ 24.921828] xhci_giveback_urb_in_irq.isra.42+0x82/0xf0 [ 24.921834] handle_cmd_completion+0xe02/0x10d0 [ 24.921837] xhci_irq+0x274/0x4a0 [ 24.921838] xhci_msi_irq+0x11/0x20 [ 24.921851] __handle_irq_event_percpu+0x44/0x190 [ 24.921856] handle_irq_event_percpu+0x32/0x80 [ 24.921861] handle_irq_event+0x3b/0x5a [ 24.921867] handle_edge_irq+0x80/0x190 [ 24.921874] handle_irq+0x20/0x30 [ 24.921889] do_IRQ+0x4e/0xe0 [ 24.921891] common_interrupt+0xf/0xf [ 24.921892] </IRQ> [ 24.921900] RIP: 0010:usb_hcd_flush_endpoint+0x78/0x180 [ 24.921354] usb 3-14: USB disconnect, device number 7 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: remove redundant assignment to variable kColin Ian King2019-06-251-3/+1
| | | | | | | | | The assignment of 0 to variable k is never read once we break out of the loop, so the assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: remove redundant assignment to variable badwordenColin Ian King2019-06-251-1/+0
| | | | | | | | | | | The variable badworden is assigned with a value that is never read and it is re-assigned a new value immediately afterwards. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8192cu: fix error handle when usb probe failedPing-Ke Shih2019-06-251-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rtl_usb_probe() must do error handle rtl_deinit_core() only if rtl_init_core() is done, otherwise goto error_out2. | usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 | rtl_usb: reg 0xf0, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0 | rtl8192cu: Chip version 0x10 | rtl_usb: reg 0xa, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0 | rtl_usb: Too few input end points found | INFO: trying to register non-static key. | the code is fine but needs lockdep annotation. | turning off the locking correctness validator. | CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS | Google 01/01/2011 | Workqueue: usb_hub_wq hub_event | Call Trace: | __dump_stack lib/dump_stack.c:77 [inline] | dump_stack+0xe8/0x16e lib/dump_stack.c:113 | assign_lock_key kernel/locking/lockdep.c:786 [inline] | register_lock_class+0x11b8/0x1250 kernel/locking/lockdep.c:1095 | __lock_acquire+0xfb/0x37c0 kernel/locking/lockdep.c:3582 | lock_acquire+0x10d/0x2f0 kernel/locking/lockdep.c:4211 | __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] | _raw_spin_lock_irqsave+0x44/0x60 kernel/locking/spinlock.c:152 | rtl_c2hcmd_launcher+0xd1/0x390 | drivers/net/wireless/realtek/rtlwifi/base.c:2344 | rtl_deinit_core+0x25/0x2d0 drivers/net/wireless/realtek/rtlwifi/base.c:574 | rtl_usb_probe.cold+0x861/0xa70 | drivers/net/wireless/realtek/rtlwifi/usb.c:1093 | usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 | really_probe+0x2da/0xb10 drivers/base/dd.c:509 | driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 | __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 | bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 | __device_attach+0x223/0x3a0 drivers/base/dd.c:844 | bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 | device_add+0xad2/0x16e0 drivers/base/core.c:2106 | usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 | generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 | usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 | really_probe+0x2da/0xb10 drivers/base/dd.c:509 | driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 | __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 | bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 | __device_attach+0x223/0x3a0 drivers/base/dd.c:844 | bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 | device_add+0xad2/0x16e0 drivers/base/core.c:2106 | usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 | hub_port_connect drivers/usb/core/hub.c:5089 [inline] | hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] | port_event drivers/usb/core/hub.c:5350 [inline] | hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432 | process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 | worker_thread+0x9b/0xe20 kernel/workqueue.c:2415 | kthread+0x313/0x420 kernel/kthread.c:253 | ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Reported-by: syzbot+1fcc5ef45175fc774231@syzkaller.appspotmail.com Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: ignore processing invalid command responseSwati Kushwaha2019-06-252-10/+19
| | | | | | | | | | | | Firmware can send invalid command response, the processing of which can attempt to modify unexpected context and cause issues. To fix this, driver should check that the command response ID is same as the one it downloaded, and ignore processing of invalid response. Signed-off-by: Swati Kushwaha <swatiuma@marvell.com> Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: update set_mac_address logicSharvari Harisangam2019-06-251-3/+3
| | | | | | | | | | | | | In set_mac_address, driver check for interfaces with same bss_type For first STA entry, this would return 3 interfaces since all priv's have bss_type as 0 due to kzalloc. Thus mac address gets changed for STA unexpected. This patch adds check for first STA and avoids mac address change. This patch also adds mac_address change for p2p based on bss_num type. Signed-off-by: Sharvari Harisangam <sharvari@marvell.com> Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: print PCI mmap with %pKBrian Norris2019-06-251-1/+1
| | | | | | | | | | | | | | | Unadorned '%p' has restrictive policies these days, such that it usually just prints garbage at early boot (see Documentation/core-api/printk-formats.rst, "kernel will print ``(ptrval)`` until it gathers enough entropy"). Annotating with %pK (for "kernel pointer") allows the kptr_restrict sysctl to control printing policy better. We might just as well drop this message entirely, but this fix was easy enough for now. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: drop 'set_consistent_dma_mask' log messageBrian Norris2019-06-251-2/+1
| | | | | | | | | | This message is pointless. While we're at it, include the error code in the error message, which is not pointless. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* p54usb: Fix race between disconnect and firmware loadingAlan Stern2019-06-251-25/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The syzbot fuzzer found a bug in the p54 USB wireless driver. The issue involves a race between disconnect and the firmware-loader callback routine, and it has several aspects. One big problem is that when the firmware can't be loaded, the callback routine tries to unbind the driver from the USB _device_ (by calling device_release_driver) instead of from the USB _interface_ to which it is actually bound (by calling usb_driver_release_interface). The race involves access to the private data structure. The driver's disconnect handler waits for a completion that is signalled by the firmware-loader callback routine. As soon as the completion is signalled, you have to assume that the private data structure may have been deallocated by the disconnect handler -- even if the firmware was loaded without errors. However, the callback routine does access the private data several times after that point. Another problem is that, in order to ensure that the USB device structure hasn't been freed when the callback routine runs, the driver takes a reference to it. This isn't good enough any more, because now that the callback routine calls usb_driver_release_interface, it has to ensure that the interface structure hasn't been freed. Finally, the driver takes an unnecessary reference to the USB device structure in the probe function and drops the reference in the disconnect handler. This extra reference doesn't accomplish anything, because the USB core already guarantees that a device structure won't be deallocated while a driver is still bound to any of its interfaces. To fix these problems, this patch makes the following changes: Call usb_driver_release_interface() rather than device_release_driver(). Don't signal the completion until after the important information has been copied out of the private data structure, and don't refer to the private data at all thereafter. Lock udev (the interface's parent) before unbinding the driver instead of locking udev->parent. During the firmware loading process, take a reference to the USB interface instead of the USB device. Don't take an unnecessary reference to the device during probe (and then don't drop it during disconnect). Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: syzbot+200d4bb11b23d929335f@syzkaller.appspotmail.com CC: <stable@vger.kernel.org> Acked-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* b43: Avoid possible double calls to b43_one_core_detach()Jia-Ju Bai2019-05-281-6/+1
| | | | | | | | | | | | | | | | In b43_request_firmware(), when ieee80211_register_hw() fails, b43_one_core_detach() is called. In b43_bcma_remove() and b43_ssb_remove(), b43_one_core_detach() is called again. In this case, null-pointer dereferences and double-free problems can occur when the driver is removed. To fix this bug, the call to b43_one_core_detach() in b43_request_firmware() is deleted. This bug is found by a runtime fuzzing tool named FIZZER written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* libertas: fix spelling mistake "Donwloading" -> "Downloading"Colin Ian King2019-05-282-2/+2
| | | | | | | | There is are two spelling mistakes in lbtf_deb_usb2 messages, fix these. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Mukesh Ojha <mojha@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: remove unused function exhalbtc_stack_operation_notifyYueHaibing2019-05-282-25/+0
| | | | | | | There is no callers in tree, so can be removed. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: btcoex: Remove set but not used variable 'len' and 'asso_type_v2'YueHaibing2019-05-282-10/+4
| | | | | | | | | | | | | | | | | | | Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c: In function rtl_btc_btmpinfo_notify: drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c:319:17: warning: variable len set but not used [-Wunused-but-set-variable] drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c: In function exhalbtc_connect_notify: drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c:1581:16: warning: variable asso_type_v2 set but not used [-Wunused-but-set-variable] 'len' is never used since commit 6aad6075ccd5 ("rtlwifi: Add BT_MP_INFO to c2h handler.") so can be removed. 'asso_type_v2' is not used since introduction in commit 0843e98a3b9a ("rtlwifi: btcoex: add assoc type v2 to connection notify") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8821ae: Remove set but not used variables 'cur_txokcnt' and ↵YueHaibing2019-05-281-4/+1
| | | | | | | | | | | | | | | | 'b_last_is_cur_rdl_state' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c: In function rtl8821ae_dm_check_rssi_monitor: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:658:6: warning: variable cur_txokcnt set but not used [-Wunused-but-set-variable] drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c: In function rtl8821ae_dm_check_edca_turbo: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c:2657:7: warning: variable b_last_is_cur_rdl_state set but not used [-Wunused-but-set-variable] They are never used so can be removed. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8821ae: Convert inline routines to little-endian wordsLarry Finger2019-05-283-179/+185
| | | | | | | | | | | | | In this step, the read/write routines for the descriptors are converted to use __le32 quantities, thus a lot of casts can be removed. Callback routines still use the 8-bit arrays, but these are changed within the specified routine. The macro that cleared a descriptor has now been converted into an inline routine. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8821ae: Convert macros that set descriptorLarry Finger2019-05-283-275/+474
| | | | | | | | | | | | As a first step in the conversion, the macros that set the RX and TX descriptors are converted to static inline routines, and the names are changed from upper to lower case. To minimize the changes in a given step, the input descriptor information is left as as a byte array (u8 *), even though it should be a little-endian word array (__le32 *). That will be changed later. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8821ae: Replace local bit manipulation macrosLarry Finger2019-05-282-126/+127
| | | | | | | | | | | This driver uses a set of local macros to manipulate the RX and TX descriptors, which are all little-endian quantities. These macros are replaced by the bitfield macros le32p_replace_bits() and le32_get_bits(). In several places, the macros operated on an entire 32-bit word. In these cases, a direct read or replacement is used. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: rtl8821ae: Remove unused GET_XXX and SET_XXX descriptor macrosLarry Finger2019-05-281-155/+2
| | | | | | | | As the first step in converting from macros that get/set information in the RX and TX descriptors, unused macros are being removed. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: 8192de: use le32 to access cckswing tablesPing-Ke Shih2019-05-281-22/+14
| | | | | | | | | The cckswing tables cckswing_table_ch1ch13 and cckswing_table_ch14 are u8 array in little-endian order. To compare four u8 value with register u32 value, cast the value to cpu order. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: 8192de: Fix used uninitialized variables in power trackingPing-Ke Shih2019-05-281-2/+9
| | | | | | | | | | | | | | | | | | | | | ofdm_index_old[] is the index of ofdmswing_table[], and used to indicate initial value of ROFDM0_X{A,B}TXIQIMBALANCE in rtl8192de_phy_reg_2tarray[] table, and the initial value is corresponding to calibration thermal value written in efuse, namely rtlefuse->eeprom_thermalmeter. Then, local variable ofdm_index_old[] save to rtlpriv->dm.ofdm_index[] for operational use. If thermal value (temperature) is increasing, output TX power is lower. So, we calculate the delta between current and calibration thermal value, then add power to yield expected and the same output TX power. Thus, ofdm_index[] should be initialized as rtlpriv->dm.ofdm_index[], and shift to proper index depends on delta of thermal value. Then, new power value ofdmswing_table[ofdm_index[]] is written to register. Reported-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: 8192de: make tables to be 'static const'Ping-Ke Shih2019-05-281-4/+4
| | | | | | | | | | | This can reduce code size 264 bytes, and make code more readable. text data bss dec hex filename Before: 13586 0 16 13602 3522 rtl8192de/dm.o After: 13322 0 16 13338 341a rtl8192de/dm.o Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* rtlwifi: 8192de: Reduce indentation and fix coding stylePing-Ke Shih2019-05-281-337/+303
| | | | | | | | | This commit doesn't change logic at all. Since indentation is lower, the wrapped statements can be put in single line that will become more readable. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* p54: Support boottime in scan resultsChristian Lamparter2019-05-281-0/+6
| | | | | | | | | | | | This patch fixes an issue with wpa_supplicant dropping all scan results because their where considered to be "too old" (e.g.: "skip - scan result not recent enough (121056.086325 seconds too old)") which is very weird because this looks like that the scan results have been received before a scan started. This is due to the inaccuracy of the default timing mechanism for calculating the BSS entry age. Signed-off-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* p54: fix crash during initializationChristian Lamparter2019-05-281-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a crash that got introduced when the mentioned patch replaced the direct list_head access with skb_peek_tail(). When the device is starting up, there are no entries in the queue, so previously to "Use skb_peek_tail() instead..." the target_skb would end up as the tail and head pointer which then could be used by __skb_queue_after to fill the empty queue. With skb_peek_tail() in its place will instead just return NULL which then causes a crash in the __skb_queue_after(). | BUG: unable to handle kernel NULL pointer dereference at 000000 | #PF error: [normal kernel read fault] | PGD 0 P4D 0 | Oops: 0000 [#1] SMP PTI | CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: GO 5.1.0-rc7-wt+ #218 | Hardware name: MSI MS-7816/Z87-G43 (MS-7816), BIOS V1.11 05/09/2015 | Workqueue: events request_firmware_work_func | RIP: 0010:p54_tx_pending+0x10f/0x1b0 [p54common] | Code: 78 06 80 78 28 00 74 6d <48> 8b 07 49 89 7c 24 08 49 89 04 24 4 | RSP: 0018:ffffa81c81927d90 EFLAGS: 00010086 | RAX: ffff9bbaaf131048 RBX: 0000000000020670 RCX: 0000000000020264 | RDX: ffff9bbaa976d660 RSI: 0000000000000202 RDI: 0000000000000000 | RBP: ffff9bbaa976d620 R08: 00000000000006c0 R09: ffff9bbaa976d660 | R10: 0000000000000000 R11: ffffe8480dbc5900 R12: ffff9bbb45e87700 | R13: ffff9bbaa976d648 R14: ffff9bbaa976d674 R15: ffff9bbaaf131048 | FS: 0000000000000000(0000) GS:ffff9bbb5ec00000(0000) knlGS:00000 | CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | CR2: 0000000000000000 CR3: 00000003695fc003 CR4: 00000000001606f0 | Call Trace: | p54_download_eeprom+0xbe/0x120 [p54common] | p54_read_eeprom+0x7f/0xc0 [p54common] | p54u_load_firmware_cb+0xe0/0x160 [p54usb] | request_firmware_work_func+0x42/0x80 | process_one_work+0x1f5/0x3f0 | worker_thread+0x28/0x3c0 Cc: stable@vger.kernel.org Fixes: e3554197fc8f ("p54: Use skb_peek_tail() instead of direct head pointer accesses.") Signed-off-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* brcmfmac: use strlcpy() instead of strcpy()Neo Jou2019-05-281-1/+1
| | | | | | | | | The function strcpy() is inherently not safe. Though the function works without problems here, it would be better to use other safer function, e.g. strlcpy(), to replace strcpy() still. Signed-off-by: Neo Jou <neojou@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* brcmfmac: fix typos in code commentsWeitao Hou2019-05-281-1/+1
| | | | | | | fix lengh to length Signed-off-by: Weitao Hou <houweitaoo@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 20:52:51 +0100