summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-12-20iwlwifi: mvm: add dbg_time_point to debugfsJohannes Berg
We forgot to link this to debugfs, so the code is all dead. Add it for real. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/iwlwifi.20211219110000.d0f314101410.I7357c01179c35621686265d4da4a64d2333a5f1a@changeid
2021-12-20iwlwifi: mvm: add missing min_size to kernel-docJohannes Berg
On struct iwl_rx_handlers we should document the min_size member, do that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/iwlwifi.20211219110000.0c42c428bc6b.I8bfa49d534acc5f513f2fb3dff2d6f22f6c45071@changeid
2021-12-20iwlwifi: mei: fix W=1 warningsJohannes Berg
There are a few warnings due to kernel-doc not understanding the constructs the way they're done here, fix them. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/iwlwifi.20211219110000.1ef2bb24771c.I6a59ad2d64f719d3e27398951c8f1b678b0b1092@changeid
2021-12-20Merge tag 'mt76-for-kvalo-2021-12-18' of https://github.com/nbd168/wirelessKalle Valo
mt76 patches for 5.17 * decap offload fixes * mt7915 fixes * mt7921 fixes * eeprom fixes * powersave handling fixes * SAR support * code cleanups
2021-12-20ath11k: add support for hardware rfkill for QCA6390Wen Gong
When hardware rfkill is enabled in the firmware it will report the capability via using WMI_SYS_CAP_INFO_RFKILL bit in the WMI_SERVICE_READY event to the host. ath11k will check the capability, and if it is enabled then ath11k will set the GPIO information to firmware using WMI_PDEV_SET_PARAM. When the firmware detects hardware rfkill is enabled by the user, it will report it via WMI_RFKILL_STATE_CHANGE_EVENTID. Once ath11k receives the event it will send wmi command WMI_PDEV_SET_PARAM to the firmware and also notifies cfg80211. This only enable rfkill feature for QCA6390, rfkill_pin is all initialized to 0 for other chips in ath11k_hw_params. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211217102334.14907-1-quic_wgong@quicinc.com
2021-12-20ath11k: report tx bitrate for iw wlan station dumpWen Gong
HTT_T2H_MSG_TYPE_PPDU_STATS_IND is a message which include the ppdu info, currently it is not report from firmware for ath11k, then the tx bitrate of "iw wlan0 station dump" always show an invalid value "tx bitrate: 6.0 MBit/s". To address the issue, this is to parse the info of tx complete report from firmware and indicate the tx rate to mac80211. After that, "iw wlan0 station dump" show the correct tx bit rate such as: tx bitrate: 78.0 MBit/s MCS 12 tx bitrate: 144.4 MBit/s VHT-MCS 7 short GI VHT-NSS 2 tx bitrate: 286.7 MBit/s HE-MCS 11 HE-NSS 2 HE-GI 0 HE-DCM 0 tx bitrate: 1921.5 MBit/s 160MHz HE-MCS 9 HE-NSS 2 HE-GI 0 HE-DCM 0 Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211217093722.5739-1-quic_wgong@quicinc.com
2021-12-20Merge tag 'spi-fix-v5.16-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One small fix for a long standing issue with error handling on probe in the Armada driver" * tag 'spi-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: change clk_disable_unprepare to clk_unprepare
2021-12-20Merge tag 'regulator-fix-v5.16-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Binding fix for v5.16 This fixes problems validating DT bindings using op_mode which wasn't described as it should have been when converting to DT schema" * tag 'regulator-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: dt-bindings: samsung,s5m8767: add missing op_mode to bucks
2021-12-20staging: greybus: fix stack size warning with UBSANArnd Bergmann
clang warns about excessive stack usage in this driver when UBSAN is enabled: drivers/staging/greybus/audio_topology.c:977:12: error: stack frame size of 1836 bytes in function 'gbaudio_tplg_create_widget' [-Werror,-Wframe-larger-than=] Rework this code to no longer use compound literals for initializing the structure in each case, but instead keep the common bits in a preallocated constant array and copy them as needed. Link: https://github.com/ClangBuiltLinux/linux/issues/1535 Link: https://lore.kernel.org/r/20210103223541.2790855-1-arnd@kernel.org/ Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Reviewed-by: Alex Elder <elder@linaro.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> [nathan: Address review comments from v1] Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20211209195141.1165233-1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: move the steps into Hal8188EPwrSeq.cMartin Kaiser
Move the power transition steps into Hal8188EPwrSeq.c where the arrays are defined. There's no point in having defines for sequences of steps in the include file. All of these sequences are used only once (apart from the end sequence). Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-10-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: reformat the power transition stepsMartin Kaiser
Clean up the definitions of the power transition steps and address some checkpatch warnings. Reduce the line lengths where possible. Add spaces between elements. Rewrite comments that are in contradiction with the definition they describe. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-9-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove unused power commandMartin Kaiser
None of the remaining power transition steps used PWR_CMD_READ. It can be removed. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-8-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove base address from power transitionsMartin Kaiser
Remove the base entry from the power transition steps. This field is not used. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-7-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove interface mask from power transitionsMartin Kaiser
For the r8188 driver, we always have a usb interface. We can remove the power transition steps that are not applicable for a usb interface. We can then remove the interface mask itself. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-6-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove fab mask from power transitionsMartin Kaiser
Remove the fab mask from the steps of the power transitions. The fab mask is not used, all values are allowed for all steps. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-5-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove cut mask from power transitionsMartin Kaiser
Remove the power cut mask from the steps of the power transitions. The power cut mask is not used, all values are allowed for all steps. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove sizes from power transition arraysMartin Kaiser
There's no need to set the array size explicitly if an array is initialized with a constant value. Remove the array sizes and related definitions for the power transition arrays. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove unused power transitionsMartin Kaiser
The r8188 driver defines a number of transitions between different power states. Remove the transitions which are not used by the rest of the code. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211219183926.4746-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: ODM_BB_RA_MASK is always setMartin Kaiser
Remove the ODM_BB_RA_MASK capability. It is always set for this driver. Like for ODM_BB_DIG before, we can be sure that ODM_BB_RA_MASK was never checked before it was set. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-10-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: ODM_BB_DIG is always setMartin Kaiser
Remove the ODM_BB_DIG capability. It is always set for this driver. (ODM_BB_DIG was set in Update_ODM_ComInfo_88E and checked in odm_DIG, which was always called after the capability was set.) Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-9-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove unused odm capabilitiesMartin Kaiser
Remove odm capabilities which are either unused or set but never checked. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-8-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: Bssid in struct fast_ant_train is set but not usedMartin Kaiser
Bssid in struct fast_ant_train is set but not used. Remove it. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-7-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: antSumRSSI is set but not usedMartin Kaiser
antSumRSSI in struct fast_ant_train is set but not used. Remove it. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-6-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: antRSSIcnt is set but not usedMartin Kaiser
antRSSIcnt in struct fast_ant_train is set but not used. Remove it. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-5-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: antAveRSSI is set but not usedMartin Kaiser
antAveRSSI in struct fast_ant_train is set but not used. Remove it. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: remove the dummy ioctl handlerMartin Kaiser
The r8188 driver installs a dummy handler for some unused ioctls. All that the dummy handler does is return -1. Remove the dummy handler and let the wext core handle unused ioctls. This way, user space gets a consistent errno for an unused wext ioctl, regardless of which driver is used for the interface. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188: make rx signal strength function staticMartin Kaiser
The _linked_rx_signal_strength_display function is used only in rtw_mlme_ext.c. Make the function static and remove the prototype. While at it, fix a typo in the function name. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211218120423.29906-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188eu: clean up rtl8188e_sreset_linked_status_checkMartin Kaiser
Clean up the rtl8188e_sreset_linked_status_check, which has just been moved to rtw_mlme_ext. Don't initialise variables to 0 if the first access sets a new value. Check the value of fw_status only once. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211212185833.22000-4-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188eu: move linked status check from hal to rtw_mlme_extMartin Kaiser
Move rtl8188e_sreset_linked_status_check from the hal layer into rtw_mlme_ext.c. Like the xmit status check, this is a simple function that's only called from one place. With this function gone, hal/rtl8188e_sreset.c and include/rtl8188e_sreset.h are now empty and can be removed. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211212185833.22000-3-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: r8188eu: move xmit status check from hal to rtw_cmdMartin Kaiser
Move rtl8188e_sreset_xmit_status_check from the hal layer into rtw_cmd.c. As this driver supports only the 8188 chipset, there's no need to go through the hal layer for simple operations that have only one caller. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20211212185833.22000-2-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: rtl8723bs: fix typo in a commentJason Wang
The double `for' in the comment in line 2203 is repeated. Remove one of them from the comment. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Link: https://lore.kernel.org/r/20211211091632.264035-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20staging: rtl8192u: remove some repeated words in some commentsJason Wang
The double `new' in the comment in line 1349 and `to' in the comment in line 2030 are repeated. Remove the repeated words from these comments. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Link: https://lore.kernel.org/r/20211211091422.260442-1-wangborong@cdjrlc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20Merge tag 'tegra-for-5.17-arm-dt' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/dt ARM: tegra: Changes for v5.17-rc1 A large part of this is cleanups to existing device trees in order to improve validation of the device trees using the dt-schema tooling. This also contains a set of new device trees for various boards that have been contributed by community members as well as fixes to existing devices. * tag 'tegra-for-5.17-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (55 commits) ARM: tegra: Add host1x hotflush reset on Tegra124 ARM: tegra: Add memory client hotflush resets on Tegra114 ARM: tegra: Add back gpio-ranges properties ARM: tegra: paz00: Enable S/PDIF and HDMI audio ARM: tegra: acer-a500: Enable S/PDIF and HDMI audio ARM: tegra: Add HDMI audio graph to Tegra20 device-tree ARM: tegra: Add S/PDIF node to Tegra20 device-tree ARM: tegra20/30: Disable unused host1x hardware ARM: tegra: Add Memory Client resets to Tegra30 GR2D, GR3D and Host1x ARM: tegra: Add Memory Client resets to Tegra20 GR2D, GR3D and Host1x ARM: tegra: Add OPP tables and power domains to Tegra30 device-trees ARM: tegra: Add OPP tables and power domains to Tegra20 device-trees ARM: tegra: Add 500 MHz entry to Tegra30 memory OPP table ARM: tegra: Enable video decoder on Tegra114 ARM: tegra: nexus7: Use common LVDS display device-tree ARM: tegra: Add CPU thermal zones to Nyan device-tree ARM: tegra: Enable CPU DFLL on Nyan ARM: tegra: Enable HDMI CEC on Nyan ARM: tegra: Add usb-role-switch property to USB OTG ports ARM: tegra: Add device-tree for 1080p version of Nyan Big ... Link: https://lore.kernel.org/r/20211217162253.1801077-5-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_streamZekun Shen
Large pkt_len can lead to out-out-bound memcpy. Current ath9k_hif_usb_rx_stream allows combining the content of two urb inputs to one pkt. The first input can indicate the size of the pkt. Any remaining size is saved in hif_dev->rx_remain_len. While processing the next input, memcpy is used with rx_remain_len. 4-byte pkt_len can go up to 0xffff, while a single input is 0x4000 maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE. BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <IRQ> dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] __kasan_report.cold+0x37/0x7c ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] kasan_report+0xe/0x20 check_memory_region+0x15a/0x1d0 memcpy+0x20/0x50 ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc] ? _raw_spin_lock_irqsave+0x7b/0xd0 ? _raw_spin_trylock_bh+0x120/0x120 ? __usb_unanchor_urb+0x12f/0x210 __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU emulation, I found the KASAN report. The bug is triggerable whenever pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes to test the driver works when applying the patch. Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wireless.nyu.edu
2021-12-20ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()Tetsuo Handa
syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) depends on spin_lock_init() from ath9k_init_priv() being already completed. Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is called via tasklet interrupt before spin_lock_init() from ath9k_init_priv() from ath9k_init_device() from ath9k_htc_probe_device() is called. Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until ath9k_tx_init() completes. Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b [1] Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@i-love.sakura.ne.jp
2021-12-20ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep()Tetsuo Handa
syzbot is reporting lockdep warning followed by kernel panic at ath9k_htc_rxep() [1], for ath9k_htc_rxep() depends on ath9k_rx_init() being already completed. Since ath9k_htc_rxep() is set by ath9k_htc_connect_svc(WMI_BEACON_SVC) from ath9k_init_htc_services(), it is possible that ath9k_htc_rxep() is called via timer interrupt before ath9k_rx_init() from ath9k_init_device() is called. Since we can't call ath9k_init_device() before ath9k_init_htc_services(), let's hold ath9k_htc_rxep() no-op until ath9k_rx_init() completes. Link: https://syzkaller.appspot.com/bug?extid=4d2d56175b934b9a7bf9 [1] Reported-by: syzbot <syzbot+4d2d56175b934b9a7bf9@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+4d2d56175b934b9a7bf9@syzkaller.appspotmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/2b88f416-b2cb-7a18-d688-951e6dc3fe92@i-love.sakura.ne.jp
2021-12-20ath11k: fix warning of RCU usage for ath11k_mac_get_arvif_by_vdev_id()Wen Gong
When enable more debug config, it happen below warning. It is because the caller does not add rcu_read_lock()/rcu_read_unlock() to wrap the rcu_dereference(). Add rcu_read_lock()/rcu_read_unlock() to wrap rcu_dereference(), then fixed it. [ 180.716604] ============================= [ 180.716670] WARNING: suspicious RCU usage [ 180.716734] 5.16.0-rc4-wt-ath+ #542 Not tainted [ 180.716895] ----------------------------- [ 180.716957] drivers/net/wireless/ath/ath11k/mac.c:506 suspicious rcu_dereference_check() usage! [ 180.717023] other info that might help us debug this: [ 180.717087] rcu_scheduler_active = 2, debug_locks = 1 [ 180.717151] no locks held by swapper/0/0. [ 180.717215] stack backtrace: [ 180.717279] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 5.16.0-rc4-wt-ath+ #542 [ 180.717346] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 [ 180.717411] Call Trace: [ 180.717475] <IRQ> [ 180.717541] dump_stack_lvl+0x57/0x7d [ 180.717610] ath11k_mac_get_arvif_by_vdev_id+0x1ab/0x2d0 [ath11k] [ 180.717694] ? ath11k_mac_get_arvif+0x140/0x140 [ath11k] [ 180.717798] ? ath11k_wmi_tlv_op_rx+0xc1b/0x2520 [ath11k] [ 180.717888] ? kfree+0xe8/0x2c0 [ 180.717959] ath11k_wmi_tlv_op_rx+0xc27/0x2520 [ath11k] [ 180.718038] ? ath11k_mgmt_rx_event+0xda0/0xda0 [ath11k] [ 180.718113] ? __lock_acquire+0xb72/0x1870 [ 180.718182] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 180.718250] ? sched_clock_cpu+0x15/0x1b0 [ 180.718314] ? find_held_lock+0x33/0x110 [ 180.718381] ? __lock_release+0x4bd/0x9f0 [ 180.718447] ? lock_downgrade+0x130/0x130 [ 180.718517] ath11k_htc_rx_completion_handler+0x38f/0x5b0 [ath11k] [ 180.718596] ? __local_bh_enable_ip+0xa0/0x110 [ 180.718662] ath11k_ce_recv_process_cb+0x5ac/0x920 [ath11k] [ 180.718783] ? __lock_acquired+0x205/0x890 [ 180.718864] ? ath11k_ce_rx_post_pipe+0x970/0x970 [ath11k] [ 180.718949] ? __wake_up_bit+0x100/0x100 [ 180.719020] ath11k_pci_ce_tasklet+0x5f/0xf0 [ath11k_pci] [ 180.719085] ? tasklet_clear_sched+0x42/0xe0 [ 180.719148] tasklet_action_common.constprop.0+0x204/0x2f0 [ 180.719217] __do_softirq+0x276/0x86a [ 180.719281] ? __common_interrupt+0x92/0x1d0 [ 180.719350] __irq_exit_rcu+0x11c/0x180 [ 180.719418] irq_exit_rcu+0x5/0x20 [ 180.719482] common_interrupt+0xa4/0xc0 [ 180.719547] </IRQ> [ 180.719609] <TASK> [ 180.719671] asm_common_interrupt+0x1e/0x40 [ 180.719772] RIP: 0010:cpuidle_enter_state+0x1f3/0x8d0 [ 180.719838] Code: 00 41 8b 77 04 bf ff ff ff ff e8 78 f1 ff ff 31 ff e8 81 fa 52 fe 80 7c 24 08 00 0f 85 9e 01 00 00 e8 11 13 78 fe fb 45 85 e4 <0f> 88 8c 02 00 00 49 63 ec 48 8d 44 6d 00 48 8d 44 85 00 48 8d 7c [ 180.719909] RSP: 0018:ffffffffa4607dd0 EFLAGS: 00000202 [ 180.719982] RAX: 00000000002aea91 RBX: ffffffffa4a5fec0 RCX: 1ffffffff49ca501 [ 180.720047] RDX: 0000000000000000 RSI: ffffffffa3c6e4e0 RDI: ffffffffa3dcf2a0 [ 180.720110] RBP: 0000000000000002 R08: 0000000000000001 R09: ffffffffa4e54d17 [ 180.720173] R10: fffffbfff49ca9a2 R11: 0000000000000001 R12: 0000000000000002 [ 180.720236] R13: ffff8881169ccc04 R14: 0000002a13899598 R15: ffff8881169ccc00 [ 180.720321] cpuidle_enter+0x45/0xa0 [ 180.720413] cpuidle_idle_call+0x274/0x3f0 [ 180.720503] ? arch_cpu_idle_exit+0x30/0x30 [ 180.720869] ? tsc_verify_tsc_adjust+0x97/0x2e0 [ 180.720935] ? lockdep_hardirqs_off+0x90/0xd0 [ 180.721002] do_idle+0xe0/0x150 [ 180.721069] cpu_startup_entry+0x14/0x20 [ 180.721134] start_kernel+0x3a2/0x3c2 [ 180.721200] secondary_startup_64_no_verify+0xb0/0xbb [ 180.721274] </TASK> Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-02892.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211217064132.30911-1-quic_wgong@quicinc.com
2021-12-20ath11k: add signal report to mac80211 for QCA6390 and WCN6855Wen Gong
IEEE80211_HW_USES_RSS is set in ath11k, then the device uses RSS and thus requires parallel RX which implies using per-CPU station statistics in sta_get_last_rx_stats() of mac80211. Currently signal is only set in ath11k_mgmt_rx_event(), and not set for RX data packet, then it show signal as 0 for iw command easily. Change to get signal from firmware and report to mac80211. For QCA6390 and WCN6855, the rssi value is already in dbm unit, so don't need to convert it again. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211216070535.31732-1-quic_wgong@quicinc.com
2021-12-20ath11k: report rssi of each chain to mac80211 for QCA6390/WCN6855Wen Gong
Command "iw wls1 station dump" does not show each chain's rssi currently. If the rssi of each chain from mon status which parsed in function ath11k_hal_rx_parse_mon_status_tlv() is invalid, then ath11k send wmi cmd WMI_REQUEST_STATS_CMDID with flag WMI_REQUEST_RSSI_PER_CHAIN_STAT to firmware, and parse the rssi of chain in wmi WMI_UPDATE_STATS_EVENTID, then report them to mac80211. WMI_REQUEST_STATS_CMDID is only sent when CONFIG_ATH11K_DEBUGFS is set, it is only called by ath11k_mac_op_sta_statistics(). It does not effect performance and power consumption. Because after STATION connected to AP, it is only called every 6 seconds by NetworkManager in below stack. [ 797.005587] CPU: 0 PID: 701 Comm: NetworkManager Tainted: G W OE 5.13.0-rc6-wt-ath+ #2 [ 797.005596] Hardware name: LENOVO 418065C/418065C, BIOS 83ET63WW (1.33 ) 07/29/2011 [ 797.005600] RIP: 0010:ath11k_mac_op_sta_statistics+0x2f/0x1b0 [ath11k] [ 797.005644] Code: 41 56 41 55 4c 8d aa 58 01 00 00 41 54 55 48 89 d5 53 48 8b 82 58 01 00 00 48 89 cb 4c 8b 70 20 49 8b 06 4c 8b a0 90 08 00 00 <0f> 0b 48 8b 82 b8 01 00 00 48 ba 00 00 00 00 01 00 00 00 48 89 81 [ 797.005651] RSP: 0018:ffffb1fc80a4b890 EFLAGS: 00010282 [ 797.005658] RAX: ffff8a5726200000 RBX: ffffb1fc80a4b958 RCX: ffffb1fc80a4b958 [ 797.005664] RDX: ffff8a5726a609f0 RSI: ffff8a581247f598 RDI: ffff8a5702878800 [ 797.005668] RBP: ffff8a5726a609f0 R08: 0000000000000000 R09: 0000000000000000 [ 797.005672] R10: 0000000000000000 R11: 0000000000000007 R12: 02dd68024f75f480 [ 797.005676] R13: ffff8a5726a60b48 R14: ffff8a5702879f40 R15: ffff8a5726a60000 [ 797.005681] FS: 00007f632c52a380(0000) GS:ffff8a583a200000(0000) knlGS:0000000000000000 [ 797.005687] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 797.005692] CR2: 00007fb025d69000 CR3: 00000001124f6005 CR4: 00000000000606f0 [ 797.005698] Call Trace: [ 797.005710] sta_set_sinfo+0xa7/0xb80 [mac80211] [ 797.005820] ieee80211_get_station+0x50/0x70 [mac80211] [ 797.005925] nl80211_get_station+0xd1/0x200 [cfg80211] [ 797.006045] genl_family_rcv_msg_doit.isra.15+0x111/0x140 [ 797.006059] genl_rcv_msg+0xe6/0x1e0 [ 797.006065] ? nl80211_dump_station+0x220/0x220 [cfg80211] [ 797.006223] ? nl80211_send_station.isra.72+0xf50/0xf50 [cfg80211] [ 797.006348] ? genl_family_rcv_msg_doit.isra.15+0x140/0x140 [ 797.006355] netlink_rcv_skb+0xb9/0xf0 [ 797.006363] genl_rcv+0x24/0x40 [ 797.006369] netlink_unicast+0x18e/0x290 [ 797.006375] netlink_sendmsg+0x30f/0x450 [ 797.006382] sock_sendmsg+0x5b/0x60 [ 797.006393] ____sys_sendmsg+0x219/0x240 [ 797.006403] ? copy_msghdr_from_user+0x5c/0x90 [ 797.006413] ? ____sys_recvmsg+0xf5/0x190 [ 797.006422] ___sys_sendmsg+0x88/0xd0 [ 797.006432] ? copy_msghdr_from_user+0x5c/0x90 [ 797.006443] ? ___sys_recvmsg+0x9e/0xd0 [ 797.006454] ? __fget_files+0x58/0x90 [ 797.006461] ? __fget_light+0x2d/0x70 [ 797.006466] ? do_epoll_wait+0xce/0x720 [ 797.006476] ? __sys_sendmsg+0x63/0xa0 [ 797.006485] __sys_sendmsg+0x63/0xa0 [ 797.006497] do_syscall_64+0x3c/0xb0 [ 797.006509] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 797.006519] RIP: 0033:0x7f632d99912d [ 797.006526] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48 [ 797.006533] RSP: 002b:00007ffd80808c00 EFLAGS: 00000293 ORIG_RAX: 000000000000002e [ 797.006540] RAX: ffffffffffffffda RBX: 0000563dab99d840 RCX: 00007f632d99912d [ 797.006545] RDX: 0000000000000000 RSI: 00007ffd80808c50 RDI: 000000000000000b [ 797.006549] RBP: 00007ffd80808c50 R08: 0000000000000000 R09: 0000000000001000 [ 797.006552] R10: 0000563dab96f010 R11: 0000000000000293 R12: 0000563dab99d840 [ 797.006556] R13: 0000563dabbb28c0 R14: 00007f632dad4280 R15: 0000563dabab11c0 [ 797.006563] ---[ end trace c9dcf08920c9945c ]--- Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01230-QCAHSTSWPLZ_V2_TO_X86-1 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-02892.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211215090944.19729-1-quic_wgong@quicinc.com
2021-12-20ath5k: switch to rate table based lookupJonas Jelonek
Switching from legacy usage of ieee80211_get_tx_rates() lookup to direct rate table lookup in struct ieee80211_sta->rates. The current rate control API allows drivers to directly get rates from ieee80211_sta->rates. ath5k is currently one of the legacy drivers that perform translation/merge with the internal rate table via ieee80211_get_tx_rates provided by rate control API. For our upcoming changes to rate control API and the implementation of transmit power control, this patch changes the behaviour. The call to ieee80211_get_tx_rates and subsequent calls are also avoided. ath5k now directly reads rates from sta->rates into its internal rate table. Cause ath5k does not rely on the rate array in SKB->CB, this is not considered anymore except for the first entry (used for probing). Tested this on a PCEngines ALIX with CMP9-GP miniPCI wifi card (Atheros AR5213A). Generated traffic between AP and multiple STAs before and after applying the patch and simultaneously measured throughput and captured rc_stats. Comparison resulted in same rate selection and no performance loss between both runs. Co-developed-by: Thomas Huehn <thomas.huehn@hs-nordhausen.de> Signed-off-by: Thomas Huehn <thomas.huehn@hs-nordhausen.de> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211215215042.637-1-jelonek.jonas@gmail.com
2021-12-20serial: sh-sci: Remove BREAK/FRAME/PARITY/OVERRUN printoutsMagnus Damm
Update the SCIF serial driver to remove printouts for break, frame, parity and overrun errors. This reduces the amount of console printouts generated by the defconfig kernel on R-Car Gen3 for certain use cases. To retrieve more information about such errors the user may inspect counters. Also these errors are fed into the TTY layer for further application specific handling. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Magnus Damm <damm+renesas@opensource.se> Link: https://lore.kernel.org/r/163884254093.18109.2982470198301927679.sendpatchset@octo Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20serial: 8250_pericom: Use serial_dl_write() instead of open codedAndy Shevchenko
It's better to stick with standard API to write and read DL value when the hardware is compatible with it. In case any quirks are needed it may be easily added in one place rather than modifying code here and there. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211122133512.8947-4-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20serial: 8250_pericom: Re-enable higher baud ratesJay Dolan
Add UPF_MAGIC_MULTIPLIER to the port flags since there is now range checking in serial8250_get_baud_rate() in 8250_port.c. Signed-off-by: Jay Dolan <jay.dolan@accesio.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211122133512.8947-3-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20serial: 8250_pci: Split out Pericom driverAndy Shevchenko
Pericom along with Acces I/O support consumes a lot of LOCs in 8250_pci.c. For the sake of easier maintenance, split it to a separate driver. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20211122133512.8947-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20tty: serial: samsung: Fix console registration from moduleSam Protsenko
On modern Exynos SoCs (like Exynos850) the UART can be implemented as a part of USI IP-core. In such case, USI driver is used to initialize USI registers, and it also calls of_platform_populate() to instantiate all sub-nodes (e.g. serial node) of USI node. When serial driver is built-in, but USI driver is a module, and CONFIG_SERIAL_SAMSUNG_CONSOLE is enabled, next call chain will happen when loading USI module from user space: usi_init v usi_probe v of_platform_populate v s3c24xx_serial_probe v uart_add_one_port v uart_configure_port v register_console v try_enable_new_console v s3c24xx_serial_console_setup But because the serial driver is built-in, and s3c24xx_serial_console_setup() is marked with __init keyword, that symbol will discarded and long gone by that time already, causing failed paging request. That happens during the next config combination: EXYNOS_USI=m SERIAL_SAMSUNG=y SERIAL_SAMSUNG_CONSOLE=y That config should be completely possible, so rather than limiting SERIAL_SAMSUNG choice to "m" only when USI=m, remove __init keyword for all affected functions. Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Link: https://lore.kernel.org/r/20211204195757.8600-6-semen.protsenko@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20tty: serial: samsung: Enable console as moduleSam Protsenko
Enable serial driver to be built as a module. To do so, init the console support on driver/module load instead of using console_initcall(). Inspired by commit 87a0b9f98ac5 ("tty: serial: meson: enable console as module"). Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Link: https://lore.kernel.org/r/20211204195757.8600-5-semen.protsenko@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20tty: serial: samsung: Remove USI initializationSam Protsenko
USI control is now extracted to the dedicated USI driver. Remove USI related code from serial driver to avoid conflicts and code duplication. Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Link: https://lore.kernel.org/r/20211204195757.8600-4-semen.protsenko@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20Merge branch 'xsa' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tipLinus Torvalds
Merge xen fixes from Juergen Gross: "Fixes for two issues related to Xen and malicious guests: - Guest can force the netback driver to hog large amounts of memory - Denial of Service in other guests due to event storms" * 'xsa' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/netback: don't queue unlimited number of packages xen/netback: fix rx queue stall detection xen/console: harden hvc_xen against event channel storms xen/netfront: harden netfront against event channel storms xen/blkfront: harden blkfront against event channel storms
2021-12-20drm/i915: Ensure i915_vma tests do not get -ENOSPC with the locking changes.Maarten Lankhorst
Now that we require locking to evict, multiple vmas from the same object might not be evicted. This is expected and required, because execbuf will move to short-term pinning by using the lock only. This will cause these tests to fail, because they create a ton of vma's for the same object. Unbind manually to prevent spurious -ENOSPC in those mock tests. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-8-maarten.lankhorst@linux.intel.com
2021-12-20drm/i915: Ensure gem_contexts selftests work with unbind changes, v2.Maarten Lankhorst
In the next commits, we may not evict when refcount = 0. igt_vm_isolation() continuously tries to pin/unpin at same address, but also calls put() on the object, which means the object may not be unpinned in time. Instead of this, re-use the same object over and over, so they can be unbound as required. Changes since v1: - Fix cleaning up obj_b on failure. (Matt) Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-7-maarten.lankhorst@linux.intel.com
generated by cgit (git 2.34.1) at 2025-09-26 04:16:48 +0000