summaryrefslogtreecommitdiff
path: root/drivers/net/wireless
AgeCommit message (Collapse)Author
2019-09-05mt76: introduce mt76_mmio_read_copy routineLorenzo Bianconi
Add mt76_mmio_read_copy routine and the related function pointer in mt76_bus_ops data structure. mt76_mmio_read_copy will be used to add BIP_CMAC_128 cipher hw support to mt7615 driver Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: add set_key_cmd and mt76_wcid to mt7615_mac_wtbl_set_key signatureLorenzo Bianconi
Introduce set_key_cmd and mt76_wcid pointer to mt7615_mac_wtbl_set_key signature and do not set key to NULL if cmd is DISABLE_KEY. This is a preliminary patch to add BIP_CMAC_128 hw support to mt7615 driver Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: remove wtbl_sec_key definitionLorenzo Bianconi
Get rid of wtbl_sec_key definition since it is no longer used Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: introduce mt7615_mac_wtbl_set_key routineLorenzo Bianconi
Add mt7615_mac_wtbl_set_key routine to configure wtbl key parameter directly from host cpu. This is a preliminary patch to add BIP_CMAC_128 hw support. Moreover add static qualifier to mt7615_mac_get_key_info routine Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: add mt7615_mac_wtbl_addr routineLorenzo Bianconi
Introduce mt7615_mac_wtbl_addr rouinte to compute sta wtbl address. This is a preliminary patch to update wtbl key directly from host processor Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: move mt7615_mac_get_key_info in mac.cLorenzo Bianconi
This is a preliminary patch to update wtbl key directly from host processor Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: add missing register initializationFelix Fietkau
- initialize CCA signal source - initialize clock for band 1 (7615D) - initialize BAR rate Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt76x0u: add support to TP-Link T2UHPLorenzo Bianconi
Introduce support to TP-Link T2UHP https://wikidevi.com/wiki/TP-LINK_Archer_T2UHP Tested-by: Sid Hayn <sidhayn@gmail.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: use params->ssn value directlyStanislaw Gruszka
There is no point to use pointer to params->ssn. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7603: use params->ssn value directlyStanislaw Gruszka
There is no point to use pointer to params->ssn. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt76x02: use params->ssn value directlyStanislaw Gruszka
There is no point to use pointer to params->ssn. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: usb: remove unneeded {put,get}_unalignedStanislaw Gruszka
Compiler give us guarantees on variables alignment, so use an variable as buffer when read/write registers and remove unneeded {put,get}_unaligned. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: usb: fix endian in mt76u_copyStanislaw Gruszka
In contrast to mt76_wr() which we use to program registers, on mt76_wr_copy() we should not change endian of the data. Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7603: fix invalid fallback ratesFelix Fietkau
Only decrement the rate index on duplicate rates if it is not already 0 Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: fix invalid fallback ratesFelix Fietkau
Only decrement the rate index on duplicate rates if it is not already 0 Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: fix PS buffering of action framesFelix Fietkau
Bufferable management frames need to be put in the data queue, otherwise they will not be buffered when the receiver is asleep. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: fix using VHT STBC ratesFelix Fietkau
The hardware expects MT_TX_RATE_NSS to be filled with the number of space/time streams. For non-STBC rates, this is equal to nss. For 1-stream STBC, this needs to be set to 2. This is relevant for VHT rates only, on HT, the value is derived from MCS internally. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt76u: fix typo in mt76u_fill_rx_sgLorenzo Bianconi
Fix typo setting urb->transfer_buffer_length in mt76u_fill_rx_sg Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Fixes: f8f527b16db5 ("mt76: usb: use EP max packet aligned buffer sizes for rx") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: sync with mt7603 rate control changesFelix Fietkau
- Store the previous and current rate set in the driver + the TSF value at the time of the switch. - Use the tx status TSF value to determine which rate set needs to be used as reference. - Report only short or long GI rates for a single status event, not a mix. - The hardware reports the last used rate index. Use it along with the retry count to figure out what rate was used for the first attempt. - Use the same retry count value for all rate slots to make this calculation work. - Derive the probe rate from the current rateset instead of the skb cb - Do not wait for a status report for the probe frame before removing the probe rate from the rate table. Do it immediately after it was referenced in a tx status report. - Use the first half of the first rate retry budget for the probe rate in order to avoid using too many retries on that rate - Switch from lower rates to higher rates more conservatively - enable hardware rate up/down selection Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: reset rate index/counters on rate table updateFelix Fietkau
These values must be initialized to zero, otherwise the hardware could reuse previous values, especially the rate index Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: move mt7615_mcu_set_rates to mac.cFelix Fietkau
It bypasses the MCU, so it does not belong in mcu.c Also make mt7615_mac_tx_rate_val static Reviewed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7603: enable hardware rate up/down selectionFelix Fietkau
Improves performance by switching away from bad rates faster Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: introduce mt7615_mcu_send_ram_firmware routineLorenzo Bianconi
Add mt7615_mcu_send_ram_firmware routine since mt7615_load_ram runs the same code to send ram firmware to cr4 and n9 mcus. Moreover rename gen_dl_mode in mt7615_mcu_gen_dl_mode. This patch does not introduce any behaviour change, it is just code refactor. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: always release sem in mt7615_load_patchLorenzo Bianconi
Release patch semaphore even if request_firmware fails in mt7615_load_patch Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: fall back to sw encryption for unsupported ciphersLorenzo Bianconi
Fix following warning falling back to sw encryption for unsupported ciphers WARNING: CPU: 2 PID: 1495 at backports-4.19.32-1/net/mac80211/key.c:1023 mt76_wcid_key_setup+0x68/0xbc [mt76] CPU: 2 PID: 1495 Comm: hostapd Not tainted 4.14.131 #0 Stack : 00000000 8f0f8bc0 00000000 8007ccec 805f0000 8058ec18 00000000 00000000 80559788 8dca79bc 8fefb10c 805c89c7 805545c8 00000001 8dca7960 53261662 00000000 00000000 80640000 00004668 00000000 000000e9 00000007 00000000 00000000 805d0000 00072537 00000000 80000000 00000000 805f0000 8f1e70d0 8e8fa098 000003ff 805c0000 8f0f8bc0 00000001 802d4340 00000008 80630008 [<800108d0>] show_stack+0x58/0x100 [<8049214c>] dump_stack+0x9c/0xe0 [<80033998>] __warn+0xe0/0x138 [<80033a80>] warn_slowpath_null+0x1c/0x2c [<8e8fa098>] mt76_wcid_key_setup+0x68/0xbc [mt76] [<8e889930>] mt7615_eeprom_init+0x7c0/0xe14 [mt7615e] Suggested-by: Sebastian Gottschall <s.gottschall@newmedia-net.de> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: clean up FWDL TXQ during/after firmware uploadFelix Fietkau
Since we don't clean that tx queue from the tx tasklet, we need to do it after the firmware upload is done. This patch also adds a cleanup step during the upload, to help reclaim memory faster. Fixes unprocessed queued frames eating up memory long after the firmware upload has already completed Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: add radar pattern test knob to debugfsLorenzo Bianconi
Introduce mt7615_mcu_rdd_send_pattern routine to trigger a radar pattern detection. Moreover move debugfs related routines in a dedicated source file. Suggested-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: add csa supportLorenzo Bianconi
Add Channel Switch Announcement support to mt7615 driver updating beacon template with CSA IE received from mac80211 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: do not perform txcalibration before cac is complitedLorenzo Bianconi
Delay channel calibration after Channel Availability Check. Add some code cleanup to mt7615_mcu_set_channel Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: add hw dfs pattern detector supportLorenzo Bianconi
Add hw radar detection support to mt7615 driver in order to unlock dfs channels on 5GHz band Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: introduce mt7615_regd_notifierLorenzo Bianconi
Introduce mt7615_regd_notifier callback. This is a preliminary patch to add radar detection support to mt7615 driver Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: mt7615: fix sparse warnings: warning: restricted __le16 degrades to ↵Lorenzo Bianconi
integer Fix the following sparse warning in __mt7615_mcu_msg_send: drivers/net/wireless/mediatek/mt76/mt7615/mcu.c:78:15: sparse: warning: restricted __le16 degrades to integer drivers/net/wireless/mediatek/mt76/mt7615/mcu.c:78:15: sparse: warning: cast from restricted __le16 Fixes: 04b8e65922f6 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-05mt76: round up length on mt76_wr_copyFelix Fietkau
When beacon length is not a multiple of 4, the beacon could be sent with the last 1-3 bytes corrupted. The skb data is guaranteed to have enough room for reading beyond the end, because it is always followed by skb_shared_info, so rounding up is safe. All other callers of mt76_wr_copy have multiple-of-4 length already. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2019-09-04ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()Hui Peng
The `ar_usb` field of `ath6kl_usb_pipe_usb_pipe` objects are initialized to point to the containing `ath6kl_usb` object according to endpoint descriptors read from the device side, as shown below in `ath6kl_usb_setup_pipe_resources`: for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { endpoint = &iface_desc->endpoint[i].desc; // get the address from endpoint descriptor pipe_num = ath6kl_usb_get_logical_pipe_num(ar_usb, endpoint->bEndpointAddress, &urbcount); ...... // select the pipe object pipe = &ar_usb->pipes[pipe_num]; // initialize the ar_usb field pipe->ar_usb = ar_usb; } The driver assumes that the addresses reported in endpoint descriptors from device side to be complete. If a device is malicious and does not report complete addresses, it may trigger NULL-ptr-deref `ath6kl_usb_alloc_urb_from_pipe` and `ath6kl_usb_free_urb_to_pipe`. This patch fixes the bug by preventing potential NULL-ptr-deref (CVE-2019-15098). Signed-off-by: Hui Peng <benquike@gmail.com> Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04wcn36xx: use dynamic allocation for large variablesArnd Bergmann
clang triggers a warning about oversized stack frames that gcc does not notice because of slightly different inlining decisions: ath/wcn36xx/smd.c:1409:5: error: stack frame size of 1040 bytes in function 'wcn36xx_smd_config_bss' [-Werror,-Wframe-larger-than=] ath/wcn36xx/smd.c:640:5: error: stack frame size of 1032 bytes in function 'wcn36xx_smd_start_hw_scan' [-Werror,-Wframe-larger-than=] Basically the wcn36xx_hal_start_scan_offload_req_msg, wcn36xx_hal_config_bss_req_msg_v1, and wcn36xx_hal_config_bss_req_msg structures are too large to be put on the kernel stack, but small enough that gcc does not warn about them. Use kzalloc() to allocate them all. There are similar structures in other parts of this driver, but they are all smaller, with the next largest stack frame at 480 bytes for wcn36xx_smd_send_beacon. Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create()Jia-Ju Bai
In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails, target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is called on line 2885. In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895: ath6kl_hif_cleanup_scatter(target->dev->ar); Thus, a null-pointer dereference may occur. To fix this bug, kfree(target) is called and NULL is returned when kzalloc() on line 2855 fails. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath9k: dynack: set ackto to max timeout in ath_dynack_resetLorenzo Bianconi
Initialize acktimeout to the maximum configurable value in ath_dynack_reset in order to not disconnect long distance static links enabling dynack and even to take care of possible errors configuring a static timeout. Moreover initialize station timeout value to the current acktimeout value Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath9k: dynack: set max timeout according to channel widthLorenzo Bianconi
Compute maximum configurable ackimeout/ctstimeout according to channel width (clockrate) Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath9k: dynack: properly set last timeout timestamp in ath_dynack_resetLorenzo Bianconi
Add compute timeout to last computation timestamp in ath_dynack_reset in order to not run ath_dynack_compute_ackto immediately Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath9k: dyanck: introduce ath_dynack_set_timeout routineLorenzo Bianconi
Introduce ath_dynack_set_timeout routine to configure slottime/ack/cts timeouts and remove duplicated code Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}initLorenzo Bianconi
Fix following lockdep warning disabling bh in ath_dynack_node_init/ath_dynack_node_deinit [ 75.955878] -------------------------------- [ 75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes: [ 75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.955905] {SOFTIRQ-ON-W} state was registered at: [ 75.955912] lock_acquire+0x9a/0x160 [ 75.955917] _raw_spin_lock+0x2c/0x70 [ 75.955927] ath_dynack_node_init+0x2a/0x60 [ath9k_hw] [ 75.955934] ath9k_sta_state+0xec/0x160 [ath9k] [ 75.955976] drv_sta_state+0xb2/0x740 [mac80211] [ 75.956008] sta_info_insert_finish+0x21a/0x420 [mac80211] [ 75.956039] sta_info_insert_rcu+0x12b/0x2c0 [mac80211] [ 75.956069] sta_info_insert+0x7/0x70 [mac80211] [ 75.956093] ieee80211_prep_connection+0x42e/0x730 [mac80211] [ 75.956120] ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211] [ 75.956152] cfg80211_mlme_auth+0x143/0x350 [cfg80211] [ 75.956169] nl80211_authenticate+0x25e/0x2b0 [cfg80211] [ 75.956172] genl_family_rcv_msg+0x198/0x400 [ 75.956174] genl_rcv_msg+0x42/0x90 [ 75.956176] netlink_rcv_skb+0x35/0xf0 [ 75.956178] genl_rcv+0x1f/0x30 [ 75.956180] netlink_unicast+0x154/0x200 [ 75.956182] netlink_sendmsg+0x1bf/0x3d0 [ 75.956186] ___sys_sendmsg+0x2c2/0x2f0 [ 75.956187] __sys_sendmsg+0x44/0x80 [ 75.956190] do_syscall_64+0x55/0x1a0 [ 75.956192] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 75.956194] irq event stamp: 2357092 [ 75.956196] hardirqs last enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50 [ 75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80 [ 75.956202] softirqs last enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60 [ 75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0 [ 75.956206] other info that might help us debug this: [ 75.956207] Possible unsafe locking scenario: [ 75.956208] CPU0 [ 75.956209] ---- [ 75.956210] lock(&(&da->qlock)->rlock); [ 75.956213] <Interrupt> [ 75.956214] lock(&(&da->qlock)->rlock); [ 75.956216] *** DEADLOCK *** [ 75.956217] 1 lock held by swapper/0/0: [ 75.956219] #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k] [ 75.956225] stack backtrace: [ 75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13 [ 75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009 [ 75.956231] Call Trace: [ 75.956233] <IRQ> [ 75.956236] dump_stack+0x67/0x90 [ 75.956239] mark_lock+0x4c1/0x640 [ 75.956242] ? check_usage_backwards+0x130/0x130 [ 75.956245] ? sched_clock_local+0x12/0x80 [ 75.956247] __lock_acquire+0x484/0x7a0 [ 75.956250] ? __lock_acquire+0x3b9/0x7a0 [ 75.956252] lock_acquire+0x9a/0x160 [ 75.956259] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.956262] _raw_spin_lock_bh+0x34/0x80 [ 75.956268] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.956275] ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] [ 75.956280] ath_rx_tasklet+0xd09/0xe90 [ath9k] [ 75.956286] ath9k_tasklet+0x102/0x240 [ath9k] [ 75.956288] tasklet_action_common.isra.0+0x6d/0x170 [ 75.956291] __do_softirq+0xcc/0x425 [ 75.956294] irq_exit+0xae/0xc0 [ 75.956296] do_IRQ+0x8a/0x110 [ 75.956298] common_interrupt+0xf/0xf [ 75.956300] </IRQ> [ 75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400 [ 75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7 [ 75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000 [ 75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800 [ 75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000 [ 75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 [ 75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800 [ 75.956321] cpuidle_enter+0x24/0x40 [ 75.956323] do_idle+0x1ac/0x220 [ 75.956326] cpu_startup_entry+0x14/0x20 [ 75.956329] start_kernel+0x482/0x489 [ 75.956332] secondary_startup_64+0xa4/0xb0 Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04ath9k: add loader for AR92XX (and older) pci(e)Christian Lamparter
Atheros cards with a AR92XX generation (and older) chip usually store their pci(e) initialization vectors on an external eeprom chip. However these chips technically don't need the eeprom chip attached, the AR9280 Datasheet in section "6.1.2 DEVICE_ID" describes that "... if the EEPROM content is not valid, a value of 0xFF1C returns when read from the register". So, they will show up on the system's pci bus. However in that state, ath9k can't load, since it relies on having the correct pci-id, otherwise it doesn't know what chip it actually is. This happens on many embedded devices like routers and accesspoint since they want to keep the BOM low and store the pci(e) initialization vectors together with the calibration data on the system's FLASH, which is out of reach of the ath9k chip. Furthermore, Some devices (like the Cisco Meraki Z1 Cloud Managed Teleworker Gateway) need to be able to initialize the PCIe wifi device. Normally, this should be done as a pci quirk during the early stages of booting linux. However, this isn't possible for devices which have the init code for the Atheros chip stored on NAND in an UBI volume. Hence, this module can be used to initialize the chip when the user-space is ready to extract the init code. Martin Blumenstingl prodived the following fixes: owl-loader: add support for OWL emulation PCI devices owl-loader: don't re-scan the bus when ath9k_pci_fixup failed owl-loader: use dev_* instead of pr_* logging functions owl-loader: auto-generate the eeprom filename as fallback owl-loader: add a debug message when swapping the eeprom data owl-loader: add missing newlines in log messages Reviewed-by: Julian Calaby <julian.calaby@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04carl9170: remove set but not used variable 'udev'YueHaibing
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/carl9170/usb.c: In function carl9170_usb_disconnect: drivers/net/wireless/ath/carl9170/usb.c:1110:21: warning: variable udev set but not used [-Wunused-but-set-variable] It is not use since commit feb09b293327 ("carl9170: fix misuse of device driver API") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04wil6210: Delete an unnecessary kfree() call in wil_tid_ampdu_rx_alloc()Markus Elfring
A null pointer would be passed to a call of the function “kfree” directly after a call of the function “kcalloc” failed at one place. Remove this superfluous function call. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Reviewed-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04wil6210: Add EDMG channel supportAlexei Avshalom Lazar
Add support for Enhanced Directional Multi-Gigabit (EDMG) channels 9-11. wil6210 reports it's EDMG capabilities (that are also based on FW capability) to cfg80211 by filling wiphy->bands[NL80211_BAND_60GHZ]->edmg_cap. wil6210 handles edmg.channels and edmg.bw_config requested in connect and start_ap operations. Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-04wil6210: fix wil_cid_valid with negative cid valuesColin Ian King
There are several occasions where a negative cid value is passed into wil_cid_valid and this is converted into a u8 causing the range check of cid >= 0 to always succeed. Fix this by making the cid argument an int to handle any -ve error value of cid. An example of this behaviour is in wil_cfg80211_dump_station, where cid is assigned -ENOENT if the call to wil_find_cid_by_idx fails, and this -ve value is passed to wil_cid_valid. I believe that the conversion of -ENOENT to the u8 value 254 which is greater than wil->max_assoc_sta causes wil_find_cid_by_idx to currently work fine, but I think is by luck and not the intended behaviour. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-03rsi: fix a double free bug in rsi_91x_deinit()Hui Peng
`dev` (struct rsi_91x_usbdev *) field of adapter (struct rsi_91x_usbdev *) is allocated and initialized in `rsi_init_usb_interface`. If any error is detected in information read from the device side, `rsi_init_usb_interface` will be freed. However, in the higher level error handling code in `rsi_probe`, if error is detected, `rsi_91x_deinit` is called again, in which `dev` will be freed again, resulting double free. This patch fixes the double free by removing the free operation on `dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also used in `rsi_disconnect`, in that code path, the `dev` field is not (and thus needs to be) freed. This bug was found in v4.19, but is also present in the latest version of kernel. Fixes CVE-2019-15504. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-03Revert "rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band"Stanislaw Gruszka
This reverts commit 9ad3b55654455258a9463384edb40077439d879f. As reported by Sergey: "I got some problem after upgrade kernel to 5.2 version (debian testing linux-image-5.2.0-2-amd64). 5Ghz client stopped to see AP. Some tests with 1metre distance between client-AP: 2.4Ghz -22dBm, for 5Ghz - 53dBm !, for longer distance (8m + walls) 2.4 - 61dBm, 5Ghz not visible." It was identified that rx signal level degradation was caused by 9ad3b5565445 ("rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band"). So revert this commit. Cc: <stable@vger.kernel.org> # v5.1+ Reported-and-tested-by: Sergey Maranchuk <slav0nic0@gmail.com> Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-03rt2x00: clear up IV's on key removalStanislaw Gruszka
After looking at code I realized that my previous fix 95844124385e ("rt2x00: clear IV's on start to fix AP mode regression") was incomplete. We can still have wrong IV's after re-keyring. To fix that, clear up IV's also on key removal. Fixes: 710e6cc1595e ("rt2800: do not nullify initialization vector data") Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> tested-by: Emil Karlson <jekarl@iki.fi> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-09-03iwlwifi: assign directly to iwl_trans->cfg in QuZ detectionLuca Coelho
We were erroneously assigning the new configuration to a local variable cfg, but that was not being assigned to anything, so the change was getting lost. Assign directly to iwl_trans->cfg instead. Fixes: 5a8c31aa6357 ("iwlwifi: pcie: fix recognition of QuZ devices") Cc: stable@vger.kernel.org # 5.2 Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
generated by cgit (git 2.34.1) at 2025-09-19 16:48:20 +0000