aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
AgeCommit message (Collapse)AuthorFilesLines
2020-07-21mt76: mt7615: wake device before accessing regmap in debugfsLorenzo Bianconi1-1/+24
Make sure the device is in full-power before reading regs in debugfs Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: introduce mt7615_mutex_{acquire,release} utilitiesLorenzo Bianconi5-52/+72
Introduce mt7615_mutex_{acquire,release} utility routines in order to switch in full-power/low-power before/after accessing device register-map Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: add mt7615_pm_wake utility routineLorenzo Bianconi6-6/+75
Introduce mt7615_pm_wake utility routine to wake the device from runtime low-power state (lower-power state is currently supported by offload firmware for pcie devices). Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: move mt76 workqueue in common codeLorenzo Bianconi8-34/+26
Move mt76 workqueue from usb to common code in order to be reused adding low-power support for mt7663 chipset Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: avoid polling in fw_own for mt7663Lorenzo Bianconi1-2/+2
According to the vendor sdk, mt7663 does not need to poll register after firmware own. Since just mt7622 polls status register, set proper timeout value according to the vendor sdk Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7915: avoid memcpy in rxv operationRyder Lee2-48/+37
Avoid memcpy in Rx hot path to slightly improve performance. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt76x2u: enable HC-M7662BU1Lorenzo Bianconi1-0/+1
Enable support for HC-M7662BU1 module on mt76x2u driver Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt76x2: fix pci suspend/resume on mt7612eLorenzo Bianconi3-0/+74
Fix the following mt7612e hw hangs during suspend/resume reported on Dell Vostro 3360 mt76x2e 0000:01:00.0: MCU message 2 (seq 11) timed out mt76x2e 0000:01:00.0: MCU message 30 (seq 12) timed out mt76x2e 0000:01:00.0: MCU message 30 (seq 13) timed out mt76x2e 0000:01:00.0: Firmware Version: 0.0.00 mt76x2e 0000:01:00.0: Build: 1 mt76x2e 0000:01:00.0: Build Time: 201507311614____ mt76x2e 0000:01:00.0: Firmware running! ieee80211 phy0: Hardware restart was requested mt76x2e 0000:01:00.0: MCU message 2 (seq 1) timed out mt76x2e 0000:01:00.0: MCU message 30 (seq 2) timed out mt76x2e 0000:01:00.0: MCU message 30 (seq 3) timed out mt76x2e 0000:01:00.0: Firmware Version: 0.0.00 mt76x2e 0000:01:00.0: Build: 1 mt76x2e 0000:01:00.0: Build Time: 201507311614____ mt76x2e 0000:01:00.0: Firmware running! ieee80211 phy0: Hardware restart was requested mt76x2e 0000:01:00.0: MCU message 31 (seq 5) timed out mt76x2e 0000:01:00.0: MCU message 31 (seq 6) timed out mt76x2e 0000:01:00.0: MCU message 31 (seq 7) timed out mt76x2e 0000:01:00.0: MCU message 31 (seq 8) timed out mt76x2e 0000:01:00.0: MCU message 31 (seq 9) timed out mt76x2e 0000:01:00.0: MCU message 31 (seq 10) timed out mt76x2e 0000:01:00.0: MCU message 31 (seq 11) timed out mt76x2e 0000:01:00.0: Firmware Version: 0.0.00 mt76x2e 0000:01:00.0: Build: 1 mt76x2e 0000:01:00.0: Build Time: 201507311614____ mt76x2e 0000:01:00.0: Firmware running! ieee80211 phy0: Hardware restart was requested ------------[ cut here ]----------- CPU: 3 PID: 11956 Comm: kworker/3:1 Not tainted 5.7.0-pf2 #1 Hardware name: Dell Inc. Vostro 3360/0F5DWF, BIOS A18 09/25/2013 Workqueue: events_freezable ieee80211_restart_work [mac80211] RIP: 0010:ieee80211_reconfig+0x234/0x1700 [mac80211] RSP: 0018:ffffb803c23ffdf0 EFLAGS: 00010286 RAX: 00000000fffffff0 RBX: ffff9595a7564900 RCX: 0000000000000008 RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000100 RBP: ffff9595a7ec07e0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff9595a7ec18d0 R13: 00000000ffffffff R14: 0000000000000000 R15: 00000000fffffff0 FS: 0000000000000000(0000) GS:ffff9595af2c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e56d7de000 CR3: 000000042200a001 CR4: 00000000001706e0 Call Trace: ieee80211_restart_work+0xb7/0xe0 [mac80211] process_one_work+0x1d4/0x3c0 worker_thread+0x228/0x470 ? process_one_work+0x3c0/0x3c0 kthread+0x19c/0x1c0 ? __kthread_init_worker+0x30/0x30 ret_from_fork+0x35/0x40 wlp1s0: Failed check-sdata-in-driver check, flags: 0x0 CPU: 3 PID: 11956 Comm: kworker/3:1 Tainted: G W 5.7.0-pf2 #1 Hardware name: Dell Inc. Vostro 3360/0F5DWF, BIOS A18 09/25/2013 Workqueue: events_freezable ieee80211_restart_work [mac80211] RIP: 0010:drv_remove_interface+0x11f/0x130 [mac80211] RSP: 0018:ffffb803c23ffc80 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9595a7564900 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000082 RDI: 00000000ffffffff RBP: ffff9595a7ec1930 R08: 00000000000004b6 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000006f08 R12: ffff9595a7ec1000 R13: ffff9595a75654b8 R14: ffff9595a7ec0ca0 R15: ffff9595a7ec07e0 FS: 0000000000000000(0000) GS:ffff9595af2c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e56d7de000 CR3: 000000042200a001 CR4: 00000000001706e0 Call Trace: ieee80211_do_stop+0x5af/0x8c0 [mac80211] ieee80211_stop+0x16/0x20 [mac80211] __dev_close_many+0xaa/0x120 dev_close_many+0xa1/0x2b0 dev_close+0x6d/0x90 cfg80211_shutdown_all_interfaces+0x71/0xd0 [cfg80211] ieee80211_reconfig+0xa2/0x1700 [mac80211] ieee80211_restart_work+0xb7/0xe0 [mac80211] process_one_work+0x1d4/0x3c0 worker_thread+0x228/0x470 ? process_one_work+0x3c0/0x3c0 kthread+0x19c/0x1c0 ? __kthread_init_worker+0x30/0x30 ret_from_fork+0x35/0x40 Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e") Tested-by: Oleksandr Natalenko <oleksandr@redhat.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7915: update HE capabilitiesRyder Lee1-18/+26
Sync from SDK to update HE capabilities. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: implement testmode supportFelix Fietkau10-9/+523
Supports sending a configurable number of packets with a specific rate and configurable tx power levels / antenna settings, as well as displaying rx statistics. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: add API for testmode supportFelix Fietkau8-0/+765
This can be used for calibration in the manufacturing process. It supports sending a configurable number of packets with a specific rate and configurable tx power levels / antenna settings. It also supports receiving packets and showing some statistics, including packet counters and detailed RSSI information. It will only be compiled in if CONFIG_NL80211_TESTMODE is enabled Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: vif_mask to struct mt76_phyFelix Fietkau10-19/+16
All drivers use this in pretty much the same way. Moving it to core helps with some checks for the upcoming testmode support Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: use full on-chip memory address for WF_PHY registersFelix Fietkau3-5/+1
Now that the bus access functions can use mapping for accessing full register addresses, use it for WF_PHY registers to keep them constant. Needed for follow-up work on testmode support Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: add support for accessing RF registers via MCUFelix Fietkau4-3/+77
Includes debugfs files for testing it. Will be used for testmode support. Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: add support for accessing mapped registers via bus opsFelix Fietkau2-0/+47
Makes it possible to read/write them via debugfs, similar to mt7603 Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: schedule tx tasklet and sta poll on mac tx freeFelix Fietkau2-4/+6
Unlike on earlier chips, DMA completion on MT7615 does not imply actually having sent out any packets. Since AQL will prevent filling the hardware queues and will only allow more packets to be passed to the driver after tx completion, it makes much more sense to schedule the tx tasklet there. This is also needed for scheduling tx in testmode support Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt76x2e: rename routines in pci.cLorenzo Bianconi1-7/+7
Rely on mt76x2e prefix in mt76x2/pci.c and align to the rest of mt76 code Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7915: overwrite qid for non-bufferable mgmt framesRyder Lee3-18/+20
Overwrite hw queue id for non-bufferable management frames if the hw/fw support always txq (altxq) in order to be in sync with mac txwi code Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7915: use ieee80211_tx_queue_params to avoid open codedRyder Lee3-19/+10
This is easy to add MU EDCA parameters in the future. This patch also fixes a wrong cw_min assignment. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7915: add MU-MIMO supportRyder Lee4-10/+87
Enable MU-MIMO DL/UL and add relative counters in debugfs. Currently MU modules read WTBL first to notify BA changes to other cross modules, so adjust mt7915_mcu_sta_ba() accordingly. Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7915: add a fixed AC queue mappingRyder Lee4-11/+29
In MT7915, hardware queue map is flexible. However, certain firmware modules like MU and U-APSD presume a fixed queue order to adapt some devices that have DMA scheduler with a strict order, so this patch can help in the long run. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: add .set_tsf callbackRyder Lee2-0/+22
It is useful for IBSS Mesh to adjust t_clockdrift. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: add U-APSD support on AP sideLorenzo Bianconi3-3/+68
Introduce U-APSD support in mt76 driver for AP interface Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: rely on register macrosLorenzo Bianconi2-4/+4
For consistency with the rest of the code always rely on defined macros for register access Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: fix include in pci.hMarkus Theil1-0/+1
kernel test robot <lkp@intel.com> found the following issue and Kalle Valo forwarded it to Linux wireless. drivers/net/wireless/mediatek/mt76/pci.c:8:6: warning: no previous prototype for 'mt76_pci_disable_aspm' Fix this by adding the missing include of mt76.h as Kalle suggested. Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: allow more channels, allowed in ETSI domainMarkus Theil1-0/+3
While looking at the ETSI regulatory domain definitions and a patch, which allows more channels for ath10k, I also checked the channels allowed for mt76. ETSI regulations would possibly allow to add channels 32, 68, 96, 144, 169 and 173. IEEE 802.11-2016 defines no operating class for channels 32, 68 and 96. This leaves us channels 144, 169 and 173, which are included in this patch. I tested 169 and 173 with a mt76 based USB dongle (AVM AC 860) and they worked fine. If I saw that right, these channels are also covered by register definitions inside the driver. Channel 144 should also work, but gets disabled by the kernel as of now. Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: fix up typo in Kconfig for MT7663USean Wang1-1/+1
Fix up typo in Kconfig with indicating MT7663U is an 802.11ac device Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7663: introduce ARP filter offloadSean Wang4-3/+91
Introduce ARP filter offload Co-developed-by: Wan-Feng Jiang <Wan-Feng.Jiang@mediatek.com> Signed-off-by: Wan-Feng Jiang <Wan-Feng.Jiang@mediatek.com> Co-developed-by: Soul Huang <Soul.Huang@mediatek.com> Signed-off-by: Soul Huang <Soul.Huang@mediatek.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: usb: rely on mt76_for_each_q_rxLorenzo Bianconi2-32/+12
Rely on mt76_for_each_q_rx whenever possible in order to simply the code Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: re-enable offloading of sequence number assignmentFelix Fietkau3-8/+40
Preparation for supporting more offload features Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: overwrite qid for non-bufferable mgmt framesLorenzo Bianconi6-15/+18
Overwrite hw queue id for non-bufferable management frames if the hw support always txq (altxq) in order to be in sync with mac txwi code Fixes: cdad4874057d ("mt76: mt7615: add dma and tx queue initialization for MT7622") Fixes: f40ac0f3d3c0 ("mt76: mt7615: introduce mt7663e support") Suggested-by: Felix Fietkau <nbd@nbd.name> Tested-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: fix hw queue mappingLorenzo Bianconi6-28/+45
mt7622/mt7663 chipsets rely on a fixed reverse queue map order respect to mac80211 one: - q(0): IEEE80211_AC_BK - q(1): IEEE80211_AC_BE - q(2): IEEE80211_AC_VI - q(3): IEEE80211_AC_VO Fixes: cdad4874057d ("mt76: mt7615: add dma and tx queue initialization for MT7622") Fixes: f40ac0f3d3c0 ("mt76: mt7615: introduce mt7663e support") Co-developed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Co-developed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: mt7615: fix lmac queue debugsfs entryLorenzo Bianconi1-4/+5
acs and wmm index are swapped in mt7615_queues_acq respect to the hw design Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-21mt76: add missing lock configuring coverage classLorenzo Bianconi3-0/+8
Coverage class callback can potentially run in parallel with other routines (e.g. mt7615_set_channel) that configures timing registers. Run coverage class callback holding mt76 mutex Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
2020-07-20Merge tag 'wireless-drivers-next-2020-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-nextDavid S. Miller124-589/+22380
Kalle Valo says: ==================== wireless-drivers-next patches for v5.9 First set of patches for v5.9. This comes later than usual as I was offline for two weeks. The biggest change here is moving Microchip wilc1000 driver from staging. There was an immutable topic branch with one commit moving the whole driver and the topic branch was pulled both to staging-next and wireless-drivers-next. At the moment the only reported conflict is in MAINTAINERS file, so I'm hoping the move should go smoothly. Other notable changes are ath11k getting 6 GHz band support and rtw88 supporting RTL8821CE. And there's also the usual fixes, API changes and cleanups all over. Major changes: wilc1000 * move from drivers/staging to drivers/net/wireless/microchip ath11k * add 6G band support * add spectral scan support iwlwifi * make FW reconfiguration quieter by not using warn level rtw88 * add support for RTL8821CE ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-20ath10k: Fix NULL pointer dereference in AHB device probeHauke Mehrtens2-42/+38
This fixes a NULL pointer dereference in the probe path for AHB devices. There attr parameter in the ath10k_ce_alloc_pipe() function is not initialized, but accessed. This function is called by ath10k_pci_setup_resource() which is called by ath10k_ahb_probe(). The struct ath10k_pci is also used for AHB devices and not only for PCI devices. The initialization of the new members of struct ath10k_pci is moved to ath10k_pci_setup_resource() which is used by the PCI and the AHB code. This also fixes a use after free bug in ath10k_pci_remove() when ar_pci is accessed after ath10k_core_destroy() was called, which calls ieee80211_free_hw() and frees this memory. This fixes the following bug seen with backports-5.8-rc2 on OpenWrt on a IPQ4019 device: [ 11.117462] 8<--- cut here --- [ 11.117494] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 11.119510] pgd = f377fd58 [ 11.127657] [00000000] *pgd=8e9a0835, *pte=00000000, *ppte=00000000 [ 11.130206] Internal error: Oops: 17 [#1] SMP ARM [ 11.136339] Modules linked in: ath10k_pci(+) ath10k_core ath xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD pppox ppp_generic nf_nat nf_flow_table_hw nf_flow_table nf_conntrack_rtcache nf_conntrack mac80211 ipt_REJECT cfg80211 xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG slhc nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables crc_ccitt compat nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom gpio_button_hotplug [ 11.174355] CPU: 2 PID: 257 Comm: kmodloader Not tainted 5.4.51 #0 [ 11.196585] Hardware name: Generic DT based system [ 11.202746] PC is at ath10k_ce_alloc_pipe+0x58/0x180 [ath10k_core] [ 11.207459] LR is at ath10k_pci_alloc_pipes+0x94/0xc8 [ath10k_pci] [ 11.213600] pc : [<bf2c96cc>] lr : [<bf2fbf98>] psr: 80000013 [ 11.219760] sp : cea0dc90 ip : cf4001f0 fp : 00000001 [ 11.225923] r10: 00000000 r9 : 00000018 r8 : ce4963b4 [ 11.231133] r7 : 00000000 r6 : ce491ea0 r5 : 00000000 r4 : ce4963b4 [ 11.236342] r3 : 0004a000 r2 : 0004a000 r1 : bf2d0d70 r0 : 00000006 [ 11.242942] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 11.249452] Control: 10c5387d Table: 8e9c006a DAC: 00000051 [ 11.256656] Process kmodloader (pid: 257, stack limit = 0xaba286ca) [ 11.262386] Stack: (0xcea0dc90 to 0xcea0e000) [ 11.268462] dc80: 00000000 ce49629c ce491ea0 ce4963bc [ 11.272984] dca0: ce495ea0 bf2fbf98 00000002 ce4963a8 ce495ea0 00000000 ce491ea0 cf95d800 [ 11.281142] dcc0: cf95d810 cf95d810 00000001 bf2fc854 00000000 cf95d800 bf300748 ce495ea0 [ 11.289304] dce0: ce491ea0 d1300000 cf95d800 bf2fde8c 00000000 00000001 ce49cea0 00000000 [ 11.297462] dd00: 00000000 00000000 bf3010a0 cf95d810 bf3010a0 c0b61580 00000000 00000000 [ 11.305624] dd20: bf3010a0 0000000b c0b04e48 c06110c8 c0b61588 cf95d810 c0b61580 c060f740 [ 11.313781] dd40: cf95d810 00000000 bf3010a0 00000000 00000000 ce49d2a4 bf301100 c060fc90 [ 11.321943] dd60: 00000000 bf3010a0 cf95d810 c060fcf0 cf95d810 bf3010a0 c060fc98 c060dca4 [ 11.330101] dd80: cf809d58 cf952cb4 bf3010a0 ce967900 c0b1f2c8 c060ec28 bf3007b8 bf301038 [ 11.338263] dda0: bf3010a0 bf3010a0 c0b2d4d4 ffffe000 bf304000 c0610278 c0b04e48 c0b2d4d4 [ 11.346422] ddc0: ffffe000 bf2fe2b4 c0b04e48 bf30403c c0b04e48 c0302764 8040003f 00000001 [ 11.354582] dde0: 38e38e39 ce513580 c0b2cb50 cf801e00 cffbc6ac ce513600 cf801e00 cffbc6ac [ 11.362740] de00: 8040003e ce49d280 00000001 c0428d54 00000001 cf801e00 cffbc6ac ce513580 [ 11.370900] de20: ce49d280 0e391998 bf301100 ce49d340 d12d2000 ce49d280 00000001 c0398c2c [ 11.379061] de40: 00000001 cea0df34 cea0df34 00000001 d12d2000 c039ae48 bf30110c 00007fff [ 11.387221] de60: bf301100 c0398044 cf804028 bf301148 c0397674 bf30126c c08ee5c0 c08ee70c [ 11.395380] de80: bf30110c c0b04e48 c08ee518 00000000 c08ee570 c0b04e48 ce513600 fffff000 [ 11.403540] dea0: 00000001 ce513580 0000000d 0000000d 00000000 00000000 00000000 00000000 [ 11.411698] dec0: 00000000 00000000 6e72656b 00006c65 00000000 00000000 00000000 00000000 [ 11.419858] dee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 11.428018] df00: 00000000 0e391998 00000000 0000c610 d12de610 00000000 0062c620 ffffe000 [ 11.436180] df20: 000129d1 00000051 00000000 c039b228 00000000 d12d7afd d12d8e80 d12d2000 [ 11.444337] df40: 0000c610 d12de0e8 d12ddfa8 d12dab74 00009000 00009570 00003a2c 00009cae [ 11.452498] df60: 00000000 00000000 00000000 00003a1c 0000001e 0000001f 00000018 00000000 [ 11.460656] df80: 00000010 00000000 00000000 00000000 00000003 00000080 c0301204 cea0c000 [ 11.468817] dfa0: 00000080 c0301000 00000000 00000000 00620010 0000c610 000129d1 00000014 [ 11.476975] dfc0: 00000000 00000000 00000003 00000080 0000c610 00000000 b6fc1d20 00000000 [ 11.485137] dfe0: bef0ad14 bef0acf8 00011e14 b6f74c94 60000010 00620010 00000000 00000000 [ 11.493390] [<bf2c96cc>] (ath10k_ce_alloc_pipe [ath10k_core]) from [<bf2fbf98>] (ath10k_pci_alloc_pipes+0x94/0xc8 [ath10k_pci]) [ 11.501498] [<bf2fbf98>] (ath10k_pci_alloc_pipes [ath10k_pci]) from [<bf2fc854>] (ath10k_pci_setup_resource+0xb8/0xf0 [ath10k_pci]) [ 11.512773] [<bf2fc854>] (ath10k_pci_setup_resource [ath10k_pci]) from [<bf2fde8c>] (ath10k_ahb_probe+0x32c/0x670 [ath10k_pci]) [ 11.524566] [<bf2fde8c>] (ath10k_ahb_probe [ath10k_pci]) from [<c06110c8>] (platform_drv_probe+0x34/0x70) [ 11.536016] [<c06110c8>] (platform_drv_probe) from [<c060f740>] (really_probe+0x1f0/0x358) [ 11.545729] [<c060f740>] (really_probe) from [<c060fc90>] (device_driver_attach+0x58/0x60) [ 11.553886] [<c060fc90>] (device_driver_attach) from [<c060fcf0>] (__driver_attach+0x58/0xcc) [ 11.562134] [<c060fcf0>] (__driver_attach) from [<c060dca4>] (bus_for_each_dev+0x68/0x8c) [ 11.570731] [<c060dca4>] (bus_for_each_dev) from [<c060ec28>] (bus_add_driver+0x1c8/0x1d8) [ 11.578886] [<c060ec28>] (bus_add_driver) from [<c0610278>] (driver_register+0x74/0x108) [ 11.587060] [<c0610278>] (driver_register) from [<bf2fe2b4>] (ath10k_ahb_init+0x18/0x38 [ath10k_pci]) [ 11.595320] [<bf2fe2b4>] (ath10k_ahb_init [ath10k_pci]) from [<bf30403c>] (init_module+0x3c/0x1000 [ath10k_pci]) [ 11.604432] [<bf30403c>] (init_module [ath10k_pci]) from [<c0302764>] (do_one_initcall+0x84/0x1d8) [ 11.614657] [<c0302764>] (do_one_initcall) from [<c0398c2c>] (do_init_module+0x5c/0x228) [ 11.623421] [<c0398c2c>] (do_init_module) from [<c039ae48>] (load_module+0x1fc8/0x224c) [ 11.631663] [<c039ae48>] (load_module) from [<c039b228>] (sys_init_module+0x15c/0x17c) [ 11.639390] [<c039b228>] (sys_init_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54) [ 11.647370] Exception stack(0xcea0dfa8 to 0xcea0dff0) [ 11.655615] dfa0: 00000000 00000000 00620010 0000c610 000129d1 00000014 [ 11.660569] dfc0: 00000000 00000000 00000003 00000080 0000c610 00000000 b6fc1d20 00000000 [ 11.668725] dfe0: bef0ad14 bef0acf8 00011e14 b6f74c94 [ 11.676886] Code: e1c321d4 e0433002 e0232397 e5843014 (e5953000) [ 11.681958] ---[ end trace 8f35917de2e76854 ]--- Fixes: 521fc37be3d8 ("ath10k: Avoid override CE5 configuration for QCA99X0 chipsets") Reported-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> [ipq40xx/ map-ac2200] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200714205802.17688-1-hauke@hauke-m.de
2020-07-20ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()Zekun Shen1-0/+8
The idx in __ath10k_htt_rx_ring_fill_n function lives in consistent dma region writable by the device. Malfunctional or malicious device could manipulate such idx to have a OOB write. Either by htt->rx_ring.netbufs_ring[idx] = skb; or by ath10k_htt_set_paddrs_ring(htt, paddr, idx); The idx can also be negative as it's signed, giving a large memory space to write to. It's possibly exploitable by corruptting a legit pointer with a skb pointer. And then fill skb with payload as rougue object. Part of the log here. Sometimes it appears as UAF when writing to a freed memory by chance. [ 15.594376] BUG: unable to handle page fault for address: ffff887f5c1804f0 [ 15.595483] #PF: supervisor write access in kernel mode [ 15.596250] #PF: error_code(0x0002) - not-present page [ 15.597013] PGD 0 P4D 0 [ 15.597395] Oops: 0002 [#1] SMP KASAN PTI [ 15.597967] CPU: 0 PID: 82 Comm: kworker/u2:2 Not tainted 5.6.0 #69 [ 15.598843] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 15.600438] Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core] [ 15.601389] RIP: 0010:__ath10k_htt_rx_ring_fill_n (linux/drivers/net/wireless/ath/ath10k/htt_rx.c:173) ath10k_core Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200623221105.3486-1-bruceshenzk@gmail.com
2020-07-20ath9k: Check the return value of pcie_capability_read_*()Bolarinwa Olayemi Saheed1-2/+3
On failure pcie_capability_read_dword() sets it's last parameter, val to 0. However, with Patch 14/14, it is possible that val is set to ~0 on failure. This would introduce a bug because (x & x) == (~0 & x). This bug can be avoided without changing the function's behaviour if the return value of pcie_capability_read_dword is checked to confirm success. Check the return value of pcie_capability_read_dword() to ensure success. Suggested-by: Bjorn Helgaas <bjorn@helgaas.com> Signed-off-by: Bolarinwa Olayemi Saheed <refactormyself@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200713175529.29715-2-refactormyself@gmail.com
2020-07-20iwlwifi: Make some Killer Wireless-AC 1550 cards work againAlessio Bonfiglio1-0/+2
Fix the regression introduced by commit c8685937d07f ("iwlwifi: move pu devices to new table") by adding the ids and the configurations of two missing Killer 1550 cards in order to configure and let them work correctly again (following the new table convention). Resolve bug 208141 ("Wireless ac 9560 not working kernel 5.7.2", https://bugzilla.kernel.org/show_bug.cgi?id=208141). Fixes: c8685937d07f ("iwlwifi: move pu devices to new table") Signed-off-by: Alessio Bonfiglio <alessio.bonfiglio@mail.polimi.it> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200714091911.4442-1-alessio.bonfiglio@mail.polimi.it
2020-07-20ath9k: Fix regression with Atheros 9271Mark O'Donovan1-1/+3
This fix allows ath9k_htc modules to connect to WLAN once again. Fixes: 2bbcaaee1fcb ("ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb") Link: https://bugzilla.kernel.org/show_bug.cgi?id=208251 Signed-off-by: Mark O'Donovan <shiftee@posteo.net> Reported-by: Roman Mamedov <rm@romanrm.net> Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200711043324.8079-1-shiftee@posteo.net
2020-07-16treewide: Remove uninitialized_var() usageKees Cook13-19/+19
Using uninitialized_var() is dangerous as it papers over real bugs[1] (or can in the future), and suppresses unrelated compiler warnings (e.g. "unused variable"). If the compiler thinks it is uninitialized, either simply initialize the variable or make compiler changes. In preparation for removing[2] the[3] macro[4], remove all remaining needless uses with the following script: git grep '\buninitialized_var\b' | cut -d: -f1 | sort -u | \ xargs perl -pi -e \ 's/\buninitialized_var\(([^\)]+)\)/\1/g; s:\s*/\* (GCC be quiet|to make compiler happy) \*/$::g;' drivers/video/fbdev/riva/riva_hw.c was manually tweaked to avoid pathological white-space. No outstanding warnings were found building allmodconfig with GCC 9.3.0 for x86_64, i386, arm64, arm, powerpc, powerpc64le, s390x, mips, sparc64, alpha, and m68k. [1] https://lore.kernel.org/lkml/20200603174714.192027-1-glider@google.com/ [2] https://lore.kernel.org/lkml/CA+55aFw+Vbj0i=1TGqCR5vQkCzWJ0QxK6CernOU6eedsudAixw@mail.gmail.com/ [3] https://lore.kernel.org/lkml/CA+55aFwgbgqhbp1fkxvRKEpzyR5J8n1vKT1VZdz9knmPuXhOeg@mail.gmail.com/ [4] https://lore.kernel.org/lkml/CA+55aFz2500WfbKXAx8s67wrm9=yVJu65TpLgN_ybYNv0VEOKA@mail.gmail.com/ Reviewed-by: Leon Romanovsky <leonro@mellanox.com> # drivers/infiniband and mlx4/mlx5 Acked-by: Jason Gunthorpe <jgg@mellanox.com> # IB Acked-by: Kalle Valo <kvalo@codeaurora.org> # wireless drivers Reviewed-by: Chao Yu <yuchao0@huawei.com> # erofs Signed-off-by: Kees Cook <keescook@chromium.org>
2020-07-16rtlwifi: rtl8192cu: Remove uninitialized_var() usageKees Cook1-2/+2
Using uninitialized_var() is dangerous as it papers over real bugs[1] (or can in the future), and suppresses unrelated compiler warnings (e.g. "unused variable"). If the compiler thinks it is uninitialized, either simply initialize the variable or make compiler changes. As a precursor to removing[2] this[3] macro[4], just initialize this variable to NULL, and avoid sending garbage by returning. [1] https://lore.kernel.org/lkml/20200603174714.192027-1-glider@google.com/ [2] https://lore.kernel.org/lkml/CA+55aFw+Vbj0i=1TGqCR5vQkCzWJ0QxK6CernOU6eedsudAixw@mail.gmail.com/ [3] https://lore.kernel.org/lkml/CA+55aFwgbgqhbp1fkxvRKEpzyR5J8n1vKT1VZdz9knmPuXhOeg@mail.gmail.com/ [4] https://lore.kernel.org/lkml/CA+55aFz2500WfbKXAx8s67wrm9=yVJu65TpLgN_ybYNv0VEOKA@mail.gmail.com/ Fixes: dc0313f46664 ("rtlwifi: rtl8192cu: Add routine hw") Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Acked-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Kees Cook <keescook@chromium.org>
2020-07-16b43: Remove uninitialized_var() usageKees Cook1-1/+1
Using uninitialized_var() is dangerous as it papers over real bugs[1] (or can in the future), and suppresses unrelated compiler warnings (e.g. "unused variable"). If the compiler thinks it is uninitialized, either simply initialize the variable or make compiler changes. As a precursor to removing[2] this[3] macro[4], just initialize this variable to NULL. No later NULL deref is possible due to the early returns outside of the (phy->rev >= 7 && phy->rev < 19) case, which explicitly tests for NULL. [1] https://lore.kernel.org/lkml/20200603174714.192027-1-glider@google.com/ [2] https://lore.kernel.org/lkml/CA+55aFw+Vbj0i=1TGqCR5vQkCzWJ0QxK6CernOU6eedsudAixw@mail.gmail.com/ [3] https://lore.kernel.org/lkml/CA+55aFwgbgqhbp1fkxvRKEpzyR5J8n1vKT1VZdz9knmPuXhOeg@mail.gmail.com/ [4] https://lore.kernel.org/lkml/CA+55aFz2500WfbKXAx8s67wrm9=yVJu65TpLgN_ybYNv0VEOKA@mail.gmail.com/ Fixes: 58619b14d106 ("b43: move under broadcom vendor directory") Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: Kees Cook <keescook@chromium.org>
2020-07-15wireless: Fix trivial spellingKieran Bingham3-3/+3
The word 'descriptor' is misspelled throughout the tree. Fix it up accordingly: decriptors -> descriptors Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200715124839.252822-5-kieran.bingham+renesas@ideasonboard.com
2020-07-15iwlegacy: Check the return value of pcie_capability_read_*()Bolarinwa Olayemi Saheed1-2/+2
On failure pcie_capability_read_dword() sets it's last parameter, val to 0. However, with Patch 14/14, it is possible that val is set to ~0 on failure. This would introduce a bug because (x & x) == (~0 & x). This bug can be avoided without changing the function's behaviour if the return value of pcie_capability_read_dword is checked to confirm success. Check the return value of pcie_capability_read_dword() to ensure success. Suggested-by: Bjorn Helgaas <bjorn@helgaas.com> Signed-off-by: Bolarinwa Olayemi Saheed <refactormyself@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200713175529.29715-3-refactormyself@gmail.com
2020-07-15zd1211rw: remove needless check before usb_free_coherent()Xu Wang1-3/+1
usb_free_coherent() is safe with NULL addr and this check is not required. Signed-off-by: Xu Wang <vulab@iscas.ac.cn> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200630070404.8207-1-vulab@iscas.ac.cn
2020-07-15rtlwifi: 8821ae: remove unused path B parameters from swing tablePing-Ke Shih1-54/+2
8821AE is a 1x1 chip, so swing parameters for path B aren't necessary. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200629055843.25394-2-pkshih@realtek.com
2020-07-15rtlwifi: Use const in 8188ee/8723be/8821ae swing_table declarationsJoe Perches3-58/+64
Reduce data usage about 1KB by using const. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200629055843.25394-1-pkshih@realtek.com
2020-07-15airo: use set_current_state macroXu Wang1-1/+1
Use set_current_state macro instead of current->state = TASK_RUNNING. Signed-off-by: Xu Wang <vulab@iscas.ac.cn> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200702015701.8606-1-vulab@iscas.ac.cn
2020-07-15iwlegacy: remove redundant initialization of variable tidColin Ian King1-1/+1
The variable tid is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200701135221.549700-1-colin.king@canonical.com
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.