31419 Commits

Author SHA1 Message Date
Haim Dreyfuss
d3b4dc014c iwlwifi: mvm: add support for new version for D0I3_END_CMD
During D3 state there are some flows which requires FW reset.
Add new API to support it.

Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:10:05 +03:00
Mordechay Goodstein
ee4cce9b9d iwlwifi: mvm: consider ieee80211 station max amsdu value
debugfs amsdu_len sets only the max_amsdu_len for ieee80211 station
so take it into consideration while getting max amsdu

Fixes: af2984e9e625 ("iwlwifi: mvm: add a debugfs entry to set a fixed size AMSDU for all TX packets")
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:10:03 +03:00
Shahar S Matityahu
eae7550b9d iwlwifi: dbg_ini: support FW notification dumping in case of missed beacon
Pass the FW notification packet to the dump collection flow to allow
the driver to include it in the dump file if requested.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:10:00 +03:00
Shahar S Matityahu
b87384af8d iwlwifi: dbg_ini: remove old API and some related code
Remove unused code of the old debug ini API.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:56 +03:00
Shahar S Matityahu
e8d9e982bf iwlwifi: dbg_ini: rename external debug configuration file
Rename the external configuration file to align to the debug SAS.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:53 +03:00
Shahar S Matityahu
3ed34fbf9d iwlwifi: dbg_ini: support FW response/notification region type
Allow the driver to collect FW response/notification region type
during dump and allow triggering dump collection for a given FW
response/notification.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:51 +03:00
Shahar S Matityahu
068893b7a2 iwlwifi: dbg_ini: support domain changing via debugfs
Allow to change or read the debug domain bitmap at runtime via
fw_dbg_domain debugfs.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:48 +03:00
Shahar S Matityahu
60e8abd9d3 iwlwifi: dbg_ini: add periodic trigger new API support
Enable periodic trigger.
Allows the driver to trigger dump collection in constant intervals.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:45 +03:00
Shahar S Matityahu
14124b2578 iwlwifi: dbg_ini: implement monitor allocation flow
Allow allocating fragmented buffers for several allocation IDs.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:43 +03:00
Shahar S Matityahu
cf29c5b66b iwlwifi: dbg_ini: implement time point handling
Calculate active triggers list and implement time points handling.
Also allow to override the debug domain via iwl-dbg-cfg.ini by setting
FW_DBG_DOMAIN field.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:40 +03:00
Shahar S Matityahu
a9248de424 iwlwifi: dbg_ini: add TLV allocation new API support
Add new debug TLVs API preprocessing.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:37 +03:00
Shahar S Matityahu
677d25b237 iwlwifi: dbg_ini: use new API in dump info
Make dump info region use new API.
debug_info_tlv_list list will be initialize in a future patch once the
driver will start using it.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:34 +03:00
Shahar S Matityahu
a77e3d2829 iwlwifi: dbg_ini: add error tables dumping support
Allow to collect error table data.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:32 +03:00
Shahar S Matityahu
593fae3e5e iwlwifi: dbg_ini: add monitor dumping support
Allow collecting monitor data in ini debug mode.
Implement both SMEM and DRAM monitor regions dumping.
For DRAM monitor, support DBGC1, DBGC2 and DBGC3 and support several
DRAM fragments per DBGC.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:29 +03:00
Shahar S Matityahu
69f0e5059b iwlwifi: dbg: remove multi buffers infra
Legacy DRAM monitor does not support multi buffers.
Remove this infra.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:26 +03:00
Shahar S Matityahu
3b589d5624 iwlwifi: dbg_ini: use new trigger TLV in dump flow
Make dump flow use the new trigger TLV.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:24 +03:00
Shahar S Matityahu
c9fe75e9f3 iwlwifi: dbg_ini: use new region TLV in dump flow
Make dump flow use the new region TLV and update the region type enum.
Temporarily remove monitor dumping support. Support will be readded in a
future patch.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:19 +03:00
Shahar S Matityahu
c03fe6d3b3 iwlwifi: dbg_ini: load external dbg cfg after internal cfg is loaded
In the new API implementation the driver does not keep the internal and
external debug configurations in separate structs so the last
configuration that is loaded overrides the previous ones (this is true
only in some of the TLVs e.g. the buffer allocation TLV).
Load the external configuration after the internal is loaded so that
user configuration will override the default coming with the FW.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-10-25 10:09:14 +03:00
Taehee Yoo
1962f86b42 virt_wifi: fix refcnt leak in module exit routine
virt_wifi_newlink() calls netdev_upper_dev_link() and it internally
holds reference count of lower interface.

Current code does not release a reference count of the lower interface
when the lower interface is being deleted.
So, reference count leaks occur.

Test commands:
    ip link add dummy0 type dummy
    ip link add vw1 link dummy0 type virt_wifi
    ip link del dummy0

Splat looks like:
[  133.787526][  T788] WARNING: CPU: 1 PID: 788 at net/core/dev.c:8274 rollback_registered_many+0x835/0xc80
[  133.788355][  T788] Modules linked in: virt_wifi cfg80211 dummy team af_packet sch_fq_codel ip_tables x_tables unix
[  133.789377][  T788] CPU: 1 PID: 788 Comm: ip Not tainted 5.4.0-rc3+ #96
[  133.790069][  T788] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  133.791167][  T788] RIP: 0010:rollback_registered_many+0x835/0xc80
[  133.791906][  T788] Code: 00 4d 85 ff 0f 84 b5 fd ff ff ba c0 0c 00 00 48 89 de 4c 89 ff e8 9b 58 04 00 48 89 df e8 30
[  133.794317][  T788] RSP: 0018:ffff88805ba3f338 EFLAGS: 00010202
[  133.795080][  T788] RAX: ffff88805e57e801 RBX: ffff88805ba34000 RCX: ffffffffa9294723
[  133.796045][  T788] RDX: 1ffff1100b746816 RSI: 0000000000000008 RDI: ffffffffabcc4240
[  133.797006][  T788] RBP: ffff88805ba3f4c0 R08: fffffbfff5798849 R09: fffffbfff5798849
[  133.797993][  T788] R10: 0000000000000001 R11: fffffbfff5798848 R12: dffffc0000000000
[  133.802514][  T788] R13: ffff88805ba3f440 R14: ffff88805ba3f400 R15: ffff88805ed622c0
[  133.803237][  T788] FS:  00007f2e9608c0c0(0000) GS:ffff88806cc00000(0000) knlGS:0000000000000000
[  133.804002][  T788] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.804664][  T788] CR2: 00007f2e95610603 CR3: 000000005f68c004 CR4: 00000000000606e0
[  133.805363][  T788] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.806073][  T788] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.806787][  T788] Call Trace:
[  133.807069][  T788]  ? generic_xdp_install+0x310/0x310
[  133.807612][  T788]  ? lock_acquire+0x164/0x3b0
[  133.808077][  T788]  ? is_bpf_text_address+0x5/0xf0
[  133.808640][  T788]  ? deref_stack_reg+0x9c/0xd0
[  133.809138][  T788]  ? __nla_validate_parse+0x98/0x1ab0
[  133.809944][  T788]  unregister_netdevice_many.part.122+0x13/0x1b0
[  133.810599][  T788]  rtnl_delete_link+0xbc/0x100
[  133.811073][  T788]  ? rtnl_af_register+0xc0/0xc0
[  133.811672][  T788]  rtnl_dellink+0x30e/0x8a0
[  133.812205][  T788]  ? is_bpf_text_address+0x5/0xf0
[ ... ]

[  144.110530][  T788] unregister_netdevice: waiting for dummy0 to become free. Usage count = 1

This patch adds notifier routine to delete upper interface before deleting
lower interface.

Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-24 14:53:49 -07:00
Taehee Yoo
ab92d68fc2 net: core: add generic lockdep keys
Some interface types could be nested.
(VLAN, BONDING, TEAM, MACSEC, MACVLAN, IPVLAN, VIRT_WIFI, VXLAN, etc..)
These interface types should set lockdep class because, without lockdep
class key, lockdep always warn about unexisting circular locking.

In the current code, these interfaces have their own lockdep class keys and
these manage itself. So that there are so many duplicate code around the
/driver/net and /net/.
This patch adds new generic lockdep keys and some helper functions for it.

This patch does below changes.
a) Add lockdep class keys in struct net_device
   - qdisc_running, xmit, addr_list, qdisc_busylock
   - these keys are used as dynamic lockdep key.
b) When net_device is being allocated, lockdep keys are registered.
   - alloc_netdev_mqs()
c) When net_device is being free'd llockdep keys are unregistered.
   - free_netdev()
d) Add generic lockdep key helper function
   - netdev_register_lockdep_key()
   - netdev_unregister_lockdep_key()
   - netdev_update_lockdep_key()
e) Remove unnecessary generic lockdep macro and functions
f) Remove unnecessary lockdep code of each interfaces.

After this patch, each interface modules don't need to maintain
their lockdep keys.

Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-24 14:53:48 -07:00
Chris Chiu
b298800dd8 rtl8xxxu: fix warnings for symbol not declared
Fix the following sparse warnings.
sparse: symbol 'rtl8723bu_set_coex_with_type' was not declared.
Should it be static?
sparse: symbol 'rtl8723bu_update_bt_link_info' was not declared.
Should it be static?
sparse: symbol 'rtl8723bu_handle_bt_inquiry' was not declared.
Should it be static?
sparse: symbol 'rtl8723bu_handle_bt_info' was not declared.
Should it be static?

Signed-off-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:50:02 +03:00
YueHaibing
4fcef86091 rtl8xxxu: remove set but not used variable 'rate_mask'
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c:4484:6:
 warning: variable rate_mask set but not used [-Wunused-but-set-variable]

It is never used since commit a9bb0b515778 ("rtl8xxxu: Improve
TX performance of RTL8723BU on rtl8xxxu driver")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:49:04 +03:00
YueHaibing
d0c160b18e atmel: remove set but not used variable 'dev'
Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/wireless/atmel/atmel_cs.c:120:21:
 warning: variable dev set but not used [-Wunused-but-set-variable]

It is never used, so can remove it.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:48:31 +03:00
YueHaibing
f64b06bd36 adm80211: remove set but not used variables 'mem_addr' and 'io_addr'
Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/wireless/admtek/adm8211.c:1784:16:
 warning: variable mem_addr set but not used [-Wunused-but-set-variable]
drivers/net/wireless/admtek/adm8211.c:1785:15:
 warning: variable io_addr set but not used [-Wunused-but-set-variable]

They are never used, so can be removed.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:48:00 +03:00
Nathan Chancellor
091c6e9c08 rtlwifi: Remove unnecessary NULL check in rtl_regd_init
When building with Clang + -Wtautological-pointer-compare:

drivers/net/wireless/realtek/rtlwifi/regd.c:389:33: warning: comparison
of address of 'rtlpriv->regd' equal to a null pointer is always false
[-Wtautological-pointer-compare]
        if (wiphy == NULL || &rtlpriv->regd == NULL)
                              ~~~~~~~~~^~~~    ~~~~
1 warning generated.

The address of an array member is never NULL unless it is the first
struct member so remove the unnecessary check. This was addressed in
the staging version of the driver in commit f986978b32b3 ("Staging:
rtlwifi: remove unnecessary NULL check").

While we are here, fix the following checkpatch warning:

CHECK: Comparison to NULL could be written "!wiphy"
35: FILE: drivers/net/wireless/realtek/rtlwifi/regd.c:389:
+       if (wiphy == NULL)

Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
Link:https://github.com/ClangBuiltLinux/linux/issues/750
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:47:07 +03:00
Tsang-Shian Lin
082a36dc99 rtw88: add phy_info debugfs to show Tx/Rx physical status
This commit adds several Tx/Rx physical information to phy_info
debugfs for 8822B/8822C. By this debugfs, we can know physical
information, such as Tx/Rx rate, RSSI, EVM,SNR, etc. The
information is gotten from the packets of Tx/Rx path. It has
no impact for the performance of 8822B/8822C.

In the fields, we may meet different kinds of problems, but
we may have no professional instrument to check them. At
this moment, this debugfs is a good tool, and it may provide
useful information for debug.

Signed-off-by: Tsang-Shian Lin <thlin@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Reviewed-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:46:25 +03:00
Tzu-En Huang
f39e9bd49a rtw88: add set_bitrate_mask support
Support setting bit rate from upper layer.
After configuring the original rate control result in the driver, the
result is then masked by the bit rate mask received from the ops
set_bitrate_mask. Lastly, the masked result will be sent to firmware.

Signed-off-by: Tzu-En Huang <tehuang@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Reviewed-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:46:24 +03:00
Tzu-En Huang
0bd9557341 rtw88: Enable 802.11ac beamformee support
Enable MU-MIMO transmit beamformee support for chipset 8822b and 8822c.

If the driver is in station mode and associated with an AP, and the
capabilities of both meet the requirement of beamforming, driver will
run as a beamformee and the corresponding chip settings will be set.

In addition, module parameter support_bf is added to enable or disable
beamforming. Sometimes driver will need to disable for inter-operate
issues, and it would be easier for driver to debug.

Signed-off-by: Tzu-En Huang <tehuang@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:46:22 +03:00
Tzu-En Huang
c97ee3e0be rtw88: add power tracking support
The temperature of the chip can affect the output power
of the RF components. Hence driver requires to compensate
the power by adjusting the power index recorded in the
power swing table.

And if the difference of current thermal value to the
default thermal value exceeds a threshold, the RF IQK
should be triggered to re-calibrate the characteristics
of the RF components, to keep the output IQ vectors of
the RF components orthogonal enough.

Signed-off-by: Tzu-En Huang <tehuang@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Reviewed-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:46:21 +03:00
Yan-Hsuan Chuang
8575b534b0 rtw88: use macro to check the current band
Add macros to see which band we are, based on the current channel.

Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-24 08:46:20 +03:00
Larry Finger
b43f4a169f rtlwifi: rtl_pci: Fix problem of too small skb->len
In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap
only"), buffers whose length is too short cause a WARN_ON(1) to be
executed. This change exposed a fault in rtlwifi drivers, which is fixed
by regarding packets with skb->len <= FCS_LEN as though they are in error
and dropping them. The test is now annotated as likely.

Cc: Stable <stable@vger.kernel.org> # v5.0+
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:32:39 +03:00
Luca Coelho
17c216ed6b iwlwifi: pcie: 0x2720 is qu and 0x30DC is not
When converting the wrong qu configurations in an earlier commit, I
accidentally swapped 0x2720 and 0x30DC.  Instead of converting 0x2720,
I converted 0x30DC.  Undo 0x30DC and convert 0x2720.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:31:34 +03:00
Luca Coelho
9a47cb9883 iwlwifi: pcie: add workaround for power gating in integrated 22000
Add a workaround that forces power gating to be enabled on integrated
22000 devices.  This improves power saving in certain situations.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:31:33 +03:00
Johannes Berg
91cf5dede5 iwlwifi: mvm: handle iwl_mvm_tvqm_enable_txq() error return
iwl_mvm_tvqm_enable_txq() can return an error, notably if unable
to allocate memory for the queue. Handle this error throughout,
avoiding storing the invalid value into a u16 which later leads
to a disable of an invalid queue ("queue 65524 not used", where
65524 is just -ENOMEM in a u16).

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:31:33 +03:00
Luca Coelho
e55890150a iwlwifi: pcie: fix all 9460 entries for qnj
A bunch of the entries for qnj were wrong.  The 9460 device doesn't
exist, so update them to 9461 and 9462.  There are still a bunch of
other occurrences of 9460, but that will be fixed separately.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:31:32 +03:00
Luca Coelho
6dea7da701 iwlwifi: pcie: fix PCI ID 0x2720 configs that should be soc
Some entries for PCI ID 0x2720 were using iwl9260_2ac_cfg, but the
correct is to use iwl9260_2ac_cfg_soc.  Fix that.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:31:31 +03:00
Laura Abbott
8c55dedb79 rtlwifi: Fix potential overflow on P2P code
Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bound noa_num against P2P_MAX_NOA_NUM.

Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:30:51 +03:00
Luca Coelho
7cded56583 iwlwifi: pcie: fix merge damage on making QnJ exclusive
Two patches were sent out of order: one removed some conditions from
an if and the other moved the code elsewhere.  When sending the patch
that moved the code, an older version of the original code was moved,
causing the "make QnJ exclusive" code to be essentially undone.

Fix that by removing the inclusive conditions from the check again.

Fixes: 809805a820c6 ("iwlwifi: pcie: move some cfg mangling from trans_pcie_alloc to probe")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-23 13:29:11 +03:00
Hui Peng
bfd6e6e6c5 ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe
The `ar_usb` field of `ath10k_usb_pipe_usb_pipe` objects
are initialized to point to the containing `ath10k_usb` object
according to endpoint descriptors read from the device side, as shown
below in `ath10k_usb_setup_pipe_resources`:

for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
        endpoint = &iface_desc->endpoint[i].desc;

        // get the address from endpoint descriptor
        pipe_num = ath10k_usb_get_logical_pipe_num(ar_usb,
                                                endpoint->bEndpointAddress,
                                                &urbcount);
        ......
        // select the pipe object
        pipe = &ar_usb->pipes[pipe_num];

        // initialize the ar_usb field
        pipe->ar_usb = ar_usb;
}

The driver assumes that the addresses reported in endpoint
descriptors from device side  to be complete. If a device is
malicious and does not report complete addresses, it may trigger
NULL-ptr-deref `ath10k_usb_alloc_urb_from_pipe` and
`ath10k_usb_free_urb_to_pipe`.

This patch fixes the bug by preventing potential NULL-ptr-deref.

Signed-off-by: Hui Peng <benquike@gmail.com>
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[groeck: Add driver tag to subject, fix build warning]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-22 11:37:18 +03:00
Chris Chiu
0eeb91ade9 rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
The RTL8723BU has problems connecting to AP after each warm reboot.
Sometimes it returns no scan result, and in most cases, it fails
the authentication for unknown reason. However, it works totally
fine after cold reboot.

Compare the value of register SYS_CR and SYS_CLK_MAC_CLK_ENABLE
for cold reboot and warm reboot, the registers imply that the MAC
is already powered and thus some procedures are skipped during
driver initialization. Double checked the vendor driver, it reads
the SYS_CR and SYS_CLK_MAC_CLK_ENABLE also but doesn't skip any
during initialization based on them. This commit only tells the
RTL8723BU to do full initialization without checking MAC status.

Signed-off-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-22 11:26:13 +03:00
David S. Miller
2f184393e0 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Several cases of overlapping changes which were for the most
part trivially resolvable.

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-20 10:43:00 -07:00
Brian Norris
89dca86d29 rtw88: mark rtw_fw_hdr __packed
The use of u8 and __le16 in this struct assumes that it's going to be
packed to byte alignment. C doesn't guarantee that, so we should mark
this __packed.

Fixes: cc20a7139836 ("rtw88: use struct rtw_fw_hdr to access firmware header")
Cc: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-16 10:35:25 +03:00
David S. Miller
9cb0aec9ad wireless-drivers fixes for 5.4
Second set of fixes for 5.4. ath10k regression and iwlwifi BAD_COMMAND
 bug are the ones getting most reports at the moment.
 
 ath10k
 
 * fix throughput regression on QCA98XX
 
 iwlwifi
 
 * fix initialization of 3168 devices (the infamous BAD_COMMAND bug)
 
 * other smaller fixes
 
 rt2x00
 
 * don't include input-polldev.h header
 
 * fix hw reset to work during first 5 minutes of system run
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJdpbPAAAoJEG4XJFUm622bDo8H/RhoLZrKWCf5G8N+jRhq5XmV
 15uZ2OiAOircZzSeYQ6z32XyPqOocQaR831lDrwYi/pXU4WatjKOiVqeCtqHD3ro
 WVc+n8+9jhSDTFxzGJEPoF1a9qu4r672Vc+orlPl2LKT7DO7fcaNMauHVP/o9fcT
 H8+OGQySmGYGYPMxHU1EKkbG8egirRqkfZZNd9wJ+u8FLDqlwZlmyjt5mbAiG2j3
 CYT4fwBG1IsjJcNJB4rjzhtBy2o3jWdxhSvYSUpPYSPCVsFLTl5SGOrLQgx5+0Cl
 garU1b851JRx/9lxljT6rqj2ZH3q/JdTrXsMpflncBZYmAhNSspOWJtN77bbAkE=
 =0Fdg
 -----END PGP SIGNATURE-----

Merge tag 'wireless-drivers-for-davem-2019-10-15' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

Kalle Valo says:

====================
wireless-drivers fixes for 5.4

Second set of fixes for 5.4. ath10k regression and iwlwifi BAD_COMMAND
bug are the ones getting most reports at the moment.

ath10k

* fix throughput regression on QCA98XX

iwlwifi

* fix initialization of 3168 devices (the infamous BAD_COMMAND bug)

* other smaller fixes

rt2x00

* don't include input-polldev.h header

* fix hw reset to work during first 5 minutes of system run
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-15 12:40:57 -04:00
Markus Elfring
868ad21496 net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb”
The dev_kfree_skb() function performs also input parameter validation.
Thus the test around the shown calls is not needed.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-15 08:27:02 +03:00
Fuqian Huang
52d4261862 wireless: Remove call to memset after dma_alloc_coherent
In commit 518a2f1925c3
("dma-mapping: zero memory returned from dma_alloc_*"),
dma_alloc_coherent has already zeroed the memory.
So memset is not needed.

Signed-off-by: Fuqian Huang <huangfq.daxian@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-15 08:20:16 +03:00
Brian Norris
c3226d93f8 rtw88: include interrupt.h for tasklet_struct
Depending on implicit header includes, we might see this compilation
error:

.../main.h:1391:24: error: field has incomplete type 'struct tasklet_struct'
        struct tasklet_struct tx_tasklet;
                              ^

Fixes: 3745d3e550d1 ("rtw88: add driver TX queue support")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Acked-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-14 12:11:57 +03:00
Brian Norris
4ee2f34266 rtw88: use a for loop in rtw_power_mode_change(), not goto
No change in logic.

Signed-off-by: Brian Norris <briannorris@chromium.org>
Acked-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-14 12:11:33 +03:00
Ping-Ke Shih
12078aae45 rtw88: coex: Set 4 slot mode for A2DP
With shallow buffer size, certain BT devices have active
A2DP flow control to fill buffer frequently. If the slot
is not at BT side, data can't be sent successfully to BT
devices, and will cause audio glitch.

To resolve this issue, this commit splits TUs into 4-slots
instead of 2-slot for all of the A2DP related coexistence
strategies. That makes BT have higher opportunity to fill
the A2DP buffer in time, and the audio quality could be
more stable and smooth.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-14 12:10:51 +03:00
Yan-Hsuan Chuang
474264d5a6 rtw88: pci: config phy after chip info is setup
Chip info such as cut_version is required to configure
PCI phy. Move rtw_pci_phy_config after rtw_chip_info_setup.

Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-14 12:10:50 +03:00
Yan-Hsuan Chuang
a483541099 rtw88: Use rtw_write8_set to set SYS_FUNC
rtw_write8 could modify the values that we do not want
to change, use rtw_write8_set instead to only enable the
bits of sys_func_en

Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-10-14 12:10:49 +03:00