* Re: pull-request: iwlwifi-next 2019-04-29
From: Kalle Valo @ 2019-04-29 17:58 UTC (permalink / raw)
To: Luca Coelho; +Cc: linux-wireless, linuxwifi, david.e.box, joe.konno
In-Reply-To: <491e2c7557a981d2e1a721ffe7571ec992dfe62d.camel@coelho.fi>
Luca Coelho <luca@coelho.fi> writes:
> This is the fourth batch of patches intended for v5.2. This includes
> the last patchset I sent. Usual development work. More details about
> the contents in the tag description.
>
> I have sent this out before and kbuildbot reported success.
>
> Please let me know if there are any issues.
>
> Cheers,
> Luca.
>
>
> The following changes since commit 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc:
>
> brcmfmac: send mailbox interrupt twice for specific hardware device (2019-04-26 15:00:53 +0300)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git tags/iwlwifi-next-for-kalle-2019-04-29
>
> for you to fetch changes up to a0eaead41db98c08614c4b1ef453bdfaacde962d:
>
> iwlwifi: dbg_ini: check for valid region type during regions parsing (2019-04-29 18:42:48 +0300)
>
> ----------------------------------------------------------------
> Fourth batch of patches intended for v5.2
>
> * Fix a bug we introduced in the RX path in a previous patch;
> * Add command version parsing from the FW TLVs;
> * Some fixes and improvements in the new debugging framework;
> * Bump the FW API supported for 22000 series;
> * Small improvement in FTM;
> * Some RF-Kill interrupt handling fixes;
> * Support for a new WoWLAN patterns FW API;
> * Other small fixes and improvements;
>
> ----------------------------------------------------------------
Pulled, thanks Luca.
--
Kalle Valo
^ permalink raw reply
* [PATCH 3/4] mt76: mt7603: fix initialization of max rx length
From: Felix Fietkau @ 2019-04-29 17:17 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <20190429171712.52983-1-nbd@nbd.name>
The previous version only accidentally disabled A-MSDU deaggregation by
using the wrong mask for rx length configuration, which left previous
length value in place.
Fix the length and initialize the register completely to keep A-MSDU
de-aggregation remaining disabled
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mt7603/init.c | 3 ++-
drivers/net/wireless/mediatek/mt76/mt7603/regs.h | 4 ++++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/init.c b/drivers/net/wireless/mediatek/mt76/mt7603/init.c
index d394839f1bd8..0d347ac6dfa6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/init.c
@@ -167,7 +167,8 @@ mt7603_mac_init(struct mt7603_dev *dev)
FIELD_PREP(MT_AGG_RETRY_CONTROL_BAR_LIMIT, 1) |
FIELD_PREP(MT_AGG_RETRY_CONTROL_RTS_LIMIT, 15));
- mt76_rmw(dev, MT_DMA_DCR0, ~0xfffc, 4096);
+ mt76_wr(dev, MT_DMA_DCR0, MT_DMA_DCR0_RX_VEC_DROP |
+ FIELD_PREP(MT_DMA_DCR0_MAX_RX_LEN, 4096));
mt76_rmw(dev, MT_DMA_VCFR0, BIT(0), BIT(13));
mt76_rmw(dev, MT_DMA_TMCFR0, BIT(0) | BIT(1), BIT(13));
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/regs.h b/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
index da6827ae6cee..9d257d5c309d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
@@ -233,6 +233,10 @@
#define MT_WF_DMA(ofs) (MT_WF_DMA_BASE + (ofs))
#define MT_DMA_DCR0 MT_WF_DMA(0x000)
+#define MT_DMA_DCR0_MAX_RX_LEN GENMASK(15, 0)
+#define MT_DMA_DCR0_DAMSDU BIT(16)
+#define MT_DMA_DCR0_RX_VEC_DROP BIT(17)
+
#define MT_DMA_DCR1 MT_WF_DMA(0x004)
#define MT_DMA_FQCR0 MT_WF_DMA(0x008)
--
2.17.0
^ permalink raw reply related
* [PATCH 2/4] mt76: mt76x02: remove irqsave/restore in locking for tx status fifo
From: Felix Fietkau @ 2019-04-29 17:17 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <20190429171712.52983-1-nbd@nbd.name>
Use a separate lock and spin_trylock to avoid disabling interrupts.
Should improve performance and latency
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mt76x02.h | 1 +
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 7 ++++---
drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c | 1 +
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h
index cd37f44580ba..9f103c2506db 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h
@@ -86,6 +86,7 @@ struct mt76x02_dev {
u8 txdone_seq;
DECLARE_KFIFO_PTR(txstatus_fifo, struct mt76x02_tx_status);
+ spinlock_t txstatus_fifo_lock;
struct sk_buff *rx_head;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 28851060aa0f..c1f041e1a279 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -739,7 +739,6 @@ int mt76x02_mac_process_rx(struct mt76x02_dev *dev, struct sk_buff *skb,
void mt76x02_mac_poll_tx_status(struct mt76x02_dev *dev, bool irq)
{
struct mt76x02_tx_status stat = {};
- unsigned long flags;
u8 update = 1;
bool ret;
@@ -749,9 +748,11 @@ void mt76x02_mac_poll_tx_status(struct mt76x02_dev *dev, bool irq)
trace_mac_txstat_poll(dev);
while (!irq || !kfifo_is_full(&dev->txstatus_fifo)) {
- spin_lock_irqsave(&dev->mt76.mmio.irq_lock, flags);
+ if (!spin_trylock(&dev->txstatus_fifo_lock))
+ break;
+
ret = mt76x02_mac_load_tx_status(dev, &stat);
- spin_unlock_irqrestore(&dev->mt76.mmio.irq_lock, flags);
+ spin_unlock(&dev->txstatus_fifo_lock);
if (!ret)
break;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
index 87e14af7a93b..5bc1b901f897 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
@@ -201,6 +201,7 @@ int mt76x02_dma_init(struct mt76x02_dev *dev)
tasklet_init(&dev->pre_tbtt_tasklet, mt76x02_pre_tbtt_tasklet,
(unsigned long)dev);
+ spin_lock_init(&dev->txstatus_fifo_lock);
kfifo_init(&dev->txstatus_fifo, status_fifo, fifo_size);
mt76_dma_attach(&dev->mt76);
--
2.17.0
^ permalink raw reply related
* [PATCH 1/4] mt76: mt76x02: use napi polling for tx cleanup
From: Felix Fietkau @ 2019-04-29 17:17 UTC (permalink / raw)
To: linux-wireless
This allows tx scheduling and tx cleanup to run concurrently
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mt76x02.h | 2 +-
.../net/wireless/mediatek/mt76/mt76x02_mmio.c | 49 ++++++++++++++-----
2 files changed, 37 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02.h b/drivers/net/wireless/mediatek/mt76/mt76x02.h
index dfd3a4f1a624..cd37f44580ba 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02.h
@@ -89,7 +89,7 @@ struct mt76x02_dev {
struct sk_buff *rx_head;
- struct tasklet_struct tx_tasklet;
+ struct napi_struct tx_napi;
struct tasklet_struct pre_tbtt_tasklet;
struct delayed_work cal_work;
struct delayed_work wdt_work;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
index 644706ab2893..87e14af7a93b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c
@@ -154,18 +154,32 @@ static void mt76x02_process_tx_status_fifo(struct mt76x02_dev *dev)
static void mt76x02_tx_tasklet(unsigned long data)
{
struct mt76x02_dev *dev = (struct mt76x02_dev *)data;
- int i;
+ mt76x02_mac_poll_tx_status(dev, false);
mt76x02_process_tx_status_fifo(dev);
+ mt76_txq_schedule_all(&dev->mt76);
+}
+
+int mt76x02_poll_tx(struct napi_struct *napi, int budget)
+{
+ struct mt76x02_dev *dev = container_of(napi, struct mt76x02_dev, tx_napi);
+ int i;
+
+ mt76x02_mac_poll_tx_status(dev, false);
+
for (i = MT_TXQ_MCU; i >= 0; i--)
mt76_queue_tx_cleanup(dev, i, false);
- mt76x02_mac_poll_tx_status(dev, false);
+ if (napi_complete_done(napi, 0))
+ mt76x02_irq_enable(dev, MT_INT_TX_DONE_ALL);
- mt76_txq_schedule_all(&dev->mt76);
+ for (i = MT_TXQ_MCU; i >= 0; i--)
+ mt76_queue_tx_cleanup(dev, i, false);
- mt76x02_irq_enable(dev, MT_INT_TX_DONE_ALL);
+ tasklet_schedule(&dev->mt76.tx_tasklet);
+
+ return 0;
}
int mt76x02_dma_init(struct mt76x02_dev *dev)
@@ -223,7 +237,15 @@ int mt76x02_dma_init(struct mt76x02_dev *dev)
if (ret)
return ret;
- return mt76_init_queues(dev);
+ ret = mt76_init_queues(dev);
+ if (ret)
+ return ret;
+
+ netif_tx_napi_add(&dev->mt76.napi_dev, &dev->tx_napi, mt76x02_poll_tx,
+ NAPI_POLL_WEIGHT);
+ napi_enable(&dev->tx_napi);
+
+ return 0;
}
EXPORT_SYMBOL_GPL(mt76x02_dma_init);
@@ -251,11 +273,6 @@ irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance)
intr &= dev->mt76.mmio.irqmask;
- if (intr & MT_INT_TX_DONE_ALL) {
- mt76x02_irq_disable(dev, MT_INT_TX_DONE_ALL);
- tasklet_schedule(&dev->mt76.tx_tasklet);
- }
-
if (intr & MT_INT_RX_DONE(0)) {
mt76x02_irq_disable(dev, MT_INT_RX_DONE(0));
napi_schedule(&dev->mt76.napi[0]);
@@ -277,9 +294,12 @@ irqreturn_t mt76x02_irq_handler(int irq, void *dev_instance)
mt76_queue_kick(dev, dev->mt76.q_tx[MT_TXQ_PSD].q);
}
- if (intr & MT_INT_TX_STAT) {
+ if (intr & MT_INT_TX_STAT)
mt76x02_mac_poll_tx_status(dev, true);
- tasklet_schedule(&dev->mt76.tx_tasklet);
+
+ if (intr & (MT_INT_TX_STAT | MT_INT_TX_DONE_ALL)) {
+ mt76x02_irq_disable(dev, MT_INT_TX_DONE_ALL);
+ napi_schedule(&dev->tx_napi);
}
if (intr & MT_INT_GPTIMER) {
@@ -310,6 +330,7 @@ static void mt76x02_dma_enable(struct mt76x02_dev *dev)
void mt76x02_dma_cleanup(struct mt76x02_dev *dev)
{
tasklet_kill(&dev->mt76.tx_tasklet);
+ netif_napi_del(&dev->tx_napi);
mt76_dma_cleanup(&dev->mt76);
}
EXPORT_SYMBOL_GPL(mt76x02_dma_cleanup);
@@ -429,6 +450,7 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev)
tasklet_disable(&dev->pre_tbtt_tasklet);
tasklet_disable(&dev->mt76.tx_tasklet);
+ napi_disable(&dev->tx_napi);
for (i = 0; i < ARRAY_SIZE(dev->mt76.napi); i++)
napi_disable(&dev->mt76.napi[i]);
@@ -482,7 +504,8 @@ static void mt76x02_watchdog_reset(struct mt76x02_dev *dev)
clear_bit(MT76_RESET, &dev->mt76.state);
tasklet_enable(&dev->mt76.tx_tasklet);
- tasklet_schedule(&dev->mt76.tx_tasklet);
+ napi_enable(&dev->tx_napi);
+ napi_schedule(&dev->tx_napi);
tasklet_enable(&dev->pre_tbtt_tasklet);
--
2.17.0
^ permalink raw reply related
* [PATCH 4/4] mt76: mt7615: use sizeof instead of sizeof_field
From: Felix Fietkau @ 2019-04-29 17:17 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <20190429171712.52983-1-nbd@nbd.name>
It is simpler in this case
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index b09540654b09..ea67c6022fe6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -88,8 +88,7 @@ static int __mt7615_mcu_msg_send(struct mt7615_dev *dev, struct sk_buff *skb,
FIELD_PREP(MT_TXD1_PKT_FMT, pkt_fmt);
txd[1] = cpu_to_le32(val);
- mcu_txd->len = cpu_to_le16(skb->len -
- sizeof_field(struct mt7615_mcu_txd, txd));
+ mcu_txd->len = cpu_to_le16(skb->len - sizeof(mcu_txd->txd));
mcu_txd->pq_id = cpu_to_le16(MCU_PQ_ID(MT_TX_PORT_IDX_MCU, q_idx));
mcu_txd->pkt_type = MCU_PKT_ID;
mcu_txd->seq = seq;
--
2.17.0
^ permalink raw reply related
* Re: [PATCH] brcmfmac: change the order of things in brcmf_detach()
From: Arend Van Spriel @ 2019-04-29 16:31 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless, Arend Van Spriel
In-Reply-To: <1556532561-24428-1-git-send-email-arend.vanspriel@broadcom.com>
Hi Kalle,
This should have been RFT/RFC. Not sure how that's handled in patchwork but
please do not take this (yet).
Regards,
Arend
On April 29, 2019 6:02:03 PM Arend van Spriel
<arend.vanspriel@broadcom.com> wrote:
> When brcmf_detach() from the bus layer upon rmmod we can no longer
> communicate. Hence we will set the bus state to DOWN and cleanup
> the event and protocol layer. The network interfaces need to be
> deleted before brcmf_cfg80211_detach() because the latter does the
> wiphy_unregister() which issues a warning if there are still network
> devices linked to the wiphy instance.
>
> This change solves a null pointer dereference issue which happened
> upon issueing rmmod while there are packets queued in bus protocol
> layer.
>
> Reported-by: Rafał Miłecki <rafal@milecki.pl>
> Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
> Reviewed-by: Franky Lin <franky.lin@broadcom.com>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> ---
> Hi Piotr,
>
> While working on an issue with msgbuf protocol (used for PCIe devices)
> your change 5cdb0ef6144f ("brcmfmac: fix NULL pointer derefence during
> USB disconnect") conflicted. I suspect my reordering stuff in
> brcmf_detach() also fixes your issue so could you retest this patch,
> which basically reverts your change and applies my reordering, and see
> whether my suspicion can be confirmed.
>
> Regards,
> Arend
> ---
> .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 11 ++-------
> .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h | 6 ++---
> .../wireless/broadcom/brcm80211/brcmfmac/core.c | 27 +++++++++++-----------
> .../broadcom/brcm80211/brcmfmac/fwsignal.c | 16 ++++---------
> .../broadcom/brcm80211/brcmfmac/fwsignal.h | 3 +--
> .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++------
> .../wireless/broadcom/brcm80211/brcmfmac/proto.h | 3 +--
> 7 files changed, 25 insertions(+), 51 deletions(-)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
> index 98b1687..73d3c1a 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
> @@ -490,18 +490,11 @@ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
> return -ENOMEM;
> }
>
> -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
> -{
> - struct brcmf_bcdc *bcdc = drvr->proto->pd;
> -
> - brcmf_fws_detach_pre_delif(bcdc->fws);
> -}
> -
> -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
> +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
> {
> struct brcmf_bcdc *bcdc = drvr->proto->pd;
>
> drvr->proto->pd = NULL;
> - brcmf_fws_detach_post_delif(bcdc->fws);
> + brcmf_fws_detach(bcdc->fws);
> kfree(bcdc);
> }
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
> index 4bc5224..3b0e9ef 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
> @@ -18,16 +18,14 @@
>
> #ifdef CONFIG_BRCMFMAC_PROTO_BCDC
> int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
> -void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
> -void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
> +void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
> void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
> void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
> bool success);
> struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
> #else
> static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
> -static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
> -static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub
> *drvr) {}
> +static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
> #endif
>
> #endif /* BRCMFMAC_BCDC_H */
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> index bc73a2e..db49381 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> @@ -1322,27 +1322,26 @@ void brcmf_detach(struct device *dev)
> unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
> #endif
>
> - /* stop firmware event handling */
> - brcmf_fweh_detach(drvr);
> - if (drvr->config)
> - brcmf_p2p_detach(&drvr->config->p2p);
> -
> brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
> + brcmf_bus_stop(drvr->bus_if);
>
> - brcmf_proto_detach_pre_delif(drvr);
> + brcmf_fweh_detach(drvr);
> + brcmf_proto_detach(drvr);
>
> /* make sure primary interface removed last */
> - for (i = BRCMF_MAX_IFS-1; i > -1; i--)
> - brcmf_remove_interface(drvr->iflist[i], false);
> -
> - brcmf_cfg80211_detach(drvr->config);
> - drvr->config = NULL;
> -
> - brcmf_bus_stop(drvr->bus_if);
> + for (i = BRCMF_MAX_IFS-1; i > -1; i--) {
> + if (drvr->iflist[i])
> + brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
> + }
>
> - brcmf_proto_detach_post_delif(drvr);
> + if (drvr->config) {
> + brcmf_p2p_detach(&drvr->config->p2p);
> + brcmf_cfg80211_detach(drvr->config);
> + drvr->config = NULL;
> + }
>
> bus_if->drvr = NULL;
> +
> wiphy_free(drvr->wiphy);
> }
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
> index c22c49a..d48b8b2 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
> @@ -2443,25 +2443,17 @@ struct brcmf_fws_info *brcmf_fws_attach(struct
> brcmf_pub *drvr)
> return fws;
>
> fail:
> - brcmf_fws_detach_pre_delif(fws);
> - brcmf_fws_detach_post_delif(fws);
> + brcmf_fws_detach(fws);
> return ERR_PTR(rc);
> }
>
> -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
> +void brcmf_fws_detach(struct brcmf_fws_info *fws)
> {
> if (!fws)
> return;
> - if (fws->fws_wq) {
> - destroy_workqueue(fws->fws_wq);
> - fws->fws_wq = NULL;
> - }
> -}
>
> -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
> -{
> - if (!fws)
> - return;
> + if (fws->fws_wq)
> + destroy_workqueue(fws->fws_wq);
>
> /* cleanup */
> brcmf_fws_lock(fws);
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
> index 749c06d..4e68357 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
> @@ -19,8 +19,7 @@
> #define FWSIGNAL_H_
>
> struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
> -void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
> -void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
> +void brcmf_fws_detach(struct brcmf_fws_info *fws);
> void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
> bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
> bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
> index c7964cc..024c643 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
> @@ -67,22 +67,16 @@ int brcmf_proto_attach(struct brcmf_pub *drvr)
> return -ENOMEM;
> }
>
> -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
> +void brcmf_proto_detach(struct brcmf_pub *drvr)
> {
> brcmf_dbg(TRACE, "Enter\n");
>
> if (drvr->proto) {
> if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
> - brcmf_proto_bcdc_detach_post_delif(drvr);
> + brcmf_proto_bcdc_detach(drvr);
> else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
> brcmf_proto_msgbuf_detach(drvr);
> kfree(drvr->proto);
> drvr->proto = NULL;
> }
> }
> -
> -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
> -{
> - if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
> - brcmf_proto_bcdc_detach_pre_delif(drvr);
> -}
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
> index 72355ae..d3c3b9a 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
> @@ -54,8 +54,7 @@ struct brcmf_proto {
>
>
> int brcmf_proto_attach(struct brcmf_pub *drvr);
> -void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
> -void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
> +void brcmf_proto_detach(struct brcmf_pub *drvr);
>
> static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
> struct sk_buff *skb,
> --
> 1.9.1
>
^ permalink raw reply
* [PATCH] brcmfmac: change the order of things in brcmf_detach()
From: Arend van Spriel @ 2019-04-29 10:09 UTC (permalink / raw)
To: Piotr Figiel; +Cc: Rafał Miłecki, linux-wireless, Arend van Spriel
When brcmf_detach() from the bus layer upon rmmod we can no longer
communicate. Hence we will set the bus state to DOWN and cleanup
the event and protocol layer. The network interfaces need to be
deleted before brcmf_cfg80211_detach() because the latter does the
wiphy_unregister() which issues a warning if there are still network
devices linked to the wiphy instance.
This change solves a null pointer dereference issue which happened
upon issueing rmmod while there are packets queued in bus protocol
layer.
Reported-by: Rafał Miłecki <rafal@milecki.pl>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
Hi Piotr,
While working on an issue with msgbuf protocol (used for PCIe devices)
your change 5cdb0ef6144f ("brcmfmac: fix NULL pointer derefence during
USB disconnect") conflicted. I suspect my reordering stuff in
brcmf_detach() also fixes your issue so could you retest this patch,
which basically reverts your change and applies my reordering, and see
whether my suspicion can be confirmed.
Regards,
Arend
---
.../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 11 ++-------
.../wireless/broadcom/brcm80211/brcmfmac/bcdc.h | 6 ++---
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 27 +++++++++++-----------
.../broadcom/brcm80211/brcmfmac/fwsignal.c | 16 ++++---------
.../broadcom/brcm80211/brcmfmac/fwsignal.h | 3 +--
.../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++------
.../wireless/broadcom/brcm80211/brcmfmac/proto.h | 3 +--
7 files changed, 25 insertions(+), 51 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
index 98b1687..73d3c1a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
@@ -490,18 +490,11 @@ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
return -ENOMEM;
}
-void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
-{
- struct brcmf_bcdc *bcdc = drvr->proto->pd;
-
- brcmf_fws_detach_pre_delif(bcdc->fws);
-}
-
-void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
+void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
{
struct brcmf_bcdc *bcdc = drvr->proto->pd;
drvr->proto->pd = NULL;
- brcmf_fws_detach_post_delif(bcdc->fws);
+ brcmf_fws_detach(bcdc->fws);
kfree(bcdc);
}
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
index 4bc5224..3b0e9ef 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
@@ -18,16 +18,14 @@
#ifdef CONFIG_BRCMFMAC_PROTO_BCDC
int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
-void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
-void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
+void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
bool success);
struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
#else
static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
-static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
-static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
+static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
#endif
#endif /* BRCMFMAC_BCDC_H */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index bc73a2e..db49381 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1322,27 +1322,26 @@ void brcmf_detach(struct device *dev)
unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
#endif
- /* stop firmware event handling */
- brcmf_fweh_detach(drvr);
- if (drvr->config)
- brcmf_p2p_detach(&drvr->config->p2p);
-
brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+ brcmf_bus_stop(drvr->bus_if);
- brcmf_proto_detach_pre_delif(drvr);
+ brcmf_fweh_detach(drvr);
+ brcmf_proto_detach(drvr);
/* make sure primary interface removed last */
- for (i = BRCMF_MAX_IFS-1; i > -1; i--)
- brcmf_remove_interface(drvr->iflist[i], false);
-
- brcmf_cfg80211_detach(drvr->config);
- drvr->config = NULL;
-
- brcmf_bus_stop(drvr->bus_if);
+ for (i = BRCMF_MAX_IFS-1; i > -1; i--) {
+ if (drvr->iflist[i])
+ brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
+ }
- brcmf_proto_detach_post_delif(drvr);
+ if (drvr->config) {
+ brcmf_p2p_detach(&drvr->config->p2p);
+ brcmf_cfg80211_detach(drvr->config);
+ drvr->config = NULL;
+ }
bus_if->drvr = NULL;
+
wiphy_free(drvr->wiphy);
}
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
index c22c49a..d48b8b2 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
@@ -2443,25 +2443,17 @@ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr)
return fws;
fail:
- brcmf_fws_detach_pre_delif(fws);
- brcmf_fws_detach_post_delif(fws);
+ brcmf_fws_detach(fws);
return ERR_PTR(rc);
}
-void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
+void brcmf_fws_detach(struct brcmf_fws_info *fws)
{
if (!fws)
return;
- if (fws->fws_wq) {
- destroy_workqueue(fws->fws_wq);
- fws->fws_wq = NULL;
- }
-}
-void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
-{
- if (!fws)
- return;
+ if (fws->fws_wq)
+ destroy_workqueue(fws->fws_wq);
/* cleanup */
brcmf_fws_lock(fws);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
index 749c06d..4e68357 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
@@ -19,8 +19,7 @@
#define FWSIGNAL_H_
struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
-void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
-void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
+void brcmf_fws_detach(struct brcmf_fws_info *fws);
void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
index c7964cc..024c643 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
@@ -67,22 +67,16 @@ int brcmf_proto_attach(struct brcmf_pub *drvr)
return -ENOMEM;
}
-void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
+void brcmf_proto_detach(struct brcmf_pub *drvr)
{
brcmf_dbg(TRACE, "Enter\n");
if (drvr->proto) {
if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
- brcmf_proto_bcdc_detach_post_delif(drvr);
+ brcmf_proto_bcdc_detach(drvr);
else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
brcmf_proto_msgbuf_detach(drvr);
kfree(drvr->proto);
drvr->proto = NULL;
}
}
-
-void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
-{
- if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
- brcmf_proto_bcdc_detach_pre_delif(drvr);
-}
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
index 72355ae..d3c3b9a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
@@ -54,8 +54,7 @@ struct brcmf_proto {
int brcmf_proto_attach(struct brcmf_pub *drvr);
-void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
-void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
+void brcmf_proto_detach(struct brcmf_pub *drvr);
static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
struct sk_buff *skb,
--
1.9.1
^ permalink raw reply related
* pull-request: iwlwifi-next 2019-04-29
From: Luca Coelho @ 2019-04-29 16:00 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, linuxwifi, david.e.box, joe.konno
[-- Attachment #1: Type: text/plain, Size: 4291 bytes --]
Hi Kalle,
This is the fourth batch of patches intended for v5.2. This includes
the last patchset I sent. Usual development work. More details about
the contents in the tag description.
I have sent this out before and kbuildbot reported success.
Please let me know if there are any issues.
Cheers,
Luca.
The following changes since commit 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc:
brcmfmac: send mailbox interrupt twice for specific hardware device (2019-04-26 15:00:53 +0300)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git tags/iwlwifi-next-for-kalle-2019-04-29
for you to fetch changes up to a0eaead41db98c08614c4b1ef453bdfaacde962d:
iwlwifi: dbg_ini: check for valid region type during regions parsing (2019-04-29 18:42:48 +0300)
----------------------------------------------------------------
Fourth batch of patches intended for v5.2
* Fix a bug we introduced in the RX path in a previous patch;
* Add command version parsing from the FW TLVs;
* Some fixes and improvements in the new debugging framework;
* Bump the FW API supported for 22000 series;
* Small improvement in FTM;
* Some RF-Kill interrupt handling fixes;
* Support for a new WoWLAN patterns FW API;
* Other small fixes and improvements;
----------------------------------------------------------------
Andrei Otcheretianski (1):
iwlwifi: mvm: Don't sleep in RX path
Avraham Stern (1):
iwlwifi: mvm: report FTM start time TSF when applicable
Johannes Berg (3):
iwlwifi: pcie: initialize debug_rfkill to -1
iwlwifi: pcie: don't crash on invalid RX interrupt
iwlwifi: parse command version TLV
Liad Kaufman (1):
iwlwifi: mvm: limit TLC according to our HE capabilities
Luca Coelho (3):
iwlwifi: mvm: support v2 of the WoWLAN patterns command
iwlwifi: bump FW API to 48 for 22000 series
iwlwifi: pcie: remove stray character in iwl_pcie_rx_alloc_page()
Shahar S Matityahu (6):
iwlwifi: support fseq tlv and print fseq version
iwlwifi: dbg_ini: add lmac and umac error tables dumping support
iwlwifi: dbg_ini: add periodic trigger support
iwlwifi: dbg: replace dump info device family with HW type
iwlwifi: avoid allocating memory for region with disabled domain
iwlwifi: dbg_ini: check for valid region type during regions parsing
YueHaibing (1):
iwlwifi: Use correct channel_profile iniwl_get_nvm
drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 2 +-
drivers/net/wireless/intel/iwlwifi/fw/api/d3.h | 136 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----
drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 4 +++
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 70 ++++++++++++++++++++++++++++++++++++++++++-------
drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 3 +++
drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 4 +--
drivers/net/wireless/intel/iwlwifi/fw/file.h | 32 +++++++++++++++++++----
drivers/net/wireless/intel/iwlwifi/fw/img.h | 7 +++--
drivers/net/wireless/intel/iwlwifi/fw/init.c | 2 ++
drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 +
drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 1 +
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 18 +++++++++++++
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 58 +++++++++++++++++++++++++++++++++++++----
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 20 +++++++++++---
drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 1 +
drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 34 ++++++++++++++++++++----
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 2 +-
drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 4 +--
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 9 +++++--
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 11 ++++----
22 files changed, 373 insertions(+), 50 deletions(-)
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH] wil6210: fix potential out-of-bounds read
From: Gustavo A. R. Silva @ 2019-04-29 15:23 UTC (permalink / raw)
To: Kalle Valo
Cc: Maya Erez, David S. Miller, Vladimir Kondratiev, linux-wireless,
wil6210, netdev, linux-kernel
In-Reply-To: <20190429150007.69D8E60741@smtp.codeaurora.org>
On 4/29/19 10:00 AM, Kalle Valo wrote:
> "Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
>
>> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
>>
>> enum gro_result {
>> GRO_MERGED,
>> GRO_MERGED_FREE,
>> GRO_HELD,
>> GRO_NORMAL,
>> GRO_DROP,
>> GRO_CONSUMED,
>> };
>> typedef enum gro_result gro_result_t;
>>
>> In case *rc* evaluates to 5, we end up having an out-of-bounds read
>> at drivers/net/wireless/ath/wil6210/txrx.c:821:
>>
>> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
>> len, gro_res_str[rc]);
>>
>> Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
>>
>> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
>> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
>> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
>> Reviewed-by: Maya Erez <merez@codeaurora.org>
>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>
> Patch applied to ath-next branch of ath.git, thanks.
>
> bfabdd699732 wil6210: fix potential out-of-bounds read
>
Awesome. :)
Thanks, Kalle.
--
Gustavo
^ permalink raw reply
* Re: pull-request: mac80211 2019-04-26
From: David Miller @ 2019-04-29 15:02 UTC (permalink / raw)
To: johannes; +Cc: netdev, linux-wireless
In-Reply-To: <459c1807e264def23b14441777a6cda6e432bfc4.camel@sipsolutions.net>
From: Johannes Berg <johannes@sipsolutions.net>
Date: Mon, 29 Apr 2019 13:19:27 +0200
> Sorry to nag, and maybe I'm missing something, but I didn't see this
> show up in your tree, yet you marked it as accepted in patchwork:
>
> https://patchwork.ozlabs.org/patch/1091413/
>
> But maybe there's a gap that I should expect here, like you mark it as
> accepted when you start some kind of testing and then push it out later?
>
> Really the only reason I'm asking is that I wanted to forward to apply
> another patch, but maybe I'll ask you to apply that one patch directly.
Sorry about that, I'll use the excuse that I'm travelling :-)
I've pulled it in now and pushed it back out, should certainly be
there for sure now.
^ permalink raw reply
* Re: [PATCH] wireless: carl9170: fix clang build warning
From: Kalle Valo @ 2019-04-29 15:01 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Christian Lamparter, David S. Miller, clang-built-linux,
Nick Desaulniers, Nathan Chancellor, Arnd Bergmann, Dan Carpenter,
Gustavo A. R. Silva, linux-wireless, netdev, linux-kernel
In-Reply-To: <20190325124354.1413529-1-arnd@arndb.de>
Arnd Bergmann <arnd@arndb.de> wrote:
> clang fails to eliminate some dead code with always-taken branches
> when CONFIG_PROFILE_ANNOTATED_BRANCHES is set, leading to a false-positive
> warning:
>
> drivers/net/wireless/ath/carl9170/mac.c:522:3: error: variable 'power' is used uninitialized whenever 'if' condition is
> false [-Werror,-Wsometimes-uninitialized]
> BUG_ON(1);
> ^~~~~~~~~
>
> Change both instances of BUG_ON(1) in carl9170 to the simpler BUG()
> to avoid the warning.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> Acked-by: Christian Lamparter <chunkeey@gmail.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
62acdcfa8b7a wireless: carl9170: fix clang build warning
--
https://patchwork.kernel.org/patch/10869053/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] wil6210: fix potential out-of-bounds read
From: Kalle Valo @ 2019-04-29 15:00 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Maya Erez, David S. Miller, Vladimir Kondratiev, linux-wireless,
wil6210, netdev, linux-kernel, Gustavo A. R. Silva
In-Reply-To: <20190415145646.GA16597@embeddedor>
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
>
> enum gro_result {
> GRO_MERGED,
> GRO_MERGED_FREE,
> GRO_HELD,
> GRO_NORMAL,
> GRO_DROP,
> GRO_CONSUMED,
> };
> typedef enum gro_result gro_result_t;
>
> In case *rc* evaluates to 5, we end up having an out-of-bounds read
> at drivers/net/wireless/ath/wil6210/txrx.c:821:
>
> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
> len, gro_res_str[rc]);
>
> Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
>
> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> Reviewed-by: Maya Erez <merez@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
bfabdd699732 wil6210: fix potential out-of-bounds read
--
https://patchwork.kernel.org/patch/10901053/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
From: Kalle Valo @ 2019-04-29 14:59 UTC (permalink / raw)
To: Tamizh chelvam; +Cc: ath10k, linux-wireless, Anilkumar Kolli, Tamizh chelvam
In-Reply-To: <1551893771-22485-1-git-send-email-tamizhr@codeaurora.org>
Tamizh chelvam <tamizhr@codeaurora.org> wrote:
> Increase pulse width range from 1-2usec to 0-4usec.
> During data traffic HW occasionally fails detecting radar pulses,
> so that SW cannot get enough radar reports to achieve the success rate.
>
> Tested ath10k hw and fw:
> * QCA9888(10.4-3.5.1-00052)
> * QCA4019(10.4-3.2.1.1-00017)
> * QCA9984(10.4-3.6-00104)
> * QCA988X(10.2.4-1.0-00041)
>
> Tested ath9k hw: AR9300
>
> Tested-by: Tamizh chelvam <tamizhr@codeaurora.org>
> Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
> Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
d8792393a783 ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
--
https://patchwork.kernel.org/patch/10841487/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH v2 1/2] ath: drop duplicated define
From: Kalle Valo @ 2019-04-29 14:58 UTC (permalink / raw)
To: Tomislav Požega; +Cc: linux-wireless
In-Reply-To: <1552572470-2656-1-git-send-email-pozega.tomislav@gmail.com>
Tomislav Požega wrote:
> Remove duplicate NO_CTL that is just 2 lines below.
>
> Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2 patches applied to ath-next branch of ath.git, thanks.
b50fd29c5268 ath: drop duplicated define
d3c2be9022d6 ath9k: drop redundant code in ar9003_hw_set_channel
--
https://patchwork.kernel.org/patch/10852929/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath9k: Remove some set but not used variables
From: Kalle Valo @ 2019-04-29 14:55 UTC (permalink / raw)
To: Yue Haibing
Cc: linux-kernel, netdev, linux-wireless, ath9k-devel, davem,
YueHaibing
In-Reply-To: <20190417025745.24044-1-yuehaibing@huawei.com>
Yue Haibing <yuehaibing@huawei.com> wrote:
> Fixes gcc '-Wunused-but-set-variable' warning:
>
> drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_count_frames':
> drivers/net/wireless/ath/ath9k/xmit.c:413:25: warning: variable 'fi' set but not used [-Wunused-but-set-variable]
> drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_complete_aggr':
> drivers/net/wireless/ath/ath9k/xmit.c:449:24: warning: variable 'hdr' set but not used [-Wunused-but-set-variable]
> drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_start':
> drivers/net/wireless/ath/ath9k/xmit.c:2274:18: warning: variable 'avp' set but not used [-Wunused-but-set-variable]
> drivers/net/wireless/ath/ath9k/xmit.c:2269:24: warning: variable 'hdr' set but not used [-Wunused-but-set-variable]
>
> These variables are not used any more
> and can be removed.
>
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
05039f01e630 ath9k: Remove some set but not used variables
--
https://patchwork.kernel.org/patch/10904395/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath9k: Differentiate between max combined and per chain power
From: Kalle Valo @ 2019-04-29 14:54 UTC (permalink / raw)
To: Sven Eckelmann; +Cc: linux-wireless, QCA ath9k Development, Sven Eckelmann
In-Reply-To: <20190320103723.27228-1-sven@narfation.org>
Sven Eckelmann <sven@narfation.org> wrote:
> The ath9k driver uses as maximum allowed txpower the constant
> MAX_RATE_POWER. It is used to set a maximum txpower limit for the PHY
> (which is combined txpower) and also the maximum txpower for per chain
> rates. Its value 63 is derived from the maximum number the registers can
> store for the per chain txpower.
>
> The max txpower a user can set because of this is 31 dBm (floor(63 / 2)).
> This also means that a device with multiple tx chains is even limited
> further:
>
> * 1 chain: 31 dBm per chain
> * 2 chains: 28 dBm per chain
> * 3 chains: 26 dBm per chain
>
> This combined txpower limit of 31 dBm becomes even more problematic when
> some extra antenna gain is set in the EEPROM. A high power device is then
> no longer able to reach its potential limits.
>
> Instead the code dealing with the combined txpower must use a higher limit
> than 63 and only the code dealing with the per chain txpower have to use
> the limit of 63. Since the antenna gain can be quite large and 8 bit
> variables are often used in ath9k for txpower, a large, divisible by two
> number like 254 is a good choice for this new limit.
>
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
b037b107565f ath9k: Differentiate between max combined and per chain power
--
https://patchwork.kernel.org/patch/10861389/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath9k: Check for errors when reading SREV register
From: Kalle Valo @ 2019-04-29 14:53 UTC (permalink / raw)
To: Tim Schumacher
In-Reply-To: <20190318190557.21599-1-timschumi@gmx.de>
Tim Schumacher <timschumi@gmx.de> wrote:
> Right now, if an error is encountered during the SREV register
> read (i.e. an EIO in ath9k_regread()), that error code gets
> passed all the way to __ath9k_hw_init(), where it is visible
> during the "Chip rev not supported" message.
>
> ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits
> ath: phy2: Mac Chip Rev 0x0f.3 is not supported by this driver
> ath: phy2: Unable to initialize hardware; initialization status: -95
> ath: phy2: Unable to initialize hardware; initialization status: -95
> ath9k_htc: Failed to initialize the device
>
> Check for -EIO explicitly in ath9k_hw_read_revisions() and return
> a boolean based on the success of the operation. Check for that in
> __ath9k_hw_init() and abort with a more debugging-friendly message
> if reading the revisions wasn't successful.
>
> ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits
> ath: phy2: Failed to read SREV register
> ath: phy2: Could not read hardware revision
> ath: phy2: Unable to initialize hardware; initialization status: -95
> ath: phy2: Unable to initialize hardware; initialization status: -95
> ath9k_htc: Failed to initialize the device
>
> This helps when debugging by directly showing the first point of
> failure and it could prevent possible errors if a 0x0f.3 revision
> is ever supported.
>
> Signed-off-by: Tim Schumacher <timschumi@gmx.de>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
2f90c7e5d094 ath9k: Check for errors when reading SREV register
--
https://patchwork.kernel.org/patch/10858399/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath9k: Don't trust TX status TID number when reporting airtime
From: Kalle Valo @ 2019-04-29 14:52 UTC (permalink / raw)
To: Toke Høiland-Jørgensen
Cc: linux-wireless, Toke Høiland-Jørgensen,
Miguel Catalan Cid
In-Reply-To: <20190307183944.11190-1-toke@redhat.com>
Toke Høiland-Jørgensen wrote:
> As already noted a comment in ath_tx_complete_aggr(), the hardware will
> occasionally send a TX status with the wrong tid number. If we trust the
> value, airtime usage will be reported to the wrong AC, which can cause the
> deficit on that AC to become very low, blocking subsequent attempts to
> transmit.
>
> To fix this, account airtime usage to the TID number from the original skb,
> instead of the one in the hardware TX status report.
>
> Reported-by: Miguel Catalan Cid <miguel.catalan@i2cat.net>
> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
389b72e58259 ath9k: Don't trust TX status TID number when reporting airtime
--
https://patchwork.kernel.org/patch/10843731/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath6kl: remove redundant check of status != 0
From: Kalle Valo @ 2019-04-29 14:50 UTC (permalink / raw)
To: Colin King
Cc: David S . Miller, linux-wireless, netdev, kernel-janitors,
linux-kernel
In-Reply-To: <20190404134723.24667-1-colin.king@canonical.com>
Colin King <colin.king@canonical.com> wrote:
> The check on status not being zero is redundant as previous code
> paths that set status to an error value break out of the while
> loop and hence status is never non-zero at the check. Remove
> this redundant code.
>
> Addresses-Coverity: ("Logically dead code")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
e643da21e19a ath6kl: remove redundant check of status != 0
--
https://patchwork.kernel.org/patch/10885625/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath6kl: add some bounds checking
From: Kalle Valo @ 2019-04-29 14:49 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-wireless, kernel-janitors
In-Reply-To: <20190404085651.GC20193@kadam>
Dan Carpenter <dan.carpenter@oracle.com> wrote:
> The "ev->traffic_class" and "reply->ac" variables come from the network
> and they're used as an offset into the wmi->stream_exist_for_ac[] array.
> Those variables are u8 so they can be 0-255 but the stream_exist_for_ac[]
> array only has WMM_NUM_AC (4) elements. We need to add a couple bounds
> checks to prevent array overflows.
>
> I also modified one existing check from "if (traffic_class > 3) {" to
> "if (traffic_class >= WMM_NUM_AC) {" just to make them all consistent.
>
> Fixes: bdcd81707973 (" Add ath6kl cleaned up driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
5d6751eaff67 ath6kl: add some bounds checking
--
https://patchwork.kernel.org/patch/10885299/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH][next] ath6kl: wmi: use struct_size() helper
From: Kalle Valo @ 2019-04-29 14:48 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: David S. Miller, linux-wireless, netdev, linux-kernel,
Gustavo A. R. Silva
In-Reply-To: <20190403184949.GA7597@embeddedor>
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
> Make use of the struct_size() helper instead of an open-coded version
> in order to avoid any potential type mistakes, in particular in the
> context in which this code is being used.
>
> So, replace code of the following form:
>
> sizeof(*ev) + ev->num_neighbors * sizeof(struct wmi_neighbor_info)
>
> with:
>
> struct_size(ev, neighbor, ev->num_neighbors)
>
> This code was detected with the help of Coccinelle.
>
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
83d9562b6478 ath6kl: wmi: use struct_size() helper
--
https://patchwork.kernel.org/patch/10884343/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH][next] ath6kl: debug: Use struct_size() helper
From: Kalle Valo @ 2019-04-29 14:46 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: David S. Miller, linux-wireless, netdev, linux-kernel,
Gustavo A. R. Silva
In-Reply-To: <20190403154835.GA20955@embeddedor>
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
> Make use of the struct_size() helper instead of an open-coded version
> in order to avoid any potential type mistakes, in particular in the
> context in which this code is being used.
>
> So, change the following form:
>
> sizeof(*tbl) + num_entries * sizeof(struct wmi_bss_roam_info)
>
> to :
>
> struct_size(tbl, info, num_entries)
>
> This code was detected with the help of Coccinelle.
>
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
df75786b9233 ath6kl: debug: Use struct_size() helper
--
https://patchwork.kernel.org/patch/10884039/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath10k: fix incorrect multicast/broadcast rate setting
From: Kalle Valo @ 2019-04-29 14:43 UTC (permalink / raw)
To: Pradeep Kumar Chitrapu
Cc: ath10k, linux-wireless, Pradeep kumar Chitrapu, Zhi Chen
In-Reply-To: <1544504171-19810-1-git-send-email-pradeepc@codeaurora.org>
Pradeep Kumar Chitrapu <pradeepc@codeaurora.org> wrote:
> Invalid rate code is sent to firmware when multicast rate value of 0 is
> sent to driver indicating disabled case, causing broken mesh path.
> so fix that.
>
> Tested on QCA9984 with firmware 10.4-3.6.1-00827
>
> Sven tested on IPQ4019 with 10.4-3.5.3-00057 and QCA9888 with 10.4-3.5.3-00053
> (ath10k-firmware) and 10.4-3.6-00140 (linux-firmware 2018-12-16-211de167).
>
> Fixes: cd93b83ad92 ("ath10k: support for multicast rate control")
> Co-developed-by: Zhi Chen <zhichen@codeaurora.org>
> Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
> Tested-by: Sven Eckelmann <sven@narfation.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
93ee3d108fc7 ath10k: fix incorrect multicast/broadcast rate setting
--
https://patchwork.kernel.org/patch/10723033/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH 1/5] ath10k: add struct for high latency PN replay protection
From: Kalle Valo @ 2019-04-29 14:39 UTC (permalink / raw)
To: Kalle Valo; +Cc: ath10k, linux-wireless, Wen Gong
In-Reply-To: <1556260871-2919-2-git-send-email-kvalo@codeaurora.org>
Kalle Valo <kvalo@codeaurora.org> wrote:
> Add the struct for PN replay protection and fragment packet
> handler.
>
> Also fix the bitmask of HTT_RX_DESC_HL_INFO_MCAST_BCAST to match what's currently
> used by SDIO firmware. The defines are not used yet so it's safe to modify
> them. Remove the conflicting HTT_RX_DESC_HL_INFO_FRAGMENT as
> it's not either used in ath10k.
>
> Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1.
>
> Signed-off-by: Wen Gong <wgong@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
5 patches applied to ath-next branch of ath.git, thanks.
e1bddde9737a ath10k: add struct for high latency PN replay protection
28ce53b6cfda ath10k: add handler for HTT_T2H_MSG_TYPE_SEC_IND event
130c77495708 ath10k: add PN replay protection for high latency devices
33f9747291ff ath10k: add fragmentation handler for high latency devices
a8b10da05cbe ath10k: enable QCA6174 hw3.2 SDIO hardware
--
https://patchwork.kernel.org/patch/10918335/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] ath10k: Drop WARN_ON()s that always trigger during system resume
From: Kalle Valo @ 2019-04-29 14:26 UTC (permalink / raw)
To: Rafael J. Wysocki
Cc: Linux PM, Srinivas Pandruvada, ath10k, Todd Brandt,
linux-wireless
In-Reply-To: <2884043.Jv1Mn93hE8@aspire.rjw.lan>
"Rafael J. Wysocki" <rjw@rjwysocki.net> wrote:
> ath10k_mac_vif_chan() always returns an error for the given vif
> during system-wide resume which reliably triggers two WARN_ON()s
> in ath10k_bss_info_changed() and they are not particularly
> useful in that code path, so drop them.
>
> Tested: QCA6174 hw3.2 PCI with WLAN.RM.2.0-00180-QCARMSWPZ-1
> Tested: QCA6174 hw3.2 SDIO with WLAN.RMH.4.4.1-00007-QCARMSWP-1
>
> Fixes: cd93b83ad927 ("ath10k: support for multicast rate control")
> Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate")
> Cc: stable@vger.kernel.org
> Reviewed-by: Brian Norris <briannorris@chromium.org>
> Tested-by: Brian Norris <briannorris@chromium.org>
> Tested-by: Claire Chang <tientzu@chromium.org>
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-current branch of ath.git, thanks.
9e80ad37f678 ath10k: Drop WARN_ON()s that always trigger during system resume
--
https://patchwork.kernel.org/patch/10837139/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox