* [PATCH AUTOSEL 4.9 06/21] mwifiex: Fix possible buffer overflows at parsing bss descriptor
From: Sasha Levin @ 2019-06-27 0:41 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, huangwen, Kalle Valo, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627004122.21671-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 13ec7f10b87f5fc04c4ccbd491c94c7980236a74 ]
mwifiex_update_bss_desc_with_ie() calls memcpy() unconditionally in
a couple places without checking the destination size. Since the
source is given from user-space, this may trigger a heap buffer
overflow.
Fix it by putting the length check before performing memcpy().
This fix addresses CVE-2019-3846.
Reported-by: huangwen <huangwen@venustech.com.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/scan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 78d59a67f7e1..674ad3405646 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1236,6 +1236,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
}
switch (element_id) {
case WLAN_EID_SSID:
+ if (element_len > IEEE80211_MAX_SSID_LEN)
+ return -EINVAL;
bss_entry->ssid.ssid_len = element_len;
memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
element_len);
@@ -1245,6 +1247,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_SUPP_RATES:
+ if (element_len > MWIFIEX_SUPPORTED_RATES)
+ return -EINVAL;
memcpy(bss_entry->data_rates, current_ptr + 2,
element_len);
memcpy(bss_entry->supported_rates, current_ptr + 2,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.9 07/21] mwifiex: Abort at too short BSS descriptor element
From: Sasha Levin @ 2019-06-27 0:41 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, Kalle Valo, Sasha Levin, linux-wireless, netdev
In-Reply-To: <20190627004122.21671-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ]
Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that
the source descriptor entries contain the enough size for each type
and performs copying without checking the source size. This may lead
to read over boundary.
Fix this by putting the source size check in appropriate places.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/scan.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 674ad3405646..32b6b9efd6ae 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1258,6 +1258,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_FH_PARAMS:
+ if (element_len + 2 < sizeof(*fh_param_set))
+ return -EINVAL;
fh_param_set =
(struct ieee_types_fh_param_set *) current_ptr;
memcpy(&bss_entry->phy_param_set.fh_param_set,
@@ -1266,6 +1268,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_DS_PARAMS:
+ if (element_len + 2 < sizeof(*ds_param_set))
+ return -EINVAL;
ds_param_set =
(struct ieee_types_ds_param_set *) current_ptr;
@@ -1277,6 +1281,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_CF_PARAMS:
+ if (element_len + 2 < sizeof(*cf_param_set))
+ return -EINVAL;
cf_param_set =
(struct ieee_types_cf_param_set *) current_ptr;
memcpy(&bss_entry->ss_param_set.cf_param_set,
@@ -1285,6 +1291,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_IBSS_PARAMS:
+ if (element_len + 2 < sizeof(*ibss_param_set))
+ return -EINVAL;
ibss_param_set =
(struct ieee_types_ibss_param_set *)
current_ptr;
@@ -1294,10 +1302,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_ERP_INFO:
+ if (!element_len)
+ return -EINVAL;
bss_entry->erp_flags = *(current_ptr + 2);
break;
case WLAN_EID_PWR_CONSTRAINT:
+ if (!element_len)
+ return -EINVAL;
bss_entry->local_constraint = *(current_ptr + 2);
bss_entry->sensed_11h = true;
break;
@@ -1337,6 +1349,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_VENDOR_SPECIFIC:
+ if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
+ return -EINVAL;
+
vendor_ie = (struct ieee_types_vendor_specific *)
current_ptr;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.9 17/21] mac80211: only warn once on chanctx_conf being NULL
From: Sasha Levin @ 2019-06-27 0:41 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yibo Zhao, Zhi Chen, Johannes Berg, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627004122.21671-1-sashal@kernel.org>
From: Yibo Zhao <yiboz@codeaurora.org>
[ Upstream commit 563572340173865a9a356e6bb02579e6998a876d ]
In multiple SSID cases, it takes time to prepare every AP interface
to be ready in initializing phase. If a sta already knows everything it
needs to join one of the APs and sends authentication to the AP which
is not fully prepared at this point of time, AP's channel context
could be NULL. As a result, warning message occurs.
Even worse, if the AP is under attack via tools such as MDK3 and massive
authentication requests are received in a very short time, console will
be hung due to kernel warning messages.
WARN_ON_ONCE() could be a better way for indicating warning messages
without duplicate messages to flood the console.
Johannes: We still need to address the underlying problem, but we
don't really have a good handle on it yet. Suppress the
worst side-effects for now.
Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
Signed-off-by: Yibo Zhao <yiboz@codeaurora.org>
[johannes: add note, change subject]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/ieee80211_i.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8a690ebd7374..6708de10a3e5 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1403,7 +1403,7 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
rcu_read_lock();
chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
- if (WARN_ON(!chanctx_conf)) {
+ if (WARN_ON_ONCE(!chanctx_conf)) {
rcu_read_unlock();
return NULL;
}
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.4 05/12] mwifiex: Abort at too short BSS descriptor element
From: Sasha Levin @ 2019-06-27 0:42 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, Kalle Valo, Sasha Levin, linux-wireless, netdev
In-Reply-To: <20190627004236.21909-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 685c9b7750bfacd6fc1db50d86579980593b7869 ]
Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that
the source descriptor entries contain the enough size for each type
and performs copying without checking the source size. This may lead
to read over boundary.
Fix this by putting the source size check in appropriate places.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mwifiex/scan.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 6f789899c888..b755f72d85d5 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1241,6 +1241,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_FH_PARAMS:
+ if (element_len + 2 < sizeof(*fh_param_set))
+ return -EINVAL;
fh_param_set =
(struct ieee_types_fh_param_set *) current_ptr;
memcpy(&bss_entry->phy_param_set.fh_param_set,
@@ -1249,6 +1251,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_DS_PARAMS:
+ if (element_len + 2 < sizeof(*ds_param_set))
+ return -EINVAL;
ds_param_set =
(struct ieee_types_ds_param_set *) current_ptr;
@@ -1260,6 +1264,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_CF_PARAMS:
+ if (element_len + 2 < sizeof(*cf_param_set))
+ return -EINVAL;
cf_param_set =
(struct ieee_types_cf_param_set *) current_ptr;
memcpy(&bss_entry->ss_param_set.cf_param_set,
@@ -1268,6 +1274,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_IBSS_PARAMS:
+ if (element_len + 2 < sizeof(*ibss_param_set))
+ return -EINVAL;
ibss_param_set =
(struct ieee_types_ibss_param_set *)
current_ptr;
@@ -1277,10 +1285,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_ERP_INFO:
+ if (!element_len)
+ return -EINVAL;
bss_entry->erp_flags = *(current_ptr + 2);
break;
case WLAN_EID_PWR_CONSTRAINT:
+ if (!element_len)
+ return -EINVAL;
bss_entry->local_constraint = *(current_ptr + 2);
bss_entry->sensed_11h = true;
break;
@@ -1320,6 +1332,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_VENDOR_SPECIFIC:
+ if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
+ return -EINVAL;
+
vendor_ie = (struct ieee_types_vendor_specific *)
current_ptr;
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.4 04/12] mwifiex: Fix possible buffer overflows at parsing bss descriptor
From: Sasha Levin @ 2019-06-27 0:42 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, huangwen, Kalle Valo, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627004236.21909-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 13ec7f10b87f5fc04c4ccbd491c94c7980236a74 ]
mwifiex_update_bss_desc_with_ie() calls memcpy() unconditionally in
a couple places without checking the destination size. Since the
source is given from user-space, this may trigger a heap buffer
overflow.
Fix it by putting the length check before performing memcpy().
This fix addresses CVE-2019-3846.
Reported-by: huangwen <huangwen@venustech.com.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mwifiex/scan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index fb98f42cb5e7..6f789899c888 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1219,6 +1219,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
}
switch (element_id) {
case WLAN_EID_SSID:
+ if (element_len > IEEE80211_MAX_SSID_LEN)
+ return -EINVAL;
bss_entry->ssid.ssid_len = element_len;
memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
element_len);
@@ -1228,6 +1230,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_SUPP_RATES:
+ if (element_len > MWIFIEX_SUPPORTED_RATES)
+ return -EINVAL;
memcpy(bss_entry->data_rates, current_ptr + 2,
element_len);
memcpy(bss_entry->supported_rates, current_ptr + 2,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.4 03/12] mac80211: mesh: fix RCU warning
From: Sasha Levin @ 2019-06-27 0:42 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Pedersen, Johannes Berg, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627004236.21909-1-sashal@kernel.org>
From: Thomas Pedersen <thomas@eero.com>
[ Upstream commit 551842446ed695641a00782cd118cbb064a416a1 ]
ifmsh->csa is an RCU-protected pointer. The writer context
in ieee80211_mesh_finish_csa() is already mutually
exclusive with wdev->sdata.mtx, but the RCU checker did
not know this. Use rcu_dereference_protected() to avoid a
warning.
fixes the following warning:
[ 12.519089] =============================
[ 12.520042] WARNING: suspicious RCU usage
[ 12.520652] 5.1.0-rc7-wt+ #16 Tainted: G W
[ 12.521409] -----------------------------
[ 12.521972] net/mac80211/mesh.c:1223 suspicious rcu_dereference_check() usage!
[ 12.522928] other info that might help us debug this:
[ 12.523984] rcu_scheduler_active = 2, debug_locks = 1
[ 12.524855] 5 locks held by kworker/u8:2/152:
[ 12.525438] #0: 00000000057be08c ((wq_completion)phy0){+.+.}, at: process_one_work+0x1a2/0x620
[ 12.526607] #1: 0000000059c6b07a ((work_completion)(&sdata->csa_finalize_work)){+.+.}, at: process_one_work+0x1a2/0x620
[ 12.528001] #2: 00000000f184ba7d (&wdev->mtx){+.+.}, at: ieee80211_csa_finalize_work+0x2f/0x90
[ 12.529116] #3: 00000000831a1f54 (&local->mtx){+.+.}, at: ieee80211_csa_finalize_work+0x47/0x90
[ 12.530233] #4: 00000000fd06f988 (&local->chanctx_mtx){+.+.}, at: ieee80211_csa_finalize_work+0x51/0x90
Signed-off-by: Thomas Pedersen <thomas@eero.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mesh.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 1cbc7bd26de3..4bd8f3f056d8 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1138,7 +1138,8 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
ifmsh->chsw_ttl = 0;
/* Remove the CSA and MCSP elements from the beacon */
- tmp_csa_settings = rcu_dereference(ifmsh->csa);
+ tmp_csa_settings = rcu_dereference_protected(ifmsh->csa,
+ lockdep_is_held(&sdata->wdev.mtx));
RCU_INIT_POINTER(ifmsh->csa, NULL);
if (tmp_csa_settings)
kfree_rcu(tmp_csa_settings, rcu_head);
@@ -1160,6 +1161,8 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
struct mesh_csa_settings *tmp_csa_settings;
int ret = 0;
+ lockdep_assert_held(&sdata->wdev.mtx);
+
tmp_csa_settings = kmalloc(sizeof(*tmp_csa_settings),
GFP_ATOMIC);
if (!tmp_csa_settings)
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.14 06/35] mac80211: free peer keys before vif down in mesh
From: Sasha Levin @ 2019-06-27 0:38 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pradeep Kumar Chitrapu, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003925.21330-1-sashal@kernel.org>
From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
[ Upstream commit 0112fa557c3bb3a002bc85760dc3761d737264d3 ]
freeing peer keys after vif down is resulting in peer key uninstall
to fail due to interface lookup failure. so fix that.
Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mesh.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index aca054539f4a..c6edae051e9b 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -922,6 +922,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
/* flush STAs and mpaths on this iface */
sta_info_flush(sdata);
+ ieee80211_free_keys(sdata, true);
mesh_path_flush_by_iface(sdata);
/* stop the beacon */
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 66/95] cfg80211: util: fix bit count off by one
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mordechay Goodstein, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Mordechay Goodstein <mordechay.goodstein@intel.com>
[ Upstream commit 1a473d6092d5d182914bea854ce0b21e6d12519d ]
The bits of Rx MCS Map in VHT capability were enumerated
with index transform - index i -> (i + 1) bit => nss i. BUG!
while it should be - index i -> (i + 1) bit => (i + 1) nss.
The bug was exposed in commit a53b2a0b1245 ("iwlwifi: mvm: implement VHT
extended NSS support in rs.c"), where iwlwifi started using the
function.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: b0aa75f0b1b2 ("ieee80211: add new VHT capability fields/parsing")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 5a03f38788e7..5ac66a571e33 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1989,7 +1989,7 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
continue;
if (supp >= mcs_encoding) {
- max_vht_nss = i;
+ max_vht_nss = i + 1;
break;
}
}
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 28/95] iwlwifi: Fix double-free problems in iwl_req_fw_callback()
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jia-Ju Bai, Luca Coelho, Kalle Valo, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Jia-Ju Bai <baijiaju1990@gmail.com>
[ Upstream commit a8627176b0de7ba3f4524f641ddff4abf23ae4e4 ]
In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
again, which can cause double-free problems.
To fix this bug, the call to iwl_dealloc_ucode() in
iwl_req_fw_callback() is deleted.
This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 689a65b11cc3..4fd1737d768b 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -1579,7 +1579,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
goto free;
out_free_fw:
- iwl_dealloc_ucode(drv);
release_firmware(ucode_raw);
out_unbind:
complete(&drv->request_firmware_complete);
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 26/95] iwlwifi: clear persistence bit according to device family
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shahar S Matityahu, Luca Coelho, Kalle Valo, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Shahar S Matityahu <shahar.s.matityahu@intel.com>
[ Upstream commit 44f61b5c832c4085fcf476484efeaeef96dcfb8b ]
The driver attempts to clear persistence bit on any device familiy even
though only 9000 and 22000 families require it. Clear the bit only on
the relevant device families.
Each HW has different address to the write protection register. Use the
right register for each HW
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Fixes: 8954e1eb2270 ("iwlwifi: trans: Clear persistence bit when starting the FW")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 7 ++-
.../net/wireless/intel/iwlwifi/pcie/trans.c | 46 +++++++++++++------
2 files changed, 39 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 1af9f9e1ecd4..0c0799d13e15 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -402,7 +402,12 @@ enum aux_misc_master1_en {
#define AUX_MISC_MASTER1_SMPHR_STATUS 0xA20800
#define RSA_ENABLE 0xA24B08
#define PREG_AUX_BUS_WPROT_0 0xA04CC0
-#define PREG_PRPH_WPROT_0 0xA04CE0
+
+/* device family 9000 WPROT register */
+#define PREG_PRPH_WPROT_9000 0xA04CE0
+/* device family 22000 WPROT register */
+#define PREG_PRPH_WPROT_22000 0xA04D00
+
#define SB_CPU_1_STATUS 0xA01E30
#define SB_CPU_2_STATUS 0xA01E34
#define UMAG_SB_CPU_1_STATUS 0xA038C0
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index c4375b868901..2a03d34afa3b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1696,26 +1696,26 @@ static int iwl_pcie_init_msix_handler(struct pci_dev *pdev,
return 0;
}
-static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+static int iwl_trans_pcie_clear_persistence_bit(struct iwl_trans *trans)
{
- struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
- u32 hpm;
- int err;
-
- lockdep_assert_held(&trans_pcie->mutex);
+ u32 hpm, wprot;
- err = iwl_pcie_prepare_card_hw(trans);
- if (err) {
- IWL_ERR(trans, "Error while preparing HW: %d\n", err);
- return err;
+ switch (trans->cfg->device_family) {
+ case IWL_DEVICE_FAMILY_9000:
+ wprot = PREG_PRPH_WPROT_9000;
+ break;
+ case IWL_DEVICE_FAMILY_22000:
+ wprot = PREG_PRPH_WPROT_22000;
+ break;
+ default:
+ return 0;
}
hpm = iwl_read_umac_prph_no_grab(trans, HPM_DEBUG);
if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) {
- int wfpm_val = iwl_read_umac_prph_no_grab(trans,
- PREG_PRPH_WPROT_0);
+ u32 wprot_val = iwl_read_umac_prph_no_grab(trans, wprot);
- if (wfpm_val & PREG_WFPM_ACCESS) {
+ if (wprot_val & PREG_WFPM_ACCESS) {
IWL_ERR(trans,
"Error, can not clear persistence bit\n");
return -EPERM;
@@ -1724,6 +1724,26 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
hpm & ~PERSISTENCE_BIT);
}
+ return 0;
+}
+
+static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+{
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ int err;
+
+ lockdep_assert_held(&trans_pcie->mutex);
+
+ err = iwl_pcie_prepare_card_hw(trans);
+ if (err) {
+ IWL_ERR(trans, "Error while preparing HW: %d\n", err);
+ return err;
+ }
+
+ err = iwl_trans_pcie_clear_persistence_bit(trans);
+ if (err)
+ return err;
+
iwl_trans_pcie_sw_reset(trans);
err = iwl_pcie_apm_init(trans);
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 25/95] iwlwifi: fix load in rfkill flow for unified firmware
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Emmanuel Grumbach, Luca Coelho, Kalle Valo, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[ Upstream commit b3500b472c880b5abe90ffd5c4a25aa736f906ad ]
When we have a single image (same firmware image for INIT and
OPERATIONAL), we couldn't load the driver and register to the
stack if we had hardware RF-Kill asserted.
Fix this. This required a few changes:
1) Run the firmware as part of the INIT phase even if its
ucode_type is not IWL_UCODE_INIT.
2) Send the commands that are sent to the unified image in
INIT flow even in RF-Kill.
3) Don't ask the transport to stop the hardware upon RF-Kill
interrupt if the RF-Kill is asserted.
4) Allow the RF-Kill interrupt to take us out of L1A so that
the RF-Kill interrupt will be received by the host (to
enable the radio).
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 23 ++++++++++++++-----
.../net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 17 ++++++++++----
.../wireless/intel/iwlwifi/pcie/internal.h | 2 +-
5 files changed, 33 insertions(+), 13 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index ab68b5d53ec9..153717587aeb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -311,6 +311,8 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
int ret;
enum iwl_ucode_type old_type = mvm->fwrt.cur_fw_img;
static const u16 alive_cmd[] = { MVM_ALIVE };
+ bool run_in_rfkill =
+ ucode_type == IWL_UCODE_INIT || iwl_mvm_has_unified_ucode(mvm);
if (ucode_type == IWL_UCODE_REGULAR &&
iwl_fw_dbg_conf_usniffer(mvm->fw, FW_DBG_START_FROM_ALIVE) &&
@@ -328,7 +330,12 @@ static int iwl_mvm_load_ucode_wait_alive(struct iwl_mvm *mvm,
alive_cmd, ARRAY_SIZE(alive_cmd),
iwl_alive_fn, &alive_data);
- ret = iwl_trans_start_fw(mvm->trans, fw, ucode_type == IWL_UCODE_INIT);
+ /*
+ * We want to load the INIT firmware even in RFKILL
+ * For the unified firmware case, the ucode_type is not
+ * INIT, but we still need to run it.
+ */
+ ret = iwl_trans_start_fw(mvm->trans, fw, run_in_rfkill);
if (ret) {
iwl_fw_set_current_image(&mvm->fwrt, old_type);
iwl_remove_notification(&mvm->notif_wait, &alive_wait);
@@ -433,7 +440,8 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
* commands
*/
ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(SYSTEM_GROUP,
- INIT_EXTENDED_CFG_CMD), 0,
+ INIT_EXTENDED_CFG_CMD),
+ CMD_SEND_IN_RFKILL,
sizeof(init_cfg), &init_cfg);
if (ret) {
IWL_ERR(mvm, "Failed to run init config command: %d\n",
@@ -457,7 +465,8 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
}
ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(REGULATORY_AND_NVM_GROUP,
- NVM_ACCESS_COMPLETE), 0,
+ NVM_ACCESS_COMPLETE),
+ CMD_SEND_IN_RFKILL,
sizeof(nvm_complete), &nvm_complete);
if (ret) {
IWL_ERR(mvm, "Failed to run complete NVM access: %d\n",
@@ -482,6 +491,8 @@ static int iwl_run_unified_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
}
}
+ mvm->rfkill_safe_init_done = true;
+
return 0;
error:
@@ -526,7 +537,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
lockdep_assert_held(&mvm->mutex);
- if (WARN_ON_ONCE(mvm->calibrating))
+ if (WARN_ON_ONCE(mvm->rfkill_safe_init_done))
return 0;
iwl_init_notification_wait(&mvm->notif_wait,
@@ -576,7 +587,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
goto remove_notif;
}
- mvm->calibrating = true;
+ mvm->rfkill_safe_init_done = true;
/* Send TX valid antennas before triggering calibrations */
ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
@@ -612,7 +623,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
remove_notif:
iwl_remove_notification(&mvm->notif_wait, &calib_wait);
out:
- mvm->calibrating = false;
+ mvm->rfkill_safe_init_done = false;
if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
/* we want to debug INIT and we have no NVM - fake */
mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 6a3b11dd2edf..4ddf620c267d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1211,7 +1211,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
mvm->scan_status = 0;
mvm->ps_disabled = false;
- mvm->calibrating = false;
+ mvm->rfkill_safe_init_done = false;
/* just in case one was running */
iwl_mvm_cleanup_roc_te(mvm);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index a50dc53df086..b698d55ace1b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -877,7 +877,7 @@ struct iwl_mvm {
struct iwl_mvm_vif *bf_allowed_vif;
bool hw_registered;
- bool calibrating;
+ bool rfkill_safe_init_done;
bool support_umac_log;
u32 ampdu_ref;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 13681b03c10e..20115770e75a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1222,7 +1222,8 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
{
struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
- bool calibrating = READ_ONCE(mvm->calibrating);
+ bool rfkill_safe_init_done = READ_ONCE(mvm->rfkill_safe_init_done);
+ bool unified = iwl_mvm_has_unified_ucode(mvm);
if (state)
set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
@@ -1231,15 +1232,23 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
iwl_mvm_set_rfkill_state(mvm);
- /* iwl_run_init_mvm_ucode is waiting for results, abort it */
- if (calibrating)
+ /* iwl_run_init_mvm_ucode is waiting for results, abort it. */
+ if (rfkill_safe_init_done)
iwl_abort_notification_waits(&mvm->notif_wait);
+ /*
+ * Don't ask the transport to stop the firmware. We'll do it
+ * after cfg80211 takes us down.
+ */
+ if (unified)
+ return false;
+
/*
* Stop the device if we run OPERATIONAL firmware or if we are in the
* middle of the calibrations.
*/
- return state && (mvm->fwrt.cur_fw_img != IWL_UCODE_INIT || calibrating);
+ return state && (mvm->fwrt.cur_fw_img != IWL_UCODE_INIT ||
+ rfkill_safe_init_done);
}
static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 59213164f35e..2afce5c41322 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -948,7 +948,7 @@ static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
MSIX_HW_INT_CAUSES_REG_RF_KILL);
}
- if (trans->cfg->device_family == IWL_DEVICE_FAMILY_9000) {
+ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_9000) {
/*
* On 9000-series devices this bit isn't enabled by default, so
* when we power down the device we need set the bit to allow it
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 22/95] mwifiex: Fix possible buffer overflows at parsing bss descriptor
From: Sasha Levin @ 2019-06-27 0:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, huangwen, Kalle Valo, Sasha Levin, linux-wireless,
netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 13ec7f10b87f5fc04c4ccbd491c94c7980236a74 ]
mwifiex_update_bss_desc_with_ie() calls memcpy() unconditionally in
a couple places without checking the destination size. Since the
source is given from user-space, this may trigger a heap buffer
overflow.
Fix it by putting the length check before performing memcpy().
This fix addresses CVE-2019-3846.
Reported-by: huangwen <huangwen@venustech.com.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/scan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 935778ec9a1b..64ab6fe78c0d 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1247,6 +1247,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
}
switch (element_id) {
case WLAN_EID_SSID:
+ if (element_len > IEEE80211_MAX_SSID_LEN)
+ return -EINVAL;
bss_entry->ssid.ssid_len = element_len;
memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
element_len);
@@ -1256,6 +1258,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
break;
case WLAN_EID_SUPP_RATES:
+ if (element_len > MWIFIEX_SUPPORTED_RATES)
+ return -EINVAL;
memcpy(bss_entry->data_rates, current_ptr + 2,
element_len);
memcpy(bss_entry->supported_rates, current_ptr + 2,
--
2.20.1
^ permalink raw reply related
* [PATCH AUTOSEL 5.1 13/95] mac80211: fix rate reporting inside cfg80211_calculate_bitrate_he()
From: Sasha Levin @ 2019-06-27 0:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: John Crispin, Shashidhar Lakkavalli, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190627003021.19867-1-sashal@kernel.org>
From: John Crispin <john@phrozen.org>
[ Upstream commit 25d16d124a5e249e947c0487678b61dcff25cf8b ]
The reported rate is not scaled down correctly. After applying this patch,
the function will behave just like the v/ht equivalents.
Signed-off-by: Shashidhar Lakkavalli <slakkavalli@datto.com>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 75899b62bdc9..5a03f38788e7 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1237,7 +1237,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
if (rate->he_dcm)
result /= 2;
- return result;
+ return result / 10000;
}
u32 cfg80211_calculate_bitrate(struct rate_info *rate)
--
2.20.1
^ permalink raw reply related
* Re: [PATCH 2/2] iwlwifi: Extended Key ID support
From: Alexander Wetzel @ 2019-06-26 21:10 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, luca
In-Reply-To: <20190506190149.3624-2-alexander@wetzel-home.de>
> iwlwifi cards are all able to support Extended Key ID as long as
> mac80211 stops A-MPDU aggregation when replacing the unicast key.
>
> Enable Extended Key ID support and tell mac80211 that it has to tear
> down any running Tx aggregation sessions during rekey when using
> Extended Key ID.
With the merge of the A-MPDU handling patch
https://patchwork.kernel.org/patch/10931861/ we probably should simplify
the API for Extended Key ID and not merge the patch as it is:
1) We can drop EXT_KEY_ID_NATIVE from mac80211 and let the drivers set
NL80211_EXT_FEATURE_EXT_KEY_ID instead of mac80211.
Without the COMPAT support the naming is off and the flag is simply
pointless. Assuming we want to pick up the COMPAT Extended Key ID we
still can just define a new flag, e.g.
SINGLE_STA_UNICAST_KEY_OFFLOAD_ONLY to tell mac80211 it can only
have one unicast key active in the HW per STA.
2) Mac80211 would then enable Extended Key ID for all drivers using SW
crypto and just also set NO_AMPDU_KEYBORDER_SUPPORT when the driver
supports A-MPDU
3) we then could undo (revert?) cfe7007a9b4c ("mac80211_hwsim: Extended
Key ID support") and let the more generic code in mac80211 handle it
If you agree I'll prepare and test a small patch series for that.
And we better only merge a iteration of this patch here once we got the
API updated.
Alexander
^ permalink raw reply
* Re: pull-request: wireless-drivers-next 2019-06-26
From: David Miller @ 2019-06-26 17:12 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, netdev, linux-kernel
In-Reply-To: <87ef3gjq16.fsf@kamboji.qca.qualcomm.com>
From: Kalle Valo <kvalo@codeaurora.org>
Date: Wed, 26 Jun 2019 18:59:49 +0300
> here's a pull request to net-next for 5.3, more info below. Please let
> me know if there are any problems.
Pulled, thanks Kalo.
^ permalink raw reply
* Re: [PATCH] libertas: Fix a double free in if_spi_c2h_data()
From: Dan Williams @ 2019-06-26 16:02 UTC (permalink / raw)
To: Dan Carpenter
Cc: Philip Rakity, libertas-dev, kernel-janitors, linux-wireless,
Lubomir Rintel, Kalle Valo, Allison Randal
In-Reply-To: <20190626132340.GE28859@kadam>
On Wed, 2019-06-26 at 16:23 +0300, Dan Carpenter wrote:
> Yeah. That looks nicer. Could you send it as a proper patch and
> give
> me Reported-by credit?
Will do.
Dan
^ permalink raw reply
* pull-request: wireless-drivers-next 2019-06-26
From: Kalle Valo @ 2019-06-26 15:59 UTC (permalink / raw)
To: David Miller; +Cc: linux-wireless, netdev, linux-kernel
Hi Dave,
here's a pull request to net-next for 5.3, more info below. Please let
me know if there are any problems.
Kalle
The following changes since commit f4aa80129ff71909380ee0bde8be36c5cc031d4c:
cxgb4: Make t4_get_tp_e2c_map static (2019-05-26 22:16:26 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git tags/wireless-drivers-next-for-davem-2019-06-26
for you to fetch changes up to e5db0ad7563c38b7b329504836c9a64ae025a47a:
airo: switch to skcipher interface (2019-06-25 08:12:20 +0300)
----------------------------------------------------------------
wireless-drivers-next patches for 5.3
First set of patches for 5.3, but not that many patches this time.
This pull request fails to compile with the tip tree due to
ktime_get_boot_ns() API changes there. It should be easy for Linus to
fix it in p54 driver once he pulls this, an example resolution here:
https://lkml.kernel.org/r/20190625160432.533aa140@canb.auug.org.au
Major changes:
airo
* switch to use skcipher interface
p54
* support boottime in scan results
rtw88
* add fast xmit support
* add random mac address on scan support
rt2x00
* add software watchdog to detect hangs, it's disabled by default
----------------------------------------------------------------
Ahmad Masri (1):
wil6210: fix overwriting max_assoc_sta module param
Alagu Sankar (3):
ath10k: htt: don't use txdone_fifo with SDIO
ath10k: htt: support MSDU ids with SDIO
ath10k: add initialization of HTC header
Alan Stern (1):
p54usb: Fix race between disconnect and firmware loading
Alexei Avshalom Lazar (1):
wil6210: fix _desc access in __wil_tx_vring_tso
Anilkumar Kolli (1):
ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
Ard Biesheuvel (1):
airo: switch to skcipher interface
Arend van Spriel (6):
brcm80211: switch common header files to using SPDX license identifier
brcmutil: switch source files to using SPDX license identifier
brcmsmac: switch phy source files to using SPDX license identifier
brcmfmac: switch source files to using SPDX license identifier
brcmfmac: use separate Kconfig file for brcmfmac
brcm80211: select WANT_DEV_COREDUMP conditionally for brcmfmac
Arnd Bergmann (1):
wireless: carl9170: fix clang build warning
Balaji Pothunoori (1):
ath10k: rx_duration update for fw_stats debugfs entry
Brandon Huang (1):
ath10k: Fix the tx stats bytes & packets parsing
Brian Norris (2):
mwifiex: drop 'set_consistent_dma_mask' log message
mwifiex: print PCI mmap with %pK
Chien-Hsun Liao (2):
rtw88: 8822c: add rf write protection when switching channel
rtw88: 8822c: update channel and bandwidth BB setting
Chin-Yen Lee (1):
rtw88: add beacon function setting
Christian Lamparter (3):
p54: fix crash during initialization
p54: Support boottime in scan results
p54: remove dead branch in op_conf_tx callback
Colin Ian King (5):
ath6kl: remove redundant check of status != 0
libertas: fix spelling mistake "Donwloading" -> "Downloading"
rtlwifi: remove redundant assignment to variable badworden
rtlwifi: remove redundant assignment to variable k
rtlwifi: rtl8188ee: remove redundant assignment to rtstatus
Dan Carpenter (1):
ath6kl: add some bounds checking
Dedy Lansky (3):
wil6210: add printout of platform capabilities
wil6210: enhancements for descriptor and status ring debugfs
wil6210: check rx_buff_mgmt before accessing it
Erik Stromdahl (1):
ath10k: sdio: add missing error check
Govind Singh (2):
ath10k: Move board id and fw version logging to info level
ath10k: Modify CE4 src buffer entries to 2048 for WCN3990
Greg Kroah-Hartman (2):
iwlegacy: 3945: no need to check return value of debugfs_create functions
iwlegacy: 4965: no need to check return value of debugfs_create functions
Gustavo A. R. Silva (6):
ath6kl: debug: Use struct_size() helper
ath6kl: wmi: use struct_size() helper
wil6210: fix potential out-of-bounds read
ath10k: Use struct_size() helper
ath10k: coredump: use struct_size() helper
qtnfmac: Use struct_size() in kzalloc()
Jia-Ju Bai (1):
b43: Avoid possible double calls to b43_one_core_detach()
Kalle Valo (3):
ath10k: initialise struct ath10k_bus params to zero
ath10k: fix use-after-free on SDIO data frames
Merge ath-next from git://git.kernel.org/.../kvalo/ath.git
Larry Finger (4):
rtlwifi: rtl8821ae: Remove unused GET_XXX and SET_XXX descriptor macros
rtlwifi: rtl8821ae: Replace local bit manipulation macros
rtlwifi: rtl8821ae: Convert macros that set descriptor
rtlwifi: rtl8821ae: Convert inline routines to little-endian words
Lorenzo Bianconi (2):
mt7601u: do not schedule rx_tasklet when the device has been disconnected
mt7601u: fix possible memory leak when the device is disconnected
Maharaja Kennadyrajan (2):
ath10k: Extended the HTT stats support to retrieve Mu-MIMO related stats
ath10k: Added support to reset HTT stats in debugfs
Maya Erez (4):
wil6210: fix spurious interrupts in 3-msi
wil6210: add support for multiple sections in brd file
wil6210: fix missed MISC mbox interrupt
wil6210: remove HALP for Talyn devices
Michael Buesch (1):
ssb/gpio: Remove unnecessary WARN_ON from driver_gpio
Neo Jou (1):
brcmfmac: use strlcpy() instead of strcpy()
Ping-Ke Shih (5):
rtlwifi: 8192de: Reduce indentation and fix coding style
rtlwifi: 8192de: make tables to be 'static const'
rtlwifi: 8192de: Fix used uninitialized variables in power tracking
rtlwifi: 8192de: use le32 to access cckswing tables
rtlwifi: rtl8192cu: fix error handle when usb probe failed
Pradeep kumar Chitrapu (1):
ath10k: fix incorrect multicast/broadcast rate setting
Rakesh Pillai (1):
ath10k: Fix encoding for protected management frames
Sharvari Harisangam (1):
mwifiex: update set_mac_address logic
Stanislaw Gruszka (7):
rt2x00: allow to specify watchdog interval
rt2800: add helpers for reading dma done index
rt2800: initial watchdog implementation
rt2800: add pre_reset_hw callback
rt2800: do not nullify initialization vector data
rt2x00: add restart hw
rt2800: do not enable watchdog by default
Surabhi Vishnoi (4):
ath10k: Fix the wrong value of enums for wmi tlv stats id
ath10k: Add wmi tlv vdev subtype for mesh in WCN3990
ath10k: Do not send probe response template for mesh
ath10k: Add wmi tlv service map for mesh 11s
Sven Eckelmann (1):
ath9k: Differentiate between max combined and per chain power
Swati Kushwaha (1):
mwifiex: ignore processing invalid command response
Tim Schumacher (1):
ath9k: Check for errors when reading SREV register
Toke Høiland-Jørgensen (1):
ath9k: Don't trust TX status TID number when reporting airtime
Tomislav Požega (2):
ath: drop duplicated define
ath9k: drop redundant code in ar9003_hw_set_channel
Tzu-En Huang (1):
rtw88: fix typo rtw_writ16_set
Weitao Hou (1):
brcmfmac: fix typos in code comments
Wen Gong (9):
ath10k: sdio: workaround firmware UART pin configuration bug
ath10k: don't disable interrupts in ath10k_sdio_remove()
ath10k: add struct for high latency PN replay protection
ath10k: add handler for HTT_T2H_MSG_TYPE_SEC_IND event
ath10k: add PN replay protection for high latency devices
ath10k: add fragmentation handler for high latency devices
ath10k: enable QCA6174 hw3.2 SDIO hardware
ath10k: change swap mail box config for UTF mode of SDIO
ath10k: add peer id check in ath10k_peer_find_by_id
Yan-Hsuan Chuang (10):
rtw88: pci: use ieee80211_ac_numbers instead of 0-3
rtw88: pci: check if queue mapping exceeds size of ac_to_hwq
rtw88: more descriptions about LPS
rtw88: add fast xmit support
rtw88: add support for random mac scan
rtw88: 8822c: disable rx clock gating before counter reset
rtw88: 8822c: use more accurate ofdm fa counting
rtw88: power on again if it was already on
rtw88: restore DACK results to save time
rtw88: rsvd page should go though management queue
Yingying Tang (1):
ath10k: Check tx_stats before use it
YueHaibing (4):
ath9k: Remove some set but not used variables
rtlwifi: rtl8821ae: Remove set but not used variables 'cur_txokcnt' and 'b_last_is_cur_rdl_state'
rtlwifi: btcoex: Remove set but not used variable 'len' and 'asso_type_v2'
rtlwifi: btcoex: remove unused function exhalbtc_stack_operation_notify
drivers/net/wireless/ath/ath10k/ahb.c | 2 +-
drivers/net/wireless/ath/ath10k/core.c | 48 +-
drivers/net/wireless/ath/ath10k/core.h | 12 +-
drivers/net/wireless/ath/ath10k/coredump.c | 4 +-
drivers/net/wireless/ath/ath10k/debug.c | 50 +-
drivers/net/wireless/ath/ath10k/debugfs_sta.c | 7 +
drivers/net/wireless/ath/ath10k/htc.c | 1 +
drivers/net/wireless/ath/ath10k/htt.h | 60 +-
drivers/net/wireless/ath/ath10k/htt_rx.c | 387 ++++++++++-
drivers/net/wireless/ath/ath10k/htt_tx.c | 29 +-
drivers/net/wireless/ath/ath10k/hw.h | 6 +
drivers/net/wireless/ath/ath10k/mac.c | 14 +-
drivers/net/wireless/ath/ath10k/pci.c | 2 +-
drivers/net/wireless/ath/ath10k/qmi.c | 15 +-
drivers/net/wireless/ath/ath10k/sdio.c | 18 +-
drivers/net/wireless/ath/ath10k/snoc.c | 4 +-
drivers/net/wireless/ath/ath10k/txrx.c | 3 +
drivers/net/wireless/ath/ath10k/usb.c | 2 +-
drivers/net/wireless/ath/ath10k/wmi-tlv.c | 28 +-
drivers/net/wireless/ath/ath10k/wmi-tlv.h | 12 +
drivers/net/wireless/ath/ath10k/wmi.c | 37 +-
drivers/net/wireless/ath/ath10k/wmi.h | 7 +-
drivers/net/wireless/ath/ath6kl/debug.c | 3 +-
drivers/net/wireless/ath/ath6kl/htc_pipe.c | 3 -
drivers/net/wireless/ath/ath6kl/wmi.c | 13 +-
drivers/net/wireless/ath/ath9k/ar9003_phy.c | 24 +-
drivers/net/wireless/ath/ath9k/eeprom.c | 2 +-
drivers/net/wireless/ath/ath9k/eeprom_4k.c | 1 +
drivers/net/wireless/ath/ath9k/hw.c | 40 +-
drivers/net/wireless/ath/ath9k/hw.h | 1 +
drivers/net/wireless/ath/ath9k/init.c | 2 +-
drivers/net/wireless/ath/ath9k/xmit.c | 18 +-
drivers/net/wireless/ath/carl9170/mac.c | 2 +-
drivers/net/wireless/ath/carl9170/rx.c | 2 +-
drivers/net/wireless/ath/dfs_pattern_detector.c | 2 +-
drivers/net/wireless/ath/regd.h | 1 -
drivers/net/wireless/ath/wil6210/cfg80211.c | 4 +-
drivers/net/wireless/ath/wil6210/debugfs.c | 70 +-
drivers/net/wireless/ath/wil6210/fw.h | 11 +-
drivers/net/wireless/ath/wil6210/fw_inc.c | 148 +++--
drivers/net/wireless/ath/wil6210/interrupt.c | 67 +-
drivers/net/wireless/ath/wil6210/main.c | 18 +-
drivers/net/wireless/ath/wil6210/pcie_bus.c | 2 +
drivers/net/wireless/ath/wil6210/rx_reorder.c | 2 +-
drivers/net/wireless/ath/wil6210/txrx.c | 26 +-
drivers/net/wireless/ath/wil6210/txrx_edma.c | 10 +-
drivers/net/wireless/ath/wil6210/wil6210.h | 33 +-
drivers/net/wireless/ath/wil6210/wmi.c | 14 +-
drivers/net/wireless/broadcom/b43/main.c | 7 +-
drivers/net/wireless/broadcom/brcm80211/Kconfig | 52 +-
drivers/net/wireless/broadcom/brcm80211/Makefile | 14 +-
.../wireless/broadcom/brcm80211/brcmfmac/Kconfig | 50 ++
.../wireless/broadcom/brcm80211/brcmfmac/Makefile | 14 +-
.../wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/bcdc.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/btcoex.h | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 13 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/chip.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/chip.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/common.c | 15 +-
.../wireless/broadcom/brcm80211/brcmfmac/common.h | 16 +-
.../broadcom/brcm80211/brcmfmac/commonring.c | 16 +-
.../broadcom/brcm80211/brcmfmac/commonring.h | 16 +-
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/core.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/debug.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/debug.h | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/feature.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/feature.h | 13 +-
.../broadcom/brcm80211/brcmfmac/firmware.c | 13 +-
.../broadcom/brcm80211/brcmfmac/firmware.h | 13 +-
.../broadcom/brcm80211/brcmfmac/flowring.c | 16 +-
.../broadcom/brcm80211/brcmfmac/flowring.h | 16 +-
.../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/fweh.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/fwil.c | 15 +-
.../wireless/broadcom/brcm80211/brcmfmac/fwil.h | 13 +-
.../broadcom/brcm80211/brcmfmac/fwil_types.h | 13 +-
.../broadcom/brcm80211/brcmfmac/fwsignal.c | 13 +-
.../broadcom/brcm80211/brcmfmac/fwsignal.h | 14 +-
.../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 16 +-
.../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h | 16 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/of.h | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 16 +-
.../wireless/broadcom/brcm80211/brcmfmac/pcie.h | 16 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/pno.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/proto.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/proto.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 13 +-
.../broadcom/brcm80211/brcmfmac/tracepoint.c | 13 +-
.../broadcom/brcm80211/brcmfmac/tracepoint.h | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 13 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/usb.h | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/vendor.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/vendor.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_cmn.c | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_hal.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_int.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_lcn.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_n.c | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_qmath.c | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_qmath.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_radio.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phyreg_n.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phytbl_lcn.c | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phytbl_lcn.h | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phytbl_n.c | 13 +-
.../broadcom/brcm80211/brcmsmac/phy/phytbl_n.h | 13 +-
.../wireless/broadcom/brcm80211/brcmutil/Makefile | 13 +-
.../net/wireless/broadcom/brcm80211/brcmutil/d11.c | 13 +-
.../wireless/broadcom/brcm80211/brcmutil/utils.c | 13 +-
.../broadcom/brcm80211/include/brcm_hw_ids.h | 13 +-
.../broadcom/brcm80211/include/brcmu_d11.h | 13 +-
.../broadcom/brcm80211/include/brcmu_utils.h | 13 +-
.../broadcom/brcm80211/include/brcmu_wifi.h | 13 +-
.../broadcom/brcm80211/include/chipcommon.h | 13 +-
.../net/wireless/broadcom/brcm80211/include/defs.h | 13 +-
.../net/wireless/broadcom/brcm80211/include/soc.h | 13 +-
drivers/net/wireless/cisco/Kconfig | 2 +
drivers/net/wireless/cisco/airo.c | 57 +-
drivers/net/wireless/intel/iwlegacy/3945-rs.c | 14 +-
drivers/net/wireless/intel/iwlegacy/3945.h | 3 -
drivers/net/wireless/intel/iwlegacy/4965-rs.c | 31 +-
drivers/net/wireless/intel/iwlegacy/common.h | 4 -
drivers/net/wireless/intersil/p54/main.c | 9 +-
drivers/net/wireless/intersil/p54/p54usb.c | 43 +-
drivers/net/wireless/intersil/p54/txrx.c | 11 +-
drivers/net/wireless/marvell/libertas/if_usb.c | 2 +-
drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +-
drivers/net/wireless/marvell/mwifiex/cmdevt.c | 27 +-
drivers/net/wireless/marvell/mwifiex/main.c | 6 +-
drivers/net/wireless/marvell/mwifiex/main.h | 2 +-
drivers/net/wireless/marvell/mwifiex/pcie.c | 5 +-
drivers/net/wireless/mediatek/mt7601u/dma.c | 54 +-
drivers/net/wireless/mediatek/mt7601u/tx.c | 4 +-
drivers/net/wireless/quantenna/qtnfmac/commands.c | 5 +-
drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 96 ++-
drivers/net/wireless/ralink/rt2x00/rt2800lib.h | 11 +
drivers/net/wireless/ralink/rt2x00/rt2800mmio.c | 31 +
drivers/net/wireless/ralink/rt2x00/rt2800mmio.h | 2 +
drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 3 +
drivers/net/wireless/ralink/rt2x00/rt2800soc.c | 3 +
drivers/net/wireless/ralink/rt2x00/rt2800usb.c | 11 +
drivers/net/wireless/ralink/rt2x00/rt2x00.h | 10 +
drivers/net/wireless/ralink/rt2x00/rt2x00debug.c | 35 +
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 10 +-
drivers/net/wireless/ralink/rt2x00/rt2x00link.c | 15 +-
drivers/net/wireless/ralink/rt2x00/rt2x00queue.h | 6 +
.../realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 35 +-
.../realtek/rtlwifi/btcoexist/halbtcoutsrc.h | 1 -
.../wireless/realtek/rtlwifi/btcoexist/rtl_btc.c | 3 +-
drivers/net/wireless/realtek/rtlwifi/efuse.c | 5 +-
.../net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 2 +-
.../net/wireless/realtek/rtlwifi/rtl8192de/dm.c | 695 ++++++++++----------
.../net/wireless/realtek/rtlwifi/rtl8821ae/dm.c | 8 +-
.../net/wireless/realtek/rtlwifi/rtl8821ae/trx.c | 253 ++++----
.../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 708 +++++++++++----------
drivers/net/wireless/realtek/rtlwifi/usb.c | 5 +-
drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 +
drivers/net/wireless/realtek/rtw88/hci.h | 2 +-
drivers/net/wireless/realtek/rtw88/mac.c | 8 +-
drivers/net/wireless/realtek/rtw88/mac80211.c | 32 +
drivers/net/wireless/realtek/rtw88/main.c | 10 +-
drivers/net/wireless/realtek/rtw88/main.h | 11 +
drivers/net/wireless/realtek/rtw88/pci.c | 10 +-
drivers/net/wireless/realtek/rtw88/phy.c | 13 +-
drivers/net/wireless/realtek/rtw88/rtw8822c.c | 436 ++++++++++++-
drivers/net/wireless/realtek/rtw88/rtw8822c.h | 23 +
drivers/net/wireless/realtek/rtw88/tx.c | 2 +-
drivers/ssb/driver_gpio.c | 6 -
181 files changed, 2885 insertions(+), 2322 deletions(-)
create mode 100644 drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig
^ permalink raw reply
* Re: [PATCH] ath: fix SPDX tags
From: Kalle Valo @ 2019-06-26 15:10 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless
In-Reply-To: <1561474345-1439-1-git-send-email-kvalo@codeaurora.org>
Kalle Valo <kvalo@codeaurora.org> wrote:
> Commit ec8f24b7faaf ("treewide: Add SPDX license identifier -
> Makefile/Kconfig") marked various Makefiles and Kconfig files within ath
> directories as GPL-2.0. But these modules and drivers are actually ISC:
>
> * ath
> * ar5523
> * ath10k
> * ath5k
> * ath6kl
> * ath9k
> * wcn36xx
> * wil6210
>
> Fix SPDX tags accordingly.
>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to wireless-drivers.git, thanks.
e780d22757fb ath: fix SPDX tags
--
https://patchwork.kernel.org/patch/11015875/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply
* Re: [PATCH] carl9170: fix enum compare splat
From: Kalle Valo @ 2019-06-26 14:17 UTC (permalink / raw)
To: Christian Lamparter; +Cc: linux-wireless
In-Reply-To: <4392478.8kWN0Ehzps@debian64>
Christian Lamparter <chunkeey@gmail.com> writes:
> On Tuesday, June 18, 2019 2:11:53 PM CEST Kalle Valo wrote:
>> Christian Lamparter <chunkeey@gmail.com> writes:
>> > On Monday, June 10, 2019 9:06:30 AM CEST Kalle Valo wrote:
>> >> Christian Lamparter <chunkeey@gmail.com> writes:
>> >>
>> >> > This patch fixes a noisy warning triggered by -Wenum-compare
>> >> >
>> >> > |main.c:1390:31: warning: comparison between ‘enum nl80211_ac’
>> >> > | and ‘enum ar9170_txq’ [-Wenum-compare]
>> >> > | BUILD_BUG_ON(NL80211_NUM_ACS > __AR9170_NUM_TXQ);
>> >> > | ^
>> >> > | [...]
>> >> >
>> >> > This is a little bit unfortunate, since the number of queues
>> >> > (hence NL80211_NUM_ACS) is a constant based on the IEEE 802.11
>> >> > (much like IEEE80211_NUM_ACS) and __AR9170_NUM_TXQ is more or
>> >> > less defined by the AR9170 hardware.
>> >>
>> >> Is the warning enabled by default? TBH I'm not seeing how useful this
>> >> warning is for kernel development.
>> >
>> > It is included in the "-Wall" (which is coming from "KBUILD_CFLAGS"
>> > in the main Makefile).
>> >
>> > I tried debian's gcc starting from 4.6 to the lastest 8.3. They all
>> > complain about it in various degrees.
>> >
>> > https://gcc.gnu.org/onlinedocs/gcc-4.6.0/gcc/Warning-Options.html#Warning-Options
>>
>> Ok, odd that I haven't noticed this warning. Maybe I have been just
>> blind.
>
> Sorry. No, I messed up there. I made a patch back in the day during the spectre
> mac80211 patches that I kept in my tree for the driver. But I now remember that
> I never published those because of that exact "warning".
> These lines are coming from there.
>
>> >> > --- a/drivers/net/wireless/ath/carl9170/main.c
>> >> > +++ b/drivers/net/wireless/ath/carl9170/main.c
>> >> > @@ -1387,7 +1387,7 @@ static int carl9170_op_conf_tx(struct ieee80211_hw *hw,
>> >> > int ret;
>> >> >
>> >> > BUILD_BUG_ON(ARRAY_SIZE(ar9170_qmap) != __AR9170_NUM_TXQ);
>> >> > - BUILD_BUG_ON(NL80211_NUM_ACS > __AR9170_NUM_TXQ);
>> >> > + BUILD_BUG_ON((size_t)NL80211_NUM_ACS > (size_t)__AR9170_NUM_TXQ);
>> >>
>> >> IMHO this just makes the code worse. Does it make sense to workaround
>> >> (stupid) compiler warnings like this?
>> >
>> > True. What's worse: This isn't really code. The BUILD_BUG_ON Macro is there
>> > to guard but it's getting compiled away. I could also just drop it.
>>
>> Either way is fine for me. If the GCC (by default) emits a warning for
>> this we need to silence that warning, so in that respect I guess we
>> should apply this. Unless better solutions come up, of course :)
>
> Note: I dropped this patch from patchwork. So, there's nothing that
> needs to be done now ;)
Thanks, except I would prefer that I drop the patch myself :) In
numerous cases I have been wondering there a patch has disappeared and
only after a while I realise the submitter deleted the patch altogether
(which also destroys the conversation from patchwork etc). IMHO that's
really bad UX in patchwork, I should file a bug report about that.
So in general it's enough to say "Kalle, please drop the patch" and I'll
do the rest.
> Well, except OT: Would you mind adding the QCA4019 boardfiles that
> have accumulated over the past six-ish months?
Yeah, those are in my queue. But I'll first want to implement a script
so that I don't need to manually add all of them and I just haven't
found the time for that.
--
Kalle Valo
^ permalink raw reply
* Re: [PATCH] rt2x00: fix rx queue hang
From: Soeren Moch @ 2019-06-26 13:28 UTC (permalink / raw)
To: Stanislaw Gruszka
Cc: Helmut Schaa, Kalle Valo, David S. Miller, linux-wireless, netdev,
linux-kernel, stable
In-Reply-To: <20190625095734.GA2886@redhat.com>
On 25.06.19 11:57, Stanislaw Gruszka wrote:
> Hello
>
> On Fri, Jun 21, 2019 at 01:30:01PM +0200, Soeren Moch wrote:
>> On 18.06.19 11:34, Stanislaw Gruszka wrote:
>>> Hi
>>>
>>> On Mon, Jun 17, 2019 at 11:46:56AM +0200, Soeren Moch wrote:
>>>> Since commit ed194d136769 ("usb: core: remove local_irq_save() around
>>>> ->complete() handler") the handlers rt2x00usb_interrupt_rxdone() and
>>>> rt2x00usb_interrupt_txdone() are not running with interrupts disabled
>>>> anymore. So these handlers are not guaranteed to run completely before
>>>> workqueue processing starts. So only mark entries ready for workqueue
>>>> processing after proper accounting in the dma done queue.
>>> It was always the case on SMP machines that rt2x00usb_interrupt_{tx/rx}done
>>> can run concurrently with rt2x00_work_{rx,tx}done, so I do not
>>> understand how removing local_irq_save() around complete handler broke
>>> things.
>> I think because completion handlers can be interrupted now and scheduled
>> away
>> in the middle of processing.
>>> Have you reverted commit ed194d136769 and the revert does solve the problem ?
>> Yes, I already sent a patch for this, see [1]. But this was not considered
>> an acceptablesolution. Especially RT folks do not like code running with
>> interrupts disabled,particularly when trying to acquire spinlocks then.
>>
>> [1] https://lkml.org/lkml/2019/5/31/863
>>> Between 4.19 and 4.20 we have some quite big changes in rt2x00 driver:
>>>
>>> 0240564430c0 rt2800: flush and txstatus rework for rt2800mmio
>>> adf26a356f13 rt2x00: use different txstatus timeouts when flushing
>>> 5022efb50f62 rt2x00: do not check for txstatus timeout every time on tasklet
>>> 0b0d556e0ebb rt2800mmio: use txdone/txstatus routines from lib
>>> 5c656c71b1bf rt2800: move usb specific txdone/txstatus routines to rt2800lib
>>>
>>> so I'm a bit afraid that one of those changes is real cause of
>>> the issue not ed194d136769 .
>> I tested 4.20 and 5.1 and see the exact same behavior. Reverting this
>> usb core patchsolves the problem.
>> 4.19.x (before this usb core patch) is running fine.
>>>> Note that rt2x00usb_work_rxdone() processes all available entries, not
>>>> only such for which queue_work() was called.
>>>>
>>>> This fixes a regression on a RT5370 based wifi stick in AP mode, which
>>>> suddenly stopped data transmission after some period of heavy load. Also
>>>> stopping the hanging hostapd resulted in the error message "ieee80211
>>>> phy0: rt2x00queue_flush_queue: Warning - Queue 14 failed to flush".
>>>> Other operation modes are probably affected as well, this just was
>>>> the used testcase.
>>> Do you know what actually make the traffic stop,
>>> TX queue hung or RX queue hung?
>> I think RX queue hang, as stated in the patch title. "Queue 14" means QID_RX
>> (rt2x00queue.h, enum data_queue_qid).
>> I also tried to re-add local_irq_save() in only one of the handlers. Adding
>> this tort2x00usb_interrupt_rxdone() alone solved the issue, while doing so
>> for tx alonedid not.
>>
>> Note that this doesn't mean there is no problem for tx, that's maybe
>> just more
>> difficult to trigger.
>>>> diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
>>>> index 1b08b01db27b..9c102a501ee6 100644
>>>> --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
>>>> +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
>>>> @@ -263,9 +263,9 @@ EXPORT_SYMBOL_GPL(rt2x00lib_dmastart);
>>>>
>>>> void rt2x00lib_dmadone(struct queue_entry *entry)
>>>> {
>>>> - set_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags);
>>>> clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
>>>> rt2x00queue_index_inc(entry, Q_INDEX_DMA_DONE);
>>>> + set_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags);
>>> Unfortunately I do not understand how this suppose to fix the problem,
>>> could you elaborate more about this change?
>>>
>> Re-adding local_irq_save() around thisrt2x00lib_dmadone()solved
>> the issue. So I also tried to reverse the order of these calls.
>> It seems totally plausible to me, that the correct sequence is to
>> first clear the device assignment, then to set the status to dma_done,
>> then to trigger the workqueue processing for this entry. When the handler
>> is scheduled away in the middle of this sequence, now there is no
>> strange state where the entry can be processed by the workqueue while
>> not declared dma_done for it.
>> With this changed sequence there is no need anymore to disable interrupts
>> for solving the hang issue.
> Thanks very much for explanations. However I still do not fully
> understand the issue. Q_INDEX_DMA_DONE index is only checked on TX
> processing (on RX we use only Q_INDEX_DONE and Q_INDEX) and
> ENTRY_OWNER_DEVICE_DATA is already cleared before rt2x00lib_dmadone()
> in rt2x00usb_interrupt_rxdone() .
>
> So I'm not sure how changing the order solve the problem. Looks
> for me that the issue is triggered by some rt2x00lib_dmadone()
> call done on error path (not in rt2x00usb_interrupt_rxdone())
> and it race with this check:
>
> if (test_and_set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
> test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
> return false;
>
> in rt2x00usb_kick_rx_entry() - we return instead of submit urb.
Hi Stanislaw,
the good news is: your patch below also solves the issue for me. But
removing the ENTRY_DATA_STATUS_PENDING check in
rt2x00usb_kick_rx_entry() alone does not help, while removing this check
in rt2x00usb_work_rxdone() alone does the trick.
So the real race seems to be that the flags set in the completion
handler are not yet visible on the cpu core running the workqueue. And
because the worker is not rescheduled when aborted, the entry can just
wait forever.
Do you think this could make sense?
> I'm somewhat reluctant to change the order, because TX processing
> might relay on it (we first mark we wait for TX status and
> then mark entry is no longer owned by hardware).
OK, maybe it's just good luck that changing the order solves the rx
problem. Or can memory barriers associated with the spinlock in
rt2x00lib_dmadone() be responsible for that?
(I'm testing on a armv7 system, Cortex-A9 quadcore.)
While looking at it, why we double-clear ENTRY_OWNER_DEVICE_DATA in
rt2x00usb_interrupt_rxdone() directly and in rt2x00lib_dmadone() again,
while not doing the same for tx? Would it make more sense to possibly
set ENTRY_DATA_IO_FAILED before clearing ENTRY_OWNER_DEVICE_DATA in
rt2x00usb_interrupt_rxdone() as for tx?
> However on RX
> side ENTRY_DATA_STATUS_PENDING bit make no sense as we do not
> wait for status. We should remove ENTRY_DATA_STATUS_PENDING on
> RX side and perhaps this also will solve issue you observe.
I agree that removing the unnecessary checks is a good idea in any case.
> Could you please check below patch, if it fixes the problem as well?
At least I could not trigger the problem within transferring 10GB of
data. But maybe the probability for triggering this bug is just lower
because ENTRY_OWNER_DEVICE_DATA is cleared some time before
ENTRY_DATA_STATUS_PENDING is set?
Soeren
>
> Stanislaw
>
> diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
> index b6c1344..731e633 100644
> --- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
> +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
> @@ -360,8 +360,7 @@ static void rt2x00usb_work_rxdone(struct work_struct *work)
> while (!rt2x00queue_empty(rt2x00dev->rx)) {
> entry = rt2x00queue_get_entry(rt2x00dev->rx, Q_INDEX_DONE);
>
> - if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
> - !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
> + if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
> break;
>
> /*
> @@ -413,8 +412,7 @@ static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
> struct queue_entry_priv_usb *entry_priv = entry->priv_data;
> int status;
>
> - if (test_and_set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
> - test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
> + if (test_and_set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
> return false;
>
> rt2x00lib_dmastart(entry);
^ permalink raw reply
* Re: [PATCH] libertas: Fix a double free in if_spi_c2h_data()
From: Dan Carpenter @ 2019-06-26 13:23 UTC (permalink / raw)
To: Dan Williams
Cc: Kalle Valo, Philip Rakity, Lubomir Rintel, kernel-janitors,
linux-wireless, Allison Randal, libertas-dev
In-Reply-To: <be491ab35ba46111a1c90cc12b6d5ff6ea3f57e8.camel@redhat.com>
Yeah. That looks nicer. Could you send it as a proper patch and give
me Reported-by credit?
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] libertas: Fix a double free in if_spi_c2h_data()
From: Dan Williams @ 2019-06-26 13:16 UTC (permalink / raw)
To: Dan Carpenter, Kalle Valo, Philip Rakity
Cc: Lubomir Rintel, kernel-janitors, linux-wireless, Allison Randal,
libertas-dev
In-Reply-To: <20190626100926.GD3242@mwanda>
On Wed, 2019-06-26 at 13:09 +0300, Dan Carpenter wrote:
> The lbs_process_rxed_packet() frees the skb. It didn't originally,
> but
> we fixed it in commit f54930f36311 ("libertas: don't leak skb on
> receive
> error").
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/net/wireless/marvell/libertas/if_spi.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/marvell/libertas/if_spi.c
> b/drivers/net/wireless/marvell/libertas/if_spi.c
> index 27067e79e83f..e38f02d1f2e4 100644
> --- a/drivers/net/wireless/marvell/libertas/if_spi.c
> +++ b/drivers/net/wireless/marvell/libertas/if_spi.c
> @@ -772,7 +772,7 @@ static int if_spi_c2h_data(struct if_spi_card
> *card)
> /* pass the SKB to libertas */
> err = lbs_process_rxed_packet(card->priv, skb);
> if (err)
> - goto free_skb;
> + goto out; /* lbs_process_rxed_packet() frees skb */
>
> /* success */
> goto out;
It can be further simplified (not compile tested yet):
diff --git a/drivers/net/wireless/marvell/libertas/if_spi.c b/drivers/net/wireless/marvell/libertas/if_spi.c
index 27067e79e83fe..072da89c4986f 100644
--- a/drivers/net/wireless/marvell/libertas/if_spi.c
+++ b/drivers/net/wireless/marvell/libertas/if_spi.c
@@ -766,19 +766,15 @@ static int if_spi_c2h_data(struct if_spi_card *card)
/* Read the data from the WLAN module into our skb... */
err = spu_read(card, IF_SPI_DATA_RDWRPORT_REG, data, ALIGN(len, 4));
- if (err)
- goto free_skb;
+ if (err) {
+ dev_kfree_skb(skb);
+ goto out
+ }
/* pass the SKB to libertas */
err = lbs_process_rxed_packet(card->priv, skb);
- if (err)
- goto free_skb;
+ /* lbs_process_rxed_packet() consumes the skb */
- /* success */
- goto out;
-
-free_skb:
- dev_kfree_skb(skb);
out:
if (err)
netdev_err(priv->dev, "%s: err=%d\n", __func__, err);
^ permalink raw reply related
* [PATCH 6/8] staging: wilc1000: remove use of 'src_addr' element in 'wilc_vif' struct
From: Ajay.Kathat @ 2019-06-26 12:41 UTC (permalink / raw)
To: linux-wireless; +Cc: devel, gregkh, Adham.Abozaeid, johannes, Ajay.Kathat
In-Reply-To: <1561552810-8933-1-git-send-email-ajay.kathat@microchip.com>
From: Ajay Singh <ajay.kathat@microchip.com>
Remove use of 'src_addr' element in wilc_vif, as the same information
already copied to net_device->dev_addr.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
---
drivers/staging/wilc1000/wilc_netdev.c | 3 +--
drivers/staging/wilc1000/wilc_wfi_cfgoperations.c | 2 +-
drivers/staging/wilc1000/wilc_wfi_netdevice.h | 1 -
3 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/wilc1000/wilc_netdev.c b/drivers/staging/wilc1000/wilc_netdev.c
index 0af60b2..565e2b5 100644
--- a/drivers/staging/wilc1000/wilc_netdev.c
+++ b/drivers/staging/wilc1000/wilc_netdev.c
@@ -638,8 +638,7 @@ static int wilc_mac_open(struct net_device *ndev)
wilc_get_mac_address(vif, mac_add);
netdev_dbg(ndev, "Mac address: %pM\n", mac_add);
- memcpy(vif->src_addr, mac_add, ETH_ALEN);
- memcpy(ndev->dev_addr, vif->src_addr, ETH_ALEN);
+ ether_addr_copy(ndev->dev_addr, mac_add);
if (!is_valid_ether_addr(ndev->dev_addr)) {
netdev_err(ndev, "Wrong MAC address\n");
diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 1580909..d72fdd3 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1499,7 +1499,7 @@ static int start_ap(struct wiphy *wiphy, struct net_device *dev,
if (ret != 0)
netdev_err(dev, "Error in setting channel\n");
- wilc_wlan_set_bssid(dev, vif->src_addr, WILC_AP_MODE);
+ wilc_wlan_set_bssid(dev, dev->dev_addr, WILC_AP_MODE);
wilc_set_power_mgmt(vif, 0, 0);
return wilc_add_beacon(vif, settings->beacon_interval,
diff --git a/drivers/staging/wilc1000/wilc_wfi_netdevice.h b/drivers/staging/wilc1000/wilc_wfi_netdevice.h
index d5d830d..e28c8de 100644
--- a/drivers/staging/wilc1000/wilc_wfi_netdevice.h
+++ b/drivers/staging/wilc1000/wilc_wfi_netdevice.h
@@ -198,7 +198,6 @@ struct wilc_vif {
struct frame_reg frame_reg[NUM_REG_FRAME];
struct net_device_stats netstats;
struct wilc *wilc;
- u8 src_addr[ETH_ALEN];
u8 bssid[ETH_ALEN];
struct host_if_drv *hif_drv;
struct net_device *ndev;
--
2.7.4
^ permalink raw reply related
* [PATCH 8/8] staging: wilc1000: rename 'host_interface' source and header
From: Ajay.Kathat @ 2019-06-26 12:41 UTC (permalink / raw)
To: linux-wireless; +Cc: devel, gregkh, Adham.Abozaeid, johannes, Ajay.Kathat
In-Reply-To: <1561552810-8933-1-git-send-email-ajay.kathat@microchip.com>
From: Ajay Singh <ajay.kathat@microchip.com>
Rename 'host_interface' source and header file to include the 'wilc_'
prefix in its name.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
---
drivers/staging/wilc1000/Makefile | 2 +-
drivers/staging/wilc1000/{host_interface.c => wilc_hif.c} | 0
drivers/staging/wilc1000/{host_interface.h => wilc_hif.h} | 0
drivers/staging/wilc1000/wilc_wfi_netdevice.h | 2 +-
4 files changed, 2 insertions(+), 2 deletions(-)
rename drivers/staging/wilc1000/{host_interface.c => wilc_hif.c} (100%)
rename drivers/staging/wilc1000/{host_interface.h => wilc_hif.h} (100%)
diff --git a/drivers/staging/wilc1000/Makefile b/drivers/staging/wilc1000/Makefile
index 2ad3fee..a5a8e80 100644
--- a/drivers/staging/wilc1000/Makefile
+++ b/drivers/staging/wilc1000/Makefile
@@ -5,7 +5,7 @@ ccflags-y += -DFIRMWARE_1002=\"atmel/wilc1002_firmware.bin\" \
-DFIRMWARE_1003=\"atmel/wilc1003_firmware.bin\"
wilc1000-objs := wilc_wfi_cfgoperations.o wilc_netdev.o wilc_mon.o \
- host_interface.o wilc_wlan_cfg.o wilc_wlan.o
+ wilc_hif.o wilc_wlan_cfg.o wilc_wlan.o
obj-$(CONFIG_WILC1000_SDIO) += wilc1000-sdio.o
wilc1000-sdio-objs += wilc_sdio.o
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/wilc_hif.c
similarity index 100%
rename from drivers/staging/wilc1000/host_interface.c
rename to drivers/staging/wilc1000/wilc_hif.c
diff --git a/drivers/staging/wilc1000/host_interface.h b/drivers/staging/wilc1000/wilc_hif.h
similarity index 100%
rename from drivers/staging/wilc1000/host_interface.h
rename to drivers/staging/wilc1000/wilc_hif.h
diff --git a/drivers/staging/wilc1000/wilc_wfi_netdevice.h b/drivers/staging/wilc1000/wilc_wfi_netdevice.h
index e28c8de..1e74a08 100644
--- a/drivers/staging/wilc1000/wilc_wfi_netdevice.h
+++ b/drivers/staging/wilc1000/wilc_wfi_netdevice.h
@@ -14,7 +14,7 @@
#include <linux/if_arp.h>
#include <linux/gpio/consumer.h>
-#include "host_interface.h"
+#include "wilc_hif.h"
#include "wilc_wlan.h"
#include "wilc_wlan_cfg.h"
--
2.7.4
^ permalink raw reply related
* [PATCH 4/8] staging: wilc1000: remove use of driver_handler_id & ifc_id
From: Ajay.Kathat @ 2019-06-26 12:40 UTC (permalink / raw)
To: linux-wireless; +Cc: devel, gregkh, Adham.Abozaeid, johannes, Ajay.Kathat
In-Reply-To: <1561552810-8933-1-git-send-email-ajay.kathat@microchip.com>
From: Ajay Singh <ajay.kathat@microchip.com>
Removed the 'driver_handler_id' & 'ifc_id' elements and used 'idx' to
identify the handler.
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
---
drivers/staging/wilc1000/host_interface.c | 3 +--
drivers/staging/wilc1000/host_interface.h | 1 -
drivers/staging/wilc1000/wilc_netdev.c | 3 +--
drivers/staging/wilc1000/wilc_wfi_cfgoperations.c | 5 ++---
drivers/staging/wilc1000/wilc_wfi_netdevice.h | 1 -
5 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index b505990..389f9f8c 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -1472,7 +1472,7 @@ int wilc_set_wfi_drv_handler(struct wilc_vif *vif, int index, u8 mode,
drv.mode = (ifc_id | (mode << 1));
result = wilc_send_config_pkt(vif, WILC_SET_CFG, &wid, 1,
- hif_drv->driver_handler_id);
+ wilc_get_vif_idx(vif));
if (result)
netdev_err(vif->ndev, "Failed to set driver handler\n");
@@ -1644,7 +1644,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
for (i = 0; i < wilc->vif_num; i++)
if (dev == wilc->vif[i]->ndev) {
wilc->vif[i]->hif_drv = hif_drv;
- hif_drv->driver_handler_id = i + 1;
break;
}
diff --git a/drivers/staging/wilc1000/host_interface.h b/drivers/staging/wilc1000/host_interface.h
index 4fcc7a3..be1d249 100644
--- a/drivers/staging/wilc1000/host_interface.h
+++ b/drivers/staging/wilc1000/host_interface.h
@@ -166,7 +166,6 @@ struct host_if_drv {
struct wilc_vif *remain_on_ch_timer_vif;
bool ifc_up;
- int driver_handler_id;
u8 assoc_resp[WILC_MAX_ASSOC_RESP_FRAME_SIZE];
};
diff --git a/drivers/staging/wilc1000/wilc_netdev.c b/drivers/staging/wilc1000/wilc_netdev.c
index 9006111..ad04744 100644
--- a/drivers/staging/wilc1000/wilc_netdev.c
+++ b/drivers/staging/wilc1000/wilc_netdev.c
@@ -636,7 +636,7 @@ static int wilc_mac_open(struct net_device *ndev)
for (i = 0; i < wl->vif_num; i++) {
if (ndev == wl->vif[i]->ndev) {
wilc_set_wfi_drv_handler(vif, wilc_get_vif_idx(vif),
- vif->iftype, vif->ifc_id);
+ vif->iftype, vif->idx);
wilc_set_operation_mode(vif, vif->iftype);
break;
}
@@ -995,7 +995,6 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name,
ndev->needs_free_netdev = true;
vif->iftype = vif_type;
vif->wilc->vif[wl->vif_num] = vif;
- vif->ifc_id = wl->vif_num;
vif->idx = wl->vif_num;
wl->vif_num += 1;
vif->mac_opened = 0;
diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 012e325..1580909 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1462,7 +1462,7 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev,
if (wl->initialized) {
wilc_set_wfi_drv_handler(vif, wilc_get_vif_idx(vif),
- 0, vif->ifc_id);
+ 0, vif->idx);
wilc_set_operation_mode(vif, WILC_AP_MODE);
wilc_set_power_mgmt(vif, 0, 0);
}
@@ -1693,11 +1693,10 @@ static int del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
wl->vif[i] = NULL;
} else {
vif = wl->vif[i + 1];
- vif->ifc_id = i;
vif->idx = i;
wl->vif[i] = vif;
wilc_set_wfi_drv_handler(vif, wilc_get_vif_idx(vif),
- vif->iftype, vif->ifc_id);
+ vif->iftype, vif->idx);
}
}
wl->vif_num--;
diff --git a/drivers/staging/wilc1000/wilc_wfi_netdevice.h b/drivers/staging/wilc1000/wilc_wfi_netdevice.h
index fca3380..d5d830d 100644
--- a/drivers/staging/wilc1000/wilc_wfi_netdevice.h
+++ b/drivers/staging/wilc1000/wilc_wfi_netdevice.h
@@ -203,7 +203,6 @@ struct wilc_vif {
struct host_if_drv *hif_drv;
struct net_device *ndev;
u8 mode;
- u8 ifc_id;
struct timer_list during_ip_timer;
bool obtaining_ip;
struct timer_list periodic_rssi;
--
2.7.4
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox