- 29 Aug, 2021 16 commits
-
-
Zenghui Yu authored
As it had never been used since the initial commit 8369ae33 ("bcma: add Broadcom specific AMBA bus driver"). Signed-off-by:
Zenghui Yu <yuzenghui@huawei.com> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20210727025232.663-3-yuzenghui@huawei.com
-
Zenghui Yu authored
kmemleak reported that dev_name() of internally-handled cores were leaked on driver unbinding. Let's use device_initialize() to take refcounts for them and put_device() to properly free the related stuff. While looking at it, there's another potential issue for those which should be *registered* into driver core. If device_register() failed, we put device once and freed bcma_device structures. In bcma_unregister_cores(), they're treated as unregistered and we hit both UAF and double-free. That smells not good and has also been fixed now. Fixes: ab54bc84 ("bcma: fill core details for every device") Signed-off-by:
-
Kalle Valo authored
Merge commit 'e257d969' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next I think last commits in tag iwlwifi-next-for-kalle-2021-08-26 are not ready yet so I'm skipping those and pulling an earlier commit. I modified Luca's description below to not include the skipped commits. iwlwifi patches for v5.15 * Support scanning hidden 6GHz networks; * Some improvements in the FW error dumps; * Add some HE capability flags * A bunch of janitorial clean-ups; * Clean-ups in the TX code; * Small fix for SMPS; * Support for a new hardware family (Bz); * Small fix in the scan code; * A bunch of changes in the D3 code, including new FW API; * Finalize the refactoring of 6GHz scan; * Initial changes in the SAR profile code; * Fix reading one of our ACPI tables (WTAS); * Support some new ACPI table revisions; * Support new API of the WoWlan status FW notification; * Fixes in SAR ACPI tables handling; * Some debugging improvements; * Fix in ROC; * Support for new FW API versions; * Support new FW command versions; * Some other small fixes, clean-ups and improvements.
-
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo authored
ath.git patches for v5.15. Major changes: wcn36xx * allow firmware name to be overridden by DT
-
David Mosberger-Tang authored
Move static "isinit" variable to wilc_spi structure to allow multiple WILC1000 devices per machine. Signed-off-by:
David Mosberger-Tang <davidm@egauge.net> Signed-off-by:
-
Paweł Drewniak authored
This allows the driver to connect to BSSIDs supporting SAE with 802.11r. Tested on Raspberry Pi 4 Model B (STA) and UniFi 6LR/OpenWRT 21.02.0-rc2. AP was set to 'sae-mixed' (WPA2/3 Personal). Signed-off-by:
Paweł Drewniak <czajernia@gmail.com> Signed-off-by:
-
Linus Walleij authored
The SSB header only uses the legacy <linux/gpio.h> header to get struct gpio_chip so inluce <linux/gpio/driver.h> which is the right include to deal with gpio_chip. Cc: Michael Buesch <m@bues.ch> Cc: Kalle Valo <kvalo@codeaurora.org> Signed-off-by:
Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
Colin Ian King authored
Don't populate the array fsm_state on the stack but instead it static const. Makes the object code smaller by 154 bytes: Before: text data bss dec hex filename 9213 3904 0 13117 333d .../wireless/rsi/rsi_91x_debugfs.o After: text data bss dec hex filename 8995 3968 0 12963 32a3 .../wireless/rsi/rsi_91x_debugfs.o (gcc version 10.3.0) Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Nathan Chancellor authored
Clang warns: drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:901:6: warning: variable 'place' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] if (chnl > 14) { ^~~~~~~~~ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:909:9: note: uninitialized use occurs here return place; ^~~~~ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:901:2: note: remove the 'if' if its condition is always true if (chnl > 14) { ^~~~~~~~~~~~~~~ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:899:10: note: initialize the variable 'place' to silence this warning u8 place; ^ = '\0' 1 warning generated. Commit 369956ae ("rtlwifi: rtl8192de: Remove redundant variable initializations") removed the initialization of place but it appears that this removal was in the wrong function. _rtl92c_phy_get_rightchnlplace() returns place's value at the end of the function so now if the if statement is false, place never gets initialized. Add that initialization back to address the warning. place's initialization is not necessary in rtl92d_get_rightchnlplace_for_iqk() as place is only used within the if statement so it can be removed, which is likely what was intended in the first place. Fixes: 369956ae ("rtlwifi: rtl8192de: Remove redundant variable initializations") Signed-off-by:Nathan Chancellor <nathan@kernel.org> Acked-by:
Ping-Ke Shih <pkshih@realtek.com> Reviewed-by:
Kees Cook <keescook@chromium.org> Signed-off-by:
-
Ugo Rémery authored
8821CE causes random freezes on HP Pavilion 14-ce0019nf. Add a quirk to disable pci ASPM capability. Signed-off-by:
Ugo Rémery <ugo.remery@gmail.com> Signed-off-by:
Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:
-
Dan Carpenter authored
This error path is unlikely because of it checked for NULL and returned -ENOMEM earlier in the function. But it should return an error code here as well if we ever do hit it because of a race condition or something. Fixes: bdcd8170 ("Add ath6kl cleaned up driver") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Miaoqing Pan authored
The problem is that gpio_free() can sleep and the cfg_soc() can be called with spinlocks held. One problematic call tree is: --> ath_reset_internal() takes &sc->sc_pcu_lock spin lock --> ath9k_hw_reset() --> ath9k_hw_gpio_request_in() --> ath9k_hw_gpio_request() --> ath9k_hw_gpio_cfg_soc() Remove gpio_free(), use error message instead, so we should make sure there is no GPIO conflict. Also remove ath9k_hw_gpio_free() from ath9k_hw_apply_gpio_override(), as gpio_mask will never be set for SOC chips. Signed-off-by:Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by:
-
Zekun Shen authored
Bad header can have large length field which can cause OOB. cptr is the last bytes for read, and the eeprom is parsed from high to low address. The OOB, triggered by the condition length > cptr could cause memory error with a read on negative index. There are some sanity check around length, but it is not compared with cptr (the remaining bytes). Here, the corrupted/bad EEPROM can cause panic. I was able to reproduce the crash, but I cannot find the log and the reproducer now. After I applied the patch, the bug is no longer reproducible. Signed-off-by:
Zekun Shen <bruceshenzk@gmail.com> Signed-off-by:
-
Loic Poulain authored
When receiving a beacon or probe response, we should update the boottime_ns field which is the timestamp the frame was received at. (cf mac80211.h) This fixes a scanning issue with Android since it relies on this timestamp to determine when the AP has been seen for the last time (via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter). Signed-off-by:
Loic Poulain <loic.poulain@linaro.org> Reviewed-by:
Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by:
-
Bjorn Andersson authored
The WLAN NV firmware blob differs between platforms, and possibly devices, so add support in the wcn36xx driver for reading the path of this file from DT in order to allow these files to live in a generic file system (or linux-firmware). For some reason the parent (wcnss_ctrl) also needs to upload this blob, so rather than specifying the same information in both nodes wcn36xx reads the string from the parent's of_node. Signed-off-by:
Bjorn Andersson <bjorn.andersson@linaro.org> Tested-by:
Aníbal Limón <anibal.limon@linaro.org> Signed-off-by:
-
Joseph Gates authored
If the operating channel is the first in the scan list, it was seen that a finish scan request would be sent before a start scan request was sent, causing the firmware to fail all future scans. Track the current channel being scanned to avoid requesting the scan finish before it starts. Cc: <stable@vger.kernel.org> Fixes: 5973a294 ("wcn36xx: Fix software-driven scan") Signed-off-by:
Joseph Gates <jgates@squareup.com> Signed-off-by:
-
- 26 Aug, 2021 24 commits
-
-
Johannes Berg authored
To check beacon protection had a mismatch of the key ID we currently use the key ID from the firmware, but firmware side we want to clean up the API to stop reporting this. Instead, check the IWL_RX_MPDU_STATUS_KEY_VALID bit that indicates that the firmware used the correct key, and if that's set but we get invalid MIC/replay use the key ID from the frame to look up the key and notify mac80211 of MIC error or replay. Since both keys must have the same cipher and thus MIC length, we can use either of them to look up the MIC length. Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Signed-off-by:
Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20210826224715.30e665d39b07.I78bf7d304ef5a80cecf5fa1c1fca0b51b956cceb@changeidSigned-off-by:
-
Ilan Peer authored
The iwl_mvm_scan_ch_n_aps_flag() is called with a variable before the value of the variable is set. Fix it. Signed-off-by:
Ilan Peer <ilan.peer@intel.com> Signed-off-by:
-
Shaul Triebitz authored
Tell the firmware about broadcast TWT support even if individual TWT is not supported. In that case the firmware will negotiate only a broadcast TWT session. Signed-off-by:
Shaul Triebitz <shaul.triebitz@intel.com> Signed-off-by:
-
Gregory Greenman authored
The new version sends station id in the notification. It's still not used, but need to adjust the code since the offset of the data was changed. Signed-off-by:
Gregory Greenman <gregory.greenman@intel.com> Signed-off-by:
-
Dror Moshe authored
Move code that generates the pnvm file name to a separate function, so that it can be reused. Signed-off-by:
Dror Moshe <drorx.moshe@intel.com> Signed-off-by:
-
Avraham Stern authored
This version adds the following configuration options: 1. Enable/disable setting the session id in the FTM frame 2. Set the BSS color for the responder 3. Set the minimum and maximum time between measurements for non trigger based NDP ranging. Signed-off-by:
Avraham Stern <avraham.stern@intel.com> Signed-off-by:
-
Avraham Stern authored
This version adds the following configuration options: 1. Set the BSS color for NDP ranging 2. Set the minimum and maximum time between measurements for non trigger based NDP ranging. 3. Terminate the session in case the responder requests LMR feedback. Signed-off-by:
-
Johannes Berg authored
We can send this even if initializing in RF-kill, thus suppressing a bunch of error messages about it. In fact, we _want_ to, since we might still want to debug the firmware even if in RF-kill. Signed-off-by:
-
Avraham Stern authored
When P2P roc is removed, the IWL_MVM_STATUS_NEED_FLUSH_P2P bit is set to indicate to iwl_mvm_roc_done_wk() that the removed roc is a P2P one, so it will flush the broadcast station and not the aux station. However, since setting this bit and scheduling the worker is done in roc ended flow as well as in case the roc is removed, there is a race where the worker has already started running (but did not test this bit yet) and then it is scheduled again. In this case, the first run of the worker will clear this bit, and thus the second run will find it already cleared and will try to flush and remove the aux station by mistake. Fix it by scheduling the worker only if this bit is not yet set. In case this bit is already set, the worker is either running or scheduled, so there is no need to re-schedule it. Signed-off-by:
-
Mukesh Sisodiya authored
new region handling is added for dump collection. Signed-off-by:
Mukesh Sisodiya <mukesh.sisodiya@intel.com> Signed-off-by:
-
Shaul Triebitz authored
'Rx control frame to MBSSID' is supported by HW and FW. Add the capability to the HE mac capabilities. Signed-off-by:
-
Johannes Berg authored
The debug dump ranges aren't just an array of such ranges since each range has a variable size. Therefore, the use of a struct array is misleading at best. Change it to be a u8 data[] instead of the struct array, the code doesn't significantly change since it's actually doing things correctly now. Signed-off-by:
-
Johannes Berg authored
We don't use this, but we embed this struct elsewhere and having structs with flexible arrays embedded isn't quite right, with sparse (for example) complaining. Remove the data[] member in this case. Signed-off-by:
-
Johannes Berg authored
Sparse warns about some type mismatches, which really is just because of the strangely placed __percpu annotation. Put it into the correct place. Signed-off-by:
-
Johannes Berg authored
DMA-API debug code pointed out that in this code path we never check the return value of dma_map_page(), which could fail. However, we don't really even want to unmap/remap, we just want to ensure that we can actually access the last version of the data that the (now-dead) device may have written, so only need to dma_sync_single_for_cpu() instead. Signed-off-by:
-
Luca Coelho authored
If the tables we get in the iwl_sar_set_profile() is smaller than the revision we support, we need to fill the values with 0. Make sure that's the case. Signed-off-by:
-
Luca Coelho authored
The tables we store are the larger of all the revisions, so we need to fill in the values that we don't get from ACPI when using older revisions. Signed-off-by:
-
Luca Coelho authored
Start supporting API version 65 for AX devices. Signed-off-by:
-
Luca Coelho authored
Revisions 0 and 1 are identical, so we were already supporting that. But revision 2 has a different size, so we have to try to read them separately. Add support for this new revision. Signed-off-by:
-
Miri Korenblit authored
We used to load the regdomain only in the load stage, this caused the 'iw phy phy0 reg get' command to fail if we booted a machine with wifi off. Therefor we should load it in INIT stage already. Signed-off-by:
Miri Korenblit <miriam.rachel.korenblit@intel.com> Signed-off-by:
-
Miri Korenblit authored
We used to read the PPAG, WRDS, EWRD, WGDS tables from ACPI in the load stage only. This prevented vendor commands from being executed before bringing the interface up. Move reading those tables to INIT stage. Signed-off-by:
-
Shaul Triebitz authored
If the session protection ends but no beacon was heard, the driver triggers a disconnection. Trigger WRT in that case so it can be debugged. Signed-off-by:
-
Johannes Berg authored
In commit 79f033f6 ("iwlwifi: dbg: don't limit dump decisions to all or monitor") we changed the code to pass around a bitmap, but in the monitor_only case, one place accidentally used the bit number, not the bit mask, resulting in CSR and FW_INFO getting dumped instead of monitor data. Fix that. Signed-off-by:
-
Abhishek Naik authored
By mistake we were considering the first element of the WTAS wifi package as part of the data we want to rid, but that element is the wifi package signature (always 0x07), so it should be skipped. Change the code to read the data starting from element 1 instead. Signed-off-by:
Abhishek Naik <abhishek.naik@intel.com> Fixes: 28dd7ccd ("iwlwifi: acpi: read TAS table from ACPI and send it to the FW") Signed-off-by:
-
