- 24 Nov, 2020 35 commits
-
-
Jia-Ju Bai authored
In rtl92de_tx_fill_cmddesc(), skb->data is mapped to streaming DMA on line 667: dma_addr_t mapping = dma_map_single(..., skb->data, ...); On line 669, skb->data is assigned to hdr after cast: struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)(skb->data); Then hdr->frame_control is accessed on line 670: __le16 fc = hdr->frame_control; This DMA access may cause data inconsistency between CPU and hardwre. To fix this bug, hdr->frame_control is accessed before the DMA mapping. Signed-off-by:
Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20201119015205.12162-1-baijiaju1990@gmail.com
-
Jia-Ju Bai authored
In rtl92ce_tx_fill_cmddesc(), skb->data is mapped to streaming DMA on line 530: dma_addr_t mapping = dma_map_single(..., skb->data, ...); On line 533, skb->data is assigned to hdr after cast: struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)(skb->data); Then hdr->frame_control is accessed on line 534: __le16 fc = hdr->frame_control; This DMA access may cause data inconsistency between CPU and hardwre. To fix this bug, hdr->frame_control is accessed before the DMA mapping. Signed-off-by:
-
Jia-Ju Bai authored
In rtl88ee_tx_fill_cmddesc(), skb->data is mapped to streaming DMA on line 677: dma_addr_t mapping = dma_map_single(..., skb->data, ...); On line 680, skb->data is assigned to hdr after cast: struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)(skb->data); Then hdr->frame_control is accessed on line 681: __le16 fc = hdr->frame_control; This DMA access may cause data inconsistency between CPU and hardwre. To fix this bug, hdr->frame_control is accessed before the DMA mapping. Signed-off-by:
-
Gustavo A. R. Silva authored
In preparation to enable -Wimplicit-fallthrough for Clang, fix multiple warnings by explicitly adding multiple break statements instead of letting the code fall through to the next case. Link: https://github.com/KSPP/linux/issues/115Signed-off-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by:
-
Zhang Changzhong authored
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 17ff2c79 ("rsi: reset device changes for 9116") Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
Zhang Changzhong <zhangchangzhong@huawei.com> Signed-off-by:
-
Dmitry Safonov authored
bindex can be out of BA window (64): tid 0 seq 2983, start_seq 2915, bindex 68, index 39 tid 0 seq 2984, start_seq 2915, bindex 69, index 40 tid 0 seq 2985, start_seq 2915, bindex 70, index 41 tid 0 seq 2986, start_seq 2915, bindex 71, index 42 tid 0 seq 2879, start_seq 2915, bindex 4060, index 63 tid 0 seq 2854, start_seq 2915, bindex 4035, index 38 tid 0 seq 2795, start_seq 2915, bindex 3976, index 43 tid 0 seq 2989, start_seq 2924, bindex 65, index 45 tid 0 seq 2992, start_seq 2924, bindex 68, index 48 tid 0 seq 2993, start_seq 2924, bindex 69, index 49 tid 0 seq 2994, start_seq 2924, bindex 70, index 50 tid 0 seq 2997, start_seq 2924, bindex 73, index 53 tid 0 seq 2795, start_seq 2941, bindex 3950, index 43 tid 0 seq 2921, start_seq 2941, bindex 4076, index 41 tid 0 seq 2929, start_seq 2941, bindex 4084, index 49 tid 0 seq 3011, start_seq 2946, bindex 65, index 3 tid 0 seq 3012, start_seq 2946, bindex 66, index 4 tid 0 seq 3013, start_seq 2946, bindex 67, index 5 In result isset() will try to dereference something on the stack, causing panics: BUG: unable to handle page fault for address: ffffa742800ed01f #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 6a4e9067 P4D 6a4e9067 PUD 6a4ec067 PMD 6a4ed067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Not tainted 5.8.5-arch1-1-kdump #1 Hardware name: Apple Inc. MacBookAir3,1/Mac-942452F5819B1C1B, BIOS MBA31.88Z.0061.B07.1201241641 01/24/12 RIP: 0010:brcms_c_ampdu_dotxstatus+0x343/0x9f0 [brcmsmac] Code: 54 24 20 66 81 e2 ff 0f 41 83 e4 07 89 d1 0f b7 d2 66 c1 e9 03 0f b7 c9 4c 8d 5c 0c 48 49 8b 4d 10 48 8b 79 68 41 57 44 89 e1 <41> 0f b6 33 41 d3 e0 48 c7 c1 38 e0 ea c0 48 83 c7 10 44 21 c6 4c RSP: 0018:ffffa742800ecdd0 EFLAGS: 00010207 RAX: 0000000000000019 RBX: 000000000000000b RCX: 0000000000000006 RDX: 0000000000000ffe RSI: 0000000000000004 RDI: ffff8fc6ad776800 RBP: ffff8fc6855acb00 R08: 0000000000000001 R09: 00000000000005d9 R10: 00000000fffffffe R11: ffffa742800ed01f R12: 0000000000000006 R13: ffff8fc68d75a000 R14: 00000000000005db R15: 0000000000000019 FS: 0000000000000000(0000) GS:ffff8fc6aad00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa742800ed01f CR3: 000000002480a000 CR4: 00000000000406e0 Call Trace: <IRQ> brcms_c_dpc+0xb46/0x1020 [brcmsmac] ? wlc_intstatus+0xc8/0x180 [brcmsmac] ? __raise_softirq_irqoff+0x1a/0x80 brcms_dpc+0x37/0xd0 [brcmsmac] tasklet_action_common.constprop.0+0x51/0xb0 __do_softirq+0xff/0x340 ? handle_level_irq+0x1a0/0x1a0 asm_call_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x5f/0x80 irq_exit_rcu+0xcb/0x120 common_interrupt+0xd1/0x200 asm_common_interrupt+0x1e/0x40 RIP: 0010:cpuidle_enter_state+0xb3/0x420 Check if the block is within BA window and only then check block's status. Otherwise as Behan wrote: "When I came back to Dublin I was courtmartialed in my absence and sentenced to death in my absence, so I said they could shoot me in my absence." Also reported: https://bbs.archlinux.org/viewtopic.php?id=258428 https://lore.kernel.org/linux-wireless/87tuwgi92n.fsf@yujinakao.com/Reported-by:
Yuji Nakao <contact@yujinakao.com> Signed-off-by:
Dmitry Safonov <dima@arista.com> Signed-off-by:
-
Remi Depommier authored
The left-hand side of the assignment from cpu_to_le32() should be of type __le32. This commit clears the warning reported by sparse when building with C=1 CF="-D__CHECK_ENDIAN__". Fixes: d56fd83c ("brcmfmac: fix SDIO access for big-endian host") Reported-by:
kernel test robot <lkp@intel.com> Signed-off-by:
Remi Depommier <rde@setrix.com> Signed-off-by:
-
Wang Hai authored
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: b7da53cd ("qtnfmac_pcie: use single PCIe driver for all platforms") Reported-by:
Wang Hai <wanghai38@huawei.com> Signed-off-by:
-
Kaixu Xia authored
The variable u4tmp is overwritten by the following call and the assignment is useless, so remove it. Reported-by:
Tosk Robot <tencent_os_robot@tencent.com> Signed-off-by:
Kaixu Xia <kaixuxia@tencent.com> Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_read_ltv() is always invoked via the ->read_ltv() callback. This callback is mostly invoked under orinoco_lock() which disables BH. There are a few invocations during probe which occur in preemptible context via: ezusb_probe() -> orinoco_init() -> determine_fw_capabilities() Extend `hermes_ops' with the ->read_ltv_pr callback which is implemented with the same callback like ->read_ltv on `hermes_ops_local'. On `ezusb_ops' ->read_ltv is used for callbacks under the lock which need to poll. The new ->read_ltv_pr() is used in the preemptible context in which it is possible to wait for the completion. Provide HERMES_READ_RECORD_PR() and hermes_read_wordrec_pr() which behave like their non _pr equivalents and invoke ->read_ltv_pr(). This removes the last user of ezusb_req_ctx_wait() and can now be removed. Signed-off-by:
Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by:
-
Sebastian Andrzej Siewior authored
All invocations of ezusb_docmd_wait() happen via ->cmd_wait(). This callback is always invoked under the orinoco_lock() which disables BH. Use ezusb_req_ctx_wait_poll() for ezusb_docmd_wait() because it must not sleep. Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_doicmd_wait() is invoked via ->init_cmd_wait() callback. This callback is only invoked hermesi_program_init() and hermesi_program_end() which are the ->program_init() and ->program_end() callbacks as assigned by `hermes_ops_local'. They are never used by the USB interface since the USB interface provides its own set of callbacks by `ezusb_ops'. Replace ezusb_doicmd_wait() with a warning in case I missed the obvious. Signed-off-by:
-
Sebastian Andrzej Siewior authored
All invocation of ezusb_write_ltv() happen via ->write_ltv() and are performed under the orinoco_lock() which disables BH. Use ezusb_req_ctx_wait_poll() for ezusb_write_ltv() because it must not sleep. Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_read_pda() is invoked via ->read_pda() while firmware is loaded in preemtible context. Use ezusb_req_ctx_wait_compl() in ezusb_read_pda(). Signed-off-by:
-
Sebastian Andrzej Siewior authored
The ezusb_program() is invoked via ->program() in preemptible context during firmware loading. This is also true for the ->program_init() and ->program_end() callback. Use ezusb_req_ctx_wait_compl() in ezusb_program_init(), ezusb_program_bytes(), ezusb_program_end() which are part of firmware loading during device probe. Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_init() is always invoked in preemptible context during device probe. Only orinoco_up() -> orinoco_reinit_firmware() may invoke the function from atomic context but this is never used for the USB interface. Use ezusb_req_ctx_wait_compl() for the ezusb_write_ltv() and ezusb_docmd_wait() invocations from within ezusb_init(). Preserve the generic versions which have still other user via the callback. Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_xmit() sets ->in_rid in its request which means it does not wait for an answer. Use the ezusb_req_ctx_wait_skip() to denote that an answer is not expected. Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_access_ltv() sends the prepared request to the USB device. Requests which have ->in_rid set expect an answer from the USB device and the function has to wait until the URB with the answer arrives. The function uses in_interrupt() to determine if it can simply sleep on the completion and be woken up once the answer arrives or if it needs to poll on the completion. The usage of in_interrupt() in drivers is phased out and Linus clearly requested that code which changes behaviour depending on context should either be separated or the context be conveyed in an argument passed by the caller, which usually knows the context. Aside of that in_interrupt() is not correct as it does not catch preempt disabled regions in which sleeping is also not allowed. Provide stubs which can be used as a replacement. The current default is the current behaviour which sleeps/polls depending on in_interrupt(). The goal is to audit all callers and use either the poll or sleep version. Signed-off-by:
-
Sebastian Andrzej Siewior authored
ezusb_xmit() allocates a context which is leaked if orinoco_process_xmit_skb() returns an error. Move ezusb_alloc_ctx() after the invocation of orinoco_process_xmit_skb() because the context is not needed so early. ezusb_access_ltv() will cleanup the context in case of an error. Fixes: bac6fafd ("orinoco: refactor xmit path") Signed-off-by:
-
Zhang Changzhong authored
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 3b1e0a7b ("brcmfmac: add support for SAE authentication offload") Reported-by:
Chi-hsien Lin <chi-hsien.lin@infineon.com> Signed-off-by:
-
Yejune Deng authored
a set of atomic_inc() looks more readable Signed-off-by:
Yejune Deng <yejune.deng@gmail.com> Signed-off-by:
-
Brian Norris authored
It's much easier to spot what went wrong when you print out the unhandled key type. Signed-off-by:
Brian Norris <briannorris@chromium.org> Signed-off-by:
-
Ching-Te Ku authored
Fix sometimes FW information will be parsed as wrong value, do a correction of sign bit to show the correct information. (Ex, Value should be 20, but it shows 236.) Signed-off-by:
Ching-Te Ku <ku920601@realtek.com> Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
-
Ching-Te Ku authored
Remove extend 5 ms related operation at WLAN media status notify. The mechanism should be enable only while DUT connect to a AP that it doesn't follow our power save control or its rate is decreasing unusually sensitive. So we extend a extra slot to save the transmission rate. The original logic will always extend WLAN slot. It will lead to BT slot always decrease 5 ms. Remove write scoreboard action at WLAN media status notify. It has already done in WLAN info notify. Signed-off-by:
-
Ching-Te Ku authored
Remove some action which were writing scan bit to scoreboard, since these behaviors are redundant. It is already done in WLAN info notify. Signed-off-by:
-
Ching-Te Ku authored
Force set the coexistence to BT high priority during WLAN initial/power-on step. Since the duration the related setting may be not ready yet. The score board is not related to scan when initialing, remove the scan parameter. Signed-off-by:
-
Ching-Te Ku authored
While the mechanism goes to 2G_free_run or WL5G_BT2G, set BT to hardware PTA mode to get a more efficiently performance. Add a flag to indicate antenna switch is supported or not so that the IC serials which has different antenna structure can set antenna correctly. Signed-off-by:
-
Ching-Te Ku authored
The updated parameter and original parameter all means TDMA-OFF. The original setting write 0x8 to firmware, but it only works for some old IC series. To avoid the confusing, update a proper parameter. Signed-off-by:
-
Ching-Te Ku authored
Add the related coexistence mechanism about RF4CE and WLAN connected flag to decide control packet is whether higher or normal priority. Signed-off-by:
-
Ching-Te Ku authored
Because sometimes hardware action may be unpredictable. (Ex: after WLAN LPS...etc) Add a check mechanism if the action is triggered by some concerned case, it can force to write the table again. Signed-off-by:
-
Ching-Te Ku authored
When WLAN in critical procedure, such as connecting, scan and so on, coexistence will notify BT by scoreboard. While BT firmware received the scoreboard interrupt, it will adjust BT page priority lower to avoid WLAN critical procedure suffering impact. Signed-off-by:
-
Ching-Te Ku authored
Because the WLAN RSSI report feature had been implemented at WLAN link info update function, it is redundant to update WLAN RSSI while BT is updating link info, so remove the update WLAN RSSI part. Signed-off-by:
-
Ching-Te Ku authored
Add considering for different WLAN beacon interval in coexistence mechanism. Because the WLAN beacon period may be not 100 ms, so it's necessary to consider any beacon period and set timer according to the interval. Signed-off-by:
-
Ping-Ke Shih authored
In order to help debugging in field, we add some log messages. Signed-off-by:
-
Ping-Ke Shih authored
CCK PD can reduce the number of false alarm of the CCK rates. It dynamically adjusts the power threshold and CS ratio. The values are compared to the values of the previous level, if the level is changed, set new values of power threshold and CS ratio. Implement rtw_chip_ops::cck_pd_set() for 8723d. Signed-off-by:
-
- 10 Nov, 2020 5 commits
-
-
Ching-Te Ku authored
Life time related setting is related to WLAN active port number, not its mode. The original setting may cause poor WLAN performance. In most case, WLAN TX limitation is helpful for BT in coexistence scenario, especially for A2DP quality. So this is necessary to fix the setting and constraint it. Signed-off-by:
-
Ching-Te Ku authored
Since coexistence issue is related to WL/BT and each digital/analog/rf, and these issues are often critical with low failure rate, add more debugging information is helpful to clarify issues. Signed-off-by:
-
Ching-Te Ku authored
Adaptive Frequency Hopping(AFH) is a method of transmitting radio signals by rapidly changing the carrier frequency among many distinct frequencies, which can avoid interference. Add this feature to update AFH parameter for 8822b. Signed-off-by:
-
Ching-Te Ku authored
The original mechanism may cause A2DP glitch during WiFi connecting AP. Because the original TDMA may decrease too much A2DP slot. This patch add a timer and variable to let the case A2DP + WL_Connecting performed more well. Signed-off-by:
-
Ching-Te Ku authored
Add counter to count BT info C2H command for debug usage. It could present the C2H channel situation. Fix BT IQK state decision condition for counting. The original condition is wrong, it would cause coexistence mechanism going to the wrong strategy. New format supports getting TDMA parameter from WL firmware, since coexistence needs current TDMA parameter to decide strategy. Remove unnecessary operations about scoreboard, it is not a must for current version. Signed-off-by:
-
