Commit graph

23657 commits

Author SHA1 Message Date
Amitkumar Karwar
c94897e820 mwifiex: fix corner case association failure
commit a6139b6271f9f95377fe3486aed6120c9142779b upstream.

This patch corrects the error case in association path by returning
-1. Earlier "media_connected" used to remain on in this error case
causing failure for further association attempts.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Fixes: b887664d88 ('mwifiex: channel switch handling for station')
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-11 11:21:10 +02:00
Matti Gottlieb
72b847aa95 iwlwifi: mvm: fix memory leak in paging
commit 7fdf9663261cc77a516396fec82cee8a8ea07e76 upstream.

Currently paging download buffer is freed during the
the unloading of the opmode which happens when the driver
is unloaded.

This causes a memory leak since the paging download
buffer is allocated every time we enable the
interface, so the download buffer can be allocated many
times, but only be freed once.

Free paging download buffer during disabling of the
interface.

Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-04 14:48:44 -07:00
Emmanuel Grumbach
0dec867402 iwlwifi: pcie: lower the debug level for RSA semaphore access
commit 9fc515bc9e735c10cd327f05c20f5ef69474188d upstream.

IWL_INFO is not an error but still printed by default.
"can't access the RSA semaphore it is write protected" seems
worrisome but it is not really a problem.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-04 14:48:44 -07:00
Arnd Bergmann
a317579bb6 ath9k: fix buffer overrun for ar9287
[ Upstream commit 83d6f1f15f8cce844b0a131cbc63e444620e48b5 ]

Code that was added back in 2.6.38 has an obvious overflow
when accessing a static array, and at the time it was added
only a code comment was put in front of it as a reminder
to have it reviewed properly.

This has not happened, but gcc-6 now points to the specific
overflow:

drivers/net/wireless/ath/ath9k/eeprom.c: In function 'ath9k_hw_get_gain_boundaries_pdadcs':
drivers/net/wireless/ath/ath9k/eeprom.c:483:44: error: array subscript is above array bounds [-Werror=array-bounds]
     maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
                   ~~~~~~~~~~~~~~~~~~~~~~~~~^~~

It turns out that the correct array length exists in the local
'intercepts' variable of this function, so we can just use that
instead of hardcoding '4', so this patch changes all three
instances to use that variable. The other two instances were
already correct, but it's more consistent this way.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 940cd2c12e ("ath9k_hw: merge the ar9287 version of ath9k_hw_get_gain_boundaries_pdadcs")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-20 15:42:03 +09:00
Matti Gottlieb
0ae6554c2b iwlwifi: mvm: Fix paging memory leak
commit 905e36ae172c83a30894a3adefab7d4f850fcf54 upstream.

If the opmode is stopped and started again we did not free
the paging buffers. Fix that.
In addition when freeing the firmware's paging download
buffer, set the pointer to NULL.

Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-12 09:08:58 -07:00
Liad Kaufman
8c904a4498 iwlwifi: mvm: inc pending frames counter also when txing non-sta
commit fb896c44f88a75843a072cd6961b1615732f7811 upstream.

Until this patch, when TXing non-sta the pending_frames counter
wasn't increased, but it WAS decreased in
iwl_mvm_rx_tx_cmd_single(), what makes it negative in certain
conditions. This in turn caused much trouble when we need to
remove the station since we won't be waiting forever until
pending_frames gets 0. In certain cases, we were exhausting
the station table even in BSS mode, because we had a lot of
stale stations.

Increase the counter also in iwl_mvm_tx_skb_non_sta() after a
successful TX to avoid this outcome.

Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-16 08:42:59 -07:00
Luca Coelho
74e5797640 iwlwifi: mvm: don't allow sched scans without matches to be started
commit 5e56276e7555b34550d51459a801ff75eca8b907 upstream.

The firmware can perform a scheduled scan with not matchsets passed,
but it can't send notification that results were found.  Since the
userspace then cannot know when we got new results and the firmware
wouldn't trigger a wake in case we are sleeping, it's better not to
allow scans without matchsets.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=110831

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:32 -08:00
Oren Givon
3beb469074 iwlwifi: update and fix 7265 series PCI IDs
commit 006bda75d81fd27a583a3b310e9444fea2aa6ef2 upstream.

Update and fix some 7265 PCI IDs entries.

Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:32 -08:00
Emmanuel Grumbach
8a55831546 iwlwifi: pcie: properly configure the debug buffer size for 8000
commit 62d7476d958ce06d7a10b02bdb30006870286fe2 upstream.

8000 device family has a new debug engine that needs to be
configured differently than 7000's.
The debug engine's DMA works in chunks of memory and the
size of the buffer really means the start of the last
chunk. Since one chunk is 256-byte long, we should
configure the device to write to buffer_size - 256.
This fixes a situation were the device would write to
memory it is not allowed to access.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:32 -08:00
Emmanuel Grumbach
d19573e849 iwlwifi: dvm: fix WoWLAN
commit a1cdb1c59c8c203de2731fc6910598ed19c97e41 upstream.

My commit below introduced a mutex in the transport to
prevent concurrent operations. To do so, it added a flag
(is_down) to make sure the transport is in the right state.
This uncoverred an bug that didn't cause any harm until
now: iwldvm calls stop_device and then starts the firmware
without calling start_hw in between. While this flow is
fine from the device configuration point of view (register,
etc...), it is now forbidden by the new is_down flag.
This led to this error to appear:
iwlwifi 0000:05:00.0: Can't start_fw since the HW hasn't been started
and the suspend would fail.

This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=109591

Reported-by: Bogdan Bogush <bogdan.s.bogush@gmail.com>
Fixes=fa9f3281cbb1 ("iwlwifi: pcie: lock start_hw / start_fw / stop_device")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:32 -08:00
Larry Finger
f037c35161 rtlwifi: rtl8723be: Fix module parameter initialization
commit 7079604ddb83f428359feace3aeaf8a9f435be4a upstream.

This driver has a number of errors in the module initialization. These
include the following:

Parameter msi_support is stored in two places - one is removed.
Paramters sw_crypto and disable_watchdog were never stored in the final
locations, nor were they initialized properly.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
e1b08009fb rtlwifi: rtl8188ee: Fix module parameter initialization
commit 06f34572c6110e2e2d5e653a957f1d74db9e3f2b upstream.

In this driver, parameters disable_watchdog and sw_crypto are never
copied into the locations used in the main code. While modifying the
parameter handling, the copying of parameter msi_support is moved to
be with the rest.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
da5c2c01da rtlwifi: rtl8192se: Fix module parameter initialization
commit 7503efbd82c15c4070adffff1344e5169d3634b4 upstream.

Two of the module parameter descriptions show incorrect default values.
In addition the value for software encryption is not transferred to
the locations used by the driver.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
626f652ac5 rtlwifi: rtl8723ae: Fix initialization of module parameters
commit 793b09994211fbe0b5cd5f7b6dd8cc9b6256c3c6 upstream.

This driver has some errors in the handling of module parameters. These
include missing initialization for parameters msi_support and
disable_watchdog. In addition, neither of these parameters nor sw_crypto
are transferred into the locations used by the driver. A final fix is
adding parameter msi to the module named and description macros.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
b7e9aec7b4 rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
commit d4d60b4caaa5926e1b243070770968f05656107a upstream.

Two of the module parameters are listed with incorrect default values.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
8c2265e9fa rtlwifi: rtl8192ce: Fix handling of module parameters
commit b24f19f16b9e43f54218c07609b783ea8625406a upstream.

The module parameter for software encryption was never transferred to
the location used by the driver.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
766e210921 rtlwifi: rtl8192cu: Add missing parameter setup
commit b68d0ae7e58624c33f2eddab471fee55db27dbf9 upstream.

This driver fails to copy the module parameter for software encryption
to the locations used by the main code.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:13 -08:00
Larry Finger
78899f827e rtlwifi: rtl_pci: Fix kernel panic
commit f99551a2d39dc26ea03dc6761be11ac913eb2d57 upstream.

In commit 38506ecefa (rtlwifi: rtl_pci: Start modification for new
drivers), a bug was introduced that causes a NULL pointer dereference.
As this bug only affects the infrequently used RTL8192EE and only under
low-memory conditions, it has taken a long time for the bug to show up.

The bug was reported on the linux-wireless mailing list and also at
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/ as
bug #1527603 (kernel crashes due to rtl8192ee driver on ubuntu 15.10).

Fixes: 38506ecefa ("rtlwifi: rtl_pci: Start modification for new drivers")
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-03-03 15:07:12 -08:00
Larry Finger
724f135b75 rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded
commit c72fc9093718a3f8597249863a1bac345ba00859 upstream.

Recently, it has been reported that D-Link DWA-582 cards, which use an
RTL8812AE chip are not able to scan for 5G networks. The problems started
with kernel 4.2, which is the first version that had commit d10101a603
("rtlwifi: rtl8821ae: Fix problem with regulatory information"). With this
patch, the driver went from setting a default channel plan to using
the value derived from EEPROM.

Bug reports at https://bugzilla.kernel.org/show_bug.cgi?id=111031 and
https://bugzilla.redhat.com/show_bug.cgi?id=1279653 are examples of this
problem.

The problem was solved once I learned that the internal country code was
resulting in a regulatory set with only 2.4 GHz channels. With the RTL8821AE
chips available to me, the country code was such that both 2.4 and 5 GHz
channels are allowed. The fix is to allow both bands even when the EEPROM
is incorrectly encoded.

Fixes: d10101a603 ("rtlwifi: rtl8821ae: Fix problem with regulatory information")
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: littlesmartguy@gmail.com
Cc: gabe@codehaus.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-17 12:31:05 -08:00
Larry Finger
7d4bf40d4e rtlwifi: rtl8821ae: Fix errors in parameter initialization
commit 78bae1de422a7f6f2b4b61f6a5c379e3d7f96f44 upstream.

This driver failed to copy parameters sw_crypto and disable_watchdog into
the locations actually used by the driver. In addition, msi_support was
initialized three times and one of them used the wrong variable. The
initialization of parameter int_clear was moved so that it is near that
of the rest of the parameters.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-17 12:31:05 -08:00
Uri Mashiach
c13c92acfa wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [<00000000>]    lr : [<bf2581f0>]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
[<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [<c04387ec>] (request_firmware_work_func) from
[<c0058e2c>] (process_one_work+0x1b4/0x4b4)
[   23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
(worker_thread+0x3c/0x4a4)
[   23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
(kthread+0xd4/0xf0)
[   23.711747] [<c005ee68>] (kthread) from [<c000f598>]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-17 12:30:56 -08:00
Uri Mashiach
1463df0fa8 wlcore/wl12xx: spi: fix oops on firmware load
commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.

The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.

Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:

root@debian-armhf:~# ifconfig wlan0 up
[  294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[  294.320173] pgd = de528000
[  294.323028] [00203fc4] *pgd=00000000
[  294.326916] Internal error: Oops: 5 [#1] SMP ARM
[  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[  294.372236] PC is at __spi_validate+0xa8/0x2ac
[  294.376902] LR is at __spi_sync+0x78/0x210
[  294.381200] pc : [<c049c760>]    lr : [<c049ebe0>]    psr: 60000013
[  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
[  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
[  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
00203fbc
[  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
de3a9000
[  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment user
[  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
[  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[  294.432437] Stack: (0xde551998 to 0xde552000)

...

[  294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>]
(__spi_sync+0x78/0x210)
[  294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>]
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[  294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from
[<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[  294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from
[<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx])
[  294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>]
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[  294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from
[<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[  294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from
[<c0537978>] (__dev_open+0xa8/0x110)
[  294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>]
(__dev_change_flags+0x88/0x148)
[  294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>]
(dev_change_flags+0x18/0x48)
[  294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>]
(devinet_ioctl+0x6b4/0x7d0)
[  294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>]
(sock_ioctl+0x1e4/0x2bc)
[  294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>]
(do_vfs_ioctl+0x420/0x6b0)
[  294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>]
(SyS_ioctl+0x6c/0x7c)
[  295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>]
(ret_fast_syscall+0x0/0x54)
[  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[  295.021544] ---[ end trace 66ed188198f4e24e ]---

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-02-17 12:30:56 -08:00
Peter Wu
7e92cfc478 rtlwifi: fix memory leak for USB device
commit 17bc55864f81dd730d05f09b1641312a7990d636 upstream.

Free skb for received frames with a wrong checksum. This can happen
pretty rapidly, exhausting all memory.

This fixes a memleak (detected with kmemleak). Originally found while
using monitor mode, but it also appears during managed mode (once the
link is up).

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-01-31 11:28:58 -08:00
Kalle Valo
01d85b9b2b * don't load firmware that won't exist for 7260
* fix RCU splat
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWcRtgAAoJEC0Llv5uNjIB8SsP/jgsZT5J8xxLpMThe0Pw7C9d
 zZ9Hk1GGBtw9bqMxb7ZjXiGufJQoCf4ckYIEd8OVTOj/3UNE+ZS1StLYmOgie1Ah
 XEgGH9mCuhBAPHGjjsi/YgxNKiwVQ4XOTuV5V9QVUotcTlZGTmtx6UBIxPtnbhWr
 9/uthiDTzgR6c/3sHLSYv66qkrBRMLWbqAdfyJdv4fRW9jwJKTkjexNXuDLMN/Vz
 vgOoSgl62+ixZ211RdLSpO5CasO/FwYabDfcO2UK/h81MetZIn09BQAxBy6p0D1E
 CbMfH1C1Y8TBScRwVEdHgaZ36M+waOfQ0QOcBZOzWveH3xagajNspLaz8yUPO08w
 DCJykrIRkh8C4g1lxK3X5VXh1nyMAuXxAJ9XSr2Rt6ihxi4bA7sFs88xzSCNXyNM
 5QbDjDrJAxb8amprG7F7Ge2N1vO5NQ2dsbluSiMtU43KxhwOvIBjqVbaZmDhYF6m
 in7AndtM1xkSY32KWDVMJYhycwm/ZOQL1kN2WRLEOgnnCW0JQ84kLIBkyFkBMYPs
 Go42+BnOr3qPEfnTd7xufjXK/1hJ+lZt58UM6qlhMsGY48ZXw+vrPe1/vWlq61rT
 ZP+V1LaBAg5nk6jGuA67mN7Wbof0oCaHqljNe9eX/GewahKS0Rn8TpHpw0z05rvI
 CcitRAsPwMQNGW3WdmIo
 =OIVH
 -----END PGP SIGNATURE-----

Merge tag 'iwlwifi-for-kalle-2015-12-16' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes

* don't load firmware that won't exist for 7260
* fix RCU splat
2015-12-18 14:57:02 +02:00
Johannes Berg
4585436091 iwlwifi: mvm: protect RCU dereference in iwl_mvm_get_key_sta_id
Properly protect the RCU dereference in iwl_mvm_get_key_sta_id() when
coming from iwl_mvm_update_tkip_key() which cannot hold the mvm->mutex
by moving the call into the RCU critical section.
Modify the check to use rcu_dereference_check() to permit this.

Fixes: 9513c5e18a ("iwlwifi: mvm: Avoid dereferencing sta if it was already flushed")
Reported-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-12-13 13:38:26 +02:00
Johannes Berg
628a2918af iwlwifi: separate firmware version for 7260 devices
The 7260 devices aren't going to be updated for completely new
firmware versions any more (only bugfixes), and haven't been
since API version 17. Encode that in the data structures to
avoid trying to load FW images that will never exist.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-12-13 13:38:26 +02:00
Larry Finger
eeec5d0ef7 rtlwifi: rtl8821ae: Fix lockups on boot
In commit 54328e6404 ("rtlwifi: rtl8821ae: Fix system lockups on boot"),
an attempt was made to fix a regression introduced in commit 1277fa2ab2
("rtlwifi: Remove the clear interrupt routine from all drivers").
Unfortunately, there were logic errors in that patch that prevented
affected boxes from booting even after that patch was applied.

The actual cause of the original problem is unknown as none of the
developers have systems that are affected.

Fixes: 54328e6404 ("rtlwifi: rtl8821ae: Fix system lockups on boot")
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org> [V4.1+]
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2015-11-17 15:58:53 +02:00
Kalle Valo
cecd4cfb54 Merge ath-current from ath.git
ath10k

* fix invalid NSS for 4x4 devices
* add QCA9377 hw1.0 support
* fix QCA6174 regression with CE5 usage

wil6210

* new maintainer - Maya Erez
2015-11-17 15:56:52 +02:00
Kalle Valo
948cca9fc3 * bump API to firmware 19 - not released yet.
* fix D3 flows (Luca)
 * new device IDs (Oren)
 * fix NULL pointer dereference (Avri)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJWSNxNAAoJEC0Llv5uNjIBJgoP/1DJ7f/aB3sfvPuSO+bx+x5F
 V+GJK7QK85qMd2n7G0bA1BNn+Xr3wrsUugnV4XiOM7Ew4wIVY7cwOaxTBkuXlxm9
 QOHeSBQXq8L9pl5rxMTui7BYEaOMjtGRZXeHQL5qXAD2KJpmZLcka+55C0hxitq3
 xXBvIMV0yZcm223i3wkF4ZnUO75AWbIdEKw8VzDY0uTPeDDgQNGVcpHTriw4Afch
 VdXtMRaWf5+l4KC0qhZiPaQ/dM4OQoI0Y0iSi3DlamaSAZoOMl6b1KSWaRtx5inA
 iICF9iUriqi6kJ3y1DkbVY3++/ASbGM37w3YY0HC1Mzd2tRHLMVRMkHUuIjPAbLt
 omLgZ5v1mV9D5H29M4giaW7M5emoHwrCvLhdzREzFenjvnUQLnBcN8YjzWJKoidj
 UaL/6Ur3FKFXc/5IBcSIdSkpla/eZmZL+V+JhTWd69Vhb6giBhfyzkoEU2nD+fWt
 kaBuERKN+J8FuxDJj8Bo3eaPN4/jxmQBLAlRlf4VsHEDCJZKP9VCLl+UWfgaXl++
 lCfs3PEhJL/sgjMHcrfTw2fVlSTI8dqO/SfFd4ll32W7uIjQk/aaz0T1I2ThoudZ
 az/oRP5Xbgy1/VQOYZQdPx2KIxgkqtxbiPHyWuBVx0IjD4cVwXv2uFFmNs/t/gWp
 cp39Rce0kyfp6IsPCBQL
 =u09V
 -----END PGP SIGNATURE-----

Merge tag 'iwlwifi-for-kalle-2015-11-15' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes

* bump API to firmware 19 - not released yet.
* fix D3 flows (Luca)
* new device IDs (Oren)
* fix NULL pointer dereference (Avri)
2015-11-17 15:51:56 +02:00
Rajkumar Manoharan
6419fdbb6f ath10k: poll HTT send completion when CE 5 is unused
commit a70587b338 ("ath10k: configure copy engine 5 for HTT messages")
moved send completion polling under HTT Rx (CE 5) service routine. For
QCA6174 based devices copy engine 1 (CE 1) is used for HTT Rx instead
of CE 5. So send completion never be called. This is causing "failed to
transmit packet, dropping: -105" errors. Fix this by processing send
completion from CE 1 service routine instead of CE 5.

Fixes: a70587b338 ("ath10k: configure copy engine 5 for HTT messages")
Tested-by: Ryan Hsu <ryanhsu@qca.qualcomm.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-16 21:40:53 +02:00
Avri Altman
9513c5e18a iwlwifi: mvm: Avoid dereferencing sta if it was already flushed
Be a little bit more careful when dereferencing sta on key removal,
As it might already get flushed on other thread.

Signed-off-by: Avri Altman <avri.altman@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-11-15 21:18:01 +02:00
Luca Coelho
d6ee54a9d7 iwlwifi: mvm: don't overwrite the key indices in D3 entry
When entering D3, we need to use hardcoded key indices because the
firmware requires that.  To do so, we are overwriting the HW key index
in the keyconf structure, which makes it impossible to reuse the
indices that were used before entering D3.  Additionally, we overwrite
all the non-PTK keys with index 1, because the firmware only allows
one non-PTK key to be set.  This is bad, because when we resume, we
may try to set more than one key with index 1, which will obviously
fail.

To fix this, allow the callers to set a pre-defined index to use in
iwl_mvm_set_sta_key() instead of relying on the hw_key_idx value from
the keyconf struct (which requires overwriting it).  In normal cases,
the caller can pass STA_KEY_IDX_INVALID, which will cause a new key
offset to be chosen.  During HW_RESTART, we pass the offset that is in
use.  And during D3 entry, we pass the hardcoded indices we need to
use.

Additionally, don't clear the fw_key_table in D3 entry, so that the
flags are still set with the pre-D3 values when exiting D3.

fixes=I3165c22362483f0152d9ec1d2a987fb5529727c1

Fixes: b546dcd6b7 ("iwlwifi: mvm: don't reset key index on HW restart")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-11-15 21:18:00 +02:00
Emmanuel Grumbach
5fd6705c36 iwlwifi: bump firmware API to 19
This firmware will be the first firmware to support
3168. It hasn't been released yet.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-11-15 21:18:00 +02:00
Oren Givon
4ab75944c4 iwlwifi: Add new PCI IDs for the 8260 series
Add some new PCI IDs for the 8260 series which were missing.
The following sub-system IDs were added:
0x0130, 0x1130, 0x0132, 0x1132, 0x1150, 0x8110, 0x9110, 0x8130,
0x9130, 0x8132, 0x9132, 0x8150, 0x9150, 0x0044, 0x0930

CC: <stable@vger.kernel.org> [4.1+]
Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-11-15 21:18:00 +02:00
Ryan Hsu
2727a743e9 ath10k: override CE5 configuration for QCA6147 device
Commit a70587b338 ("ath10k: configure copy engine 5 for HTT messages")
introduced to use the unused CE5 for target to host message. For the device
like QCA6174, CE5 already assigned for other feature. So for QCA6174, override
the CE5 configuration and use the CE1 instead.

This patch is based on Rajkumar's earlier patch.

Fixes: a70587b338 ("ath10k: configure copy engine 5 for HTT messages")
Signed-off-by: Ryan Hsu <ryanhsu@qca.qualcomm.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-12 21:05:00 +02:00
Bartosz Markowski
034074f3a8 ath10k: add QCA9377 hw1.0 support
Add new BMI target version and chip id revision. Register it
on supported chips list.

Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-12 21:03:05 +02:00
Bartosz Markowski
079a0490e2 ath10k: introduce dev_id to hw_params
A follow up patch introducing a QCA9377 hw1.0 support will need
this device identification helper for an explicit distinction of
HWs, as apparently both QCA6174 hw3.0 and QCA9377 share the same BMI
target version (0x0502000x). For the QCA9377 hw1.1 previously
added we were just lucky we did not overlap with the same chip_id_rev.

Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-12 21:03:04 +02:00
Bartosz Markowski
6cf2139582 ath10k: update missing hw_params of QCA9377 hw1.1
The uart_pin was incorrectly configured for QCA9377
and the recently added hw_params were omitted.

Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-12 21:03:02 +02:00
Bartosz Markowski
12551ced30 ath10k: fix the currently supported QCA9377 target version name
When introducing the original QCA9377 support, the chip target
version was wrongly picked. The chip advertising itself with
bmi target value equal to 0x05020001 is in fact a 1.1 revision.
I realized this once I got a real 1.1 hw to play with.

Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-12 21:03:00 +02:00
Rajkumar Manoharan
f680f70adb ath10k: fix invalid NSS for 4x4 devices
The number of spatial streams that are derived from chain mask
for 4x4 devices is using wrong bitmask and conditional check.
This is affecting downlink throughput for QCA99x0 devices. Earlier
cfg_tx_chainmask is not filled by default until user configured it
and so get_nss_from_chainmask never be called. This issue is exposed
by recent commit 166de3f189 ("ath10k: remove supported chain mask").
By default maximum supported chain mask is filled in cfg_tx_chainmask.

Cc: stable@vger.kernel.org
Fixes: 5572a95b4b ("ath10k: apply chainmask settings to vdev on creation")
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-11-10 11:48:42 +02:00
Andrew Morton
79211c8ed1 remove abs64()
Switch everything to the new and more capable implementation of abs().
Mainly to give the new abs() a bit of a workout.

Cc: Michal Nazarewicz <mina86@mina86.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-11-09 15:11:24 -08:00
Linus Torvalds
75f5db39ff spi: Updates for v4.4
Quite a lot of activity in SPI this cycle, almost all of it in drivers
 with a few minor improvements and tweaks in the core.
 
  - Updates to pxa2xx to support Intel Broxton and multiple chip selects.
  - Support for big endian in the bcm63xx driver.
  - Multiple slave support for the mt8173
  - New driver for the auxiliary SPI controller in bcm2835 SoCs.
  - Support for Layerscale SoCs in the Freescale DSPI driver.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJWOehzAAoJECTWi3JdVIfQTPYH+wYMDG8gAIw2s0AJ4DvVe4qZ
 sOAm1UgUJZxssrEA6BNqbfM0dfRo+oQJKmRd0Dc5n7LEMsYHdI/5yKHk8PCS6ZzD
 iQyQCzbd0thDAqwuPaMP62cyPDHwyJX22VGTsgVnj6AZqAQ+9+g4SPKhFnm1Mlm4
 hmDi6fdSrsqo8k8gkpVN8RFOfVsjAV1dLtAauQRWDHrqMxXURSrKG76eqAqUa5bn
 BLPXBoj5PA0DMLPO2j+ADZwWN723LrI2mSSlc+ThjEX/OIt2OhAoiOTV5RPqaafy
 TIsCkh68q/gYAsL5HtvvmgZByl41FLYiO0Z+rXmWUyMMbnvhZTLws9S2BNpBLuk=
 =DgXG
 -----END PGP SIGNATURE-----

Merge tag 'spi-v4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi updates from Mark Brown:
 "Quite a lot of activity in SPI this cycle, almost all of it in drivers
  with a few minor improvements and tweaks in the core.

   - Updates to pxa2xx to support Intel Broxton and multiple chip selects.
   - Support for big endian in the bcm63xx driver.
   - Multiple slave support for the mt8173
   - New driver for the auxiliary SPI controller in bcm2835 SoCs.
   - Support for Layerscale SoCs in the Freescale DSPI driver"

* tag 'spi-v4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (87 commits)
  spi: pxa2xx: Rework self-initiated platform data creation for non-ACPI
  spi: pxa2xx: Add support for Intel Broxton
  spi: pxa2xx: Detect number of enabled Intel LPSS SPI chip select signals
  spi: pxa2xx: Add output control for multiple Intel LPSS chip selects
  spi: pxa2xx: Use LPSS prefix for defines that are Intel LPSS specific
  spi: Add DSPI support for layerscape family
  spi: ti-qspi: improve ->remove() callback
  spi/spi-xilinx: Fix race condition on last word read
  spi: Drop owner assignment from spi_drivers
  spi: Add THIS_MODULE to spi_driver in SPI core
  spi: Setup the master controller driver before setting the chipselect
  spi: dw: replace magic constant by DW_SPI_DR
  spi: mediatek: mt8173 spi multiple devices support
  spi: mediatek: handle controller_data in mtk_spi_setup
  spi: mediatek: remove mtk_spi_config
  spi: mediatek: Update document devicetree bindings to support multiple devices
  spi: fix kernel-doc warnings about missing return desc in spi.c
  spi: fix kernel-doc warnings about missing return desc in spi.h
  spi: pxa2xx: Align a few defines
  spi: pxa2xx: Save other reg_cs_ctrl bits when configuring chip select
  ...
2015-11-05 13:15:12 -08:00
Linus Torvalds
e880e87488 driver core update for 4.4-rc1
Here's the "big" driver core updates for 4.4-rc1.  Primarily a bunch of
 debugfs updates, with a smattering of minor driver core fixes and
 updates as well.
 
 All have been in linux-next for a long time.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlY6ePQACgkQMUfUDdst+ymNTgCgpP0CZw57GpwF/Hp2L/lMkVeo
 Kx8AoKhEi4iqD5fdCQS9qTfomB+2/M6g
 =g7ZO
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core updates from Greg KH:
 "Here's the "big" driver core updates for 4.4-rc1.  Primarily a bunch
  of debugfs updates, with a smattering of minor driver core fixes and
  updates as well.

  All have been in linux-next for a long time"

* tag 'driver-core-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  debugfs: Add debugfs_create_ulong()
  of: to support binding numa node to specified device in devicetree
  debugfs: Add read-only/write-only bool file ops
  debugfs: Add read-only/write-only size_t file ops
  debugfs: Add read-only/write-only x64 file ops
  debugfs: Consolidate file mode checks in debugfs_create_*()
  Revert "mm: Check if section present during memory block (un)registering"
  driver-core: platform: Provide helpers for multi-driver modules
  mm: Check if section present during memory block (un)registering
  devres: fix a for loop bounds check
  CMA: fix CONFIG_CMA_SIZE_MBYTES overflow in 64bit
  base/platform: assert that dev_pm_domain callbacks are called unconditionally
  sysfs: correctly handle short reads on PREALLOC attrs.
  base: soc: siplify ida usage
  kobject: move EXPORT_SYMBOL() macros next to corresponding definitions
  kobject: explain what kobject's sd field is
  debugfs: document that debugfs_remove*() accepts NULL and error values
  debugfs: Pass bool pointer to debugfs_create_bool()
  ACPI / EC: Fix broken 64bit big-endian users of 'global_lock'
2015-11-04 21:50:37 -08:00
Mark Brown
4c84518523 Merge remote-tracking branches 'spi/topic/omap-100k', 'spi/topic/omap-uwire', 'spi/topic/owner', 'spi/topic/pxa' and 'spi/topic/pxa2xx' into spi-next 2015-11-04 11:02:12 +00:00
David S. Miller
b75ec3af27 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-11-01 00:15:30 -04:00
Ben Greear
13eff53113 ath6kl: implement ethtool stats
This supports a way to get target stats through normal
ethtool stats API.

For instance:
# ethtool -S wlan1
NIC statistics:
     tx_pkts_nic: 353
     tx_bytes_nic: 25142
     rx_pkts_nic: 6
     rx_bytes_nic: 996
     d_tx_ucast_pkts: 89
     d_tx_bcast_pkts: 264
     d_tx_ucast_bytes: 3020
     d_tx_bcast_bytes: 22122
...

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-29 13:07:00 +02:00
Ben Greear
0370248379 ath6kl: break stats gathering code into separate method
This will allow us to call it from elsewhere when implementing
ethtool stats.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-29 13:06:58 +02:00
Ben Greear
53cc3291bc ath6kl: fix firmware version assignment
Improper use of strlcpy caused garbage to be appended to the
firmware version string.  Fix this by paying attention to the
ie_lenth.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-29 13:06:56 +02:00
Ben Greear
7fd9852456 ath6kl: add error message to explain lack of HT
It can take a user a while to understand why their
NIC that advertises 802.11n support cannot actually
do 802.11n.  Print out a warning in the logs to save
the next poor person to use this NIC some trouble.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-29 13:06:54 +02:00
Ben Greear
9c2e90ffc9 ath6kl: report antenna configuration
This lets 'iw phy phy0 info' report antennas for
the radio device:

...
	Available Antennas: TX 0x2 RX 0x2
	Configured Antennas: TX 0x2 RX 0x2
...

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2015-10-29 13:06:52 +02:00