summaryrefslogtreecommitdiff
path: root/drivers/net/wireless
AgeCommit message (Collapse)AuthorFilesLines
2018-06-07Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-nextLinus Torvalds263-2637/+7834
Pull networking updates from David Miller: 1) Add Maglev hashing scheduler to IPVS, from Inju Song. 2) Lots of new TC subsystem tests from Roman Mashak. 3) Add TCP zero copy receive and fix delayed acks and autotuning with SO_RCVLOWAT, from Eric Dumazet. 4) Add XDP_REDIRECT support to mlx5 driver, from Jesper Dangaard Brouer. 5) Add ttl inherit support to vxlan, from Hangbin Liu. 6) Properly separate ipv6 routes into their logically independant components. fib6_info for the routing table, and fib6_nh for sets of nexthops, which thus can be shared. From David Ahern. 7) Add bpf_xdp_adjust_tail helper, which can be used to generate ICMP messages from XDP programs. From Nikita V. Shirokov. 8) Lots of long overdue cleanups to the r8169 driver, from Heiner Kallweit. 9) Add BTF ("BPF Type Format"), from Martin KaFai Lau. 10) Add traffic condition monitoring to iwlwifi, from Luca Coelho. 11) Plumb extack down into fib_rules, from Roopa Prabhu. 12) Add Flower classifier offload support to igb, from Vinicius Costa Gomes. 13) Add UDP GSO support, from Willem de Bruijn. 14) Add documentation for eBPF helpers, from Quentin Monnet. 15) Add TLS tx offload to mlx5, from Ilya Lesokhin. 16) Allow applications to be given the number of bytes available to read on a socket via a control message returned from recvmsg(), from Soheil Hassas Yeganeh. 17) Add x86_32 eBPF JIT compiler, from Wang YanQing. 18) Add AF_XDP sockets, with zerocopy support infrastructure as well. From Björn Töpel. 19) Remove indirect load support from all of the BPF JITs and handle these operations in the verifier by translating them into native BPF instead. From Daniel Borkmann. 20) Add GRO support to ipv6 gre tunnels, from Eran Ben Elisha. 21) Allow XDP programs to do lookups in the main kernel routing tables for forwarding. From David Ahern. 22) Allow drivers to store hardware state into an ELF section of kernel dump vmcore files, and use it in cxgb4. From Rahul Lakkireddy. 23) Various RACK and loss detection improvements in TCP, from Yuchung Cheng. 24) Add TCP SACK compression, from Eric Dumazet. 25) Add User Mode Helper support and basic bpfilter infrastructure, from Alexei Starovoitov. 26) Support ports and protocol values in RTM_GETROUTE, from Roopa Prabhu. 27) Support bulking in ->ndo_xdp_xmit() API, from Jesper Dangaard Brouer. 28) Add lots of forwarding selftests, from Petr Machata. 29) Add generic network device failover driver, from Sridhar Samudrala. * ra.kernel.org:/pub/scm/linux/kernel/git/davem/net-next: (1959 commits) strparser: Add __strp_unpause and use it in ktls. rxrpc: Fix terminal retransmission connection ID to include the channel net: hns3: Optimize PF CMDQ interrupt switching process net: hns3: Fix for VF mailbox receiving unknown message net: hns3: Fix for VF mailbox cannot receiving PF response bnx2x: use the right constant Revert "net: sched: cls: Fix offloading when ingress dev is vxlan" net: dsa: b53: Fix for brcm tag issue in Cygnus SoC enic: fix UDP rss bits netdev-FAQ: clarify DaveM's position for stable backports rtnetlink: validate attributes in do_setlink() mlxsw: Add extack messages for port_{un, }split failures netdevsim: Add extack error message for devlink reload devlink: Add extack to reload and port_{un, }split operations net: metrics: add proper netlink validation ipmr: fix error path when ipmr_new_table fails ip6mr: only set ip6mr_table from setsockopt when ip6mr_new_table succeeds net: hns3: remove unused hclgevf_cfg_func_mta_filter netfilter: provide udp*_lib_lookup for nf_tproxy qed*: Utilize FW 8.37.2.0 ...
2018-06-07Merge tag 'overflow-v4.18-rc1' of ↵Linus Torvalds2-5/+3
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull overflow updates from Kees Cook: "This adds the new overflow checking helpers and adds them to the 2-factor argument allocators. And this adds the saturating size helpers and does a treewide replacement for the struct_size() usage. Additionally this adds the overflow testing modules to make sure everything works. I'm still working on the treewide replacements for allocators with "simple" multiplied arguments: *alloc(a * b, ...) -> *alloc_array(a, b, ...) and *zalloc(a * b, ...) -> *calloc(a, b, ...) as well as the more complex cases, but that's separable from this portion of the series. I expect to have the rest sent before -rc1 closes; there are a lot of messy cases to clean up. Summary: - Introduce arithmetic overflow test helper functions (Rasmus) - Use overflow helpers in 2-factor allocators (Kees, Rasmus) - Introduce overflow test module (Rasmus, Kees) - Introduce saturating size helper functions (Matthew, Kees) - Treewide use of struct_size() for allocators (Kees)" * tag 'overflow-v4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: treewide: Use struct_size() for devm_kmalloc() and friends treewide: Use struct_size() for vmalloc()-family treewide: Use struct_size() for kmalloc()-family device: Use overflow helpers for devm_kmalloc() mm: Use overflow helpers in kvmalloc() mm: Use overflow helpers in kmalloc_array*() test_overflow: Add memory allocation overflow tests overflow.h: Add allocation size calculation helpers test_overflow: Report test failures test_overflow: macrofy some more, do more tests for free lib: add runtime test of check_*_overflow functions compiler.h: enable builtin overflow checkers and add fallback code
2018-06-06treewide: Use struct_size() for kmalloc()-familyKees Cook2-5/+3
One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; void *entry[]; }; instance = kmalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kmalloc(struct_size(instance, entry, count), GFP_KERNEL); This patch makes the changes for kmalloc()-family (and kvmalloc()-family) uses. It was done via automatic conversion with manual review for the "CHECKME" non-standard cases noted below, using the following Coccinelle script: // pkey_cache = kmalloc(sizeof *pkey_cache + tprops->pkey_tbl_len * // sizeof *pkey_cache->table, GFP_KERNEL); @@ identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc"; expression GFP; identifier VAR, ELEMENT; expression COUNT; @@ - alloc(sizeof(*VAR) + COUNT * sizeof(*VAR->ELEMENT), GFP) + alloc(struct_size(VAR, ELEMENT, COUNT), GFP) // mr = kzalloc(sizeof(*mr) + m * sizeof(mr->map[0]), GFP_KERNEL); @@ identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc"; expression GFP; identifier VAR, ELEMENT; expression COUNT; @@ - alloc(sizeof(*VAR) + COUNT * sizeof(VAR->ELEMENT[0]), GFP) + alloc(struct_size(VAR, ELEMENT, COUNT), GFP) // Same pattern, but can't trivially locate the trailing element name, // or variable name. @@ identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc"; expression GFP; expression SOMETHING, COUNT, ELEMENT; @@ - alloc(sizeof(SOMETHING) + COUNT * sizeof(ELEMENT), GFP) + alloc(CHECKME_struct_size(&SOMETHING, ELEMENT, COUNT), GFP) Signed-off-by: Kees Cook <keescook@chromium.org>
2018-06-06Merge tag 'driver-core-4.18-rc1' of ↵Linus Torvalds2-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the driver core patchset for 4.18-rc1. The large chunk of these are firmware core documentation and api updates. Nothing major there, just better descriptions for others to be able to understand the firmware code better. There's also a user for a new firmware api call. Other than that, there are some minor updates for debugfs, kernfs, and the driver core itself. All of these have been in linux-next for a while with no reported issues" * tag 'driver-core-4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (23 commits) driver core: hold dev's parent lock when needed driver-core: return EINVAL error instead of BUG_ON() driver core: add __printf verification to device_create_groups_vargs mm: memory_hotplug: use put_device() if device_register fail base: core: fix typo 'can by' to 'can be' debugfs: inode: debugfs_create_dir uses mode permission from parent debugfs: Re-use kstrtobool_from_user() Documentation: clarify firmware_class provenance and why we can't rename the module Documentation: remove stale firmware API reference Documentation: fix few typos and clarifications for the firmware loader ath10k: re-enable the firmware fallback mechanism for testmode ath10k: use firmware_request_nowarn() to load firmware firmware: add firmware_request_nowarn() - load firmware without warnings firmware_loader: make firmware_fallback_sysfs() print more useful firmware_loader: move kconfig FW_LOADER entries to its own file firmware_loader: replace ---help--- with help firmware_loader: enhance Kconfig documentation over FW_LOADER firmware_loader: document firmware_sysfs_fallback() firmware: rename fw_sysfs_fallback to firmware_fallback_sysfs() firmware: use () to terminate kernel-doc function names ...
2018-06-04Merge branch 'hch.procfs' of ↵Linus Torvalds5-232/+44
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull procfs updates from Al Viro: "Christoph's proc_create_... cleanups series" * 'hch.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (44 commits) xfs, proc: hide unused xfs procfs helpers isdn/gigaset: add back gigaset_procinfo assignment proc: update SIZEOF_PDE_INLINE_NAME for the new pde fields tty: replace ->proc_fops with ->proc_show ide: replace ->proc_fops with ->proc_show ide: remove ide_driver_proc_write isdn: replace ->proc_fops with ->proc_show atm: switch to proc_create_seq_private atm: simplify procfs code bluetooth: switch to proc_create_seq_data netfilter/x_tables: switch to proc_create_seq_private netfilter/xt_hashlimit: switch to proc_create_{seq,single}_data neigh: switch to proc_create_seq_data hostap: switch to proc_create_{seq,single}_data bonding: switch to proc_create_seq_data rtc/proc: switch to proc_create_single_data drbd: switch to proc_create_single resource: switch to proc_create_seq_data staging/rtl8192u: simplify procfs code jfs: simplify procfs code ...
2018-06-03Merge tag 'wireless-drivers-next-for-davem-2018-05-31' of ↵David S. Miller133-1157/+2282
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.18 Hopefully the last pull request to 4.18 before the merge window. Nothing major here, we have smaller new features and of course a lots of fixes. Major changes: ath10k * add memory dump support for QCA9888 and QCA99X0 * add support to configure channel dwell time * support new DFS host confirmation feature in the firmware ath * update various regulatory mappings wcn36xx * various fixes to improve reliability * add Factory Test Mode support brmfmac * add debugfs file for reading firmware capabilities mwifiex * support sysfs initiated device coredump ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-06-03Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2-9/+8
Filling in the padding slot in the bpf structure as a bug fix in 'ne' overlapped with actually using that padding area for something in 'net-next'. Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-31Merge tag 'wireless-drivers-for-davem-2018-05-30' of ↵David S. Miller2-9/+8
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.17 Two last minute fixes, hopefully they make it to 4.17 still. rt2x00 * revert a fix which caused even more problems iwlwifi * fix a crash when there are 16 or more logical CPUs ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-30Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo23-124/+920
ath.git patches for 4.18. Major changes: ath10k * add memory dump support for QCA9888 and QCA99X0 * add support to configure channel dwell time * support new DFS host confirmation feature in the firmware ath * update various regulatory mappings wcn36xx * various fixes to improve reliability * add Factory Test Mode support
2018-05-30qtnfmac: fix invalid STA state on EAPOL failureSergey Matyukevich2-12/+17
Driver switches vif sta_state into QTNF_STA_CONNECTING when cfg80211 core initiates connect procedure. Further this state is changed either to QTNF_STA_CONNECTED or to QTNF_STA_DISCONNECTED by BSS_JOIN and BSS_LEAVE events from firmware. However it is possible that no such events will be sent by firmware, e.g. if EAPOL timed out. In this case vif sta_mode will remain in QTNF_STA_CONNECTING state and all subsequent connection attempts will fail with -EBUSY error code. Fix this by perfroming STA state transition from QTNF_STA_CONNECTING to QTNF_STA_DISCONNECTED in cfg80211 disconnect callback. No need to rely upon firmware events in this case. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: cancel scan on disconnectAndrey Shevchenko1-0/+2
Cancel scan operation on STA disconnect. Signed-off-by: Andrey Shevchenko <ashevchenko@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: fix bg_scan_period parameter processingAndrey Shevchenko2-7/+3
Do not process bg_scan_period parameter in qtnfmac driver. Pass correct values as is. In the case of invalid values pass default value. Leave further processing to firmware. Signed-off-by: Andrey Shevchenko <ashevchenko@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: fix firmware command error pathDmitry Lebed2-1/+4
Free command skb if bus state is not QTNF_FW_STATE_ACTIVE. Signed-off-by: Dmitry Lebed <dlebed@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: improve control path timeout handlingDmitry Lebed3-5/+15
Control path will not be operational after firmware failure. Change bus state to QTNF_FW_STATE_EP_DEAD after the control path timeout. Don't wait for timeout if control path is already dead. Signed-off-by: Dmitry Lebed <dlebed@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: cleanup wdev structure between its usesSergey Matyukevich2-6/+3
Driver uses statically allocated wdev structures for each virtual interface. However wdev structure is not properly cleaned up between its uses. As a result, various bugs appear when userspace tools like hostapd were not gracefully stopped. In particular, this commit fixes the following issue: - start hostapd with more than 2 mBSS - kill hostapd using SIGKILL - start again hostapd with more than 2 mBSS However only two mBSS entities will be started: primary and the last BSS listed in hostapd config. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: decode error codes from firmware repliesIgor Mitsyanko2-2/+26
Introduce a function that will map an error code reported in reply to a firmware command, into one of standard errno codes. Use additional error codes to improve error reporting for MAC address changes. Signed-off-by: Igor Mitsyanko <igor.mitsyanko.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: simplify notationSergey Matyukevich1-12/+13
Shorten line lengths using a more compact notation to access mac info. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30qtnfmac: remove unused function declarationsAndrey Shevchenko1-5/+0
Functions qtnf_cmd_resp_parse and qtnf_cmd_resp_check have been removed. Remove their declarations as well. Signed-off-by: Andrey Shevchenko <ashevchenko@quantenna.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-30drivers/net: Fix various unnecessary characters after logging newlinesJoe Perches7-13/+12
Remove and coalesce formats when there is an unnecessary character after a logging newline. These extra characters cause logging defects. Miscellanea: o Coalesce formats Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-30iwlwifi: fix non_shared_ant for 9000 devicesErel Geron1-1/+1
The non-shared antenna was wrong for 9000 device series. Fix it to ANT_B for correct antenna preference by coex in MVM driver. Fixes: 89374fe60bfb ("iwlwifi: Add new PCI IDs for 9260 and 5165 series") Signed-off-by: Erel Geron <erelx.geron@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: mvm: fix race in queue notification waitJohannes Berg1-8/+8
Initially in this code, the race didn't matter since it didn't do anything. Latest with the commit I marked this as fixing it started to matter as something got done here that needed other data that got freed as soon as the queue notification wait was returning. In the scenario we saw, apparently the IWL_MVM_RXQ_NOTIF_DEL_BA event was sent to all queues, but processing the last event we returned from iwl_mvm_sync_rx_queues_internal() and then from iwl_mvm_free_reorder() and continued some processing before wl_mvm_del_ba() was even invoked on the other CPU. Thus, when the latter finally ran, it found that mvm->baid_map[baid] was no longer valid. Correct the race by moving the counter decrement and wake_up() to be done only after all the per-event processing completed. Note that in the commit I marked as being fixed the wake_up() didn't exist yet (and the code was otherwise problematic) but this particular problem already existed in a way. Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: mvm: honor the max_amsdu_subframes limitEmmanuel Grumbach1-0/+4
A peer can limit the number of subframes it can handle in a single A-MSDU. Honor this limit. Note that the smallest limit is 8, and we are very unlikely to reach that limit. So this isn't really a big deal. Fixes: a6d5e32f247c ("iwlwifi: mvm: send large SKBs to the transport") Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: mvm: open BA session only when sta is authorizedGregory Greenman5-36/+29
Currently, a BA session is opened when the tx traffic exceeds 10 frames per second. As a result of inter-op problems with some APs, add a condition to open BA session only when station is already authorized. Fixes: 482e48440a0e ("iwlwifi: mvm: change open and close criteria of a BA session") Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: mvm: remove division by size of sizeof(struct ieee80211_wmm_rule)Colin Ian King1-2/+1
The subtraction of two struct ieee80211_wmm_rule pointers leaves a result that is automatically scaled down by the size of the size of pointed-to type, hence the division by sizeof(struct ieee80211_wmm_rule) is bogus and should be removed. Detected by CoverityScan, CID#1467777 ("Extra sizeof expression") Fixes: 77e30e10ee28 ("iwlwifi: mvm: query regdb for wmm rule if needed") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: pcie: fix race in Rx buffer allocatorShaul Triebitz1-0/+2
Make sure the rx_allocator worker is canceled before running the rx_init routine. rx_init frees and re-allocates all rxb's pages. The rx_allocator worker also allocates pages for the used rxb's. Running rx_init and rx_allocator simultaniously causes a kernel panic. Fix that by canceling the work in rx_init. Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: mvm: fix TSO with highly fragmented SKBsEmmanuel Grumbach1-6/+6
Our hardware has a limited amount of buffer descriptors for each Tx packet. Because of that, there is a short piece of code that makes sure that that we don't push too many subframes in an A-MSDU because of subframes needs 2 buffer descriptors. This code also takes into account the number of fragment of the skb since we also need a buffer descriptor for each fragment in the skb. This piece of code though didn't check that the resulting number of subframes wasn't 0. A user reported that using NFS client, he could get skbs that are so fragmented that the code mentioned above returned 0 for the number of subframes making skb_gso_segment fail and subconsequently iwlwifi would WARN. Fix this by make sure that num_subframes is at least 1. This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=199209 Fixes: a6d5e32f247c ("iwlwifi: mvm: send large SKBs to the transport") Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlmvm: tdls: Check TDLS channel switch supportAviya Erenfeld1-5/+11
Some versions of the FW don't support channel switch in TDLS. Add a condition that checks it. Fixes: 307e47235a10 ("iwlwifi: mvm: configure TDLS peers to FW") Signed-off-by: Aviya Erenfeld <aviya.erenfeld@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-30iwlwifi: mvm: drop UNKNOWN security type framesSara Sharon2-4/+17
In some cases we may get from FW errored frames with UNKNOWN security type. This may happen in unsecured aggregation flow, where the first packet had a CRC error in the WEP bit, which was followed by a failure to decrypt and was dropped. The next frames in the aggregation "inherit" the bad metadata of the first packet. Make sure to drop such frames since RADA and other offloads will not operate correctly which may have unexpected results. In case of AP it also causes to TX AMSDU frames to the peers, resulting with assert 0x104B. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-29net: remove unnecessary genlmsg_cancel() callsYueHaibing1-1/+0
the message be freed immediately, no need to trim it back to the previous size. Inspired by commit 7a9b3ec1e19f ("nl80211: remove unnecessary genlmsg_cancel() calls") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-29iwlwifi: add csr configuration for 6300 devicesGolan Ben Ami2-0/+4
Recently we have switched the csr addresses and values configuration from a single configuration to all devices to a per-device configuration. Doing that, the configuration for 6300 devices wasn't set. This missing definition introduced a kernel panic once trying to access the csr's. Add the missing 6300 csr configuration. While at it, add a checker that the csr values were indeed configured, and bail out more gracefully if not. Fixes: a8cbb46f831d ("iwlwifi: allow different csr flags for different device families") Signed-off-by: Golan Ben Ami <golan.ben.ami@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2018-05-29iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUsHao Wei Tee1-5/+5
When there are 16 or more logical CPUs, we request for `IWL_MAX_RX_HW_QUEUES` (16) IRQs only as we limit to that number of IRQs, but later on we compare the number of IRQs returned to nr_online_cpus+2 instead of max_irqs, the latter being what we actually asked for. This ends up setting num_rx_queues to 17 which causes lots of out-of-bounds array accesses later on. Compare to max_irqs instead, and also add an assertion in case num_rx_queues > IWM_MAX_RX_HW_QUEUES. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=199551 Fixes: 2e5d4a8f61dc ("iwlwifi: pcie: Add new configuration to enable MSIX") Signed-off-by: Hao Wei Tee <angelsl@in04.sg> Tested-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29Revert "rt2800: use TXOP_BACKOFF for probe frames"Stanislaw Gruszka1-4/+3
This reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e. In some situations when we set TXOP_BACKOFF, the probe frame is not sent at all. What it worse then sending probe frame as part of AMPDU and can degrade 11n performance to 11g rates. Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: remove duplicate codeGustavo A. R. Silva1-19/+4
Remove and refactor some code in order to avoid having identical code for different branches. Notice that the logic has been there since 2014. Addresses-Coverity-ID: 1426199 ("Identical code for different branches") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29mwifiex: reserve passive scan time for radar channelXinming Hu1-3/+6
Active scan is not allowed on radar channel, instead using passvie scan with more time. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29mwifiex: increase log level for internal scan fail resultXinming Hu1-1/+1
Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29mwifiex: mark expected switch fall-throughsGustavo A. R. Silva2-0/+5
In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29mwifiex: skip sending GT_REKEY_OFFLOAD_CFG if firmware has no supportGanapathi Bhat3-1/+21
If firmware does not support embedded supplicant, then it in turn will not support GT rekey offloading. If this is the case, then driver must not advertise WOWLAN flags related to GTK rekey and it must also skip sending the GT_REKEY_OFFLOAD_CFG command. Signed-off-by: Shrenik Shikhare <shrenik@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29mwifiex: handle race during mwifiex_usb_disconnectGanapathi Bhat1-0/+3
Race condition is observed during rmmod of mwifiex_usb: 1. The rmmod thread will call mwifiex_usb_disconnect(), download SHUTDOWN command and do wait_event_interruptible_timeout(), waiting for response. 2. The main thread will handle the response and will do a wake_up_interruptible(), unblocking rmmod thread. 3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in mwifiex_usb_free(). 4. The main thread will try to resubmit rx_cmd.urb in mwifiex_usb_submit_rx_urb(), which is NULL. To fix, wait for main thread to complete before calling mwifiex_usb_free(). Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29mwifiex: avoid exporting mwifiex_send_cmdGanapathi Bhat4-4/+10
This is a follow-up patch for commit 21c5c83ce833 ("mwifiex: support sysfs initiated device coredump"). Let us avoid exporting mwifiex_send_cmd and instead use a utility function mwifiex_fw_dump_event to achive the work. Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rsi: fix spelling mistake "Uknown" -> "Unknown"Colin Ian King1-1/+1
Trivial fix to spelling mistake in rsi_dbg message text Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29wlcore: sdio: check for valid platform device data before suspendEyal Reizer1-0/+5
the wl pointer can be null In case only wlcore_sdio is probed while no WiLink module is successfully probed, as in the case of mounting a wl12xx module while using a device tree file configured with wl18xx related settings. In this case the system was crashing in wl1271_suspend() as platform device data is not set. Make sure wl the pointer is valid before using it. Signed-off-by: Eyal Reizer <eyalr@ti.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29atmel: Add missing call to pci_disable_device()YueHaibing1-1/+3
add pci_disable_device in error handling while init_atmel_card failed. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: fix btmpinfo timeout while processing C2H_BT_INFOPing-Ke Shih1-0/+22
In former patch, I enqueu all C2H commands and processed by a workqueue. In case C2H_BT_INFO will issue a H2C command to set BT reg, and wait for a C2H ack. But it is totally impossible that C2H workqueue waits for a C2H command, so kernel log warn rtlwifi: :<0> btmpinfo wait (req_num=0) timeout Since the C2H ack command C2H_BT_MP can be safely processed in interrupt context, add a fast command path to deal with the command. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: access skb->data to get C2H data by macroPing-Ke Shih2-4/+9
The format of C2H data is ID(1 byte) + Length(1 byte) + value, and it is more readable to use macros to access C2H data. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: use sk_buff to queue C2H commandsPing-Ke Shih4-81/+25
We use 'struct rtl_c2hcmd' to store C2H commands originally, and the code is slightly complex to enqueue and dequeue and also wastes time to allocate and memcpy data. Since C2H commands are asynchronous events, they can be processed in work queue, so RX ISR enqueues C2H result in removal of rtl_c2h_packet_handler(). Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: remove hal_op c2h_content_parsingPing-Ke Shih5-9/+3
Similar to rx_command_packet, we can call rtl_c2h_content_parsing so the hal_op isn't necessary. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: remove hal_op rx_command_packetPing-Ke Shih11-90/+2
Because the hal_op rx_command_packet does C2H handler if rx packet type is C2H, and the handler have been moved to base.c so we can call the handler directly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: remove duplicate C2H handlerPing-Ke Shih14-230/+81
Merge duplicate C2H handler and implement the handler in base.c. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: Add hal_op c2h_ra_report_handler for special processPing-Ke Shih7-5/+15
We're going to merge C2H handler into one, but one special case is to handle RA_REPORT that implements in individual IC folder. So this commit adds a hal_op for caller in common code. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-05-29rtlwifi: remove dummy hal_op rx_command_packet from rtl8188ee and rtl8723aePing-Ke Shih6-24/+0
The caller of hal_op rx_command_packet will assert function pointer before calling, so we can remove dummy functions safely. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>