If iwl_transt_start_hw() failed, we were returning without calling
wiphy_unlock() and rtnl_unlock(), causing a locking imbalance:
drivers/net/wireless/intel/iwlwifi/mvm/ops.c:686:12: warning: context imbalance in 'iwl_mvm_start_get_nvm' - wrong count at exit
Fix that by adding the unlock calls.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20211219090128.42417-2-luca@coelho.fi
When hardware rfkill is enabled in the firmware it will report the
capability via using WMI_SYS_CAP_INFO_RFKILL bit in the WMI_SERVICE_READY
event to the host. ath11k will check the capability, and if it is enabled then
ath11k will set the GPIO information to firmware using WMI_PDEV_SET_PARAM. When
the firmware detects hardware rfkill is enabled by the user, it will report it
via WMI_RFKILL_STATE_CHANGE_EVENTID. Once ath11k receives the event it will
send wmi command WMI_PDEV_SET_PARAM to the firmware and also notifies cfg80211.
This only enable rfkill feature for QCA6390, rfkill_pin is all initialized to 0
for other chips in ath11k_hw_params.
Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20211217102334.14907-1-quic_wgong@quicinc.com
HTT_T2H_MSG_TYPE_PPDU_STATS_IND is a message which include the ppdu
info, currently it is not report from firmware for ath11k, then the
tx bitrate of "iw wlan0 station dump" always show an invalid value
"tx bitrate: 6.0 MBit/s".
To address the issue, this is to parse the info of tx complete report
from firmware and indicate the tx rate to mac80211.
After that, "iw wlan0 station dump" show the correct tx bit rate such
as:
tx bitrate: 78.0 MBit/s MCS 12
tx bitrate: 144.4 MBit/s VHT-MCS 7 short GI VHT-NSS 2
tx bitrate: 286.7 MBit/s HE-MCS 11 HE-NSS 2 HE-GI 0 HE-DCM 0
tx bitrate: 1921.5 MBit/s 160MHz HE-MCS 9 HE-NSS 2 HE-GI 0 HE-DCM 0
Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20211217093722.5739-1-quic_wgong@quicinc.com
One small fix for a long standing issue with error handling on probe in
the Armada driver.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmHAupoACgkQJNaLcl1U
h9Ca7Af+MSrnkT9q1GiDRT57ndUpG7CWa7tKDfzU/2QnPFFQED+Mne/ZvaopMNuz
bbov7YvvObJKDjfdwYYK5KrnNyaqHcbjX5cow+BG6zEMAMTeQLqOjMEN4/QcgO2j
nr5gYIqj9bOosoTrPZlJ2HUdTg48FgFovc0w/b9GUrzKAJJSKNZzeMffVx9ljtjs
UgdFj1h9mgyZq/cD4TS5+DgnP6qwi195FidOJQWXoAiwohMBZFjGglaTNhGYprGq
EDAbDZOaw4hjRBdZk2GAvo60PyhWU9BpGlsucFf341oLxdo9qqHuzP7x8MRIGobx
TnKfHSWO0PoYVJReiIKy2ShgYvlrYA==
=vwk0
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fix from Mark Brown:
"One small fix for a long standing issue with error handling on probe
in the Armada driver"
* tag 'spi-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: change clk_disable_unprepare to clk_unprepare
This fixes problems validating DT bindings using op_mode which wasn't
described as it should have been when converting to DT schema.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmHAuVgACgkQJNaLcl1U
h9BD7gf+MMfzUBhMBgFM+iO0KRJt+yTZOS7d2FVSfKxF74px0gT43K0ABgFUPyb1
LhzWxHFAh8oxGFQtLu9KThFO0b7IaT07TGx0iqDdapVd7jj7aUg38/7fUqYY1p21
uAYRHqPJIYbLM5WyzXRrbF7LuhqrJ+ZhJhyeHy4HOYvbV8QqhmDjsnAuU/mXlicr
pmkR+ph00V+JLW2w2EGJ+d8S9x2hOQ+PncQ2i++KFBQiUAyPSzlRLkvIXSgEqINp
IxwISXXzh8CwKBlqV8Zo11vDW9q7Crt5OYxE1epfPBFjQPvu9HPCoIe7BTK55AuX
/gkULxXtpTo13z5N20k5tMAitU0W+g==
=JDrH
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"Binding fix for v5.16
This fixes problems validating DT bindings using op_mode which wasn't
described as it should have been when converting to DT schema"
* tag 'regulator-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: dt-bindings: samsung,s5m8767: add missing op_mode to bucks
In Isolation VM, all shared memory with host needs to mark visible
to host via hvcall. vmbus_establish_gpadl() has already done it for
netvsc rx/tx ring buffer. The page buffer used by vmbus_sendpacket_
pagebuffer() stills need to be handled. Use DMA API to map/umap
these memory during sending/receiving packet and Hyper-V swiotlb
bounce buffer dma address will be returned. The swiotlb bounce buffer
has been masked to be visible to host during boot up.
rx/tx ring buffer is allocated via vzalloc() and they need to be
mapped into unencrypted address space(above vTOM) before sharing
with host and accessing. Add hv_map/unmap_memory() to map/umap rx
/tx ring buffer.
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20211213071407.314309-6-ltykernel@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
In Isolation VM, all shared memory with host needs to mark visible
to host via hvcall. vmbus_establish_gpadl() has already done it for
storvsc rx/tx ring buffer. The page buffer used by vmbus_sendpacket_
mpb_desc() still needs to be handled. Use DMA API(scsi_dma_map/unmap)
to map these memory during sending/receiving packet and return swiotlb
bounce buffer dma address. In Isolation VM, swiotlb bounce buffer is
marked to be visible to host and the swiotlb force mode is enabled.
Set device's dma min align mask to HV_HYP_PAGE_SIZE - 1 in order to
keep the original data offset in the bounce buffer.
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Reviewed-by: Long Li <longli@microsoft.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20211213071407.314309-5-ltykernel@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
hyperv Isolation VM requires bounce buffer support to copy
data from/to encrypted memory and so enable swiotlb force
mode to use swiotlb bounce buffer for DMA transaction.
In Isolation VM with AMD SEV, the bounce buffer needs to be
accessed via extra address space which is above shared_gpa_boundary
(E.G 39 bit address line) reported by Hyper-V CPUID ISOLATION_CONFIG.
The access physical address will be original physical address +
shared_gpa_boundary. The shared_gpa_boundary in the AMD SEV SNP
spec is called virtual top of memory(vTOM). Memory addresses below
vTOM are automatically treated as private while memory above
vTOM is treated as shared.
Swiotlb bounce buffer code calls set_memory_decrypted()
to mark bounce buffer visible to host and map it in extra
address space via memremap. Populate the shared_gpa_boundary
(vTOM) via swiotlb_unencrypted_base variable.
The map function memremap() can't work in the early place
(e.g ms_hyperv_init_platform()) and so call swiotlb_update_mem_
attributes() in the hyperv_init().
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20211213071407.314309-4-ltykernel@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Hyper-V provides Isolation VM for confidential computing support and
guest memory is encrypted in it. Places checking cc_platform_has()
with GUEST_MEM_ENCRYPT attr should return "True" in Isolation VM.
Hyper-V Isolation VMs need to adjust the SWIOTLB size just like SEV
guests. Add a hyperv_cc_platform_has() variant which enables that.
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Acked-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20211213071407.314309-3-ltykernel@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
In Isolation VM with AMD SEV, bounce buffer needs to be accessed via
extra address space which is above shared_gpa_boundary (E.G 39 bit
address line) reported by Hyper-V CPUID ISOLATION_CONFIG. The access
physical address will be original physical address + shared_gpa_boundary.
The shared_gpa_boundary in the AMD SEV SNP spec is called virtual top of
memory(vTOM). Memory addresses below vTOM are automatically treated as
private while memory above vTOM is treated as shared.
Expose swiotlb_unencrypted_base for platforms to set unencrypted
memory base offset and platform calls swiotlb_update_mem_attributes()
to remap swiotlb mem to unencrypted address space. memremap() can
not be called in the early stage and so put remapping code into
swiotlb_update_mem_attributes(). Store remap address and use it to copy
data from/to swiotlb bounce buffer.
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20211213071407.314309-2-ltykernel@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
The patch d1af5cd86997 ("drm: get rid of DRM_DEBUG_* log
calls in drm core, files drm_a*.c") fails when the drm_device
cannot be found in the parameter plane_state->crtc.
Fix it using plane_state->plane.
Reported-by: kernel test robot <oliver.sang@intel.com>
Fixes: 6e22dc3583 ("drm: get rid of DRM_DEBUG_* log calls in drm core, files drm_a*.c")
Signed-off-by: Claudio Suarez <cssk@net-c.es>
[danvet: fix Fixes: line]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/YaiXEARd8z2C463h@gineta.localdomain
clang warns about excessive stack usage in this driver when
UBSAN is enabled:
drivers/staging/greybus/audio_topology.c:977:12: error: stack frame size of 1836 bytes in function 'gbaudio_tplg_create_widget' [-Werror,-Wframe-larger-than=]
Rework this code to no longer use compound literals for
initializing the structure in each case, but instead keep
the common bits in a preallocated constant array and copy
them as needed.
Link: https://github.com/ClangBuiltLinux/linux/issues/1535
Link: https://lore.kernel.org/r/20210103223541.2790855-1-arnd@kernel.org/
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[nathan: Address review comments from v1]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20211209195141.1165233-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move the power transition steps into Hal8188EPwrSeq.c where the arrays
are defined.
There's no point in having defines for sequences of steps in the include
file. All of these sequences are used only once (apart from the end
sequence).
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-10-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Clean up the definitions of the power transition steps and address some
checkpatch warnings.
Reduce the line lengths where possible. Add spaces between elements.
Rewrite comments that are in contradiction with the definition they
describe.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-9-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
None of the remaining power transition steps used PWR_CMD_READ.
It can be removed.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-8-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the base entry from the power transition steps. This field
is not used.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-7-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
For the r8188 driver, we always have a usb interface. We can remove
the power transition steps that are not applicable for a usb interface.
We can then remove the interface mask itself.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-6-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the fab mask from the steps of the power transitions.
The fab mask is not used, all values are allowed for all steps.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-5-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the power cut mask from the steps of the power transitions.
The power cut mask is not used, all values are allowed for all steps.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-4-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
There's no need to set the array size explicitly if an array is
initialized with a constant value. Remove the array sizes and
related definitions for the power transition arrays.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-3-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The r8188 driver defines a number of transitions between different
power states. Remove the transitions which are not used by the rest
of the code.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211219183926.4746-2-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the ODM_BB_RA_MASK capability. It is always set for this driver.
Like for ODM_BB_DIG before, we can be sure that ODM_BB_RA_MASK was never
checked before it was set.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211218120423.29906-10-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the ODM_BB_DIG capability. It is always set for this driver.
(ODM_BB_DIG was set in Update_ODM_ComInfo_88E and checked in odm_DIG,
which was always called after the capability was set.)
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211218120423.29906-9-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The r8188 driver installs a dummy handler for some unused ioctls. All
that the dummy handler does is return -1.
Remove the dummy handler and let the wext core handle unused ioctls.
This way, user space gets a consistent errno for an unused wext ioctl,
regardless of which driver is used for the interface.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211218120423.29906-3-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The _linked_rx_signal_strength_display function is used only in
rtw_mlme_ext.c. Make the function static and remove the prototype.
While at it, fix a typo in the function name.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211218120423.29906-2-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
I just fixed a bug in copy_process when using the label
bad_fork_cleanup_threadgroup_lock. While fixing the bug I looked
closer at the label and realized it has been misnamed since
568ac88821 ("cgroup: reduce read locked section of
cgroup_threadgroup_rwsem during fork").
Fix the name so that fork is easier to understand.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Mark Brown <broonie@kernel.org> reported:
> This is also causing further build errors including but not limited to:
>
> /tmp/next/build/kernel/fork.c: In function 'copy_process':
> /tmp/next/build/kernel/fork.c:2106:4: error: label 'bad_fork_cleanup_threadgroup_lock' used but not defined
> 2106 | goto bad_fork_cleanup_threadgroup_lock;
> | ^~~~
It turns out that I messed up and was depending upon a label protected
by an ifdef. Move the label out of the ifdef as the ifdef around the label
no longer makes sense (if it ever did).
Link: https://lkml.kernel.org/r/YbugCP144uxXvRsk@sirena.org.uk
Fixes: 40966e316f ("kthread: Ensure struct kthread is present for all kthreads")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Clean up the rtl8188e_sreset_linked_status_check, which has just
been moved to rtw_mlme_ext.
Don't initialise variables to 0 if the first access sets a new value.
Check the value of fw_status only once.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211212185833.22000-4-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move rtl8188e_sreset_linked_status_check from the hal layer into
rtw_mlme_ext.c.
Like the xmit status check, this is a simple function that's only
called from one place.
With this function gone, hal/rtl8188e_sreset.c and
include/rtl8188e_sreset.h are now empty and can be removed.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211212185833.22000-3-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move rtl8188e_sreset_xmit_status_check from the hal layer into
rtw_cmd.c.
As this driver supports only the 8188 chipset, there's no need
to go through the hal layer for simple operations that have only
one caller.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211212185833.22000-2-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The double `for' in the comment in line 2203 is repeated. Remove one
of them from the comment.
Signed-off-by: Jason Wang <wangborong@cdjrlc.com>
Link: https://lore.kernel.org/r/20211211091632.264035-1-wangborong@cdjrlc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The double `new' in the comment in line 1349 and `to' in the comment in
line 2030 are repeated. Remove the repeated words from these comments.
Signed-off-by: Jason Wang <wangborong@cdjrlc.com>
Link: https://lore.kernel.org/r/20211211091422.260442-1-wangborong@cdjrlc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pm_runtime_get_sync can also return 1 on success, change
to use pm_runtime_resume_and_get which return 0 only on
success.
This bug has been discovered by Dan Carpenter by using Smatch
static checker.
Fixes: 285892a74f ("remoteproc: Add Renesas rcar driver")
Signed-off-by: Julien Massot <julien.massot@iot.bzh>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
[Fixed blank line between tags]
Link: https://lore.kernel.org/r/20211216160653.203768-1-julien.massot@iot.bzh
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
A large part of this is cleanups to existing device trees in order to
improve validation of the device trees using the dt-schema tooling.
This also contains a set of new device trees for various boards that
have been contributed by community members as well as fixes to existing
devices.
-----BEGIN PGP SIGNATURE-----
iQJHBAABCAAxFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmG8sjMTHHRyZWRpbmdA
bnZpZGlhLmNvbQAKCRDdI6zXfz6zoVRwEAC3bpMxfr01p98zxX3hwiAEW5prN1zJ
eKgBvalvGXSfF1YfWhpjQ7gX2Q2jZwnriChE47BPlskwCMCwMj+5Fn78WsB/a49W
WeyvYUY9PSAUTY+EmlaV+Mzu+XHAaE28/YMoIp4CWaWMFqRe8pgXoxE89zldy3KV
HS5M6TIQWm8R+VSgFUX05C/OMiGury+9bs1qiYr/CXtcAuwDM+f7ZLtRYzXXZafk
UHZWmrvQAKXQm+U2fZRRE9AB1o0NXXZ6HKCI+TWhhNIxT3z/ZTrVKmKiqqHwJ1Ly
L6GMxoUbYxVNnzViopzihJFaZSXwDKbJBtCCOzg4E+x4UfB5aXUKuA/0apX3Zd5U
7DRUG3a92brrpx1cVtGaHlBtFL8zIppELgqVTThsUn4i43WU9upmbfnHy0x2sBEt
eODyqRSWuTZTLwXliuiJkE2u5eyQcC0ze5/lKIF/2upQ8EDC/9mzpVWB72vOluSe
nO/PMFPBLvQjrYYtuTp66Eqfpe59QiCTdrCOJLR/YsrXqG7WDNhkVLfccpmCNaZ1
uJyAOK1W9kjL7mbodyHrv92y5QLnx/1H2OU+sC65M+Qlq4w+rxnf1g+TOz32CSor
UZuTlBvhdbdq+8ibd6S5QzxkqvqvsP2VkaTvUb7PxqSl20Lt2mBKFuym8Oe3/4Z8
V/0L2KIhFqTJ6g==
=2rZJ
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmHAq84ACgkQmmx57+YA
GNlvcA/+NPSr/UkQFdJGJdej3/MLp5FyvriLZf7qyqebRsoVK14N/l4L4fMNizss
sKqZU6/ZkQevVmBIW3v3iioKEsFGFPkhnmicPZjpuhvMu5OOn7rPA6YvA8UJDK+1
/opnD39z/NLVJxIoC4mWMMYxP4gWMTYNXNPMqfTnF8stKcZwErzNYGudMBoIbZ6f
UUhVbs9SatsSlfJD8QTUgavr+ve8/RbjoKGkEmrYJwaSps6V/NikwWLrRogHHNg2
Ui3YXutRarzOuJFboDlLey8hZBdkhIMWGkOcmCvnLZfJ1oqpIcCz2mqSoeikO+j1
vH3l2a9JazrXfE59rxbF94iqAPCPms0l4C8GfTLiTs+bvEe+YgcVPvv7Yj5GBcke
oUtirvVd3QmSZ3LtDI8Jpjt6VitkGDvZRcU+ZN/b0vDTi1j8c7EDvLMCRCuy/yVr
7zYINyAkLlK6FdxcXCv6FHh4qtG/bKh6OWuAPtxe/OHo18c4DhWnGuWP351bQyBD
11Iov+P7NeuUG7L7SMkuE8/Z72vseTHZnpDW8wW6jTxDh0fsk7ValjlXZhMy4K1C
DVmpYOa8bh/rx4nCJo2fk1t4vgEMkMySgznd1pTM0q5UOtdrw985+2EcweOpVN7q
VUhXmhoLldyFvFGjL/OnKUPvR/UWt1Rg1xZwz1nTux/Ifkl1aCo=
=WDGY
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-5.17-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/dt
ARM: tegra: Changes for v5.17-rc1
A large part of this is cleanups to existing device trees in order to
improve validation of the device trees using the dt-schema tooling.
This also contains a set of new device trees for various boards that
have been contributed by community members as well as fixes to existing
devices.
* tag 'tegra-for-5.17-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (55 commits)
ARM: tegra: Add host1x hotflush reset on Tegra124
ARM: tegra: Add memory client hotflush resets on Tegra114
ARM: tegra: Add back gpio-ranges properties
ARM: tegra: paz00: Enable S/PDIF and HDMI audio
ARM: tegra: acer-a500: Enable S/PDIF and HDMI audio
ARM: tegra: Add HDMI audio graph to Tegra20 device-tree
ARM: tegra: Add S/PDIF node to Tegra20 device-tree
ARM: tegra20/30: Disable unused host1x hardware
ARM: tegra: Add Memory Client resets to Tegra30 GR2D, GR3D and Host1x
ARM: tegra: Add Memory Client resets to Tegra20 GR2D, GR3D and Host1x
ARM: tegra: Add OPP tables and power domains to Tegra30 device-trees
ARM: tegra: Add OPP tables and power domains to Tegra20 device-trees
ARM: tegra: Add 500 MHz entry to Tegra30 memory OPP table
ARM: tegra: Enable video decoder on Tegra114
ARM: tegra: nexus7: Use common LVDS display device-tree
ARM: tegra: Add CPU thermal zones to Nyan device-tree
ARM: tegra: Enable CPU DFLL on Nyan
ARM: tegra: Enable HDMI CEC on Nyan
ARM: tegra: Add usb-role-switch property to USB OTG ports
ARM: tegra: Add device-tree for 1080p version of Nyan Big
...
Link: https://lore.kernel.org/r/20211217162253.1801077-5-thierry.reding@gmail.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Large pkt_len can lead to out-out-bound memcpy. Current
ath9k_hif_usb_rx_stream allows combining the content of two urb
inputs to one pkt. The first input can indicate the size of the
pkt. Any remaining size is saved in hif_dev->rx_remain_len.
While processing the next input, memcpy is used with rx_remain_len.
4-byte pkt_len can go up to 0xffff, while a single input is 0x4000
maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for
pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE.
BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc]
Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23
CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
Workqueue: events request_firmware_work_func
Call Trace:
<IRQ>
dump_stack+0x76/0xa0
print_address_description.constprop.0+0x16/0x200
? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc]
? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc]
__kasan_report.cold+0x37/0x7c
? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc]
kasan_report+0xe/0x20
check_memory_region+0x15a/0x1d0
memcpy+0x20/0x50
ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc]
? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc]
? _raw_spin_lock_irqsave+0x7b/0xd0
? _raw_spin_trylock_bh+0x120/0x120
? __usb_unanchor_urb+0x12f/0x210
__usb_hcd_giveback_urb+0x1e4/0x380
usb_giveback_urb_bh+0x241/0x4f0
? __hrtimer_run_queues+0x316/0x740
? __usb_hcd_giveback_urb+0x380/0x380
tasklet_action_common.isra.0+0x135/0x330
__do_softirq+0x18c/0x634
irq_exit+0x114/0x140
smp_apic_timer_interrupt+0xde/0x380
apic_timer_interrupt+0xf/0x20
I found the bug using a custome USBFuzz port. It's a research work
to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only,
providing hand-crafted usb descriptors to QEMU.
After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU
emulation, I found the KASAN report. The bug is triggerable whenever
pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes
to test the driver works when applying the patch.
Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wireless.nyu.edu
syzbot is reporting lockdep warning at ath9k_wmi_event_tasklet() followed
by kernel panic at get_htc_epid_queue() from ath9k_htc_tx_get_packet() from
ath9k_htc_txstatus() [1], for ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID)
depends on spin_lock_init() from ath9k_init_priv() being already completed.
Since ath9k_wmi_event_tasklet() is set by ath9k_init_wmi() from
ath9k_htc_probe_device(), it is possible that ath9k_wmi_event_tasklet() is
called via tasklet interrupt before spin_lock_init() from ath9k_init_priv()
from ath9k_init_device() from ath9k_htc_probe_device() is called.
Let's hold ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) no-op until
ath9k_tx_init() completes.
Link: https://syzkaller.appspot.com/bug?extid=31d54c60c5b254d6f75b [1]
Reported-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+31d54c60c5b254d6f75b@syzkaller.appspotmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/77b76ac8-2bee-6444-d26c-8c30858b8daa@i-love.sakura.ne.jp
syzbot is reporting lockdep warning followed by kernel panic at
ath9k_htc_rxep() [1], for ath9k_htc_rxep() depends on ath9k_rx_init()
being already completed.
Since ath9k_htc_rxep() is set by ath9k_htc_connect_svc(WMI_BEACON_SVC)
from ath9k_init_htc_services(), it is possible that ath9k_htc_rxep() is
called via timer interrupt before ath9k_rx_init() from ath9k_init_device()
is called.
Since we can't call ath9k_init_device() before ath9k_init_htc_services(),
let's hold ath9k_htc_rxep() no-op until ath9k_rx_init() completes.
Link: https://syzkaller.appspot.com/bug?extid=4d2d56175b934b9a7bf9 [1]
Reported-by: syzbot <syzbot+4d2d56175b934b9a7bf9@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+4d2d56175b934b9a7bf9@syzkaller.appspotmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/2b88f416-b2cb-7a18-d688-951e6dc3fe92@i-love.sakura.ne.jp
IEEE80211_HW_USES_RSS is set in ath11k, then the device uses RSS and
thus requires parallel RX which implies using per-CPU station statistics
in sta_get_last_rx_stats() of mac80211. Currently signal is only set in
ath11k_mgmt_rx_event(), and not set for RX data packet, then it show
signal as 0 for iw command easily.
Change to get signal from firmware and report to mac80211.
For QCA6390 and WCN6855, the rssi value is already in dbm unit, so
don't need to convert it again.
Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20211216070535.31732-1-quic_wgong@quicinc.com
