Age | Commit message (Collapse) | Author | Files | Lines |
|
Since 8821C code is ready, we can build it.
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Since single rf path chips don't support TX SPBC, tell mac80211
to not advertise it.
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Beamforming is used for directional signal transmission/reception.
Beamformee plays the role for signal reception, and makes the RX
performance better in middle distance range.
Implement beamformee related callbacks for 8821c.
Since 8821c only support 1ss rate, nc_index in beamformee setting
needs to be adjusted based on the capability.
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
The TX power requires to be adjusted based on the thermal value.
The actual power will decrease if the thermal value raised, and
will increase if the thermal value lowered. Driver comapres the
thermal value, as moving averages. If it changes over a limit,
driver will modify the TX power index to compensate.
Implement rtw_chip_ops::pwr_track() for 8821c.
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
CCK PD can reduce the number of false alarm of the CCK rates.
It dynamically adjusts the power threshold and CS ratio.
The values are compared to the values of the previous level, if
the level is changed, set new values of power threshold and CS
ratio.
Implement rtw_chip_ops::cck_pd_set() for 8821c.
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
In order to get a better TX EVM, do calibration after association.
The calibration needed for 8821c is the IQK, which is done in the
firmware. Implement the rtw_chip_ops::phy_calibration() to trigger
firmware to calibrate.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
False alarm statistics can be used to adjust the RX gain. This
helps the driver to adapt to different circumstances.
Implement rtw_chip_ops::false_alarm_statistics() for 8821c.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Some RX packets contain also information about environment status.
Implement rtw_chip_ops::query_rx_desc() for 8821c. Parse the RX
descriptor which describes the current condition of the received
packet.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
8821c is capable of 2.4G and 5G.
Implement rtw_chip_ops::set_channel() to set 2G and 5G channels.
This includes MAC, BB and RF related settings.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
To improve user experience in field, we need DIG to adjust RX initial
gain depends on field situation.
Define the register addresses for 8821c.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
To configure the transmit power of 8821c implement trasmit
power index setting callback function for 8821c. This is very
similar to the callback function of 8822b.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
RTL8821CE chipsets are 802.11ac dual-band WiFi + BT combo chips.
This patch adds the basic functions such as parameter tables, chip
information, power on flow.
Reviewed-by: Sebastian Andrzej Siewior <[email protected]>
Signed-off-by: Tzu-En Huang <[email protected]>
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
which is a typedef for an enum type defining 'NETDEV_TX_OK' but this
driver returns '0' instead of 'NETDEV_TX_OK'.
Fix this by returning 'NETDEV_TX_OK' instead of '0'.
Signed-off-by: Luc Van Oostenryck <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Added version number info along with firmware name so driver can pick
the correct revision of FW file. Moved FW filename macro as part of
driver code & added MODULE_FIRMWARE to specify FW needed by module.
Signed-off-by: Ajay Singh <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Modify WILC1000 binary filename to use single unified wilc1000 FW.
A single wilc1000 binary is used for different wilc1000 revisions.
Signed-off-by: Ajay Singh <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Avoid below reported warning found when 'CONFIG_PM' config is
undefined.
'warning: unused variable 'wowlan_support' [-Wunused-const-variable]'
Reported-by: kernel test robot <[email protected]>
Signed-off-by: Ajay Singh <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Make use 'strlcpy' instead of 'strncpy' to overcome 'stringop-truncation'
compiler warning.
Reported-by: kernel test robot <[email protected]>
Signed-off-by: Ajay Singh <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
The code in the BRCM80211 BRCMSMAC driver is using the legacy
GPIO API to to a complex check of the validity of the base of
the GPIO chip and whether it is present at all and then adding
an offset to the base of the chip.
Use the existing function to obtain a GPIO line internally
from a GPIO chip so we can use the offset directly and
modernize the code to use GPIO descriptors instead of integers
from the global GPIO numberspace.
Cc: Wright Feng <[email protected]>
Cc: Frank Kao <[email protected]>
Cc: Kalle Valo <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
The driver relies on the compatible string from DT to determine which
FW configuration file it should load. The DTS spec allows for '/' as
part of the compatible string. We change this to '-' so that we will
still be able to load the config file, even when the compatible has a
'/'. This fixes explicitly the firmware loading for
"solidrun,cubox-i/q".
Signed-off-by: Matthias Brugger <[email protected]>
Reviewed-by: Hans deGoede <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Linux 3.6 introduces TSQ which has a per socket threshold for TCP Tx
packet to reduce latency. In flow control mode, host driver enqueues skb
in hanger and TCP doesn't push new skb frees until host frees the skb when
receiving fwstatus event. So set pacing shift 8 to send them as a single
large aggregate frame to the bus layer.
43455 TX TCP throughput in different FC modes on Linux 5.4.18
sk_pacing_shift : Throughput (fcmode=0)
10: 245 Mbps
9: 245 Mbps
8: 246 Mbps
7: 246 Mbps
sk_pacing_shift : Throughput (fcmode=1)
10: 182 Mbps
9: 197 Mbps
8: 206 Mbps
7: 207 Mbps
sk_pacing_shift : Throughput (fcmode=2)
10: 180 Mbps
9: 197 Mbps
8: 206 Mbps
7: 207 Mbps
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
When USB or SDIO device got abnormal bus disconnection, host driver
tried to clean up the skbs in PSQ and TXQ (The skb's pointer in hanger
slot linked to PSQ and TSQ), so we should set the state of skb hanger slot
to BRCMF_FWS_HANGER_ITEM_STATE_FREE before freeing skb.
In brcmf_fws_bus_txq_cleanup it already sets
BRCMF_FWS_HANGER_ITEM_STATE_FREE before freeing skb, therefore we add the
same thing in brcmf_fws_psq_flush to avoid following warning message.
[ 1580.012880] ------------ [ cut here ]------------
[ 1580.017550] WARNING: CPU: 3 PID: 3065 at
drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49
brcmu_pkt_buf_free_skb+0x21/0x30 [brcmutil]
[ 1580.184017] Call Trace:
[ 1580.186514] brcmf_fws_cleanup+0x14e/0x190 [brcmfmac]
[ 1580.191594] brcmf_fws_del_interface+0x70/0x90 [brcmfmac]
[ 1580.197029] brcmf_proto_bcdc_del_if+0xe/0x10 [brcmfmac]
[ 1580.202418] brcmf_remove_interface+0x69/0x190 [brcmfmac]
[ 1580.207888] brcmf_detach+0x90/0xe0 [brcmfmac]
[ 1580.212385] brcmf_usb_disconnect+0x76/0xb0 [brcmfmac]
[ 1580.217557] usb_unbind_interface+0x72/0x260
[ 1580.221857] device_release_driver_internal+0x141/0x200
[ 1580.227152] device_release_driver+0x12/0x20
[ 1580.231460] bus_remove_device+0xfd/0x170
[ 1580.235504] device_del+0x1d9/0x300
[ 1580.239041] usb_disable_device+0x9e/0x270
[ 1580.243160] usb_disconnect+0x94/0x270
[ 1580.246980] hub_event+0x76d/0x13b0
[ 1580.250499] process_one_work+0x144/0x360
[ 1580.254564] worker_thread+0x4d/0x3c0
[ 1580.258247] kthread+0x109/0x140
[ 1580.261515] ? rescuer_thread+0x340/0x340
[ 1580.265543] ? kthread_park+0x60/0x60
[ 1580.269237] ? SyS_exit_group+0x14/0x20
[ 1580.273118] ret_from_fork+0x25/0x30
[ 1580.300446] ------------ [ cut here ]------------
Acked-by: Arend van Spriel <[email protected]>
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
commit 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
adds a reset function to recover firmware trap for PCIe bus. This commit
adds an implementation for SDIO bus.
Upon SDIO firmware trap, do below:
- Remove the device
- Reset hardware
- Probe the device again
Signed-off-by: Chi-Hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Ignore FW event if the event's BSSID is different form the BSSID of the
currently connected AP. Check interface state is connected or not, if
state is not connected that can ignore link down event.
Signed-off-by: Able Liao <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Current brcmf_link_down() always call cfg80211_disconnected() with
locally_generated=1, which is not always the case. Add event source
argument on link down handler and set locally_generated based on the
real trigger.
Signed-off-by: Soontak Lee <[email protected]>
Signed-off-by: Chi-Hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Unable to change back to visiable SSID because there is
no disable hidden ssid routine.
Signed-off-by: Soontak Lee <[email protected]>
Signed-off-by: Chi-Hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Commit 4905432b28b7 ("brcmfmac: Fix P2P Group Formation failure via Go-neg
method") did not initialize requested_dwell properly, resulting in an
always-false dwell time overflow check. Fix it by setting the correct
requested_dwell value.
Fixes: 4905432b28b7 ("brcmfmac: Fix P2P Group Formation failure via Go-neg method")
Reported-by: kernel test robot <[email protected]>
Signed-off-by: Joseph Chuang <[email protected]>
Signed-off-by: Chi-Hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
This patch move the credit map setting to right place to avoid
brcmf_fws_return_credits() return without setting the credit map.
It fix the thoughput zero stalls issue in softAP mode when STA
using PM 1 mode.
Signed-off-by: Double Lo <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
There is a mismatch of tx status flag values between host and firmware.
It makes the host mistake the flags and have incorrect behavior of credit
returns. So update the flags to sync with the firmware ones.
Signed-off-by: Chung-Hsien Hsu <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
It is observed that sometimes when sdiod is low in tx credits in low
rssi scenarios, the data path consumes all sdiod rx all credits and
there is no sdiod rx credit available for control path causing host
and card to go out of sync resulting in link loss between host and
card. So in order to prevent it some credits are reserved for control
path.
Note that TXCTL_CREDITS can't be larger than the firmware default
credit update threshold 2; otherwise there will be a deadlock for both
side waiting for each other.
Signed-off-by: Amar Shankar <[email protected]>
Signed-off-by: Jia-Shyr Chuang <[email protected]>
Signed-off-by: Chi-Hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
In wifi firmware, max length of IOCTL/IOVAR buffer size is 8192.
Increase the message buffer max size same as wifi firmware for control
packets so return buffers can come back.
Signed-off-by: Soontak Lee <[email protected]>
Signed-off-by: Jia-Shyr Chuang <[email protected]>
Signed-off-by: Chi-Hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Current credit borrowing allows only the access category BE to
borrow the credits. This change is to fix the credit borrowing
logic, to make borrowing available for all access categories
and also to borrow only from the lower categories. This fixes WFA
802.11n certs 5.2.27 failures.
Signed-off-by: Raveendran Somu <[email protected]>
Signed-off-by: Jia-Shyr Chuang <[email protected]>
Signed-off-by: Chung-Hsien Hsu <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Bss info flag definition need to be fixed from 0x2 to 0x4
This flag is for rssi info received on channel.
All Firmware branches defined as 0x4 and this is bug in brcmfmac.
Signed-off-by: Prasanna Kerekoppa <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
The firmware state machines are not fully suitable for concurrent
station interface support, it may hit unexpected error if we have 2
different SSIDs and the roaming scenarios concurrently.
To avoid the bad user-experience if this is not fully validated, we
dis-allow user to create two concurrent station interfaces.
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
brcmfmac host driver makes SDIO bus sleep and stops SDIO watchdog if no
pending event or data. As a result, host driver does not poll firmware
console buffer before buffer overflow, which leads to missing firmware
logs. We should not stop SDIO watchdog if console_interval is non-zero
in debug build.
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
When host driver retrieves mac addresses from dongle, driver copies memory
from drvr->mac to perm_addr. But at the moment, drvr->mac is all zero
array which causes permanent MAC address in wiphy is all zero as well.
To fix this, we set drvr->mac before setting perm_addr.
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
To truncate the additional bytes, if extra bytes have been received.
Current code only have a warning and proceed without handling it.
But in one of the crash reported by DVT, these causes the
crash intermittently. So the processing is limit to the skb->len.
Signed-off-by: Raveendran Somu <[email protected]>
Signed-off-by: Chi-hsien Lin <[email protected]>
Signed-off-by: Wright Feng <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
Kalle Valo says:
====================
wireless-drivers fixes for v5.8
First set of fixes for v5.8. Various important fixes for iwlwifi and
mt76.
iwlwifi
* fix sleeping under RCU
* fix a kernel crash when using compressed firmware images
mt76
* tx queueing fixes for mt7615/22/63
* locking fix
* fix a crash during watchdog reset
* fix memory leaks
====================
Signed-off-by: David S. Miller <[email protected]>
|
|
Define appropriate macro names for consistency with other macros.
Signed-off-by: Pali Rohár <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Ulf Hansson <[email protected]>
|
|
This is an immutable branch shared between wireless-drivers-next and
staging-next for moving wilc1000 driver out of staging to drivers/net/wireless
directory.
|
|
Some thermal zone devices never change their state, so they should be
always enabled.
Signed-off-by: Andrzej Pietrasiewicz <[email protected]>
Reviewed-by: Bartlomiej Zolnierkiewicz <[email protected]>
Signed-off-by: Daniel Lezcano <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Move ray_cs into Wi-Fi driver docs subdirectory.
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Organize driver documentation by device type. Most documents
have fairly verbose yet uninformative names, so let users
first select a well defined device type, and then search for
a particular driver.
While at it rename the section from Vendor drivers to
Hardware drivers. This seems more accurate, besides people
sometimes refer to out-of-tree drivers as vendor drivers.
Signed-off-by: Jakub Kicinski <[email protected]>
Acked-by: Jeff Kirsher <[email protected]>
Acked-by: Shannon Nelson <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
WILC1000 is an IEEE 802.11 b/g/n IoT link controller module. The
WILC1000 connects to Microchip AVR/SMART MCUs, SMART MPUs, and other
processors with minimal resource requirements with a simple
SPI/SDIO-to-Wi-Fi interface.
WILC1000 driver has been part of staging for few years. With
contributions from the community, it has improved significantly. Full
driver review has helped in achieving the current state.
The details for those reviews are captured in 1 & 2.
[1]. https://lore.kernel.org/linux-wireless/[email protected]/
[2]. https://lore.kernel.org/linux-wireless/[email protected]/
Signed-off-by: Ajay Singh <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
|
|
The napi_gro_receive function no longer returns GRO_DROP ever, making
handling GRO_DROP dead code. This commit removes that dead code.
Further, it's not even clear that device drivers have any business in
taking action after passing off received packets; that's arguably out of
their hands. In this case, too, the non-gro path didn't bother checking
the return value. Plus, this had some clunky debugging functions that
duplicated code from elsewhere and was generally pretty messy. So, this
commit cleans that all up too.
Fixes: 6570bc79c0df ("net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()")
Signed-off-by: Jason A. Donenfeld <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Avoid adding MT7615_EEPROM_SIZE twice.
Rename MT7615_EEPROM_EXTRA_DATA to MT7615_EEPROM_FULL_SIZE, since it already
includes MT7615_EEPROM_SIZE
Fixes: ad380ad1ebbe ("mt76: mt7615: add support for applying DC offset calibration from EEPROM")
Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Fix the two following memory leaks in mt7663u_probe:
1- if device power-own times out, remove ieee80211 hw device.
2- if mt76u queues allocation fails, remove pending urbs.
Fixes: eb99cc95c3b65 ("mt76: mt7615: introduce mt7663u support")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/e4098f0c8a9ac51997de07f38c2bcdf7042d6db1.1592755166.git.lorenzo@kernel.org
|
|
Fixes a crash on MMIO devices when running into the watchdog reset
Fixes: d3377b78cec6 ("mt76: add HE phy modes and hardware queue")
Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
mt76 patches for 5.8
* tx queueing fixes for mt7615/22/63
* locking fix
# gpg: Signature made Sun 07 Jun 2020 06:17:47 PM EEST using DSA key ID 02A76EF5
# gpg: Good signature from "Felix Fietkau <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 75D1 1A7D 91A7 710F 4900 42EF D77D 141D 02A7 6EF5
|
|
The tlv passed to iwl_dbg_tlv_alloc_trigger comes from a loaded firmware
file. The memory can be marked as read-only as firmware could be
shared. In anyway, writing to this memory is not expected. So,
iwl_dbg_tlv_alloc_trigger can crash now:
BUG: unable to handle page fault for address: ffffae2c01bfa794
PF: supervisor write access in kernel mode
PF: error_code(0x0003) - permissions violation
PGD 107d51067 P4D 107d51067 PUD 107d52067 PMD 659ad2067 PTE 8000000662298161
CPU: 2 PID: 161 Comm: kworker/2:1 Not tainted 5.7.0-3.gad96a07-default #1 openSUSE Tumbleweed (unreleased)
RIP: 0010:iwl_dbg_tlv_alloc_trigger+0x25/0x60 [iwlwifi]
Code: eb f2 0f 1f 00 66 66 66 66 90 83 7e 04 33 48 89 f8 44 8b 46 10 48 89 f7 76 40 41 8d 50 ff 83 fa 19 77 23 8b 56 20 85 d2 75 07 <c7> 46 20 ff ff ff ff 4b 8d 14 40 48 c1 e2 04 48 8d b4 10 00 05 00
RSP: 0018:ffffae2c00417ce8 EFLAGS: 00010246
RAX: ffff8f0522334018 RBX: ffff8f0522334018 RCX: ffffffffc0fc26c0
RDX: 0000000000000000 RSI: ffffae2c01bfa774 RDI: ffffae2c01bfa774
RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001
R10: 0000000000000034 R11: ffffae2c01bfa77c R12: ffff8f0522334230
R13: 0000000001000009 R14: ffff8f0523fdbc00 R15: ffff8f051f395800
FS: 0000000000000000(0000) GS:ffff8f0527c80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffae2c01bfa794 CR3: 0000000389eba000 CR4: 00000000000006e0
Call Trace:
iwl_dbg_tlv_alloc+0x79/0x120 [iwlwifi]
iwl_parse_tlv_firmware.isra.0+0x57d/0x1550 [iwlwifi]
iwl_req_fw_callback+0x3f8/0x6a0 [iwlwifi]
request_firmware_work_func+0x47/0x90
process_one_work+0x1e3/0x3b0
worker_thread+0x46/0x340
kthread+0x115/0x140
ret_from_fork+0x1f/0x40
As can be seen, write bit is not set in the PTE. Read of
trig->occurrences succeeds in iwl_dbg_tlv_alloc_trigger, but
trig->occurrences = cpu_to_le32(-1); fails there, obviously.
This is likely because we (at SUSE) use compressed firmware and that is
marked as RO after decompression (see fw_map_paged_buf).
Fix it by creating a temporary buffer in case we need to change the
memory.
Signed-off-by: Jiri Slaby <[email protected]>
Reported-by: Dieter Nützel <[email protected]>
Tested-by: Dieter Nützel <[email protected]>
Cc: Johannes Berg <[email protected]>
Cc: Emmanuel Grumbach <[email protected]>
Cc: Luca Coelho <[email protected]>
Cc: Intel Linux Wireless <[email protected]>
Cc: Kalle Valo <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
iwl_mvm_free_inactive_queue() will sleep in synchronize_net() under
some circumstances, so don't call it under RCU. There doesn't appear
to be a need for RCU protection around this particular call.
Cc: [email protected] # v5.4+
Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: Luca Coelho <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/iwlwifi.20200403112332.0f49448c133d.I17fd308bc4a9491859c9b112f4eb5d2c3fc18d7d@changeid
|