summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
Commit message (Collapse)AuthorAgeFilesLines
* rt2x00: fix HT TX descriptor settings regressionStanislaw Gruszka2013-11-113-5/+5
| | | | | | | | | | | | | | | | | | Since: commit 36323f817af0376c78612cfdab714b0feb05fea5 Author: Thomas Huehn <thomas@net.t-labs.tu-berlin.de> Date: Mon Jul 23 21:33:42 2012 +0200 mac80211: move TX station pointer and restructure TX we do not pass sta pointer to rt2x00queue_create_tx_descriptor_ht(), hence we do not correctly set station WCID and AMPDU density parameters. Cc: stable@vger.kernel.org # 3.7+ Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* libertas: fix error return code in if_cs_probe()Wei Yongjun2013-11-111-0/+1
| | | | | | | | | Fix to return -ENODEV in the unknown model error handling case instead of 0, as done elsewhere in this function. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* libertas: potential oops in debugfsDan Carpenter2013-11-111-1/+5
| | | | | | | | | | | | | | If we do a zero size allocation then it will oops. Also we can't be sure the user passes us a NUL terminated string so I've added a terminator. This code can only be triggered by root. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* rtlwifi: fix null dereference on efuse_word on kmalloc fail returns NULLColin Ian King2013-11-111-2/+3
| | | | | | | | | | | | | | | kmalloc on efuse_word can return null, leading to free'ing of elements in efuse_word on the error exit path even though it has not been allocated. Instead, don't free the elements of efuse_word if kmalloc failed. Also, kmalloc of any of the arrays in efuse_word[] can also fail, leading to undefined contents in the remaining elements leading to problems when free'ing these elements later on. So kzalloc efuse_word to ensure the kfree on the remaining elements won't cause breakage. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* mwifiex: fix invalid memory access in mwifiex_update_autoindex_ies()Amitkumar Karwar2013-11-111-4/+7
| | | | | | | | | | While parsing TLVs, return failure if number of remaining bytes are less than current tlv length. This avoids invalid memory access. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* mwifiex: fix invalid memory access in mwifiex_ret_tx_rate_cfg()Amitkumar Karwar2013-11-111-10/+12
| | | | | | | | | | | | As tlv_buf_len is decremented at the end of the loop, we may have accessed invalid memory in the last iteration. Modify the while condition and add a break statement at the begining of the loop to fix the problem. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* mwifiex: fix invalid memory access in mwifiex_get_power_level()Amitkumar Karwar2013-11-111-10/+12
| | | | | | | | | | | | With "while (length)" check we may end up in accessing invalid memory in last iteration. This patch makes sure that tlv length is not less than the length of structure mwifiex_power_group when min/max power is calculated. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* mwifiex: replace u16 with __le16 in struct mwifiex_types_power_groupAmitkumar Karwar2013-11-114-8/+9
| | | | | | | | | | | | __le16 to u16 conversion is missing for "pg_tlv_hdr->length" in mwifiex_get_power_level(). This creates a problem on big endian machines. It is resolved by changing definition of the structure and making required endianness changes. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status()Dan Carpenter2013-11-111-0/+3
| | | | | | | | | | | | | | | | Before we loop for next iteration we adjust the buffer pointer and "resp_len": curr += (tlv_len + sizeof(tlv_hdr->header)); resp_len -= (tlv_len + sizeof(tlv_hdr->header)); If "resp_len" gets set to negative then it counts as a high positive value. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* rtlwifi: rtl8192se: Fix wrong assignmentFelipe Pena2013-11-111-1/+1
| | | | | | | | | | | There is a typo in the struct member name on assignment when checking rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40, the check uses pwrgroup_ht40 for bound limit and uses pwrgroup_ht20 when assigning instead. Signed-off-by: Felipe Pena <felipensp@gmail.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: stable@vger.kernel.org [3.0+] Signed-off-by: John W. Linville <linville@tuxdriver.com>
* wireless: rt2800lib: Fix typo on checkingFelipe Pena2013-11-111-1/+1
| | | | | | | | | On rt2800_config_channel_rf53xx function the member default_power1 is checked for bound limit, but default_power2 is used instead. Signed-off-by: Felipe Pena <felipensp@gmail.com> Acked-by: Gertjan van Wingerde <gwingerde@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
* Merge branch 'master' of ↵John W. Linville2013-11-0831-86/+244
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
| * ath9k: enable DFS for IBSS modeSimon Wunderlich2013-11-071-1/+2
| | | | | | | | | | | | Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de> Signed-off-by: Mathias Kretschmer <mathias.kretschmer@fokus.fraunhofer.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * Merge branch 'for-john' of ↵John W. Linville2013-11-0513-29/+43
| |\ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
| | * iwlwifi: mvm: BT Coex - fix copy paste issueEmmanuel Grumbach2013-10-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Putting the context id of the primary phy context in the placeholder of the secondary is obviously a bad idea. Spotted by smatch. Fixes: dac94da8dba3 ("iwlwifi: mvm: new BT Coex API") Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: remove duplicate includesMichael Opdenacker2013-10-292-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Reported by "make includecheck" Tested that the corresponding sources still compile well on x86 Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: warn if firmware image doesn't existJohannes Berg2013-10-292-10/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the firmware image that we attempt to load doesn't actually exist we have a broken firmware file or other code not checking things correctly, so warn in such a case. Also avoid assigning cur_ucode/ucode_loaded then. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: mvm: add missing break in debugfsJohannes Berg2013-10-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | When writing the disable_power_off value, the LPRX enable value also gets written unintentionally, so fix that by adding the missing break statement. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: mvm: capture the FCS in monitor modeJohannes Berg2013-10-292-2/+12
| | | | | | | | | | | | | | | | | | | | | This can be useful when using the device as a sniffer. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: pcie: move warning message into warningJohannes Berg2013-10-291-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Having a WARN_ON() followed by a printed message is less useful than having the message in the warning so move the message. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: mvm: BT Coex fix NULL pointer dereferenceEmmanuel Grumbach2013-10-291-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we disassociate, mac80211 removes the station and then, it sets the bss it unsets the assoc bool in bss_info. Since the firwmware wants it the opposite (first set the MAC context as unassoc, and only then, remove the STA of the API), we have a small period of time in which the STA in firmware doesn't have a valid ieee80211_sta pointer. During that time, iwl_mvm_vif->ap_sta_id, is still set to the STA in firmware that represent the AP. This avoids: [ 4481.476246] BUG: unable to handle kernel NULL pointer dereference at 00000045 [ 4481.479521] IP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm] [ 4481.482023] *pde = 00000000 [ 4481.484332] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC [ 4481.486897] Modules linked in: netconsole configfs autofs4 rfcomm(O) bnep(O) nfsd nfs_acl auth_rpcgss exportfs nfs lockd binfmt_misc sunrpc fscache arc4 iwlmvm(O) mac80211(O) btusb(O) iwlwifi(O) bluetooth(O) cfg80211(O) snd_hda_codec_hdmi coretemp dell_wmi snd_hda_codec_idt compat(O) dell_laptop aesni_intel i915 sparse_keymap dcdbas cryptd psmouse serio_raw aes_i586 microcode snd_hda_intel drm_kms_helper snd_hda_codec drm snd_pcm snd_timer i2c_algo_bit video intel_agp intel_gtt snd soundcore snd_page_alloc crc32c_intel ahci sdhci_pci libahci sdhci mmc_core e1000e xhci_hcd [last unloaded: configfs] [ 4481.502983] [ 4481.505599] Pid: 6507, comm: kworker/0:1 Tainted: G O 3.4.43-dev #1 Dell Inc. Latitude E6430/0CMDYV [ 4481.508575] EIP: 0060:[<f8416a6a>] EFLAGS: 00010246 CPU: 0 [ 4481.511248] EIP is at iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm] [ 4481.513947] EAX: ffffffea EBX: 00000002 ECX: 00000001 EDX: 00000001 [ 4481.516710] ESI: ec6f0f28 EDI: 00000000 EBP: e8175dfc ESP: e8175d9c [ 4481.519445] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 4481.522185] CR0: 8005003b CR2: 00000045 CR3: 01a5e000 CR4: 001407d0 [ 4481.524950] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 4481.527768] DR6: ffff0ff0 DR7: 00000400 [ 4481.530565] Process kworker/0:1 (pid: 6507, ti=e8174000 task=e8032b20 task.ti=e8174000) [ 4481.533447] Stack: [ 4481.536379] e472439f 00003a12 e8032b20 e8033048 00000001 e8175ddc 00000246 e8033040 [ 4481.540132] 00000002 01814990 ec4d1ddc e8175dcc 00000000 00000000 00000000 00000000 [ 4481.543867] 00000000 00000000 00000001 000001c8 009b0002 ec4d1ddc ec6f0f28 00000000 [ 4481.547633] Call Trace: [ 4481.550578] [<f8418027>] iwl_mvm_bt_rssi_event+0x197/0x220 [iwlmvm] [ 4481.553537] [<f840919c>] iwl_mvm_stat_iterator+0xdc/0x240 [iwlmvm] [ 4481.556582] [<f8d129c2>] __iterate_active_interfaces+0xe2/0x1f0 [mac80211] [ 4481.559544] [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm] [ 4481.562519] [<f84090c0>] ? iwl_mvm_update_smps+0x90/0x90 [iwlmvm] [ 4481.565498] [<f8d12b0c>] ieee80211_iterate_active_interfaces+0x3c/0x50 [mac80211] [ 4481.568421] [<f8409b43>] iwl_mvm_rx_statistics+0xb3/0x130 [iwlmvm] [ 4481.571349] [<f8405431>] iwl_mvm_async_handlers_wk+0xc1/0xf0 [iwlmvm] [ 4481.574251] [<c1052915>] ? process_one_work+0x105/0x5c0 [ 4481.577162] [<c1052991>] process_one_work+0x181/0x5c0 [ 4481.580025] [<c1052915>] ? process_one_work+0x105/0x5c0 [ 4481.582861] [<f8405370>] ? iwl_mvm_rx_fw_logs+0x20/0x20 [iwlmvm] [ 4481.585722] [<c10530f1>] worker_thread+0x121/0x2c0 [ 4481.588536] [<c1052fd0>] ? rescuer_thread+0x1d0/0x1d0 [ 4481.591323] [<c105af0d>] kthread+0x7d/0x90 [ 4481.594059] [<c105ae90>] ? flush_kthread_worker+0x120/0x120 [ 4481.596868] [<c15b7cc2>] kernel_thread_helper+0x6/0x10 [ 4481.599605] Code: 9d de c3 c8 85 c0 74 0d 80 3d f8 ae 42 f8 00 0f 84 dc 00 00 00 8b 45 c8 0f b6 d3 31 ff 89 55 c0 8b 84 90 d8 03 00 00 0f b6 55 c7 <38> 50 5b 89 45 bc 0f 84 a8 00 00 00 a1 e4 d2 04 c2 85 c0 0f 84 [ 4481.611782] EIP: [<f8416a6a>] iwl_mvm_bt_coex_reduced_txp+0x7a/0x190 [iwlmvm] SS:ESP 0068:e8175d9c [ 4481.614985] CR2: 0000000000000045 [ 4481.687441] ---[ end trace b11bc915fbac4412 ]--- Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: transport config n_no_reclaim_cmds should be unsignedJohannes Berg2013-10-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The number of commands can never be negative, so it should be using an unsigned type. This also shuts up an smatch warning elsewhere in the code. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| | * iwlwifi: mvm: update UAPSD support TLV bitsAlexander Bondar2013-10-293-7/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | Change old UAPSD bit to PM_CMD_SUPPORT, and add a new bit to indicate real UAPSD support. Don't use UAPSD when the firmware doesn't support it. Signed-off-by: David Spinadel <david.spinadel@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
| * | Merge branch 'for-linville' of ↵John W. Linville2013-11-0516-53/+175
| |\ \ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx
| | * | wlcore: save last regdom configuration on stopEliad Peller2013-10-231-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to reconfigure the correct reg domain on recovery, we have to save the current configuration before clearing it (wl->reg_ch_conf_pending is considered before configuring a new regdomain). Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: fix started_vifs calculationEliad Peller2013-10-231-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | wlcore configures different dwell times according to number of active interfaces (in order to prevent hurting VO during scan). However, determining active vif only according to bss_conf->idle is not explicit enough, and might result in non-started vifs being counted as started as well (e.g. unassociated sta during sta). Fix it by checking for explicit conditions according to the vif type. Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: wakeup from ELP before starting recoveryBarak Bercovitz2013-10-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure the FW is awake when entering recovery. This is useful for reading the FW panic log and also some FW registers giving us crash report stats. We must do this before interrupts are disabled since we rely on an interrupt to complete the wakeup. If the wakeup fails, continue recovery normally. All read/writes will be blocked and won't do any harm. Signed-off-by: Barak Bercovitz <barak@wizery.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: Allow stopping fw log in recoveryBarak Bercovitz2013-10-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The FW panic log is read during recovery work. It has to be stopped properly before reading. otherwise, inconsistent data might be read which cause the driver to freeze. __wlcore_cmd_send has to work for the special case of CMD_STOP_FWLOGGER, while in recovery, in order to stop the fw log before it is read. Signed-off-by: Barak Bercovitz <barak@wizery.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: read fw panic log only in host modeBarak Bercovitz2013-10-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reading FW panic log is only supported in host mode (SDIO) Signed-off-by: Barak Bercovitz <barak@wizery.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore/wl18xx/wl12xx: FW log params per chip archIgal Chernobelsky2013-10-237-23/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FW memory block size and FW log end marker parameters are added to wl structure and are initialized per chip architecture. convert_hwaddr hw operation is added to convert chip dependent FW internal address. Copy from FW log is also simplified to copy the entire memory block as FW logger utility is repsponsible for parsing of FW log content. Signed-off-by: Igal Chernobelsky <igalc@ti.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wl12xx/wl18xx: update default fw logger's settingsIdo Reis2013-10-232-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | update the fw logger mode to continuous, and output to dbgpins (uart). Signed-off-by: Ido Reis <idor@ti.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: fwlog dynamic mem_block controlIdo Reis2013-10-232-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | number of fwlog mem_blocks can be configured using module param. this is a fw debug feature: in case a large fw log data is busrted during a short period of time, the memory get filled and data is lost. this allows us to dynamicly set the fw log mem_block usage, although configuring more mem_block for logger comes at the expense of TP. Signed-off-by: Yair Shapira <yair.shapira@ti.com> Signed-off-by: Ido Reis <idor@ti.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: fix interrogate command lengthIgal Chernobelsky2013-10-234-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change interrogate command prototype to have command size and returned buffer length. This fixes the issue when command parameters are needed to be passed to FW in addition to acx header as in the case with get RSSI command, where role_id has to be passed. Signed-off-by: Igal Chernobelsky <igalc@ti.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: add ap_event_maskEliad Peller2013-10-236-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new ap_event_mask field, to indicate events that should be unmasked only when there's an ap interface. This is done in order to avoid spurious wakeups when we don't care about the incoming event anyway. Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wlcore: print active channel in the driver_stateVictor Goldenshtein2013-10-231-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Print current active channel/s and a role type for that channel in the driver_state debugfs. Signed-off-by: Victor Goldenshtein <victorg@ti.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| | * | wl18xx: default config alignment with phy defaultsIgal Chernobelsky2013-10-231-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Driver default config is aligned with phy default parameters. Now that RDL1_3 has 2 antennas defined by default we need to explicitly define ht.mode to HT_MODE_WIDE to have SISO40 as default. Signed-off-by: Yair Shapira <yair.shapira@ti.com> Signed-off-by: Igal Chernobelsky <igalc@ti.com> Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
| * | | Merge branch 'for-john' of ↵John W. Linville2013-11-051-3/+24
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Conflicts: net/wireless/reg.c
| | * | | mac80211_hwsim: Fix tracking of beaconing for multi-vifJouni Malinen2013-10-281-3/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mac80211_hwsim canceled beacon_timer on any vif changing from enabled to disabled beaconing. This breaks cases where there are multiple beaconing vifs and only one of them is removed. Fix this by tracking beaconing status per vif and disable beacon_timer only if no active vif remain with beaconing enabled. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* | | | | Merge branch 'master' of ↵John W. Linville2013-11-04108-2771/+8703
|\ \ \ \ \ | |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem Conflicts: drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
| * | | | Merge branch 'master' of ↵John W. Linville2013-11-0437-155/+224
| |\ \ \ \ | | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless Conflicts: drivers/net/wireless/iwlwifi/pcie/drv.c
| | * | | drivers: net: wireless: b43: Fix possible NULL ptr dereferenceFelipe Pena2013-10-181-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On the ternary expression the 'e' variable could be NULL dereferenced, when b43_nphy_get_rf_ctl_over_rev7 function returns NULL. Signed-off-by: Felipe Pena <felipensp@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | rt2800usb: slow down TX status pollingStanislaw Gruszka2013-10-181-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Polling TX statuses too frequently has two negative effects. First is randomly peek CPU usage, causing overall system functioning delays. Second bad effect is that device is not able to fill TX statuses in H/W register on some workloads and we get lot of timeouts like below: ieee80211 phy4: rt2800usb_entry_txstatus_timeout: Warning - TX status timeout for entry 7 in queue 2 ieee80211 phy4: rt2800usb_entry_txstatus_timeout: Warning - TX status timeout for entry 7 in queue 2 ieee80211 phy4: rt2800usb_txdone: Warning - Got TX status for an empty queue 2, dropping This not only cause flood of messages in dmesg, but also bad throughput, since rate scaling algorithm can not work optimally. In the future, we should probably make polling interval be adjusted automatically, but for now just increase values, this make mentioned problems gone. Resolve: https://bugzilla.kernel.org/show_bug.cgi?id=62781 Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | rt2x00: check if device is still available on rt2x00mac_flush()Stanislaw Gruszka2013-10-181-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix random kernel panic with below messages when remove dongle. [ 2212.355447] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250 [ 2212.355527] IP: [<ffffffffa02667f2>] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb] [ 2212.355599] PGD 0 [ 2212.355626] Oops: 0000 [#1] SMP [ 2212.355664] Modules linked in: rt2800usb rt2x00usb rt2800lib crc_ccitt rt2x00lib mac80211 cfg80211 tun arc4 fuse rfcomm bnep snd_hda_codec_realtek snd_hda_intel snd_hda_codec btusb uvcvideo bluetooth snd_hwdep x86_pkg_temp_thermal snd_seq coretemp aesni_intel aes_x86_64 snd_seq_device glue_helper snd_pcm ablk_helper videobuf2_vmalloc sdhci_pci videobuf2_memops videobuf2_core sdhci videodev mmc_core serio_raw snd_page_alloc microcode i2c_i801 snd_timer hid_multitouch thinkpad_acpi lpc_ich mfd_core snd tpm_tis wmi tpm tpm_bios soundcore acpi_cpufreq i915 i2c_algo_bit drm_kms_helper drm i2c_core video [last unloaded: cfg80211] [ 2212.356224] CPU: 0 PID: 34 Comm: khubd Not tainted 3.12.0-rc3-wl+ #3 [ 2212.356268] Hardware name: LENOVO 3444CUU/3444CUU, BIOS G6ET93WW (2.53 ) 02/04/2013 [ 2212.356319] task: ffff880212f687c0 ti: ffff880212f66000 task.ti: ffff880212f66000 [ 2212.356392] RIP: 0010:[<ffffffffa02667f2>] [<ffffffffa02667f2>] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb] [ 2212.356481] RSP: 0018:ffff880212f67750 EFLAGS: 00010202 [ 2212.356519] RAX: 000000000000000c RBX: 000000000000000c RCX: 0000000000000293 [ 2212.356568] RDX: ffff8801f4dc219a RSI: 0000000000000000 RDI: 0000000000000240 [ 2212.356617] RBP: ffff880212f67778 R08: ffffffffa02667e0 R09: 0000000000000002 [ 2212.356665] R10: 0001f95254ab4b40 R11: ffff880212f675be R12: ffff8801f4dc2150 [ 2212.356712] R13: 0000000000000000 R14: ffffffffa02667e0 R15: 000000000000000d [ 2212.356761] FS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000 [ 2212.356813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2212.356852] CR2: 0000000000000250 CR3: 0000000001a0c000 CR4: 00000000001407f0 [ 2212.356899] Stack: [ 2212.356917] 000000000000000c ffff8801f4dc2150 0000000000000000 ffffffffa02667e0 [ 2212.356980] 000000000000000d ffff880212f677b8 ffffffffa03a31ad ffff8801f4dc219a [ 2212.357038] ffff8801f4dc2150 0000000000000000 ffff8800b93217a0 ffff8801f49bc800 [ 2212.357099] Call Trace: [ 2212.357122] [<ffffffffa02667e0>] ? rt2x00usb_interrupt_txdone+0x90/0x90 [rt2x00usb] [ 2212.357174] [<ffffffffa03a31ad>] rt2x00queue_for_each_entry+0xed/0x170 [rt2x00lib] [ 2212.357244] [<ffffffffa026701c>] rt2x00usb_kick_queue+0x5c/0x60 [rt2x00usb] [ 2212.357314] [<ffffffffa03a3682>] rt2x00queue_flush_queue+0x62/0xa0 [rt2x00lib] [ 2212.357386] [<ffffffffa03a2930>] rt2x00mac_flush+0x30/0x70 [rt2x00lib] [ 2212.357470] [<ffffffffa04edded>] ieee80211_flush_queues+0xbd/0x140 [mac80211] [ 2212.357555] [<ffffffffa0502e52>] ieee80211_set_disassoc+0x2d2/0x3d0 [mac80211] [ 2212.357645] [<ffffffffa0506da3>] ieee80211_mgd_deauth+0x1d3/0x240 [mac80211] [ 2212.357718] [<ffffffff8108b17c>] ? try_to_wake_up+0xec/0x290 [ 2212.357788] [<ffffffffa04dbd18>] ieee80211_deauth+0x18/0x20 [mac80211] [ 2212.357872] [<ffffffffa0418ddc>] cfg80211_mlme_deauth+0x9c/0x140 [cfg80211] [ 2212.357913] [<ffffffffa041907c>] cfg80211_mlme_down+0x5c/0x60 [cfg80211] [ 2212.357962] [<ffffffffa041cd18>] cfg80211_disconnect+0x188/0x1a0 [cfg80211] [ 2212.358014] [<ffffffffa04013bc>] ? __cfg80211_stop_sched_scan+0x1c/0x130 [cfg80211] [ 2212.358067] [<ffffffffa03f8954>] cfg80211_leave+0xc4/0xe0 [cfg80211] [ 2212.358124] [<ffffffffa03f8d1b>] cfg80211_netdev_notifier_call+0x3ab/0x5e0 [cfg80211] [ 2212.358177] [<ffffffff815140f8>] ? inetdev_event+0x38/0x510 [ 2212.358217] [<ffffffff81085a94>] ? __wake_up+0x44/0x50 [ 2212.358254] [<ffffffff8155995c>] notifier_call_chain+0x4c/0x70 [ 2212.358293] [<ffffffff81081156>] raw_notifier_call_chain+0x16/0x20 [ 2212.358361] [<ffffffff814b6dd5>] call_netdevice_notifiers_info+0x35/0x60 [ 2212.358429] [<ffffffff814b6ec9>] __dev_close_many+0x49/0xd0 [ 2212.358487] [<ffffffff814b7028>] dev_close_many+0x88/0x100 [ 2212.358546] [<ffffffff814b8150>] rollback_registered_many+0xb0/0x220 [ 2212.358612] [<ffffffff814b8319>] unregister_netdevice_many+0x19/0x60 [ 2212.358694] [<ffffffffa04d8eb2>] ieee80211_remove_interfaces+0x112/0x190 [mac80211] [ 2212.358791] [<ffffffffa04c585f>] ieee80211_unregister_hw+0x4f/0x100 [mac80211] [ 2212.361994] [<ffffffffa03a1221>] rt2x00lib_remove_dev+0x161/0x1a0 [rt2x00lib] [ 2212.365240] [<ffffffffa0266e2e>] rt2x00usb_disconnect+0x2e/0x70 [rt2x00usb] [ 2212.368470] [<ffffffff81419ce4>] usb_unbind_interface+0x64/0x1c0 [ 2212.371734] [<ffffffff813b446f>] __device_release_driver+0x7f/0xf0 [ 2212.374999] [<ffffffff813b4503>] device_release_driver+0x23/0x30 [ 2212.378131] [<ffffffff813b3c98>] bus_remove_device+0x108/0x180 [ 2212.381358] [<ffffffff813b0565>] device_del+0x135/0x1d0 [ 2212.384454] [<ffffffff81417760>] usb_disable_device+0xb0/0x270 [ 2212.387451] [<ffffffff8140d9cd>] usb_disconnect+0xad/0x1d0 [ 2212.390294] [<ffffffff8140f6cd>] hub_thread+0x63d/0x1660 [ 2212.393034] [<ffffffff8107c860>] ? wake_up_atomic_t+0x30/0x30 [ 2212.395728] [<ffffffff8140f090>] ? hub_port_debounce+0x130/0x130 [ 2212.398412] [<ffffffff8107baa0>] kthread+0xc0/0xd0 [ 2212.401058] [<ffffffff8107b9e0>] ? insert_kthread_work+0x40/0x40 [ 2212.403639] [<ffffffff8155de3c>] ret_from_fork+0x7c/0xb0 [ 2212.406193] [<ffffffff8107b9e0>] ? insert_kthread_work+0x40/0x40 [ 2212.408732] Code: 24 58 08 00 00 bf 80 00 00 00 e8 3a c3 e0 e0 5b 41 5c 5d c3 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 <48> 8b 47 10 48 89 fb 4c 8b 6f 28 4c 8b 20 49 8b 04 24 4c 8b 30 [ 2212.414671] RIP [<ffffffffa02667f2>] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb] [ 2212.417646] RSP <ffff880212f67750> [ 2212.420547] CR2: 0000000000000250 [ 2212.441024] ---[ end trace 5442918f33832bce ]--- Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl> Acked-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | rt2400pci: fix RSSI readStanislaw Gruszka2013-10-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RSSI value is provided on word3 not on word2. Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | ath5k: fix regression in tx status processingFelix Fietkau2013-10-181-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regression was introduced in the following commit: 0967e01e8e713ed2982fb4eba8ba13794e9a6e89 "ath5k: make use of the new rate control API" ath5k_tx_frame_completed saves the intended per-rate retry counts before they are cleared by ieee80211_tx_info_clear_status, however at this point the information in info->status.rates is incomplete. This causes significant throughput degradation and excessive packet loss on links where high bit rates don't work properly. Move the copy from bf->rates a few lines up to ensure that the saved retry counts are updated, and that they are really cleared in info->status.rates after the call to ieee80211_tx_info_clear_status. Cc: stable@vger.kernel.org # 3.10+ Cc: Thomas Huehn <thomas@net.t-labs.tu-berlin.de> Cc: Benjamin Vahl <bvahl@net.t-labs.tu-berlin.de> Reported-by: Ben West <ben@gowasabi.net> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Acked-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | Merge branch 'for-john' of ↵John W. Linville2013-10-184-30/+43
| | |\ \ \ | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
| | | * | | iwlwifi: dvm: don't override mac80211's queue settingEmmanuel Grumbach2013-10-181-11/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since we set IEEE80211_HW_QUEUE_CONTROL, we can let mac80211 do the queue assignement and don't need to override its decisions. While reassiging the same values is harmless of course, it triggered a WARNING when iwlwifi and mac80211 came to different conclusions. This happened when mac80211 set IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the packet to the cab_queue because no stations were asleep. iwlwifi should not override mac80211's decicions for offchannel packets and packets to be sent after DTIM, but it should override mac80211's decision for AMPDUs since we have a special queue for them. So for AMPDU, we still override info->hw_queue by the AMPDU queue. This avoids: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883() Modules linked in: CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1 Hardware name: /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000 ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000 ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e Call Trace: [<ffffffff8189aa62>] ? dump_stack+0x41/0x51 [<ffffffff8105a4f2>] ? warn_slowpath_common+0x78/0x90 [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883 [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883 [<ffffffff818a0040>] ? put_cred+0x15/0x15 [<ffffffff815f6db4>] ? iwlagn_mac_tx+0x19/0x2f [<ffffffff8186cc45>] ? __ieee80211_tx+0x226/0x29b [<ffffffff8186e6bd>] ? ieee80211_tx+0xa6/0xb5 [<ffffffff8186e98b>] ? ieee80211_monitor_start_xmit+0x1e9/0x204 [<ffffffff8171ce5f>] ? dev_hard_start_xmit+0x271/0x3ec [<ffffffff817351ac>] ? sch_direct_xmit+0x66/0x164 [<ffffffff8171d1bf>] ? dev_queue_xmit+0x1e5/0x3c8 [<ffffffff817fac5a>] ? packet_sendmsg+0xac5/0xb3d [<ffffffff81709a09>] ? sock_sendmsg+0x37/0x52 [<ffffffff810f9e0c>] ? __do_fault+0x338/0x36b [<ffffffff81713820>] ? verify_iovec+0x44/0x94 [<ffffffff81709e63>] ? ___sys_sendmsg+0x1f1/0x283 [<ffffffff81140a73>] ? __inode_wait_for_writeback+0x67/0xae [<ffffffff8111735e>] ? __cache_free.isra.46+0x178/0x187 [<ffffffff811173b1>] ? kmem_cache_free+0x44/0x84 [<ffffffff81132c22>] ? dentry_kill+0x13d/0x149 [<ffffffff81132f6f>] ? dput+0xe5/0xef [<ffffffff81136e04>] ? fget_light+0x2e/0x7c [<ffffffff8170ae62>] ? __sys_sendmsg+0x39/0x57 [<ffffffff818a7e39>] ? system_call_fastpath+0x16/0x1b ---[ end trace 1b3eb79359c1d1e6 ]--- Reported-by: Sander Eikelenboom <linux@eikelenboom.it> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | | iwlwifi: mvm: fix scan request's suspend time parameterAlexander Bondar2013-10-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fix is related to a scan request when associated (bgscan). FW expects suspend time parameter in micro seconds while the driver provides a value in time units. This bug leads to a high traffic latency when scan is requested while traffic is in progress. Signed-off-by: Alexander Bondar <alexander.bondar@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | | iwlwifi: don't WARN on bad firmware stateStanislaw Gruszka2013-10-111-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we restart firmware and it is marked as not alive, we can still get calls from mac80211. Don't WARN on in this situation as this triggers automatic bug reports with no valuable information. This continuation of: commit 8ca95995e64f5d270889badb3e449dca91106a2b Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Date: Sun Sep 15 11:37:17 2013 +0300 iwlwifi: don't WARN on host commands sent when firmware is dead which remove WARN_ONCE from one place, but those warnings are also triggered from other functions. Patch also adds unlikely() statement. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | | * | | iwlwifi: pcie: poke device when commands don't complete quicklyJohannes Berg2013-10-111-5/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In certain corner cases in the firmware implementation, powersave transitions can cause the firmware to miss the fact that commands were added to the queue/FIFO and thus never processes them. Since the commands really are in the queue, try to poke the firmware in such cases (by grabbing NIC access, which wakes up the NIC) so it notices the new command and processes it. Reviewed-by: Alexander Bondar <alexander.bondar@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
OpenPOWER on IntegriCloud