OSDN Git Service
Alexander Aring [Tue, 29 Jul 2014 21:47:00 +0000 (23:47 +0200)]
6lowpan: iphc: cleanup use of lowpan_fetch_skb
We introduced the lowpan_fetch_skb function in some previous patches for
6lowpan to have a generic fetch function. This patch drops the old
function and use the generic lowpan_fetch_skb one.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Alexander Aring [Tue, 29 Jul 2014 21:46:59 +0000 (23:46 +0200)]
6lowpan: iphc: use sizeof in udp uncompression
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Alexander Aring [Tue, 29 Jul 2014 21:46:58 +0000 (23:46 +0200)]
6lowpan: iphc: rename hc06_ptr pointer to hc_ptr
The hc06_ptr pointer variable stands for header compression draft-06. We
are mostly rfc complaint. This patch rename the variable to normal hc_ptr.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Johan Hedberg [Tue, 29 Jul 2014 11:18:48 +0000 (14:18 +0300)]
Bluetooth: Fix SMP context tracking leading to a kernel crash
The HCI_CONN_LE_SMP_PEND flag is supposed to indicate whether we have an
SMP context or not. If the context creation fails, or some other error
is indicated between setting the flag and creating the context the flag
must be cleared first.
This patch ensures that smp_chan_create() clears the flag in case of
allocation failure as well as reorders code in smp_cmd_security_req()
that could lead to returning an error between setting the flag and
creating the context.
Without the patch the following kind of kernel crash could be observed
(this one because of unacceptable authentication requirements in a
Security Request):
[ +0.000855] kernel BUG at net/bluetooth/smp.c:606!
[ +0.000000] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ +0.000000] CPU: 0 PID: 58 Comm: kworker/u5:2 Tainted: G W 3.16.0-rc1+ #785
[ +0.008391] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ +0.000000] Workqueue: hci0 hci_rx_work
[ +0.000000] task:
f4dc8f90 ti:
f4ef0000 task.ti:
f4ef0000
[ +0.000000] EIP: 0060:[<
c13432b6>] EFLAGS:
00010246 CPU: 0
[ +0.000000] EIP is at smp_chan_destroy+0x1e/0x145
[ +0.000709] EAX:
f46db870 EBX:
00000000 ECX:
00000000 EDX:
00000005
[ +0.000000] ESI:
f46db870 EDI:
f46db870 EBP:
f4ef1dc0 ESP:
f4ef1db0
[ +0.000000] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ +0.000000] CR0:
8005003b CR2:
b666b0b0 CR3:
00022000 CR4:
00000690
[ +0.000000] DR0:
00000000 DR1:
00000000 DR2:
00000000 DR3:
00000000
[ +0.000000] DR6:
fffe0ff0 DR7:
00000400
[ +0.000000] Stack:
[ +0.000000]
00000005 f17b7840 f46db870 f4ef1dd4 f4ef1de4 c1343441 c134342e 00000000
[ +0.000000]
c1343441 00000005 00000002 00000000 f17b7840 f4ef1e38 c134452a 00002aae
[ +0.000000]
01ef1e00 00002aae f46bd980 f46db870 00000039 ffffffff 00000007 f4ef1e34
[ +0.000000] Call Trace:
[ +0.000000] [<
c1343441>] smp_failure+0x64/0x6c
[ +0.000000] [<
c134342e>] ? smp_failure+0x51/0x6c
[ +0.000000] [<
c1343441>] ? smp_failure+0x64/0x6c
[ +0.000000] [<
c134452a>] smp_sig_channel+0xad6/0xafc
[ +0.000000] [<
c1053b61>] ? vprintk_emit+0x343/0x366
[ +0.000000] [<
c133f34e>] l2cap_recv_frame+0x1337/0x1ac4
[ +0.000000] [<
c133f34e>] ? l2cap_recv_frame+0x1337/0x1ac4
[ +0.000000] [<
c1172307>] ? __dynamic_pr_debug+0x3e/0x40
[ +0.000000] [<
c11702a1>] ? debug_smp_processor_id+0x12/0x14
[ +0.000000] [<
c1340bc9>] l2cap_recv_acldata+0xe8/0x239
[ +0.000000] [<
c1340bc9>] ? l2cap_recv_acldata+0xe8/0x239
[ +0.000000] [<
c1169931>] ? __const_udelay+0x1a/0x1c
[ +0.000000] [<
c131f120>] hci_rx_work+0x1a1/0x286
[ +0.000000] [<
c137244e>] ? mutex_unlock+0x8/0xa
[ +0.000000] [<
c131f120>] ? hci_rx_work+0x1a1/0x286
[ +0.000000] [<
c1038fe5>] process_one_work+0x128/0x1df
[ +0.000000] [<
c1038fe5>] ? process_one_work+0x128/0x1df
[ +0.000000] [<
c10392df>] worker_thread+0x222/0x2de
[ +0.000000] [<
c10390bd>] ? process_scheduled_works+0x21/0x21
[ +0.000000] [<
c103d34c>] kthread+0x82/0x87
[ +0.000000] [<
c1040000>] ? create_new_namespaces+0x90/0x105
[ +0.000000] [<
c13738e1>] ret_from_kernel_thread+0x21/0x30
[ +0.000000] [<
c103d2ca>] ? __kthread_parkme+0x50/0x50
[ +0.000000] Code: 65 f4 89 f0 5b 5e 5f 5d 8d 67 f8 5f c3 57 8d 7c 24 08 83 e4 f8 ff 77 fc 55 89 e5 57 89 c7 56 53 52 8b 98 e0 00 00 00 85 db 75 02 <0f> 0b 8b b3 80 00 00 00 8b 00 c1 ee 03 83 e6 01 89 f2 e8 ef 09
[ +0.000000] EIP: [<
c13432b6>] smp_chan_destroy+0x1e/0x145 SS:ESP 0068:
f4ef1db0
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Hans de Goede [Tue, 29 Jul 2014 12:23:23 +0000 (14:23 +0200)]
brcmfmac: Fix OOB interrupt not working for BCM43362
It has taken me a long long time to get the OOB interrupt working on the
AP6210 sdio wifi/bt module found on various Allwinner A20 boards. In the
end I found these magic register pokes in the cubietruck kernel tree:
https://github.com/cubieboard2/linux-sunxi/commit/
7f08ba395617d17e7a711507503d89a50406fe7a
This is also done for the bcm43362 in broadcom's internal/proprietary driver.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
[arend@broadcom.com: rebased changing BCM43362 chip id to fix compilation]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rajkumar Manoharan [Sat, 26 Jul 2014 04:55:41 +0000 (10:25 +0530)]
ath9k: Initialize channel context ops on ahb probe
Not doing so, could fail on device probing when use_chanctx
module param is set to true.
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Thu, 24 Jul 2014 13:29:19 +0000 (15:29 +0200)]
bcma: add support for BCM43131 that was found in Tenda W311E
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Thu, 24 Jul 2014 13:29:18 +0000 (15:29 +0200)]
b43: add support for BCM43131 chipset with N-PHY rev 17
It contains radio 0x2057 rev 14 just like a BCM43217, so it doesn't
require any magic. The main difference is that BCM4313 is 1x1:1.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Hans de Goede [Sun, 29 Jun 2014 14:17:00 +0000 (16:17 +0200)]
brcmfmac: Fix some wrong register defines
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Chen-Yu Tsai [Sun, 29 Jun 2014 14:16:59 +0000 (16:16 +0200)]
brcmfmac: add device tree support for SDIO devices
brcmfmac devices can use an out-of-band interrupt on a GPIO line.
Currently this is specified using platform data. Add support for
specifying out-of-band interrupt via device tree.
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
[arend@broadcom.com: conditionalize more of-code, use driver debug routines]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
[hdegoede@redhat.com: drop clk / reg_on gpio handling, as there is no consensus
on how to handle this yet]
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Arend van Spriel [Sun, 29 Jun 2014 14:16:58 +0000 (16:16 +0200)]
dt: bindings: add bindings for Broadcom bcm43xx sdio devices
The Broadcom bcm43xx sdio devices are fullmac devices that may be
integrated in ARM platforms. Currently, the brcmfmac driver for
these devices support use of platform data. This patch specifies
the bindings that allow this platform data to be expressed in the
devicetree.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
[hdegoede@redhat.com: drop clk / reg_on gpio handling, as there is no consensus
on how to handle this yet]
[hdegoede@redhat.com: move from bindings/staging to bindings]
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Tue, 29 Jul 2014 14:32:36 +0000 (10:32 -0400)]
Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next
John W. Linville [Tue, 29 Jul 2014 14:32:12 +0000 (10:32 -0400)]
Merge tag 'for-linville-
20140725' of git://github.com/kvalo/ath
John W. Linville [Tue, 29 Jul 2014 14:31:20 +0000 (10:31 -0400)]
Merge tag 'nfc-next-3.17-1' of git://git./linux/kernel/git/sameo/nfc-next
Samuel Ortiz <sameo@linux.intel.com> says:
"NFC: 3.17 pull request
This is the NFC pull request for 3.17.
This is a rather quiet one, we have:
- A new driver from ST Microelectronics for their NCI ST21NFCB,
including device tree support.
- p2p support for the ST21NFCA driver
- A few fixes an enhancements for the NFC digital layer"
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Johan Hedberg [Mon, 28 Jul 2014 17:53:58 +0000 (20:53 +0300)]
Bluetooth: Fix incorrectly disabling page scan when toggling connectable
If we have entries in the whitelist we shouldn't disable page scanning
when disabling connectable mode. This patch adds the necessary check to
the Set Connectable command handler.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Johan Hedberg [Mon, 28 Jul 2014 12:45:31 +0000 (15:45 +0300)]
Bluetooth: Fix clearing HCI_PSCAN flag
This patch fixes a typo in the hci_cc_write_scan_enable() function where
we want to clear the HCI_PSCAN flag if the SCAN_PAGE bit of the HCI
command parameter was not set.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Alexander Aring [Mon, 28 Jul 2014 13:16:30 +0000 (15:16 +0200)]
MAINTAINERS: add 6lowpan header file
Since commit
68d96dcfc6c09b565d57897c127b61afbab74c6f ("MAINTAINERS: add
net/6lowpan/ maintainer entry") we have a 6lowpan branch. This patch
adds a forgotten file which should also be maintained by this branch.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Marcel Holtmann [Thu, 24 Jul 2014 18:04:16 +0000 (20:04 +0200)]
Bluetooth: Set Simultaneous LE and BR/EDR controller option to zero
With the Bluetooth 4.1 specification the Simultaneous LE and BR/EDR
controller option has been deprecated. It shall be set to zero and
ignored otherwise.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Georg Lukas [Sat, 26 Jul 2014 11:59:58 +0000 (13:59 +0200)]
Bluetooth: Expose default LE advertising interval via debugfs
Expose the default values for minimum and maximum LE advertising
interval via debugfs for testing purposes.
Signed-off-by: Georg Lukas <georg@op-co.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Georg Lukas [Sat, 26 Jul 2014 11:59:57 +0000 (13:59 +0200)]
Bluetooth: Provide defaults for LE advertising interval
Store the default values for minimum and maximum advertising interval
with all the other controller defaults. These vaules are sent to the
adapter whenever advertising is (re)enabled.
Signed-off-by: Georg Lukas <georg@op-co.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Marcel Holtmann [Thu, 24 Jul 2014 13:20:58 +0000 (15:20 +0200)]
Bluetooth: Fix white list handling with resolvable private addresses
Devices using resolvable private addresses are required to provide
an identity resolving key. These devices can not be found using
the current controller white list support. This means if the kernel
knows about any devices with an identity resolving key, the white
list filtering must be disabled.
However so far the kernel kept identity resolving keys around even
for devices that are not using resolvable private addresses. The
notification to userspace clearly hints to not store the key and
so it is best to just remove the key from the kernel as well at
that point.
With this it easy now to detect when using the white list is
possible or when kernel side resolving of addresses is required.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Marcel Holtmann [Thu, 24 Jul 2014 13:20:57 +0000 (15:20 +0200)]
Bluetooth: Add support for using controller white list filtering
The Bluetooth controller can use a white list filter when scanning
to avoid waking up the host for devices that are of no interest.
Devices marked as reporting, direct connection (incoming) or general
connection are now added to the controller white list. The update of
the white list happens just before enabling passive scanning.
In case the white list is full and can not hold all devices, the
white list is not used and the filter policy set to accept all
advertisements.
Using the white list for scanning allows for power saving with
controllers that do not handle the duplicate filtering correctly.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
John W. Linville [Fri, 25 Jul 2014 14:22:36 +0000 (10:22 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless
Conflicts:
net/mac80211/cfg.c
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Janusz Dziedzic [Fri, 25 Jul 2014 08:28:50 +0000 (11:28 +0300)]
ath10k: handle attention flags correctly when using A-MSDU
In case of A-MSDU RX we should check attention flags
correctly to be sure we report correct FCS status for
A-MSDU subframes. Without a patch we could report A-MSDU
subframes with wrong FCS as a correct to the stack, next
get a lot of DUP ACK TCP packets. Finally TP drop is seen
and this drop depends on FCS errors ratio for A-MSDU frame.
Example test case when TP drop is seen:
- ath10k configured as an AP
- used ath10k station
- forced A-MSDU (7 frames) on STA
- other traffic on channel (often FCS errors)
- monitor iface added on AP
- TCP STA -> AP traffic (iperf)
a) Iperf logs for case without the patch:
echo "1 64" > htt_max_amsdu_ampdu // disable A-MSDU
[ ID] Interval Transfer Bandwidth
[ 3] 0.0- 5.0 sec 56.6 MBytes 95.0 Mbits/sec
[ 3] 5.0-10.0 sec 60.4 MBytes 101 Mbits/sec
[ 3] 10.0-15.0 sec 60.2 MBytes 101 Mbits/sec
[ 3] 15.0-20.0 sec 60.2 MBytes 101 Mbits/sec
[ 3] 20.0-25.0 sec 63.8 MBytes 107 Mbits/sec
[ 3] 25.0-30.0 sec 64.9 MBytes 109 Mbits/sec
echo "7 64" > htt_max_amsdu_ampdu // set 7 A-MSDU subframes
[ 3] 30.0-35.0 sec 40.0 MBytes 67.1 Mbits/sec
[ 3] 35.0-40.0 sec 35.9 MBytes 60.2 Mbits/sec
[ 3] 40.0-45.0 sec 36.9 MBytes 61.9 Mbits/sec
[ 3] 45.0-50.0 sec 37.9 MBytes 63.5 Mbits/sec
[ 3] 50.0-55.0 sec 34.5 MBytes 57.9 Mbits/sec
[ 3] 55.0-60.0 sec 25.4 MBytes 42.6 Mbits/sec
[ 3] 60.0-65.0 sec 48.2 MBytes 81.0 Mbits/sec
[ 3] 65.0-70.0 sec 28.8 MBytes 48.2 Mbits/sec
[ 3] 70.0-75.0 sec 29.2 MBytes 49.1 Mbits/sec
[ 3] 75.0-80.0 sec 22.9 MBytes 38.4 Mbits/sec
[ 3] 80.0-85.0 sec 26.4 MBytes 44.2 Mbits/sec
[ 3] 85.0-90.0 sec 31.5 MBytes 52.8 Mbits/sec
b) Iperf logs for case with patch:
echo "1 64" > htt_max_amsdu_ampdu // disable A-MSDU
[ 3] local 192.168.12.2 port 57512 connected with 192.168.12.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0- 5.0 sec 60.8 MBytes 102 Mbits/sec
[ 3] 5.0-10.0 sec 62.2 MBytes 104 Mbits/sec
[ 3] 10.0-15.0 sec 60.9 MBytes 102 Mbits/sec
echo "7 64" > htt_max_amsdu_ampdu // set 7 A-MSDU subframes
[ 3] 15.0-20.0 sec 68.1 MBytes 114 Mbits/sec
[ 3] 20.0-25.0 sec 80.5 MBytes 135 Mbits/sec
[ 3] 25.0-30.0 sec 83.0 MBytes 139 Mbits/sec
[ 3] 30.0-35.0 sec 79.1 MBytes 133 Mbits/sec
[ 3] 35.0-40.0 sec 77.1 MBytes 129 Mbits/sec
[ 3] 40.0-45.0 sec 77.4 MBytes 130 Mbits/sec
Reported-by: Denton Gentry <denton.gentry@gmail.com>
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior [Thu, 24 Jul 2014 17:07:00 +0000 (20:07 +0300)]
ath10k: don't advertise IBSS iftype for 10.x
The 10.x firmware does not support IBSS mode at
all. It can't beacon and it crashes when trying to
scan.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior [Wed, 23 Jul 2014 10:20:33 +0000 (12:20 +0200)]
ath10k: fix Rx aggregation reordering
Firmware doesn't perform Rx reordering so it is
left to the host driver to do that.
Use mac80211 to perform reordering instead of
re-inventing the wheel.
This fixes TCP throughput issues in some
environments.
Reported-by: Denton Gentry <denton.gentry@gmail.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Kalle Valo [Thu, 24 Jul 2014 17:06:37 +0000 (20:06 +0300)]
Merge remote-tracking branch 'wireless-next/master' into ath-next
Marcel Holtmann [Wed, 23 Jul 2014 19:55:23 +0000 (21:55 +0200)]
Bluetooth: Fix issue with ADV_IND reports and auto-connection handling
When adding remote devices to the kernel using the Add Device management
command, these devices are explicitly allowed to connect. This kind of
incoming connections are possible even when the controller itself is
not connectable.
For BR/EDR this distinction is pretty simple since there is only one
type of incoming connections. With LE this is not that simple anymore
since there are ADV_IND and ADV_DIRECT_IND advertising events.
The ADV_DIRECT_IND advertising events are send for incoming (slave
initiated) connections only. And this is the only thing the kernel
should allow when adding devices using action 0x01. This meaning
of incoming connections is coming from BR/EDR and needs to be
mapped to LE the same way.
Supporting the auto-connection of devices using ADV_IND advertising
events is an important feature as well. However it does not map to
incoming connections. So introduce a new action 0x02 that allows
the kernel to connect to devices using ADV_DIRECT_IND and in addition
ADV_IND advertising reports.
This difference is represented by the new HCI_AUTO_CONN_DIRECT value
for only connecting to ADV_DIRECT_IND. For connection to ADV_IND and
ADV_DIRECT_IND the old value HCI_AUTO_CONN_ALWAYS is used.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Marcel Holtmann [Wed, 23 Jul 2014 19:55:22 +0000 (21:55 +0200)]
Bluetooth: Ignore ADV_DIRECT_IND attempts from unknown devices
Unconditionally connecting to devices sending ADV_DIRECT_IND when
the controller is in CONNECTABLE mode is a feature that is not
fully working. The background scanning trigger for this has been
removed, but the statement allowing it to happen in case some
other part triggers is still present. So remove that code part
as well to avoid unwanted connections.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Marcel Holtmann [Wed, 23 Jul 2014 17:24:57 +0000 (19:24 +0200)]
Bluetooth: Get MWS transport configuration of the controller
If the Bluetooth controller supports Get MWS Transport Layer
Configuration command, then issue it during initialization.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Marcel Holtmann [Wed, 23 Jul 2014 17:24:56 +0000 (19:24 +0200)]
Bluetooth: Read list of local codecs supported by the controller
If the Bluetooth controller supports Read Local Supported Codecs
command, then issue it during initialization so that the list of
codecs is known.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Rafał Miłecki [Wed, 23 Jul 2014 16:54:50 +0000 (18:54 +0200)]
b43: enable 5 GHz support for N-PHY devices
This has been tested on 14e4:4328 (BCM4321), 14e4:432b (BCM4322),
14e4:4353 (BCM43224) and 14e4:4359 (BCM43228) which is an almost
complete list of 5 GHz capable device (only BCM43222 is missing).
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Wed, 23 Jul 2014 16:54:49 +0000 (18:54 +0200)]
b43: register limited amount of 5G channels for BCM43228
We don't have all needed channel tables due to RE process for this
device.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Wed, 23 Jul 2014 16:54:48 +0000 (18:54 +0200)]
b43: N-PHY: don't calculate values for TSSI if we can't transmit
This process requires sending some sample tone, so make sure we're
allowed to transmit first.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Wed, 23 Jul 2014 14:55:44 +0000 (16:55 +0200)]
b43: report correct rate to mac80211 for 5 GHz packets
So far we were assuming only A-PHY supports 5 GHz.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Andrew Bresticker [Tue, 22 Jul 2014 21:43:51 +0000 (14:43 -0700)]
mac80211_hwsim: fix compiler warning on MIPS
The dividend in do_div() is expected to be an unsigned 64-bit integer,
which leads to the following warning when building for 32-bit MIPS:
drivers/net/wireless/mac80211_hwsim.c: In function 'mac80211_hwsim_set_tsf':
drivers/net/wireless/mac80211_hwsim.c:664:98: warning: comparison of distinct pointer types lacks a cast [enabled by default]
data->bcn_delta = do_div(delta, bcn_int);
Since we care about the signedness of delta when adjusting tsf_offset
and bcm_delta, use the absolute value for the division and compare
the two timestamps to determine the sign.
Signed-off-by: Andrew Bresticker <abrestic@chromium.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Tue, 22 Jul 2014 19:31:05 +0000 (21:31 +0200)]
b43: N-PHY: fix rev7+ typos at random places
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Wed, 23 Jul 2014 17:06:17 +0000 (13:06 -0400)]
Merge branch 'for-john' of git://git./linux/kernel/git/iwlwifi/iwlwifi-next
Felix Fietkau [Wed, 23 Jul 2014 13:40:54 +0000 (15:40 +0200)]
ath9k: fix aggregation session lockup
If an aggregation session fails, frames still end up in the driver queue
with IEEE80211_TX_CTL_AMPDU set.
This causes tx for the affected station/tid to stall, since
ath_tx_get_tid_subframe returning packets to send.
Fix this by clearing IEEE80211_TX_CTL_AMPDU as long as no aggregation
session is running.
Cc: stable@vger.kernel.org
Reported-by: Antonio Quartulli <antonio@open-mesh.com>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Wed, 23 Jul 2014 17:01:14 +0000 (13:01 -0400)]
Merge branch 'for-john' of git://git./linux/kernel/git/jberg/mac80211
Mark A. Greer [Tue, 22 Jul 2014 04:24:39 +0000 (21:24 -0700)]
NFC: digital: Add 'tg_listen_md' and 'tg_get_rf_tech' driver hooks
The digital layer of the NFC subsystem currently
supports a 'tg_listen_mdaa' driver hook that supports
devices that can do mode detection and automatic
anticollision. However, there are some devices that
can do mode detection but not automatic anitcollision
so add the 'tg_listen_md' hook to support those devices.
In order for the digital layer to get the RF technology
detected by the device from the driver, add the
'tg_get_rf_tech' hook. It is only valid to call this
hook immediately after a successful call to 'tg_listen_md'.
CC: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Mark A. Greer <mgreer@animalcreek.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Mark A. Greer [Tue, 22 Jul 2014 04:22:29 +0000 (21:22 -0700)]
NFC: digital: Remove extra blank line
Remove extra blank line that was inadvertently
added by a recent commit.
CC: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Mark A. Greer <mgreer@animalcreek.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Tue, 20 May 2014 20:21:59 +0000 (22:21 +0200)]
NFC: st21nfca: Adding P2P support to st21nfca in Initiator & Target mode
Support for Initiator and Target mode with ISO18092 commands support:
- ATR_REQ/ATR_RES
- PSL_REQ/PSL_RES
- DEP_REQ/DEP_RES
Work based on net/nfc/digital_dep.c.
st21nfca is using:
- Gate reader F for P2P in initiator mode.
- Gate card F for P2P in target mode.
Felica tag and p2p are differentiated with NFCID2.
When starting with 01FE it is acting in p2p mode.
On complete_target_discovered on ST21NFCA_RF_READER_F_GATE
supported_protocols is set to NFC_PROTO_NFC_DEP_MASK
for P2P.
Tested against: Nexus S, Galaxy S2, Galaxy S3, Galaxy S3 Mini,
Nexus 4 & Nexus 5.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Tue, 20 May 2014 20:21:58 +0000 (22:21 +0200)]
NFC: st21nfca: Implement stop_poll HCI hook
Send DM_DISCONNECT command to disconnect Terminal Host from the HCI network.
- The persistent states of the terminal host pipes, including registry values,
are not modifies. Therefore, there is no NVRAM update to disconnect the
terminal host.
- The terminal host RF card gates are disabled which means that there will be no event
related to card RF gates until communication has been restored.
- The terminal host RF reader request is reset so the RF reader polling for terminal
host is disabled.
To restore the communication, the terminal host can send any HCI command or event.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Tue, 20 May 2014 20:21:57 +0000 (22:21 +0200)]
NFC: hci: Add stop_poll HCI operand.
stop_poll allows to stop CLF reader polling. Some other operations might be
necessary for some CLF to stop polling. For example in card mode.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Tue, 20 May 2014 20:21:56 +0000 (22:21 +0200)]
NFC: st21nfca: Improve read length sequence for P2P mode.
A DEP_RES with a SUPERVISOR PDU can be up to 16 bytes long.
In order to avoid useless read during p2p, extend first read
sequence to 16 and reduce third sequence to 12 to keep same
total on the full sequence.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Tue, 20 May 2014 20:21:55 +0000 (22:21 +0200)]
NFC: st21nfca: Improved start of frame detection
A start of frame is 7E 00 not only 7E. Make sure the first read sequence is
starting with 7E 00.
For example: 7E FF FF FF FF is as a correct crc but it is a bad frame.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Tue, 20 May 2014 20:21:54 +0000 (22:21 +0200)]
NFC: st21nfca: Free buffer in case no data are retrieved.
In case no data are retrieve through i2c or one specific case is not handled.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Sun, 25 May 2014 20:46:58 +0000 (22:46 +0200)]
NFC: st21nfcb: few code clean up
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Sun, 25 May 2014 20:35:40 +0000 (22:35 +0200)]
NFC: nci: Add T1T support notification
Add T1T matching with Jewel during notification.
It was causing "the target found does not have the desired protocol"
to show up.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Sun, 25 May 2014 20:35:39 +0000 (22:35 +0200)]
NFC: dts: st21nfcb_i2c: Add DTS Documentation
Describe the properties used by the st21nfcb NFC controller driver.
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Christophe Ricard [Sun, 25 May 2014 20:35:38 +0000 (22:35 +0200)]
NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip
Add driver for STMicroelectronics ST21NFCB NFC controller.
ST21NFCB is using NCI protocol and a proprietary low level transport
protocol called NDLC used on top.
NDLC:
The protocol defines 2 types of frame:
- One type carrying NCI data (referred as DATAFRAME frames).
- One type carrying protocol information used for flow control and error
control mechanisms (referred as SUPERVISOR frames).
After each frame transmission to the NFC controller, the device host
SHALL waitfor an ACK (SUPERVISOR frame) reception before sending a
new frame.
The NFC controller MAY send a frame at anytime to the device host.
The NFC controller MAY send a specific WAIT supervisor frame to indicate
to device host that a NCI data packet has been received but that it could
take significant time before the NFC controller sends an ACK and thus
allows next data reception.
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Felix Fietkau [Tue, 22 Jul 2014 19:00:26 +0000 (21:00 +0200)]
mac80211: fix crash on getting sta info with uninitialized rate control
If the expected throughput is queried before rate control has been
initialized, the minstrel op for it will crash while trying to access
the rate table.
Check for WLAN_STA_RATE_CONTROL before attempting to use the rate
control op.
Reported-by: Jean-Pierre Tosoni <jp.tosoni@acksys.fr>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Sun, 15 Jun 2014 13:03:55 +0000 (16:03 +0300)]
iwlwifi: mvm: teardown TDLS peers during chan-switch and AP DCM
The DCM condition was not checked well for channel switch in both AP and
station scenarios. Teardown was also not done for AP/GO DCM. Add the
missing checks.
Reported-by: Peer, Ilan <ilan.peer@intel.com>
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Tue, 22 Jul 2014 19:08:29 +0000 (22:08 +0300)]
Merge remote-tracking branch 'wireless-next/master' into iwlwifi-next
Michal Kazior [Mon, 21 Jul 2014 18:03:10 +0000 (21:03 +0300)]
ath10k: prevent endless pci rx loop
It was possible to enter an endless loop while
processing a single pci copy engine pipe. This
could effectively render ath10k incapable of
responding to any requests.
An example case when this could happen is when
firmware generates a lot of events, e.g. spectral
scan phyerr via WMI.
Reported-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Rafał Miłecki [Sun, 20 Jul 2014 10:57:45 +0000 (12:57 +0200)]
b43: extract one more radio parameter: version
Some radios may share the same ID and revision but differ by a version.
E.g. radio in BCM5357B0 is version 1 and requires specific handling.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:47 +0000 (12:52 +0200)]
b43: enable radio 0x2057 rev 14 support (AKA BCM43217)
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:46 +0000 (12:52 +0200)]
b43: N-PHY: final fixes to rev7+ workarounds
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:45 +0000 (12:52 +0200)]
b43: N-PHY: add rev7+ workarounds for radio revs 9 and 14
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:44 +0000 (12:52 +0200)]
b43: N-PHY: allow applying separated workarounds per core
Newer devices need different workarounds for cores 0 and 1.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:43 +0000 (12:52 +0200)]
b43: N-PHY: update generic rev7+ workarounds
Add some missing ops and prepare for new devices support. This patch is
a great stability improvement for BCM43217. Earlier Tenda W322E used to
disconnect every 2 minutes (16 times over 30 minutes). With this fix I
got it running for 4 hours (with iperf) without any disconnection.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:42 +0000 (12:52 +0200)]
b43: N-PHY: update digital filters setup
This fixes handling channel 14 and adds code for BCM43217.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Sat, 19 Jul 2014 10:52:41 +0000 (12:52 +0200)]
b43: N-PHY: add helper for setting digital filters
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Andreas Fenkart [Mon, 21 Jul 2014 08:01:52 +0000 (10:01 +0200)]
mwifiex: card reset: enable rescan of non-removable card
mmc_rescan will scan for non-removable cards only once, hence the card
will not be rediscovered.
Signed-off-by: Andreas Fenkart <afenkart@gmail.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Tue, 22 Jul 2014 17:50:23 +0000 (13:50 -0400)]
Merge branch 'for-upstream' of git://git./linux/kernel/git/bluetooth/bluetooth-next
John W. Linville [Tue, 22 Jul 2014 17:49:34 +0000 (13:49 -0400)]
Merge git://git./linux/kernel/git/jberg/mac80211-next
John W. Linville [Tue, 22 Jul 2014 16:49:22 +0000 (12:49 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/iwlwifi/iwlwifi-fixes
Emmanuel Grumbach [Tue, 22 Jul 2014 16:26:41 +0000 (19:26 +0300)]
Merge branch 'iwlwifi-fixes' into iwlwifi-next
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Conflicts:
drivers/net/wireless/iwlwifi/mvm/mac80211.c
Emmanuel Grumbach [Sun, 13 Jul 2014 06:12:11 +0000 (09:12 +0300)]
iwlwifi: mvm: reset beacon filtering and BT Coex data upon FW restart
When the firmware asserts, we restart the device and reset
the relevant data we hold in the driver. BT Coex data was
not reset and because of that, the driver wouldn't
reconfigure the firmware properly after firmware restart.
Same for beacon filtering. Fix that.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eran Harary [Tue, 15 Jul 2014 11:04:23 +0000 (14:04 +0300)]
iwlwifi: mvm: update smart fifo / beacon filtering upon association
When we associate, we may have heard the beacon before the
association. In that case, BSS_CHANGED_BEACON_INFO will be
set along with BSS_CHANGED_ASSOC in changes in
bss_info_change.
In this case, we didn't update the smart fifo nor beacon
filtering leaving those two feature disabled.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Tue, 8 Jul 2014 16:44:25 +0000 (19:44 +0300)]
iwlwifi: dump CSRs to fw-error-dump
Add the Control Status Registers to the firmware error dump
infrastructure.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Thu, 26 Jun 2014 08:27:51 +0000 (11:27 +0300)]
iwlwifi: dump periphery registers to fw-error-dump
Use the fw-error-dump infrastructure to dump the periphery
registers. Only certain ranges are readable, so dump only
these.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Tue, 8 Jul 2014 16:45:17 +0000 (19:45 +0300)]
iwlwifi: split fw-error-dump between transport and mvm
The mvm op_mode won't allocate the buffer for the transport
any more. The transport allocates its own buffer and mvm
is in charge of splicing the buffers in the debugfs hook.
This makes the repartition easier to handle.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Mon, 21 Jul 2014 08:44:12 +0000 (11:44 +0300)]
iwlwifi: fix inconsistency about power_save module parameter
modinfo and kerneldoc disagreed on the meaning of this field.
Reported-by: Andrea Oliveri <oliveriandrea@gmail.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eran Harary [Tue, 1 Jul 2014 14:33:29 +0000 (17:33 +0300)]
iwlwifi: mvm: minor change in debug print
Add OTP to the string: "can't parse empty OTP/NVM section"
NVM usually refers to nvm_file while the problem can be in
the OTP.
Signed-off-by: Eran Harary <eran.harary@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Eliad Peller [Sun, 22 Jun 2014 15:15:59 +0000 (18:15 +0300)]
iwlwifi: mvm: wait for handlers when stopping scans
The recent unified scan api change introduced issues
when stopping ongoing scans, since both regular and
sched scan now use same stopped notification.
When issuing a new scan right after a running one,
we get the "old" notification and handle it wrongly
as notification for the current scan.
Fix it by introducing a new function that make sure
we consume the pending notifications before issuing
a new scan.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Reviewed-by: ArikX Nemtsov <arik@wizery.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Mon, 7 Jul 2014 11:38:39 +0000 (14:38 +0300)]
iwlwifi: mvm: BT Coex - don't change AP SMPS mode
Leave it to default instead - regardless of the BT activity.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Emmanuel Grumbach [Sun, 6 Jul 2014 06:34:38 +0000 (09:34 +0300)]
iwlwifi: mvm: BT Coex - fix the ACK / CTS kill mask
According to new requirements, the ACK / CTS kill mask is
not related to reduced TX power anymore. This allows to
remove the code that tracked reduced TX power enablement
across different interfaces.
The ACK / CTS kill mask is now fetch from a table. It
depends on the Activity grading (activity from BT) and on
the Look Up Table (LUT) type.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Ariej Marjieh [Wed, 16 Jul 2014 18:11:12 +0000 (21:11 +0300)]
iwlwifi: mvm: add Aux ROC request/response flow
The Remain On Channel framework added to the firmare is
a bit like time events. It allows the driver to request
the firmware to be on a certain channel for a certain time.
Unlike the time events, the ROC infrastructure doesn't need
a MAC context in the firmware - it uses a generic context
called "auxiliary framework".
This is useful for any offchannel activity that is not bound
to a specific MAC.
The flow is synchronized much like with time events:
1) The driver receives an action frame from the wpa_supplicant
via nl80211 that requests to be sent offchannel.
2) The driver sends an Aux ROC command (0x53) to the firmware.
3) The firmware responds with the unique id of the time event.
4) When time event starts, the driver puts the frame in the
Aux queue.
Special care needs to be taken when the time events ends:
the queue needs to be cleaned-up.
Signed-off-by: Ariej Marjieh <ariej.marjieh@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Michal Kazior [Mon, 21 Jul 2014 18:03:10 +0000 (21:03 +0300)]
ath10k: workaround qos nullfunc bug
Apparently fw/hw generates a corrupted QoS Control
Field in Qos NullFunc frames. The only way to
workaround this is to downgrade frames to
NullFunc. This should be okay since powersave is
done by fw/hw and these frames are only used for
CQM purposes (e.g. from hostapd to check if
station is still connected).
This doesn't fix any user visible bug that I know
of. It just prevents from sending out funky frames
on the air.
Reported-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior [Mon, 21 Jul 2014 18:03:09 +0000 (21:03 +0300)]
ath10k: simplify tx helpers
It always bugged me how tid is computed and stored
in a temporary var before written to the control
buffer. It was confusing and it made it difficult
to work with tx helpers.
While at it rename the qos workaround function as
it was misleading - it's not a workaround but
preparation for nwifi tx mode.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Vignesh Raman [Tue, 22 Jul 2014 13:54:25 +0000 (19:24 +0530)]
Bluetooth: Avoid use of session socket after the session gets freed
The commits
08c30aca9e698faddebd34f81e1196295f9dc063 "Bluetooth: Remove
RFCOMM session refcnt" and
8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
"Bluetooth: Return RFCOMM session ptrs to avoid freed session"
allow rfcomm_recv_ua and rfcomm_session_close to delete the session
(and free the corresponding socket) and propagate NULL session pointer
to the upper callers.
Additional fix is required to terminate the loop in rfcomm_process_rx
function to avoid use of freed 'sk' memory.
The issue is only reproducible with kernel option CONFIG_PAGE_POISONING
enabled making freed memory being changed and filled up with fixed char
value used to unmask use-after-free issues.
Signed-off-by: Vignesh Raman <Vignesh_Raman@mentor.com>
Signed-off-by: Vitaly Kuzmichev <Vitaly_Kuzmichev@mentor.com>
Acked-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
Michal Kazior [Mon, 21 Jul 2014 17:52:59 +0000 (20:52 +0300)]
ath10k: prevent some tx flushing failures
Firmware could request inspection of some
submitted tx requests. Since the callback wasn't
implemented it was possible to bleed tx msdu_ids
which could translate to tx flushing timeouts.
There's nothing ath10k can do to help firmware
with tx processing now so just report all tx
frames as already inspected to prevent firmware
from sending up inspection events and force it to
report regular tx completion indications with
discard status.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior [Wed, 16 Jul 2014 13:01:39 +0000 (15:01 +0200)]
ath10k: workaround boot issues with KVM/PCI-passthrough
Apparently iomap writes that unmask CE irqs aren't
propagated properly sometimes. Before failing try
to poll for the control response message as it may
have been delivered without an interrupt.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior [Wed, 16 Jul 2014 10:12:15 +0000 (12:12 +0200)]
mac80211: add support for Rx reordering offloading
Some drivers may be performing most of Tx/Rx
aggregation on their own (e.g. in firmware)
including AddBa/DelBa negotiations but may
otherwise require Rx reordering assistance.
The patch exports 2 new functions for establishing
Rx aggregation sessions in assumption device
driver has taken care of the necessary
negotiations.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
[fix endian bug]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Michal Kazior [Wed, 16 Jul 2014 10:09:31 +0000 (12:09 +0200)]
mac80211: fix Rx reordering with RX_FLAG_AMSDU_MORE
Some drivers (e.g. ath10k) report A-MSDU subframes
individually with identical seqno. The A-MPDU Rx
reorder code did not account for that which made
it practically unusable with drivers using
RX_FLAG_AMSDU_MORE because it would end up
dropping a lot of frames resulting in confusion in
upper network transport layers.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Eytan Lifshitz [Mon, 21 Jul 2014 12:18:41 +0000 (15:18 +0300)]
mac80211: remove useless NULL checks
sdata can't be NULL, and key being NULL is really not possible
unless the code is modified.
The sdata check made a static analyze (klocwork) unhappy because
we would get pointer to local (sdata->local) and only then check
if sdata is non-NULL.
Signed-off-by: Eytan Lifshitz <eytan.lifshitz@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
[remove !key check as well]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Marcel Holtmann [Mon, 21 Jul 2014 12:02:33 +0000 (14:02 +0200)]
Bluetooth: Add support for Broadcom device of Asus Z97-DELUXE motherboard
The Asus Z97-DELUXE motherboard contains a Broadcom based Bluetooth
controller on the USB bus. However vendor and product ID are listed
as ASUSTek Computer.
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0b05 ProdID=17cf Rev= 1.12
S: Manufacturer=Broadcom Corp
S: Product=BCM20702A0
S: SerialNumber=
54271E910064
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
Reported-by: Jerome Leclanche <jerome@leclan.ch>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Johan Hedberg [Mon, 21 Jul 2014 07:50:06 +0000 (10:50 +0300)]
Bluetooth: Prefer sizeof(*ptr) when allocating memory
It's safer practice to use sizeof(*ptr) instead of sizeof(ptr_type) when
allocating memory in case the type changes. This also fixes the
following style of warnings from static analyzers:
CHECK: Prefer kzalloc(sizeof(*ie)...) over kzalloc(sizeof(struct inquiry_entry)...)
+ ie = kzalloc(sizeof(struct inquiry_entry), GFP_KERNEL);
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Max Stepanov [Wed, 9 Jul 2014 13:55:32 +0000 (16:55 +0300)]
mac80211: fix a potential NULL access in ieee80211_crypto_hw_decrypt
The NULL pointer access could happen when ieee80211_crypto_hw_decrypt
is called from ieee80211_rx_h_decrypt with the following condition:
1. rx->key->conf.cipher is not WEP, CCMP, TKIP or AES_CMAC
2. rx->sta is NULL
When ieee80211_crypto_hw_decrypt is called, it verifies
rx->sta->cipher_scheme and it will cause Oops if rx->sta is NULL.
This path adds an addirional rx->sta == NULL verification in
ieee80211_crypto_hw_decrypt for this case.
Signed-off-by: Max Stepanov <Max.Stepanov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Luis R. Rodriguez [Mon, 14 Jul 2014 21:19:49 +0000 (14:19 -0700)]
wireless: fixup genregdb.awk for remove of antenna gain from wireless-regd
Since "wireless-regdb: remove antenna gain" was merged in the
wireless-regdb tree, the awk script parser has been incompatible
with the 'official' regulatory database. This fixes that up.
Without this change the max EIRP is set to 0 making 802.11 devices
useless.
The fragile nature of the awk parser must be replaced, but ideas
over how to do that in the most scalable way are being reviewed.
In the meantime update the documentation for CFG80211_INTERNAL_REGDB
so folks are aware of expectations for now.
Reported-by: John Walker <john@x109.net>
Reported-by: Krishna Chaitanya <chaitanya.mgit@gmail.com>
Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Luciano Coelho [Sat, 5 Jul 2014 08:43:01 +0000 (11:43 +0300)]
mac80211: remove redundant IEEE80211_STA_CSA_RECEIVED flag
The csa_active flag was added in sdata a while ago and made
IEEE80211_STA_CSA_RECEIVED redundant. The new flag is also used to
mark when CSA is ongoing on other iftypes and took over the old one as
the preferred method for checking whether we're in the middle of a
channel switch. Remove the old, redundant flag.
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Liad Kaufman [Thu, 17 Jul 2014 14:14:31 +0000 (17:14 +0300)]
mac80211: make sure TDLS teardown packet is sent on time
Since the teardown packet is created while the queues are
stopped, it isn't sent immediately, but rather is pending.
To be sure that when we flush the queues prior to destroying
the station we also send this packet - the tasklet handling
pending packets is invoked to flush the packets.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Reviewed-by: ArikX Nemtsov <arik@wizery.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 17 Jul 2014 14:14:30 +0000 (17:14 +0300)]
mac80211: ignore frames between TDLS peers when operating as AP
If the AP receives actions frames destined for other peers, it may
mistakenly toggle BA-sessions from itself to a peer.
Ignore TDLS data packets as well - the AP should not handle them.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 17 Jul 2014 14:14:29 +0000 (17:14 +0300)]
cfg80211: fix TDLS setup with VHT peers
Some VHT TDLS peers (Google Nexus 5) include the VHT-AID IE in their
TDLS setup request/response. Usermode passes this aid as the station
aid, causing it to fail verifiction, since this happens in the
"set_station" stage. Make an exception for the TDLS use-case.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 17 Jul 2014 14:14:28 +0000 (17:14 +0300)]
mac80211: disable VHT for TDLS
TDLS VHT support requires some more information elements during setup.
While these are not there, mask out the peer's VHT capabilities so that
VHT rates are not mistakenly used.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 17 Jul 2014 14:14:27 +0000 (17:14 +0300)]
mac80211: set Rx highest rate in ht_cap
Set for completeness mostly, currently unused in the code.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 17 Jul 2014 14:14:26 +0000 (17:14 +0300)]
mac80211: support HT for TDLS stations
Add the HT capabilities and HT operation information elements to TDLS
setup packets where appropriate.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Arik Nemtsov [Thu, 17 Jul 2014 14:14:25 +0000 (17:14 +0300)]
mac80211: move TDLS data to mgd private part
We can only be a station for TDLS connections. Also fix a bug where
a delayed work could be left scheduled if the station interface was
brought down during TDLS setup.
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>