From: Greg Kroah-Hartman Date: Sat, 13 Nov 2021 14:35:38 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v5.4.160~121 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2258783b1c6a828ecb2957983946e2a02b5711aa;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: ath10k-fix-control-message-timeout.patch ath10k-fix-division-by-zero-in-send-path.patch ath6kl-fix-control-message-timeout.patch ath6kl-fix-division-by-zero-in-send-path.patch edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch evm-mark-evm_fixmode-as-__ro_after_init.patch hwmon-pmbus-lm25066-add-offset-coefficients.patch ia64-kprobes-fix-to-pass-correct-trampoline-address-to-the-handler.patch ifb-depend-on-netfilter-alternatively-to-tc.patch libata-fix-checking-of-dma-state.patch mwifiex-fix-division-by-zero-in-fw-download-path.patch mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch pci-mark-atheros-qca6174-to-avoid-bus-reset.patch powerpc-kvm-fix-kvm_use_magic_page.patch regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch rsi-fix-key-enabled-check-causing-unwanted-encryption-for-vap_id-0.patch rsi-fix-module-dev_oper_mode-parameter-description.patch rsi-fix-occasional-initialisation-failure-with-bt-coex.patch rsi-fix-rate-mask-set-leading-to-p2p-failure.patch rtl8187-fix-control-message-timeouts.patch wcn36xx-fix-ht40-capability-for-2ghz-band.patch wcn36xx-handle-connection-loss-indication.patch --- diff --git a/queue-5.4/ath10k-fix-control-message-timeout.patch b/queue-5.4/ath10k-fix-control-message-timeout.patch new file mode 100644 index 00000000000..cf175c2e8e9 --- /dev/null +++ b/queue-5.4/ath10k-fix-control-message-timeout.patch @@ -0,0 +1,34 @@ +From 5286132324230168d3fab6ffc16bfd7de85bdfb4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:19 +0200 +Subject: ath10k: fix control-message timeout + +From: Johan Hovold + +commit 5286132324230168d3fab6ffc16bfd7de85bdfb4 upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Cc: stable@vger.kernel.org # 4.14 +Cc: Erik Stromdahl +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -525,7 +525,7 @@ static int ath10k_usb_submit_ctrl_in(str + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath10k_warn(ar, "Failed to read usb control message: %d\n", diff --git a/queue-5.4/ath10k-fix-division-by-zero-in-send-path.patch b/queue-5.4/ath10k-fix-division-by-zero-in-send-path.patch new file mode 100644 index 00000000000..8fa8c35907d --- /dev/null +++ b/queue-5.4/ath10k-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,43 @@ +From a006acb931317aad3a8dd41333ebb0453caf49b8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:17 +0200 +Subject: ath10k: fix division by zero in send path + +From: Johan Hovold + +commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream. + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in ath10k_usb_hif_tx_sg() in case a malicious device +has broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Cc: stable@vger.kernel.org # 4.14 +Cc: Erik Stromdahl +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -865,6 +865,11 @@ static int ath10k_usb_setup_pipe_resourc + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = diff --git a/queue-5.4/ath6kl-fix-control-message-timeout.patch b/queue-5.4/ath6kl-fix-control-message-timeout.patch new file mode 100644 index 00000000000..876b1396a8c --- /dev/null +++ b/queue-5.4/ath6kl-fix-control-message-timeout.patch @@ -0,0 +1,33 @@ +From a066d28a7e729f808a3e6eff22e70c003091544e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:20 +0200 +Subject: ath6kl: fix control-message timeout + +From: Johan Hovold + +commit a066d28a7e729f808a3e6eff22e70c003091544e upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support") +Cc: stable@vger.kernel.org # 3.4 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath6kl/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -912,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(str + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath6kl_warn("Failed to read usb control message: %d\n", ret); diff --git a/queue-5.4/ath6kl-fix-division-by-zero-in-send-path.patch b/queue-5.4/ath6kl-fix-division-by-zero-in-send-path.patch new file mode 100644 index 00000000000..417d7d5c915 --- /dev/null +++ b/queue-5.4/ath6kl-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,42 @@ +From c1b9ca365deae667192be9fe24db244919971234 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:18 +0200 +Subject: ath6kl: fix division by zero in send path + +From: Johan Hovold + +commit c1b9ca365deae667192be9fe24db244919971234 upstream. + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in ath10k_usb_hif_tx_sg() in case a malicious device +has broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 9cbee358687e ("ath6kl: add full USB support") +Cc: stable@vger.kernel.org # 3.5 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resourc + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = diff --git a/queue-5.4/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch b/queue-5.4/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch new file mode 100644 index 00000000000..dc0d1f9a028 --- /dev/null +++ b/queue-5.4/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch @@ -0,0 +1,37 @@ +From 537bddd069c743759addf422d0b8f028ff0f8dbc Mon Sep 17 00:00:00 2001 +From: Eric Badger +Date: Sun, 10 Oct 2021 10:06:56 -0700 +Subject: EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell + +From: Eric Badger + +commit 537bddd069c743759addf422d0b8f028ff0f8dbc upstream. + +The computation of TOHM is off by one bit. This missed bit results in +too low a value for TOHM, which can cause errors in regular memory to +incorrectly report: + + EDAC MC0: 1 CE Error at MMIOH area, on addr 0x000000207fffa680 on any memory + +Fixes: 50d1bb93672f ("sb_edac: add support for Haswell based systems") +Cc: stable@vger.kernel.org +Reported-by: Meeta Saggi +Signed-off-by: Eric Badger +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20211010170127.848113-1-ebadger@purestorage.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/sb_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1055,7 +1055,7 @@ static u64 haswell_get_tohm(struct sbrid + pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®); + rc = ((reg << 6) | rc) << 26; + +- return rc | 0x1ffffff; ++ return rc | 0x3ffffff; + } + + static u64 knl_get_tolm(struct sbridge_pvt *pvt) diff --git a/queue-5.4/evm-mark-evm_fixmode-as-__ro_after_init.patch b/queue-5.4/evm-mark-evm_fixmode-as-__ro_after_init.patch new file mode 100644 index 00000000000..3bc2118162f --- /dev/null +++ b/queue-5.4/evm-mark-evm_fixmode-as-__ro_after_init.patch @@ -0,0 +1,31 @@ +From 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 Mon Sep 17 00:00:00 2001 +From: Austin Kim +Date: Thu, 28 Oct 2021 12:26:42 +0100 +Subject: evm: mark evm_fixmode as __ro_after_init + +From: Austin Kim + +commit 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 upstream. + +The evm_fixmode is only configurable by command-line option and it is never +modified outside initcalls, so declaring it with __ro_after_init is better. + +Signed-off-by: Austin Kim +Cc: stable@vger.kernel.org +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/evm/evm_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -56,7 +56,7 @@ static struct xattr_list evm_config_defa + + LIST_HEAD(evm_config_xattrnames); + +-static int evm_fixmode; ++static int evm_fixmode __ro_after_init; + static int __init evm_set_fixmode(char *str) + { + if (strncmp(str, "fix", 3) == 0) diff --git a/queue-5.4/hwmon-pmbus-lm25066-add-offset-coefficients.patch b/queue-5.4/hwmon-pmbus-lm25066-add-offset-coefficients.patch new file mode 100644 index 00000000000..53849282597 --- /dev/null +++ b/queue-5.4/hwmon-pmbus-lm25066-add-offset-coefficients.patch @@ -0,0 +1,153 @@ +From ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 Mon Sep 17 00:00:00 2001 +From: Zev Weiss +Date: Tue, 28 Sep 2021 02:22:35 -0700 +Subject: hwmon: (pmbus/lm25066) Add offset coefficients + +From: Zev Weiss + +commit ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 upstream. + +With the exception of the lm5066i, all the devices handled by this +driver had been missing their offset ('b') coefficients for direct +format readings. + +Cc: stable@vger.kernel.org +Fixes: 58615a94f6a1 ("hwmon: (pmbus/lm25066) Add support for LM25056") +Fixes: e53e6497fc9f ("hwmon: (pmbus/lm25066) Refactor device specific coefficients") +Signed-off-by: Zev Weiss +Link: https://lore.kernel.org/r/20210928092242.30036-2-zev@bewilderbeest.net +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/lm25066.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/drivers/hwmon/pmbus/lm25066.c ++++ b/drivers/hwmon/pmbus/lm25066.c +@@ -55,22 +55,27 @@ static struct __coeff lm25066_coeff[6][P + [lm25056] = { + [PSC_VOLTAGE_IN] = { + .m = 16296, ++ .b = 1343, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13797, ++ .b = -1833, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6726, ++ .b = -537, + .R = -2, + }, + [PSC_POWER] = { + .m = 5501, ++ .b = -2908, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 26882, ++ .b = -5646, + .R = -4, + }, + [PSC_TEMPERATURE] = { +@@ -82,26 +87,32 @@ static struct __coeff lm25066_coeff[6][P + [lm25066] = { + [PSC_VOLTAGE_IN] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13661, ++ .b = -5200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6852, ++ .b = -3100, + .R = -2, + }, + [PSC_POWER] = { + .m = 736, ++ .b = -3300, + .R = -2, + }, + [PSC_POWER_L] = { + .m = 369, ++ .b = -1900, + .R = -2, + }, + [PSC_TEMPERATURE] = { +@@ -111,26 +122,32 @@ static struct __coeff lm25066_coeff[6][P + [lm5064] = { + [PSC_VOLTAGE_IN] = { + .m = 4611, ++ .b = -642, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4621, ++ .b = 423, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10742, ++ .b = 1552, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5456, ++ .b = 2118, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = 8524, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 612, ++ .b = 11202, + .R = -3, + }, + [PSC_TEMPERATURE] = { +@@ -140,26 +157,32 @@ static struct __coeff lm25066_coeff[6][P + [lm5066] = { + [PSC_VOLTAGE_IN] = { + .m = 4587, ++ .b = -1200, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4587, ++ .b = -2400, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10753, ++ .b = -1200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5405, ++ .b = -600, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = -6000, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 605, ++ .b = -8000, + .R = -3, + }, + [PSC_TEMPERATURE] = { diff --git a/queue-5.4/ia64-kprobes-fix-to-pass-correct-trampoline-address-to-the-handler.patch b/queue-5.4/ia64-kprobes-fix-to-pass-correct-trampoline-address-to-the-handler.patch new file mode 100644 index 00000000000..b01674657e2 --- /dev/null +++ b/queue-5.4/ia64-kprobes-fix-to-pass-correct-trampoline-address-to-the-handler.patch @@ -0,0 +1,80 @@ +From a7fe2378454cf46cd5e2776d05e72bbe8f0a468c Mon Sep 17 00:00:00 2001 +From: Masami Hiramatsu +Date: Tue, 14 Sep 2021 23:40:27 +0900 +Subject: ia64: kprobes: Fix to pass correct trampoline address to the handler + +From: Masami Hiramatsu + +commit a7fe2378454cf46cd5e2776d05e72bbe8f0a468c upstream. + +The following commit: + + Commit e792ff804f49 ("ia64: kprobes: Use generic kretprobe trampoline handler") + +Passed the wrong trampoline address to __kretprobe_trampoline_handler(): it +passes the descriptor address instead of function entry address. + +Pass the right parameter. + +Also use correct symbol dereference function to get the function address +from 'kretprobe_trampoline' - an IA64 special. + +Link: https://lkml.kernel.org/r/163163042696.489837.12551102356265354730.stgit@devnote2 + +Fixes: e792ff804f49 ("ia64: kprobes: Use generic kretprobe trampoline handler") +Cc: Josh Poimboeuf +Cc: Ingo Molnar +Cc: X86 ML +Cc: Daniel Xu +Cc: Thomas Gleixner +Cc: Borislav Petkov +Cc: Peter Zijlstra +Cc: Abhishek Sagar +Cc: Andrii Nakryiko +Cc: Paul McKenney +Cc: stable@vger.kernel.org +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman +--- + arch/ia64/kernel/kprobes.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/ia64/kernel/kprobes.c ++++ b/arch/ia64/kernel/kprobes.c +@@ -398,7 +398,8 @@ static void kretprobe_trampoline(void) + + int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs) + { +- regs->cr_iip = __kretprobe_trampoline_handler(regs, kretprobe_trampoline, NULL); ++ regs->cr_iip = __kretprobe_trampoline_handler(regs, ++ dereference_function_descriptor(kretprobe_trampoline), NULL); + /* + * By returning a non-zero value, we are telling + * kprobe_handler() that we don't want the post_handler +@@ -414,7 +415,7 @@ void __kprobes arch_prepare_kretprobe(st + ri->fp = NULL; + + /* Replace the return addr with trampoline addr */ +- regs->b0 = ((struct fnptr *)kretprobe_trampoline)->ip; ++ regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline); + } + + /* Check the instruction in the slot is break */ +@@ -918,14 +919,14 @@ static struct kprobe trampoline_p = { + int __init arch_init_kprobes(void) + { + trampoline_p.addr = +- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip; ++ dereference_function_descriptor(kretprobe_trampoline); + return register_kprobe(&trampoline_p); + } + + int __kprobes arch_trampoline_kprobe(struct kprobe *p) + { + if (p->addr == +- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip) ++ dereference_function_descriptor(kretprobe_trampoline)) + return 1; + + return 0; diff --git a/queue-5.4/ifb-depend-on-netfilter-alternatively-to-tc.patch b/queue-5.4/ifb-depend-on-netfilter-alternatively-to-tc.patch new file mode 100644 index 00000000000..6becbca1d1f --- /dev/null +++ b/queue-5.4/ifb-depend-on-netfilter-alternatively-to-tc.patch @@ -0,0 +1,33 @@ +From 046178e726c2977d686ba5e07105d5a6685c830e Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Tue, 26 Oct 2021 07:15:32 +0200 +Subject: ifb: Depend on netfilter alternatively to tc + +From: Lukas Wunner + +commit 046178e726c2977d686ba5e07105d5a6685c830e upstream. + +IFB originally depended on NET_CLS_ACT for traffic redirection. +But since v4.5, that may be achieved with NFT_FWD_NETDEV as well. + +Fixes: 39e6dea28adc ("netfilter: nf_tables: add forward expression to the netdev family") +Signed-off-by: Lukas Wunner +Cc: # v4.5+: bcfabee1afd9: netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress +Cc: # v4.5+ +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/Kconfig ++++ b/drivers/net/Kconfig +@@ -105,7 +105,7 @@ config NET_FC + + config IFB + tristate "Intermediate Functional Block support" +- depends on NET_CLS_ACT ++ depends on NET_ACT_MIRRED || NFT_FWD_NETDEV + select NET_REDIRECT + ---help--- + This is an intermediate driver that allows sharing of diff --git a/queue-5.4/libata-fix-checking-of-dma-state.patch b/queue-5.4/libata-fix-checking-of-dma-state.patch new file mode 100644 index 00000000000..e09fb833eba --- /dev/null +++ b/queue-5.4/libata-fix-checking-of-dma-state.patch @@ -0,0 +1,42 @@ +From f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= +Date: Tue, 12 Oct 2021 08:27:44 +0200 +Subject: libata: fix checking of DMA state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Reimar Döffinger + +commit f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b upstream. + +Checking if DMA is enabled should be done via the +ata_dma_enabled helper function, since the init state +0xff indicates disabled. +This meant that ATA_CMD_READ_LOG_DMA_EXT was used and probed +for before DMA was enabled, which caused hangs for some combinations +of controllers and devices. +It might also have caused it to be incorrectly disabled as broken, +but there have been no reports of that. + +Cc: stable@vger.kernel.org +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195895 +Signed-off-by: Reimar Döffinger +Tested-by: Paul Menzel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2057,7 +2057,7 @@ unsigned int ata_read_log_page(struct at + + retry: + ata_tf_init(dev, &tf); +- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) && ++ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) && + !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) { + tf.command = ATA_CMD_READ_LOG_DMA_EXT; + tf.protocol = ATA_PROT_DMA; diff --git a/queue-5.4/mwifiex-fix-division-by-zero-in-fw-download-path.patch b/queue-5.4/mwifiex-fix-division-by-zero-in-fw-download-path.patch new file mode 100644 index 00000000000..1437ef6ed15 --- /dev/null +++ b/queue-5.4/mwifiex-fix-division-by-zero-in-fw-download-path.patch @@ -0,0 +1,61 @@ +From 89f8765a11d8df49296d92c404067f9b5c58ee26 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:19 +0200 +Subject: mwifiex: fix division by zero in fw download path + +From: Johan Hovold + +commit 89f8765a11d8df49296d92c404067f9b5c58ee26 upstream. + +Add the missing endpoint sanity checks to probe() to avoid division by +zero in mwifiex_write_data_sync() in case a malicious device has broken +descriptors (or when doing descriptor fuzz testing). + +Only add checks for the firmware-download boot stage, which require both +command endpoints, for now. The driver looks like it will handle a +missing endpoint during normal operation without oopsing, albeit not +very gracefully as it will try to submit URBs to the default pipe and +fail. + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 4daffe354366 ("mwifiex: add support for Marvell USB8797 chipset") +Cc: stable@vger.kernel.org # 3.5 +Cc: Amitkumar Karwar +Signed-off-by: Johan Hovold +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -505,6 +505,22 @@ static int mwifiex_usb_probe(struct usb_ + } + } + ++ switch (card->usb_boot_state) { ++ case USB8XXX_FW_DNLD: ++ /* Reject broken descriptors. */ ++ if (!card->rx_cmd_ep || !card->tx_cmd_ep) ++ return -ENODEV; ++ if (card->bulk_out_maxpktsize == 0) ++ return -ENODEV; ++ break; ++ case USB8XXX_FW_READY: ++ /* Assume the driver can handle missing endpoints for now. */ ++ break; ++ default: ++ WARN_ON(1); ++ return -ENODEV; ++ } ++ + usb_set_intfdata(intf, card); + + ret = mwifiex_add_card(card, &card->fw_done, &usb_ops, diff --git a/queue-5.4/mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch b/queue-5.4/mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch new file mode 100644 index 00000000000..61d74f265ef --- /dev/null +++ b/queue-5.4/mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch @@ -0,0 +1,54 @@ +From e5f4eb8223aa740237cd463246a7debcddf4eda1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= +Date: Mon, 11 Oct 2021 15:32:23 +0200 +Subject: mwifiex: Read a PCI register after writing the TX ring write pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +commit e5f4eb8223aa740237cd463246a7debcddf4eda1 upstream. + +On the 88W8897 PCIe+USB card the firmware randomly crashes after setting +the TX ring write pointer. The issue is present in the latest firmware +version 15.68.19.p21 of the PCIe+USB card. + +Those firmware crashes can be worked around by reading any PCI register +of the card after setting that register, so read the PCI_VENDOR_ID +register here. The reason this works is probably because we keep the bus +from entering an ASPM state for a bit longer, because that's what causes +the cards firmware to crash. + +This fixes a bug where during RX/TX traffic and with ASPM L1 substates +enabled (the specific substates where the issue happens appear to be +platform dependent), the firmware crashes and eventually a command +timeout appears in the logs. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681 +Cc: stable@vger.kernel.org +Signed-off-by: Jonas Dreßler +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211011133224.15561-2-verdre@v0yd.nl +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1326,6 +1326,14 @@ mwifiex_pcie_send_data(struct mwifiex_ad + ret = -1; + goto done_unmap; + } ++ ++ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card ++ * seems to crash randomly after setting the TX ring write pointer when ++ * ASPM powersaving is enabled. A workaround seems to be keeping the bus ++ * busy by reading a random register afterwards. ++ */ ++ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val); ++ + if ((mwifiex_pcie_txbd_not_full(card)) && + tx_param->next_pkt_len) { + /* have more packets and TxBD still can hold more */ diff --git a/queue-5.4/pci-mark-atheros-qca6174-to-avoid-bus-reset.patch b/queue-5.4/pci-mark-atheros-qca6174-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..7e3b58ce36f --- /dev/null +++ b/queue-5.4/pci-mark-atheros-qca6174-to-avoid-bus-reset.patch @@ -0,0 +1,38 @@ +From e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 Mon Sep 17 00:00:00 2001 +From: Ingmar Klein +Date: Fri, 9 Apr 2021 11:26:33 +0200 +Subject: PCI: Mark Atheros QCA6174 to avoid bus reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ingmar Klein + +commit e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 upstream. + +When passing the Atheros QCA6174 through to a virtual machine, the VM hangs +at the point where the ath10k driver loads. + +Add a quirk to avoid bus resets on this device, which avoids the hang. + +[bhelgaas: commit log] +Link: https://lore.kernel.org/r/08982e05-b6e8-5a8d-24ab-da1488ee50a8@web.de +Signed-off-by: Ingmar Klein +Signed-off-by: Bjorn Helgaas +Reviewed-by: Pali Rohár +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3584,6 +3584,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_A + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset); + + /* + * Root port on some Cavium CN8xxx chips do not successfully complete a bus diff --git a/queue-5.4/powerpc-kvm-fix-kvm_use_magic_page.patch b/queue-5.4/powerpc-kvm-fix-kvm_use_magic_page.patch new file mode 100644 index 00000000000..87689884815 --- /dev/null +++ b/queue-5.4/powerpc-kvm-fix-kvm_use_magic_page.patch @@ -0,0 +1,32 @@ +From 0c8eb2884a42d992c7726539328b7d3568f22143 Mon Sep 17 00:00:00 2001 +From: Andreas Gruenbacher +Date: Mon, 2 Aug 2021 13:46:19 +0200 +Subject: powerpc/kvm: Fix kvm_use_magic_page + +From: Andreas Gruenbacher + +commit 0c8eb2884a42d992c7726539328b7d3568f22143 upstream. + +When switching from __get_user to fault_in_pages_readable, commit +9f9eae5ce717 broke kvm_use_magic_page: like __get_user, +fault_in_pages_readable returns 0 on success. + +Fixes: 9f9eae5ce717 ("powerpc/kvm: Prefer fault_in_pages_readable function") +Cc: stable@vger.kernel.org # v4.18+ +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/kvm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/kvm.c ++++ b/arch/powerpc/kernel/kvm.c +@@ -669,7 +669,7 @@ static void __init kvm_use_magic_page(vo + on_each_cpu(kvm_map_magic_page, &features, 1); + + /* Quick self-test to see if the mapping works */ +- if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { ++ if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { + kvm_patching_worked = false; + return; + } diff --git a/queue-5.4/regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch b/queue-5.4/regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch new file mode 100644 index 00000000000..9d11b9faf4d --- /dev/null +++ b/queue-5.4/regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch @@ -0,0 +1,34 @@ +From a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 8 Oct 2021 13:37:14 +0200 +Subject: regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property + +From: Krzysztof Kozlowski + +commit a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a upstream. + +The driver was always parsing "s5m8767,pmic-buck-default-dvs-idx", not +"s5m8767,pmic-buck234-default-dvs-idx". + +Cc: +Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Rob Herring +Message-Id: <20211008113723.134648-3-krzysztof.kozlowski@canonical.com> +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -39,7 +39,7 @@ Optional properties of the main device n + + Additional properties required if either of the optional properties are used: + +- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from ++ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from + the possible 8 options selectable by the dvs gpios. The value of this + property should be between 0 and 7. If not specified or if out of range, the + default value of this property is set to 0. diff --git a/queue-5.4/regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch b/queue-5.4/regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch new file mode 100644 index 00000000000..bad25f664b3 --- /dev/null +++ b/queue-5.4/regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch @@ -0,0 +1,113 @@ +From b16bef60a9112b1e6daf3afd16484eb06e7ce792 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 8 Oct 2021 13:37:13 +0200 +Subject: regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled + +From: Krzysztof Kozlowski + +commit b16bef60a9112b1e6daf3afd16484eb06e7ce792 upstream. + +The driver and its bindings, before commit 04f9f068a619 ("regulator: +s5m8767: Modify parsing method of the voltage table of buck2/3/4") were +requiring to provide at least one safe/default voltage for DVS registers +if DVS GPIO is not being enabled. + +IOW, if s5m8767,pmic-buck2-uses-gpio-dvs is missing, the +s5m8767,pmic-buck2-dvs-voltage should still be present and contain one +voltage. + +This requirement was coming from driver behavior matching this condition +(none of DVS GPIO is enabled): it was always initializing the DVS +selector pins to 0 and keeping the DVS enable setting at reset value +(enabled). Therefore if none of DVS GPIO is enabled in devicetree, +driver was configuring the first DVS voltage for buck[234]. + +Mentioned commit 04f9f068a619 ("regulator: s5m8767: Modify parsing +method of the voltage table of buck2/3/4") broke it because DVS voltage +won't be parsed from devicetree if DVS GPIO is not enabled. After the +change, driver will configure bucks to use the register reset value as +voltage which might have unpleasant effects. + +Fix this by relaxing the bindings constrain: if DVS GPIO is not enabled +in devicetree (therefore DVS voltage is also not parsed), explicitly +disable it. + +Cc: +Fixes: 04f9f068a619 ("regulator: s5m8767: Modify parsing method of the voltage table of buck2/3/4") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Rob Herring +Message-Id: <20211008113723.134648-2-krzysztof.kozlowski@canonical.com> +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 21 +++------- + drivers/regulator/s5m8767.c | 21 ++++------ + 2 files changed, 17 insertions(+), 25 deletions(-) + +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -13,6 +13,14 @@ common regulator binding documented in: + + + Required properties of the main device node (the parent!): ++ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used ++ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. ++ ++ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional ++ property is specified, then all the eight voltage values for the ++ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. ++ ++Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) + units for buck2 when changing voltage using gpio dvs. Refer to [1] below + for additional information. +@@ -25,19 +33,6 @@ Required properties of the main device n + units for buck4 when changing voltage using gpio dvs. Refer to [1] below + for additional information. + +- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used +- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. +- +- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' +- property should specify atleast one voltage level (which would be a +- safe operating voltage). +- +- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, then all the eight voltage values for the +- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. +- +-Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. + - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. + - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs. +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -851,18 +851,15 @@ static int s5m8767_pmic_probe(struct pla + /* DS4 GPIO */ + gpio_direction_output(pdata->buck_ds[2], 0x0); + +- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || +- pdata->buck4_gpiodvs) { +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK2CTRL, 1 << 1, +- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK3CTRL, 1 << 1, +- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK4CTRL, 1 << 1, +- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); +- } ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK2CTRL, 1 << 1, ++ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK3CTRL, 1 << 1, ++ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK4CTRL, 1 << 1, ++ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); + + /* Initialize GPIO DVS registers */ + for (i = 0; i < 8; i++) { diff --git a/queue-5.4/rsi-fix-key-enabled-check-causing-unwanted-encryption-for-vap_id-0.patch b/queue-5.4/rsi-fix-key-enabled-check-causing-unwanted-encryption-for-vap_id-0.patch new file mode 100644 index 00000000000..a07b4cc13e1 --- /dev/null +++ b/queue-5.4/rsi-fix-key-enabled-check-causing-unwanted-encryption-for-vap_id-0.patch @@ -0,0 +1,73 @@ +From 99ac6018821253ec67f466086afb63fc18ea48e2 Mon Sep 17 00:00:00 2001 +From: Martin Fuzzey +Date: Mon, 30 Aug 2021 17:26:45 +0200 +Subject: rsi: fix key enabled check causing unwanted encryption for vap_id > 0 + +From: Martin Fuzzey + +commit 99ac6018821253ec67f466086afb63fc18ea48e2 upstream. + +My previous patch checked if encryption should be enabled by directly +checking info->control.hw_key (like the downstream driver). +However that missed that the control and driver_info members of +struct ieee80211_tx_info are union fields. + +Due to this when rsi_core_xmit() updates fields in "tx_params" +(driver_info) it can overwrite the control.hw_key, causing the result +of the later test to be incorrect. + +With the current structure layout the first byte of control.hw_key is +overlayed with the vap_id so, since we only test if control.hw_key is +NULL / non NULL, a non zero vap_id will incorrectly enable encryption. + +In basic STA and AP modes the vap_id is always zero so it works but in +P2P client mode a second VIF is created causing vap_id to be non zero +and hence encryption to be enabled before keys have been set. + +Fix this by extracting the key presence flag to a new field in the driver +private tx_params structure and populating it first. + +Fixes: 314538041b56 ("rsi: fix AP mode with WPA failure due to encrypted EAPOL") +Signed-off-by: Martin Fuzzey +CC: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1630337206-12410-3-git-send-email-martin.fuzzey@flowbird.group +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_core.c | 2 ++ + drivers/net/wireless/rsi/rsi_91x_hal.c | 2 +- + drivers/net/wireless/rsi/rsi_main.h | 1 + + 3 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_core.c ++++ b/drivers/net/wireless/rsi/rsi_91x_core.c +@@ -400,6 +400,8 @@ void rsi_core_xmit(struct rsi_common *co + + info = IEEE80211_SKB_CB(skb); + tx_params = (struct skb_info *)info->driver_data; ++ /* info->driver_data and info->control part of union so make copy */ ++ tx_params->have_key = !!info->control.hw_key; + wh = (struct ieee80211_hdr *)&skb->data[0]; + tx_params->sta_id = 0; + +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -203,7 +203,7 @@ int rsi_prepare_data_desc(struct rsi_com + wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE); + + if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) && +- info->control.hw_key) { ++ tx_params->have_key) { + if (rsi_is_cipher_wep(common)) + ieee80211_size += 4; + else +--- a/drivers/net/wireless/rsi/rsi_main.h ++++ b/drivers/net/wireless/rsi/rsi_main.h +@@ -139,6 +139,7 @@ struct skb_info { + u8 internal_hdr_size; + struct ieee80211_vif *vif; + u8 vap_id; ++ bool have_key; + }; + + enum edca_queue { diff --git a/queue-5.4/rsi-fix-module-dev_oper_mode-parameter-description.patch b/queue-5.4/rsi-fix-module-dev_oper_mode-parameter-description.patch new file mode 100644 index 00000000000..45a5e972098 --- /dev/null +++ b/queue-5.4/rsi-fix-module-dev_oper_mode-parameter-description.patch @@ -0,0 +1,95 @@ +From 31f97cf9f0c31143a2a6fcc89c4a1286ce20157e Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Thu, 16 Sep 2021 16:42:45 +0200 +Subject: rsi: Fix module dev_oper_mode parameter description + +From: Marek Vasut + +commit 31f97cf9f0c31143a2a6fcc89c4a1286ce20157e upstream. + +The module parameters are missing dev_oper_mode 12, BT classic alone, +add it. Moreover, the parameters encode newlines, which ends up being +printed malformed e.g. by modinfo, so fix that too. + +However, the module parameter string is duplicated in both USB and SDIO +modules and the dev_oper_mode mode enumeration in those module parameters +is a duplicate of macros used by the driver. Furthermore, the enumeration +is confusing. + +So, deduplicate the module parameter string and use __stringify() to +encode the correct mode enumeration values into the module parameter +string. Finally, replace 'Wi-Fi' with 'Wi-Fi alone' and 'BT' with +'BT classic alone' to clarify what those modes really mean. + +Fixes: 898b255339310 ("rsi: add module parameter operating mode") +Signed-off-by: Marek Vasut +Cc: Amitkumar Karwar +Cc: Angus Ainslie +Cc: David S. Miller +Cc: Jakub Kicinski +Cc: Kalle Valo +Cc: Karun Eagalapati +Cc: Martin Fuzzey +Cc: Martin Kepplinger +Cc: Prameela Rani Garnepudi +Cc: Sebastian Krzyszkowiak +Cc: Siva Rebbagondla +Cc: netdev@vger.kernel.org +Cc: # 4.17+ +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210916144245.10181-1-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 5 +---- + drivers/net/wireless/rsi/rsi_91x_usb.c | 5 +---- + drivers/net/wireless/rsi/rsi_hal.h | 11 +++++++++++ + 3 files changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -24,10 +24,7 @@ + /* Default operating mode is wlan STA + BT */ + static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL; + module_param(dev_oper_mode, ushort, 0444); +-MODULE_PARM_DESC(dev_oper_mode, +- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n" +- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n" +- "6[AP + BT classic], 14[AP + BT classic + BT LE]"); ++MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC); + + /** + * rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg. +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -25,10 +25,7 @@ + /* Default operating mode is wlan STA + BT */ + static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL; + module_param(dev_oper_mode, ushort, 0444); +-MODULE_PARM_DESC(dev_oper_mode, +- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n" +- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n" +- "6[AP + BT classic], 14[AP + BT classic + BT LE]"); ++MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC); + + static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags); + +--- a/drivers/net/wireless/rsi/rsi_hal.h ++++ b/drivers/net/wireless/rsi/rsi_hal.h +@@ -28,6 +28,17 @@ + #define DEV_OPMODE_AP_BT 6 + #define DEV_OPMODE_AP_BT_DUAL 14 + ++#define DEV_OPMODE_PARAM_DESC \ ++ __stringify(DEV_OPMODE_WIFI_ALONE) "[Wi-Fi alone], " \ ++ __stringify(DEV_OPMODE_BT_ALONE) "[BT classic alone], " \ ++ __stringify(DEV_OPMODE_BT_LE_ALONE) "[BT LE alone], " \ ++ __stringify(DEV_OPMODE_BT_DUAL) "[BT classic + BT LE alone], " \ ++ __stringify(DEV_OPMODE_STA_BT) "[Wi-Fi STA + BT classic], " \ ++ __stringify(DEV_OPMODE_STA_BT_LE) "[Wi-Fi STA + BT LE], " \ ++ __stringify(DEV_OPMODE_STA_BT_DUAL) "[Wi-Fi STA + BT classic + BT LE], " \ ++ __stringify(DEV_OPMODE_AP_BT) "[Wi-Fi AP + BT classic], " \ ++ __stringify(DEV_OPMODE_AP_BT_DUAL) "[Wi-Fi AP + BT classic + BT LE]" ++ + #define FLASH_WRITE_CHUNK_SIZE (4 * 1024) + #define FLASH_SECTOR_SIZE (4 * 1024) + diff --git a/queue-5.4/rsi-fix-occasional-initialisation-failure-with-bt-coex.patch b/queue-5.4/rsi-fix-occasional-initialisation-failure-with-bt-coex.patch new file mode 100644 index 00000000000..34fb60f913e --- /dev/null +++ b/queue-5.4/rsi-fix-occasional-initialisation-failure-with-bt-coex.patch @@ -0,0 +1,112 @@ +From 9b14ed6e11b72dd4806535449ca6c6962cb2369d Mon Sep 17 00:00:00 2001 +From: Martin Fuzzey +Date: Mon, 30 Aug 2021 17:26:44 +0200 +Subject: rsi: fix occasional initialisation failure with BT coex + +From: Martin Fuzzey + +commit 9b14ed6e11b72dd4806535449ca6c6962cb2369d upstream. + +When BT coexistence is enabled (eg oper mode 13, which is the default) +the initialisation on startup sometimes silently fails. + +In a normal initialisation we see + usb 1-1.3: Product: Wireless USB Network Module + usb 1-1.3: Manufacturer: Redpine Signals, Inc. + usb 1-1.3: SerialNumber: 000000000001 + rsi_91x: rsi_probe: Initialized os intf ops + rsi_91x: rsi_load_9116_firmware: Loading chunk 0 + rsi_91x: rsi_load_9116_firmware: Loading chunk 1 + rsi_91x: rsi_load_9116_firmware: Loading chunk 2 + rsi_91x: Max Stations Allowed = 1 + +But sometimes the last log is missing and the wlan net device is +not created. + +Running a userspace loop that resets the hardware via a GPIO shows the +problem occurring ~5/100 resets. + +The problem does not occur in oper mode 1 (wifi only). + +Adding logs shows that the initialisation state machine requests a MAC +reset via rsi_send_reset_mac() but the firmware does not reply, leading +to the initialisation sequence being incomplete. + +Fix this by delaying attaching the BT adapter until the wifi +initialisation has completed. + +With this applied I have done > 300 reset loops with no errors. + +Fixes: 716b840c7641 ("rsi: handle BT traffic in driver") +Signed-off-by: Martin Fuzzey +CC: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1630337206-12410-2-git-send-email-martin.fuzzey@flowbird.group +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_main.c | 16 +++++++++++++--- + drivers/net/wireless/rsi/rsi_91x_mgmt.c | 3 +++ + drivers/net/wireless/rsi/rsi_main.h | 2 ++ + 3 files changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_main.c ++++ b/drivers/net/wireless/rsi/rsi_91x_main.c +@@ -210,9 +210,10 @@ int rsi_read_pkt(struct rsi_common *comm + bt_pkt_type = frame_desc[offset + BT_RX_PKT_TYPE_OFST]; + if (bt_pkt_type == BT_CARD_READY_IND) { + rsi_dbg(INFO_ZONE, "BT Card ready recvd\n"); +- if (rsi_bt_ops.attach(common, &g_proto_ops)) +- rsi_dbg(ERR_ZONE, +- "Failed to attach BT module\n"); ++ if (common->fsm_state == FSM_MAC_INIT_DONE) ++ rsi_attach_bt(common); ++ else ++ common->bt_defer_attach = true; + } else { + if (common->bt_adapter) + rsi_bt_ops.recv_pkt(common->bt_adapter, +@@ -277,6 +278,15 @@ void rsi_set_bt_context(void *priv, void + } + #endif + ++void rsi_attach_bt(struct rsi_common *common) ++{ ++#ifdef CONFIG_RSI_COEX ++ if (rsi_bt_ops.attach(common, &g_proto_ops)) ++ rsi_dbg(ERR_ZONE, ++ "Failed to attach BT module\n"); ++#endif ++} ++ + /** + * rsi_91x_init() - This function initializes os interface operations. + * @void: Void. +--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +@@ -2056,6 +2056,9 @@ static int rsi_handle_ta_confirm_type(st + if (common->reinit_hw) { + complete(&common->wlan_init_completion); + } else { ++ if (common->bt_defer_attach) ++ rsi_attach_bt(common); ++ + return rsi_mac80211_attach(common); + } + } +--- a/drivers/net/wireless/rsi/rsi_main.h ++++ b/drivers/net/wireless/rsi/rsi_main.h +@@ -320,6 +320,7 @@ struct rsi_common { + struct ieee80211_vif *roc_vif; + + bool eapol4_confirm; ++ bool bt_defer_attach; + void *bt_adapter; + + struct cfg80211_scan_request *hwscan; +@@ -401,5 +402,6 @@ struct rsi_host_intf_ops { + + enum rsi_host_intf rsi_get_host_intf(void *priv); + void rsi_set_bt_context(void *priv, void *bt_context); ++void rsi_attach_bt(struct rsi_common *common); + + #endif diff --git a/queue-5.4/rsi-fix-rate-mask-set-leading-to-p2p-failure.patch b/queue-5.4/rsi-fix-rate-mask-set-leading-to-p2p-failure.patch new file mode 100644 index 00000000000..966f2fd6c80 --- /dev/null +++ b/queue-5.4/rsi-fix-rate-mask-set-leading-to-p2p-failure.patch @@ -0,0 +1,294 @@ +From b515d097053a71d624e0c5840b42cd4caa653941 Mon Sep 17 00:00:00 2001 +From: Martin Fuzzey +Date: Mon, 30 Aug 2021 17:26:46 +0200 +Subject: rsi: fix rate mask set leading to P2P failure + +From: Martin Fuzzey + +commit b515d097053a71d624e0c5840b42cd4caa653941 upstream. + +P2P client mode was only working the first time. +On subsequent connection attempts the group was successfully created but +no data was sent (no transmitted data packets were seen with a sniffer). + +The reason for this was that the hardware was being configured in fixed +rate mode with rate RSI_RATE_1 (1Mbps) which is not valid in the 5GHz band. + +In P2P mode wpa_supplicant uses NL80211_CMD_SET_TX_BITRATE_MASK to disallow +the 11b rates in the 2.4GHz band which updated common->fixedrate_mask. + +rsi_set_min_rate() then used the fixedrate_mask to calculate the minimum +allowed rate, or 0xffff = auto if none was found. +However that calculation did not account for the different rate sets +allowed in the different bands leading to the error. + +Fixing set_min_rate() would result in 6Mb/s being used all the time +which is not what we want either. + +The reason the problem did not occur on the first connection is that +rsi_mac80211_set_rate_mask() only updated the fixedrate_mask for +the *current* band. When it was called that was still 2.4GHz as the +switch is done later. So the when set_min_rate() was subsequently +called after the switch to 5GHz it still had a mask of zero, leading +to defaulting to auto mode. + +Fix this by differentiating the case of a single rate being +requested, in which case the hardware will be used in fixed rate +mode with just that rate, and multiple rates being requested, +in which case we remain in auto mode but the firmware rate selection +algorithm is configured with a restricted set of rates. + +Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") +Signed-off-by: Martin Fuzzey +CC: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1630337206-12410-4-git-send-email-martin.fuzzey@flowbird.group +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_hal.c | 8 +-- + drivers/net/wireless/rsi/rsi_91x_mac80211.c | 74 ++++++++-------------------- + drivers/net/wireless/rsi/rsi_91x_mgmt.c | 21 +++++-- + drivers/net/wireless/rsi/rsi_main.h | 12 +++- + 4 files changed, 50 insertions(+), 65 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -214,15 +214,17 @@ int rsi_prepare_data_desc(struct rsi_com + RSI_WIFI_DATA_Q); + data_desc->header_len = ieee80211_size; + +- if (common->min_rate != RSI_RATE_AUTO) { ++ if (common->rate_config[common->band].fixed_enabled) { + /* Send fixed rate */ ++ u16 fixed_rate = common->rate_config[common->band].fixed_hw_rate; ++ + data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE); +- data_desc->rate_info = cpu_to_le16(common->min_rate); ++ data_desc->rate_info = cpu_to_le16(fixed_rate); + + if (conf_is_ht40(&common->priv->hw->conf)) + data_desc->bbp_info = cpu_to_le16(FULL40M_ENABLE); + +- if ((common->vif_info[0].sgi) && (common->min_rate & 0x100)) { ++ if (common->vif_info[0].sgi && (fixed_rate & 0x100)) { + /* Only MCS rates */ + data_desc->rate_info |= + cpu_to_le16(ENABLE_SHORTGI_RATE); +--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c +@@ -510,7 +510,6 @@ static int rsi_mac80211_add_interface(st + if ((vif->type == NL80211_IFTYPE_AP) || + (vif->type == NL80211_IFTYPE_P2P_GO)) { + rsi_send_rx_filter_frame(common, DISALLOW_BEACONS); +- common->min_rate = RSI_RATE_AUTO; + for (i = 0; i < common->max_stations; i++) + common->stations[i].sta = NULL; + } +@@ -1211,20 +1210,32 @@ static int rsi_mac80211_set_rate_mask(st + struct ieee80211_vif *vif, + const struct cfg80211_bitrate_mask *mask) + { ++ const unsigned int mcs_offset = ARRAY_SIZE(rsi_rates); + struct rsi_hw *adapter = hw->priv; + struct rsi_common *common = adapter->priv; +- enum nl80211_band band = hw->conf.chandef.chan->band; ++ int i; + + mutex_lock(&common->mutex); +- common->fixedrate_mask[band] = 0; + +- if (mask->control[band].legacy == 0xfff) { +- common->fixedrate_mask[band] = +- (mask->control[band].ht_mcs[0] << 12); +- } else { +- common->fixedrate_mask[band] = +- mask->control[band].legacy; ++ for (i = 0; i < ARRAY_SIZE(common->rate_config); i++) { ++ struct rsi_rate_config *cfg = &common->rate_config[i]; ++ u32 bm; ++ ++ bm = mask->control[i].legacy | (mask->control[i].ht_mcs[0] << mcs_offset); ++ if (hweight32(bm) == 1) { /* single rate */ ++ int rate_index = ffs(bm) - 1; ++ ++ if (rate_index < mcs_offset) ++ cfg->fixed_hw_rate = rsi_rates[rate_index].hw_value; ++ else ++ cfg->fixed_hw_rate = rsi_mcsrates[rate_index - mcs_offset]; ++ cfg->fixed_enabled = true; ++ } else { ++ cfg->configured_mask = bm; ++ cfg->fixed_enabled = false; ++ } + } ++ + mutex_unlock(&common->mutex); + + return 0; +@@ -1360,46 +1371,6 @@ void rsi_indicate_pkt_to_os(struct rsi_c + ieee80211_rx_irqsafe(hw, skb); + } + +-static void rsi_set_min_rate(struct ieee80211_hw *hw, +- struct ieee80211_sta *sta, +- struct rsi_common *common) +-{ +- u8 band = hw->conf.chandef.chan->band; +- u8 ii; +- u32 rate_bitmap; +- bool matched = false; +- +- common->bitrate_mask[band] = sta->supp_rates[band]; +- +- rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]); +- +- if (rate_bitmap & 0xfff) { +- /* Find out the min rate */ +- for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) { +- if (rate_bitmap & BIT(ii)) { +- common->min_rate = rsi_rates[ii].hw_value; +- matched = true; +- break; +- } +- } +- } +- +- common->vif_info[0].is_ht = sta->ht_cap.ht_supported; +- +- if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) { +- for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) { +- if ((rate_bitmap >> 12) & BIT(ii)) { +- common->min_rate = rsi_mcsrates[ii]; +- matched = true; +- break; +- } +- } +- } +- +- if (!matched) +- common->min_rate = 0xffff; +-} +- + /** + * rsi_mac80211_sta_add() - This function notifies driver about a peer getting + * connected. +@@ -1498,9 +1469,9 @@ static int rsi_mac80211_sta_add(struct i + + if ((vif->type == NL80211_IFTYPE_STATION) || + (vif->type == NL80211_IFTYPE_P2P_CLIENT)) { +- rsi_set_min_rate(hw, sta, common); ++ common->bitrate_mask[common->band] = sta->supp_rates[common->band]; ++ common->vif_info[0].is_ht = sta->ht_cap.ht_supported; + if (sta->ht_cap.ht_supported) { +- common->vif_info[0].is_ht = true; + common->bitrate_mask[NL80211_BAND_2GHZ] = + sta->supp_rates[NL80211_BAND_2GHZ]; + if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) || +@@ -1574,7 +1545,6 @@ static int rsi_mac80211_sta_remove(struc + bss->qos = sta->wme; + common->bitrate_mask[NL80211_BAND_2GHZ] = 0; + common->bitrate_mask[NL80211_BAND_5GHZ] = 0; +- common->min_rate = 0xffff; + common->vif_info[0].is_ht = false; + common->vif_info[0].sgi = false; + common->vif_info[0].seq_start = 0; +--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c +@@ -276,7 +276,7 @@ static void rsi_set_default_parameters(s + common->channel_width = BW_20MHZ; + common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD; + common->channel = 1; +- common->min_rate = 0xffff; ++ memset(&common->rate_config, 0, sizeof(common->rate_config)); + common->fsm_state = FSM_CARD_NOT_READY; + common->iface_down = true; + common->endpoint = EP_2GHZ_20MHZ; +@@ -1304,7 +1304,7 @@ static int rsi_send_auto_rate_request(st + u8 band = hw->conf.chandef.chan->band; + u8 num_supported_rates = 0; + u8 rate_table_offset, rate_offset = 0; +- u32 rate_bitmap; ++ u32 rate_bitmap, configured_rates; + u16 *selected_rates, min_rate; + bool is_ht = false, is_sgi = false; + u16 frame_len = sizeof(struct rsi_auto_rate); +@@ -1354,6 +1354,10 @@ static int rsi_send_auto_rate_request(st + is_sgi = true; + } + ++ /* Limit to any rates administratively configured by cfg80211 */ ++ configured_rates = common->rate_config[band].configured_mask ?: 0xffffffff; ++ rate_bitmap &= configured_rates; ++ + if (band == NL80211_BAND_2GHZ) { + if ((rate_bitmap == 0) && (is_ht)) + min_rate = RSI_RATE_MCS0; +@@ -1379,10 +1383,13 @@ static int rsi_send_auto_rate_request(st + num_supported_rates = jj; + + if (is_ht) { +- for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) +- selected_rates[jj++] = mcs[ii]; +- num_supported_rates += ARRAY_SIZE(mcs); +- rate_offset += ARRAY_SIZE(mcs); ++ for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) { ++ if (configured_rates & BIT(ii + ARRAY_SIZE(rsi_rates))) { ++ selected_rates[jj++] = mcs[ii]; ++ num_supported_rates++; ++ rate_offset++; ++ } ++ } + } + + sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL); +@@ -1467,7 +1474,7 @@ void rsi_inform_bss_status(struct rsi_co + qos_enable, + aid, sta_id, + vif); +- if (common->min_rate == 0xffff) ++ if (!common->rate_config[common->band].fixed_enabled) + rsi_send_auto_rate_request(common, sta, sta_id, vif); + if (opmode == RSI_OPMODE_STA && + !(assoc_cap & WLAN_CAPABILITY_PRIVACY) && +--- a/drivers/net/wireless/rsi/rsi_main.h ++++ b/drivers/net/wireless/rsi/rsi_main.h +@@ -61,6 +61,7 @@ enum RSI_FSM_STATES { + extern u32 rsi_zone_enabled; + extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...); + ++#define RSI_MAX_BANDS 2 + #define RSI_MAX_VIFS 3 + #define NUM_EDCA_QUEUES 4 + #define IEEE80211_ADDR_LEN 6 +@@ -230,6 +231,12 @@ struct rsi_9116_features { + u32 ps_options; + }; + ++struct rsi_rate_config { ++ u32 configured_mask; /* configured by mac80211 bits 0-11=legacy 12+ mcs */ ++ u16 fixed_hw_rate; ++ bool fixed_enabled; ++}; ++ + struct rsi_common { + struct rsi_hw *priv; + struct vif_priv vif_info[RSI_MAX_VIFS]; +@@ -255,8 +262,8 @@ struct rsi_common { + u8 channel_width; + + u16 rts_threshold; +- u16 bitrate_mask[2]; +- u32 fixedrate_mask[2]; ++ u32 bitrate_mask[RSI_MAX_BANDS]; ++ struct rsi_rate_config rate_config[RSI_MAX_BANDS]; + + u8 rf_reset; + struct transmit_q_stats tx_stats; +@@ -277,7 +284,6 @@ struct rsi_common { + u8 mac_id; + u8 radio_id; + u16 rate_pwr[20]; +- u16 min_rate; + + /* WMM algo related */ + u8 selected_qnum; diff --git a/queue-5.4/rtl8187-fix-control-message-timeouts.patch b/queue-5.4/rtl8187-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..3a4700a5f6d --- /dev/null +++ b/queue-5.4/rtl8187-fix-control-message-timeouts.patch @@ -0,0 +1,87 @@ +From 2e9be536a213e838daed6ba42024dd68954ac061 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:21 +0200 +Subject: rtl8187: fix control-message timeouts + +From: Johan Hovold + +commit 2e9be536a213e838daed6ba42024dd68954ac061 upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 605bebe23bf6 ("[PATCH] Add rtl8187 wireless driver") +Cc: stable@vger.kernel.org # 2.6.23 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +@@ -28,7 +28,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_pr + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + val = priv->io_dmabuf->bits8; + mutex_unlock(&priv->io_mutex); +@@ -45,7 +45,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_ + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + val = priv->io_dmabuf->bits16; + mutex_unlock(&priv->io_mutex); +@@ -62,7 +62,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_ + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + val = priv->io_dmabuf->bits32; + mutex_unlock(&priv->io_mutex); +@@ -79,7 +79,7 @@ void rtl818x_iowrite8_idx(struct rtl8187 + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -93,7 +93,7 @@ void rtl818x_iowrite16_idx(struct rtl818 + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -107,7 +107,7 @@ void rtl818x_iowrite32_idx(struct rtl818 + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -183,7 +183,7 @@ static void rtl8225_write_8051(struct ie + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data), +- HZ / 2); ++ 500); + + mutex_unlock(&priv->io_mutex); + diff --git a/queue-5.4/series b/queue-5.4/series index 636028aa75e..010a34aa771 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -60,3 +60,26 @@ net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch btrfs-clear-missing-device-status-bit-in-btrfs_close_one_device.patch btrfs-fix-lost-error-handling-when-replaying-directory-deletes.patch btrfs-call-btrfs_check_rw_degradable-only-if-there-is-a-missing-device.patch +powerpc-kvm-fix-kvm_use_magic_page.patch +ia64-kprobes-fix-to-pass-correct-trampoline-address-to-the-handler.patch +hwmon-pmbus-lm25066-add-offset-coefficients.patch +regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch +regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch +edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch +mwifiex-fix-division-by-zero-in-fw-download-path.patch +ath6kl-fix-division-by-zero-in-send-path.patch +ath6kl-fix-control-message-timeout.patch +ath10k-fix-control-message-timeout.patch +ath10k-fix-division-by-zero-in-send-path.patch +pci-mark-atheros-qca6174-to-avoid-bus-reset.patch +rtl8187-fix-control-message-timeouts.patch +evm-mark-evm_fixmode-as-__ro_after_init.patch +ifb-depend-on-netfilter-alternatively-to-tc.patch +wcn36xx-fix-ht40-capability-for-2ghz-band.patch +mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch +libata-fix-checking-of-dma-state.patch +wcn36xx-handle-connection-loss-indication.patch +rsi-fix-occasional-initialisation-failure-with-bt-coex.patch +rsi-fix-key-enabled-check-causing-unwanted-encryption-for-vap_id-0.patch +rsi-fix-rate-mask-set-leading-to-p2p-failure.patch +rsi-fix-module-dev_oper_mode-parameter-description.patch diff --git a/queue-5.4/wcn36xx-fix-ht40-capability-for-2ghz-band.patch b/queue-5.4/wcn36xx-fix-ht40-capability-for-2ghz-band.patch new file mode 100644 index 00000000000..2f69d41e824 --- /dev/null +++ b/queue-5.4/wcn36xx-fix-ht40-capability-for-2ghz-band.patch @@ -0,0 +1,37 @@ +From 960ae77f25631bbe4e3aafefe209b52e044baf31 Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Wed, 20 Oct 2021 15:38:53 +0200 +Subject: wcn36xx: Fix HT40 capability for 2Ghz band + +From: Loic Poulain + +commit 960ae77f25631bbe4e3aafefe209b52e044baf31 upstream. + +All wcn36xx controllers are supposed to support HT40 (and SGI40), +This doubles the maximum bitrate/throughput with compatible APs. + +Tested with wcn3620 & wcn3680B. + +Cc: stable@vger.kernel.org +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") +Signed-off-by: Loic Poulain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1634737133-22336-1-git-send-email-loic.poulain@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wcn36xx/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -134,7 +134,9 @@ static struct ieee80211_supported_band w + .cap = IEEE80211_HT_CAP_GRN_FLD | + IEEE80211_HT_CAP_SGI_20 | + IEEE80211_HT_CAP_DSSSCCK40 | +- IEEE80211_HT_CAP_LSIG_TXOP_PROT, ++ IEEE80211_HT_CAP_LSIG_TXOP_PROT | ++ IEEE80211_HT_CAP_SGI_40 | ++ IEEE80211_HT_CAP_SUP_WIDTH_20_40, + .ht_supported = true, + .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, diff --git a/queue-5.4/wcn36xx-handle-connection-loss-indication.patch b/queue-5.4/wcn36xx-handle-connection-loss-indication.patch new file mode 100644 index 00000000000..dfe458d81a4 --- /dev/null +++ b/queue-5.4/wcn36xx-handle-connection-loss-indication.patch @@ -0,0 +1,90 @@ +From d6dbce453b19c64b96f3e927b10230f9a704b504 Mon Sep 17 00:00:00 2001 +From: Benjamin Li +Date: Wed, 1 Sep 2021 11:06:05 -0700 +Subject: wcn36xx: handle connection loss indication + +From: Benjamin Li + +commit d6dbce453b19c64b96f3e927b10230f9a704b504 upstream. + +Firmware sends delete_sta_context_ind when it detects the AP has gone +away in STA mode. Right now the handler for that indication only handles +AP mode; fix it to also handle STA mode. + +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Li +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Loic Poulain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210901180606.11686-1-benl@squareup.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wcn36xx/smd.c | 44 ++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/ath/wcn36xx/smd.c ++++ b/drivers/net/wireless/ath/wcn36xx/smd.c +@@ -2340,30 +2340,52 @@ static int wcn36xx_smd_delete_sta_contex + size_t len) + { + struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf; +- struct wcn36xx_vif *tmp; ++ struct wcn36xx_vif *vif_priv; ++ struct ieee80211_vif *vif; ++ struct ieee80211_bss_conf *bss_conf; + struct ieee80211_sta *sta; ++ bool found = false; + + if (len != sizeof(*rsp)) { + wcn36xx_warn("Corrupted delete sta indication\n"); + return -EIO; + } + +- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n", +- rsp->addr2, rsp->sta_id); ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "delete station indication %pM index %d reason %d\n", ++ rsp->addr2, rsp->sta_id, rsp->reason_code); + +- list_for_each_entry(tmp, &wcn->vif_list, list) { ++ list_for_each_entry(vif_priv, &wcn->vif_list, list) { + rcu_read_lock(); +- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2); +- if (sta) +- ieee80211_report_low_ack(sta, 0); ++ vif = wcn36xx_priv_to_vif(vif_priv); ++ ++ if (vif->type == NL80211_IFTYPE_STATION) { ++ /* We could call ieee80211_find_sta too, but checking ++ * bss_conf is clearer. ++ */ ++ bss_conf = &vif->bss_conf; ++ if (vif_priv->sta_assoc && ++ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) { ++ found = true; ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "connection loss bss_index %d\n", ++ vif_priv->bss_index); ++ ieee80211_connection_loss(vif); ++ } ++ } else { ++ sta = ieee80211_find_sta(vif, rsp->addr2); ++ if (sta) { ++ found = true; ++ ieee80211_report_low_ack(sta, 0); ++ } ++ } ++ + rcu_read_unlock(); +- if (sta) ++ if (found) + return 0; + } + +- wcn36xx_warn("STA with addr %pM and index %d not found\n", +- rsp->addr2, +- rsp->sta_id); ++ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2); + return -ENOENT; + } +