From: Greg Kroah-Hartman Date: Sat, 13 Nov 2021 14:35:01 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v5.4.160~123 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=47bf0c0323de96ec7f8074262249d143512887c4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: ath10k-fix-control-message-timeout.patch ath10k-fix-division-by-zero-in-send-path.patch ath6kl-fix-control-message-timeout.patch ath6kl-fix-division-by-zero-in-send-path.patch edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch evm-mark-evm_fixmode-as-__ro_after_init.patch hwmon-pmbus-lm25066-add-offset-coefficients.patch ifb-depend-on-netfilter-alternatively-to-tc.patch libata-fix-checking-of-dma-state.patch mwifiex-fix-division-by-zero-in-fw-download-path.patch mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch pci-mark-atheros-qca6174-to-avoid-bus-reset.patch regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch rtl8187-fix-control-message-timeouts.patch wcn36xx-fix-ht40-capability-for-2ghz-band.patch wcn36xx-handle-connection-loss-indication.patch --- diff --git a/queue-4.14/ath10k-fix-control-message-timeout.patch b/queue-4.14/ath10k-fix-control-message-timeout.patch new file mode 100644 index 00000000000..9767c0b28de --- /dev/null +++ b/queue-4.14/ath10k-fix-control-message-timeout.patch @@ -0,0 +1,34 @@ +From 5286132324230168d3fab6ffc16bfd7de85bdfb4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:19 +0200 +Subject: ath10k: fix control-message timeout + +From: Johan Hovold + +commit 5286132324230168d3fab6ffc16bfd7de85bdfb4 upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Cc: stable@vger.kernel.org # 4.14 +Cc: Erik Stromdahl +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -536,7 +536,7 @@ static int ath10k_usb_submit_ctrl_in(str + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath10k_warn(ar, "Failed to read usb control message: %d\n", diff --git a/queue-4.14/ath10k-fix-division-by-zero-in-send-path.patch b/queue-4.14/ath10k-fix-division-by-zero-in-send-path.patch new file mode 100644 index 00000000000..22213dbbf00 --- /dev/null +++ b/queue-4.14/ath10k-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,43 @@ +From a006acb931317aad3a8dd41333ebb0453caf49b8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:17 +0200 +Subject: ath10k: fix division by zero in send path + +From: Johan Hovold + +commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream. + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in ath10k_usb_hif_tx_sg() in case a malicious device +has broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Cc: stable@vger.kernel.org # 4.14 +Cc: Erik Stromdahl +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -875,6 +875,11 @@ static int ath10k_usb_setup_pipe_resourc + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = diff --git a/queue-4.14/ath6kl-fix-control-message-timeout.patch b/queue-4.14/ath6kl-fix-control-message-timeout.patch new file mode 100644 index 00000000000..876b1396a8c --- /dev/null +++ b/queue-4.14/ath6kl-fix-control-message-timeout.patch @@ -0,0 +1,33 @@ +From a066d28a7e729f808a3e6eff22e70c003091544e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:20 +0200 +Subject: ath6kl: fix control-message timeout + +From: Johan Hovold + +commit a066d28a7e729f808a3e6eff22e70c003091544e upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support") +Cc: stable@vger.kernel.org # 3.4 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath6kl/usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -912,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(str + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath6kl_warn("Failed to read usb control message: %d\n", ret); diff --git a/queue-4.14/ath6kl-fix-division-by-zero-in-send-path.patch b/queue-4.14/ath6kl-fix-division-by-zero-in-send-path.patch new file mode 100644 index 00000000000..417d7d5c915 --- /dev/null +++ b/queue-4.14/ath6kl-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,42 @@ +From c1b9ca365deae667192be9fe24db244919971234 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:18 +0200 +Subject: ath6kl: fix division by zero in send path + +From: Johan Hovold + +commit c1b9ca365deae667192be9fe24db244919971234 upstream. + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in ath10k_usb_hif_tx_sg() in case a malicious device +has broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 9cbee358687e ("ath6kl: add full USB support") +Cc: stable@vger.kernel.org # 3.5 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resourc + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = diff --git a/queue-4.14/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch b/queue-4.14/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch new file mode 100644 index 00000000000..258e7f2efb6 --- /dev/null +++ b/queue-4.14/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch @@ -0,0 +1,37 @@ +From 537bddd069c743759addf422d0b8f028ff0f8dbc Mon Sep 17 00:00:00 2001 +From: Eric Badger +Date: Sun, 10 Oct 2021 10:06:56 -0700 +Subject: EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell + +From: Eric Badger + +commit 537bddd069c743759addf422d0b8f028ff0f8dbc upstream. + +The computation of TOHM is off by one bit. This missed bit results in +too low a value for TOHM, which can cause errors in regular memory to +incorrectly report: + + EDAC MC0: 1 CE Error at MMIOH area, on addr 0x000000207fffa680 on any memory + +Fixes: 50d1bb93672f ("sb_edac: add support for Haswell based systems") +Cc: stable@vger.kernel.org +Reported-by: Meeta Saggi +Signed-off-by: Eric Badger +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20211010170127.848113-1-ebadger@purestorage.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/sb_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1014,7 +1014,7 @@ static u64 haswell_get_tohm(struct sbrid + pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®); + rc = ((reg << 6) | rc) << 26; + +- return rc | 0x1ffffff; ++ return rc | 0x3ffffff; + } + + static u64 knl_get_tolm(struct sbridge_pvt *pvt) diff --git a/queue-4.14/evm-mark-evm_fixmode-as-__ro_after_init.patch b/queue-4.14/evm-mark-evm_fixmode-as-__ro_after_init.patch new file mode 100644 index 00000000000..ad7bd080646 --- /dev/null +++ b/queue-4.14/evm-mark-evm_fixmode-as-__ro_after_init.patch @@ -0,0 +1,31 @@ +From 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 Mon Sep 17 00:00:00 2001 +From: Austin Kim +Date: Thu, 28 Oct 2021 12:26:42 +0100 +Subject: evm: mark evm_fixmode as __ro_after_init + +From: Austin Kim + +commit 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 upstream. + +The evm_fixmode is only configurable by command-line option and it is never +modified outside initcalls, so declaring it with __ro_after_init is better. + +Signed-off-by: Austin Kim +Cc: stable@vger.kernel.org +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/evm/evm_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -56,7 +56,7 @@ char *evm_config_xattrnames[] = { + NULL + }; + +-static int evm_fixmode; ++static int evm_fixmode __ro_after_init; + static int __init evm_set_fixmode(char *str) + { + if (strncmp(str, "fix", 3) == 0) diff --git a/queue-4.14/hwmon-pmbus-lm25066-add-offset-coefficients.patch b/queue-4.14/hwmon-pmbus-lm25066-add-offset-coefficients.patch new file mode 100644 index 00000000000..e838c0b1ed7 --- /dev/null +++ b/queue-4.14/hwmon-pmbus-lm25066-add-offset-coefficients.patch @@ -0,0 +1,153 @@ +From ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 Mon Sep 17 00:00:00 2001 +From: Zev Weiss +Date: Tue, 28 Sep 2021 02:22:35 -0700 +Subject: hwmon: (pmbus/lm25066) Add offset coefficients + +From: Zev Weiss + +commit ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 upstream. + +With the exception of the lm5066i, all the devices handled by this +driver had been missing their offset ('b') coefficients for direct +format readings. + +Cc: stable@vger.kernel.org +Fixes: 58615a94f6a1 ("hwmon: (pmbus/lm25066) Add support for LM25056") +Fixes: e53e6497fc9f ("hwmon: (pmbus/lm25066) Refactor device specific coefficients") +Signed-off-by: Zev Weiss +Link: https://lore.kernel.org/r/20210928092242.30036-2-zev@bewilderbeest.net +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/lm25066.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/drivers/hwmon/pmbus/lm25066.c ++++ b/drivers/hwmon/pmbus/lm25066.c +@@ -69,22 +69,27 @@ static struct __coeff lm25066_coeff[6][P + [lm25056] = { + [PSC_VOLTAGE_IN] = { + .m = 16296, ++ .b = 1343, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13797, ++ .b = -1833, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6726, ++ .b = -537, + .R = -2, + }, + [PSC_POWER] = { + .m = 5501, ++ .b = -2908, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 26882, ++ .b = -5646, + .R = -4, + }, + [PSC_TEMPERATURE] = { +@@ -96,26 +101,32 @@ static struct __coeff lm25066_coeff[6][P + [lm25066] = { + [PSC_VOLTAGE_IN] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13661, ++ .b = -5200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6852, ++ .b = -3100, + .R = -2, + }, + [PSC_POWER] = { + .m = 736, ++ .b = -3300, + .R = -2, + }, + [PSC_POWER_L] = { + .m = 369, ++ .b = -1900, + .R = -2, + }, + [PSC_TEMPERATURE] = { +@@ -155,26 +166,32 @@ static struct __coeff lm25066_coeff[6][P + [lm5064] = { + [PSC_VOLTAGE_IN] = { + .m = 4611, ++ .b = -642, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4621, ++ .b = 423, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10742, ++ .b = 1552, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5456, ++ .b = 2118, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = 8524, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 612, ++ .b = 11202, + .R = -3, + }, + [PSC_TEMPERATURE] = { +@@ -184,26 +201,32 @@ static struct __coeff lm25066_coeff[6][P + [lm5066] = { + [PSC_VOLTAGE_IN] = { + .m = 4587, ++ .b = -1200, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4587, ++ .b = -2400, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10753, ++ .b = -1200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5405, ++ .b = -600, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = -6000, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 605, ++ .b = -8000, + .R = -3, + }, + [PSC_TEMPERATURE] = { diff --git a/queue-4.14/ifb-depend-on-netfilter-alternatively-to-tc.patch b/queue-4.14/ifb-depend-on-netfilter-alternatively-to-tc.patch new file mode 100644 index 00000000000..83ed858db68 --- /dev/null +++ b/queue-4.14/ifb-depend-on-netfilter-alternatively-to-tc.patch @@ -0,0 +1,33 @@ +From 046178e726c2977d686ba5e07105d5a6685c830e Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Tue, 26 Oct 2021 07:15:32 +0200 +Subject: ifb: Depend on netfilter alternatively to tc + +From: Lukas Wunner + +commit 046178e726c2977d686ba5e07105d5a6685c830e upstream. + +IFB originally depended on NET_CLS_ACT for traffic redirection. +But since v4.5, that may be achieved with NFT_FWD_NETDEV as well. + +Fixes: 39e6dea28adc ("netfilter: nf_tables: add forward expression to the netdev family") +Signed-off-by: Lukas Wunner +Cc: # v4.5+: bcfabee1afd9: netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress +Cc: # v4.5+ +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/Kconfig ++++ b/drivers/net/Kconfig +@@ -104,7 +104,7 @@ config NET_FC + + config IFB + tristate "Intermediate Functional Block support" +- depends on NET_CLS_ACT ++ depends on NET_ACT_MIRRED || NFT_FWD_NETDEV + ---help--- + This is an intermediate driver that allows sharing of + resources. diff --git a/queue-4.14/libata-fix-checking-of-dma-state.patch b/queue-4.14/libata-fix-checking-of-dma-state.patch new file mode 100644 index 00000000000..f329df45583 --- /dev/null +++ b/queue-4.14/libata-fix-checking-of-dma-state.patch @@ -0,0 +1,42 @@ +From f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= +Date: Tue, 12 Oct 2021 08:27:44 +0200 +Subject: libata: fix checking of DMA state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Reimar Döffinger + +commit f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b upstream. + +Checking if DMA is enabled should be done via the +ata_dma_enabled helper function, since the init state +0xff indicates disabled. +This meant that ATA_CMD_READ_LOG_DMA_EXT was used and probed +for before DMA was enabled, which caused hangs for some combinations +of controllers and devices. +It might also have caused it to be incorrectly disabled as broken, +but there have been no reports of that. + +Cc: stable@vger.kernel.org +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195895 +Signed-off-by: Reimar Döffinger +Tested-by: Paul Menzel +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2081,7 +2081,7 @@ unsigned int ata_read_log_page(struct at + + retry: + ata_tf_init(dev, &tf); +- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) && ++ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) && + !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) { + tf.command = ATA_CMD_READ_LOG_DMA_EXT; + tf.protocol = ATA_PROT_DMA; diff --git a/queue-4.14/mwifiex-fix-division-by-zero-in-fw-download-path.patch b/queue-4.14/mwifiex-fix-division-by-zero-in-fw-download-path.patch new file mode 100644 index 00000000000..6f6f2aa1365 --- /dev/null +++ b/queue-4.14/mwifiex-fix-division-by-zero-in-fw-download-path.patch @@ -0,0 +1,61 @@ +From 89f8765a11d8df49296d92c404067f9b5c58ee26 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Oct 2021 10:08:19 +0200 +Subject: mwifiex: fix division by zero in fw download path + +From: Johan Hovold + +commit 89f8765a11d8df49296d92c404067f9b5c58ee26 upstream. + +Add the missing endpoint sanity checks to probe() to avoid division by +zero in mwifiex_write_data_sync() in case a malicious device has broken +descriptors (or when doing descriptor fuzz testing). + +Only add checks for the firmware-download boot stage, which require both +command endpoints, for now. The driver looks like it will handle a +missing endpoint during normal operation without oopsing, albeit not +very gracefully as it will try to submit URBs to the default pipe and +fail. + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 4daffe354366 ("mwifiex: add support for Marvell USB8797 chipset") +Cc: stable@vger.kernel.org # 3.5 +Cc: Amitkumar Karwar +Signed-off-by: Johan Hovold +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027080819.6675-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -491,6 +491,22 @@ static int mwifiex_usb_probe(struct usb_ + } + } + ++ switch (card->usb_boot_state) { ++ case USB8XXX_FW_DNLD: ++ /* Reject broken descriptors. */ ++ if (!card->rx_cmd_ep || !card->tx_cmd_ep) ++ return -ENODEV; ++ if (card->bulk_out_maxpktsize == 0) ++ return -ENODEV; ++ break; ++ case USB8XXX_FW_READY: ++ /* Assume the driver can handle missing endpoints for now. */ ++ break; ++ default: ++ WARN_ON(1); ++ return -ENODEV; ++ } ++ + usb_set_intfdata(intf, card); + + ret = mwifiex_add_card(card, &card->fw_done, &usb_ops, diff --git a/queue-4.14/mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch b/queue-4.14/mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch new file mode 100644 index 00000000000..87ceef86b19 --- /dev/null +++ b/queue-4.14/mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch @@ -0,0 +1,54 @@ +From e5f4eb8223aa740237cd463246a7debcddf4eda1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= +Date: Mon, 11 Oct 2021 15:32:23 +0200 +Subject: mwifiex: Read a PCI register after writing the TX ring write pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonas Dreßler + +commit e5f4eb8223aa740237cd463246a7debcddf4eda1 upstream. + +On the 88W8897 PCIe+USB card the firmware randomly crashes after setting +the TX ring write pointer. The issue is present in the latest firmware +version 15.68.19.p21 of the PCIe+USB card. + +Those firmware crashes can be worked around by reading any PCI register +of the card after setting that register, so read the PCI_VENDOR_ID +register here. The reason this works is probably because we keep the bus +from entering an ASPM state for a bit longer, because that's what causes +the cards firmware to crash. + +This fixes a bug where during RX/TX traffic and with ASPM L1 substates +enabled (the specific substates where the issue happens appear to be +platform dependent), the firmware crashes and eventually a command +timeout appears in the logs. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681 +Cc: stable@vger.kernel.org +Signed-off-by: Jonas Dreßler +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211011133224.15561-2-verdre@v0yd.nl +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1316,6 +1316,14 @@ mwifiex_pcie_send_data(struct mwifiex_ad + ret = -1; + goto done_unmap; + } ++ ++ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card ++ * seems to crash randomly after setting the TX ring write pointer when ++ * ASPM powersaving is enabled. A workaround seems to be keeping the bus ++ * busy by reading a random register afterwards. ++ */ ++ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val); ++ + if ((mwifiex_pcie_txbd_not_full(card)) && + tx_param->next_pkt_len) { + /* have more packets and TxBD still can hold more */ diff --git a/queue-4.14/pci-mark-atheros-qca6174-to-avoid-bus-reset.patch b/queue-4.14/pci-mark-atheros-qca6174-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..894351f8a38 --- /dev/null +++ b/queue-4.14/pci-mark-atheros-qca6174-to-avoid-bus-reset.patch @@ -0,0 +1,38 @@ +From e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 Mon Sep 17 00:00:00 2001 +From: Ingmar Klein +Date: Fri, 9 Apr 2021 11:26:33 +0200 +Subject: PCI: Mark Atheros QCA6174 to avoid bus reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ingmar Klein + +commit e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 upstream. + +When passing the Atheros QCA6174 through to a virtual machine, the VM hangs +at the point where the ath10k driver loads. + +Add a quirk to avoid bus resets on this device, which avoids the hang. + +[bhelgaas: commit log] +Link: https://lore.kernel.org/r/08982e05-b6e8-5a8d-24ab-da1488ee50a8@web.de +Signed-off-by: Ingmar Klein +Signed-off-by: Bjorn Helgaas +Reviewed-by: Pali Rohár +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3414,6 +3414,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_A + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset); + + /* + * Some TI KeyStone C667X devices do not support bus/hot reset. The PCIESS diff --git a/queue-4.14/regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch b/queue-4.14/regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch new file mode 100644 index 00000000000..9d11b9faf4d --- /dev/null +++ b/queue-4.14/regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch @@ -0,0 +1,34 @@ +From a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 8 Oct 2021 13:37:14 +0200 +Subject: regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property + +From: Krzysztof Kozlowski + +commit a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a upstream. + +The driver was always parsing "s5m8767,pmic-buck-default-dvs-idx", not +"s5m8767,pmic-buck234-default-dvs-idx". + +Cc: +Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Rob Herring +Message-Id: <20211008113723.134648-3-krzysztof.kozlowski@canonical.com> +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -39,7 +39,7 @@ Optional properties of the main device n + + Additional properties required if either of the optional properties are used: + +- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from ++ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from + the possible 8 options selectable by the dvs gpios. The value of this + property should be between 0 and 7. If not specified or if out of range, the + default value of this property is set to 0. diff --git a/queue-4.14/regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch b/queue-4.14/regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch new file mode 100644 index 00000000000..ac7f4d18959 --- /dev/null +++ b/queue-4.14/regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch @@ -0,0 +1,113 @@ +From b16bef60a9112b1e6daf3afd16484eb06e7ce792 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 8 Oct 2021 13:37:13 +0200 +Subject: regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled + +From: Krzysztof Kozlowski + +commit b16bef60a9112b1e6daf3afd16484eb06e7ce792 upstream. + +The driver and its bindings, before commit 04f9f068a619 ("regulator: +s5m8767: Modify parsing method of the voltage table of buck2/3/4") were +requiring to provide at least one safe/default voltage for DVS registers +if DVS GPIO is not being enabled. + +IOW, if s5m8767,pmic-buck2-uses-gpio-dvs is missing, the +s5m8767,pmic-buck2-dvs-voltage should still be present and contain one +voltage. + +This requirement was coming from driver behavior matching this condition +(none of DVS GPIO is enabled): it was always initializing the DVS +selector pins to 0 and keeping the DVS enable setting at reset value +(enabled). Therefore if none of DVS GPIO is enabled in devicetree, +driver was configuring the first DVS voltage for buck[234]. + +Mentioned commit 04f9f068a619 ("regulator: s5m8767: Modify parsing +method of the voltage table of buck2/3/4") broke it because DVS voltage +won't be parsed from devicetree if DVS GPIO is not enabled. After the +change, driver will configure bucks to use the register reset value as +voltage which might have unpleasant effects. + +Fix this by relaxing the bindings constrain: if DVS GPIO is not enabled +in devicetree (therefore DVS voltage is also not parsed), explicitly +disable it. + +Cc: +Fixes: 04f9f068a619 ("regulator: s5m8767: Modify parsing method of the voltage table of buck2/3/4") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Rob Herring +Message-Id: <20211008113723.134648-2-krzysztof.kozlowski@canonical.com> +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 21 +++------- + drivers/regulator/s5m8767.c | 21 ++++------ + 2 files changed, 17 insertions(+), 25 deletions(-) + +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -13,6 +13,14 @@ common regulator binding documented in: + + + Required properties of the main device node (the parent!): ++ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used ++ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. ++ ++ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional ++ property is specified, then all the eight voltage values for the ++ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. ++ ++Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) + units for buck2 when changing voltage using gpio dvs. Refer to [1] below + for additional information. +@@ -25,19 +33,6 @@ Required properties of the main device n + units for buck4 when changing voltage using gpio dvs. Refer to [1] below + for additional information. + +- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used +- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. +- +- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' +- property should specify atleast one voltage level (which would be a +- safe operating voltage). +- +- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, then all the eight voltage values for the +- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. +- +-Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. + - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. + - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs. +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -845,18 +845,15 @@ static int s5m8767_pmic_probe(struct pla + /* DS4 GPIO */ + gpio_direction_output(pdata->buck_ds[2], 0x0); + +- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || +- pdata->buck4_gpiodvs) { +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK2CTRL, 1 << 1, +- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK3CTRL, 1 << 1, +- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK4CTRL, 1 << 1, +- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); +- } ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK2CTRL, 1 << 1, ++ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK3CTRL, 1 << 1, ++ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK4CTRL, 1 << 1, ++ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); + + /* Initialize GPIO DVS registers */ + for (i = 0; i < 8; i++) { diff --git a/queue-4.14/rtl8187-fix-control-message-timeouts.patch b/queue-4.14/rtl8187-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..e92b61993b1 --- /dev/null +++ b/queue-4.14/rtl8187-fix-control-message-timeouts.patch @@ -0,0 +1,87 @@ +From 2e9be536a213e838daed6ba42024dd68954ac061 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 14:05:21 +0200 +Subject: rtl8187: fix control-message timeouts + +From: Johan Hovold + +commit 2e9be536a213e838daed6ba42024dd68954ac061 upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 605bebe23bf6 ("[PATCH] Add rtl8187 wireless driver") +Cc: stable@vger.kernel.org # 2.6.23 +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211025120522.6045-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +@@ -31,7 +31,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_pr + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + val = priv->io_dmabuf->bits8; + mutex_unlock(&priv->io_mutex); +@@ -48,7 +48,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_ + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + val = priv->io_dmabuf->bits16; + mutex_unlock(&priv->io_mutex); +@@ -65,7 +65,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_ + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + val = priv->io_dmabuf->bits32; + mutex_unlock(&priv->io_mutex); +@@ -82,7 +82,7 @@ void rtl818x_iowrite8_idx(struct rtl8187 + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -96,7 +96,7 @@ void rtl818x_iowrite16_idx(struct rtl818 + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -110,7 +110,7 @@ void rtl818x_iowrite32_idx(struct rtl818 + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -186,7 +186,7 @@ static void rtl8225_write_8051(struct ie + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data), +- HZ / 2); ++ 500); + + mutex_unlock(&priv->io_mutex); + diff --git a/queue-4.14/series b/queue-4.14/series index 91f67e4ea7e..3d66fbf3403 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -29,3 +29,20 @@ spi-spl022-fix-microwire-full-duplex-mode.patch watchdog-fix-omap-watchdog-early-handling.patch vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch btrfs-fix-lost-error-handling-when-replaying-directory-deletes.patch +hwmon-pmbus-lm25066-add-offset-coefficients.patch +regulator-s5m8767-do-not-use-reset-value-as-dvs-voltage-if-gpio-dvs-is-disabled.patch +regulator-dt-bindings-samsung-s5m8767-correct-s5m8767-pmic-buck-default-dvs-idx-property.patch +edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch +mwifiex-fix-division-by-zero-in-fw-download-path.patch +ath6kl-fix-division-by-zero-in-send-path.patch +ath6kl-fix-control-message-timeout.patch +ath10k-fix-control-message-timeout.patch +ath10k-fix-division-by-zero-in-send-path.patch +pci-mark-atheros-qca6174-to-avoid-bus-reset.patch +rtl8187-fix-control-message-timeouts.patch +evm-mark-evm_fixmode-as-__ro_after_init.patch +ifb-depend-on-netfilter-alternatively-to-tc.patch +wcn36xx-fix-ht40-capability-for-2ghz-band.patch +mwifiex-read-a-pci-register-after-writing-the-tx-ring-write-pointer.patch +libata-fix-checking-of-dma-state.patch +wcn36xx-handle-connection-loss-indication.patch diff --git a/queue-4.14/wcn36xx-fix-ht40-capability-for-2ghz-band.patch b/queue-4.14/wcn36xx-fix-ht40-capability-for-2ghz-band.patch new file mode 100644 index 00000000000..01c11704738 --- /dev/null +++ b/queue-4.14/wcn36xx-fix-ht40-capability-for-2ghz-band.patch @@ -0,0 +1,37 @@ +From 960ae77f25631bbe4e3aafefe209b52e044baf31 Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Wed, 20 Oct 2021 15:38:53 +0200 +Subject: wcn36xx: Fix HT40 capability for 2Ghz band + +From: Loic Poulain + +commit 960ae77f25631bbe4e3aafefe209b52e044baf31 upstream. + +All wcn36xx controllers are supposed to support HT40 (and SGI40), +This doubles the maximum bitrate/throughput with compatible APs. + +Tested with wcn3620 & wcn3680B. + +Cc: stable@vger.kernel.org +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") +Signed-off-by: Loic Poulain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1634737133-22336-1-git-send-email-loic.poulain@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wcn36xx/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -133,7 +133,9 @@ static struct ieee80211_supported_band w + .cap = IEEE80211_HT_CAP_GRN_FLD | + IEEE80211_HT_CAP_SGI_20 | + IEEE80211_HT_CAP_DSSSCCK40 | +- IEEE80211_HT_CAP_LSIG_TXOP_PROT, ++ IEEE80211_HT_CAP_LSIG_TXOP_PROT | ++ IEEE80211_HT_CAP_SGI_40 | ++ IEEE80211_HT_CAP_SUP_WIDTH_20_40, + .ht_supported = true, + .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, diff --git a/queue-4.14/wcn36xx-handle-connection-loss-indication.patch b/queue-4.14/wcn36xx-handle-connection-loss-indication.patch new file mode 100644 index 00000000000..10dda3359f5 --- /dev/null +++ b/queue-4.14/wcn36xx-handle-connection-loss-indication.patch @@ -0,0 +1,90 @@ +From d6dbce453b19c64b96f3e927b10230f9a704b504 Mon Sep 17 00:00:00 2001 +From: Benjamin Li +Date: Wed, 1 Sep 2021 11:06:05 -0700 +Subject: wcn36xx: handle connection loss indication + +From: Benjamin Li + +commit d6dbce453b19c64b96f3e927b10230f9a704b504 upstream. + +Firmware sends delete_sta_context_ind when it detects the AP has gone +away in STA mode. Right now the handler for that indication only handles +AP mode; fix it to also handle STA mode. + +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Li +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Loic Poulain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210901180606.11686-1-benl@squareup.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wcn36xx/smd.c | 44 ++++++++++++++++++++++++--------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/ath/wcn36xx/smd.c ++++ b/drivers/net/wireless/ath/wcn36xx/smd.c +@@ -2082,30 +2082,52 @@ static int wcn36xx_smd_delete_sta_contex + size_t len) + { + struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf; +- struct wcn36xx_vif *tmp; ++ struct wcn36xx_vif *vif_priv; ++ struct ieee80211_vif *vif; ++ struct ieee80211_bss_conf *bss_conf; + struct ieee80211_sta *sta; ++ bool found = false; + + if (len != sizeof(*rsp)) { + wcn36xx_warn("Corrupted delete sta indication\n"); + return -EIO; + } + +- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n", +- rsp->addr2, rsp->sta_id); ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "delete station indication %pM index %d reason %d\n", ++ rsp->addr2, rsp->sta_id, rsp->reason_code); + +- list_for_each_entry(tmp, &wcn->vif_list, list) { ++ list_for_each_entry(vif_priv, &wcn->vif_list, list) { + rcu_read_lock(); +- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2); +- if (sta) +- ieee80211_report_low_ack(sta, 0); ++ vif = wcn36xx_priv_to_vif(vif_priv); ++ ++ if (vif->type == NL80211_IFTYPE_STATION) { ++ /* We could call ieee80211_find_sta too, but checking ++ * bss_conf is clearer. ++ */ ++ bss_conf = &vif->bss_conf; ++ if (vif_priv->sta_assoc && ++ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) { ++ found = true; ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "connection loss bss_index %d\n", ++ vif_priv->bss_index); ++ ieee80211_connection_loss(vif); ++ } ++ } else { ++ sta = ieee80211_find_sta(vif, rsp->addr2); ++ if (sta) { ++ found = true; ++ ieee80211_report_low_ack(sta, 0); ++ } ++ } ++ + rcu_read_unlock(); +- if (sta) ++ if (found) + return 0; + } + +- wcn36xx_warn("STA with addr %pM and index %d not found\n", +- rsp->addr2, +- rsp->sta_id); ++ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2); + return -ENOENT; + } +