- 14 Feb, 2022 1 commit
-
-
Wen Gong authored
The rate_idx which passed to ath11k_debugfs_sta_add_tx_stats() by ath11k_dp_tx_update_txcompl() is not initialized, add initialization for it. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Fixes: 1b8bb94c ("ath11k: report tx bitrate for iw wlan station dump") Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Signed-off-by:
Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220209060816.423-1-quic_wgong@quicinc.com
-
- 10 Feb, 2022 1 commit
-
-
Dan Carpenter authored
This code needs "channel" to be initialized to NULL for it to work correctly. Fixes: d6f27466 ("wcn36xx: Track the band and channel we are tuned to") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by:
Bryan O'Donoghue <bryan.odonghue@linaro.org> Signed-off-by:
-
- 03 Feb, 2022 1 commit
-
-
Yang Li authored
Eliminate the follow smatch warnings: drivers/net/wireless/ath/wcn36xx/main.c:1394 wcn36xx_get_survey() warn: inconsistent indenting drivers/net/wireless/ath/wcn36xx/txrx.c:379 wcn36xx_rx_skb() warn: inconsistent indenting Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Signed-off-by:
Yang Li <yang.lee@linux.alibaba.com> Signed-off-by:
-
- 01 Feb, 2022 3 commits
-
-
John Crispin authored
New debugfs files to manually add/delete/pause/resume TWT dialogs for test/debug purposes. The debugfs files expect the following parameters - Add dialog echo '<Peer_MAC> <Dialog_ID> <Wake_Interval_Usec> <Wake_Interval_Mantis> <Wake_Duration_Usec> <First_SP_Offset> <TWT_Command> <1:Broadcast /0:Individual> <1:Triggered / 0:Untriggered> <1:Unannounced /0:Announced> <1:Protected / 0:Unprotected>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/add_dialog Example (Non-triggered and un-announced): echo '00:03:7F:20:13:52 1 102400 100 30720 20480 4 0 0 1 0' > /sys/kernel/debug/ieee80211/phy0/netdev:wlan0/twt/add_dialog - Delete dialog echo '<Peer_MAC> <Dialog_ID>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/del_dialog - Pause dialog echo '<Peer_MAC> <Dialog_ID>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/pause_dialog - Resume dialog echo '<Peer_MAC> <Dialog_ID> <SP_Offset_Usec> <Next_TWT_Size>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/resume_dialog Example: echo '00:03:7F:20:13:52 1 2000000 3' > /sys/kernel/debug/ieee80211/phy0/netdev:wlan0/twt/resume_dialog Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01179-QCAHKSWPL_SILICONZ-1 Signed-off-by:
John Crispin <john@phrozen.org> Signed-off-by:
Aloka Dixit <alokad@codeaurora.org> Signed-off-by:
-
John Crispin authored
These calls are used for debugging and will be required for WFA certification tests. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01179-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Seevalamuthu Mariappan authored
Add debugfs interface "fw_dbglog_config" to configure firmware log level. Configuration is done via WMI command WMI_DBGLOG_CFG_CMDID. Command to configure, echo "<dbglog_param> <values>" > /sys/kernel/debug/ath11k/<hw>/macX/fw_dbglog_config where dbglog_param can be, 1) WMI_DEBUG_LOG_PARAM_LOG_LEVEL - configure log level for a given module here, <values> = <0xaaaa00bb>, 'aaaa' - module id and 'bb' - loglevel 2) WMI_DEBUG_LOG_PARAM_VDEV_ENABLE - enable debug log for a given vdev here, <values> = vdev_id 3) WMI_DEBUG_LOG_PARAM_VDEV_DISABLE - disable debug log for a given vdev except ERROR logs here, <values> = vdev_id 4) WMI_DEBUG_LOG_PARAM_VDEV_ENABLE_BITMAP - set vdev enable bitmap here, <values> = vdev_enable_bitmap 5) WMI_DEBUG_LOG_PARAM_MOD_ENABLE_BITMAP - set a given log level to all the modules specified in the module bitmap. Command to configure for this log param, $ echo "5 <values> <module_id_index> <is_end>" > /sys/kernel/debug/ath11k/<hw>/macX/fw_dbglog_config here, <values> = <0xaaaaaaaa000000bb>, 'aaaaaaaa' - module bitmap and 'bb' - loglevel <module_id_index> = index of module bitmap. Max module id is 512. So, module_id_index is 0-15. <is_end> = to indicate if more configuration to follow. 6) WMI_DEBUG_LOG_PARAM_WOW_MOD_ENABLE_BITMAP - Wow mode specific logging enable. Command to configure for this log param, $ echo "6 <values> <module_id_index> <is_end>" > /sys/kernel/debug/ath11k/<hw>/macX/fw_dbglog_config here, <values> = <0xaaaaaaaa000000bb>, 'aaaaaaaa' - module bitmap and 'bb' - loglevel <module_id_index> = index of module bitmap. Max module id is 512. So, module_id_index is 0-15. <is_end> = to indicate if more configuration to follow. Sample command usage, To enable module WLAN_MODULE_WMI and log level ATH11K_FW_DBGLOG_VERBOSE, echo "1 0x10001" > /sys/kernel/debug/ath11k/<hw>/macX/fw_dbglog_config To enable module bit map from 32 to 63 and log level ATH11K_FW_DBGLOG_VERBOSE, echo "5 0xffffffff00000001 1 1" > /sys/kernel/debug/ath11k/<hw>/macX/fw_dbglog_config Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 Signed-off-by:Seevalamuthu Mariappan <quic_seevalam@quicinc.com> Signed-off-by:
-
- 31 Jan, 2022 8 commits
-
-
Colin Ian King authored
Currently tx_params is being re-assigned with a new value and the previous setting IEEE80211_HT_MCS_TX_RX_DIFF is being overwritten. The assignment operator is incorrect, the original intent was to bit-wise or the value in. Fix this by replacing the = operator with |= instead. Kudos to Christian Lamparter for suggesting the correct fix. Fixes: fe8ee9ad ("carl9170: mac80211 glue and command interface") Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Cc: <Stable@vger.kernel.org> Acked-by:
Christian Lamparter <chunkeey@gmail.com> Signed-off-by:
-
Bryan O'Donoghue authored
The spread of capability between the three WiFi silicon parts wcn36xx supports is: wcn3620 - 802.11 a/b/g wcn3660 - 802.11 a/b/g/n wcn3680 - 802.11 a/b/g/n/ac We currently treat wcn3660 as wcn3620 thus limiting it to 2GHz channels. Fix this regression by ensuring we differentiate between all three parts. Fixes: 8490987b ("wcn36xx: Hook and identify RF_IRIS_WCN3680") Cc: stable@vger.kernel.org Signed-off-by:
Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by:
Loic Poulain <loic.poulain@linaro.org> Signed-off-by:
-
Kalle Valo authored
If amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The reason for that was that we were using mhi_async_power_up() which does not check any errors. But mhi_sync_power_up() on the other hand does check for errors so let's use that to fix the crash. I was not able to find a reason why an async version was used. ath11k_mhi_start() (which enables state ATH11K_MHI_POWER_ON) is called from ath11k_hif_power_up(), which can sleep. So sync version should be safe to use here. [ 145.569731] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI [ 145.569789] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 145.569843] CPU: 2 PID: 1628 Comm: rmmod Kdump: loaded Tainted: G W 5.16.0-wt-ath+ #567 [ 145.569898] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 [ 145.569956] RIP: 0010:ath11k_hal_srng_access_begin+0xb5/0x2b0 [ath11k] [ 145.570028] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ec 01 00 00 48 8b ab a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 <0f> b6 14 02 48 89 e8 83 e0 07 83 c0 03 45 85 ed 75 48 38 d0 7c 08 [ 145.570089] RSP: 0018:ffffc900025d7ac0 EFLAGS: 00010246 [ 145.570144] RAX: dffffc0000000000 RBX: ffff88814fca2dd8 RCX: 1ffffffff50cb455 [ 145.570196] RDX: 0000000000000000 RSI: ffff88814fca2dd8 RDI: ffff88814fca2e80 [ 145.570252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffa8659497 [ 145.570329] R10: fffffbfff50cb292 R11: 0000000000000001 R12: ffff88814fca0000 [ 145.570410] R13: 0000000000000000 R14: ffff88814fca2798 R15: ffff88814fca2dd8 [ 145.570465] FS: 00007fa399988540(0000) GS:ffff888233e00000(0000) knlGS:0000000000000000 [ 145.570519] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 145.570571] CR2: 00007fa399b51421 CR3: 0000000137898002 CR4: 00000000003706e0 [ 145.570623] Call Trace: [ 145.570675] <TASK> [ 145.570727] ? ath11k_ce_tx_process_cb+0x34b/0x860 [ath11k] [ 145.570797] ath11k_ce_tx_process_cb+0x356/0x860 [ath11k] [ 145.570864] ? tasklet_init+0x150/0x150 [ 145.570919] ? ath11k_ce_alloc_pipes+0x280/0x280 [ath11k] [ 145.570986] ? tasklet_clear_sched+0x42/0xe0 [ 145.571042] ? tasklet_kill+0xe9/0x1b0 [ 145.571095] ? tasklet_clear_sched+0xe0/0xe0 [ 145.571148] ? irq_has_action+0x120/0x120 [ 145.571202] ath11k_ce_cleanup_pipes+0x45a/0x580 [ath11k] [ 145.571270] ? ath11k_pci_stop+0x10e/0x170 [ath11k_pci] [ 145.571345] ath11k_core_stop+0x8a/0xc0 [ath11k] [ 145.571434] ath11k_core_deinit+0x9e/0x150 [ath11k] [ 145.571499] ath11k_pci_remove+0xd2/0x260 [ath11k_pci] [ 145.571553] pci_device_remove+0x9a/0x1c0 [ 145.571605] __device_release_driver+0x332/0x660 [ 145.571659] driver_detach+0x1e7/0x2c0 [ 145.571712] bus_remove_driver+0xe2/0x2d0 [ 145.571772] pci_unregister_driver+0x21/0x250 [ 145.571826] __do_sys_delete_module+0x30a/0x4b0 [ 145.571879] ? free_module+0xac0/0xac0 [ 145.571933] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 145.571986] ? syscall_enter_from_user_mode+0x1d/0x50 [ 145.572039] ? lockdep_hardirqs_on+0x79/0x100 [ 145.572097] do_syscall_64+0x3b/0x90 [ 145.572153] entry_SYSCALL_64_after_hwframe+0x44/0xae Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Signed-off-by:
-
Kalle Valo authored
Mario reported that the kernel was crashing on suspend if ath11k was not able to find a board file: [ 473.693286] PM: Suspending system (s2idle) [ 473.693291] printk: Suspending console(s) (use no_console_suspend to debug) [ 474.407787] BUG: unable to handle page fault for address: 0000000000002070 [ 474.407791] #PF: supervisor read access in kernel mode [ 474.407794] #PF: error_code(0x0000) - not-present page [ 474.407798] PGD 0 P4D 0 [ 474.407801] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 474.407805] CPU: 2 PID: 2350 Comm: kworker/u32:14 Tainted: G W 5.16.0 #248 [...] [ 474.407868] Call Trace: [ 474.407870] <TASK> [ 474.407874] ? _raw_spin_lock_irqsave+0x2a/0x60 [ 474.407882] ? lock_timer_base+0x72/0xa0 [ 474.407889] ? _raw_spin_unlock_irqrestore+0x29/0x3d [ 474.407892] ? try_to_del_timer_sync+0x54/0x80 [ 474.407896] ath11k_dp_rx_pktlog_stop+0x49/0xc0 [ath11k] [ 474.407912] ath11k_core_suspend+0x34/0x130 [ath11k] [ 474.407923] ath11k_pci_pm_suspend+0x1b/0x50 [ath11k_pci] [ 474.407928] pci_pm_suspend+0x7e/0x170 [ 474.407935] ? pci_pm_freeze+0xc0/0xc0 [ 474.407939] dpm_run_callback+0x4e/0x150 [ 474.407947] __device_suspend+0x148/0x4c0 [ 474.407951] async_suspend+0x20/0x90 dmesg-efi-164255130401001: Oops#1 Part1 [ 474.407955] async_run_entry_fn+0x33/0x120 [ 474.407959] process_one_work+0x220/0x3f0 [ 474.407966] worker_thread+0x4a/0x3d0 [ 474.407971] kthread+0x17a/0x1a0 [ 474.407975] ? process_one_work+0x3f0/0x3f0 [ 474.407979] ? set_kthread_struct+0x40/0x40 [ 474.407983] ret_from_fork+0x22/0x30 [ 474.407991] </TASK> The issue here is that board file loading happens after ath11k_pci_probe() succesfully returns (ath11k initialisation happends asynchronously) and the suspend handler is still enabled, of course failing as ath11k is not properly initialised. Fix this by checking ATH11K_FLAG_QMI_FAIL during both suspend and resume. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Reported-by:
Mario Limonciello <mario.limonciello@amd.com> Link: https://bugzilla.kernel.org/show_bug.cgi?id=215504Signed-off-by:
-
Baochen Qiang authored
rx_desc_get_ldpc_support is missing in wcn6855_ops, resulting on WCN6855 a kernel crash after connecting to an AP and waiting for few minutes. Fix it by implementing WCN6855's version of this field and adding it to wcn6855_ops. Crash stack: [ 184.862605] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 184.862615] #PF: supervisor instruction fetch in kernel mode [ 184.862620] #PF: error_code(0x0010) - not-present page [ 184.862626] PGD 0 P4D 0 [ 184.862634] Oops: 0010 [#1] PREEMPT SMP PTI [ 184.862642] CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Not tainted 5.16.0-wt-ath+ #1 [ 184.862651] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0059.2019.1112.1124 11/12/2019 [ 184.862656] RIP: 0010:0x0 [ 184.862669] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [ 184.862673] RSP: 0018:ffff9eedc003cca8 EFLAGS: 00010202 [ 184.862680] RAX: 0000000000000000 RBX: ffff9eedc003cd30 RCX: 0000000000000002 [ 184.862686] RDX: 0000000000000002 RSI: ffffffffc1773458 RDI: ffff8eb5843de240 [ 184.862692] RBP: ffff8eb59685a0e0 R08: 0000000000000001 R09: ffff8eb6fef2b000 [ 184.862700] R10: ffff9eedc003cd70 R11: ffff8eb5880a9ff0 R12: ffff8eb5843de240 [ 184.862707] R13: 0000000000000000 R14: 0000000000000008 R15: 0000000000000003 [ 184.862714] FS: 0000000000000000(0000) GS:ffff8eb6f6c40000(0000) knlGS:0000000000000000 [ 184.862723] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 184.862733] CR2: ffffffffffffffd6 CR3: 000000002f60a001 CR4: 00000000003706e0 [ 184.862743] Call Trace: [ 184.862751] <IRQ> [ 184.862759] ath11k_dp_rx_h_ppdu+0x210/0x350 [ath11k] [ 184.862841] ath11k_dp_rx_process_received_packets+0x1e6/0x6b0 [ath11k] [ 184.862891] ath11k_dp_process_rx+0x32d/0x3e0 [ath11k] Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Fixes: b3febdcc ("ath11k: add LDPC FEC type in 802.11 radiotap header") Signed-off-by:
Baochen Qiang <quic_bqiang@quicinc.com> Signed-off-by:
-
Anilkumar Kolli authored
Add missing else statement in ath11k_dp_rx_process_mon_status() to fix below smatch warnings, drivers/net/wireless/ath/ath11k/dp_rx.c:3105 ath11k_dp_rx_process_mon_status() error: uninitialized symbol 'rx_buf_sz'. Fixes: ab18e3bc ("ath11k: Fix pktlog lite rx events") Reported-by:Anilkumar Kolli <quic_akolli@quicinc.com> Signed-off-by:
-
Venkateswara Naralasetty authored
Call netif_napi_del() from ath11k_ahb_free_ext_irq() to fix the following kernel panic when unload/load ath11k modules for few iterations. [ 971.201365] Unable to handle kernel paging request at virtual address 6d97a208 [ 971.204227] pgd = 594c2919 [ 971.211478] [6d97a208] *pgd=00000000 [ 971.214120] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 971.412024] CPU: 2 PID: 4435 Comm: insmod Not tainted 5.4.89 #0 [ 971.434256] Hardware name: Generic DT based system [ 971.440165] PC is at napi_by_id+0x10/0x40 [ 971.445019] LR is at netif_napi_add+0x160/0x1dc [ 971.743127] (napi_by_id) from [<807d89a0>] (netif_napi_add+0x160/0x1dc) [ 971.751295] (netif_napi_add) from [<7f1209ac>] (ath11k_ahb_config_irq+0xf8/0x414 [ath11k_ahb]) [ 971.759164] (ath11k_ahb_config_irq [ath11k_ahb]) from [<7f12135c>] (ath11k_ahb_probe+0x40c/0x51c [ath11k_ahb]) [ 971.768567] (ath11k_ahb_probe [ath11k_ahb]) from [<80666864>] (platform_drv_probe+0x48/0x94) [ 971.779670] (platform_drv_probe) from [<80664718>] (really_probe+0x1c8/0x450) [ 971.789389] (really_probe) from [<80664cc4>] (driver_probe_device+0x15c/0x1b8) [ 971.797547] (driver_probe_device) from [<80664f60>] (device_driver_attach+0x44/0x60) [ 971.805795] (device_driver_attach) from [<806650a0>] (__driver_attach+0x124/0x140) [ 971.814822] (__driver_attach) from [<80662adc>] (bus_for_each_dev+0x58/0xa4) [ 971.823328] (bus_for_each_dev) from [<80663a2c>] (bus_add_driver+0xf0/0x1e8) [ 971.831662] (bus_add_driver) from [<806658a4>] (driver_register+0xa8/0xf0) [ 971.839822] (driver_register) from [<8030269c>] (do_one_initcall+0x78/0x1ac) [ 971.847638] (do_one_initcall) from [<80392524>] (do_init_module+0x54/0x200) [ 971.855968] (do_init_module) from [<803945b0>] (load_module+0x1e30/0x1ffc) [ 971.864126] (load_module) from [<803948b0>] (sys_init_module+0x134/0x17c) [ 971.871852] (sys_init_module) from [<80301000>] (ret_fast_syscall+0x0/0x50) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Venkateswara Naralasetty <quic_vnaralas@quicinc.com> Signed-off-by:
-
Venkateswara Naralasetty authored
Rename ath11k_ahb_ext_irq_config() to ath11k_ahb_config_ext_irq() for just symmetry with ath11k_ahb_free_ext_irq(). Signed-off-by:
-
- 28 Jan, 2022 25 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo authored
ath.git patches for v5.18. Major changes: ath11k * add LDPC FEC type in 802.11 radiotap header * enable RX PPDU stats in monitor co-exist mode wcn36xx * implement survey reporting
-
Wen Gong authored
For the NL80211_REGDOM_SET_BY_USER hint from cfg80211, it set the new alpha2 code to ath11k, then ath11k send WMI_SET_INIT_COUNTRY_CMDID to firmware for all chips currently. When test with WCN6855/QCA6390 chips, this WMI CMD leads firmware crash. For AP based chips(ipq8074/qcn9074), WMI_SET_INIT_COUNTRY_CMDID is used to send to firmware, for STATION based chips(WCN6855/QCA6390), it need to use another WMI CMD WMI_SET_CURRENT_COUNTRY_CMDID. Add flag current_cc_support in hardware parameters, it is used to distinguish AP/STA platform. After that, the firmware will work normal and the regulatory feature works well for QCA6390/WCN6855. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Signed-off-by:
-
Wen Gong authored
When station connect to AP of 6 GHz with 40 MHz bandwidth, the TX is always stay 20 MHz, it is because the flag WMI_PEER_40MHZ is not set while peer assoc. Add the flag if remote peer is 40 MHz bandwidth. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Fixes: c3a7d7eb ("ath11k: add 6 GHz params in peer assoc command") Signed-off-by:
-
Pavel Skripkin authored
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 Fixes: fb9987d0 ("ath9k_htc: Support for AR9271 chipset.") Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com Signed-off-by:
Pavel Skripkin <paskripkin@gmail.com> Signed-off-by:
-
Jakub Kicinski authored
Pavel Begunkov says: ==================== udp/ipv6 optimisations Shed some weight from udp/ipv6. Zerocopy benchmarks over dummy showed ~5% tx/s improvement, should be similar for small payload non-zc cases. The performance comes from killing 4 atomics and a couple of big struct memcpy/memset. 1/10 removes a pair of atomics on dst refcounting for cork->skb setup, 9/10 saves another pair on cork init. 5/10 and 8/10 kill extra 88B memset and memcpy respectively. ==================== Link: https://lore.kernel.org/r/cover.1643243772.git.asml.silence@gmail.comSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Pavel Begunkov authored
Inline a part of ipv6_fixup_options() to avoid extra overhead on function call if opt is NULL. Signed-off-by:
Pavel Begunkov <asml.silence@gmail.com> Reviewed-by:
Willem de Bruijn <willemb@google.com> Signed-off-by:
-
Pavel Begunkov authored
udpv6_sendmsg() doesn't need dst after calling ip6_make_skb(), so instead of taking an additional reference inside ip6_setup_cork() and releasing the initial one afterwards, we can hand over a reference into ip6_make_skb() saving two atomics. The only other user of ip6_setup_cork() is ip6_append_data() and it requires an extra dst_hold(). Signed-off-by:
-
Pavel Begunkov authored
udpv6_sendmsg() first initialises an on-stack 88B struct flowi6 and then copies it into cork, which is expensive. Avoid the copy in corkless case by initialising on-stack cork->fl directly. The main part is a couple of lines under !corkreq check. The rest converts fl6 variable to be a pointer. Signed-off-by:
-
Pavel Begunkov authored
Another preparation patch. inet_cork_full already contains a field for iflow, so we can avoid passing a separate struct iflow6 into __ip6_append_data() and ip6_make_skb(), and use the flow stored in inet_cork_full. Make sure callers set cork->fl, i.e. we init it in ip6_append_data() and before calling ip6_make_skb(). Signed-off-by:
-
Pavel Begunkov authored
Convert a struct inet_cork argument in __ip6_append_data() to struct inet_cork_full. As one struct contains another inet_cork is still can be accessed via ->base field. It's a preparation patch making further changes a bit cleaner. Signed-off-by:
-
Pavel Begunkov authored
It doesn't appear there is any reason for ip6_cork_release() to zero cork->fl, it'll be fully filled on next initialisation. This 88 bytes memset accounts to 0.3-0.5% of total CPU cycles. It's also needed in following patches and allows to remove an extar flow copy in udp_v6_push_pending_frames(). Signed-off-by:
-
Pavel Begunkov authored
Clean up ip6_setup_cork() and ip6_cork_release() adding a local variable for v6_cork->opt. It's a preparation patch for further changes. Signed-off-by:
-
Pavel Begunkov authored
ipv6_push_nfrag_opts() doesn't change passed daddr, and so __ip6_make_skb() doesn't actually need to keep an on-stack copy of fl6->daddr. Set initially final_dst to fl6->daddr, ipv6_push_nfrag_opts() will override it if needed, and get rid of extra copies. Signed-off-by:
-
Pavel Begunkov authored
Corked AF_INET for ipv6 socket doesn't appear to be the hottest case, so move it out of the common path under up->pending check to remove overhead. Signed-off-by:
-
Pavel Begunkov authored
__ip6_make_skb() gets a cork->dst ref, hands it over to skb and shortly after puts cork->dst. Save two atomics by stealing it without extra referencing, ip6_cork_release() handles NULL cork->dst. Signed-off-by:
-
Jakub Kicinski authored
Ido Schimmel says: ==================== mlxsw: Various updates This patchset contains miscellaneous updates for mlxsw. No user visible changes that I am aware of. Patches #1-#5 rework registration of internal traps in preparation of line cards support. Patch #6 improves driver resilience against a misbehaving device. Patch #7 prevents the driver from overwriting device internal actions. See the commit message for more details. ==================== Link: https://lore.kernel.org/r/20220127090226.283442-1-idosch@nvidia.comSigned-off-by:
-
Ido Schimmel authored
In Spectrum-2 and later ASICs, each TCAM region has a default action that is executed in case a packet did not match any rule in the region. The location of the action in the database (KVDL) is computed by adding the region's index to a base value. Some TCAM regions are not exposed to the host and used internally by the device. Allocate KVDL entries for the default actions of these regions to avoid the host from overwriting them. With mlxsw, lookups in the internal regions are not currently performed, but it is a good practice not to overwrite their default actions. Signed-off-by:
Ido Schimmel <idosch@nvidia.com> Reviewed-by:
Petr Machata <petrm@nvidia.com> Signed-off-by:
-
Amit Cohen authored
When processing events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not for the CPU port (local port 0), which exists, but does not have all the fields as any local port. This can result in a NULL pointer dereference when trying access 'struct mlxsw_sp_port' fields which are not initialized for CPU port. Commit 63b08b1f ("mlxsw: spectrum: Protect driver from buggy firmware") already handled such issue by bailing early when processing a PUDE event reported for the CPU port. Generalize the approach by moving the check to a common function and making use of it in all relevant places. Signed-off-by:
Amit Cohen <amcohen@nvidia.com> Signed-off-by:
-
Jiri Pirko authored
For event traps which are used in core, avoid having a separate trap group for each event. Instead of that introduce a single core event trap group and use it for all event traps. Signed-off-by:
Jiri Pirko <jiri@nvidia.com> Signed-off-by:
-
Jiri Pirko authored
These functions belong to core.c alongside the functions that register/unregister a single trap. Move it there. Make the functions possibly usable by other parts of mlxsw code. Signed-off-by:
-
Jiri Pirko authored
Instead of initializing the trap groups used by core in spectrum.c over op, do it directly in core.c Signed-off-by:
-
Jiri Pirko authored
The call inits the EMAD group, but other groups as well. Therefore, move it out of EMAD init code and call it before. Signed-off-by:
-
Jiri Pirko authored
Instead of calling the same code four times, do it in a loop over array which contains trap grups to be set. Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linuxJakub Kicinski authored
Saeed Mahameed says: ==================== mlx5-updates-2022-01-27 1) Dima, adds an internal mlx5 steering callback per steering provider (FW vs SW steering), to advertise steering capabilities implemented by each module, this helps upper modules in mlx5 to know what is supported and what's not without the need to tell what is the underlying steering mode. 2nd patch is the usecase where this interface is used to implement Vlan Push/pop for uplink with SW steering, where in FW mode it's not supported yet. 2) Roi Dayan improves code readability and maintainability as preparation step for multi attribute instance per flow in mlx5 TC module Currently the mlx5_flow object contains a single mlx5_attr instance. However, multi table actions (e.g. CT) instantiate multiple attr instances. This is a refactoring series in a preparation to support multiple attribute instances per flow. The commits prepare functions to get attr instance instead of using flow->attr and also using attr->flags if the flag is more relevant to be attr flag and not a flow flag considering there will be multiple attr instances. i.e. CT and SAMPLE flags. * tag 'mlx5-updates-2022-01-27' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: VLAN push on RX, pop on TX net/mlx5: Introduce software defined steering capabilities net/mlx5: Remove unused TIR modify bitmask enums net/mlx5e: CT, Remove redundant flow args from tc ct calls net/mlx5e: TC, Store mapped tunnel id on flow attr net/mlx5e: Test CT and SAMPLE on flow attr net/mlx5e: Refactor eswitch attr flags to just attr flags net/mlx5e: CT, Don't set flow flag CT for ct clear flow net/mlx5e: TC, Hold sample_attr on stack instead of pointer net/mlx5e: TC, Reject rules with multiple CT actions net/mlx5e: TC, Refactor mlx5e_tc_add_flow_mod_hdr() to get flow attr net/mlx5e: TC, Pass attr to tc_act can_offload() net/mlx5e: TC, Split pedit offloads verify from alloc_tc_pedit_action() net/mlx5e: TC, Move pedit_headers_action to parse_attr net/mlx5e: Move counter creation call to alloc_flow_attr_counter() net/mlx5e: Pass attr arg for attaching/detaching encaps net/mlx5e: Move code chunk setting encap dests into its own function ==================== Link: https://lore.kernel.org/r/20220127204007.146300-1-saeed@kernel.orgSigned-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queueJakub Kicinski authored
Tony Nguyen says: ==================== 1GbE Intel Wired LAN Driver Updates 2022-01-27 Christophe Jaillet removes useless DMA-32 fallback calls from applicable Intel drivers and simplifies code as a result of the removal. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: igbvf: Remove useless DMA-32 fallback configuration igb: Remove useless DMA-32 fallback configuration igc: Remove useless DMA-32 fallback configuration ice: Remove useless DMA-32 fallback configuration iavf: Remove useless DMA-32 fallback configuration e1000e: Remove useless DMA-32 fallback configuration i40e: Remove useless DMA-32 fallback configuration ixgbevf: Remove useless DMA-32 fallback configuration ixgbe: Remove useless DMA-32 fallback configuration ixgb: Remove useless DMA-32 fallback configuration ==================== Link: https://lore.kernel.org/r/20220127215224.422113-1-anthony.l.nguyen@intel.comSigned-off-by:
-
- 27 Jan, 2022 1 commit
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski authored
No conflicts. Signed-off-by:
-
