linux.git/drivers/net/wireless, branch v4.7-rc4

Merge tag 'wireless-drivers-for-davem-2016-06-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

2016-06-05T02:14:53+00:00

Kalle Valo says:

====================
wireless-drivers fixes for 4.7

brcmfmac

* add fallback RSSI report for devices that do not report per-chain values
* fix a null pointer derefence regression on PCIe full dongle devices

rtlwifi

* fix scheduling while atomic regression from commit 49f86ec21c01

MAINTAINERS

* add file patterns for wireless device tree bindings
====================

Signed-off-by: David S. Miller

brcmfmac: add eth_type_trans back for PCIe full dongle

2016-06-03T08:17:45+00:00

A regression was introduced in commit 9c349892ccc9 ("brcmfmac: revise
handling events in receive path") which moves eth_type_trans() call
to brcmf_rx_frame(). Msgbuf layer doesn't use brcmf_rx_frame() but invokes
brcmf_netif_rx() directly. In such case the Ethernet header was not
stripped out resulting in null pointer dereference in the networking
stack.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
IP: [] enqueue_to_backlog+0x56/0x260
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: fuse ipt_MASQUERADE nf_nat_masquerade_ipv4
iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype
[...]
rtsx_pci scsi_mod usbcore usb_common i8042 serio nvme nvme_core
CPU: 7 PID: 1340 Comm: irq/136-brcmf_p Not tainted 4.7.0-rc1-mainline #1
Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016
task: ffff8804a0c5bd00 ti: ffff88049e124000 task.ti: ffff88049e124000
RIP: 0010:[] []
enqueue_to_backlog+0x56/0x260
RSP: 0018:ffff88049e127ca0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8804bddd7c40 RCX: 000000000000002f
RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffff8804bddd7d4c
RBP: ffff88049e127ce8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8804bddd12c0 R11: 000000000000149e R12: 0000000000017c40
R13: ffff88049e127d08 R14: ffff8804a9bd6d00 R15: ffff8804bddd7d4c
FS: 0000000000000000(0000) GS:ffff8804bddc0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000048 CR3: 0000000001806000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8804bdddad00 ffff8804ad089e00 0000000000000000 0000000000000282
0000000000000000 ffff8804a9bd6d00 ffff8804a1b27e00 ffff8804a9bd6d00
ffff88002ee88000 ffff88049e127d28 ffffffff814c3f3b ffffffff81311fc3
Call Trace:
[] netif_rx_internal+0x4b/0x170
[] ? swiotlb_tbl_unmap_single+0xf3/0x120
[] netif_rx_ni+0x27/0xc0
[] brcmf_netif_rx+0x49/0x70 [brcmfmac]
[] brcmf_msgbuf_process_rx+0x2b4/0x570 [brcmfmac]
[] ? __xen_set_pgd_hyper+0x57/0xd0
[] ? irq_forced_thread_fn+0x70/0x70
[] brcmf_proto_msgbuf_rx_trigger+0x31/0xe0 [brcmfmac]
[] brcmf_pcie_isr_thread+0x7f/0x110 [brcmfmac]
[] irq_thread_fn+0x20/0x50
[] irq_thread+0x12d/0x1c0
[] ? __schedule+0x2f5/0x7a0
[] ? wake_threads_waitq+0x30/0x30
[] ? irq_thread_dtor+0xb0/0xb0
[] kthread+0xd8/0xf0
[] ret_from_fork+0x1f/0x40
[] ? kthread_worker_fn+0x170/0x170
Code: 1c f5 60 9a 8e 81 9c 58 0f 1f 44 00 00 48 89 45 d0 fa 66 0f 1f
44 00 00 4c 8d bb 0c 01 00 00 4c 89 ff e8 5e 08 11 00 49 8b 56 20 <48>
8b 52 48 83 e2 01 74 10 8b 8b 08 01 00 00 8b 15 59 c5 42 00
RIP [] enqueue_to_backlog+0x56/0x260
RSP 
CR2: 0000000000000048

Fixes: 9c349892ccc9 ("brcmfmac: revise handling events in receive path")
Reported-by: Rafal Milecki 
Reported-by: Grey Christoforo 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Arend Van Spriel 
Reviewed-by: Hante Meuleman 
Signed-off-by: Franky Lin 
[arend@broadcom.com: rephrased the commit message]
Signed-off-by: Arend van Spriel 
Signed-off-by: Kalle Valo

Merge tag 'mac80211-for-davem-2016-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

2016-06-02T00:53:19+00:00

Johannes Berg says:

====================
Three small fixes for the current cycle:
 * missing netlink attribute check in hwsim wmediumd (Martin)
 * fast xmit structure alignment fix (Felix)
 * mesh path flush/synchronisation fix (Bob)
====================

Signed-off-by: David S. Miller

mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL

2016-05-31T10:11:54+00:00

A wmediumd that does not send this attribute causes a NULL pointer
dereference, as the attribute is accessed even if it does not exist.

The attribute was required but never checked ever since userspace frame
forwarding has been introduced. The issue gets more problematic once we
allow wmediumd registration from user namespaces.

Cc: stable@vger.kernel.org
Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx")
Signed-off-by: Martin Willi 
Signed-off-by: Johannes Berg

remove lots of IS_ERR_VALUE abuses

2016-05-27T22:26:11+00:00

Most users of IS_ERR_VALUE() in the kernel are wrong, as they
pass an 'int' into a function that takes an 'unsigned long'
argument. This happens to work because the type is sign-extended
on 64-bit architectures before it gets converted into an
unsigned type.

However, anything that passes an 'unsigned short' or 'unsigned int'
argument into IS_ERR_VALUE() is guaranteed to be broken, as are
8-bit integers and types that are wider than 'unsigned long'.

Andrzej Hajda has already fixed a lot of the worst abusers that
were causing actual bugs, but it would be nice to prevent any
users that are not passing 'unsigned long' arguments.

This patch changes all users of IS_ERR_VALUE() that I could find
on 32-bit ARM randconfig builds and x86 allmodconfig. For the
moment, this doesn't change the definition of IS_ERR_VALUE()
because there are probably still architecture specific users
elsewhere.

Almost all the warnings I got are for files that are better off
using 'if (err)' or 'if (err < 0)'.
The only legitimate user I could find that we get a warning for
is the (32-bit only) freescale fman driver, so I did not remove
the IS_ERR_VALUE() there but changed the type to 'unsigned long'.
For 9pfs, I just worked around one user whose calling conventions
are so obscure that I did not dare change the behavior.

I was using this definition for testing:

 #define IS_ERR_VALUE(x) ((unsigned long*)NULL == (typeof (x)*)NULL && \
       unlikely((unsigned long long)(x) >= (unsigned long long)(typeof(x))-MAX_ERRNO))

which ends up making all 16-bit or wider types work correctly with
the most plausible interpretation of what IS_ERR_VALUE() was supposed
to return according to its users, but also causes a compile-time
warning for any users that do not pass an 'unsigned long' argument.

I suggested this approach earlier this year, but back then we ended
up deciding to just fix the users that are obviously broken. After
the initial warning that caused me to get involved in the discussion
(fs/gfs2/dir.c) showed up again in the mainline kernel, Linus
asked me to send the whole thing again.

[ Updated the 9p parts as per Al Viro  - Linus ]

Signed-off-by: Arnd Bergmann 
Cc: Andrzej Hajda 
Cc: Andrew Morton 
Link: https://lkml.org/lkml/2016/1/7/363
Link: https://lkml.org/lkml/2016/5/27/486
Acked-by: Srinivas Kandagatla  # For nvmem part
Signed-off-by: Linus Torvalds

rtlwifi: Fix scheduling while atomic error from commit 49f86ec21c01

2016-05-27T17:53:39+00:00

Commit 49f86ec21c01 ("rtlwifi: Change long delays to sleeps") was correct
for most cases; however, driver rtl8192ce calls the affected routines while
in atomic context. The kernel bug output is as follows:

BUG: scheduling while atomic: wpa_supplicant/627/0x00000002
[...]
  [] __schedule+0x899/0xad0
  [] schedule+0x3c/0x90
  [] schedule_hrtimeout_range_clock+0xa2/0x120
  [] ? hrtimer_init+0x120/0x120
  [] ? schedule_hrtimeout_range_clock+0x96/0x120
  [] schedule_hrtimeout_range+0x13/0x20
  [] usleep_range+0x4f/0x70
  [] rtl_rfreg_delay+0x38/0x50 [rtlwifi]
  [] rtl92c_phy_config_rf_with_headerfile+0xc7/0xe0 [rtl8192ce]

To fix this bug, three of the changes from delay to sleep are reverted.
Unfortunately, one of the changes involves a delay of 50 msec. The calling
code will be modified so that this long delay can be avoided; however,
this change is being pushed now to fix the problem in kernel 4.6.0.

Fixes: 49f86ec21c01 ("rtlwifi: Change long delays to sleeps")
Reported-by: James Feeney 
Signed-off-by: Larry Finger 
Cc: James Feeney 
Cc: Stable  [4.6+]
Signed-off-by: Kalle Valo

brcmfmac: add fallback for devices that do not report per-chain values

2016-05-27T17:52:29+00:00

If brcmf_cfg80211_get_station fails to determine the RSSI from the
per-chain values get the value individually as a fallback.

Fixes: 1f0dc59a6de9 ("brcmfmac: rework .get_station() callback")
Signed-off-by: Jaap Jan Meijer 
Acked-by: Arend van Spriel 
Signed-off-by: Kalle Valo

Merge tag 'driver-core-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2016-05-21T04:26:15+00:00

Pull driver core updates from Greg KH:
 "Here's the "big" driver core update for 4.7-rc1.

  Mostly just debugfs changes, the long-known and messy races with
  removing debugfs files should be fixed thanks to the great work of
  Nicolai Stange.  We also have some isa updates in here (the x86
  maintainers told me to take it through this tree), a new warning when
  we run out of dynamic char major numbers, and a few other assorted
  changes, details in the shortlog.

  All have been in linux-next for some time with no reported issues"

* tag 'driver-core-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (32 commits)
  Revert "base: dd: don't remove driver_data in -EPROBE_DEFER case"
  gpio: ws16c48: Utilize the ISA bus driver
  gpio: 104-idio-16: Utilize the ISA bus driver
  gpio: 104-idi-48: Utilize the ISA bus driver
  gpio: 104-dio-48e: Utilize the ISA bus driver
  watchdog: ebc-c384_wdt: Utilize the ISA bus driver
  iio: stx104: Utilize the module_isa_driver and max_num_isa_dev macros
  iio: stx104: Add X86 dependency to STX104 Kconfig option
  Documentation: Add ISA bus driver documentation
  isa: Implement the max_num_isa_dev macro
  isa: Implement the module_isa_driver macro
  pnp: pnpbios: Add explicit X86_32 dependency to PNPBIOS
  isa: Decouple X86_32 dependency from the ISA Kconfig option
  driver-core: use 'dev' argument in dev_dbg_ratelimited stub
  base: dd: don't remove driver_data in -EPROBE_DEFER case
  kernfs: Move faulting copy_user operations outside of the mutex
  devcoredump: add scatterlist support
  debugfs: unproxify files created through debugfs_create_u32_array()
  debugfs: unproxify files created through debugfs_create_blob()
  debugfs: unproxify files created through debugfs_create_bool()
  ...

Merge tag 'wireless-drivers-next-for-davem-2016-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next

2016-05-20T23:40:35+00:00

Kalle Valo says:

====================
wireless-drivers patches for 4.7

Major changes:

iwlwifi

* remove IWLWIFI_DEBUG_EXPERIMENTAL_UCODE kconfig option
* work for RX multiqueue continues
* dynamic queue allocation work continues
* add Luca as maintainer
* a bunch of fixes and improvements all over

brcmfmac

* add 4356 sdio support

ath6kl

* add ability to set debug uart baud rate with a module parameter

wil6210

* add debugfs file to configure firmware led functionality
====================

Signed-off-by: David S. Miller

iwlwifi: fix mis-merge that breaks the driver

2016-05-18T19:11:22+00:00

My laptop that uses the intel 7680 iwlwifi module would no longer
connects to the network.  It would fail with a "Microcode SW error
detected." and spew out register state over and over again without ever
connecting to the network.

The cause is mis-merge in commit 909b27f70643, where David seems to have
lost some of the changes to iwl_mvm_set_tx_cmd() from commit
5c08b0f5026f ("iwlwifi: mvm: don't override the rate with the AMSDU
len").

The reason seems to be a conflict with commit d8fe484470dd ("iwlwifi:
mvm: add support for new TX CMD API"), which touched a line adjacent to
the changes in 909b27f70643.

David missed the fact that "info->driver_data[0]" had become
"skb_info->driver_data[0]".  Then he removed the skb_info because it was
unused.

This just re-updates iwl_mvm_set_tx_cmd() with the lost two lines.

Reported-and-tested-by: Linus Torvalds 
Reported-by: Reinoud Koornstra 
Cc: Luciano Coelho 
Cc: Kalle Valo 
Cc: David Miller 
Signed-off-by: Linus Torvalds