- Nov 09, 2020
-
-
Ole Bjørn Midtbø authoredA different wait queue was used when removing ctrl_wait than when adding it. This effectively made the remove operation without locking compared to other operations on the wait queue ctrl_wait was part of. This caused issues like below where dead000000000100 is LIST_POISON1 and dead000000000200 is LIST_POISON2. list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \ but was dead000000000200. (next=ffffffc03ac77de0). ------------[ cut here ]------------ CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G O 4.4.238+ #9 ... ---[ end trace 0adc2158f0646eac ]--- Call trace: [<ffffffc000443f78>] __list_add+0x38/0xb0 [<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68 [<ffffffc00020eecc>] __pollwait+0xec/0x100 [<ffffffc000d1556c>] bt_sock_poll+0x74/0x200 [<ffffffc000bdb8a8>] sock_poll+0x110/0x128 [<ffffffc000210378>] do_sys_poll+0x220/0x480 [<ffffffc0002106f0>] SyS_poll+0x80/0x138 [<ffffffc00008510c>] __sys_trace_return+0x0/0x4 Unable to handle kernel paging request at virtual address dead000000000100 ... CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G W O 4.4.238+ #9 ... Call trace: [<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8 [<ffffffc0000f0818>] __wake_up+0x50/0x70 [<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60 [<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224 [<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298 [<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198 [<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78 [<ffffffc000d29934>] hci_event_packet+0x564/0x2e30 [<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360 [<ffffffc0000c2218>] process_one_work+0x268/0x460 [<ffffffc0000c2678>] worker_thread+0x268/0x480 [<ffffffc0000c94e0>] kthread+0x118/0x128 [<ffffffc000085070>] ret_from_fork+0x10/0x20 ---[ end trace 0adc2158f0646ead ]--- Signed-off-by:
Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Claire Chang authored
Avoid multiple attempts to create the debugfs entry, force_bredr_smp, by moving it from the SMP registration to the BR/EDR controller init section. hci_debugfs_create_bredr is only called when HCI_SETUP and HCI_CONFIG is not set. Signed-off-by:
Claire Chang <tientzu@chromium.org>
Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Sathish Narasimman authored
When adding device to white list the device is added to resolving list also. It has to be added only when HCI_ENABLE_LL_PRIVACY flag is set. HCI_ENABLE_LL_PRIVACY flag has to be tested before adding/deleting devices to resolving list. use_ll_privacy macro is used only to check if controller supports LL_Privacy. https://bugzilla.kernel.org/show_bug.cgi?id=209745 Fixes: 0eee35bd ("Bluetooth: Update resolving list when updating whitelist") Signed-off-by:
Sathish Narasimman <sathish.narasimman@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Kai-Heng Feng authored
Some platforms keep USB power even when they are powered off and in S5, this makes Realtek 8821C keep its firmware even after a cold boot, and make 8821C never load new firmware. So use vendor specific HCI command to ask 8821C drop its firmware after system shutdown. Newer firmware doesn't have this issue so we only use this trick for old 8821C firmware version. Suggested-by:
Max Chou <max.chou@realtek.com>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Max Chou authored
Enhance the ic_id_table that it's able to maintain regularly. To judge which chip should be initialized by LMP subversion, HCI revision, HCI version and HCI bus which were given in the ic_id_table. Also, refine the incorrect LMP subversion of ROM for RTL8723D and RTL8723A. Suggested-by:
Alex Lu <alex_lu@realsil.com.cn>
Signed-off-by: Max Chou <max.chou@realtek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Max Chou authored
Add the more IDs to usb_device_id table for Realtek RTL8822CE and also support the wideband speech capability for all RTL8822CE devices. -Device(04c5:161f) from /sys/kernel/debug/usb/devices T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=04c5 ProdID=161f Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -Device(0b05:18ef) from /sys/kernel/debug/usb/devices T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0b05 ProdID=18ef Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -Device(13d3:3549) from /sys/kernel/debug/usb/devices T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3549 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -Device(13d3:3553) from /sys/kernel/debug/usb/devices T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3553 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -Device(13d3:3555) from /sys/kernel/debug/usb/devices T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3555 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms -Device(2ff8:3051) from /sys/kernel/debug/usb/devices T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2ff8 ProdID=3051 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by:
Max Chou <max.chou@realtek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Daniel Winkler authored
When an LE connection request is made, advertising is disabled and never resumed. When a client has an active advertisement, this is disruptive. This change adds resume logic for client-configured (non-directed) advertisements after the connection attempt. The patch was tested by registering an advertisement, initiating an LE connection from a remote peer, and verifying that the advertisement is re-activated after the connection is established. This is performed on Hatch and Kukui Chromebooks. Signed-off-by:
Daniel Winkler <danielwinkler@google.com>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Peilin Ye authored
`num_reports` is not being properly checked. A malformed event packet with a large `num_reports` number makes hci_le_direct_adv_report_evt() read out of bounds. Fix it. Cc: stable@vger.kernel.org Fixes: 2f010b55 ("Bluetooth: Add support for handling LE Direct Advertising Report events") Reported-and-tested-by:
<syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Anant Thazhemadam authored
When h5_close() gets called, the memory allocated for the hu gets freed only if hu->serdev doesn't exist. This leads to a memory leak. So when h5_close() is requested, close the serdev device instance and free the memory allocated to the hu entirely instead. Fixes: https://syzkaller.appspot.com/bug?extid=6ce141c55b2f7aafd1c4 Reported-by:
<syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com>
Tested-by: <syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Anmol Karn authored
AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called from hci_event_packet() and there is a possibility, that hcon->amp_mgr may not be found when accessing after initialization of hcon. - net/bluetooth/hci_event.c:4945 The bug seems to get triggered in this line: bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon; Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status. Fixes: d5e91192 ("Bluetooth: AMP: Process Physical Link Complete evt") Reported-and-tested-by:
<syzbot+0bef568258653cff272f@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org> -
Abhishek Pandit-Subedi authored
WCN3991 supports connectable advertisements so we need to add the valid le states quirk so the 'central-peripheral' role is exposed in userspace. Signed-off-by:
Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
-
- Nov 08, 2020
-
-
Voon Weifeng authored
Set all EHL/TGL phy_addr to -1 so that the driver will automatically detect it at run-time by probing all the possible 32 addresses. Signed-off-by:
Voon Weifeng <weifeng.voon@intel.com>
Signed-off-by: Wong Vee Khee <vee.khee.wong@intel.com>
Link: https://lore.kernel.org/r/20201106094341.4241-1-vee.khee.wong@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Wang Qing authored
Actually, withing should be within. Signed-off-by:
Wang Qing <wangqing@vivo.com>
Link: https://lore.kernel.org/r/1604649025-22559-1-git-send-email-wangqing@vivo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Wang Qing authored
withing should be within. Signed-off-by:
Wang Qing <wangqing@vivo.com>
Link: https://lore.kernel.org/r/1604650310-30432-1-git-send-email-wangqing@vivo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Jakub Kicinski authored
Alex Elder says: ==================== net: ipa: constrain GSI interrupts The goal of this series is to more tightly control when GSI interrupts are enabled. This is a long-ish series, so I'll describe it in parts. The first patch is actually unrelated... I forgot to include it in my previous series (which exposed the GSI layer to the IPA version). It is a trivial comments-only update patch. The second patch defers registering the GSI interrupt handler until *after* all of the resources that handler touches have been initialized. In practice, we don't see this interrupt that early, but this precludes an obvious problem. The next two patches are simple changes. The first just trivially renames a field. The second switches from using constant mask values to using an enumerated type of bit positions to represent each GSI interrupt type. The rest implement the "real work." First, all interrupts are disabled at initialization time. Next, we keep track of a bitmask of enabled GSI interrupt types, updating it each time we enable or disable one of them. From there we have a set of patches that one-by-one enable each interrupt type only during the period it is required. This includes allowing a channel to generate IEOB interrupts only when it has been enabled. And finally, the last patch simplifies some code now that all GSI interrupt types are handled uniformly. ==================== Link: https://lore.kernel.org/r/20201105181407.8006-1-elder@linaro.org Signed-off-by:Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Now that all of the GSI interrupts are handled uniformly, change gsi_irq_type_update() so it takes a value. Have the function assign that value to the cached mask of enabled GSI IRQ types before writing it to hardware. Note that gsi_irq_teardown() will only be called after gsi_irq_disable(), so it's not necessary for the former to disable all IRQ types. Get rid of that. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Most GSI general errors are unrecoverable without a full reset. Despite that, we want to receive these errors so we can at least report what happened before whatever undefined behavior ensues. Explicitly disable all such interrupts in gsi_irq_setup(), then enable those we want in gsi_irq_enable(). List the interrupt types we are interested in (everything but breakpoint) explicitly rather than using GSI_CNTXT_GSI_IRQ_ALL, and remove that symbol's definition. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
It is possible for other execution environments (EEs, like the modem) to request changes to local (AP) channel or event ring state. We do not support this feature. In gsi_irq_setup(), explicitly zero the mask that defines which channels are permitted to generate inter-EE channel state change interrupts. Do the same for the event ring mask. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
A GSI channel must be started in order to use it to perform a transfer data (or command) transaction. And the only time we'll see an IEOB interrupt is if we send a transaction to a started channel. Therefore we do not need to have the IEOB interrupt type enabled until at least one channel has been started. And once the last started channel has been stopped, we can disable the IEOB interrupt type again. We already enable the IEOB interrupt for a particular channel only when it is started. Extend that by having the IEOB interrupt *type* be enabled only when at least one channel is in STARTED state. Disallow all channels from triggering the IEOB interrupt in gsi_irq_setup(). We only enable an channel's interrupt when needed, so there is no longer any need to zero the channel mask in gsi_irq_disable(). Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
The completion of a generic EE GSI command is signaled by a global interrupt of type GP_INT1. The only other used type for a global interrupt is a hardware error report. First, disallow all global interrupt types in gsi_irq_setup(). We want to know about hardware errors, so re-enable the interrupt type in gsi_irq_enable(), to allow hardware errors to be reported. Disable that interrupt type again in gsi_irq_disable(). We only issue generic EE commands one at a time, and there's no reason to keep the completion interrupt enabled when no generic EE command is pending. We furthermore have no need to enable the GP_INT2 or GP_INT3 interrupt types (which aren't used). The change in gsi_irq_enable() makes GSI_CNTXT_GLOB_IRQ_ALL unused, so get rid of it. Have gsi_generic_command() enable the GP_INT1 interrupt type (in addition to the ERROR_INT type) only while a generic command is pending. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
A GSI event ring causes an event control interrupt to fire whenever its state changes (between NOT_ALLOCATED and ALLOCATED). No event ring should ever change state except when we request it to. Currently, we permit *all* events rings to generate event control interrupts--even those that are never used. And we enable event control interrupts essentially at all times, from setup to teardown. Instead, only enable the event control interrupt type for the duration of an event ring command, and when doing so, only allow the event ring being operated upon to cause the interrupt to fire. Disallow all event rings from issuing the event control interrupt in gsi_irq_setup(). Because an event ring's interrupt is only enabled when needed, there is no longer any need to zero the event channel mask in gsi_irq_disable(). Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
A GSI channel causes a channel control interrupt to fire whenever its state changes (between NOT_ALLOCATED, ALLOCATED, STARTED, etc.). We do not support inter-EE channel commands (initiated by other EEs), so no channel should ever change state except when we request it to. Currently, we permit *all* channels to generate channel control interrupts--even those that are never used. And we enable channel control interrupts essentially at all times, from setup to teardown. Instead, disable all channel control interrupts initially in gsi_irq_setup(), and only enable the channel control interrupt type for the duration of a channel command. When doing so, only allow the channel being operated upon to cause the interrupt to fire. Because a channel's interrupt is now enabled only when needed (one channel at a time), there is no longer any need to zero the channel mask in gsi_irq_disable(). Add new gsi_irq_type_enable() and gsi_irq_type_disable() as helper functions to control whether a given GSI interrupt type is enabled. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Keep track of the set of GSI interrupt types that are currently enabled by recording the mask value to write (or last written) to the TYPE_IRQ_MSK register. Create a new helper function gsi_irq_type_update() to handle actually writing the register. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Introduce gsi_irq_setup() and gsi_irq_teardown() to disable all GSI interrupts when first setting up GSI hardware, and to clean things up when we're done. Re-enable all GSI interrupt types in gsi_irq_enable(), but do so only after each of the type-specific interrupt masks has been configured. Similarly, disable all interrupt types in gsi_irq_disable()--first--before zeroing out the type-specific masks. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Define the GSI interrupt types with an enumerated type whose values are the bit positions representing each interrupt type. Include a short comment describing how each interrupt type is used. Build up the enabled interrupt mask explicitly in gsi_irq_enable(), and get rid of the definition of GSI_CNTXT_TYPE_IRQ_MSK_ALL. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Rename the "event_enable_bitmap" field of the GSI structure to be "ieob_enabled_bitmap". An upcoming patch will cache the last value stored for another interrupt mask and this is a more direct naming convention to follow. Add a few comments to explain the bitmap fields in the GSI structure. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
Introduce gsi_irq_init() and gsi_irq_exit(), to encapsulate looking up the GSI IRQ and registering its handler. Call gsi_irq_init() a little later in gsi_init(), and initialize the completion earlier. The IRQ handler accesses both the GSI virtual memory pointer and the completion, and this way these things will have been initialized before the gsi_irq() can ever be called. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Alex Elder authored
The GSI code is now exposed to IPA version numbers, and we handle version-specific behavior based on the IPA version. Modify some comments that talk about GSI versions so they reference IPA versions instead. Correct version number errors in a couple of these comments. The (comment) mapping between IPA and GSI versions in the definition of the ipa_version enumerated type remains. Signed-off-by:
Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Xie He authored
This driver transports LAPB (X.25 link layer) frames over TTY links. I can safely say that this driver has no actual user because it was not working at all until: commit 8fdcabea ("drivers/net/wan/x25_asy: Fix to make it work") The code in its current state still has problems: 1. The uses of "struct x25_asy" in x25_asy_unesc (when receiving) and in x25_asy_write_wakeup (when sending) are not protected by locks against x25_asy_change_mtu's changing of the transmitting/receiving buffers. Also, all "netif_running" checks in this driver are not protected by locks against the ndo_stop function. 2. The driver stops all TTY read/write when the netif is down. I think this is not right because this may cause the last outgoing frame before the netif goes down to be incompletely transmitted, and the first incoming frame after the netif goes up to be incompletely received. And there may also be other problems. I was planning to fix these problems but after recent discussions about deleting other old networking code, I think we may just delete this driver, too. Signed-off-by:
Xie He <xie.he.0141@gmail.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/20201105073434.429307-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Parshuram Thombare authored
This patch fixes NULL pointer dereference due to NULL pcs_config in pcs_ops. Fixes: e4e143e2 ("net: macb: add support for high speed interface") Reported-by:
Nicolas Ferre <Nicolas.Ferre@microchip.com>
Link: https://lore.kernel.org/netdev/2db854c7-9ffb-328a-f346-f68982723d29@microchip.com/
Signed-off-by: Parshuram Thombare <pthombar@cadence.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/1604599113-2488-1-git-send-email-pthombar@cadence.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Min Li authored
Use div_s64 so that the neg_adj is not needed. Signed-off-by:
Min Li <min.li.xe@renesas.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://lore.kernel.org/r/1604634729-24960-3-git-send-email-min.li.xe@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Min Li authored
Refactor idt82p33_xfer and use i2c_master_send for write operation. Because some I2C controllers are only working with single-burst write transaction. Signed-off-by:
Min Li <min.li.xe@renesas.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://lore.kernel.org/r/1604634729-24960-2-git-send-email-min.li.xe@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Min Li authored
Add idt82p33_adjphase() to support PHC write phase mode. Signed-off-by:
Min Li <min.li.xe@renesas.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://lore.kernel.org/r/1604634729-24960-1-git-send-email-min.li.xe@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Menglong Dong authored
The initialization for err with 0 seems useless, as it is soon updated with -ENOMEM. So, we can remove it. Changes since v1: -Keep -ENOMEM still. Signed-off-by:
Menglong Dong <dong.menglong@zte.com.cn>
Link: https://lore.kernel.org/r/1604541244-3241-1-git-send-email-dong.menglong@zte.com.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Kaixu Xia authored
Fix the gcc warning: drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c:2673:9: warning: this 'for' clause does not guard... [-Wmisleading-indentation] 2673 | for (i = 0; i < n; ++i) \ Reported-by:
Tosk Robot <tencent_os_robot@tencent.com>
Signed-off-by: Kaixu Xia <kaixuxia@tencent.com>
Link: https://lore.kernel.org/r/1604467444-23043-1-git-send-email-kaixuxia@tencent.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Jakub Kicinski authored
Radhey Shyam Pandey says: ==================== net: axienet: Dynamically enable MDIO interface This patchset dynamically enable MDIO interface. The background for this change is coming from Cadence GEM controller(macb) in which MDC is active only during MDIO read or write operations while the PHY registers are read or written. It is implemented as an IP feature. For axiethernet as dynamic MDC enable/disable is not supported in hw we are implementing it in sw. This change doesn't affect any existing functionality. ==================== Link: https://lore.kernel.org/r/1604402770-78045-1-git-send-email-radhey.shyam.pandey@xilinx.com Signed-off-by:Jakub Kicinski <kuba@kernel.org> -
Clayton Rayment authored
MDIO spec does not require an MDC at all times, only when MDIO transactions are occurring. This patch allows the xilinx_axienet driver to disable the MDC when not in use, and re-enable it when needed. It also simplifies the driver by removing MDC disable and enable in device reset sequence. Signed-off-by:
Clayton Rayment <clayton.rayment@xilinx.com>
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Radhey Shyam Pandey authored
Introduce helper functions to enable/disable MDIO interface clock. This change serves a preparatory patch for the coming feature to dynamically control the management bus clock. Signed-off-by:
Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org> -
Jakub Kicinski authored
Allen Pais says: ==================== net: convert tasklets to use new tasklet_setup API Commit 12cc923f ("tasklet: Introduce new initialization API")' introduced a new tasklet initialization API. This series converts all the net/* drivers to use the new tasklet_setup() API The following series is based on net-next (9faebeb2 ) v3: introduce qdisc_from_priv, suggested by Eric Dumazet. v2: get rid of QDISC_ALIGN() v1: fix kerneldoc ==================== Link: https://lore.kernel.org/r/20201103091823.586717-1-allen.lkml@gmail.com Signed-off-by:
Jakub Kicinski <kuba@kernel.org> -
Allen Pais authored
In preparation for unconditionally passing the struct tasklet_struct pointer to all tasklet callbacks, switch to using the new tasklet_setup() and from_tasklet() to pass the tasklet pointer explicitly. Signed-off-by:
Romain Perier <romain.perier@gmail.com>
Signed-off-by: Allen Pais <apais@linux.microsoft.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-