When multiple vif are in use (= one access point and one station), and
when the channels are different, it is necessary to enable power save on
station.
The firmware check that steps are done in the correct order:
- AP can't start if PS is not enable on the station
- PS can't set on the station before the association has finished
(= before the call set_bss_params)
Obviously, in add, when one of the interface disappears, it is necessary to
restore the power save status.
wfx_update_pm() is able to set the correct PS configuration. But it has
to be called at the right time:
1. before hif_start(), but after the channel configuration is known
2. after hif_set_bss_params()
3. after hif_reset()
Therefore, the call to wfx_update_pm() from wfx_add_interface() is too
early to address 1.
The call after hif_set_bss_params() already exists.
For the symmetry, the call from wfx_remove_interface() (that handle 3.)
is also relocated.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200515083325.378539-15-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The device disallows to start a scan request between hif_join() and
hif_set_bss_params(). The driver is not protected against that. The
worst case happens when association is aborted and hif_set_bss_params()
never happens.
mac80211 would never ask for scan during the association process. So,
this patch just aborts the association in progress when scan is
requested.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200515083325.378539-14-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The function wfx_notify_buffered_tx() need to know if the frame was
associated to a station. This information is available in the Control
Buffer (CB) of the skb. However, when wfx_notify_buffered_tx() is
called, the CB is no more available. Thus, the caller has to take care
of this information.
wfx_notify_buffered_tx() is a specific case. All the other function are
called before the destruction of the CB. So, this patch align the API of
wfx_notify_buffered_tx() with the other functions. Call it before the CB
was destroyed and drop the extra argument 'has_sta'.
It is also the right time to rename it into wfx_tx_update_sta() (which
is closer to the behavior of the function).
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200515083325.378539-10-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The device does not answer to the command hif_shutdown. Therefore,
hif_shutdown() is a bit special. It bypasses some of work normally made
by wfx_cmd_send(). In particularly, it unlock hif_cmd.lock and
hif_cmd.key_renew_lock.
However, if the driver notice that the device is frozen, wfx_cmd_send()
stops to send data and doesn't lock the mutexes. Then, it produced a
warning when hif_shutdown() tried to unlock these mutexes.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200515083325.378539-2-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch is removing definition of CFLAGS in Makefile of vt6656 and
vt6655, as those are defining macros that are not used. This will remove
undef of one macro from vt6655/device_main.c, as it is only undef and it is
not used anywhere else, so it is safe to remove it.
Macros are removed from vt665x/Makefile and vt6655/device_main.c.
Signed-off-by: Matej Dujava <mdujava@kocurkovo.cz>
Link: https://lore.kernel.org/r/1589397351-24655-2-git-send-email-mdujava@kocurkovo.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Drop the driver version of the line-coding request and use the protocol
definition directly as was originally intended instead.
This specifically avoids having the two versions of what is supposed to
be the same struct ever getting out of sync.
Note that this has in fact already happened once when the protocol
definition had its implicit padding removed while the driver struct
wasn't updated. The fact that we used the size of the then larger driver
struct when memcpying its content to the stack didn't exactly make
things better. A later addition of a flow-control field incidentally
made the structures match again.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20200514070548.4423-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This add a new driver for renesas xhci which is basically a firmware
loader for uPD720201 and uPD720202 w/o ROM. The xhci-pci driver will
invoke this driver for loading/unloading on relevant devices.
This patch adds a firmware loader for the uPD720201K8-711-BAC-A
and uPD720202K8-711-BAA-A variant. Both of these chips are listed
in Renesas' R19UH0078EJ0500 Rev.5.00 "User's Manual: Hardware" as
devices which need the firmware loader on page 2 in order to
work as they "do not support the External ROM".
The "Firmware Download Sequence" is describe in chapter
"7.1 FW Download Interface" R19UH0078EJ0500 Rev.5.00 page 131.
The firmware "K2013080.mem" is available from a USB3.0 Host to
PCIe Adapter (PP2U-E card) "Firmware download" archive. An
alternative version can be sourced from Netgear's WNDR4700 GPL
archives.
The release notes of the PP2U-E's "Firmware Download" ver 2.0.1.3
(2012-06-15) state that the firmware is for the following devices:
- uPD720201 ES 2.0 sample whose revision ID is 2.
- uPD720201 ES 2.1 sample & CS sample & Mass product, ID is 3.
- uPD720202 ES 2.0 sample & CS sample & Mass product, ID is 2.
[vkoul: fixed comments:
used macros for timeout count and delay
removed renesas_fw_alive_check
cleaned renesas_fw_callback
removed recursion for renesas_fw_download
add register defines and field names
move to a separate file
make fw loader as sync probe so that we execute in probe and
prevent race
make xhci-pci-renesas a seprate module]
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20200514122039.300417-3-vkoul@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb_hcd_pci_probe expects users to call this with driver_data set as
hc_driver, that limits the possibility of using the driver_data for
driver data.
Add hc_driver as argument to usb_hcd_pci_probe and modify the callers
ehci/ohci/xhci/uhci to pass hc_driver as argument and freeup the
driver_data used
Tested xhci driver on Dragon-board RB3, compile tested ehci, ohci and
uhci.
[For all but the xHCI parts]
[For the xhci part]
Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20200514122039.300417-2-vkoul@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
FuzzUSB (a variant of syzkaller) found an illegal array access
using an incorrect index while binding a gadget with UDC.
Reference: https://www.spinics.net/lists/linux-usb/msg194331.html
This bug occurs when a size variable used for a buffer
is misused to access its strcpy-ed buffer.
Given a buffer along with its size variable (taken from user input),
from which, a new buffer is created using kstrdup().
Due to the original buffer containing 0 value in the middle,
the size of the kstrdup-ed buffer becomes smaller than that of the original.
So accessing the kstrdup-ed buffer with the same size variable
triggers memory access violation.
The fix makes sure no zero value in the buffer,
by comparing the strlen() of the orignal buffer with the size variable,
so that the access to the kstrdup-ed buffer is safe.
BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200
drivers/usb/gadget/configfs.c:266
Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208
CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xce/0x128 lib/dump_stack.c:118
print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374
__kasan_report+0x131/0x1b0 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:641
__asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266
flush_write_buffer fs/configfs/file.c:251 [inline]
configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283
__vfs_write+0x85/0x110 fs/read_write.c:494
vfs_write+0x1cd/0x510 fs/read_write.c:558
ksys_write+0x18a/0x220 fs/read_write.c:611
__do_sys_write fs/read_write.c:623 [inline]
__se_sys_write fs/read_write.c:620 [inline]
__x64_sys_write+0x73/0xb0 fs/read_write.c:620
do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Signed-off-by: Kyungtae Kim <kt0755@gmail.com>
Reported-and-tested-by: Kyungtae Kim <kt0755@gmail.com>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200510054326.GA19198@pizza01
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Felipe writes:
USB: fixes for v5.7-rc6
The main part here are the important fixes for the raw-gadget before it
becomes an ABI. We're adding support for stall/halt/wedge which is
actually pretty important in many situations. There's also a NULL
pointer deref fix.
Apart from raw-gadget, I've included some recent sparse fixes to a few
drivers.
Signed-off-by: Felipe Balbi <balbi@kernel.org>
* tag 'fixes-for-v5.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb:
usb: cdns3: gadget: make a bunch of functions static
usb: mtu3: constify struct debugfs_reg32
usb: gadget: udc: atmel: Make some symbols static
usb: raw-gadget: fix null-ptr-deref when reenabling endpoints
usb: raw-gadget: documentation updates
usb: raw-gadget: support stalling/halting/wedging endpoints
usb: raw-gadget: fix gadget endpoint selection
usb: raw-gadget: improve uapi headers comments
intel-pinctrl for v5.8-1
* Introduce GPIO driver for Jasper Lake
* Fix long standing bug in Sunrisepoint-H PAD locking code
* Enable pin configuration setting for GPIO chip for Baytrail
* Work around race condition in Cherriview hardware when handle IRQ
* Clean up Cherryview code to be closer to other drivers
The following is an automated git shortlog grouped by driver:
baytrail:
- Use platform_get_irq_optional() explicitly
- Enable pin configuration setting for GPIO chip
cannonlake:
- Use generic flag for special GPIO base treatment
cherryview:
- Add missing spinlock usage in chv_gpio_irq_handler
- Use GENMASK() consistently
- Re-use data structures from pinctrl-intel.h (part 2)
icelake:
- Use generic flag for special GPIO base treatment
intel:
- Move npins closer to pin_base in struct intel_community
- Update description in struct intel_community
- Add Intel Jasper Lake pin controller support
- Introduce new flag to force GPIO base to be 0
- Introduce common flags for GPIO mapping scheme
lynxpoint:
- Use platform_get_irq_optional() explicitly
sunrisepoint:
- Fix PAD lock register offset for SPT-H
tigerlake:
- Use generic flag for special GPIO base treatment
