latest

6 files changed, 507 insertions, 119 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 0ecc902c1465..1f541eaaffc1 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,5 +1,5 @@
 pkgbase = linux-disable-tsq
-	pkgver = 4.14.14
+	pkgver = 4.14.23
 	pkgrel = 1
 	url = https://www.kernel.org/
 	arch = x86_64
@@ -12,17 +12,16 @@ pkgbase = linux-disable-tsq
 	options = !strip
 	source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.14.tar.xz
 	source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.14.tar.sign
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.14.xz
-	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.14.sign
+	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.23.xz
+	source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.14.23.sign
 	source = config
 	source = 60-linux.hook
 	source = 90-linux.hook
 	source = linux.preset
 	source = 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
 	source = 0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
-	source = 0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
-	source = 0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
 	source = disable-tsq.patch
+	source = ath.patch
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 
diff --git a/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch b/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
deleted file mode 100644
index 8a3ea3008a14..000000000000
--- a/0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From c9c8995fc83b476fdf3fc0c4b498feef2949ec75 Mon Sep 17 00:00:00 2001
-Message-Id: <c9c8995fc83b476fdf3fc0c4b498feef2949ec75.1516188238.git.jan.steffens@gmail.com>
-In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-From: Steffen Klassert <steffen.klassert@secunet.com>
-Date: Fri, 22 Dec 2017 10:44:57 +0100
-Subject: [PATCH 3/4] xfrm: Fix stack-out-of-bounds read on socket policy
- lookup.
-
-When we do tunnel or beet mode, we pass saddr and daddr from the
-template to xfrm_state_find(), this is ok. On transport mode,
-we pass the addresses from the flowi, assuming that the IP
-addresses (and address family) don't change during transformation.
-This assumption is wrong in the IPv4 mapped IPv6 case, packet
-is IPv4 and template is IPv6.
-
-Fix this by catching address family missmatches of the policy
-and the flow already before we do the lookup.
-
-Reported-by: syzbot <syzkaller@googlegroups.com>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
----
- net/xfrm/xfrm_policy.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index 6bc16bb61b55..50c5f46b5cca 100644
---- a/net/xfrm/xfrm_policy.c
-+++ b/net/xfrm/xfrm_policy.c
-@@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
-  again:
- 	pol = rcu_dereference(sk->sk_policy[dir]);
- 	if (pol != NULL) {
--		bool match = xfrm_selector_match(&pol->selector, fl, family);
-+		bool match;
- 		int err = 0;
- 
-+		if (pol->family != family) {
-+			pol = NULL;
-+			goto out;
-+		}
-+
-+		match = xfrm_selector_match(&pol->selector, fl, family);
- 		if (match) {
- 			if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
- 				pol = NULL;
--- 
-2.15.1
-
diff --git a/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch b/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
deleted file mode 100644
index f77c9b5c12c4..000000000000
--- a/0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From e722c8d112f0aa9621d7d4da5223cfc7aeb45e88 Mon Sep 17 00:00:00 2001
-Message-Id: <e722c8d112f0aa9621d7d4da5223cfc7aeb45e88.1516188238.git.jan.steffens@gmail.com>
-In-Reply-To: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-References: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
-From: Jim Bride <jim.bride@linux.intel.com>
-Date: Mon, 6 Nov 2017 13:38:57 -0800
-Subject: [PATCH 4/4] drm/i915/edp: Only use the alternate fixed mode if it's
- asked for
-
-In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for
-eDP if available."), the patch allows for the use of an alternate fixed
-mode if it is available, but the patch was not ensuring that the only
-time the alternate mode is used is when it is specifically requested.
-This patch adds an additional comparison to intel_edp_compare_alt_mode
-to ensure that we only use the alternate mode if it is directly
-requested.
-
-Fixes: dc911f5bd8aac ("Allow alternate fixed mode for eDP if available.")
-Cc: David Weinehall <david.weinehall@linux.intel.com>
-Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
-Signed-off-by: Jim Bride <jim.bride@linux.intel.com>
----
- drivers/gpu/drm/i915/intel_dp.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index 09f274419eea..838cee312e8e 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -1632,7 +1632,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1,
- 			m1->vdisplay == m2->vdisplay &&
- 			m1->vsync_start == m2->vsync_start &&
- 			m1->vsync_end == m2->vsync_end &&
--			m1->vtotal == m2->vtotal);
-+			m1->vtotal == m2->vtotal &&
-+			m1->vrefresh == m2->vrefresh);
- 	return bres;
- }
- 
--- 
-2.15.1
-
diff --git a/PKGBUILD b/PKGBUILD
index f4c16cf42e47..70da44738496 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -5,7 +5,7 @@
 pkgbase=linux-disable-tsq               # Build stock -ARCH kernel
 #pkgbase=linux-custom       # Build kernel with a different name
 _srcname=linux-4.14
-pkgver=4.14.14
+pkgver=4.14.23
 pkgrel=1
 arch=('x86_64')
 url="https://www.kernel.org/"
@@ -23,9 +23,8 @@ source=(
   'linux.preset'   # standard config files for mkinitcpio ramdisk
   0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
   0002-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
-  0003-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
-  0004-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch
   disable-tsq.patch
+  ath.patch
 )
 validpgpkeys=(
   'ABAF11C65A2970B130ABE3C479BE3E4300411886'  # Linus Torvalds
diff --git a/ath.patch b/ath.patch
new file mode 100644
index 000000000000..559820938c9a
--- /dev/null
+++ b/ath.patch
@@ -0,0 +1,476 @@
+diff --git i/drivers/net/wireless/ath/ath9k/htc.h w/drivers/net/wireless/ath/ath9k/htc.h
+index 16dff4b89a86..63eea0bc6097 100644
+--- i/drivers/net/wireless/ath/ath9k/htc.h
++++ w/drivers/net/wireless/ath/ath9k/htc.h
+@@ -604,6 +604,9 @@ void ath9k_htc_rfkill_poll_state(struct ieee80211_hw *hw);
+ 
+ struct base_eep_header *ath9k_htc_get_eeprom_base(struct ath9k_htc_priv *priv);
+ 
++// TODO make more generic: any argument instead of just 2 int32s
++int dbg_firmware_cmd(struct ath9k_htc_priv *priv, u8 cmd_id, u32 arguments[2]);
++
+ #ifdef CONFIG_MAC80211_LEDS
+ void ath9k_configure_leds(struct ath9k_htc_priv *priv);
+ void ath9k_init_leds(struct ath9k_htc_priv *priv);
+diff --git i/drivers/net/wireless/ath/ath9k/htc_drv_debug.c w/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+index dc79afd7e151..3e0d1a35ef6f 100644
+--- i/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
++++ w/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+@@ -14,6 +14,7 @@
+  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <net/genetlink.h>
+ #include "htc.h"
+ 
+ static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
+@@ -479,13 +480,298 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
+ 	WARN_ON(i != ATH9K_HTC_SSTATS_LEN);
+ }
+ 
++struct ath9k_htc_priv *genl_ath9k_priv = NULL;
++
++enum {
++	ATH9K_HTC_A_UNSPEC,
++	ATH9K_HTC_A_STR,
++	ATH9K_HTC_A_REG,
++	ATH9K_HTC_A_VAL,
++	ATH9K_HTC_A_MAX,
++};
++
++enum {
++	ATH9K_HTC_C_UNSPEC,
++	ATH9K_C_ECHO,
++	ATH9K_C_SET,
++	ATH9K_C_RATE,
++	ATH9K_C_RESET,
++	ATH9K_C_MAX,
++};
++
++/* attribute policy: defines which attribute has which type (e.g int, char * etc)
++ * possible values defined in net/netlink.h 
++ */
++static struct nla_policy ath9k_htc_genl_policy[ATH9K_HTC_A_MAX] = {
++	[ATH9K_HTC_A_STR] = { .type = NLA_NUL_STRING },
++	[ATH9K_HTC_A_REG] = { .type = NLA_U32 },
++	[ATH9K_HTC_A_VAL] = { .type = NLA_U32 },
++};
++
++static struct genl_family ath9k_htc_gnl_family = {
++	.id = GENL_ID_GENERATE,
++	.hdrsize = 0,
++	.name = "ATH9K_HTC",
++	.version = 1,
++	.maxattr = ATH9K_HTC_A_MAX-1,
++};
++
++static int ath9k_echo(struct sk_buff *iskb, struct genl_info *info) {
++	struct nlattr *received_str_attr;
++	char *received_str;
++	struct sk_buff *skb;
++	int errc;
++	void *msg_head;
++
++	if (info == NULL)
++		goto out;
++
++	received_str_attr = info->attrs[ATH9K_HTC_A_STR];
++	if (received_str_attr) {
++		received_str = (char *)nla_data(received_str_attr);
++		if (received_str != NULL)
++			printk("ath9k_htc: got %s\n", received_str);
++		else
++			printk(KERN_ERR "error while receiving data\n");
++	} else {
++		printk(KERN_ERR "attribute %i not present\n", ATH9K_HTC_A_STR);
++	}
++
++	skb = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++	if (skb == NULL)
++		goto out;
++
++	msg_head = genlmsg_put(skb, 0, info->snd_seq + 1, &ath9k_htc_gnl_family, 0, ATH9K_C_ECHO);
++	if (msg_head == NULL) {
++		errc = -ENOMEM;
++		goto out;
++	}
++	
++	errc = nla_put_string(skb, ATH9K_HTC_A_STR, "pong");
++	if (errc != 0)
++		goto out;
++
++	genlmsg_end(skb, msg_head);
++
++	errc = genlmsg_unicast(genl_info_net(info), skb, info->snd_portid);
++	if (errc != 0)
++		goto out;
++
++	return 0;
++
++out:
++	printk(KERN_ERR "an error occured in ath9k_echo:\n");
++
++	return 1;
++}
++
++static int ath9k_set_reg(struct sk_buff *iskb, struct genl_info *info) {
++	struct nlattr *received_int_attr;
++	u32 *received_reg = NULL;
++	u32 *received_val = NULL;
++	struct sk_buff *skb;
++	int errc;
++	void *msg_head;
++	u32 vals[2];
++
++	if (info == NULL)
++		goto out;
++
++	// TODO repeated code... simplify
++	received_int_attr = info->attrs[ATH9K_HTC_A_REG];
++	if (received_int_attr) {
++		received_reg = (u32*)nla_data(received_int_attr);
++		if(received_reg)
++			printk("ath9k_htc: reg %08x\n", *received_reg);
++	} else {
++		printk(KERN_ERR "attribute %i not present\n", ATH9K_HTC_A_REG);
++	}
++
++	received_int_attr = info->attrs[ATH9K_HTC_A_VAL];
++	if (received_int_attr) {
++		received_val = (u32*)nla_data(received_int_attr);
++		if(received_val)
++			printk("ath9k_htc: val %08x\n", *received_val);
++	} else {
++		printk(KERN_ERR "attribute %i not present\n", ATH9K_HTC_A_VAL);
++	}
++
++	if(received_reg)
++		vals[0] = *received_reg;
++
++	if(received_val)
++		vals[1] = *received_val;
++
++	dbg_firmware_cmd(genl_ath9k_priv, DBG_CMD_SET_REG, vals);
++
++	skb = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++	if (skb == NULL)
++		goto out;
++
++	msg_head = genlmsg_put(skb, 0, info->snd_seq + 1, &ath9k_htc_gnl_family, 0, ATH9K_C_SET);
++	if (msg_head == NULL) {
++		errc = -ENOMEM;
++		goto out;
++	}
++	
++	errc = nla_put_string(skb, ATH9K_HTC_A_STR, "reg set successfully");
++	if (errc != 0)
++		goto out;
++
++	genlmsg_end(skb, msg_head);
++
++	errc = genlmsg_unicast(genl_info_net(info), skb, info->snd_portid);
++	if (errc != 0)
++		goto out;
++
++	return 0;
++
++out:
++	printk(KERN_ERR "an error occured\n");
++
++	return 1;
++}
++
++static int ath9k_set_rate(struct sk_buff *iskb, struct genl_info *info) {
++	struct nlattr *received_int_attr;
++	u32 *received_val = NULL;
++	struct sk_buff *skb;
++	int errc;
++	void *msg_head;
++	u32 vals[2];
++
++	if (info == NULL)
++		goto out;
++
++	// TODO repeated code... simplify
++	received_int_attr = info->attrs[ATH9K_HTC_A_VAL];
++	if (received_int_attr) {
++		received_val = (u32*)nla_data(received_int_attr);
++		if(received_val)
++			printk("ath9k_htc: val %08x\n", *received_val);
++	} else {
++		printk(KERN_ERR "attribute %i not present\n", ATH9K_HTC_A_VAL);
++	}
++
++	if(received_val)
++		vals[0] = *received_val;
++
++	dbg_firmware_cmd(genl_ath9k_priv, DBG_CMD_SET_RATE, vals);
++
++	skb = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++	if (skb == NULL)
++		goto out;
++
++	msg_head = genlmsg_put(skb, 0, info->snd_seq + 1, &ath9k_htc_gnl_family, 0, ATH9K_C_RATE);
++	if (msg_head == NULL) {
++		errc = -ENOMEM;
++		goto out;
++	}
++	
++	errc = nla_put_string(skb, ATH9K_HTC_A_STR, "rate set successfully");
++	if (errc != 0)
++		goto out;
++
++	genlmsg_end(skb, msg_head);
++
++	errc = genlmsg_unicast(genl_info_net(info), skb, info->snd_portid);
++	if (errc != 0)
++		goto out;
++
++	return 0;
++
++out:
++	printk(KERN_ERR "an error occured\n");
++
++	return 1;
++}
++
++static int ath9k_reset(struct sk_buff *iskb, struct genl_info *info) {
++	struct sk_buff *skb;
++	int errc;
++	void *msg_head;
++	u32 vals[2];
++
++	if (info == NULL)
++		goto out;
++
++	dbg_firmware_cmd(genl_ath9k_priv, DBG_CMD_RESET, vals);
++
++	// TODO repeated code... simplify
++	skb = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++	if (skb == NULL)
++		goto out;
++
++	msg_head = genlmsg_put(skb, 0, info->snd_seq + 1, &ath9k_htc_gnl_family, 0, ATH9K_C_RESET);
++	if (msg_head == NULL) {
++		errc = -ENOMEM;
++		goto out;
++	}
++	
++	errc = nla_put_string(skb, ATH9K_HTC_A_STR, "reset counters");
++	if (errc != 0)
++		goto out;
++
++	genlmsg_end(skb, msg_head);
++
++	errc = genlmsg_unicast(genl_info_net(info), skb, info->snd_portid);
++	if (errc != 0)
++		goto out;
++
++	return 0;
++
++out:
++	printk(KERN_ERR "an error occured\n");
++
++	return 1;
++}
++
++static struct genl_ops ath9k_htc_gnl_ops[] = {
++	{
++		.cmd = ATH9K_C_ECHO,
++		.flags = 0,
++		.policy = ath9k_htc_genl_policy,
++		.doit = ath9k_echo,
++		.dumpit = NULL,
++	},
++	{
++		.cmd = ATH9K_C_SET,
++		.flags = 0,
++		.policy = ath9k_htc_genl_policy,
++		.doit = ath9k_set_reg,
++		.dumpit = NULL,
++	},
++	{
++		.cmd = ATH9K_C_RATE,
++		.flags = 0,
++		.policy = ath9k_htc_genl_policy,
++		.doit = ath9k_set_rate,
++		.dumpit = NULL,
++	},
++	{
++		.cmd = ATH9K_C_RESET,
++		.flags = 0,
++		.policy = ath9k_htc_genl_policy,
++		.doit = ath9k_reset,
++		.dumpit = NULL,
++	},
++};
++
++
+ void ath9k_htc_deinit_debug(struct ath9k_htc_priv *priv)
+ {
++	int errc;
+ 	ath9k_cmn_spectral_deinit_debug(&priv->spec_priv);
++
++	errc = genl_unregister_family(&ath9k_htc_gnl_family);
++	if(errc != 0){
++		printk(KERN_ERR "unregister family %i\n", errc);
++	}
+ }
+ 
+ int ath9k_htc_init_debug(struct ath_hw *ah)
+ {
++	int errc;
+ 	struct ath_common *common = ath9k_hw_common(ah);
+ 	struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+ 
+@@ -520,5 +806,14 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
+ 	ath9k_cmn_debug_base_eeprom(priv->debug.debugfs_phy, priv->ah);
+ 	ath9k_cmn_debug_modal_eeprom(priv->debug.debugfs_phy, priv->ah);
+ 
++	/* ath9k_htc netlink interface */
++	// TODO only works with one interface at the same time!
++	genl_ath9k_priv = priv;
++	errc = genl_register_family_with_ops(&ath9k_htc_gnl_family, ath9k_htc_gnl_ops);
++	if (errc != 0) {
++		printk("genl_register_family_with_ops error\n");
++		return 1;
++	}
++
+ 	return 0;
+ }
+diff --git i/drivers/net/wireless/ath/ath9k/htc_drv_init.c w/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index defacc6c9c99..df7ddfde9423 100644
+--- i/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ w/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -231,6 +231,59 @@ static void ath9k_reg_notifier(struct wiphy *wiphy,
+ 			       ath9k_hw_regulatory(priv->ah));
+ }
+ 
++static void fancy_printk(u8* buffer, u8 id, u8 len) {
++	u8 temp[400];
++	int i;
++	int counth = 0;
++	int countc = 0;
++
++	for(i = 0; i < len; i++) {
++		sprintf(temp + (counth * 3), "%02x ", buffer[i]);
++		counth++;
++	}
++
++	sprintf(temp + (counth * 3), "| ");
++
++	for(i = 0; i < len; i++) {
++		if((buffer[i] > '!' && buffer[i] < '~') || buffer[i] == ' ') {
++			sprintf(temp + (counth * 3) + 2 + countc, "%c", buffer[i]);
++		} else {
++			sprintf(temp + (counth * 3) + 2 + countc, "%c", '.');
++		}
++		countc++;
++	}
++	printk(KERN_ERR "firmware: %s (cmd %d)\n", temp, id);
++}
++
++int dbg_firmware_cmd(struct ath9k_htc_priv *priv, u8 cmd_id, u32 arguments[2])
++{
++	struct dbg_cmd_request cmd;
++	struct dbg_cmd_response cmd_rsp;
++	int ret;
++
++	// Prepare command
++	memset(&cmd, 0, sizeof(cmd));
++	cmd.id = cmd_id;
++	if(arguments != NULL) {
++		cmd.args[0] = cpu_to_be32(arguments[0]);
++		cmd.args[1] = cpu_to_be32(arguments[1]);
++	}
++
++	// Prepare response
++	memset(&cmd_rsp, 0, sizeof(cmd_rsp));
++
++	do {
++		ret = ath9k_wmi_cmd(priv->wmi, WMI_DBGCMD_CMDID, (u8 *)&cmd, sizeof(cmd), (u8 *)&cmd_rsp, sizeof(cmd_rsp), HZ*2);
++		if (ret)
++			return -EINVAL;
++
++		if(cmd_rsp.length > 0)
++			fancy_printk(cmd_rsp.buffer, cmd_id, cmd_rsp.length);
++	} while(cmd_rsp.length != 0);
++
++	return 0;
++}
++
+ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
+ {
+ 	struct ath_hw *ah = (struct ath_hw *) hw_priv;
+@@ -249,6 +302,9 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
+ 		return -EIO;
+ 	}
+ 
++	// Piggyback reading of firmware print buffer
++	dbg_firmware_cmd(priv, DBG_CMD_READ_MEMORY, NULL);
++
+ 	return be32_to_cpu(val);
+ }
+ 
+diff --git i/drivers/net/wireless/ath/ath9k/wmi.c w/drivers/net/wireless/ath/ath9k/wmi.c
+index 64a354fa78ab..f34e0d6007a5 100644
+--- i/drivers/net/wireless/ath/ath9k/wmi.c
++++ w/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -83,6 +83,11 @@ static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
+ 		return "WMI_RX_STATS_CMDID";
+ 	case WMI_BITRATE_MASK_CMDID:
+ 		return "WMI_BITRATE_MASK_CMDID";
++	case WMI_REG_RMW_CMDID:
++		return "WMI_REG_RMW_CMDID"; // Bugfix
++	// New stuff
++	case WMI_DBGCMD_CMDID:
++		return "WMI_DBGCMD_CMDID";
+ 	}
+ 
+ 	return "Bogus";
+@@ -334,6 +339,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ 	if (!time_left) {
+ 		ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
+ 			wmi_cmd_to_name(cmd_id));
++		printk(KERN_ERR "ath9k_htc: Timeout waiting for command %s", wmi_cmd_to_name(cmd_id));
+ 		mutex_unlock(&wmi->op_mutex);
+ 		return -ETIMEDOUT;
+ 	}
+diff --git i/drivers/net/wireless/ath/ath9k/wmi.h w/drivers/net/wireless/ath/ath9k/wmi.h
+index 380175d5ecd7..0f9518b3ea1c 100644
+--- i/drivers/net/wireless/ath/ath9k/wmi.h
++++ w/drivers/net/wireless/ath/ath9k/wmi.h
+@@ -41,6 +41,25 @@ struct wmi_event_swba {
+ 	u8 beacon_pending;
+ } __packed;
+ 
++// New stuff
++typedef enum {
++    DBG_CMD_READ_MEMORY,
++    DBG_CMD_TEST,
++    DBG_CMD_SET_REG,
++    DBG_CMD_SET_RATE,
++    DBG_CMD_RESET
++} DBG_CMD_ID;
++
++struct dbg_cmd_request {
++	u8 id;
++	__be32 args[2];
++} __packed;
++
++struct dbg_cmd_response {
++	u8 length;
++	u8 buffer[33]; // WMI does not allow big packets
++} __packed;
++
+ /*
+  * 64 - HTC header - WMI header - 1 / txstatus
+  * And some other hdr. space is also accounted for.
+@@ -113,6 +132,7 @@ enum wmi_cmd_id {
+ 	WMI_RX_STATS_CMDID,
+ 	WMI_BITRATE_MASK_CMDID,
+ 	WMI_REG_RMW_CMDID,
++  WMI_DBGCMD_CMDID,
+ };
+ 
+ enum wmi_event_id {
diff --git a/config b/config
index ca2bcf3c8456..64cbdc584078 100644
--- a/config
+++ b/config
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.14-1 Kernel Configuration
+# Linux/x86 4.14.16-1 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -112,7 +112,7 @@ CONFIG_NO_HZ_COMMON=y
 # CONFIG_HZ_PERIODIC is not set
 CONFIG_NO_HZ_IDLE=y
 # CONFIG_NO_HZ_FULL is not set
-# CONFIG_NO_HZ is not set
+CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 
 #
@@ -131,13 +131,17 @@ CONFIG_TASK_IO_ACCOUNTING=y
 #
 # RCU Subsystem
 #
-CONFIG_PREEMPT_RCU=y
-# CONFIG_RCU_EXPERT is not set
+CONFIG_TREE_RCU=y
+CONFIG_RCU_EXPERT=y
 CONFIG_SRCU=y
 CONFIG_TREE_SRCU=y
-CONFIG_TASKS_RCU=y
+# CONFIG_TASKS_RCU is not set
 CONFIG_RCU_STALL_COMMON=y
 CONFIG_RCU_NEED_SEGCBLIST=y
+CONFIG_RCU_FANOUT=64
+CONFIG_RCU_FANOUT_LEAF=16
+# CONFIG_RCU_FAST_NO_HZ is not set
+# CONFIG_RCU_NOCB_CPU is not set
 CONFIG_BUILD_BIN2C=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
@@ -170,11 +174,11 @@ CONFIG_CPUSETS=y
 CONFIG_PROC_PID_CPUSET=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PERF=y
+# CONFIG_CGROUP_PERF is not set
 CONFIG_CGROUP_BPF=y
 # CONFIG_CGROUP_DEBUG is not set
 CONFIG_SOCK_CGROUP_DATA=y
-CONFIG_CHECKPOINT_RESTORE=y
+# CONFIG_CHECKPOINT_RESTORE is not set
 CONFIG_NAMESPACES=y
 CONFIG_UTS_NS=y
 CONFIG_IPC_NS=y
@@ -224,6 +228,7 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT_ALWAYS_ON=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
 CONFIG_ADVISE_SYSCALLS=y
@@ -417,10 +422,10 @@ CONFIG_IOSCHED_NOOP=y
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
 CONFIG_CFQ_GROUP_IOSCHED=y
-# CONFIG_DEFAULT_DEADLINE is not set
-CONFIG_DEFAULT_CFQ=y
+CONFIG_DEFAULT_DEADLINE=y
+# CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
-CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_DEFAULT_IOSCHED="deadline"
 CONFIG_MQ_IOSCHED_DEADLINE=y
 CONFIG_MQ_IOSCHED_KYBER=y
 CONFIG_IOSCHED_BFQ=y
@@ -428,7 +433,11 @@ CONFIG_BFQ_GROUP_IOSCHED=y
 CONFIG_PREEMPT_NOTIFIERS=y
 CONFIG_PADATA=y
 CONFIG_ASN1=m
-CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+CONFIG_INLINE_READ_UNLOCK=y
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+CONFIG_INLINE_WRITE_UNLOCK=y
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
 CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
 CONFIG_MUTEX_SPIN_ON_OWNER=y
 CONFIG_RWSEM_SPIN_ON_OWNER=y
@@ -507,10 +516,9 @@ CONFIG_NR_CPUS=128
 CONFIG_SCHED_SMT=y
 CONFIG_SCHED_MC=y
 CONFIG_SCHED_MC_PRIO=y
-# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
-CONFIG_PREEMPT=y
-CONFIG_PREEMPT_COUNT=y
+# CONFIG_PREEMPT is not set
 CONFIG_X86_LOCAL_APIC=y
 CONFIG_X86_IO_APIC=y
 CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
@@ -605,7 +613,6 @@ CONFIG_TRANSPARENT_HUGE_PAGECACHE=y
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
 # CONFIG_CMA is not set
-# CONFIG_MEM_SOFT_DIRTY is not set
 CONFIG_ZSWAP=y
 CONFIG_ZPOOL=y
 CONFIG_ZBUD=y
@@ -648,11 +655,11 @@ CONFIG_EFI=y
 CONFIG_EFI_STUB=y
 CONFIG_EFI_MIXED=y
 CONFIG_SECCOMP=y
-# CONFIG_HZ_100 is not set
+CONFIG_HZ_100=y
 # CONFIG_HZ_250 is not set
-CONFIG_HZ_300=y
+# CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
-CONFIG_HZ=300
+CONFIG_HZ=100
 CONFIG_SCHED_HRTICK=y
 CONFIG_KEXEC=y
 CONFIG_KEXEC_FILE=y
@@ -7944,7 +7951,6 @@ CONFIG_SCHED_INFO=y
 CONFIG_SCHEDSTATS=y
 CONFIG_SCHED_STACK_END_CHECK=y
 # CONFIG_DEBUG_TIMEKEEPING is not set
-# CONFIG_DEBUG_PREEMPT is not set
 
 #
 # Lock Debugging (spinlocks, mutexes, etc...)
@@ -8009,7 +8015,6 @@ CONFIG_FTRACE=y
 CONFIG_FUNCTION_TRACER=y
 CONFIG_FUNCTION_GRAPH_TRACER=y
 # CONFIG_IRQSOFF_TRACER is not set
-# CONFIG_PREEMPT_TRACER is not set
 CONFIG_SCHED_TRACER=y
 CONFIG_HWLAT_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y