Carl Huang [Mon, 17 Aug 2020 10:31:54 +0000 (13:31 +0300)]
ath11k: assign correct search flag and type for QCA6390
QCA6390 doesn't enable V2 map and ummap event, so the addr search
flags and type is different from IPQ8074. Assign correct search flags
and type for QCA6390.
Without this change, ping sometimes fails. With this change, now ping
is always successful.
Carl Huang [Mon, 17 Aug 2020 10:31:53 +0000 (13:31 +0300)]
ath11k: refine the phy_id check in ath11k_reg_chan_list_event
For QCA6390, it processes the reg chan list event only for phy0,
and it goes to fallback if the phy_id is not valid. For a valid
phy_id but not 0, just discard the event.
Carl Huang [Mon, 17 Aug 2020 10:31:53 +0000 (13:31 +0300)]
ath11k: setup QCA6390 rings for both rxdmas
For QCA6390, only one pdev is created and this pdev manages both lmacs, thus
both rxdmas. So host needs to initialize all rxdma related rings for one pdev.
Another difference is for QCA6390, host fills rxbuf to firmware and firmware
further fills the rxbuf to rxbuf ring for each rxdma.
Carl Huang [Mon, 17 Aug 2020 10:31:52 +0000 (13:31 +0300)]
ath11k: don't initialize rxdma1 related ring
For QCA6390, it has 2 lmacs and thus 2 rxdmas. However, each rxdma has rxdma0
only, and doesn't have rxdma1. So for QCA6390, don't initialize rxdma1 related
rings such as rx_mon_buf_ring, rx_mon_dst_ring and rx_mon_desc_ring.
Carl Huang [Mon, 17 Aug 2020 10:31:52 +0000 (13:31 +0300)]
ath11k: enable DP interrupt setup for QCA6390
QCA6390 uses MSI interrupt, so need to configure msi_add and
msi_data to dp srngs. As there are so many DP srngs, so need
to group them. Each group shares one MSI interrupt.
Carl Huang [Mon, 17 Aug 2020 10:31:51 +0000 (13:31 +0300)]
ath11k: wmi: put hardware to DBS mode
For QCA6390, host puts hardware to Dual Band Simultaneous (DBS) mode by default
so both 2G and 5G bands can be used. Otherwise only the 5G band can be used.
QCA6390 doesn't provide band_to_mac configuration and firmware will do the
band_to_mac map.
Kalle Valo [Mon, 17 Aug 2020 10:31:40 +0000 (13:31 +0300)]
ath10k: move enable_pll_clk call to ath10k_core_start()
There's no reason to have call for enable_pll_clk in ath10k_bmi_start(), move
it to ath10k_core_start() instead. This way it's possible to call
ath10k_bmi_start() from sdio.c during firmware dump creation. And also the
function call is more visible when it's in core.c.
Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.
Dan Carpenter [Thu, 13 Aug 2020 14:12:53 +0000 (17:12 +0300)]
ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
The value of "htc_hdr->endpoint_id" comes from skb->data so Smatch marks
it as untrusted so we have to check it before using it as an array
offset.
This is similar to a bug that syzkaller found in commit e4ff08a4d727
("ath9k: Fix use-after-free Write in ath9k_htc_rx_msg") so it is
probably a real issue.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200813141253.GA457408@mwanda
ath9k: add NL80211_EXT_FEATURE_CAN_REPLACE_PTK0 support
The ath9k driver was so far only able to rekey PTK0 keys correctly due
to the best effort queue flush added with commit 62872a9b9a10
("mac80211: Fix PTK rekey freezes and clear text leak").
Add the needed queue flush and set NL80211_EXT_FEATURE_CAN_REPLACE_PTK0
to tell mac80211 that the driver can now rekey PTK0 keys correctly and
no longer needs the best effort flush.
Effectively this prevents mac80211 to warn when rekeying a PTK0 key
only.
Dan Carpenter [Thu, 13 Aug 2020 14:13:15 +0000 (17:13 +0300)]
ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
The value for "aid" comes from skb->data so Smatch marks it as
untrusted. If it's invalid then it can result in an out of bounds array
access in ath6kl_add_new_sta().
Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda
Lee Jones [Fri, 14 Aug 2020 11:39:23 +0000 (12:39 +0100)]
ath5k: Fix kerneldoc formatting issue
Kerneldoc expects attributes/parameters to be in '@*.: ' format and
gets confused if the variable does not follow the type/attribute
definitions.
Fixes the following W=1 kernel build warning(s):
drivers/net/wireless/ath/ath5k/base.c:1111: warning: Function parameter or member 'ah' not described in 'ath5k_drain_tx_buffs'
Cc: Jiri Slaby <jirislaby@kernel.org> Cc: Nick Kossifidis <mickflemm@gmail.com> Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Jesper Dangaard Brouer <hawk@kernel.org> Cc: John Fastabend <john.fastabend@gmail.com> Cc: "Luis R. Rodriguez" <mcgrof@winlab.rutgers.edu> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Cc: bpf@vger.kernel.org Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200814113933.1903438-21-lee.jones@linaro.org
Lee Jones [Fri, 14 Aug 2020 11:39:16 +0000 (12:39 +0100)]
wil6210: Demote non-kerneldoc headers to standard comment blocks
No effort has been made to document any of the function parameters here.
Fixes the following W=1 kernel build warning(s):
drivers/net/wireless/ath/wil6210/cfg80211.c:1749: warning: Function parameter or member 'ies' not described in '_wil_cfg80211_find_ie'
drivers/net/wireless/ath/wil6210/cfg80211.c:1749: warning: Function parameter or member 'ies_len' not described in '_wil_cfg80211_find_ie'
drivers/net/wireless/ath/wil6210/cfg80211.c:1749: warning: Function parameter or member 'ie' not described in '_wil_cfg80211_find_ie'
drivers/net/wireless/ath/wil6210/cfg80211.c:1749: warning: Function parameter or member 'ie_len' not described in '_wil_cfg80211_find_ie'
drivers/net/wireless/ath/wil6210/cfg80211.c:1780: warning: Function parameter or member 'ies1' not described in '_wil_cfg80211_merge_extra_ies'
drivers/net/wireless/ath/wil6210/cfg80211.c:1780: warning: Function parameter or member 'ies1_len' not described in '_wil_cfg80211_merge_extra_ies'
drivers/net/wireless/ath/wil6210/cfg80211.c:1780: warning: Function parameter or member 'ies2' not described in '_wil_cfg80211_merge_extra_ies'
drivers/net/wireless/ath/wil6210/cfg80211.c:1780: warning: Function parameter or member 'ies2_len' not described in '_wil_cfg80211_merge_extra_ies'
drivers/net/wireless/ath/wil6210/cfg80211.c:1780: warning: Function parameter or member 'merged_ies' not described in '_wil_cfg80211_merge_extra_ies'
drivers/net/wireless/ath/wil6210/cfg80211.c:1780: warning: Function parameter or member 'merged_len' not described in '_wil_cfg80211_merge_extra_ies'
Cc: Maya Erez <merez@codeaurora.org> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: linux-wireless@vger.kernel.org Cc: wil6210@qti.qualcomm.com Cc: netdev@vger.kernel.org Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200814113933.1903438-14-lee.jones@linaro.org
Lee Jones [Fri, 14 Aug 2020 11:39:12 +0000 (12:39 +0100)]
ath5k: pcu: Add a description for 'band' remove one for 'mode'
Fixes the following W=1 kernel build warning(s):
drivers/net/wireless/ath/ath5k/pcu.c:115: warning: Function parameter or member 'band' not described in 'ath5k_hw_get_frame_duration'
drivers/net/wireless/ath/ath5k/pcu.c:955: warning: Excess function parameter 'mode' description in 'ath5k_hw_pcu_init'
Cc: Jiri Slaby <jirislaby@kernel.org> Cc: Nick Kossifidis <mickflemm@gmail.com> Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Kalle Valo <kvalo@codeaurora.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Reyk Floeter <reyk@openbsd.org> Cc: "W. S. Bell" <mentor@madwifi.org> Cc: Luis Rodriguez <mcgrof@winlab.rutgers.edu> Cc: Pavel Roskin <proski@gnu.org> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200814113933.1903438-10-lee.jones@linaro.org
Kalle Valo [Fri, 14 Aug 2020 07:10:30 +0000 (10:10 +0300)]
ath11k: hal: create hw_srng_config dynamically
On QCA6390 reg_start and reg_size values are different from IPQ8074 so we need
to change the values runtime. As we can't modify a static const variable
hw_srng_config directly, instead use it as a template, copy it and modify the
copy with correct values.
Carl Huang [Fri, 14 Aug 2020 07:10:29 +0000 (10:10 +0300)]
ath11k: enable internal sleep clock
On x86 and other non-qcom platforms, host needs to explicitly tell the firmware
to use the internal sleep clock. Some QCA6390 modules have OTP burnt with
external sleep clock selected, and these modules can't work expectedly unless
firmware selects internal sleep clock.
Add a field to hw_params to support this difference.
Carl Huang [Fri, 14 Aug 2020 07:10:27 +0000 (10:10 +0300)]
ath11k: fix memory OOB access in qmi_decode
The decoded_size is wrongly assigned in ath11k_qmi_msg_handlers and it results
in out of boundary access in qmi_decode. The correct decoded_size should be
calculated from the related ind_msg structure.
This issue is exposed with QCA6390 because it needs 11 small memory chunks
which are stored in qmi_wlanfw_request_mem_ind_msg_v01 and hence the
decoded_size exceeds the wrongly assigend decoded_size.
Carl Huang [Fri, 14 Aug 2020 07:10:26 +0000 (10:10 +0300)]
ath11k: allocate smaller chunks of memory for firmware
On x86 it's sometimes difficult to allocate a large contigous DMA
memory, so instead allocate blocks of small chunk memory.
In ath11k_qmi_msg_mem_request_cb() the error handling was cleaned up to avoid
an unused variable warning. Also changed the test from (ret < 0) to just (ret)
as the functions don't return any positive values.
Govind Singh [Fri, 14 Aug 2020 07:10:25 +0000 (10:10 +0300)]
ath11k: setup ce tasklet for control path
CE srng is used for control path and CE srng processing is done using tasklet
bottom half. Setup ce tasklet initialization and scheduling for control path.
Govind Singh [Fri, 14 Aug 2020 07:10:22 +0000 (10:10 +0300)]
ath11k: fill appropriate QMI service instance id for QCA6390
QMI service instance id is used for qmi service lookup, IPQ8074 and QCA6390
uses different instance id for service lookup. Fill appropriate QMI service
instance id for respective targets.
Govind Singh [Fri, 14 Aug 2020 07:10:21 +0000 (10:10 +0300)]
ath11k: add board file support for PCI devices
PCI devices like QCA6390 load the board file differently, add support for that
and the method is chosen using bus_params variables.
Add support to create board name for different targets. This board name is
used to parse the board data from board-2.bin for ahb/pci based targets.
As struct target_mem_chunk::vaddr was changed from 'u32' to 'u32 *' in
ath11k_qmi_assign_target_mem_chunk() vaddr assignments were changed to NULL to
avoid a compilation warning. IPQ8074 does not use the vaddr field for anything
so that change does not affect functionality.
At the moment this only supports board files with BIN type. Support for ELF
type, which seems to be more popular on QCA6390 devices, needs to be added later.
Govind Singh [Thu, 13 Aug 2020 09:04:24 +0000 (12:04 +0300)]
ath11k: register MHI controller device for QCA6390
Modem Host Interface (MHI) is a communication protocol to communicate with
external Qualcomm modems and Wi-Fi chipsets over high speed peripheral buses.
Even though MHI doesn’t dictate underlying physical layer, protocol and MHI
stack is structured for PCI based devices.
Register directly with MHI subsystem as a MHI device driver for firmware
download to QCA6390.
Carl Huang [Thu, 13 Aug 2020 09:04:17 +0000 (12:04 +0300)]
ath11k: do not depend on ARCH_QCOM for ath11k
With only IPQ8074 supported ath11k was only usable on Qualcomm architectures.
But now that we are adding QCA6390 PCI support to ath11k that's not the case
anymore and it can be used on any architecture supporting PCI. So remove the
dependency on ARCH_QCOM. After that there is also no need to depend on
COMPILE_TEST.
Wen Gong [Fri, 14 Aug 2020 08:04:54 +0000 (16:04 +0800)]
ath10k: correct the array index from mcs index for HT mode for QCA6174
The mcs index of HT mode is 0 to 31, please refer http://mcsindex.com/.
Its spatial stream(Nss) number is from 1 to 4, mcs index is 0~7 for
Nss=1, 8~15 for Nss=2, 16~23 for Nss=3 and 24~31 is for Nss=4.
The mcs is reported from firmware in wmi_tlv_peer_stats_info of
event WMI_TLV_PEER_STATS_INFO_EVENTID, its range is from 0~15 for
QCA6174 SDIO and PCIe. It is for both Nss=1 and Nss=2, and it has 2
rate table supported_ht_mcs_rate_nss1 and supported_ht_mcs_rate_nss2
in ath10k, they are for Nss=1 and Nss=2, each table has 8 rates.
It need to find the matched row number with the mcs index, for example,
mcs index is 2, it is <=7, so it is Nss=1, and match row 2 in table of
Nss=1. If mcs index is 12, it is >= 8 and <= 15, so it is Nss=2, it
match row 4(12-8) in table of Nss=2. If mcs index is >=16, it is for
Nss=3/4, it need to add rate table, so it is not support in current
ath10k.
This patch is to find the row number in rate table of Nss=1 or Nss=2
with the mcs index reported from firmware.
This patch only effect the chips which supports_peer_stats_info of its
hw_params is true, it is true only for QCA6174 currently.
Wen Gong [Fri, 14 Aug 2020 15:55:51 +0000 (18:55 +0300)]
ath10k: enable supports_peer_stats_info for QCA6174 PCI devices
When using QCA6174 PCI devices working in station mode, after connected
to AP, tx bitrate is always '1.0 MBit/s' in output of command 'iw wlan0
station dump'. (QCA6174 SDIO devices are working fine.)
Wen Gong [Fri, 14 Aug 2020 15:55:50 +0000 (18:55 +0300)]
ath10k: remove return for NL80211_STA_INFO_TX_BITRATE
ath10k_sta_statistics is used to report many info to iw wlan0 link,
if it return for empty legacy and nss of arsta->txrate, then the other
stats after it will not be set.
It has 4 bit to set after the return:
NL80211_STA_INFO_TX_FAILED
NL80211_STA_INFO_RX_BITRATE
NL80211_STA_INFO_TX_BITRATE
NL80211_STA_INFO_TX_RETRIES
This patch not effect the info of above 4 bit for all hardware, reason
as below:
NL80211_STA_INFO_TX_FAILED is only for htt.disable_tx_comp is true, it
is for QCA6174 SDIO.
NL80211_STA_INFO_RX_BITRATE and NL80211_STA_INFO_TX_BITRATE are both
set in ath10k_mac_sta_get_peer_stats_info, it is only enabled for chips
which supports_peer_stats_info is true in hw_params, recently only for
QCA6174 SDIO, NL80211_STA_INFO_TX_BITRATE is set again in function
ath10k_mac_sta_get_peer_stats_info because the value which parsed from
arsta->tx_rate_code and arsta->tx_bitrate_kbps is correct for QCA6174
SDIO and PCIe, and the value arsta->txrate is not correct for QCA6174
SDIO and PCIe, so it need to set again with the correct value.
NL80211_STA_INFO_TX_RETRIES is use value of arsta->tx_retries, it is set
in ath10k_update_per_peer_tx_stats, which accumulate the retry_pkts in
HTT message from firmware, if the chips not support this feature, then
it is always 0 after accumulate, then iw wlan0 station dump always show
0 for retry count. If not set NL80211_STA_INFO_TX_RETRIES here, then it
is still 0, so the result is same, then set NL80211_STA_INFO_TX_RETRIES
has no effect.
Wen Gong [Fri, 14 Aug 2020 15:55:50 +0000 (18:55 +0300)]
ath10k: add wmi service peer stat info for wmi tlv
ath10k_sta_statistics is used to report info for iw wlan0 link,
it check ath10k_peer_stats_enabled, and ath10k_peer_stats_enabled
check WMI_SERVICE_PEER_STATS bit of ar->wmi.svc_map. SVCMAP() for
WMI_SERVICE_PEER_STATS was defined only for wmi_10x_svc_map and
wmi_10_4_svc_map interfaces, it missed in wmi_tlv_svc_map, so it is
not usable for iw wlan0 link for wmi tlv interface.
If firmware report WMI_TLV_SERVICE_PEER_STATS_INFO for wmi tlv, then
enable the WMI_SERVICE_PEER_STATS bit in ath10k, and then it pass check
in ath10k_peer_stats_enabled and ath10k_sta_statistics pass check.
Wen Gong [Fri, 14 Aug 2020 15:17:08 +0000 (18:17 +0300)]
ath10k: start recovery process when payload length exceeds max htc length for sdio
When simulate random transfer fail for sdio write and read, it happened
"payload length exceeds max htc length" and recovery later sometimes.
Test steps:
1. Add config and update kernel:
CONFIG_FAIL_MMC_REQUEST=y
CONFIG_FAULT_INJECTION=y
CONFIG_FAULT_INJECTION_DEBUG_FS=y
2. Run simulate fail:
cd /sys/kernel/debug/mmc1/fail_mmc_request
echo 10 > probability
echo 10 > times # repeat until hitting issues
3. It happened payload length exceeds max htc length.
[ 199.935506] ath10k_sdio mmc1:0001:1: payload length 57005 exceeds max htc length: 4088
....
[ 264.990191] ath10k_sdio mmc1:0001:1: payload length 57005 exceeds max htc length: 4088
4. after some time, such as 60 seconds, it start recovery which triggered
by wmi command timeout for periodic scan.
[ 269.229232] ieee80211 phy0: Hardware restart was requested
[ 269.734693] ath10k_sdio mmc1:0001:1: device successfully recovered
The simulate fail of sdio is not a real sdio transter fail, it only
set an error status in mmc_should_fail_request after the transfer end,
actually the transfer is success, then sdio_io_rw_ext_helper will
return error status and stop transfer the left data. For example,
the really RX len is 286 bytes, then it will split to 2 blocks in
sdio_io_rw_ext_helper, one is 256 bytes, left is 30 bytes, if the
first 256 bytes get an error status by mmc_should_fail_request,then
the left 30 bytes will not read in this RX operation. Then when the
next RX arrive, the left 30 bytes will be considered as the header
of the read, the top 4 bytes of the 30 bytes will be considered as
lookaheads, but actually the 4 bytes is not the lookaheads, so the len
from this lookaheads is not correct, it exceeds max htc length 4088
sometimes. When happened exceeds, the buffer chain is not matched between
firmware and ath10k, then it need to start recovery ASAP. Recently then
recovery will be started by wmi command timeout, but it will be long time
later, for example, it is 60+ seconds later from the periodic scan, if
it does not have periodic scan, it will be longer.
Start recovery when it happened "payload length exceeds max htc length"
will be reasonable.
This patch only effect sdio chips.
Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00029.
Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.
Deterministic algorithm:
For each file:
If not .svg:
For each line:
If doesn't contain `\bxmlns\b`:
For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
If both the HTTP and HTTPS versions
return 200 OK and serve the same content:
Replace HTTP with HTTPS.
Julia Lawall [Sun, 26 Jul 2020 10:58:32 +0000 (12:58 +0200)]
ath: drop unnecessary list_empty
list_for_each_entry{_safe} is able to handle an empty list.
The only effect of avoiding the loop is not initializing the
index variable.
Drop list_empty tests in cases where these variables are not
used.
Note that list_for_each_entry{_safe} is defined in terms of
list_first_entry, which indicates that it should not be used on an
empty list. But in list_for_each_entry{_safe}, the element obtained
by list_first_entry is not really accessed, only the address of its
list_head field is compared to the address of the list head, so the
list_first_entry is safe.
The semantic patch that makes this change for the list_for_each_entry
case is as follows: (http://coccinelle.lip6.fr/)
wcn36xx: Use sequence number allocated by mac80211
Instead of using the firmware generated sequence number, use the one
already allocated by the mac80211 layer. This allows better control
of the sequence numbers and avoid to rely on same sequence for Data,
QOS Data and QOS Null Data packets.
Increase the short/long retry limit to 15 in order to impove TX
robustness in noisy/busy environment. 15 is the default value
defined in the downstream driver. Observed number of ack timeout
is reduced with this change.
The controller is capable of reporting TX indication which can be used
to report TX ack when IEEE80211_TX_CTL_REQ_TX_STATUS is set.
The support was only partially implemented.
The firmware can be configured for reporting event when a packet is
acked, without specifying which packet though. In order to send a
packet flagged with TX status callback, we need to stop the queue,
submit the packet and wait for the firmware ack event. Then the queue
can be restarted and mac80211 status callback called.
In case the packet is not acked, no ack event will be received,
therefore a timeout mechanism is introduced to restart the queue
and call the status cb in case no event is received after a 100ms.
Several AMPDU sessions can be started, e.g. for different TIDs.
Currently the driver does not take care of the session ID when
requesting block-ack (statically set to 0), which leads to never
block-acked packet with sessions other than 0.
Fix this by saving the session id when creating the ba session and
use it in subsequent ba operations.
This issue can be reproduced with iperf in two steps (tid 0 strem
then tid 6 stream).
1.0 iperf -s # wcn36xx side
1.1 iperf -c ${IP_ADDR} # host side
Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.
Deterministic algorithm:
For each file:
If not .svg:
For each line:
If doesn't contain `\bxmlns\b`:
For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
If both the HTTP and HTTPS versions
return 200 OK and serve the same content:
Replace HTTP with HTTPS.
Zekun Shen [Tue, 23 Jun 2020 22:11:05 +0000 (18:11 -0400)]
ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
The idx in __ath10k_htt_rx_ring_fill_n function lives in
consistent dma region writable by the device. Malfunctional
or malicious device could manipulate such idx to have a OOB
write. Either by
htt->rx_ring.netbufs_ring[idx] = skb;
or by
ath10k_htt_set_paddrs_ring(htt, paddr, idx);
The idx can also be negative as it's signed, giving a large
memory space to write to.
It's possibly exploitable by corruptting a legit pointer with
a skb pointer. And then fill skb with payload as rougue object.
Part of the log here. Sometimes it appears as UAF when writing
to a freed memory by chance.
ath9k: Check the return value of pcie_capability_read_*()
On failure pcie_capability_read_dword() sets it's last parameter, val
to 0. However, with Patch 14/14, it is possible that val is set to ~0 on
failure. This would introduce a bug because (x & x) == (~0 & x).
This bug can be avoided without changing the function's behaviour if the
return value of pcie_capability_read_dword is checked to confirm success.
Check the return value of pcie_capability_read_dword() to ensure success.
Kalle Valo [Tue, 16 Jun 2020 14:00:50 +0000 (17:00 +0300)]
ath11k: don't use defines for hw specific firmware directories
The downside of using defines in struct ath11k_hw_params.fw.dir is that it's
easy to get it wrong as the full path is not visible. So drop the use of
defines and instead create the patch runtime using a static inline function
ath11k_core_create_firmware_path(). Hopefully this reduces the chances of using
incorrect firmware path.
Kalle Valo [Tue, 16 Jun 2020 14:00:49 +0000 (17:00 +0300)]
ath11k: create a common function to request all firmware files
To avoid duplicating the logic how the full firmware path is created create a
common function ath11k_core_firmware_request() and convert also qmi.c to use it.
Also remove a useless info print, it's more like a debug message anyway.
Zekun Shen [Tue, 16 Jun 2020 13:25:43 +0000 (09:25 -0400)]
ath10k: pci: fix memcpy size of bmi response
A compromized ath10k peripheral is able to control the size argument
of memcpy in ath10k_pci_hif_exchange_bmi_msg.
The min result from previous line is not used as the size argument
for memcpy. Instead, xfer.resp_len comes from untrusted stream dma
input. The value comes from "nbytes" in ath10k_pci_bmi_recv_data,
which is set inside _ath10k_ce_completed_recv_next_nolock with the line
nbytes = __le16_to_cpu(sdesc.nbytes);
sdesc is a stream dma region which device can write to.
It is expected that the returned counters by .get_survey are monotonic
increasing. But the data from ath10k gets reset to zero regularly. Channel
active/busy time are then showing incorrect values (less than previous or
sometimes zero) for the currently active channel during successive survey
dump commands.
example:
$ iw dev wlan0 survey dump
Survey data from wlan0
frequency: 5180 MHz [in use]
channel active time: 54995 ms
channel busy time: 432 ms
channel receive time: 0 ms
channel transmit time: 59 ms
...
$ iw dev wlan0 survey dump
Survey data from wlan0
frequency: 5180 MHz [in use]
channel active time: 32592 ms
channel busy time: 254 ms
channel receive time: 0 ms
channel transmit time: 0 ms
...
The correct way to handle this is to use the non-clearing
WMI_BSS_SURVEY_REQ_TYPE_READ wmi_bss_survey_req_type. The firmware will
then accumulate the survey data and handle wrap arounds.
When tx status enabled, retry count is updated from tx completion status.
which is not working as expected due to firmware limitation where
firmware can not provide per MSDU rate statistics from tx completion
status. Due to this tx retry count is always 0 in station dump.
Fix this issue by updating the retry packet count from per peer
statistics. This patch will not break on SDIO devices since, this retry
count is already updating from peer statistics for SDIO devices.
Douglas Anderson [Mon, 15 Jun 2020 17:28:59 +0000 (20:28 +0300)]
ath10k: Wait until copy complete is actually done before completing
On wcn3990 we have "per_ce_irq = true". That makes the
ath10k_ce_interrupt_summary() function always return 0xfff. The
ath10k_ce_per_engine_service_any() function will see this and think
that _all_ copy engines have an interrupt. Without checking, the
ath10k_ce_per_engine_service() assumes that if it's called that the
"copy complete" (cc) interrupt fired. This combination seems bad.
Let's add a check to make sure that the "copy complete" interrupt
actually fired in ath10k_ce_per_engine_service().
This might fix a hard-to-reproduce failure where it appears that the
copy complete handlers run before the copy is really complete.
Specifically a symptom was that we were seeing this on a Qualcomm
sc7180 board:
arm-smmu 15000000.iommu: Unhandled context fault:
fsr=0x402, iova=0x7fdd45780, fsynr=0x30003, cbfrsynra=0xc1, cb=10
Even on platforms that don't have wcn3990 this still seems like it
would be a sane thing to do. Specifically the current IRQ handler
comments indicate that there might be other misc interrupt sources
firing that need to be cleared. If one of those sources was the one
that caused the IRQ handler to be called it would also be important to
double-check that the interrupt we cared about actually fired.
Kalle Valo [Mon, 15 Jun 2020 17:23:23 +0000 (20:23 +0300)]
Merge tag 'iwlwifi-next-for-kalle-2020-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
First set of patches intended for v5.9
* Fix links to wiki;
* Some preparations for gcc-10;
* Make FW reconfiguration quieter by not using warn level;
* Some other small fixes and clean-up;
# gpg: Signature made Thu 11 Jun 2020 12:03:51 PM EEST using RSA key ID 1A3CC5FA
# gpg: Good signature from "Luciano Roth Coelho (Luca) <luca@coelho.fi>"
# gpg: aka "Luciano Roth Coelho (Intel) <luciano.coelho@intel.com>"
Currently need ptk/gtk wmi peer flags in wmi peer assoc cmd
are set based on the rsnie and wpaie of the bss from the bss list.
Since this bss list is not updated with current BSSID for AP mode,
we may not find bss from the bss list. Which results in ptk/gtk peer
flags are not set in the wmi peer assoc cmd. Due to this EAPOL frames
are going in data rates instead of management rates.
Sriram R [Thu, 11 Jun 2020 05:09:54 +0000 (08:09 +0300)]
ath11k: Add dp tx err stats
Add support for dp tx error stats which logs tx failure reasons due
to ring full condition, etc. This stats is added in soc_dp_stats
which was earlier used as soc_rx_stats so that all dp related info
are logged in same file.
spectral scan control interface is exposed through debugfs eentry.
Relayfs is used to collect the spectral data. These interfaces are
similar to ath10k spectral.
Add direct buffer ring (dbring) with helper API, which is used by the
spectral scan. Initialise the direct buffer ring based on the dma ring
capability, which get announced in the wmi service ready extended event.
This ring is slightly changed from data path rings. Compare to data path
ring this ring shares the hp and tp address to firmware though WMI commands.
Also the replenish buffer size is derived from firmware announcement.
driver receive indication through WMI event
WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID.
projects / mirror_ubuntu-hirsute-kernel.git / log