Commit Graph

31046 Commits

Author SHA1 Message Date
David S. Miller
a655fe9f19 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
An ipvlan bug fix in 'net' conflicted with the abstraction away
of the IPV6 specific support in 'net-next'.

Similarly, a bug fix for mlx5 in 'net' conflicted with the flow
action conversion in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-08 15:00:17 -08:00
Colin Ian King
34025a1056 rsi: fix indentation issue with a code block
There is a block of code that is indented at the wrong level. Fix this
with extra tabbing.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:31:23 +02:00
Sergey Matyukevich
47b08e75a6 qtnfmac: enable WPA3 SAE support
In the case of SAE AP, drivers offload authentication to user-space
software, e.g. hostapd. For FullMAC drivers the procedure is as follows.
If auth_type is SAE and user space indicates external authentication
capability, then driver requests authentication offload to user-space
software using cfg80211_external_auth_request call. From that point,
auth frame exchange is performed transparently for driver: user-space
software sends/receives mgmt frames using mgmt_tx/mgmt_frame_register
cfg80211 callbacks. As soon as authenitcation is completed, user-space
software notifies driver about its status using external_auth cfg80211
callback.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:30:24 +02:00
Sergey Matyukevich
524d6323af qtnfmac: enable WPA3 OWE support
In the case of OWE, STA should be able to pass DH IEs from AP assoc
responses to wpa_s for processing. For this purpose DH IEs are
received from firmware in BSS_JOIN events and passed to wireless
core and then to wpa_s as additional optional rsp_ies parameter
for cfg80211_connect_result.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:30:23 +02:00
Siva Rebbagondla
38ef8d9016 rsi: fix for wowlan wakeup failure
During wowlan regression tests, sometimes radio is not waking up for wowlan
packet in coex mode. This is because of power save is enabled by default
in case of coex mode greater than one. Hence, disable power save in coex
mode to avoid radio loss.

Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:29:42 +02:00
Siva Rebbagondla
73f9b25714 rsi: resolve power save issue after S4 resume
We are redownloading the firmware after S4 restore and observed in
stress test that mac80211 sometimes gives power save request after
resume which causes the firmware in bad state. mac_ops_resumed flag
is added to skip that request until initialisation is done and Keeping
power save state is NONE.

Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:29:40 +02:00
Siva Rebbagondla
a63762d0dc rsi: fix wowlan wakeup issue for hibernate(S4)
At SDIO restore ieee80211_restart_hw() is getting called to restart all
MAC operations. This step is not required.
Returning 1 from mac80211_resume() will serve this purpose.

Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:29:39 +02:00
Siva Rebbagondla
cbde979b33 rsi: add hci detach for hibernation and poweroff
As we missed to detach HCI, while entering power off or hibernation,
an extra hci interface gets created whenever system is woken up, to
avoid this we added hci_detach() in rsi_disconnect(), rsi_freeze(),
and rsi_shutdown() functions which are invoked for these tests.
This patch fixes the issue

Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:29:35 +02:00
Siva Rebbagondla
6f3a5de16d rsi: Add debug support for wowlan wakeup confirmation
When a wowlan magic-packet has received to wake up the device, currently
driver is not taking care of what kind of packet has received. This patch
will add debug support for wakeup reason in driver.

Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:29:34 +02:00
YueHaibing
78f2ef18e1 rtlwifi: remove set but not used variable 'cmd_seq'
Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/wireless/realtek/rtlwifi/base.c: In function 'rtl_c2h_content_parsing':
drivers/net/wireless/realtek/rtlwifi/base.c:2313:13: warning:
 variable 'cmd_seq' set but not used [-Wunused-but-set-variable]

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:28:39 +02:00
Stefan Agner
5208fea64e mwifiex: don't print error message on coex event
The BT coex event is not an error condition. Don't print an error
message in this case. The same even in sta_event.c prints a
message using the debug level already.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:28:06 +02:00
Rafał Miłecki
e665988be2 brcmfmac: support monitor frames with the hardware/ucode header
So far there were two monitor frame formats:
1) 802.11 frames (with frame (sub)type & all addresses)
2) 802.11 frames with the radiotap header

Testing the latest FullMAC firmwares for 4366b1/4366c0 resulted in
discovering a new format being used. It seems (almost?) identical to the
one known from ucode used in SoftMAC devices which is most likely the
same codebase anyway.

While new firmwares will /announce/ radiotap header support using the
"rtap" fw capability string it seems no string was added for the new
ucode header format.

All above means that:
1) We need new format support when dealing with a received frame
2) A new feature bit & mapping quirks have to be added manually

As for now only an empty radiotap is being created. Adding support for
extracting some info (band, channel, signal, etc.) is planned for the
future.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:27:26 +02:00
Matteo Croce
2359dd09f9 brcmfmac: fix typos
Fix spelling mistakes in brcmfmac: "lenght" -> "length".
The typos are also in the special comment blocks which
translates to documentation.

Signed-off-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:26:38 +02:00
Rafał Miłecki
3ef005b82e brcmfmac: add bphy_err() and use it in the cfg80211.c
This new macro uses wiphy_err() which:
1) Should be the best choice with wiphy already created
2) Uses dev_err() which allows identifying error-affected device

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:23:57 +02:00
Rafał Miłecki
8602e62441 brcmfmac: pass bus to the __brcmf_err() in pcie.c
This enables dev_err() usage (instead of pr_err()) in the __brcmf_err().
It makes error messages more meaningful and is important for debugging
errors/bugs on systems with multiple brcmfmac supported devices.

All bus files should follow & get updated similarly (soon).

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:22:48 +02:00
Rafał Miłecki
5cc898fbcb brcmfmac: modify __brcmf_err() to take bus as a parameter
So far __brcmf_err() was using pr_err() which didn't allow identifying
device that was affected by an error. It's crucial for systems with more
than 1 device supported by brcmfmac (a common case for home routers).

This change allows passing struct brcmf_bus to the __brcmf_err(). That
struct has been agreed to be the most common one. It allows accessing
struct device easily & using dev_err() printing helper.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-08 17:22:47 +02:00
Jouni Malinen
040bda85b5 mac80211_hwsim: Declare support for Multi-BSSID
This can be used to test cfg80211 support for Multi-BSSID scan result
parsing.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2019-02-08 13:58:05 +01:00
Kalle Valo
6ecde4936b Merge git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
The series "[PATCH 0/2] mt76x0: initialize per-channel max_power" depends on
commit d04ca38386 ("mt76x0u: fix suspend/resume"), so merge wireless-drivers
into wireless-drivers-next to get that.
2019-02-08 14:14:35 +02:00
Kalle Valo
287d08a23c Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
ath.git patches for 5.1. Major changes:

ath10k

* change QMI interface to support the new (and backwards incompatible)
  interface from HL3.1 and used in recent HL2.0 branch firmware releases

ath

* add new country codes for US
2019-02-08 14:10:35 +02:00
Stanislaw Gruszka
d04ca38386 mt76x0u: fix suspend/resume
We need to reset MCU and do other initializations on resume otherwise
MT7610U device will fail to initialize, what cause system hung due to
USB requests timeouts.

Patch fixes 4.19 -> 4.20 regression.

Cc: stable@vger.kernel.org # 4.20+
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 18:32:16 +02:00
Oever Gonzalez
62a2c1355c ath: regd: add extra US coutry codes
This patch adds several country codes to the regd.h and regd_common.h
files in order to support devices like the Linksys EA6350v3, whose
country codes are not present in the original list. Without this patch,
all devices whose manufacturer programmed any of these code in their
EEPROM will not work.

The values for CTRY_UNITED_STATES2 and CTRY_UNITED_STATES3 were taken
from a post by Sven Eckelmann <sven.eckelmann@openmesh.com>:
<http://lists.infradead.org/pipermail/ath10k/2017-August/010014.html>

Signed-off-by: Oever Gonzalez <notengobattery@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 17:02:19 +02:00
Zhiwei Jiang
b789f333d7 ath: move spin_lock_bh to spin_lock in tasklet
as you are already in a tasklet, it is unnecessary to call
spin_lock_bh, because softirq already disable BH.

Signed-off-by: Zhiwei Jiang <qq282012236@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 17:01:24 +02:00
Greg Kroah-Hartman
cd98625b3e ath9k: do not return invalid pointers as a *dentry
When calling debugfs functions, they can now return error values if
something went wrong.  If that happens, return a NULL as a *dentry to
the relay core instead of passing it an illegal pointer.

The relay core should be able to handle an illegal pointer, but add this
check to be safe.

Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: QCA ath9k Development <ath9k-devel@qca.qualcomm.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:59:04 +02:00
Surabhi Vishnoi
056550291d ath10k: fill tx_duration for each peer in Tx stats per STA
Firmware sends the tx_duration for each in HTT_T2H_MSG_TYPE_PEER_STATS
msg. Fill the tx_duration sent by firmware in the tx stats information
per STA.

Tested HW: WCN3990
Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1,
           WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1

Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:58:16 +02:00
Surabhi Vishnoi
ff488d0ef1 ath10k: add a condition to fill the LDPC capability correctly
The firmware advertises the LDPC support information for HT in
HT capability info in the wmi service ready event. To provide
granularity, firmware now advertises WMI_HT_CAP_RX_LDPC and
WMI_HT_CAP_TX_LDPC separately. To support LDPC, host should
also check for WMI_HT_CAP_RX_LDPC and WMI_HT_CAP_TX_LDPC in HT
capabilities.

Add a condition to existing logic in host to know whether firmware
supports LDPC or not.

Tested HW: WCN3990
Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1,
           WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1

Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:57:06 +02:00
Alagu Sankar
a73dbce3a6 ath10k: reduce transmit msdu count
Reduce the transmit MSDU count for SDIO, to match with the descriptors
as used by the firmware. This also acts as a high watermark level for
transmit. Too many packets to the firmware results in transmit overflow
interrupt.

It only affect SDIO chip, it will not cause functionaly changes to
other hardware.

Tested with QCA6174 SDIO with firmware
WLAN.RMH.4.4.1-00005-QCARMSWP-1.

Signed-off-by: Alagu Sankar <alagusankar@silex-india.com>
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:56:09 +02:00
Greg Kroah-Hartman
0b38b4b445 ath10k: do not return invalid pointers as a *dentry
When calling debugfs functions, they can now return error values if
something went wrong.  If that happens, return a NULL as a *dentry to
the relay core instead of passing it an illegal pointer.

The relay core should be able to handle an illegal pointer, but add this
check to be safe.

Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: ath10k@lists.infradead.org
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:55:12 +02:00
YueHaibing
f9a4b7f45f ath10k: snoc: remove set but not used variable 'ar_snoc'
Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/wireless/ath/ath10k/snoc.c: In function 'ath10k_snoc_tx_pipe_cleanup':
drivers/net/wireless/ath/ath10k/snoc.c:681:22: warning:
 variable 'ar_snoc' set but not used [-Wunused-but-set-variable]

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:54:21 +02:00
Brian Norris
ea69598408 ath10k: sdio: add .owner field
sdio_register_driver() doesn't do this for us, unlike (for example)
platform_driver_register(). This is important for helping track
module-to-device relationships.

Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:53:01 +02:00
Wen Gong
40194e3b36 ath10k: change swap mail box check after htc ready
The swap box flag of firmware is not set before htc ready, then it
will not set swap box flag in ath10k driver, and it will let swap
box setting not same between firmware and ath10k driver, then it
will trigger firmware assert failure.

Check the flag and set swap box after htc ready will fix the firmware
assert failure.

Tested with QCA6174 SDIO with firmware
WLAN.RMH.4.4.1-00005-QCARMSWP-1.

Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:51:58 +02:00
Rakesh Pillai
cdb78e5af4 ath10k: fix hw-restart crash inject mode for WCN3990
The hw-restart crash inject mode is a special mode, where
there is no crash generated in the firmware, but instead
the driver restarts the firmware. In order to restart WCN3990
firmware, the driver needs to send qmi_wlan_disable message
followed by the qmi_wlan_enable message to the WCN3990 firmware.

Currently the qmi_wlan_disable message is not sent to
the WCN3990 firmware when hw-restart crash is injected,
which causes the firmware to crash when the driver sends
qmi_wlan_enable message during ath10k_restart.

Send qmi_wlan_disable to the WCN3990 firmware when the
hw-restart crash is injected via debugfs.

Tested HW: WCN3990
Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1

Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:51:13 +02:00
Rakesh Pillai
6e8a8991e2 ath10k: fix dma unmap direction for management frames
The management frames transmitted are dma mapped with
direction TO_DEVICE, but incorrectly mapped with
direction FROM_DEVICE during tx complete and error cases.

Fix the direction of dma during dma unmap of the
transmitted management frames.

Tested HW: WCN3990
Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1

Fixes: 38a1390e02 ("ath10k: dma unmap mgmt tx buffer if wmi cmd send fails")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:44:03 +02:00
Rakesh Pillai
5432713344 ath10k: Enable bundle tx compl for management frames in WCN3990
WCN3990 sends tx completion of multiple management
frames bundled together in a single event, if the
host driver exposes the support to handle this
bundled tx completion event. This reduces the number
of WMI events which are sent to the host driver by
the target.

Set the BUNDLE_TX_COMPL flag in the host capability
flags when host sends the wmi init command, to indicate
the host capability to handle bundled tx completion for
management frames.

Tested HW: WCN3990
Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1

Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:36:59 +02:00
Rakesh Pillai
cc123fac97 ath10k: Handle bundled tx completion for management frames
WCN3990 supports sending tx completion for multiple
management frames bundled together in a single event.

Add support to handle the bundled tx completion
event for WCN3990.

Tested HW: WCN3990
Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1

Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:36:50 +02:00
Govind Singh
768ec4c012 ath10k: update HOST capability qmi message
HOST capability interface data structures are updated
in HL3.1 fw version. Update the qmi host capability
members for compatibility across different firmware
versions.
Since this change breaks backward compatibility with
HL2.0 fw, HL2.0 fw upgrade to WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1
or later version is required.

Testing:
        Tested on QCS404 platform(WCN3990 HW).
        Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1,
                   WLAN.HL.2.0-01617-QCAHLSWMTPLZ-1

Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-07 16:27:20 +02:00
Kalle Valo
3479f74ee4 Merge tag 'iwlwifi-next-for-kalle-2019-02-04' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
Third batch of iwlwifi patches intended for v5.1

* Work on the new debugging infrastructure continues;
* HE radiotap;
* Support for new FW version 44;
* A couple of new FW API changes;
* A bunch of fixes for static analyzer reported issues;
* General bugfixes;
* Other cleanups and small fixes;
2019-02-07 11:34:26 +02:00
David S. Miller
5661f29ade Merge tag 'wireless-drivers-next-for-davem-2019-02-06' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next
Kalle Valo says:

====================
wireless-drivers-next patches for 5.1

First set of patches for 5.1. Lots of new features in various drivers
but nothing really special standing out.

Major changes:

brcmfmac

* DMI nvram filename quirk for PoV TAB-P1006W-232 tablet

rsi

* support for hardware scan offload

iwlwifi

* support for Target Wakeup Time (TWT) -- a feature that allows the AP
  to specify when individual stations can access the medium

* support for mac80211 AMSDU handling

* some new PCI IDs

* relicense the pcie submodule to dual GPL/BSD

* reworked the TOF/CSI (channel estimation matrix) implementation

* Some product name updates in the human-readable strings

mt76

* energy detect regulatory compliance fixes

* preparation for MT7603 support

* channel switch announcement support

mwifiex

* support for sd8977 chipset

qtnfmac

* support for 4addr mode

* convert to SPDX license identifiers
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-06 09:36:36 -08:00
Jouni Malinen
341203e789 mac80211_hwsim: Support boottime in scan results
This makes the age information for cfg80211 scan results more accurate
and fixes issues with wpa_supplicant dropping "old" scan results (e.g.,
"wlan0: Own scan request started a scan in 0.000456 seconds") that
looked like would have been received before a scan started due to the
inaccuracy of the default timing mechanism for calculating the BSS entry
age. This makes hwsim test cases significantly more robust to run.

Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2019-02-05 22:36:55 +01:00
David S. Miller
3e5a7c9814 Merge tag 'wireless-drivers-for-davem-2019-02-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
Kalle Valo says:

====================
wireless-drivers fixes for 5.0

First set of small, but importnat, fixes for 5.0.

iwlwifi

* fix a build regression introduced in 5.0-rc1

wlcore

* fix a firmware regression from v4.18-rc1

mt76x0

* fix for configuring tx power from user space

ath10k

* fix wcn3990 regression from v4.20-rc1
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-04 09:12:06 -08:00
Kees Cook
4b6e9f3fe1 ath9k: eeprom: Use scnprintf instead of snprintf
Change snprintf to scnprintf. There are generally two cases where using
snprintf causes problems.

1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)  In this case,
if snprintf would have written more characters than what the buffer
size (SIZE) is, then size will end up larger than SIZE. In later uses
of snprintf, SIZE - size will result in a negative number, leading to
problems. Note that size might already be too large by using size =
snprintf before the code reaches a case of size += snprintf.

2) If size is ultimately used as a length parameter for a copy back to
user space, then it will potentially allow for a buffer overflow and
information disclosure when size is greater than SIZE. When the size is
used to index the buffer directly, we can have memory corruption. This
also means when size = snprintf... is used, it may also cause problems
since size may become large. Copying to userspace is mitigated by the
HARDENED_USERCOPY kernel configuration.

The solution to these issues is to use scnprintf which returns the number
of characters actually written to the buffer, so the size variable will
never exceed SIZE.

Cc: Willy Tarreau <w@1wt.eu>
Cc: Silvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-04 17:52:49 +02:00
Govind Singh
5cbb117477 ath10k: Add support for extended HTT aggr msg support
HTT aggr message parameter in HL2.0 fw are different in comparison
to legacy fw version. Fill correct HTT aggr msg parameter for
targets using HL2.0 firmware.

Signed-off-by: Govind Singh <govinds@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-04 17:51:39 +02:00
Yu Wang
1a86be476c ath10k: fix S5 power consumption issue for QCA9377
After system entering S5 (shut down but system still
providing power to QCA9377) on Ubuntu platform, power
consumption of QCA9377 is 69mA, which is too high.
The root cause is pci_soft_reset is not set for QCA9377
during pci probe.
To fix this issue, set 'pci_soft_reset' to 'th10k_pci_warm_reset',
and then the power consumption drops to a normal value(10mA).
Verified on Dell Ubuntu platform with firmware:
WLAN.TF.1.0-00002-QCATFSWPZ-5

Signed-off-by: Yu Wang <yyuwang@codeaurora.org>
Signed-off-by: Yu Wang <yyuwang@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-04 17:50:28 +02:00
Rakesh Pillai
5b9030cee1 ath10k: Set DMA address mask to 35 bit for WCN3990
WCN3990 is a 37-bit target but can address memory range
only upto 35 bits. The 36th bit is used to control the
smmu/iommu translation and the 37th bit is used by the
internal bus masters to access the wifi subsystem internal
SRAM. With the DMA mask set to 37i-bit, the host driver
can get 37-bit dma address, which leads to incorrect
address access in the target.

Hence the host driver can used addresses upto 35-bit
for WCN3990. Fix the dma mask for wcn3990 to 35-bit,
instead of 37-bit.

Tested HW: WCN3990
Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1

Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-02-04 17:49:11 +02:00
Johannes Berg
b998fbbd53 iwlwifi: implement BISR HW workaround for 22260 devices
There's a small hardware bug in 22260 devices which thus require a
few more delays during initialization. Implement this workaround.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:10 +02:00
Johannes Berg
dbf592f3d1 iwlwifi: mvm: fix RFH config command with >=10 CPUs
If we have >=10 (logical) CPUs, our command size exceeds the
internal buffer size and the command fails; fix that by using
IWL_HCMD_DFL_NOCOPY for the command that's allocated anyway.

While at it, also fix the leak of cmd, and use struct_size()
to calculate its size.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: 8edbfaa198 ("iwlwifi: mvm: configure multi RX queue")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:10 +02:00
Johannes Berg
c96b5eec21 iwlwifi: refactor NIC init sequence
The typical sequence of setting INIT_DONE and then waiting
for clock stabilisation is going to need a new workarounds,
so first of all refactor it.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:09 +02:00
Shahar S Matityahu
b8a7547d77 iwlwifi: fix send hcmd timeout recovery flow
Both iwl_trans_fw_error and iwl_force_nmi initiate async recovery flow.
Calling them both is redundant and causing a race.

Solve this by removing the call to iwl_trans_fw_error.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Fixes: cfadc3ffcc ("iwlwifi: pcie: stop the firmware when we restart it")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:08 +02:00
Shahar S Matityahu
505a00c071 iwlwifi: dbg_ini: implement paging memory dump
Implement paging memory dump in the new dump mechanism.
To support this change, moved iwl_self_init_dram strcut from trans_pcie
to trans so that it will accessible via fw_runtime.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:08 +02:00
Shahar S Matityahu
6e9f8f9924 iwlwifi: dbg_ini: implement device internal memory dump
Implement device internal memory dump in the new dump mechanism.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:08 +02:00
Shahar S Matityahu
f4f907aa73 iwlwifi: dbg_ini: implement csr memory dump
Implement csr memory dump in the new dump mechanism.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2019-02-04 12:28:08 +02:00