Permalink
Commits on Dec 17, 2021
-
ath11k: add support of firmware logging for WCN6855
Host enables WMI firmware logging feature via QMI message. Host receives firmware logging messages on WMI_DIAG_EVENTID, then sends logging messages to user space via event tracing infrastructure. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by: Cheng Wang <quic_chengwan@quicinc.com>
Commits on Dec 16, 2021
-
wcn36xx: Implement beacon filtering
The prima driver facilitates the direct programming of beacon filter tables via SMD commands. The purpose of beacon filters is quote: /* When beacon filtering is enabled, firmware will * analyze the selected beacons received during BMPS, * and monitor any changes in the IEs as listed below. * The format of the table is: * - EID * - Check for IE presence * - Byte offset * - Byte value * - Bit Mask * - Byte reference */ The default filter table looks something like this: tBeaconFilterIe gaBcnFilterTable[12] = { { WLAN_EID_DS_PARAMS, 0u, { 0u, 0u, 0u, 0u } }, { WLAN_EID_ERP_INFO, 0u, { 0u, 0u, 248u, 0u } }, { WLAN_EID_EDCA_PARAM_SET, 0u, { 0u, 0u, 240u, 0u } }, { WLAN_EID_QOS_CAPA, 0u, { 0u, 0u, 240u, 0u } }, { WLAN_EID_CHANNEL_SWITCH, 1u, { 0u, 0u, 0u, 0u } }, { WLAN_EID_QUIET, 1u, { 0u, 0u, 0u, 0u } }, { WLAN_EID_HT_OPERATION, 0u, { 0u, 0u, 0u, 0u } }, { WLAN_EID_HT_OPERATION, 0u, { 1u, 0u, 248u, 0u } }, { WLAN_EID_HT_OPERATION, 0u, { 2u, 0u, 235u, 0u } }, { WLAN_EID_HT_OPERATION, 0u, { 5u, 0u, 253u, 0u } }, { WLAN_EID_PWR_CONSTRAINT, 0u, { 0u, 0u, 0u, 0u } }, { WLAN_EID_OPMODE_NOTIF, 0u, { 0u, 0u, 0u, 0u } } }; Add in an equivalent filter set as present in the prima Linux driver. For now omit the beacon filter "rem" command as the driver does not have an explicit call to that SMD command. The filter mask should only count when we are inside BMPS anyway. Replicating the ability to program the filter table gives us scope to add and remove elements in future. For now though this patch makes the rote-copy of the downstream Linux beacon filter table, which we can tweak as desired from now on. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211214134630.2214840-4-bryan.odonoghue@linaro.org -
wcn36xx: Fix physical location of beacon filter comment
The comment in the header with respect to beacon filtering makes a reference to "the structure above" and "the structure below" which would be informative if the comment appeared in the right place but, it does not. Fix the comment location so that it a least makes sense w/r/t the physical location statements. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211214134630.2214840-3-bryan.odonoghue@linaro.org
-
wcn36xx: Fix beacon filter structure definitions
The beacon filter structures need to be packed. Right now its fine because we don't yet use these structures so just pack them without marking it for backporting. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@linaro.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211214134630.2214840-2-bryan.odonoghue@linaro.org
Commits on Dec 14, 2021
-
ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()
In ath11k_mac_op_hw_scan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of arg.extraie.ptr. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_ATH11K=m show no new warnings, and our static analyzer no longer warns about this code. Fixes: d5c6515 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Zhou Qingyang <zhou1615@umn.edu> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211202155348.71315-1-zhou1615@umn.edu
Commits on Dec 13, 2021
Commits on Dec 9, 2021
-
ath6kl: Use struct_group() to avoid size-mismatched casting
In builds with -Warray-bounds, casts from smaller objects to larger objects will produce warnings. These can be overly conservative, but since -Warray-bounds has been finding legitimate bugs, it is desirable to turn it on globally. Instead of casting a u32 to a larger object, redefine the u32 portion of the header to a separate struct that can be used for both u32 operations and the distinct header fields. Silences this warning: drivers/net/wireless/ath/ath6kl/htc_mbox.c: In function 'htc_wait_for_ctrl_msg': drivers/net/wireless/ath/ath6kl/htc_mbox.c:2275:20: error: array subscript 'struct htc_frame_hdr[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Werror=array-bounds] 2275 | if (htc_hdr->eid != ENDPOINT_0) | ^~ drivers/net/wireless/ath/ath6kl/htc_mbox.c:2264:13: note: while referencing 'look_ahead' 2264 | u32 look_ahead; | ^~~~~~~~~~ This change results in no executable instruction differences. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211207063538.2767954-1-keescook@chromium.org -
ath11k: Fix buffer overflow when scanning with extraie
If cfg80211 is providing extraie's for a scanning process then ath11k will copy that over to the firmware. The extraie.len is a 32 bit value in struct element_info and describes the amount of bytes for the vendor information elements. The WMI_TLV packet is having a special WMI_TAG_ARRAY_BYTE section. This section can have a (payload) length up to 65535 bytes because the WMI_TLV_LEN can store up to 16 bits. The code was missing such a check and could have created a scan request which cannot be parsed correctly by the firmware. But the bigger problem was the allocation of the buffer. It has to align the TLV sections by 4 bytes. But the code was using an u8 to store the newly calculated length of this section (with alignment). And the new calculated length was then used to allocate the skbuff. But the actual code to copy in the data is using the extraie.len and not the calculated "aligned" length. The length of extraie with IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS enabled was 264 bytes during tests with a QCA Milan card. But it only allocated 8 bytes (264 bytes % 256) for it. As consequence, the code to memcpy the extraie into the skb was then just overwriting data after skb->end. Things like shinfo were therefore corrupted. This could usually be seen by a crash in skb_zcopy_clear which tried to call a ubuf_info callback (using a bogus address). Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-02892.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Cc: stable@vger.kernel.org Fixes: d5c6515 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20211207142913.1734635-1-sven@narfation.org
Commits on Dec 8, 2021
-
While running stress tests in roaming scenarios (switching ap's every 5 seconds, we discovered a issue which leads to tx hangings of exactly 5 seconds while or after scanning for new accesspoints. We found out that this hanging is triggered by ath10k_mac_wait_tx_complete since the empty_tx_wq was not wake when the num_tx_pending counter reaches zero. To fix this, we simply move the wake_up call to htt_tx_dec_pending, since this call was missed on several locations within the ath10k code. Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20210505085806.11474-1-s.gottschall@dd-wrt.com
-
carl9170: Use the bitmap API when applicable
Use 'bitmap_zalloc()' to simplify code, improve the semantic and avoid some open-coded arithmetic in allocator arguments. Note, that this 'bitmap_zalloc()' divides by BITS_PER_LONG the amount of memory allocated. The 'roundup()' used to computed the number of needed long should have been a DIV_ROUND_UP. Also change the corresponding 'kfree()' into 'bitmap_free()' to keep consistency. Use 'bitmap_zero()' to avoid hand writing it. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Acked-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/1fe18fb73f71d855043c40c83865ad539f326478.1638396221.git.christophe.jaillet@wanadoo.fr
