Kalle Valo [Thu, 24 Jun 2021 05:29:18 +0000 (08:29 +0300)]
iwlwifi: acpi: remove unused function iwl_acpi_eval_dsm_func()
Stephen reported a warning:
drivers/net/wireless/intel/iwlwifi/fw/acpi.c:720:12: warning: 'iwl_acpi_eval_dsm_func' defined but not used [-Wunused-function]
The warning is correct and the function is not used anywhere, so let's
just remove it.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Fixes: 7119f02b5d34 ("iwlwifi: mvm: support BIOS enable/disable for 11ax in Russia") Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Acked-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20210624052918.4946-1-kvalo@codeaurora.org
Po-Hao Huang [Thu, 24 Jun 2021 02:34:59 +0000 (10:34 +0800)]
rtw88: fix c2h memory leak
Fix erroneous code that leads to unreferenced objects. During H2C
operations, some functions returned without freeing the memory that only
the function have access to. Release these objects when they're no longer
needed to avoid potentially memory leaks.
With any regulatory domain requests coming from either user space or
802.11 IE (Information Element), the country is coded in ISO3166
standard. It needs to be translated to firmware country code and
revision with the mapping info in settings->country_codes table.
Support populate country_codes table by parsing the mapping from DT.
The BRCMF_BUSTYPE_SDIO bus_type check gets separated from general DT
validation, so that country code can be handled as general part rather
than SDIO bus specific one.
Kalle Valo [Wed, 23 Jun 2021 17:48:56 +0000 (20:48 +0300)]
Merge tag 'iwlwifi-next-for-kalle-2021-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
iwlwifi patches for v5.14
* Some robustness improvements in the PCI code;
* Remove some duplicate and unused declarations;
* Improve PNVM load robustness by increasing the timeout a bit;
* Support for a new HW;
* Suport for BIOS control of 11ax enablement in Russia;
* Support UNII4 enablement from BIOS;
* Support LMR feedback;
* Fix in TWT;
* Some fixes in IML (image loader) DMA handling;
* Fixes in WoWLAN;
* Updates in the WoWLAN FW commands;
* Add one new device to the PCI ID lists;
* Support reading PNVM from a UEFI variable;
* Bump the supported FW API version;
* Some other small fixes, clean-ups and improvements.
# gpg: Signature made Tue 22 Jun 2021 05:19:19 PM EEST
# gpg: using RSA key 1772CD7E06F604F5A6EBCB26A1479CA21A3CC5FA
# gpg: Good signature from "Luciano Roth Coelho (Luca) <luca@coelho.fi>" [full]
# gpg: aka "Luciano Roth Coelho (Intel) <luciano.coelho@intel.com>" [full]
Dmitry Osipenko [Tue, 11 May 2021 21:15:49 +0000 (00:15 +0300)]
brcmfmac: Silence error messages about unsupported firmware features
KMSG is flooded with error messages about unsupported firmware
features of BCM4329 chip. The GET_ASSOCLIST error became especially
noisy with a newer NetworkManager version of Ubuntu 21.04. Turn the
noisy error messages into info messages and print them out only once.
Kees Cook [Thu, 17 Jun 2021 17:10:58 +0000 (10:10 -0700)]
wcn36xx: Avoid memset() beyond end of struct field
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring array fields.
Instead of writing past the end of the header to reach the rest of
the body, replace the redundant function with existing macro to wipe
struct contents and set field values. Additionally adjusts macro to add
missing parens.
Kees Cook [Wed, 16 Jun 2021 19:54:10 +0000 (12:54 -0700)]
ath11k: Avoid memcpy() over-reading of he_cap
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring array fields.
Since peer_he_cap_{mac,phy}info and he_cap_elem.{mac,phy}_cap_info are not
the same sizes, memcpy() was reading beyond field boundaries. Instead,
correctly cap the copy length and pad out any difference in size
(peer_he_cap_macinfo is 8 bytes whereas mac_cap_info is 6, and
peer_he_cap_phyinfo is 12 bytes whereas phy_cap_info is 11).
Kees Cook [Thu, 17 Jun 2021 17:15:22 +0000 (10:15 -0700)]
mwifiex: Avoid memset() over-write of WEP key_material
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring array fields.
When preparing to call mwifiex_set_keyparamset_wep(), key_material is
treated very differently from its structure layout (which has only a
single struct mwifiex_ie_type_key_param_set). Instead, add a new type to
the union so memset() can correctly reason about the size of the
structure.
Note that the union ("params", 196 bytes) containing key_material was
not large enough to hold the target of this memset(): sizeof(struct
mwifiex_ie_type_key_param_set) == 60, NUM_WEP_KEYS = 4, so 240
bytes, or 44 bytes past the end of "params". The good news is that
it appears that the command buffer, as allocated, is 2048 bytes
(MWIFIEX_SIZE_OF_CMD_BUFFER), so no neighboring memory appears to be
getting clobbered.
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring array fields.
The size argument to memset() is bytes, but the array element size
of curvecount_val is u32, so "CV_CURVE_CNT * 2" was only 1/4th of the
contents of curvecount_val. Adjust memset() to wipe full buffer size.
Kees Cook [Thu, 17 Jun 2021 04:14:31 +0000 (21:14 -0700)]
mwl8k: Avoid memcpy() over-reading of mcs.rx_mask
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields. Use the
sub-structure address directly.
Kees Cook [Wed, 16 Jun 2021 20:39:51 +0000 (13:39 -0700)]
orinoco: Avoid field-overflowing memcpy()
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring array fields.
Validate the expected key size and introduce a wrapping structure
to use as the multi-field memcpy() destination so that overflows
can be correctly detected.
wengjianfeng [Thu, 20 May 2021 00:55:45 +0000 (08:55 +0800)]
rtw88: coex: remove unnecessary variable and label
In some funciton, the variable ret just used as return value,and
out label just return ret,so ret and out label are unnecessary,
we should delete these and use return true/false to replace.
Ping-Ke Shih [Mon, 7 Jun 2021 01:22:54 +0000 (09:22 +0800)]
rtw88: add quirks to disable pci capabilities
8821CE with ASPM cannot work properly on Protempo Ltd L116HTN6SPW. Add a
quirk to disable the cap.
The reporter describes the symptom is that this module (driver) causes
frequent freezes, randomly but usually within a few minutes of running
(thus very soon after boot): screen display remains frozen, no response
to either keyboard or mouse input. All I can do is to hold the power
button to power off, then reboot.
Zong-Zhe Yang [Fri, 28 May 2021 03:29:00 +0000 (11:29 +0800)]
rtw88: dump FW crash via devcoredump
Use device coredump framework instead of print_hex_dump to support
FW crash dump. Pass data to the framework if preparing and dumping
are successful. The framework will take the ownership of the data.
The data will be freed after the framework determines its lifetime
is over. A new coredump will not work if the previous one still
exists.
Chin-Yen Lee [Fri, 14 May 2021 07:55:17 +0000 (15:55 +0800)]
rtw88: notify fw when driver in scan-period to avoid potential problem
It is found that driver scan could be affected by dynamic mechanism
of firmware, so we notify firmware to stop it in the scan period.
Another, firmware will detect the background noise and report to
driver for further use.
Wan Jiabing [Fri, 30 Apr 2021 02:49:50 +0000 (10:49 +0800)]
rtw88: Remove duplicate include of coex.h
In commit fb8517f4fade4 ("rtw88: 8822c: add CFO tracking"),
"coex.h" was added here which caused the duplicate include.
Remove the later duplicate include.
Before this patch, we use value from 2 seconds ago to decide
whether we should do lc calibration.
Although this don't happen frequently, fix flow to the way it should be.
Fixes: 7ae7784ec2a8 ("rtw88: 8822c: add LC calibration for RTL8822C") Signed-off-by: Po-Hao Huang <phhuang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20210426013252.5665-3-pkshih@realtek.com
This feature chooses to transmit with antenna that has better signal
strength periodically under 1ss rate.
It can benefit connection quality in the following cases:
1. User is far away from the AP.
2. The far-field pattern of the antenna showed significant signal
strength difference.
Adding this supports beacon filter and CQM.
Let firmware perform connection quality monitor and beacon processing.
This make host CPU wakeup less under power save mode.
To make mechanisms work as usual, fw will notify driver events such as
signal change and beacon loss.
This feature needs firmware 9.9.8 or newer to support it, and driver is
compatible with older firmware.
Luca Coelho [Fri, 18 Jun 2021 08:01:20 +0000 (11:01 +0300)]
iwlwifi: fix NUM_IWL_UCODE_TLV_* definitions to avoid sparse errors
We were assigning these macros manually when sparse is running, but
with newer versions of sparse, it started causing other warnings. Fix
it by making it a macro when sparse is running.
Johannes Berg [Fri, 18 Jun 2021 08:01:19 +0000 (11:01 +0300)]
iwlwifi: pcie: free some DMA memory earlier
In gen3, after firmware is alive, we no longer need the
firmware and image loader images, only the context info
itself and PRPH info/scratch need to remain.
Call iwl_pcie_ctxt_info_gen3_free() appropriately in the
alive callback (iwl_trans_pcie_gen2_fw_alive()) with a new
argument indicating whether it can free everything or only
partially.
The context info and PRPH scratch are also not needed after
PNVM load, but we don't have a good hook for freeing after
that, so keep them for now.
Johannes Berg [Fri, 18 Jun 2021 08:01:17 +0000 (11:01 +0300)]
iwlwifi: pcie: fix context info freeing
After firmware alive, iwl_trans_pcie_gen2_fw_alive() is called
to free the context info. However, on gen3 that will then free
the context info with the wrong size.
Since we free this allocation later, let it stick around until
the device is stopped for now, freeing some of it earlier is a
separate change.
iwlwifi: mvm: support LONG_GROUP for WOWLAN_GET_STATUSES version
It's been a while that the firmware uses LONG_GROUP by default
and not LEGACY_GROUP.
Until now the firmware wrongly advertise the WOWLAN_GET_STATUS
command's version with LEGACY_GROUP, but it is now being fixed.
In order to support both firmwares, first try to get the version
number of the command with the LONG_GROUP and if the firmware
didn't advertise the command version with LONG_GROUP, try to get
the command version with LEGACY_GROUP.
iwlwifi: support ver 6 of WOWLAN_CONFIGURATION and ver 10 of WOWLAN_GET_STATUSES
These two version updates deprecate the need to set/get the nonqos sequence
counter during suspend/resume flow respectively; NICs supporting this
version maintain this counter internally and don't lose it during the
suspend/resume flow.
Note that this means that for such NICs the NON_QOS_TX_COUNTER_CMD is no
longer ever sent.
iwlwifi: mvm: don't request mac80211 to disable/enable sta's queues
When operating in AP mode with NICs supporting the AP_LINK_PS hw flag,
mac80211 doesn't need to start/stop queueing tx for connected stations
because the FW already handles that.
Ilan Peer [Fri, 18 Jun 2021 08:01:12 +0000 (11:01 +0300)]
iwlwifi: mvm: Explicitly stop session protection before unbinding
In case of unbinding, the FW would remove the session protection time
events without sending a notification, so explicitly cancel the
session protection, so future requests for mgd_prepare_tx() would not
assume that the session protection is running.
Johannes Berg [Thu, 17 Jun 2021 08:07:28 +0000 (11:07 +0300)]
iwlwifi: pcie: remove TR/CR tail allocations
The TR/CR tail data are meant to be per-queue-arrays, however,
we allocate them completely wrong (we have a separate allocation
per queue).
Looking at this more closely, it turns out that the hardware
never uses these - we have a separate free list per RX queue
and maintain a write pointer for that in a register, and the
RX itself is indicated in the RB status (rb_stts) DMA region.
Despite nothing using the tail pointers, the hardware will
unconditionally access them to write updates, even when we aren't
using CRs/TRs.
Give it dummy values that we never use/update so it can do that
without causing trouble.
Johannes Berg [Thu, 17 Jun 2021 07:08:47 +0000 (10:08 +0300)]
iwlwifi: correct HE capabilities
The (default) HE capabilities for our devices weren't handled
correctly, adjust them to match the correct capabilities of
the devices.
Since the device regulatory will not allow 160 MHz on 5 GHz,
don't advertise this capability by default; do it only if an
NVM file is being loaded that might change the regulatory
parameters.
Shaul Triebitz [Thu, 17 Jun 2021 07:08:45 +0000 (10:08 +0300)]
iwlwifi: mvm: fix error print when session protection ends
When the session protection ends and the Driver is not
associated or a beacon was not heard, the Driver
prints "No beacons heard...".
That's confusing for the case where not associated.
Change the print when not associated to "Not associated...".
Johannes Berg [Thu, 17 Jun 2021 07:08:44 +0000 (10:08 +0300)]
iwlwifi: mvm: honour firmware SMPS requests
The firmware can now request SMPS (due to thermal conditions), add
some code to honour such requests and bubble them up through the
stack, subject to our other SMPS constraints, e.g. from Bluetooth.
Then, if the firmware requests SMPS, then we know that it supports
a small extension to the PHY configuration API where a chain mask
of 0 means "use 1 but pick which one yourself", so in this case we
use that extension.
During firmware restart, we stay in the previous state, and the FW
will send us a notification at startup (only) if the temperature is
below the lower or above the high threshold, to sync the state.
Johannes Berg [Thu, 17 Jun 2021 07:08:43 +0000 (10:08 +0300)]
iwlwifi: mvm: apply RX diversity per PHY context
SMPS requests may differ per interfaces due to e.g. Bluetooth
only interfering on 2.4 GHz, so if that's the case we should,
in the case of multiple PHY contexts, still allow RX diversity
on PHY context that have no interfaces with SMPS requests.
Fix the code to pass through the PHY context in question and
skip interfaces with non-matching PHY context while iterating.
Johannes Berg [Sat, 12 Jun 2021 11:32:42 +0000 (14:32 +0300)]
iwlwifi: pcie: print interrupt number, not index
Printing the interrupt index in our local array isn't very
useful in an error message, print the interrupt number (as
also shown in e.g. /proc/interrupts) instead.
Johannes Berg [Sat, 12 Jun 2021 11:32:38 +0000 (14:32 +0300)]
iwlwifi: mvm: don't change band on bound PHY contexts
When we have a P2P Device active, we attempt to only change the
PHY context it uses when we get a new remain-on-channel, if the
P2P Device is the only user of the PHY context.
This is fine if we're switching within a band, but if we're
switching bands then the switch implies a removal and re-add
of the PHY context, which isn't permitted by the firmware while
it's bound to an interface.
Fix the code to skip the unbind/release/... cycle only if the
band doesn't change (or we have old devices that can switch the
band on the fly as well.)
Miri Korenblit [Sat, 12 Jun 2021 11:32:34 +0000 (14:32 +0300)]
iwlwifi: mvm: support BIOS enable/disable for 11ax in Russia
Read the new BIOS DSM and Pass to FW if to disable\enable
11ax for Russia according to the BIOS key. This is
needed to enable OEMs to control enable/disable 11ax in Russia.
Also add support for future "enable 11ax in country X" features.
Caleb Connolly [Thu, 17 Jun 2021 08:29:40 +0000 (11:29 +0300)]
ath10k: demote chan info without scan request warning
Some devices/firmwares cause this to be printed every 5-15 seconds,
though it has no impact on functionality. Demote this to a debug
message.
I see this on SDM845 and MSM8998 platforms, specifically the OnePlus 6 devices,
PocoPhone F1 and OnePlus 5. On the OnePlus 6 (SDM845) we are stuck with the
following signed vendor fw:
Íñigo Huguet [Tue, 11 May 2021 07:19:27 +0000 (09:19 +0200)]
rtl8xxxu: avoid parsing short RX packet
One USB data buffer can contain multiple received network
packets. If that's the case, they're processed this way:
1. Original buffer is cloned
2. Original buffer is trimmed to contain only the first
network packet
3. This first network packet is passed to network stack
4. Cloned buffer is trimmed to eliminate the first network
packet
5. Repeat with the cloned buffer until there are no more
network packets inside
However, if the space remaining in original buffer after
the first network packet is not enough to contain at least
another network packet descriptor, it is not cloned.
The loop parsing this packets ended if remaining space == 0.
But if the remaining space was > 0 but < packet descriptor
size, another iteration of the loop was done, processing again
the previous packet because cloning didn't happen. Moreover,
the ownership of this packet had been passed to network
stack in the previous iteration.
This patch ensures that no extra iteration is done if the
remaining size is not enough for one packet, and also avoid
the first iteration for the same reason.
Probably this doesn't happen in practice, but can happen
theoretically.
Based on 2001:3319 and 2357:0109 which I used to test the fix and
0bda:818b and 2357:0108 for which I found efuse dumps online.
== 2357:0109 ==
=== Before ===
Vendor: Realtek
Product: \x03802.11n NI
Serial:
=== After ===
Vendor: Realtek
Product: 802.11n NIC
Serial not available.
== 2001:3319 ==
=== Before ===
Vendor: Realtek
Product: Wireless N
Serial: no USB Adap
=== After ===
Vendor: Realtek
Product: Wireless N Nano USB Adapter
Serial not available.
Ryder Lee [Thu, 17 Jun 2021 07:17:49 +0000 (15:17 +0800)]
mt76: fix iv and CCMP header insertion
The iv from RXD is only for TKIP_RSC/CCMP_PN/GCMP_PN, and it needs a
check for CCMP header insertion. Move mt76_cipher_type to mt76.h to
reduce duplicated code.
Signed-off-by: Xing Song <xing.song@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Sean Wang [Thu, 17 Jun 2021 01:39:19 +0000 (09:39 +0800)]
mt76: mt7921: fix the coredump is being truncated
Fix the maximum size of the coredump generated with current mt7921
firmware. Otherwise, a truncated coredump would be reported to userland
via dev_coredumpv.
Also, there is an additional error handling enhanced in the patch to avoid
the possible invalid buffer access when the system failed to create the
buffer to hold the coredump.
Fixes: 0da3c795d07b ("mt76: mt7921: add coredump support") Co-developed-by: YN Chen <YN.Chen@mediatek.com> Signed-off-by: YN Chen <YN.Chen@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Sean Wang [Mon, 10 May 2021 15:14:53 +0000 (23:14 +0800)]
mt76: mt7921: add deep sleep control to runtime-pm knob
Add addtional the deep sleep control to runtime-pm knob to
allow us to control driver switching between the full power
mode and the deep sleep mode the firmware is able to support.
Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Sean Wang [Mon, 10 May 2021 15:14:52 +0000 (23:14 +0800)]
mt76: mt7921: enable deep sleep at runtime
Enable the deep sleep mode with that firmware is able to trap into
the doze state at runtime to reduce the power consumption further.
The deep sleep mode is not allowed in the STA state transition with
the firmware to have the fast connection experience as we've done in
the full power mode
Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Felix Fietkau <nbd@nbd.name>
projects / kernel.git / log