- 07 May, 2019 15 commits
-
-
Wen Gong authored
For some SDIO chip, the peer id is 65535 for MPDU with error status, then test_bit will trigger buffer overflow for peer's memory, if kasan enabled, it will report error. Reason is when station is in disconnecting status, firmware do not delete the peer info since it not disconnected completely, meanwhile some AP will still send data packet to station, then hardware will receive the packet and send to firmware, firmware's logic will report peer id of 65535 for MPDU with error status. Add check for overflow the size of peer's peer_ids will avoid the buffer overflow access. Call trace of kasan: dump_backtrace+0x0/0x2ec show_stack+0x20/0x2c __dump_stack+0x20/0x28 dump_stack+0xc8/0xec print_address_description+0x74/0x240 kasan_report+0x250/0x26c __asan_report_load8_noabort+0x20/0x2c ath10k_peer_find_by_id+0x180/0x1e4 [ath10k_core] ath10k_htt_t2h_msg_handler+0x100c/0x2fd4 [ath10k_core] ath10k_htt_htc_t2h_msg_handler+0x20/0x34 [ath10k_core] ath10k_sdio_irq_handler+0xcc8/0x1678 [ath10k_sdio] process_sdio_pending_irqs+0xec/0x370 sdio_run_irqs+0x68/0xe4 sdio_irq_work+0x1c/0x28 process_one_work+0x3d8/0x8b0 worker_thread+0x508/0x7cc kthread+0x24c/0x264 ret_from_fork+0x10/0x18 Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by:
Wen Gong <wgong@codeaurora.org> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org>
-
Surabhi Vishnoi authored
WCN3990 firmware advertises the service WMI_TLV_SERVICE_MESH_11S for mesh 11s. Map this wmi tlv service to enable mesh 11s for WCN3990. Tested HW: WCN3990 Signed-off-by:
Surabhi Vishnoi <svishnoi@codeaurora.org> Signed-off-by:
-
Surabhi Vishnoi authored
Currently mac80211 do not support probe response template for mesh point. When WMI_SERVICE_BEACON_OFFLOAD is enabled, host driver tries to configure probe response template for mesh, but it fails because the interface type is not NL80211_IFTYPE_AP but NL80211_IFTYPE_MESH_POINT. To avoid this failure, skip sending probe response template to firmware for mesh point. Tested HW: WCN3990/QCA6174/QCA9984 Signed-off-by:
-
Surabhi Vishnoi authored
There is a disparity in wmi and wmi tlv vdev subtype enum for WMI_VDEV_SUBTYPE_MESH_11S. Add different enum for wmi tlv vdev subtype to support vdev of subtype mesh 11s for WCN3990. Tested HW: WCN3990 Signed-off-by:
-
Wen Gong authored
For SDIO chip, it does not have HTT connect step in boot phase of UTF mode, so it does not need the swap configuration for UTF mode, otherwise it will trigger UTF load fail. For normal mode, it is swap between HTT and WMI, for UTF mode, it does not have HTT, so it can not swap between HTT and WMI. Disable swap mail box for UTF mode will let UTF mode load success. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by:
-
Surabhi Vishnoi authored
The enum value for WMI_TLV_STAT_PDEV, WMI_TLV_STAT_VDEV and WMI_TLV_STAT_PEER is wrong, due to which the vdev stats are not received from firmware in wmi_update_stats event. Fix the enum values for above stats to receive all stats from firmware in WMI_TLV_UPDATE_STATS_EVENTID. Tested HW: WCN3990 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Fixes: f40a307e ("ath10k: Fill rx duration for each peer in fw_stats for WCN3990) Signed-off-by:
-
Gustavo A. R. Silva authored
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace code of the following form: sizeof(*ce_hdr) + CE_COUNT * sizeof(ce_hdr->entries[0]) with: struct_size(ce_hdr, entries, CE_COUNT) This code was detected with the help of Coccinelle. Signed-off-by:
Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by:
-
Gustavo A. R. Silva authored
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*rx) + (sizeof(struct htt_rx_indication_mpdu_range) * num_mpdu_ranges) to : struct_size(rx, mpdu_ranges, num_mpdu_ranges) This code was detected with the help of Coccinelle. Signed-off-by:
-
Rakesh Pillai authored
Currently the protected management frames are not appended with the MIC_LEN which results in the protected management frames being encoded incorrectly. Add the extra space at the end of the protected management frames to fix this encoding error for the protected management frames. Tested HW: WCN3990 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Fixes: 1807da49 ("ath10k: wmi: add management tx by reference support over wmi") Signed-off-by:
Rakesh Pillai <pillair@codeaurora.org> Signed-off-by:
-
Balaji Pothunoori authored
Currently instant rx_duration always fetching as zero in fw_stats debugfs entry if extended peer stats event supports. This patch updates instant rx_duration in fw_stats entry based on extended peer stats and maintaining backward compatibility for 10.2/10.x. Tested HW: QCA9984. Tested FW: 10.4-3.6.0.1-00004. Signed-off-by:
Balaji Pothunoori <bpothuno@codeaurora.org> Signed-off-by:
-
Brandon Huang authored
In tx_stats debugfs, txrate->flags may contain multiple bits. For example, RATE_INFO_FLAGS_SHORT_GI could be set, and tx stats bytes and packets will be not updated correctly. Fix this issue by using bit operation to check txrate->flags. Tested HW: QCA9984 Tested Firmware: 10.4-3.9.0.1-00007 Signed-off-by:
Brandon Huang <yanghuan@codeaurora.org> Signed-off-by:
-
Govind Singh authored
CE4 is host to target HTT tx pipe, tx completion are not served on time when CPU is loaded and this cause ce src ring full condition due to less no of src buffer entries. To mitigate the issue increase CE4 src buffer entries to 2048. Testing: Tested on QCS404 platform(WCN3990 HW) Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Signed-off-by:Govind Singh <govinds@codeaurora.org> Signed-off-by:
-
Govind Singh authored
Board id and fw version is not printed by default in qmi cap response message. Move board id and fw version logging to info level for default logging. [ 34.005399] ath10k_snoc a000000.wifi: qmi chip_id 0x30b chip_family 0x4001 board_id 0xff soc_id 0x40070000 [ 34.005432] ath10k_snoc a000000.wifi: qmi fw_version 0x3106836b fw_build_timestamp 2019-02-13 10:24 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HL.3.1-00875-QCAHLSWMTPL-1 Signed-off-by:
-
Maharaja Kennadyrajan authored
Reset HTT stats helps to get the aggregated HTT stats via tracing and also we can clear the accumulated HTT stats with this debugfs file. Signed-off-by:
Maharaja Kennadyrajan <mkenna@codeaurora.org> Signed-off-by:
-
Maharaja Kennadyrajan authored
Extended the bit mask value of the HTT stats to get the Mu-MIMO related stats via tracing. Signed-off-by:
-
- 03 May, 2019 9 commits
-
-
Maya Erez authored
In Talyn the HW is responsible for power management enter / exit flow, hence the deep sleep exit latency is significantly shorter than in Sparrow. In such a case HALP feature, that is meant to prevent long PCIe blocking accesses, is no longer needed and can be removed for Talyn. Signed-off-by:
Maya Erez <merez@codeaurora.org> Signed-off-by:
-
Dedy Lansky authored
Make sure rx_buff_mgmt is initialized before accessing it. Signed-off-by:
Dedy Lansky <dlansky@codeaurora.org> Signed-off-by:
-
Maya Erez authored
When MISC interrupt is triggered due to HALP bit, in parallel to mbox events handling by the MISC threaded IRQ, new mbox interrupt can be missed in the following scenario: 1. MISC ICR is read in the IRQ handler 2. Threaded IRQ is completed and all MISC interrupts are unmasked 3. mbox interrupt is set by FW 4. HALP is masked The mbox interrupt in step 3 can be missed due to constant high level of ICM. Masking all MISC IRQs instead of masking only HALP bit in step 4 will guarantee that ICM will drop to 0 and interrupt will be triggered once MISC interrupts will be unmasked. Signed-off-by:
-
Ahmad Masri authored
Save the parameter of max_assoc_sta per device. On fw_ready event calculate the max_assoc_sta and save it per device, do not overwrite the max_assoc_sta module param. Signed-off-by:
Ahmad Masri <amasri@codeaurora.org> Signed-off-by:
-
Dedy Lansky authored
Add printing of hwhead as part of desc ring and status ring debugfs. Validate wil->rx_buff_mgmt and ring->ctx arrays before accessing them. Dump Tx descriptor content even when it indicates invalid buff_id. Signed-off-by:
-
Maya Erez authored
Current board file loading procedure assumes that the board file includes only one section. New board files can include multiple sections. Add the ability to read multiple addresses and max size from FW file and load multiple sections from the board file into those addresses. Signed-off-by:
-
Dedy Lansky authored
Add logging of the platform capabilities after retrieving it from the platform driver. Signed-off-by:
-
Alexei Avshalom Lazar authored
_desc is defined in __wil_tx_vring_tso() and may not be set in case len is 0, verify _desc is set. Signed-off-by:
Alexei Avshalom Lazar <ailizaro@codeaurora.org> Signed-off-by:
-
Maya Erez authored
Interrupt is set in ICM (ICR & ~IMV) rising trigger. As the driver masks the IRQ after clearing it, there can be a race where an additional spurious interrupt is triggered when the driver unmask the IRQ. This can happen in case HW triggers an interrupt after the clear and before the mask. To prevent the second spurious interrupt the driver needs to mask the IRQ before reading and clearing it. Signed-off-by:
-
- 29 Apr, 2019 16 commits
-
-
Arnd Bergmann authored
clang fails to eliminate some dead code with always-taken branches when CONFIG_PROFILE_ANNOTATED_BRANCHES is set, leading to a false-positive warning: drivers/net/wireless/ath/carl9170/mac.c:522:3: error: variable 'power' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] BUG_ON(1); ^~~~~~~~~ Change both instances of BUG_ON(1) in carl9170 to the simpler BUG() to avoid the warning. Signed-off-by:Arnd Bergmann <arnd@arndb.de> Acked-by:
Christian Lamparter <chunkeey@gmail.com> Signed-off-by:
-
Gustavo A. R. Silva authored
Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: enum gro_result { GRO_MERGED, GRO_MERGED_FREE, GRO_HELD, GRO_NORMAL, GRO_DROP, GRO_CONSUMED, }; typedef enum gro_result gro_result_t; In case *rc* evaluates to 5, we end up having an out-of-bounds read at drivers/net/wireless/ath/wil6210/txrx.c:821: wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", len, gro_res_str[rc]); Fix this by adding element "GRO_CONSUMED" to array gro_res_str. Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") Fixes: 194b482b ("wil6210: Debug print GRO Rx result") Signed-off-by: -
Anilkumar Kolli authored
Increase pulse width range from 1-2usec to 0-4usec. During data traffic HW occasionally fails detecting radar pulses, so that SW cannot get enough radar reports to achieve the success rate. Tested ath10k hw and fw: * QCA9888(10.4-3.5.1-00052) * QCA4019(10.4-3.2.1.1-00017) * QCA9984(10.4-3.6-00104) * QCA988X(10.2.4-1.0-00041) Tested ath9k hw: AR9300 Tested-by:
Tamizh chelvam <tamizhr@codeaurora.org> Signed-off-by:
Anilkumar Kolli <akolli@codeaurora.org> Signed-off-by:
-
Tomislav Požega authored
AR9330, AR9485, AR9531, AR9550, AR9561 and AR9565 all use same channel set register configuration which allows for small code size reduction. Signed-off-by:
Tomislav Požega <pozega.tomislav@gmail.com> Signed-off-by:
-
Tomislav Požega authored
Remove duplicate NO_CTL that is just 2 lines below. Signed-off-by:
-
YueHaibing authored
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_count_frames': drivers/net/wireless/ath/ath9k/xmit.c:413:25: warning: variable 'fi' set but not used [-Wunused-but-set-variable] drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_complete_aggr': drivers/net/wireless/ath/ath9k/xmit.c:449:24: warning: variable 'hdr' set but not used [-Wunused-but-set-variable] drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_start': drivers/net/wireless/ath/ath9k/xmit.c:2274:18: warning: variable 'avp' set but not used [-Wunused-but-set-variable] drivers/net/wireless/ath/ath9k/xmit.c:2269:24: warning: variable 'hdr' set but not used [-Wunused-but-set-variable] These variables are not used any more and can be removed. Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Sven Eckelmann authored
The ath9k driver uses as maximum allowed txpower the constant MAX_RATE_POWER. It is used to set a maximum txpower limit for the PHY (which is combined txpower) and also the maximum txpower for per chain rates. Its value 63 is derived from the maximum number the registers can store for the per chain txpower. The max txpower a user can set because of this is 31 dBm (floor(63 / 2)). This also means that a device with multiple tx chains is even limited further: * 1 chain: 31 dBm per chain * 2 chains: 28 dBm per chain * 3 chains: 26 dBm per chain This combined txpower limit of 31 dBm becomes even more problematic when some extra antenna gain is set in the EEPROM. A high power device is then no longer able to reach its potential limits. Instead the code dealing with the combined txpower must use a higher limit than 63 and only the code dealing with the per chain txpower have to use the limit of 63. Since the antenna gain can be quite large and 8 bit variables are often used in ath9k for txpower, a large, divisible by two number like 254 is a good choice for this new limit. Signed-off-by:
Sven Eckelmann <sven@narfation.org> Signed-off-by:
-
Tim Schumacher authored
Right now, if an error is encountered during the SREV register read (i.e. an EIO in ath9k_regread()), that error code gets passed all the way to __ath9k_hw_init(), where it is visible during the "Chip rev not supported" message. ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits ath: phy2: Mac Chip Rev 0x0f.3 is not supported by this driver ath: phy2: Unable to initialize hardware; initialization status: -95 ath: phy2: Unable to initialize hardware; initialization status: -95 ath9k_htc: Failed to initialize the device Check for -EIO explicitly in ath9k_hw_read_revisions() and return a boolean based on the success of the operation. Check for that in __ath9k_hw_init() and abort with a more debugging-friendly message if reading the revisions wasn't successful. ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits ath: phy2: Failed to read SREV register ath: phy2: Could not read hardware revision ath: phy2: Unable to initialize hardware; initialization status: -95 ath: phy2: Unable to initialize hardware; initialization status: -95 ath9k_htc: Failed to initialize the device This helps when debugging by directly showing the first point of failure and it could prevent possible errors if a 0x0f.3 revision is ever supported. Signed-off-by:Tim Schumacher <timschumi@gmx.de> Signed-off-by:
-
Toke Høiland-Jørgensen authored
As already noted a comment in ath_tx_complete_aggr(), the hardware will occasionally send a TX status with the wrong tid number. If we trust the value, airtime usage will be reported to the wrong AC, which can cause the deficit on that AC to become very low, blocking subsequent attempts to transmit. To fix this, account airtime usage to the TID number from the original skb, instead of the one in the hardware TX status report. Reported-by:
Miguel Catalan Cid <miguel.catalan@i2cat.net> Signed-off-by:
Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by:
-
Colin Ian King authored
The check on status not being zero is redundant as previous code paths that set status to an error value break out of the while loop and hence status is never non-zero at the check. Remove this redundant code. Addresses-Coverity: ("Logically dead code") Signed-off-by:Colin Ian King <colin.king@canonical.com> Reviewed-by:
Mukesh Ojha <mojha@codeaurora.org> Signed-off-by:
-
Dan Carpenter authored
The "ev->traffic_class" and "reply->ac" variables come from the network and they're used as an offset into the wmi->stream_exist_for_ac[] array. Those variables are u8 so they can be 0-255 but the stream_exist_for_ac[] array only has WMM_NUM_AC (4) elements. We need to add a couple bounds checks to prevent array overflows. I also modified one existing check from "if (traffic_class > 3) {" to "if (traffic_class >= WMM_NUM_AC) {" just to make them all consistent. Fixes: bdcd8170 (" Add ath6kl cleaned up driver") Signed-off-by:Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Gustavo A. R. Silva authored
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace code of the following form: sizeof(*ev) + ev->num_neighbors * sizeof(struct wmi_neighbor_info) with: struct_size(ev, neighbor, ev->num_neighbors) This code was detected with the help of Coccinelle. Signed-off-by:
-
Gustavo A. R. Silva authored
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*tbl) + num_entries * sizeof(struct wmi_bss_roam_info) to : struct_size(tbl, info, num_entries) This code was detected with the help of Coccinelle. Signed-off-by:
-
Pradeep kumar Chitrapu authored
Invalid rate code is sent to firmware when multicast rate value of 0 is sent to driver indicating disabled case, causing broken mesh path. so fix that. Tested on QCA9984 with firmware 10.4-3.6.1-00827 Sven tested on IPQ4019 with 10.4-3.5.3-00057 and QCA9888 with 10.4-3.5.3-00053 (ath10k-firmware) and 10.4-3.6-00140 (linux-firmware 2018-12-16-211de167). Fixes: cd93b83a ("ath10k: support for multicast rate control") Co-developed-by:
Zhi Chen <zhichen@codeaurora.org> Signed-off-by:
Pradeep Kumar Chitrapu <pradeepc@codeaurora.org> Tested-by:
-
Wen Gong authored
After implementing PN replay check we can enable SDIO support on QCA6174. Tested with client mode on all security modes, and fragmentation as well. AP mode does not work yet. Also tone down the warning about SDIO being not ready yet. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. AP mode is not working yet. Signed-off-by:
-
Wen Gong authored
On high latency devices (SDIO, USB) ath10k did not handle fragmented frames and all fragmented frames on receive path were lost in ath10k. Even a simple ping test failed with fragmentation. The fragmented packets are decapsulated based on the security mode, then the PN is checked and the fragmented frame is passed to mac80211. mac80211 in ieee80211_rx_h_defragment() will then combine the fragment frames and forward to upper layers. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by:
-
