wifi: iwlwifi: dbg-tlv: ensure NUL termination

[ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ]

The iwl_fw_ini_debug_info_tlv is used as a string, so we must
ensure the string is termin

wifi: iwlwifi: dbg-tlv: ensure NUL termination

[ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ]

The iwl_fw_ini_debug_info_tlv is used as a string, so we must
ensure the string is terminated correctly before using it.

Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4c055dc84984a0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

wifi: iwlwifi: fix a memory corruption

commit cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d upstream.

iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that
if we copy to iwl_fw_ini_tri

wifi: iwlwifi: fix a memory corruption

commit cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d upstream.

iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that
if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in
bytes, we'll write past the buffer.

Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218233
Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240111150610.2d2b8b870194.I14ed76505a5cf87304e0c9cc05cc0ae85ed3bf91@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

wifi: iwlwifi: dbg-tlv: clear FW debug memory on init

When we restart the firmware, we shouldn't keep old debug data
around. Since the "allocate" function might not reallocate the
memory blocks (the

wifi: iwlwifi: dbg-tlv: clear FW debug memory on init

When we restart the firmware, we shouldn't keep old debug data
around. Since the "allocate" function might not reallocate the
memory blocks (they're only freed when we unbind from the device),
clear the memory to have a clean slate for debug data.

This is a bit more complex since we normally don't enter into
the allocation function, but duplicating the logic didn't seem
enticing either, so rework the allocation a bit to always go
into the individual block allocation, but there clear if it's
already allocated, rather than allocating again.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230613155501.30b82881cfbf.I39520aff8ac95ee64d39dc5913525a1efd7995fa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

wifi: iwlwifi: dbg-tlv: fix DRAM data init

Given the existing code in iwl_dbg_tlv_update_drams(), the
following can happen and cause firmware asserts, and even
the device to become unusable:

* We

wifi: iwlwifi: dbg-tlv: fix DRAM data init

Given the existing code in iwl_dbg_tlv_update_drams(), the
following can happen and cause firmware asserts, and even
the device to become unusable:

* We set the magic so the firmware will use the data;
* we try to fill multiple allocation IDs, with at least
one successful, but - crucially - one failing and thus
not touching the data;
* we don't clear the data since there was one success.

This doesn't seem like much of a problem just yet, however,
what happens now is that the allocation ID(s) that failed
are not initialized.

There are two additional things to know:
* we never free these allocations across FW restart or
interface down/up etc., in fact we never free them until
the driver is unbound from the device (e.g. unloaded)
* the firmware uses the DRAM info structure for real debug
data when it has used it completely

Given that, and the fact that we never initialize the data
on restart, we can be unlucky and end up with an allocation
that looks for the most part valid (valid ID, valid number
of buffers, etc.) but has bad sizes - causing the firmware
to throw an assert we can never recover from.

Fixing the code to have the entire buffers cleared (which
we should do so old debug data isn't sticking around) is a
bit more complex, so as a first step make the actual code
that fills the information more robust by clearing the
structure first, and filling the magic values only if it
actually succeeded for one, rather than doing it the other
way around.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230613155501.87cf5528f4bc.I26ac907a4162297808b33467fc7f5d8177474a34@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

wifi: iwlwifi: do not log undefined DRAM buffers unnecessarily

DRAM buffers that are not defined in the TLVs (or are unused in the
preset) would cause a log message. To avoid confusion, skip process

wifi: iwlwifi: do not log undefined DRAM buffers unnecessarily

DRAM buffers that are not defined in the TLVs (or are unused in the
preset) would cause a log message. To avoid confusion, skip processing
buffers with an invalid (i.e. uninitialized) DRAM path.

This further reduces the noise of the message in cases where it is
unlikely to be helpful. Also update a related debug log string to better
describe what is happening.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230531194629.ecae60cf2d7f.Ib44a94d4aeb55dbb2e52edea8b69a09bc0f722c3@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

wifi: iwlwifi: move debug buffer allocation failure to info verbosity

This is noising the kernel log and customers asked to hush it down.
We can live with this message in "info" verbosity.

Signed-o

wifi: iwlwifi: move debug buffer allocation failure to info verbosity

This is noising the kernel log and customers asked to hush it down.
We can live with this message in "info" verbosity.

Signed-off-by: Golan Ben Ami <golan.ben.ami@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230416154301.0a7f557aa2a0.If9db474b63242b1bfaed659aa174b678ae8dc196@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

wifi: iwlwifi: yoyo: Fix possible division by zero

Don't allow buffer allocation TLV with zero req_size since it
leads later to division by zero in iwl_dbg_tlv_alloc_fragments().
Also, NPK/SRAM loca

wifi: iwlwifi: yoyo: Fix possible division by zero

Don't allow buffer allocation TLV with zero req_size since it
leads later to division by zero in iwl_dbg_tlv_alloc_fragments().
Also, NPK/SRAM locations are allowed to have zero buffer req_size,
don't discard them.

Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230413213309.5d6688ed74d8.I5c2f3a882b50698b708d54f4524dc5bdf11e3d32@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

wifi: iwlwifi: Update logs for yoyo reset sw changes

Update the log category for the reset-fw changes.

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Gregory Greenman <gr

wifi: iwlwifi: Update logs for yoyo reset sw changes

Update the log category for the reset-fw changes.

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230305124407.852a6b5f95fa.Ie67bd28da65c7e42424cacb37495930475de2dad@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

wifi: iwlwifi: reduce verbosity of some logging events

These are cases in which we'd like to warn that something
unexpected happened but they may not be errors.

Reduce verbosity.

Signed-off-by: Go

wifi: iwlwifi: reduce verbosity of some logging events

These are cases in which we'd like to warn that something
unexpected happened but they may not be errors.

Reduce verbosity.

Signed-off-by: Golan Ben Ami <golan.ben.ami@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230305124407.5eea0f58a74f.Ifb6b35903a5a452a757bfe50b6a7e58b3fd2ef23@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

show more ...

treewide: Convert del_timer*() to timer_shutdown*()

Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called

treewide: Convert del_timer*() to timer_shutdown*()

Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown". After a timer is set to this state, then it can no
longer be re-armed.

The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed. It also ignores any locations where
the timer->function is modified between the del_timer*() and the free(),
as that is not considered a "trivial" case.

This was created by using a coccinelle script and the following
commands:

$ cat timer.cocci
@@
expression ptr, slab;
identifier timer, rfield;
@@
(
- del_timer(&ptr->timer);
+ timer_shutdown(&ptr->timer);
|
- del_timer_sync(&ptr->timer);
+ timer_shutdown_sync(&ptr->timer);
)
... when strict
when != ptr->timer
(
kfree_rcu(ptr, rfield);
|
kmem_cache_free(slab, ptr);
|
kfree(ptr);
)

$ spatch timer.cocci . > /tmp/t.patch
$ patch -p1 < /tmp/t.patch

Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

show more ...

wifi: iwlwifi: dbg: use bit of DRAM alloc ID to store failed allocs

The failed_alloc variable is used as a bitmask in the loop where we
check DRAM allocations. But erroneously, we were clearing the

wifi: iwlwifi: dbg: use bit of DRAM alloc ID to store failed allocs

The failed_alloc variable is used as a bitmask in the loop where we
check DRAM allocations. But erroneously, we were clearing the DRAM
alloc IDs we removed as an integer.

Fix that by clearing them as bits instead.

Signed-off-by: Rotem Saado <rotem.saado@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20221102165239.688dec28b1d9.I470b8d29c28d16f25f4192773f075940de7ed33c@changeid

show more ...

wifi: iwlwifi: dbg: add support for DBGC4 on BZ family and above

Update the for loop that iterates over all the DBGCs to include DBGC4.
DBGC4 is only supported staring from the BZ family of devices,

wifi: iwlwifi: dbg: add support for DBGC4 on BZ family and above

Update the for loop that iterates over all the DBGCs to include DBGC4.
DBGC4 is only supported staring from the BZ family of devices, so check
the family before accepting it.

Signed-off-by: Rotem Saado <rotem.saado@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20221102165239.0b6050b41060.Id662c716c2e3c2c850740d1f71e2801e02aeddaf@changeid

show more ...

iwlwifi: iwl-dbg: Use del_timer_sync() before freeing

In Chrome OS, a large number of crashes is observed due to corrupted timer
lists. Steven Rostedt pointed out that this usually happens when a ti

iwlwifi: iwl-dbg: Use del_timer_sync() before freeing

In Chrome OS, a large number of crashes is observed due to corrupted timer
lists. Steven Rostedt pointed out that this usually happens when a timer
is freed while still active, and that the problem is often triggered
by code calling del_timer() instead of del_timer_sync() just before
freeing.

Steven also identified the iwlwifi driver as one of the possible culprits
since it does exactly that.

Reported-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Gregory Greenman <gregory.greenman@intel.com>
Fixes: 60e8abd9d3e91 ("iwlwifi: dbg_ini: add periodic trigger new API support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Gregory Greenman <gregory.greenman@intel.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com> # Linux v5.17.3-rc1 and Debian LLVM-14
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220411154210.1870008-1-linux@roeck-us.net

show more ...

iwlwifi: dbg_ini: Split memcpy() to avoid multi-field write

To avoid a run-time false positive in the stricter FORTIFY_SOURCE
memcpy() checks, split the memcpy() into the struct and the data.
Additi

iwlwifi: dbg_ini: Split memcpy() to avoid multi-field write

To avoid a run-time false positive in the stricter FORTIFY_SOURCE
memcpy() checks, split the memcpy() into the struct and the data.
Additionally switch the data member to a flexible array to follow
modern language conventions.

Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210727205855.411487-64-keescook@chromium.org
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: yoyo: support dump policy for the dump size

Support dump size limitation based on the TLV by firmware.
This is needed for limited memory systems so only the most
important dumps are sent by

iwlwifi: yoyo: support dump policy for the dump size

Support dump size limitation based on the TLV by firmware.
This is needed for limited memory systems so only the most
important dumps are sent by driver.

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220210181930.d7e1ff264766.If2327fd890a453cdc9069d26220394d0b4e79743@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: yoyo: Avoid using dram data if allocation failed

The config set TLV setting depend on dram allocation
and if allocation failed the data used in config set tlv
should not set this.
Adding th

iwlwifi: yoyo: Avoid using dram data if allocation failed

The config set TLV setting depend on dram allocation
and if allocation failed the data used in config set tlv
should not set this.
Adding the check if dram fragment is available or not.

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Fixes: 1a5daead217c ("iwlwifi: yoyo: support for ROM usniffer")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220204122220.44835d181528.I3e78ba29c13bbeada017fcb2a620f3552c1dfa30@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: avoid variable shadowing

Change a few places to not shadow variables.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: htt

iwlwifi: avoid variable shadowing

Change a few places to not shadow variables.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220130115024.d53f2a7a9614.I7441559451d54b39dc0daeb4c31e5dce19d4d83e@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: dbg-tlv: clean up iwl_dbg_tlv_update_drams()

This function puts a fairly large structure unnecessarily
on the stack, and also has a few other very strange things,
clean it up a bit.

Signed

iwlwifi: dbg-tlv: clean up iwl_dbg_tlv_update_drams()

This function puts a fairly large structure unnecessarily
on the stack, and also has a few other very strange things,
clean it up a bit.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220130115024.9f2c282a3104.If6b868c96c0d089579ca72fd270387de81359d5b@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: yoyo: add IMR DRAM dump support

Support debug collection of the platform IMR memory region,
where data is copied by FW during d3 state

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel

iwlwifi: yoyo: add IMR DRAM dump support

Support debug collection of the platform IMR memory region,
where data is copied by FW during d3 state

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220129105618.715f04ecc635.Ib89a6caa06c1324c1c0dd3f9f4cf7407f2857155@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: yoyo: fix DBGC allocation flow

number of DBGCs and number of fragments per DBGC
is hw family dependency and not capability.

Signed-off-by: Rotem Saado <rotem.saado@intel.com>
Signed-off-by

iwlwifi: yoyo: fix DBGC allocation flow

number of DBGCs and number of fragments per DBGC
is hw family dependency and not capability.

Signed-off-by: Rotem Saado <rotem.saado@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220129105618.209c6fe4364a.I5b21769d297d6fcfafc58ddf1db87d88349fe06f@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: fix various more -Wcast-qual warnings

When enabling W=3 that gets us -Wcast-qual, fix those warnings
in the code and propagate constness properly, or cast it away
via (uintptr_t) where real

iwlwifi: fix various more -Wcast-qual warnings

When enabling W=3 that gets us -Wcast-qual, fix those warnings
in the code and propagate constness properly, or cast it away
via (uintptr_t) where really needed.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220128153014.4ac2f19c121e.Ied9469d93f8199206242bfba96e4e8d1949e3a08@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: propagate (const) type qualifier

Most of this change is a continuation of commit 403ea939ea6a
("iwlwifi: dbg: Mark ucode tlv data as const") propagating the
(const) type qualifier for ucode

iwlwifi: propagate (const) type qualifier

Most of this change is a continuation of commit 403ea939ea6a
("iwlwifi: dbg: Mark ucode tlv data as const") propagating the
(const) type qualifier for ucode based tlv data to avoid having
the impression that it is writeable.
The other part of the change preserves the (const) type qualifier
over casts and function calls where it was previously lost.
Both changes are needed to avoid compile time errors on system with
more strict error settings, in this case found with clang on FreeBSD.

Sponsored by: The FreeBSD Foundation
Signed-off-by: Bjoern A. Zeeb <bz@FreeBSD.ORG>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
[fix double word in commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20220128153014.3230c41312fc.I0032c597984834258d5a79b97052ed83dbe53b80@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: yoyo: support TLV-based firmware reset

Support resetting the firmware via TLV-based debugging. When applied,
this will cause the driver to reset the firmware when the debugging
is triggere

iwlwifi: yoyo: support TLV-based firmware reset

Support resetting the firmware via TLV-based debugging. When applied,
this will cause the driver to reset the firmware when the debugging
is triggered.

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211219121514.d59b29653a1e.I7b3be4a1ad1a9d5d0e86259740e89ac113c9348b@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: fix debug TLV parsing

Debug TLV parsing was missing size checks, so if a valid but
too short TLV was encountered, it would attempt to read it.
If the firmware file was arranged to be a mult

iwlwifi: fix debug TLV parsing

Debug TLV parsing was missing size checks, so if a valid but
too short TLV was encountered, it would attempt to read it.
If the firmware file was arranged to be a multiple of pages
long with this happening just before the end, it could crash
reading out-of-bounds of a vmalloc area.

Fix this by adding the relevant size check.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211210110539.84848da8067f.Ifb4f80c95d283ec62e495a7928069af711b5fee2@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...

iwlwifi: dbg: disable ini debug in 8000 family and below

Yoyo based debug is not applicable for 8000 and below old devices.
The check added in code has 9000 and below familiy which is corrected.

Si

iwlwifi: dbg: disable ini debug in 8000 family and below

Yoyo based debug is not applicable for 8000 and below old devices.
The check added in code has 9000 and below familiy which is corrected.

Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211204174546.b6176a5bc198.Ib8e4b1e60e0b6c1538cc4f384dcf681b3db097ce@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

show more ...