1 files changed, 336 insertions, 28 deletions

diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index c64d864799cd..d4578cefe445 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -22,7 +22,7 @@
  * USA
  *
  * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
+ * in the file called COPYING.
  *
  * Contact Information:
  *  Intel Linux Wireless <ilw@linux.intel.com>
@@ -61,8 +61,11 @@
  *
  *****************************************************************************/
 
+#include <linux/etherdevice.h>
+#include <linux/ip.h>
 #include <net/cfg80211.h>
 #include <net/ipv6.h>
+#include <net/tcp.h>
 #include "iwl-modparams.h"
 #include "fw-api.h"
 #include "mvm.h"
@@ -192,6 +195,11 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                                            sizeof(wkc), &wkc);
                 data->error = ret != 0;
 
+                mvm->ptk_ivlen = key->iv_len;
+                mvm->ptk_icvlen = key->icv_len;
+                mvm->gtk_ivlen = key->iv_len;
+                mvm->gtk_icvlen = key->icv_len;
+
                 /* don't upload key again */
                 goto out_unlock;
         }
@@ -304,9 +312,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
          */
         if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
                 key->hw_key_idx = 0;
+                mvm->ptk_ivlen = key->iv_len;
+                mvm->ptk_icvlen = key->icv_len;
         } else {
                 data->gtk_key_idx++;
                 key->hw_key_idx = data->gtk_key_idx;
+                mvm->gtk_ivlen = key->iv_len;
+                mvm->gtk_icvlen = key->icv_len;
         }
 
         ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, true);
@@ -392,6 +404,233 @@ static int iwl_mvm_send_proto_offload(struct iwl_mvm *mvm,
                                     sizeof(cmd), &cmd);
 }
 
+enum iwl_mvm_tcp_packet_type {
+        MVM_TCP_TX_SYN,
+        MVM_TCP_RX_SYNACK,
+        MVM_TCP_TX_DATA,
+        MVM_TCP_RX_ACK,
+        MVM_TCP_RX_WAKE,
+        MVM_TCP_TX_FIN,
+};
+
+static __le16 pseudo_hdr_check(int len, __be32 saddr, __be32 daddr)
+{
+        __sum16 check = tcp_v4_check(len, saddr, daddr, 0);
+        return cpu_to_le16(be16_to_cpu((__force __be16)check));
+}
+
+static void iwl_mvm_build_tcp_packet(struct iwl_mvm *mvm,
+                                     struct ieee80211_vif *vif,
+                                     struct cfg80211_wowlan_tcp *tcp,
+                                     void *_pkt, u8 *mask,
+                                     __le16 *pseudo_hdr_csum,
+                                     enum iwl_mvm_tcp_packet_type ptype)
+{
+        struct {
+                struct ethhdr eth;
+                struct iphdr ip;
+                struct tcphdr tcp;
+                u8 data[];
+        } __packed *pkt = _pkt;
+        u16 ip_tot_len = sizeof(struct iphdr) + sizeof(struct tcphdr);
+        int i;
+
+        pkt->eth.h_proto = cpu_to_be16(ETH_P_IP),
+        pkt->ip.version = 4;
+        pkt->ip.ihl = 5;
+        pkt->ip.protocol = IPPROTO_TCP;
+
+        switch (ptype) {
+        case MVM_TCP_TX_SYN:
+        case MVM_TCP_TX_DATA:
+        case MVM_TCP_TX_FIN:
+                memcpy(pkt->eth.h_dest, tcp->dst_mac, ETH_ALEN);
+                memcpy(pkt->eth.h_source, vif->addr, ETH_ALEN);
+                pkt->ip.ttl = 128;
+                pkt->ip.saddr = tcp->src;
+                pkt->ip.daddr = tcp->dst;
+                pkt->tcp.source = cpu_to_be16(tcp->src_port);
+                pkt->tcp.dest = cpu_to_be16(tcp->dst_port);
+                /* overwritten for TX SYN later */
+                pkt->tcp.doff = sizeof(struct tcphdr) / 4;
+                pkt->tcp.window = cpu_to_be16(65000);
+                break;
+        case MVM_TCP_RX_SYNACK:
+        case MVM_TCP_RX_ACK:
+        case MVM_TCP_RX_WAKE:
+                memcpy(pkt->eth.h_dest, vif->addr, ETH_ALEN);
+                memcpy(pkt->eth.h_source, tcp->dst_mac, ETH_ALEN);
+                pkt->ip.saddr = tcp->dst;
+                pkt->ip.daddr = tcp->src;
+                pkt->tcp.source = cpu_to_be16(tcp->dst_port);
+                pkt->tcp.dest = cpu_to_be16(tcp->src_port);
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
+
+        switch (ptype) {
+        case MVM_TCP_TX_SYN:
+                /* firmware assumes 8 option bytes - 8 NOPs for now */
+                memset(pkt->data, 0x01, 8);
+                ip_tot_len += 8;
+                pkt->tcp.doff = (sizeof(struct tcphdr) + 8) / 4;
+                pkt->tcp.syn = 1;
+                break;
+        case MVM_TCP_TX_DATA:
+                ip_tot_len += tcp->payload_len;
+                memcpy(pkt->data, tcp->payload, tcp->payload_len);
+                pkt->tcp.psh = 1;
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_TX_FIN:
+                pkt->tcp.fin = 1;
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_RX_SYNACK:
+                pkt->tcp.syn = 1;
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_RX_ACK:
+                pkt->tcp.ack = 1;
+                break;
+        case MVM_TCP_RX_WAKE:
+                ip_tot_len += tcp->wake_len;
+                pkt->tcp.psh = 1;
+                pkt->tcp.ack = 1;
+                memcpy(pkt->data, tcp->wake_data, tcp->wake_len);
+                break;
+        }
+
+        switch (ptype) {
+        case MVM_TCP_TX_SYN:
+        case MVM_TCP_TX_DATA:
+        case MVM_TCP_TX_FIN:
+                pkt->ip.tot_len = cpu_to_be16(ip_tot_len);
+                pkt->ip.check = ip_fast_csum(&pkt->ip, pkt->ip.ihl);
+                break;
+        case MVM_TCP_RX_WAKE:
+                for (i = 0; i < DIV_ROUND_UP(tcp->wake_len, 8); i++) {
+                        u8 tmp = tcp->wake_mask[i];
+                        mask[i + 6] |= tmp << 6;
+                        if (i + 1 < DIV_ROUND_UP(tcp->wake_len, 8))
+                                mask[i + 7] = tmp >> 2;
+                }
+                /* fall through for ethernet/IP/TCP headers mask */
+        case MVM_TCP_RX_SYNACK:
+        case MVM_TCP_RX_ACK:
+                mask[0] = 0xff; /* match ethernet */
+                /*
+                 * match ethernet, ip.version, ip.ihl
+                 * the ip.ihl half byte is really masked out by firmware
+                 */
+                mask[1] = 0x7f;
+                mask[2] = 0x80; /* match ip.protocol */
+                mask[3] = 0xfc; /* match ip.saddr, ip.daddr */
+                mask[4] = 0x3f; /* match ip.daddr, tcp.source, tcp.dest */
+                mask[5] = 0x80; /* match tcp flags */
+                /* leave rest (0 or set for MVM_TCP_RX_WAKE) */
+                break;
+        };
+
+        *pseudo_hdr_csum = pseudo_hdr_check(ip_tot_len - sizeof(struct iphdr),
+                                            pkt->ip.saddr, pkt->ip.daddr);
+}
+
+static int iwl_mvm_send_remote_wake_cfg(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        struct cfg80211_wowlan_tcp *tcp)
+{
+        struct iwl_wowlan_remote_wake_config *cfg;
+        struct iwl_host_cmd cmd = {
+                .id = REMOTE_WAKE_CONFIG_CMD,
+                .len = { sizeof(*cfg), },
+                .dataflags = { IWL_HCMD_DFL_NOCOPY, },
+                .flags = CMD_SYNC,
+        };
+        int ret;
+
+        if (!tcp)
+                return 0;
+
+        cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
+        if (!cfg)
+                return -ENOMEM;
+        cmd.data[0] = cfg;
+
+        cfg->max_syn_retries = 10;
+        cfg->max_data_retries = 10;
+        cfg->tcp_syn_ack_timeout = 1; /* seconds */
+        cfg->tcp_ack_timeout = 1; /* seconds */
+
+        /* SYN (TX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->syn_tx.data, NULL,
+                &cfg->syn_tx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_TX_SYN);
+        cfg->syn_tx.info.tcp_payload_length = 0;
+
+        /* SYN/ACK (RX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->synack_rx.data, cfg->synack_rx.rx_mask,
+                &cfg->synack_rx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_RX_SYNACK);
+        cfg->synack_rx.info.tcp_payload_length = 0;
+
+        /* KEEPALIVE/ACK (TX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->keepalive_tx.data, NULL,
+                &cfg->keepalive_tx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_TX_DATA);
+        cfg->keepalive_tx.info.tcp_payload_length =
+                cpu_to_le16(tcp->payload_len);
+        cfg->sequence_number_offset = tcp->payload_seq.offset;
+        /* length must be 0..4, the field is little endian */
+        cfg->sequence_number_length = tcp->payload_seq.len;
+        cfg->initial_sequence_number = cpu_to_le32(tcp->payload_seq.start);
+        cfg->keepalive_interval = cpu_to_le16(tcp->data_interval);
+        if (tcp->payload_tok.len) {
+                cfg->token_offset = tcp->payload_tok.offset;
+                cfg->token_length = tcp->payload_tok.len;
+                cfg->num_tokens =
+                        cpu_to_le16(tcp->tokens_size % tcp->payload_tok.len);
+                memcpy(cfg->tokens, tcp->payload_tok.token_stream,
+                       tcp->tokens_size);
+        } else {
+                /* set tokens to max value to almost never run out */
+                cfg->num_tokens = cpu_to_le16(65535);
+        }
+
+        /* ACK (RX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->keepalive_ack_rx.data,
+                cfg->keepalive_ack_rx.rx_mask,
+                &cfg->keepalive_ack_rx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_RX_ACK);
+        cfg->keepalive_ack_rx.info.tcp_payload_length = 0;
+
+        /* WAKEUP (RX) */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->wake_rx.data, cfg->wake_rx.rx_mask,
+                &cfg->wake_rx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_RX_WAKE);
+        cfg->wake_rx.info.tcp_payload_length =
+                cpu_to_le16(tcp->wake_len);
+
+        /* FIN */
+        iwl_mvm_build_tcp_packet(
+                mvm, vif, tcp, cfg->fin_tx.data, NULL,
+                &cfg->fin_tx.info.tcp_pseudo_header_checksum,
+                MVM_TCP_TX_FIN);
+        cfg->fin_tx.info.tcp_payload_length = 0;
+
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+        kfree(cfg);
+
+        return ret;
+}
+
 struct iwl_d3_iter_data {
         struct iwl_mvm *mvm;
         struct ieee80211_vif *vif;
@@ -630,6 +869,22 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 d3_cfg_cmd.wakeup_flags |=
                         cpu_to_le32(IWL_WOWLAN_WAKEUP_RF_KILL_DEASSERT);
 
+        if (wowlan->tcp) {
+                /*
+                 * The firmware currently doesn't really look at these, only
+                 * the IWL_WOWLAN_WAKEUP_LINK_CHANGE bit. We have to set that
+                 * reason bit since losing the connection to the AP implies
+                 * losing the TCP connection.
+                 * Set the flags anyway as long as they exist, in case this
+                 * will be changed in the firmware.
+                 */
+                wowlan_config_cmd.wakeup_filter |=
+                        cpu_to_le32(IWL_WOWLAN_WAKEUP_REMOTE_LINK_LOSS |
+                                    IWL_WOWLAN_WAKEUP_REMOTE_SIGNATURE_TABLE |
+                                    IWL_WOWLAN_WAKEUP_REMOTE_WAKEUP_PACKET |
+                                    IWL_WOWLAN_WAKEUP_LINK_CHANGE);
+        }
+
         iwl_mvm_cancel_scan(mvm);
 
         iwl_trans_stop_device(mvm->trans);
@@ -649,6 +904,11 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         /* We reprogram keys and shouldn't allocate new key indices */
         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
 
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+
         /*
          * The D3 firmware still hardcodes the AP station ID for the
          * BSS we're associated with as 0. As a result, we have to move
@@ -740,6 +1000,10 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         if (ret)
                 goto out;
 
+        ret = iwl_mvm_send_remote_wake_cfg(mvm, vif, wowlan->tcp);
+        if (ret)
+                goto out;
+
         /* must be last -- this switches firmware state */
         ret = iwl_mvm_send_cmd_pdu(mvm, D3_CONFIG_CMD, CMD_SYNC,
                                    sizeof(d3_cfg_cmd), &d3_cfg_cmd);
@@ -783,7 +1047,6 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         struct iwl_wowlan_status *status;
         u32 reasons;
         int ret, len;
-        bool pkt8023 = false;
         struct sk_buff *pkt = NULL;
 
         iwl_trans_read_mem_bytes(mvm->trans, base,
@@ -824,7 +1087,8 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         status = (void *)cmd.resp_pkt->data;
 
         if (len - sizeof(struct iwl_cmd_header) !=
-            sizeof(*status) + le32_to_cpu(status->wake_packet_bufsize)) {
+            sizeof(*status) +
+            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                 goto out;
         }
@@ -836,61 +1100,105 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                 goto report;
         }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET)
                 wakeup.magic_pkt = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN)
                 wakeup.pattern_idx =
                         le16_to_cpu(status->pattern_number);
-                pkt8023 = true;
-        }
 
         if (reasons & (IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_MISSED_BEACON |
                        IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_DEAUTH))
                 wakeup.disconnect = true;
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE)
                 wakeup.gtk_rekey_failure = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED)
                 wakeup.rfkill_release = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST)
                 wakeup.eap_identity_req = true;
-                pkt8023 = true;
-        }
 
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE)
                 wakeup.four_way_handshake = true;
-                pkt8023 = true;
-        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_REM_WAKE_LINK_LOSS)
+                wakeup.tcp_connlost = true;
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_REM_WAKE_SIGNATURE_TABLE)
+                wakeup.tcp_nomoretokens = true;
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_REM_WAKE_WAKEUP_PACKET)
+                wakeup.tcp_match = true;
 
         if (status->wake_packet_bufsize) {
-                u32 pktsize = le32_to_cpu(status->wake_packet_bufsize);
-                u32 pktlen = le32_to_cpu(status->wake_packet_length);
+                int pktsize = le32_to_cpu(status->wake_packet_bufsize);
+                int pktlen = le32_to_cpu(status->wake_packet_length);
+                const u8 *pktdata = status->wake_packet;
+                struct ieee80211_hdr *hdr = (void *)pktdata;
+                int truncated = pktlen - pktsize;
+
+                /* this would be a firmware bug */
+                if (WARN_ON_ONCE(truncated < 0))
+                        truncated = 0;
+
+                if (ieee80211_is_data(hdr->frame_control)) {
+                        int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+                        int ivlen = 0, icvlen = 4; /* also FCS */
 
-                if (pkt8023) {
                         pkt = alloc_skb(pktsize, GFP_KERNEL);
                         if (!pkt)
                                 goto report;
-                        memcpy(skb_put(pkt, pktsize), status->wake_packet,
-                               pktsize);
+
+                        memcpy(skb_put(pkt, hdrlen), pktdata, hdrlen);
+                        pktdata += hdrlen;
+                        pktsize -= hdrlen;
+
+                        if (ieee80211_has_protected(hdr->frame_control)) {
+                                if (is_multicast_ether_addr(hdr->addr1)) {
+                                        ivlen = mvm->gtk_ivlen;
+                                        icvlen += mvm->gtk_icvlen;
+                                } else {
+                                        ivlen = mvm->ptk_ivlen;
+                                        icvlen += mvm->ptk_icvlen;
+                                }
+                        }
+
+                        /* if truncated, FCS/ICV is (partially) gone */
+                        if (truncated >= icvlen) {
+                                icvlen = 0;
+                                truncated -= icvlen;
+                        } else {
+                                icvlen -= truncated;
+                                truncated = 0;
+                        }
+
+                        pktsize -= ivlen + icvlen;
+                        pktdata += ivlen;
+
+                        memcpy(skb_put(pkt, pktsize), pktdata, pktsize);
+
                         if (ieee80211_data_to_8023(pkt, vif->addr, vif->type))
                                 goto report;
                         wakeup.packet = pkt->data;
                         wakeup.packet_present_len = pkt->len;
-                        wakeup.packet_len = pkt->len - (pktlen - pktsize);
+                        wakeup.packet_len = pkt->len - truncated;
                         wakeup.packet_80211 = false;
                 } else {
+                        int fcslen = 4;
+
+                        if (truncated >= 4) {
+                                truncated -= 4;
+                                fcslen = 0;
+                        } else {
+                                fcslen -= truncated;
+                                truncated = 0;
+                        }
+                        pktsize -= fcslen;
                         wakeup.packet = status->wake_packet;
                         wakeup.packet_present_len = pktsize;
-                        wakeup.packet_len = pktlen;
+                        wakeup.packet_len = pktlen - truncated;
                         wakeup.packet_80211 = true;
                 }
         }