- 10 Jul, 2024 1 commit
-
-
Benjamin Berg authored
The code got copied from get_workaround_page, but here p->page is the correct way to reference the page. Signed-off-by:
Benjamin Berg <benjamin.berg@intel.com> Fixes: adc902ce ("wifi: iwlwifi: keep the TSO and workaround pages mapped") Reported-by:
kernel test robot <lkp@intel.com> Reported-by:
Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202407062135.NNjnmMdR-lkp@intel.com/ Link: https://patch.msgid.link/20240709123149.1848315-1-benjamin@sipsolutions.netSigned-off-by:
Johannes Berg <johannes.berg@intel.com>
-
- 09 Jul, 2024 14 commits
-
-
https://github.com/pkshih/rtwKalle Valo authored
rtw-next patches for v6.11 Some cleanups of rtl8xxxu and rtlwifi, and some fixes of rtw88. The major change is to develop WoWLAN and preparation of RTL8852BE-VT listed below: rtw89: - preparation of RTL8852BE-VT * add RF calibration code * move shared code with RTL8852BE to common module - add WoWLAN for WiFi 6 chips - support 36-bit PCI DMA -
Chen Ni authored
Replace kmalloc() + memset() to kzalloc() for better code readability and simplicity. Signed-off-by:
Chen Ni <nichen@iscas.ac.cn> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://patch.msgid.link/20240704090622.2260102-1-nichen@iscas.ac.cn
-
Sascha Hauer authored
mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]--- Signed-off-by:Sascha Hauer <s.hauer@pengutronix.de> Acked-by:
Brian Norris <briannorris@chromium.org> Reviewed-by:
Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by:
-
Felix Fietkau authored
This registers one wiphy radio per supported band. Number of different channels is set per radio. Signed-off-by:
Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/3a16838bb7a7d1a072bd7c9d586d17f70fcd8a60.1720514221.git-series.nbd@nbd.nameSigned-off-by:
-
Felix Fietkau authored
Validate number of channels and interface combinations per radio. Assign each channel context to a radio. Signed-off-by:
-
Felix Fietkau authored
Reduces indentation in preparation for further changes Signed-off-by:
-
Felix Fietkau authored
Add support for counting global and per-radio max/current number of channels, as well as checking radio-specific interface combinations. Signed-off-by:
-
Felix Fietkau authored
Will be used to explicitly assign a channel context to a wiphy radio. Signed-off-by:
-
Felix Fietkau authored
DFS can be supported with multi-channel combinations, as long as each DFS capable radio only supports one channel. Signed-off-by:
-
Felix Fietkau authored
Check if the full channel width is in the radio's frequency range. Signed-off-by:
-
Felix Fietkau authored
Add a field in struct iface_combination_params to check per-radio interface combinations instead of per-wiphy ones. Signed-off-by:
-
Felix Fietkau authored
The prerequisite for MLO support in cfg80211/mac80211 is that all the links participating in MLO must be from the same wiphy/ieee80211_hw. To meet this expectation, some drivers may need to group multiple discrete hardware each acting as a link in MLO under single wiphy. With this change, supported frequencies and interface combinations of each individual radio are reported to user space. This allows user space to figure out the limitations of what combination of channels can be used concurrently. Even for non-MLO devices, this improves support for devices capable of running on multiple channels at the same time. Signed-off-by:
-
Zong-Zhe Yang authored
Chanctx emulation didn't info IEEE80211_CONF_CHANGE_CHANNEL to drivers during ieee80211_restart_hw (ieee80211_emulate_add_chanctx). It caused non-chanctx drivers to not stand on the correct channel after recovery. RX then behaved abnormally. Finally, disconnection/reconnection occurred. So, set IEEE80211_CONF_CHANGE_CHANNEL when in_reconfig. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Link: https://patch.msgid.link/20240709073531.30565-1-kevin_yang@realtek.com Cc: stable@vger.kernel.org Fixes: 0a44dfc0 ("wifi: mac80211: simplify non-chanctx drivers") Signed-off-by:
-
Johannes Berg authored
Looks like not all compilers allow strlen(constant) as a constant, so don't do that. Instead, revert back to defining the length as the first submission had it. Fixes: b5d14b0c ("wifi: virt_wifi: avoid reporting connection success with wrong SSID") Reported-by:
-
- 08 Jul, 2024 6 commits
-
-
Johannes Berg authored
WARN_ON("string") will unconditionally trigger a warning, but not really do what it may look like. Use WARN(1, ...) instead and add the mode number as well. Signed-off-by: -
Michael-CY Lee authored
Do not check BSS color collision in following cases 1. already under a color change 2. color change is disabled Signed-off-by:
Michael-CY Lee <michael-cy.lee@mediatek.com> Link: https://patch.msgid.link/20240705074346.11228-1-michael-cy.lee@mediatek.comSigned-off-by:
-
Michael-CY Lee authored
The color change finalize work might be called after the link is stopped, which might lead to a kernel crash. Signed-off-by:
-
En-Wei Wu authored
When user issues a connection with a different SSID than the one virt_wifi has advertised, the __cfg80211_connect_result() will trigger the warning: WARN_ON(bss_not_found). The issue is because the connection code in virt_wifi does not check the SSID from user space (it only checks the BSSID), and virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS even if the SSID is different from the one virt_wifi has advertised. Eventually cfg80211 won't be able to find the cfg80211_bss and generate the warning. Fixed it by checking the SSID (from user space) in the connection code. Fixes: c7cdba31 ("mac80211-next: rtnetlink wifi simulation device") Reported-by: syzbot+d6eb9cee2885ec06f5e3@syzkaller.appspotmail.com Signed-off-by:
En-Wei Wu <en-wei.wu@canonical.com> Link: https://patch.msgid.link/20240705023756.10954-1-en-wei.wu@canonical.comSigned-off-by:
-
Felix Fietkau authored
Avoid reusing stale driver data when an interface is brought down and up again. In order to avoid having to duplicate the memset in every single driver, do it here. Signed-off-by:
-
Felix Fietkau authored
Create a helper function that puts the data from struct ieee80211_iface_combination to a nl80211 message. This will be used for adding per-radio interface combination data. Signed-off-by:
-
- 05 Jul, 2024 7 commits
-
-
Aleksandr Mishin authored
In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size. But then 'rate->he_gi' is used as array index instead of 'status->he_gi'. This can lead to go beyond array boundaries in case of 'rate->he_gi' is not equal to 'status->he_gi' and is bigger than array size. Looks like "copy-paste" mistake. Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e3ec7017 ("rtw89: add Realtek 802.11ax driver") Signed-off-by:
Aleksandr Mishin <amishin@t-argos.ru> Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20240703210510.11089-1-amishin@t-argos.ru
-
Fredrik Lönnegren authored
Change 'defult' to 'default' in comments in several rtlwifi drivers. Signed-off-by:
Fredrik Lönnegren <fredrik@frelon.se> Acked-by:
-
Zong-Zhe Yang authored
Driver will notify FW the target index of RFK table to use at some moments. When MCC (multi-channel concurrent), the correctness of the notification is especially important. We now unify the selection logic of RFK table as below among chips. 1. check each table if it matches target channel 2. check all tables if any is idle by iterating active channels 3. replace the first table if all are busy unexpectedly Signed-off-by:
-
Zong-Zhe Yang authored
MRC (multi-role concurrency) has a C2H event for status report. Newer FW will report some kinds of failures. We parse them now and show by debug log. Signed-off-by:
-
Ping-Ke Shih authored
For 8852BT, the initial settings of BT-coexistence is a little bit different, so add the extra handles. Signed-off-by:
-
Ping-Ke Shih authored
The BT coexistence part of 8852B and 8852BT are similar, so move shared code into common module. Don't change logic for existing RTL8852BE. Signed-off-by:
-
Marcin Ślusarz authored
Right now it's possible to hit NULL pointer dereference in rtw_rx_fill_rx_status on hw object and/or its fields because initialization routine can start getting USB replies before rtw_dev is fully setup. The stack trace looks like this: rtw_rx_fill_rx_status rtw8821c_query_rx_desc rtw_usb_rx_handler ... queue_work rtw_usb_read_port_complete ... usb_submit_urb rtw_usb_rx_resubmit rtw_usb_init_rx rtw_usb_probe So while we do the async stuff rtw_usb_probe continues and calls rtw_register_hw, which does all kinds of initialization (e.g. via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on. Fix this by moving the first usb_submit_urb after everything is set up. For me, this bug manifested as: [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status because I'm using Larry's backport of rtw88 driver with the NULL checks in rtw_rx_fill_rx_status. Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@mail.gmail.com/Signed-off-by:
Marcin Ślusarz <mslusarz@renau.com> Cc: Tim K <tpkuester@gmail.com> Cc: Ping-Ke Shih <pkshih@realtek.com> Cc: Larry Finger <Larry.Finger@lwfinger.net> Cc: Kalle Valo <kvalo@kernel.org> Cc: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by:
-
- 04 Jul, 2024 12 commits
-
-
Miri Korenblit authored
MLO was temporarily disabled by commit 5f404005 ("wifi: iwlwifi: mvm: disable MLO for the time being"), until it will stabilize. Now, that all the bugs were fixed and the minimum FW version was bumped to a stable one, we can re-enable MLO back. Signed-off-by:
Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20240703132713.8f77a71c3902.Ib302054cbd8fba82db97eb5298b2aaf8bbe106df@changeidSigned-off-by:
-
Anjaneyulu authored
Add support for activate/deactivate unii4 in USA, Canada and WW by reading DSM function 8 from UEFI or ACPI and sending it to the FW. Signed-off-by:
Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Signed-off-by:
-
Mukesh Sisodiya authored
Debug logs related to reset_fw are logged with all notification/response and polluting the trace. Remove the debug message related to reset_fw setting when dump is collected. Signed-off-by:
Mukesh Sisodiya <mukesh.sisodiya@intel.com> Signed-off-by:
-
Johannes Berg authored
Many iwl_mvm_vif members are not documented, add that. Signed-off-by:
-
Johannes Berg authored
The v1/v3 remaining bits are not annotated in kernel-doc, fix that. Signed-off-by:
-
Johannes Berg authored
This is not documented correctly, fix it. Signed-off-by:
-
Johannes Berg authored
Document the puncture_mask field in the PHY context. Signed-off-by:
-
Johannes Berg authored
Fix kernel-doc for MAC context APIs. Signed-off-by:
-
Johannes Berg authored
Add the missing special_mem union member and use constant formatting (%) for the type constants. Signed-off-by:
-
Johannes Berg authored
This should be labeled for the debug output, add the missing string. Signed-off-by:
-
Benjamin Berg authored
Much of the work during reclaim can be done without holding the TXQ lock and releasing the lock means that command submission can happen at the same time. Add a new reclaim_lock to prevent parallel cleanup. Release the lock while working with an internal copy of the txq->read_ptr and only take the lock again when updating the read pointer after the cleanup is done. Signed-off-by:
-
Benjamin Berg authored
During reclaim, we may release the txq->lock spinlock in order to call iwl_trans_tx to queue new frames. The iwl_trans_tx function expects to be called with BHs disabled and iwl_pcie_reclaim is most of the times called with BHs disabled already. However, reclaim can also happen after flushing a STA and in that case BHs will not be disabled. Solve this corner case by only releasing the spinlock but keeping BHs disabled. Signed-off-by:
-
