- 23 Apr, 2022 6 commits
-
-
Dan Carpenter authored
The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' Fixes: 4ed1a8d4 ("ath9k_htc: use ath9k_cmn_rx_accept") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Acked-by:
Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by:
Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220409061225.GA5447@kili
-
Minghao Chi authored
Using pm_runtime_resume_and_get() is more appropriate for simplifing code. Reported-by:
Zeal Robot <zealci@zte.com.cn> Signed-off-by:
Minghao Chi <chi.minghao@zte.com.cn> Signed-off-by:
-
YueHaibing authored
drivers/net/wireless/ath/ath11k/mac.c:8175:13: error: ‘ath11k_mac_op_ipv6_changed’ defined but not used [-Werror=unused-function] static void ath11k_mac_op_ipv6_changed(struct ieee80211_hw *hw, ^~~~~~~~~~~~~~~~~~~~~~~~~~ Wrap it with #ifdef block to fix this. Fixes: c3c36bfe ("ath11k: support ARP and NS offload") Signed-off-by:YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Yang Yingliang authored
Add the missing unlock before return from function ath11k_wow_op_resume() in the error handling case. Fixes: 90bf5c8d ("ath11k: purge rx pktlog when entering WoW") Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com> Signed-off-by:
-
Baochen Qiang authored
Add ath11k_mac_op_set_bios_sar_specs() to ath11k_ops, this function is called when user space application calls NL80211_CMD_SET_SAR_SPECS. ath11k also registers SAR type and frequency ranges to wiphy so user space can query SAR capabilities. This feature is currently enabled for WCN6855. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-02431-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by:
Baochen Qiang <quic_bqiang@quicinc.com> Signed-off-by:
-
Wen Gong authored
When the WMI service bits are reported from firmware they are divided into multiple segments, with 128 bits in each segment. The first segment is processed by ath11k_wmi_service_bitmap_copy(), the second segment is processed by ath11k_service_available_event() with WMI_TAG_SERVICE_AVAILABLE_EVENT. When the service bit exceed 256 bits, then firmware reports it by tag WMI_TAG_ARRAY_UINT32 in WMI_SERVICE_AVAILABLE_EVENTID. Currently ath11k does not process the third segment. Upcoming features need to know if firmware support is available for the features, so add processing of the third segment. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Signed-off-by:
-
- 12 Apr, 2022 4 commits
-
-
Yang Li authored
The print function dev_err() is redundant because platform_get_irq_byname() already prints an error. Eliminate the follow coccicheck warning: ./drivers/net/wireless/ath/ath9k/ahb.c:103:2-9: line 103 is redundant because platform_get_irq() already prints an error Reported-by:
Abaci Robot <abaci@linux.alibaba.com> Signed-off-by:
Yang Li <yang.lee@linux.alibaba.com> Acked-by:
-
Yang Li authored
Eliminate the follow smatch warning: drivers/net/wireless/ath/wcn36xx/smd.c:3151 wcn36xx_smd_gtk_offload_get_info_rsp() warn: inconsistent indenting Reported-by:
Loic Poulain <loic.poulain@linaro.org> Signed-off-by:
-
Colin Ian King authored
There is a spelling mistake in an ath11k_warn message. Fix it. Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Signed-off-by:
-
Peter Seiderer authored
Stop reading (and copying) from ieee80211_tx_rate to ath_tx_info.rates after list end tag (count == 0, idx < 0), prevents copying of garbage to card registers. Note: no need to write to the remaining ath_tx_info.rates entries as the complete ath_tx_info struct is already initialized to zero from both call sites. Signed-off-by:
Peter Seiderer <ps.report@gmx.net> Acked-by:
-
- 06 Apr, 2022 28 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo authored
ath.git patches for v5.19. Major changes: ath11k * Wake-on-WLAN support for QCA6390 and WCN6855 * device recovery (firmware restart) support for QCA6390 and WCN6855 wcn36xx * support for transmit rate reporting to user space
-
Kalle Valo authored
No need to have goto for a return statement, so simplify the code. While at it, print warning messages if power up calls fail. No functional changes. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Signed-off-by:
-
Kalle Valo authored
While reviewing the mhi.c I noticed we were just ignoring the errors coming from MHI subsystem during suspend and resume. Add proper checks and warning messages. Also pass the error value to callers. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Signed-off-by:
-
Kalle Valo authored
State machines are difficult to understand and in this case it's just useless, which is shown by the diffstat. So remove it entirely to make the code simpler. No functional changes. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Signed-off-by:
-
Ping-Ke Shih authored
The smatch reports: rtw8852a.c:1857 rtw8852a_btc_set_wl_txpwr_ctrl() error: uninitialized symbol '_cur'. rtw8852a.c:1858 rtw8852a_btc_set_wl_txpwr_ctrl() error: uninitialized symbol '_cur'. This is because rtw89_mac_txpwr_read32() can possibly return before setting argument _cur, and the caller will use the uninitialized value. To fix this problem, check the return value of rtw89_mac_txpwr_read32(). Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220318035202.42437-1-pkshih@realtek.com
-
Ping-Ke Shih authored
8852C uses different fields to represent RX bandwidth. Since other fields are the same, I check chip_id to get bandwidth instead of creating another v1 function. Signed-off-by:
-
Ping-Ke Shih authored
The newer chip will generate security header itself, so don't set IEEE80211_KEY_FLAG_GENERATE_IV in this kind of chip. But, it needs to fill key_index, PN and 802.11 header length to TX descriptor, and then hardware uses these to generate security header. Signed-off-by:
-
Ping-Ke Shih authored
The txdesc is descriptor related to skb->data. The v1 version contains 8 dwords txwd_body and 6 dwords txwd_info, and the format is also different from original one. Signed-off-by:
-
Ping-Ke Shih authored
The txaddr_info is used to fill the DMA address of skb->data. The v1 version can support up to 10 entries, but the maximum size of each entry is 2047, so it fill more than one entry for large packet, like 3000 bytes. Signed-off-by:
-
Ping-Ke Shih authored
8852A and 8852C use different H2C header and size, so add h2c_desc_size to allocate different header size and fill content by fill_txdesc_fwcmd. Signed-off-by:
-
Johnson Lin authored
Bypass IGI, known as Rx gain, adjustment flow for incompatible hardware architectures. Signed-off-by:
Johnson Lin <johnson.lin@realtek.com> Signed-off-by:
-
Johnson Lin authored
Refinement of DIG flow, a mechanism to adjust Rx gain for better Rx performance, by packing IGI(initial gain index) configuration flow into one function. Signed-off-by:
-
Zong-Zhe Yang authored
Update notes: Configure rtw89_regulatory for 6G band according to country. Adjust country GB to use RTW89_UK entry on all bands. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Zong-Zhe Yang authored
Wrap regd debug dump into a macro and add dump for 6G band field. Extend the macro used to configure regd table to account for multiple bands beyond 2G and 5G. And the follow-up commit will configure the corresponding values for 6G band into regd table. Signed-off-by:
-
Zong-Zhe Yang authored
Update notes: TX power by rate table is not changed. TX power limit table configures values for UK. TX power limit RU table configures values for UK. Signed-off-by:
-
Zong-Zhe Yang authored
Add RTW89_UK to enum rtw89_regulation_type. The follow-up commit will configure the corresponding values for it to TX power tables. Signed-off-by:
-
Ping-Ke Shih authored
An export symbol costs about 40 bytes (in x86 with gcc), so use a structure containing these small arrays to reduce code size. text data bss dec hex filename 34932 1410 0 36342 8df6 mac.o (before) 34276 1258 0 35534 8ace mac.o (after) Signed-off-by:
-
Zong-Zhe Yang authored
Originally, there is already a mechanism, SER (system error recover), to deal with HW/FW recovery. After FW v0.13.36.0, FW supports a H2C (host to chip) command to make a CPU exception. Then, SER is supposed to catch this FW crash and do L2 reset. This feature is a simulation to verify if flow of recovering from FW crash works. Usage of fw_crash debugfs is as the following. $ echo 1 > fw_crash // trigger FW crash and wait SER handling $ cat fw_crash // return 0 if restart has been done Signed-off-by:
-
Zong-Zhe Yang authored
As the fw features gradually increase, it would be better that we have a set of methods to maintain fw features instead of using scattered bool variables. We reconstruct the way fw recognize features, and introduce RTW89_CHK_FW_FEATURE() / RTW89_SET_FW_FEATURE() to check / set fw features for uses. Signed-off-by:
-
Zong-Zhe Yang authored
Read FW backtrace entry through FW reserved payload engine, and then add FW backtrace dump during SER (system error recover) L2 reset process. It contains a list of RA (return address) and SP (stack pointer) which gives us a chance to trace back the call stack of FW. Moreover, if core dump might have wrong content due to error during dumping, we won't invoke device core dump framework. For this case, rtw89_ser_cd_free() is added to free buffer by ourselves. Signed-off-by:
-
Zong-Zhe Yang authored
When FW encounters exception or assertion, SER L2 reset process will start. It will dump some error information and re-download FW eventually. Since such errors are usually critical, we would like to keep more information about error to increase possibility of analysis and debugging FW. We first add FW payload engine (fw reserved playoad engine, fw_rsvd_ple) memory dump. FW will record things like CPU registers, backtrace entry, etc. in it for debugging. Moreover, device core dump framework is used and wrapped to collect kinds of dumps during SER L2 reset process. Signed-off-by:
-
Zong-Zhe Yang authored
While SER (system error recover) is processing, it's supposed to mean something is under recovery. So, disable interrupts (excluding the one of halt which could be used during SER) to avoid unexpected behavior. And then, enable interrupts after SER is done. Signed-off-by:
-
Zong-Zhe Yang authored
The raw error code might combine error scenario and error status. But, the error scenario isn't parsed previously. It makes us mishandle cpu exception and assertion. Now, we correct the error status for them. Besides, a few uses of error status are refined. Signed-off-by:
-
Zong-Zhe Yang authored
Previously, mac_mem_base_addr_table was declared in debug.c locally because it's only used via debugfs to dump mac memory. Now, we plan to refine SER (system error recover) flow which will also need to dump mac memory to somewhere as information for error which is catched. So, we move mac_mem_base_addr_table to mac.c rtw89_mac_mem_base_addrs earlier as common code. (no logic is changed) Signed-off-by:
-
Zong-Zhe Yang authored
The CAM, meaning address CAM and bssid CAM here, will get leaks during SER (system error recover) L2 reset process and ieee80211_restart_hw() which is called by L2 reset process eventually. The normal flow would be like -> add interface (acquire 1) -> enter ips (release 1) -> leave ips (acquire 1) -> connection (occupy 1) <(A) 1 leak after L2 reset if non-sec connection> The ieee80211_restart_hw() flow (under connection) -> ieee80211 reconfig -> add interface (acquire 1) -> leave ips (acquire 1) -> connection (occupy (A) + 2) <(B) 1 more leak> Originally, CAM is released before HW restart only if connection is under security. Now, release CAM whatever connection it is to fix leak in (A). OTOH, check if CAM is already valid to avoid acquiring multiple times to fix (B). Besides, if AP mode, release address CAM of all stations before HW restart. Signed-off-by:
-
Po-Hao Huang authored
Previously we only consider single interface's status, idle mode behavior could be unexpected when multiple interfaces is active. Change to enter/leave idle mode by mac80211's configuration state. Signed-off-by:
Po-Hao Huang <phhuang@realtek.com> Signed-off-by:
-
Gustavo A. R. Silva authored
There is a regular need in the kernel to provide a way to declare having a dynamically sized set of trailing elements in a structure. Kernel code should always use “flexible array members”[1] for these cases. The older style of one-element or zero-length arrays should no longer be used[2]. [1] https://en.wikipedia.org/wiki/Flexible_array_member [2] https://www.kernel.org/doc/html/v5.16/process/deprecated.html#zero-length-and-one-element-arrays Link: https://github.com/KSPP/linux/issues/78Signed-off-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by:
Kees Cook <keescook@chromium.org> Acked-by:
Luca Coelho <luciano.coelho@intel.com> Signed-off-by:
-
Gustavo A. R. Silva authored
There is a regular need in the kernel to provide a way to declare having a dynamically sized set of trailing elements in a structure. Kernel code should always use “flexible array members”[1] for these cases. The older style of one-element or zero-length arrays should no longer be used[2]. [1] https://en.wikipedia.org/wiki/Flexible_array_member [2] https://www.kernel.org/doc/html/v5.16/process/deprecated.html#zero-length-and-one-element-arrays Link: https://github.com/KSPP/linux/issues/78Signed-off-by:
-
- 05 Apr, 2022 2 commits
-
-
Johannes Berg authored
In [1], Will raised a potential issue that the cfg80211 code, which does (from a locking perspective) rtnl_lock() wiphy_lock() rtnl_unlock() might be suspectible to ABBA deadlocks, because rtnl_unlock() calls netdev_run_todo(), which might end up calling rtnl_lock() again, which could then deadlock (see the comment in the code added here for the scenario). Some back and forth and thinking ensued, but clearly this can't happen if the net_todo_list is empty at the rtnl_unlock() here. Clearly, the code here cannot actually put an entry on it, and all other users of rtnl_unlock() will empty it since that will always go through netdev_run_todo(), emptying the list. So the only other way to get there would be to add to the list and then unlock the RTNL without going through rtnl_unlock(), which is only possible through __rtnl_unlock(). However, this isn't exported and not used in many places, and none of them seem to be able to unregister before using it. Therefore, add a WARN_ON() in the code to ensure this invariant won't be broken, so that the cfg80211 (or any similar) code stays safe. [1] https://lore.kernel.org/r/Yjzpo3TfZxtKPMAG@google.comSigned-off-by:
Johannes Berg <johannes.berg@intel.com> Link: https://lore.kernel.org/r/20220404113847.0ee02e4a70da.Ic73d206e217db20fd22dcec14fe5442ca732804b@changeidSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Tom Rix authored
The setting of i here err_nexthop6_group_get: i = nrt6; Is redundant, i is already nrt6. So remove this statement. The for loop for the unwinding err_rt6_create: for (i--; i >= 0; i--) { Is equivelent to for (; i > 0; i--) { Two consecutive labels can be reduced to one. Signed-off-by:Tom Rix <trix@redhat.com> Reviewed-by:
Ido Schimmel <idosch@nvidia.com> Link: https://lore.kernel.org/r/20220402121516.2750284-1-trix@redhat.comSigned-off-by:
-
