- 25 Oct, 2023 6 commits
-
-
Johan Hovold authored
The ath11k active pdevs are protected by RCU but the DFS radar event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. Fixes: d5c65159 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Acked-by:
Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by:
Johan Hovold <johan+linaro@kernel.org> Signed-off-by:
Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20231019153115.26401-3-johan+linaro@kernel.org
-
Johan Hovold authored
The ath11k active pdevs are protected by RCU but the temperature event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section as reported by RCU lockdep: ============================= WARNING: suspicious RCU usage 6.6.0-rc6 #7 Not tainted ----------------------------- drivers/net/wireless/ath/ath11k/mac.c:638 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by swapper/0/0. ... Call trace: ... lockdep_rcu_suspicious+0x16c/0x22c ath11k_mac_get_ar_by_pdev_id+0x194/0x1b0 [ath11k] ath11k_wmi_tlv_op_rx+0xa84/0x2c1c [ath11k] ath11k_htc_rx_completion_handler+0x388/0x510 [ath11k] Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 Fixes: a41d1034 ("ath11k: add thermal sensor device support") Cc: stable@vger.kernel.org # 5.7 Signed-off-by:
-
Karthikeyan Periyasamy authored
In PCI and HAL interface layer module, the identifier sc is used to represent an instance of ath12k_base structure. However, within ath12k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of sc to ab. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00125-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Karthikeyan Periyasamy <quic_periyasa@quicinc.com> Acked-by:
-
Karthikeyan Periyasamy authored
In WMI layer module, the identifier wmi_sc is used to represent an instance of ath12k_wmi_base structure. However, within ath12k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of wmi_sc to wmi_ab. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00125-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Anilkumar Kolli authored
Firmware IE containers can dynamically provide various information what firmware supports. Also it can embed more than one image so updating firmware is easy, user just needs to update one file in /lib/firmware/. The firmware API 2 or higher will use the IE container format, the current API 1 will not use the new format but it still is supported for some time. Firmware API 2 files are named as firmware-2.bin (which contains both amss.bin and m3.bin images) and API 1 files are amss.bin and m3.bin. Currently ath11k PCI driver provides firmware binary (amss.bin) path to MHI driver, MHI driver reads firmware from filesystem and boots it. Add provision to read firmware files from ath11k driver and provide the amss.bin firmware data and size to MHI using a pointer. Currently enum ath11k_fw_features is empty, the patches adding features will add the flags. With AHB devices there's no amss.bin or m3.bin, so no changes in how AHB firmware files are used. But AHB devices can use future additions to the meta data, for example in enum ath11k_fw_features. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Co-developed-by:
P Praneesh <quic_ppranees@quicinc.com> Signed-off-by:
Anilkumar Kolli <quic_akolli@quicinc.com> Co-developed-by:
-
Kalle Valo authored
Simple refactoring to make it easier to add firmware-2.bin support in the following patch. Earlier ath11k_qmi_m3_load() supported changing m3.bin contents while ath11k is running. But that's not going to actually work, m3.bin is supposed to be the same during the lifetime of ath11k, for example we don't support changing the firmware capabilities on the fly. Due to this ath11k requests m3.bin firmware file first and only then checks m3_mem->vaddr, so we are basically requesting the firmware file even if it's not needed. Reverse the code so that m3_mem buffer is checked first, and only if it doesn't exist, then m3.bin is requested from user space. Checking for m3_mem->size is redundant when m3_mem->vaddr is NULL, we would not be able to use the buffer in that case. So remove the check for size. Simplify the exit handling and use 'goto out'. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Signed-off-by:
-
- 18 Oct, 2023 9 commits
-
-
Karthikeyan Periyasamy authored
In PCI, thermal and HAL interface layer module, the identifier sc is used to represent an instance of ath11k_base structure. However, within ath11k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of sc to ab. Compile tested only. Signed-off-by:
-
Karthikeyan Periyasamy authored
In WMI layer module, the identifier wmi_sc is used to represent an instance of ath11k_wmi_base structure. However, within ath11k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of wmi_sc to wmi_ab. Compile tested only. Signed-off-by:
-
Justin Stitt authored
strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous interfaces. The affected code's purpose is to truncate strings that are too long with "..." like: foobar -> fo... The lengths have been carefully calculated and as such this has decayed to a simple byte copy from one buffer to another -- let's use memcpy(). Note: build-tested only. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by:
Justin Stitt <justinstitt@google.com> Signed-off-by:
-
Justin Stitt authored
strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. We expect led->name to be NUL-terminated based on the presence of a manual NUL-byte assignment. This NUL-byte assignment was added in Commit daf9669b ("ath5k: ensure led name is null terminated"). If strscpy() had existed and had been used back when this code was written then potential bugs and the need to manually NUL-terminate could have been avoided. Since we now have the technology, let's use it :) Considering the above, a suitable replacement is `strscpy` [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. If NUL-padding is required let's opt for strscpy_pad(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by:
-
Jeff Johnson authored
Currently struct ath12k_base defines the member bd_api. However, this member is only accessed within ath12k_core_fetch_bdf(). Since the scope is local just to that one function, remove it from ath12k_base and instead just use a local stack variable. No functional changes, compile tested only. Signed-off-by:
-
Jeff Johnson authored
Currently struct ath11k_base defines the member bd_api. However, this member is only accessed within ath11k_core_fetch_bdf(). Since the scope is local just to that one function, remove it from ath11k_base and instead just use a local stack variable. No functional changes, compile tested only. Signed-off-by:
-
Ramya Gnanasekar authored
Currently QCN9274 supports only AP and station interface modes. Add interface type mesh to ath12k_hw_params for QCN9274 to provide support for mesh mode as well. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-02903-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Ramya Gnanasekar <quic_rgnanase@quicinc.com> Acked-by:
-
Ramya Gnanasekar authored
The capabilities for the EHT mesh are generated from the capabilities reported by the firmware. But the firmware only reports the overall capabilities and not the one which are specific for mesh. Capabilities which requires infrastructure setup with a main STA(AP) controlling operations are not needed for mesh and hence remove these capabilities from the list. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-02903-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Rob Herring authored
Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
- 12 Oct, 2023 8 commits
-
-
Jeff Johnson authored
Currently, the logic to return an ath11k_sta pointer, given a ieee80211_sta pointer, uses typecasting throughout the driver. In general, conversion functions are preferable to typecasting since using a conversion function allows the compiler to validate the types of both the input and output parameters. ath11k already defines a conversion function ath11k_vif_to_arvif() for a similar conversion. So introduce ath11k_sta_to_arsta() for this use case, and convert all of the existing typecasting to use this function. No functional changes, compile tested only. Signed-off-by:
-
Jeff Johnson authored
struct ath11k_htc_frame is unused, and since it illogically contains two consecutive flexible arrays, it could never be used, so remove it. No functional changes, compile tested only. Signed-off-by:
-
Wen Gong authored
This is to fix m3 buffer reuse issue as m3_mem->size isn't set to zero in the free function, which leads invalid m3 downloading to firmware and firmware crashing. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Signed-off-by:
-
Wen Gong authored
ath12k_qmi_free_target_mem_chunk() and ath12k_qmi_m3_free() is static in qmi.c, they are needed for recovery, export them in a new function Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by:
-
Wen Gong authored
RDDM is Ram Dump Debug Module which is used to debug issues when the firmware encounters an error. The rddm_size is needed by the firmware while MHI goes to the RDDM state. Provide the size to MHI subsystem so that the firmware restart works when the firmware crashes. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by:
-
Aditya Kumar Singh authored
Certain regulatory domains could put restrictions on phy mode operation. For example, in a few countries HE/EHT Operation is not allowed. For such countries, firmware indicates this via phy bitmap in each reg rule. Currently, there is no logic to parse this info and then pass it on to the cfg80211/regulatory. Add parsing of this phy bitmap from the regulatory channel change event and then accordingly map it to cfg80211/regulatory flags and pass it on to it. While at it, correct typo in debug print: s/dsf/dfs. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Aditya Kumar Singh <quic_adisi@quicinc.com> Acked-by:
-
Aditya Kumar Singh authored
Certain regulatory domains could put restrictions on phy mode operation. For example, in a few countries HE Operation is not allowed. For such countries, firmware indicates this via phy bitmap in each reg rule. Currently, there is no logic to parse this info and then pass it on to the cfg80211/regulatory. Add parsing of this phy bitmap from the regulatory channel change event and then accordingly map it to cfg80211/regulatory flags and pass it on to it. While at it, correct typo in debug print s/dsf/dfs. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Kalle Valo authored
In v6.6-rc4 with GCC 13.2 I see a new warning: drivers/net/wireless/ath/ath11k/debugfs.c: In function 'ath11k_debugfs_register': drivers/net/wireless/ath/ath11k/debugfs.c:1597:51: error: '%d' directive output may be truncated writing between 1 and 3 bytes into a region of size 2 [-Werror=format-truncation=] drivers/net/wireless/ath/ath11k/debugfs.c:1597:48: note: directive argument in the range [0, 255] drivers/net/wireless/ath/ath11k/debugfs.c:1597:9: note: 'snprintf' output between 5 and 7 bytes into a destination of size 5 Increase the size of pdev_name to 10 bytes to make sure there's enough room for the string. Also change the format to '%u' as ar->pdev_idx is u8. Compile tested only. Signed-off-by:
-
- 10 Oct, 2023 3 commits
-
-
Jeff Johnson authored
Helper function ath12k_vif_to_arvif() exists to retrieve a struct ath12k_vif from a struct ieee80211_vif. However, in multiple places this logic is open-coded with inline typecasting. Since the typecasting prevents the compiler from type-checking the source and destination, update the driver to consistently use the helper function. No functional changes, compile tested only. Signed-off-by:
-
Aloka Dixit authored
Mac80211 does not set flags BSS_CHANGED_FILS_DISCOVERY and BSS_CHANGED_UNSOL_BCAST_PROBE_RESP if there are no updates to FILS discovery and unsolicited broadcast probe response transmission configurations respectively. This results in the transmissions getting stopped during BSS change operations which do not include these attributes. Remove the checks for the flags and always send the existing configuration to firmware. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Aloka Dixit <quic_alokad@quicinc.com> Acked-by:
-
Dmitry Antipov authored
Since 'ath12k_dp_rx_peer_tid_setup()' is the only place where 'struct hal_rx_reo_queue' object is allocated with 'kzalloc()', call to 'memset()' in 'ath12k_hal_reo_qdesc_setup()' may be dropped. Compile tested only. Signed-off-by:
Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by:
-
- 09 Oct, 2023 14 commits
-
-
Dmitry Antipov authored
Since 'bt_inq_page_start_time' of 'struct bt_coexist_8723' is in jiffies, prefer 'unsigned long' over 'u32' to avoid possible truncation in 'rtl8723e_dm_bt_inq_page_monitor()' and adjust related code. Found with clang's -Wshorten-64-to-32, compile tested only. Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004092418.73337-1-dmantipov@yandex.ru
-
Zong-Zhe Yang authored
Since new criterion released by SRRC (State Radio Regulatory Commission, China) is stricter, we have adjusted TX power limit tables for it. But, due to RTL8821C HW characteristic, we still need to use specific parameter in CCK TX filter when set channel to avoid violations in some corner cases. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Zong-Zhe Yang authored
Sync Realtek Regulatory R42 and Realtek Channel Plan R64. Start to configure with Realtek regd CHILE, CN, UK, QATAR, UKRAINE. Signed-off-by:
-
Zong-Zhe Yang authored
Update TX power limit to parameter package V70 * tweak values of CN for its new regulation * configure values for QATAR, UK Signed-off-by:
-
Zong-Zhe Yang authored
Update TX power limit to parameter package V67 * configure values for MEXICO, CN, QATAR, UK Signed-off-by:
-
Zong-Zhe Yang authored
In newer Realtek parameter package, Realtek regd can configure QATAR and UK individually. So, driver extends the regd enum. Besides, driver configure alternative of them which will be referenced when parameter package of a chip doesn't consider QATAR and UK individually. Signed-off-by:
-
Felipe Negrelli Wolter authored
When frames are sent over the air, the device always applies the data rates in descending order. The driver assumed Minstrel also provided rate in descending order. However, in some cases, Minstrel can a choose a fallback rate greater than the primary rate. In this case, the two rates was inverted, the device try highest rate first and we get many retries. Since the device always applies rates in descending order, the workaround is to drop the rate when it higher than its predecessor in the rate list. Thus [ 4, 5, 3 ] becomes [ 4, 3 ]. This patch has been tested in isolated room with a series of attenuators. Here are the Minstrel statistics with 80dBm of attenuation: Without the fix: best ____________rate__________ ____statistics___ _____last____ ______sum-of________ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts] HT20 LGI 1 S MCS0 0 1477 5.6 5.2 82.7 3 0 0 3 4 HT20 LGI 1 MCS1 1 738 10.6 0.0 0.0 0 0 0 0 1 HT20 LGI 1 D MCS2 2 492 14.9 13.5 81.5 5 0 0 5 9 HT20 LGI 1 C MCS3 3 369 18.8 17.6 84.3 5 0 0 76 96 HT20 LGI 1 A P MCS4 4 246 25.4 22.4 79.5 5 0 0 11268 14026 HT20 LGI 1 B S MCS5 5 185 30.7 19.7 57.7 5 8 9 3918 9793 HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 5 0 0 6 102 HT20 LGI 1 MCS7 7 148 35.1 0.0 0.0 0 0 0 0 44 With the fix: best ____________rate__________ ____statistics___ _____last____ ______sum-of________ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts] HT20 LGI 1 S MCS0 0 1477 5.6 1.8 28.6 1 0 0 1 5 HT20 LGI 1 DP MCS1 1 738 10.6 9.7 82.6 4 0 0 14 34 HT20 LGI 1 MCS2 2 492 14.9 9.2 55.4 5 0 0 52 77 HT20 LGI 1 B S MCS3 3 369 18.8 15.6 74.9 5 1 1 417 554 HT20 LGI 1 A MCS4 4 246 25.4 16.7 59.2 5 1 1 13812 17951 HT20 LGI 1 C S MCS5 5 185 30.7 14.0 41.0 5 1 5 57 640 HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 0 0 1 0 48 HT20 LGI 1 S MCS7 7 148 35.1 0.0 0.0 0 0 0 0 36 We can notice the device try now to send with lower rates (and high success rates). At the end, we measured 20-25% better throughput with this patch. Fixes: 9bca45f3 ("staging: wfx: allow to send 802.11 frames") Tested-by:Olivier Souloumiac <olivier.souloumiac@silabs.com> Tested-by:
Alexandr Suslenko <suslenko.o@ajax.systems> Reported-by:
Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by:
Felipe Negrelli Wolter <felipe.negrelliwolter@silabs.com> Signed-off-by:
-
Jérôme Pouiller authored
With some conditions, the device is able to send/receive frames during scan operation. So, it is possible to use it implement the "remain on channel" feature. We just ask for a passive scan (without sending any probe request) on one channel. This architecture allows to leverage some interesting features: - if the device is AP, the device switches channel just after the next beacon and the beacons are stopped during the off-channel interval. - if the device is connected, it advertises it is asleep before to switch channel (so the AP should stop to try to send data) Signed-off-by: -
Jérôme Pouiller authored
Until now, all the traffic was blocked during scan operation. However, scan operation is going to be used to implement Remain On Channel (ROC). In this case, special frames (marked with IEEE80211_TX_CTL_TX_OFFCHAN) must be sent during the operation. These frames need to be sent on the virtual interface #2. Until now, this interface was only used by the device for internal purpose. But since API 3.9, it can be used to send data during scan operation (we hijack the scan process to implement ROC). Thus, we need to change a bit the way we match the frames with the interface. Fortunately, the frames received during the scan are marked with the correct interface number. So there is no change to do on this part. Signed-off-by:
-
Jérôme Pouiller authored
Currently, one scan_lock is associated to each vif. However, concurrent scan on vifs is explicitly prohibited by the device. Currently, scan_lock is associated with a vif but it is always locked with conf_mutex (there is a case where conf_mutex is not associated to scan_lock but scan_lock is tested on all interfaces). So concurrent scan on vifs cannot happen. So, this patch relocate scan_lock to the device and simplify the code. Signed-off-by:
-
Jérôme Pouiller authored
The device ignore the rx filters during the scan operation. wfx_configure_filter() acquires scan_lock to reflect this restriction. However, it is not really necessary since mac80211 don't try to configure Rx filters during scan. However, the things are changing. The scan operation is going to be used to implement remain-on-channel. In this case, wfx_configure_filter() can be called during the scan. Currently, this scenario generate a delay that end with a timeout in the upper layers. For the final user, some scenario of the EasyConnect specification end with a failure. So, avoid acquiring the scan_lock and just return. Signed-off-by:
-
Jérôme Pouiller authored
Like hof_scan(), hif_scan_uniq() invoke HIF_SCAN. However, it only allows to probe one channel and disable probe requests. It works very well to implement Remain-On-Channel. Signed-off-by:
-
Jérôme Pouiller authored
There is no real reasons to keep these function in the header file. Signed-off-by:
-
Jérôme Pouiller authored
wfx_rate_mask_to_hw() is only used in hif_tx.c. So relocate it into hif_tx.c and mark it static. Signed-off-by:
-
