- 25 Sep, 2023 2 commits
-
-
Johannes Berg authored
Drivers should really be able to rely on the wiphy mutex being held all the time, unless otherwise documented. For ethtool, that wasn't quite right. Fix and clarify this in both code and documentation. Reported-by: syzbot+c12a771b218dcbba32e1@syzkaller.appspotmail.com Fixes: 0e8185ce ("wifi: mac80211: check wiphy mutex in ops") Signed-off-by:
Johannes Berg <johannes.berg@intel.com>
-
Colin Ian King authored
Don't populate the read-only array lanes on the stack, instead make it static const. Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20230919095205.24949-1-colin.i.king@gmail.comSigned-off-by:
-
- 22 Sep, 2023 9 commits
-
-
Zong-Zhe Yang authored
The following FW elements are recognized, and then the valid entries in them are loaded into SW struct case by case. * TX power by rate * TX power limit 2 GHz * TX power limit 5 GHz * TX power limit 6 GHz * TX power limit RU 2 GHz * TX power limit RU 5 GHz * TX power limit RU 6 GHz * TX shape limit * TX shape limit RU One single firmware file can contain multiples of each of the above FW elements. Each of them is configured with a target RFE (RF front end) type. We choose one of the multiples to load based on RFE type. If there are multiples of the same FW elements with the same target RFE type. The last one will be applied. We don't want to have many loading variants for above FW elements. Even if between different chips or between different generations, we would like to maintain only one single set of loadings. So, the loadings are designed to consider compatibility. The main concepts are listed below. * The driver structures, which are used to cast binary entry from FW, cannot insert new members in the middle. If there are something new, they should always be appended at the tail. * Each binary entry from FW uses a dictionary way containing a key set and a data. The keys in the key set indicate where to put the data. * If size of driver struct and size of binary entry do not match when loading, it means the number of keys in the key set are different. Then, we deal with compatibility. No matter which one has more keys, we take/use zero on those mismatched keys. If driver struct is bigger (backward compatibility): e.g. SW uses two keys, but FW is built with one key. Then, put the data of FW(keyX) into SW[keyX][0]. If binary entry is bigger (forward compatibility): e.g. FW is built with two keys, but SW uses one key. Then, only take the data of FW(keyX, keyY = 0) into SW[keyX] Besides, chip info setup flow is tweaked a bit for the following. * Before loading FW elements, we need to determine chip RFE via efuse. * Setting up RFE parameters depends on loading FW elements ahead. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-8-pkshih@realtek.com
-
Zong-Zhe Yang authored
The following are introduced for Wi-Fi 7 chips. 1. take BW/OFDMA into account on TX power by rate 2. increase TX power offset types up to EHT 3. split TX shape into tx_shape_lmt and tx_shape_lmt_ru If functions which are only for AX, they always access TX power by rate with BW/OFDMA = 0/0, and they don't access tx_shape's lmt_ru section. Signed-off-by:
-
Zong-Zhe Yang authored
Table of TX power by rate only needs to be loaded once. But, we originally loaded it every time we start core. Now, we load it one time along as RFE (RF Front End) parameters are determined. Signed-off-by:
-
Zong-Zhe Yang authored
Originally, these helpers were implemented by macros. We rewrite them by normal functions. In the new function to seek raw TX power by rate, we access the array according to rate section and discard the original pointer arithmetic. Signed-off-by:
-
Zong-Zhe Yang authored
For next-generation chips, TX power by rate table comes from RFE (RF front end) parameter. It can be different according to RFE type. So, we indicate TX power by rate table inside RFE parameter ahead. For current chips, even with different RFE types, a chip is configured with a single TX power by rate table. So, this commit doesn't really affect these currently supported chips. Signed-off-by:
-
Zong-Zhe Yang authored
For next-generation chips, TX shape table comes from RFE (RF front end) parameter. It can be different according to RFE type. So, we indicate TX shape table inside RFE parameter ahead. For current chips, even with different RFE types, a chip is configured with a single TX shape table. So, this commit doesn't really affect these currently supported chips. Signed-off-by:
-
Ping-Ke Shih authored
The subband index is a hardware value of relationship between primary channel and bandwidth, and it is used by setting channel/bandwidth to specify the primary channel. Because this index is only needed when bandwidth >= 20 MHz, adjust order of enumerator bandwidth to access offsets array easier. To prevent misuse RTW89_CHANNEL_WIDTH_NUM as size, change it to RTW89_CHANNEL_WIDTH_ORDINARY_NUM that will be the size of array. The enumerator values of bandwidth (before ordinary number) will be also used by upcoming TX power table built in firmware file, so add a comment to remind keeping the order. Signed-off-by:
-
Dmitry Antipov authored
Introduce a few more (PCIE and generic interface related) cleanups which becomes reasonable after the previous patch. Signed-off-by:
Dmitry Antipov <dmantipov@yandex.ru> Acked-by:
Brian Norris <briannorris@chromium.org> Signed-off-by:
-
Dmitry Antipov authored
Since 'mwifiex_write_reg()' just issues void 'iowrite32()', convert the former to 'void' and simplify all related users (with the only exception of 'read_poll_timeout()' which explicitly requires a non-void function argument). Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by:
-
- 21 Sep, 2023 4 commits
-
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct libipw_txb. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Stanislav Yakovlev <stas.yakovlev@gmail.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: linux-wireless@vger.kernel.org Signed-off-by:
Kees Cook <keescook@chromium.org> Reviewed-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by:
-
Prasurjya Rohan Saikia authored
Add an algorithm to backoff the Tx Task when low memory scenario is triggered at firmware. During high data transfer from host, the firmware runs out of VMM memory, which is used to hold the frames from the host. So, adding the flow control delays the transmit from host side when there is not enough space to accommodate frames in firmware side. Signed-off-by:
Prasurjya Rohan Saikia <prasurjya.rohansaikia@microchip.com> Acked-by:
Ajay Singh <ajay.kathat@microchip.com> Signed-off-by:
-
Víctor Gonzalo authored
The mwifiex_pcie driver is missing the MODULE_FIRMWARE macro to add the firmware files needed to the module metadata. Signed-off-by:
Víctor Gonzalo <victor.gonzalo@anddroptable.net> Acked-by:
-
Dmitry Antipov authored
Drop filled with NULL pointers but otherwise unused 'skb_arr' array of 'struct mwifiex_sdio_mpa_rx', adjust related code. Signed-off-by:
-
- 20 Sep, 2023 3 commits
-
-
Jinjie Ruan authored
Since debugfs_create_file() return ERR_PTR and never return NULL, so use IS_ERR() to check it instead of checking NULL. Fixes: e3037485 ("rtw88: new Realtek 802.11ac driver") Signed-off-by:
Jinjie Ruan <ruanjinjie@huawei.com> Acked-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct brcmf_fw_request. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Arend van Spriel <aspriel@gmail.com> Cc: Franky Lin <franky.lin@broadcom.com> Cc: Hante Meuleman <hante.meuleman@broadcom.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: Matthias Brugger <mbrugger@suse.com> Cc: Hector Martin <marcan@marcan.st> Cc: "Alvin Šipraga" <alsi@bang-olufsen.dk> Cc: Hans de Goede <hdegoede@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Cc: SHA-cyfmac-dev-list@infineon.com Signed-off-by:
Matthias Brugger <mbrugger@suse.com> Signed-off-by:
-
Kees Cook authored
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct brcmf_gscan_config. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Arend van Spriel <aspriel@gmail.com> Cc: Franky Lin <franky.lin@broadcom.com> Cc: Hante Meuleman <hante.meuleman@broadcom.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: Hector Martin <marcan@marcan.st> Cc: Ryohei Kondo <ryohei.kondo@cypress.com> Cc: Hans de Goede <hdegoede@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Cc: SHA-cyfmac-dev-list@infineon.com Signed-off-by:
-
- 18 Sep, 2023 18 commits
-
-
Uwe Kleine-König authored
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. wlcore_remove() returned zero unconditionally. With that converted to return void instead, the wl12xx and wl18xx driver can be converted to .remove_new trivially. Signed-off-by:
Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by:
-
Zenm Chen authored
According to the driver provided by EDIMAX, the device ID 0x7392:0xb722 belongs to EDIMAX EW-7722UTn V3, so add a comment about this. Signed-off-by:
Zenm Chen <zenmchen@gmail.com> Signed-off-by:
-
Ping-Ke Shih authored
Using mac_gen pointer to reuse the code with WiFi 7 chips, and define MAC ports registers for WiFi 7 chips. Signed-off-by:
-
Ping-Ke Shih authored
MAC port is a design to support virtual interface on single MAC hardware. For next generation chips, register addresses are changed but definitions are the same, so move registers together to be easier to reuse codes. Signed-off-by:
-
Ping-Ke Shih authored
For existing chips, size of TX WD info is 6 words, but upcoming WiFi 7 chips become 8 words, so add a chip_info to reuse the code. Signed-off-by:
-
Ping-Ke Shih authored
The format v2 of TX descriptor contains 8-word body and 8-word info, and fields include packet size, MAC_ID, security key ID and etc. By design, it can possibly only fill body to reduce overhead, but this driver keeps thing simple, so always fill body and info currently. Signed-off-by:
-
Ping-Ke Shih authored
This kind of TX descriptor is used to download firmware or send firmware command. Because we want to reduce descriptor overhead and this only needs two fields 'size' and 'type', hardware designers choose short form of RX descriptor for it. Signed-off-by:
-
Ping-Ke Shih authored
RX descriptor is used to provide meta data of received data. The WiFi 7 chips use different RX descriptor format, so add this parser along with hardware design. Signed-off-by:
-
Zong-Zhe Yang authored
In MCC STA+GO mode, we calculate NoA information and fill it into the beacon of P2P GO. Since NoA uses only 32 bits to describe time things, we need to deal with renewal when TSF[63:32] is carried. We trigger FW to notify that. Then, we can update NoA information for new time period once we get notification from FW. Signed-off-by:
-
Zong-Zhe Yang authored
When receiving request of adjusting BT slot from coex. mechanism, we need to fetch the new BT slot and use the new one to calculate MCC (multi-channel concurrency) pattern. Then, we update the new MCC pattern to FW. Signed-off-by:
-
Zong-Zhe Yang authored
MCC fills duration limit of a role according to NoA description. If P2P PS changes during MCC, we don't process P2P PS via normal flow. Instead, we re-fill duration limit of the role for new NoA description, and then we do MCC update. Signed-off-by:
-
Zong-Zhe Yang authored
In MCC STA+GC mode, the offset between TBTTs of remote AP and remote GO might change. If the change is larger than tolerance, we should update MCC after re-calculating parameters for new things. So, we track that in rtw89_track_work() now. And, we add MCC update flow to tell FW either to change durations of roles or to replace entire pattern according to how MCC plans BT slot. Signed-off-by:
-
Zong-Zhe Yang authored
Each MCC (multi-channel concurrency) role maintains a bitmap of mac IDs. The bitmap is supposed to contain the two points below. * mac ID of itself * mac ID(s) of STA(s) connecting to it Under STA+GC mode, the bitmaps of both roles should not change. However, under STA+GO mode, the bitmap of GO may change due to P2P clients which connect/disconnect to/from it. FW controls (TDMA-based) MCC things via mac IDs in bitmap of each role. For example, mac IDs are required by FW when it wants to pause role1's TX in role0 slot. So, to sync between driver and FW, we update the new mac ID bitmap of GO to FW once it's changed. Signed-off-by:
-
Zong-Zhe Yang authored
DPK is one kind of RF calibration. When MCC (multi-channel concurrency) start/stop, DPK needs to do extra things to be off/on. We add a chanctx callback type, RTW89_CHANCTX_CALLBACK_RFK, and register it for RTL8852C to deal with DPK according to MCC states. Signed-off-by:
-
Zong-Zhe Yang authored
After MCC (multi-channel concurrency) is started, FW will control channel changes and use the corresponding backup of RF calibration result. And, driver RF calibration (RF-K) won't be able to keep up with the speed at which the channels are changing. So, even if we keep tracking it in driver, the RF-K result might not be good either. To save these unnecessary things, we disable driver RF-K tracking during MCC. Signed-off-by:
-
Zong-Zhe Yang authored
RF calibration will notify FW to backup the calibration result after it is done on a channel. For MCC (multi-channel concurrency) flow, when we at RTW89_ENTITY_MODE_MCC_PREPARE mode, RF calibration should execute on second channel of MCC, i.e. RTW89_SUB_ENTITY_1, and then, notify FW to backup the result for the second one. Originally, the RF calibration flow only fit single channel case. We are planning to support MCC on RTL8852C, so we refine its RF calibration flow to fit MCC case. Signed-off-by:
-
Jeff Johnson authored
While converting struct ieee80211_tim_ie::virtual_map to be a flexible array it was observed that the TIM IE processing in cw1200_rx_cb() could potentially process a malformed IE in a manner that could result in a buffer over-read. Add logic to verify that the TIM IE length is large enough to hold a valid TIM payload before processing it. Signed-off-by:
Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by:
-
Wen Gong authored
6 GHz regulatory domains introduces Power Spectral Density (PSD). The PSD value of the regulatory rule should be taken into effect for the ieee80211_channels falling into that particular regulatory rule. Save the values in the channel which has PSD value and add nl80211 attributes accordingly to handle it. Co-developed-by:
Aditya Kumar Singh <quic_adisi@quicinc.com> Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Link: https://lore.kernel.org/r/20230914082026.3709-1-quic_wgong@quicinc.com [use hole in chan flags, reword docs] Signed-off-by:
-
- 14 Sep, 2023 1 commit
-
-
Johannes Berg authored
Now that I fixed the function name, we see the parameters are wrong as well. Fix that too. Change-Id: I1a4cfea446875998a5a242ca36acc8244991a199 Reported-by:
Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by:
-
- 13 Sep, 2023 3 commits
-
-
Ping-Ke Shih authored
We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overflow+0xe/0x10 nl80211_send_iface+0x688/0x6b0 [cfg80211] [...] cfg80211_register_wdev+0x78/0xb0 [cfg80211] cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] [...] ieee80211_if_add+0x60e/0x8f0 [mac80211] ieee80211_register_hw+0xda5/0x1170 [mac80211] In this case, simply return an error instead, to indicate that no data is available. Cc: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Stephen Douthit authored
If the driver doesn't fill NL80211_STA_INFO_TX_BITRATE in sta_set_sinfo() then as a fallback sta->deflink.tx_stats.last_rate is used. Unfortunately there's no guarantee that this has actually been set before it's used. Originally found when 'iw <dev> link' would always return a tx rate of 6Mbps regardless of actual link speed for the QCA9337 running firmware WLAN.TF.2.1-00021-QCARMSWP-1 in my netbook. Use the sanity check logic from ieee80211_fill_rx_status() and refactor that to use the new inline function. Signed-off-by:
Stephen Douthit <stephen.douthit@gmail.com> Link: https://lore.kernel.org/r/20230213204024.3377-1-stephen.douthit@gmail.com [change to bool ..._rate_valid() instead of int ..._rate_invalid()] Signed-off-by:
-
Emmanuel Grumbach authored
Getting a BAR can be an explanation if we're chasing packet loss. Add a print with the relevant debug level in that code path. Signed-off-by:
Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by:
Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230913145231.913e989a1751.I6bff9020e339d91b61b5ad6aede27bcf8c7e6819@changeidSigned-off-by:
-
