- 25 Oct, 2023 12 commits
-
-
Kalle Valo authored
This reverts commit e149353e. The commit caused QCA6390 hw2.0 firmware WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1 to crash during disconnect: [71990.787525] ath11k_pci 0000:72:00.0: firmware crashed: MHI_CB_EE_RDDM Closes: https://lore.kernel.org/all/87edhu3550.fsf@kernel.org/Signed-off-by:
Kalle Valo <quic_kvalo@quicinc.com> Reviewed-by:
Jeff Johnson <quic_jjohnson@quicinc.com> Link: https://lore.kernel.org/r/20231023164120.651151-1-kvalo@kernel.org
-
Jeff Johnson authored
Currently, the logic to return an ath12k_sta pointer, given a ieee80211_sta pointer, uses typecasting throughout the driver. In general, conversion functions are preferable to typecasting since using a conversion function allows the compiler to validate the types of both the input and output parameters. ath12k already defines a conversion function ath12k_vif_to_arvif() for a similar conversion. So introduce ath12k_sta_to_arsta() for this use case, and convert all of the existing typecasting to use this function. Signed-off-by:
-
Johan Hovold authored
The ath12k active pdevs are protected by RCU but the htt mlo-offset event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. Fixes: d8899132 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # v6.2 Signed-off-by:
Johan Hovold <johan+linaro@kernel.org> Acked-by:
-
Johan Hovold authored
The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues. Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat. Compile tested only. Fixes: d8899132 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # v6.2 Signed-off-by:
-
Johan Hovold authored
The ath11k active pdevs are protected by RCU but the gtk offload status event handling code calling ath11k_mac_get_arvif_by_vdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. Fixes: a16d9b50 ("ath11k: support GTK rekey offload") Cc: stable@vger.kernel.org # 5.18 Cc: Carl Huang <quic_cjhuang@quicinc.com> Signed-off-by:
-
Johan Hovold authored
The ath11k active pdevs are protected by RCU but the htt pktlog handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. Fixes: d5c65159 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Signed-off-by:
-
Johan Hovold authored
The ath11k active pdevs are protected by RCU but the DFS radar event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Compile tested only. Fixes: d5c65159 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Acked-by:
-
Johan Hovold authored
The ath11k active pdevs are protected by RCU but the temperature event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section as reported by RCU lockdep: ============================= WARNING: suspicious RCU usage 6.6.0-rc6 #7 Not tainted ----------------------------- drivers/net/wireless/ath/ath11k/mac.c:638 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by swapper/0/0. ... Call trace: ... lockdep_rcu_suspicious+0x16c/0x22c ath11k_mac_get_ar_by_pdev_id+0x194/0x1b0 [ath11k] ath11k_wmi_tlv_op_rx+0xa84/0x2c1c [ath11k] ath11k_htc_rx_completion_handler+0x388/0x510 [ath11k] Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 Fixes: a41d1034 ("ath11k: add thermal sensor device support") Cc: stable@vger.kernel.org # 5.7 Signed-off-by:
-
Karthikeyan Periyasamy authored
In PCI and HAL interface layer module, the identifier sc is used to represent an instance of ath12k_base structure. However, within ath12k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of sc to ab. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00125-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Karthikeyan Periyasamy <quic_periyasa@quicinc.com> Acked-by:
-
Karthikeyan Periyasamy authored
In WMI layer module, the identifier wmi_sc is used to represent an instance of ath12k_wmi_base structure. However, within ath12k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of wmi_sc to wmi_ab. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00125-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Anilkumar Kolli authored
Firmware IE containers can dynamically provide various information what firmware supports. Also it can embed more than one image so updating firmware is easy, user just needs to update one file in /lib/firmware/. The firmware API 2 or higher will use the IE container format, the current API 1 will not use the new format but it still is supported for some time. Firmware API 2 files are named as firmware-2.bin (which contains both amss.bin and m3.bin images) and API 1 files are amss.bin and m3.bin. Currently ath11k PCI driver provides firmware binary (amss.bin) path to MHI driver, MHI driver reads firmware from filesystem and boots it. Add provision to read firmware files from ath11k driver and provide the amss.bin firmware data and size to MHI using a pointer. Currently enum ath11k_fw_features is empty, the patches adding features will add the flags. With AHB devices there's no amss.bin or m3.bin, so no changes in how AHB firmware files are used. But AHB devices can use future additions to the meta data, for example in enum ath11k_fw_features. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Co-developed-by:
P Praneesh <quic_ppranees@quicinc.com> Signed-off-by:
Anilkumar Kolli <quic_akolli@quicinc.com> Co-developed-by:
-
Kalle Valo authored
Simple refactoring to make it easier to add firmware-2.bin support in the following patch. Earlier ath11k_qmi_m3_load() supported changing m3.bin contents while ath11k is running. But that's not going to actually work, m3.bin is supposed to be the same during the lifetime of ath11k, for example we don't support changing the firmware capabilities on the fly. Due to this ath11k requests m3.bin firmware file first and only then checks m3_mem->vaddr, so we are basically requesting the firmware file even if it's not needed. Reverse the code so that m3_mem buffer is checked first, and only if it doesn't exist, then m3.bin is requested from user space. Checking for m3_mem->size is redundant when m3_mem->vaddr is NULL, we would not be able to use the buffer in that case. So remove the check for size. Simplify the exit handling and use 'goto out'. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Signed-off-by:
-
- 18 Oct, 2023 9 commits
-
-
Karthikeyan Periyasamy authored
In PCI, thermal and HAL interface layer module, the identifier sc is used to represent an instance of ath11k_base structure. However, within ath11k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of sc to ab. Compile tested only. Signed-off-by:
-
Karthikeyan Periyasamy authored
In WMI layer module, the identifier wmi_sc is used to represent an instance of ath11k_wmi_base structure. However, within ath11k, the convention is to use "ab" to represent an SoC "base" struct. So change the all instances of wmi_sc to wmi_ab. Compile tested only. Signed-off-by:
-
Justin Stitt authored
strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous interfaces. The affected code's purpose is to truncate strings that are too long with "..." like: foobar -> fo... The lengths have been carefully calculated and as such this has decayed to a simple byte copy from one buffer to another -- let's use memcpy(). Note: build-tested only. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by:
Justin Stitt <justinstitt@google.com> Signed-off-by:
-
Justin Stitt authored
strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. We expect led->name to be NUL-terminated based on the presence of a manual NUL-byte assignment. This NUL-byte assignment was added in Commit daf9669b ("ath5k: ensure led name is null terminated"). If strscpy() had existed and had been used back when this code was written then potential bugs and the need to manually NUL-terminate could have been avoided. Since we now have the technology, let's use it :) Considering the above, a suitable replacement is `strscpy` [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. If NUL-padding is required let's opt for strscpy_pad(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by:
-
Jeff Johnson authored
Currently struct ath12k_base defines the member bd_api. However, this member is only accessed within ath12k_core_fetch_bdf(). Since the scope is local just to that one function, remove it from ath12k_base and instead just use a local stack variable. No functional changes, compile tested only. Signed-off-by:
-
Jeff Johnson authored
Currently struct ath11k_base defines the member bd_api. However, this member is only accessed within ath11k_core_fetch_bdf(). Since the scope is local just to that one function, remove it from ath11k_base and instead just use a local stack variable. No functional changes, compile tested only. Signed-off-by:
-
Ramya Gnanasekar authored
Currently QCN9274 supports only AP and station interface modes. Add interface type mesh to ath12k_hw_params for QCN9274 to provide support for mesh mode as well. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-02903-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Ramya Gnanasekar <quic_rgnanase@quicinc.com> Acked-by:
-
Ramya Gnanasekar authored
The capabilities for the EHT mesh are generated from the capabilities reported by the firmware. But the firmware only reports the overall capabilities and not the one which are specific for mesh. Capabilities which requires infrastructure setup with a main STA(AP) controlling operations are not needed for mesh and hence remove these capabilities from the list. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-02903-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Rob Herring authored
Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers. Signed-off-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
- 12 Oct, 2023 8 commits
-
-
Jeff Johnson authored
Currently, the logic to return an ath11k_sta pointer, given a ieee80211_sta pointer, uses typecasting throughout the driver. In general, conversion functions are preferable to typecasting since using a conversion function allows the compiler to validate the types of both the input and output parameters. ath11k already defines a conversion function ath11k_vif_to_arvif() for a similar conversion. So introduce ath11k_sta_to_arsta() for this use case, and convert all of the existing typecasting to use this function. No functional changes, compile tested only. Signed-off-by:
-
Jeff Johnson authored
struct ath11k_htc_frame is unused, and since it illogically contains two consecutive flexible arrays, it could never be used, so remove it. No functional changes, compile tested only. Signed-off-by:
-
Wen Gong authored
This is to fix m3 buffer reuse issue as m3_mem->size isn't set to zero in the free function, which leads invalid m3 downloading to firmware and firmware crashing. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Signed-off-by:
-
Wen Gong authored
ath12k_qmi_free_target_mem_chunk() and ath12k_qmi_m3_free() is static in qmi.c, they are needed for recovery, export them in a new function Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by:
-
Wen Gong authored
RDDM is Ram Dump Debug Module which is used to debug issues when the firmware encounters an error. The rddm_size is needed by the firmware while MHI goes to the RDDM state. Provide the size to MHI subsystem so that the firmware restart works when the firmware crashes. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by:
-
Aditya Kumar Singh authored
Certain regulatory domains could put restrictions on phy mode operation. For example, in a few countries HE/EHT Operation is not allowed. For such countries, firmware indicates this via phy bitmap in each reg rule. Currently, there is no logic to parse this info and then pass it on to the cfg80211/regulatory. Add parsing of this phy bitmap from the regulatory channel change event and then accordingly map it to cfg80211/regulatory flags and pass it on to it. While at it, correct typo in debug print: s/dsf/dfs. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Aditya Kumar Singh <quic_adisi@quicinc.com> Acked-by:
-
Aditya Kumar Singh authored
Certain regulatory domains could put restrictions on phy mode operation. For example, in a few countries HE Operation is not allowed. For such countries, firmware indicates this via phy bitmap in each reg rule. Currently, there is no logic to parse this info and then pass it on to the cfg80211/regulatory. Add parsing of this phy bitmap from the regulatory channel change event and then accordingly map it to cfg80211/regulatory flags and pass it on to it. While at it, correct typo in debug print s/dsf/dfs. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Kalle Valo authored
In v6.6-rc4 with GCC 13.2 I see a new warning: drivers/net/wireless/ath/ath11k/debugfs.c: In function 'ath11k_debugfs_register': drivers/net/wireless/ath/ath11k/debugfs.c:1597:51: error: '%d' directive output may be truncated writing between 1 and 3 bytes into a region of size 2 [-Werror=format-truncation=] drivers/net/wireless/ath/ath11k/debugfs.c:1597:48: note: directive argument in the range [0, 255] drivers/net/wireless/ath/ath11k/debugfs.c:1597:9: note: 'snprintf' output between 5 and 7 bytes into a destination of size 5 Increase the size of pdev_name to 10 bytes to make sure there's enough room for the string. Also change the format to '%u' as ar->pdev_idx is u8. Compile tested only. Signed-off-by:
-
- 10 Oct, 2023 3 commits
-
-
Jeff Johnson authored
Helper function ath12k_vif_to_arvif() exists to retrieve a struct ath12k_vif from a struct ieee80211_vif. However, in multiple places this logic is open-coded with inline typecasting. Since the typecasting prevents the compiler from type-checking the source and destination, update the driver to consistently use the helper function. No functional changes, compile tested only. Signed-off-by:
-
Aloka Dixit authored
Mac80211 does not set flags BSS_CHANGED_FILS_DISCOVERY and BSS_CHANGED_UNSOL_BCAST_PROBE_RESP if there are no updates to FILS discovery and unsolicited broadcast probe response transmission configurations respectively. This results in the transmissions getting stopped during BSS change operations which do not include these attributes. Remove the checks for the flags and always send the existing configuration to firmware. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Aloka Dixit <quic_alokad@quicinc.com> Acked-by:
-
Dmitry Antipov authored
Since 'ath12k_dp_rx_peer_tid_setup()' is the only place where 'struct hal_rx_reo_queue' object is allocated with 'kzalloc()', call to 'memset()' in 'ath12k_hal_reo_qdesc_setup()' may be dropped. Compile tested only. Signed-off-by:
Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by:
-
- 09 Oct, 2023 8 commits
-
-
Dmitry Antipov authored
Since 'bt_inq_page_start_time' of 'struct bt_coexist_8723' is in jiffies, prefer 'unsigned long' over 'u32' to avoid possible truncation in 'rtl8723e_dm_bt_inq_page_monitor()' and adjust related code. Found with clang's -Wshorten-64-to-32, compile tested only. Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20231004092418.73337-1-dmantipov@yandex.ru
-
Zong-Zhe Yang authored
Since new criterion released by SRRC (State Radio Regulatory Commission, China) is stricter, we have adjusted TX power limit tables for it. But, due to RTL8821C HW characteristic, we still need to use specific parameter in CCK TX filter when set channel to avoid violations in some corner cases. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Zong-Zhe Yang authored
Sync Realtek Regulatory R42 and Realtek Channel Plan R64. Start to configure with Realtek regd CHILE, CN, UK, QATAR, UKRAINE. Signed-off-by:
-
Zong-Zhe Yang authored
Update TX power limit to parameter package V70 * tweak values of CN for its new regulation * configure values for QATAR, UK Signed-off-by:
-
Zong-Zhe Yang authored
Update TX power limit to parameter package V67 * configure values for MEXICO, CN, QATAR, UK Signed-off-by:
-
Zong-Zhe Yang authored
In newer Realtek parameter package, Realtek regd can configure QATAR and UK individually. So, driver extends the regd enum. Besides, driver configure alternative of them which will be referenced when parameter package of a chip doesn't consider QATAR and UK individually. Signed-off-by:
-
Felipe Negrelli Wolter authored
When frames are sent over the air, the device always applies the data rates in descending order. The driver assumed Minstrel also provided rate in descending order. However, in some cases, Minstrel can a choose a fallback rate greater than the primary rate. In this case, the two rates was inverted, the device try highest rate first and we get many retries. Since the device always applies rates in descending order, the workaround is to drop the rate when it higher than its predecessor in the rate list. Thus [ 4, 5, 3 ] becomes [ 4, 3 ]. This patch has been tested in isolated room with a series of attenuators. Here are the Minstrel statistics with 80dBm of attenuation: Without the fix: best ____________rate__________ ____statistics___ _____last____ ______sum-of________ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts] HT20 LGI 1 S MCS0 0 1477 5.6 5.2 82.7 3 0 0 3 4 HT20 LGI 1 MCS1 1 738 10.6 0.0 0.0 0 0 0 0 1 HT20 LGI 1 D MCS2 2 492 14.9 13.5 81.5 5 0 0 5 9 HT20 LGI 1 C MCS3 3 369 18.8 17.6 84.3 5 0 0 76 96 HT20 LGI 1 A P MCS4 4 246 25.4 22.4 79.5 5 0 0 11268 14026 HT20 LGI 1 B S MCS5 5 185 30.7 19.7 57.7 5 8 9 3918 9793 HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 5 0 0 6 102 HT20 LGI 1 MCS7 7 148 35.1 0.0 0.0 0 0 0 0 44 With the fix: best ____________rate__________ ____statistics___ _____last____ ______sum-of________ mode guard # rate [name idx airtime max_tp] [avg(tp) avg(prob)] [retry|suc|att] [#success | #attempts] HT20 LGI 1 S MCS0 0 1477 5.6 1.8 28.6 1 0 0 1 5 HT20 LGI 1 DP MCS1 1 738 10.6 9.7 82.6 4 0 0 14 34 HT20 LGI 1 MCS2 2 492 14.9 9.2 55.4 5 0 0 52 77 HT20 LGI 1 B S MCS3 3 369 18.8 15.6 74.9 5 1 1 417 554 HT20 LGI 1 A MCS4 4 246 25.4 16.7 59.2 5 1 1 13812 17951 HT20 LGI 1 C S MCS5 5 185 30.7 14.0 41.0 5 1 5 57 640 HT20 LGI 1 MCS6 6 164 33.0 0.0 0.0 0 0 1 0 48 HT20 LGI 1 S MCS7 7 148 35.1 0.0 0.0 0 0 0 0 36 We can notice the device try now to send with lower rates (and high success rates). At the end, we measured 20-25% better throughput with this patch. Fixes: 9bca45f3 ("staging: wfx: allow to send 802.11 frames") Tested-by:Olivier Souloumiac <olivier.souloumiac@silabs.com> Tested-by:
Alexandr Suslenko <suslenko.o@ajax.systems> Reported-by:
Jérôme Pouiller <jerome.pouiller@silabs.com> Signed-off-by:
Felipe Negrelli Wolter <felipe.negrelliwolter@silabs.com> Signed-off-by:
-
Jérôme Pouiller authored
With some conditions, the device is able to send/receive frames during scan operation. So, it is possible to use it implement the "remain on channel" feature. We just ask for a passive scan (without sending any probe request) on one channel. This architecture allows to leverage some interesting features: - if the device is AP, the device switches channel just after the next beacon and the beacons are stopped during the off-channel interval. - if the device is connected, it advertises it is asleep before to switch channel (so the AP should stop to try to send data) Signed-off-by:
-
