summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-09-21wifi: ath10k: drop HTT_DATA_TX_STATUS_DOWNLOAD_FAILDmitry Antipov
According to Jeff, 'HTT_DATA_TX_STATUS_DOWNLOAD_FAIL' from 'enum htt_data_tx_status' is never actually used by the firmware code and so may be dropped, with the related adjustment to 'ath10k_htt_rx_tx_compl_ind()'. Suggested-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Found by Linux Verification Center (linuxtesting.org) with SVACE. Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230914160744.155903-1-dmantipov@yandex.ru
2023-09-21wifi: ath10k: Annotate struct ath10k_ce_ring with __counted_byKees Cook
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct ath10k_ce_ring. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Kalle Valo <kvalo@kernel.org> Cc: Jeff Johnson <quic_jjohnson@quicinc.com> Cc: ath10k@lists.infradead.org Cc: linux-wireless@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230915200636.never.762-kees@kernel.org
2023-09-21wifi: wcn36xx: Annotate struct wcn36xx_hal_ind_msg with __counted_byKees Cook
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct wcn36xx_hal_ind_msg. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Loic Poulain <loic.poulain@linaro.org> Cc: Kalle Valo <kvalo@kernel.org> Cc: wcn36xx@lists.infradead.org Cc: linux-wireless@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230915200622.never.820-kees@kernel.org
2023-09-21wifi: ath12k: Remove unnecessary (void*) conversionsWu Yunchuan
No need cast (void*) to (struct hal_rx_ppdu_end_user_stats *), (struct ath12k_rx_desc_info *) or (struct hal_tx_msdu_ext_desc *). Change the prototype to remove the local variable. Signed-off-by: Wu Yunchuan <yunchuan@nfschina.com> Suggested-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230919045142.524226-1-yunchuan@nfschina.com
2023-09-21wifi: ath10k: Remove unnecessary (void*) conversionsWu Yunchuan
No need cast (void*) to (struct htt_rx_ring_setup_ring32 *), (struct htt_rx_ring_setup_ring64 *). Change the prototype to remove the local variable. Signed-off-by: Wu Yunchuan <yunchuan@nfschina.com> Suggested-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230919045056.523958-1-yunchuan@nfschina.com
2023-09-21wifi: ath6kl: remove unnecessary (void*) conversionsWu Yunchuan
No need cast (void *) to (struct ath6kl *) or (struct ath6kl_cookie *). Signed-off-by: Wu Yunchuan <yunchuan@nfschina.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230919045008.523730-1-yunchuan@nfschina.com
2023-09-21wifi: ath5k: remove unnecessary (void*) conversionsWu Yunchuan
No need cast (void *) to (struct ath5k_hw *). Signed-off-by: Wu Yunchuan <yunchuan@nfschina.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230919044959.523576-1-yunchuan@nfschina.com
2023-09-21wifi: wcn36xx: remove unnecessary (void*) conversionsWu Yunchuan
No need cast (void *) to other types such as (struct wcn36xx *), (struct wcn36xx_hal_update_scan_params_resp *), etc. Signed-off-by: Wu Yunchuan <yunchuan@nfschina.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230919044925.523403-1-yunchuan@nfschina.com
2023-09-21wifi: ar5523: Remove unnecessary (void*) conversionsWu Yunchuan
No need cast (void*) to (struct ar5523_cmd_hdr *). Signed-off-by: Wu Yunchuan <yunchuan@nfschina.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230919044906.523189-1-yunchuan@nfschina.com
2023-09-21wifi: ath9k: clean up function ath9k_hif_usb_resumeDongliang Mu
In ath9k_hif_usb_resume, the error handling code calls ath9k_hif_usb_dealloc_urbs twice in different paths. To unify the error handling code, we move the else branch before the if branch and drop one level of indentation of the if branch. In addition, move the ret variable at the end of variable declarations to be reverse x-mas tree order. Note that this patch does not incur any functionability change. Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230905013556.2595854-1-dzm91@hust.edu.cn
2023-09-21wifi: ath12k: fix DMA unmap warning on NULL DMA addressBaochen Qiang
In ath12k_dp_tx(), if we reach fail_dma_unmap due to some errors, current code does DMA unmap unconditionally on skb_cb->paddr_ext_desc. However, skb_cb->paddr_ext_desc may be NULL and thus we get below warning: kernel: [ 8887.076212] WARNING: CPU: 3 PID: 0 at drivers/iommu/dma-iommu.c:1077 iommu_dma_unmap_page+0x79/0x90 Fix it by checking skb_cb->paddr_ext_desc before unmap it. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230830021131.5610-1-quic_bqiang@quicinc.com
2023-09-21wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()Baochen Qiang
reg_cap.phy_id is extracted from WMI event and could be an unexpected value in case some errors happen. As a result out-of-bound write may occur to soc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it. This is found during code review. Compile tested only. Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230830020716.5420-1-quic_bqiang@quicinc.com
2023-09-21wifi: ipw2x00: Annotate struct libipw_txb with __counted_byKees Cook
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct libipw_txb. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Stanislav Yakovlev <stas.yakovlev@gmail.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: linux-wireless@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230915200602.never.582-kees@kernel.org
2023-09-21wifi: wilc1000: add back-off algorithm to balance tx queue packetsPrasurjya Rohan Saikia
Add an algorithm to backoff the Tx Task when low memory scenario is triggered at firmware. During high data transfer from host, the firmware runs out of VMM memory, which is used to hold the frames from the host. So, adding the flow control delays the transmit from host side when there is not enough space to accommodate frames in firmware side. Signed-off-by: Prasurjya Rohan Saikia <prasurjya.rohansaikia@microchip.com> Acked-by: Ajay Singh <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230915175946.4361-1-prasurjya.rohansaikia@microchip.com
2023-09-21wifi: mwifiex: use MODULE_FIRMWARE to add firmware files metadataVíctor Gonzalo
The mwifiex_pcie driver is missing the MODULE_FIRMWARE macro to add the firmware files needed to the module metadata. Signed-off-by: Víctor Gonzalo <victor.gonzalo@anddroptable.net> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230914211938.28395-1-victor.gonzalo@anddroptable.net
2023-09-21wifi: mwifiex: cleanup struct mwifiex_sdio_mpa_rxDmitry Antipov
Drop filled with NULL pointers but otherwise unused 'skb_arr' array of 'struct mwifiex_sdio_mpa_rx', adjust related code. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230821115254.167552-1-dmantipov@yandex.ru
2023-09-20wifi: ath10k: fix clang-specific fortify warningDmitry Antipov
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following (somewhat confusing due to absence of an actual source code location): In file included from drivers/net/wireless/ath/ath10k/debug.c:8: In file included from ./include/linux/module.h:13: In file included from ./include/linux/stat.h:19: In file included from ./include/linux/time.h:60: In file included from ./include/linux/time32.h:13: In file included from ./include/linux/timex.h:67: In file included from ./arch/x86/include/asm/timex.h:5: In file included from ./arch/x86/include/asm/processor.h:23: In file included from ./arch/x86/include/asm/msr.h:11: In file included from ./arch/x86/include/asm/cpumask.h:5: In file included from ./include/linux/cpumask.h:12: In file included from ./include/linux/bitmap.h:11: In file included from ./include/linux/string.h:254: ./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] __read_overflow2_field(q_size_field, size); The compiler actually complains on 'ath10k_debug_get_et_strings()' where fortification logic inteprets call to 'memcpy()' as an attempt to copy the whole 'ath10k_gstrings_stats' array from it's first member and so issues an overread warning. This warning may be silenced by passing an address of the whole array and not the first member to 'memcpy()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230829093652.234537-1-dmantipov@yandex.ru
2023-09-20wifi: ath11k: add chip id board name while searching board-2.bin for WCN6855Wen Gong
Sometimes board-2.bin does not have the board data which matched the parameters such as bus type, vendor, device, subsystem-vendor, subsystem-device, qmi-chip-id and qmi-board-id, then wlan will load fail. Hence add another type which only matches the bus type and qmi-chip-id, then the ratio of missing board data reduced. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230830060226.18664-1-quic_wgong@quicinc.com
2023-09-20wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()Baochen Qiang
len is extracted from HTT message and could be an unexpected value in case errors happen, so add validation before using to avoid possible out-of-bound read in the following message iteration and parsing. The same issue also applies to ppdu_info->ppdu_stats.common.num_users, so validate it before using too. These are found during code review. Compile test only. Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230901015602.45112-1-quic_bqiang@quicinc.com
2023-09-20wifi: ath12k: change to initialize recovery variables earlier in ↵Wen Gong
ath12k_core_reset() Sometimes device recovery fail with this operation. Run test command for many times: echo assert > /sys/kernel/debug/ath12k/wcn7850\ hw2.0_0000\:03\:00.0/simulate_fw_crash While recovery start, ath12k_core_post_reconfigure_recovery() will call ieee80211_restart_hw(), and the restart_work which queued by ieee80211_restart_hw() is running in another thread, it will call into ath12k_mac_op_start() and ath12k_mac_wait_reconfigure(), and the variables ab->recovery_start_count and ab->recovery_start is used in ath12k_mac_wait_reconfigure(), so ath12k need to initialize the variables before queue the restart_work, otherwise ath12k_mac_wait_reconfigure() maybe use the un-initialized variables. Change to initialize the 2 variables earlier and then recovery process become correct. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230830060850.18881-1-quic_wgong@quicinc.com
2023-09-20wifi: ath12k: enable 320 MHz bandwidth for 6 GHz band in EHT PHY capability ↵Wen Gong
for WCN7850 320 MHz bandwidth is reported only for single PHY mode for WCN7850, get it from WMI_HOST_HW_MODE_SINGLE ath12k_wmi_caps_ext_params and report it for 6 GHz band. After this patch, "iw list" shows 320 MHz support for WCN7850: EHT Iftypes: managed EHT PHY Capabilities: (0xe26f090010768800): 320MHz in 6GHz Supported EHT bw=320 MHz, max NSS for MCS 8-9: Rx=0, Tx=0 EHT bw=320 MHz, max NSS for MCS 10-11: Rx=0, Tx=0 EHT bw=320 MHz, max NSS for MCS 12-13: Rx=0, Tx=0 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230828040420.2165-1-quic_wgong@quicinc.com
2023-09-20wifi: ath9k: fix clang-specific fortify warningsDmitry Antipov
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following (somewhat confusing due to absence of an actual source code location): In file included from drivers/net/wireless/ath/ath9k/debug.c:17: In file included from ./include/linux/slab.h:16: In file included from ./include/linux/gfp.h:7: In file included from ./include/linux/mmzone.h:8: In file included from ./include/linux/spinlock.h:56: In file included from ./include/linux/preempt.h:79: In file included from ./arch/x86/include/asm/preempt.h:9: In file included from ./include/linux/thread_info.h:60: In file included from ./arch/x86/include/asm/thread_info.h:53: In file included from ./arch/x86/include/asm/cpufeature.h:5: In file included from ./arch/x86/include/asm/processor.h:23: In file included from ./arch/x86/include/asm/msr.h:11: In file included from ./arch/x86/include/asm/cpumask.h:5: In file included from ./include/linux/cpumask.h:12: In file included from ./include/linux/bitmap.h:11: In file included from ./include/linux/string.h:254: ./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] __read_overflow2_field(q_size_field, size); In file included from drivers/net/wireless/ath/ath9k/htc_drv_debug.c:17: In file included from drivers/net/wireless/ath/ath9k/htc.h:20: In file included from ./include/linux/module.h:13: In file included from ./include/linux/stat.h:19: In file included from ./include/linux/time.h:60: In file included from ./include/linux/time32.h:13: In file included from ./include/linux/timex.h:67: In file included from ./arch/x86/include/asm/timex.h:5: In file included from ./arch/x86/include/asm/processor.h:23: In file included from ./arch/x86/include/asm/msr.h:11: In file included from ./arch/x86/include/asm/cpumask.h:5: In file included from ./include/linux/cpumask.h:12: In file included from ./include/linux/bitmap.h:11: In file included from ./include/linux/string.h:254: ./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] __read_overflow2_field(q_size_field, size); The compiler actually complains on 'ath9k_get_et_strings()' and 'ath9k_htc_get_et_strings()' due to the same reason: fortification logic inteprets call to 'memcpy()' as an attempt to copy the whole array from it's first member and so issues an overread warning. These warnings may be silenced by passing an address of the whole array and not the first member to 'memcpy()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230829093856.234584-1-dmantipov@yandex.ru
2023-09-20wifi: ath9k: use u32 for txgain indexesDmitry Antipov
Since both 'ar9550_hw_get_modes_txgain_index()' and 'ar9561_hw_get_modes_txgain_index()' never returns negative values, prefer 'u32' over 'int' and adjust 'ar9003_hw_process_ini()' accordingly. Suggested-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230823182401.196270-2-dmantipov@yandex.ru
2023-09-20wifi: ath9k: simplify ar9003_hw_process_ini()Dmitry Antipov
Since commit 8896934c1684 ("ath9k_hw: remove direct accesses to channel mode flags") changes 'ar9550_hw_get_modes_txgain_index()' so it never returns -EINVAL, and 'ar9561_hw_get_modes_txgain_index()' never returns negative value too, an extra check in 'ar9003_hw_process_ini()' may be dropped. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230823182401.196270-1-dmantipov@yandex.ru
2023-09-20wifi: ath12k: fix radar detection in 160 MHzManish Dharanenthiran
Radar detection fails in the secondary 80 MHz when the the AP's primary 80 MHz is in non-DFS region in 160 MHz. This is due to WMI channel flag WMI_CHAN_INFO_DFS_FREQ2 is not set properly in case of the primary 80 MHz is in non-DFS region. HALPHY detects the radar pulses in the secondary 80 MHz only when WMI_CHAN_INFO_DFS_FREQ2 is set. Fix this issue by setting WMI channel flag WMI_CHAN_INFO_DFS_FREQ2 based on the radar_enabled flag from the channel context. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230802085852.19821-3-quic_mdharane@quicinc.com
2023-09-20wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chanManish Dharanenthiran
Fix WARN_ON() from ath12k_mac_update_vif_chan() if vdev is not up. Since change_chanctx can be called even before vdev_up. Do vdev stop followed by a vdev start in case of vdev is down. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-02903-QCAHKSWPL_SILICONZ-1 Signed-off-by: Manish Dharanenthiran <quic_mdharane@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230802085852.19821-2-quic_mdharane@quicinc.com
2023-09-20wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()Jinjie Ruan
Since debugfs_create_file() return ERR_PTR and never return NULL, so use IS_ERR() to check it instead of checking NULL. Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919050651.962694-1-ruanjinjie@huawei.com
2023-09-20wifi: brcmfmac: firmware: Annotate struct brcmf_fw_request with __counted_byKees Cook
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct brcmf_fw_request. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Arend van Spriel <aspriel@gmail.com> Cc: Franky Lin <franky.lin@broadcom.com> Cc: Hante Meuleman <hante.meuleman@broadcom.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: Matthias Brugger <mbrugger@suse.com> Cc: Hector Martin <marcan@marcan.st> Cc: "Alvin Šipraga" <alsi@bang-olufsen.dk> Cc: Hans de Goede <hdegoede@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Cc: SHA-cyfmac-dev-list@infineon.com Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Matthias Brugger <mbrugger@suse.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230915200552.never.642-kees@kernel.org
2023-09-20wifi: brcmfmac: Annotate struct brcmf_gscan_config with __counted_byKees Cook
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct brcmf_gscan_config. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Arend van Spriel <aspriel@gmail.com> Cc: Franky Lin <franky.lin@broadcom.com> Cc: Hante Meuleman <hante.meuleman@broadcom.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: Hector Martin <marcan@marcan.st> Cc: Ryohei Kondo <ryohei.kondo@cypress.com> Cc: Hans de Goede <hdegoede@redhat.com> Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Cc: SHA-cyfmac-dev-list@infineon.com Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230915200542.never.417-kees@kernel.org
2023-09-18wifi: wlcore: Convert to platform remove callback returning voidUwe Kleine-König
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. wlcore_remove() returned zero unconditionally. With that converted to return void instead, the wl12xx and wl18xx driver can be converted to .remove_new trivially. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230912171249.755901-1-u.kleine-koenig@pengutronix.de
2023-09-18wifi: rtl8xxxu: Add a description about the device ID 0x7392:0xb722Zenm Chen
According to the driver provided by EDIMAX, the device ID 0x7392:0xb722 belongs to EDIMAX EW-7722UTn V3, so add a comment about this. Signed-off-by: Zenm Chen <zenmchen@gmail.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230912053614.10644-1-zenmchen@gmail.com
2023-09-18wifi: rtw89: add mac_gen pointer to access mac port registersPing-Ke Shih
Using mac_gen pointer to reuse the code with WiFi 7 chips, and define MAC ports registers for WiFi 7 chips. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-7-pkshih@realtek.com
2023-09-18wifi: rtw89: consolidate registers of mac port to structPing-Ke Shih
MAC port is a design to support virtual interface on single MAC hardware. For next generation chips, register addresses are changed but definitions are the same, so move registers together to be easier to reuse codes. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-6-pkshih@realtek.com
2023-09-18wifi: rtw89: add chip_info::txwd_info size to generalize TX WD submitPing-Ke Shih
For existing chips, size of TX WD info is 6 words, but upcoming WiFi 7 chips become 8 words, so add a chip_info to reuse the code. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-5-pkshih@realtek.com
2023-09-18wifi: rtw89: add to fill TX descriptor v2Ping-Ke Shih
The format v2 of TX descriptor contains 8-word body and 8-word info, and fields include packet size, MAC_ID, security key ID and etc. By design, it can possibly only fill body to reduce overhead, but this driver keeps thing simple, so always fill body and info currently. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-4-pkshih@realtek.com
2023-09-18wifi: rtw89: add to fill TX descriptor for firmware command v2Ping-Ke Shih
This kind of TX descriptor is used to download firmware or send firmware command. Because we want to reduce descriptor overhead and this only needs two fields 'size' and 'type', hardware designers choose short form of RX descriptor for it. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-3-pkshih@realtek.com
2023-09-18wifi: rtw89: add to query RX descriptor format v2Ping-Ke Shih
RX descriptor is used to provide meta data of received data. The WiFi 7 chips use different RX descriptor format, so add this parser along with hardware design. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-2-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: deal with beacon NoA if GO existsZong-Zhe Yang
In MCC STA+GO mode, we calculate NoA information and fill it into the beacon of P2P GO. Since NoA uses only 32 bits to describe time things, we need to deal with renewal when TSF[63:32] is carried. We trigger FW to notify that. Then, we can update NoA information for new time period once we get notification from FW. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-9-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: deal with BT slot changeZong-Zhe Yang
When receiving request of adjusting BT slot from coex. mechanism, we need to fetch the new BT slot and use the new one to calculate MCC (multi-channel concurrency) pattern. Then, we update the new MCC pattern to FW. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-8-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: deal with P2P PS changeZong-Zhe Yang
MCC fills duration limit of a role according to NoA description. If P2P PS changes during MCC, we don't process P2P PS via normal flow. Instead, we re-fill duration limit of the role for new NoA description, and then we do MCC update. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-7-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: track beacon offset and update when neededZong-Zhe Yang
In MCC STA+GC mode, the offset between TBTTs of remote AP and remote GO might change. If the change is larger than tolerance, we should update MCC after re-calculating parameters for new things. So, we track that in rtw89_track_work() now. And, we add MCC update flow to tell FW either to change durations of roles or to replace entire pattern according to how MCC plans BT slot. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-6-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: update role bitmap when changedZong-Zhe Yang
Each MCC (multi-channel concurrency) role maintains a bitmap of mac IDs. The bitmap is supposed to contain the two points below. * mac ID of itself * mac ID(s) of STA(s) connecting to it Under STA+GC mode, the bitmaps of both roles should not change. However, under STA+GO mode, the bitmap of GO may change due to P2P clients which connect/disconnect to/from it. FW controls (TDMA-based) MCC things via mac IDs in bitmap of each role. For example, mac IDs are required by FW when it wants to pause role1's TX in role0 slot. So, to sync between driver and FW, we update the new mac ID bitmap of GO to FW once it's changed. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-5-pkshih@realtek.com
2023-09-18wifi: rtw89: 52c: rfk: disable DPK during MCCZong-Zhe Yang
DPK is one kind of RF calibration. When MCC (multi-channel concurrency) start/stop, DPK needs to do extra things to be off/on. We add a chanctx callback type, RTW89_CHANCTX_CALLBACK_RFK, and register it for RTL8852C to deal with DPK according to MCC states. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-4-pkshih@realtek.com
2023-09-18wifi: rtw89: rfk: disable driver tracking during MCCZong-Zhe Yang
After MCC (multi-channel concurrency) is started, FW will control channel changes and use the corresponding backup of RF calibration result. And, driver RF calibration (RF-K) won't be able to keep up with the speed at which the channels are changing. So, even if we keep tracking it in driver, the RF-K result might not be good either. To save these unnecessary things, we disable driver RF-K tracking during MCC. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-3-pkshih@realtek.com
2023-09-18wifi: rtw89: 52c: rfk: refine MCC channel info notificationZong-Zhe Yang
RF calibration will notify FW to backup the calibration result after it is done on a channel. For MCC (multi-channel concurrency) flow, when we at RTW89_ENTITY_MODE_MCC_PREPARE mode, RF calibration should execute on second channel of MCC, i.e. RTW89_SUB_ENTITY_1, and then, notify FW to backup the result for the second one. Originally, the RF calibration flow only fit single channel case. We are planning to support MCC on RTL8852C, so we refine its RF calibration flow to fit MCC case. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-2-pkshih@realtek.com
2023-09-18wifi: cw1200: Avoid processing an invalid TIM IEJeff Johnson
While converting struct ieee80211_tim_ie::virtual_map to be a flexible array it was observed that the TIM IE processing in cw1200_rx_cb() could potentially process a malformed IE in a manner that could result in a buffer over-read. Add logic to verify that the TIM IE length is large enough to hold a valid TIM payload before processing it. Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230831-ieee80211_tim_ie-v3-1-e10ff584ab5d@quicinc.com
2023-09-18wifi: brcmfmac: Replace 1-element arrays with flexible arraysJuerg Haefliger
Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"), UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking 'element' and 'channel_list' will trigger warnings, so make them proper flexible arrays. False positive warnings were: UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6984:20 index 1 is out of range for type '__le32 [1]' UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1126:27 index 1 is out of range for type '__le16 [1]' for these lines of code: 6884 ch.chspec = (u16)le32_to_cpu(list->element[i]); 1126 params_le->channel_list[i] = cpu_to_le16(chanspec); Cc: stable@vger.kernel.org # 6.5+ Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230914070227.12028-1-juerg.haefliger@canonical.com
2023-09-18wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packetPin-yen Lin
Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking@chromium.org> Acked-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Matthew Wang <matthewmwang@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org
2023-09-18wifi: rtw88: rtw8723d: Fix MAC address offset in EEPROMSascha Hauer
The MAC address is stored at offset 0x107 in the EEPROM, like correctly stated in the comment. Add a two bytes reserved field right before the MAC address to shift it from offset 0x105 to 0x107. With this the MAC address returned from my RTL8723du wifi stick can be correctly decoded as "Shenzhen Four Seas Global Link Network Technology Co., Ltd." Fixes: 87caeef032fc ("wifi: rtw88: Add rtw8723du chipset support") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Reported-by: Yanik Fuchs <Yanik.fuchs@mbv.ch> Cc: stable@vger.kernel.org Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230907071614.2032404-1-s.hauer@pengutronix.de
2023-09-18wifi: cfg80211: save power spectral density(psd) of regulatory ruleWen Gong
6 GHz regulatory domains introduces Power Spectral Density (PSD). The PSD value of the regulatory rule should be taken into effect for the ieee80211_channels falling into that particular regulatory rule. Save the values in the channel which has PSD value and add nl80211 attributes accordingly to handle it. Co-developed-by: Aditya Kumar Singh <quic_adisi@quicinc.com> Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com> Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Link: https://lore.kernel.org/r/20230914082026.3709-1-quic_wgong@quicinc.com [use hole in chan flags, reword docs] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-30 05:39:27 +0000