summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-09-25wifi: mac80211: allow transmitting EAPOL frames with tainted keyWen Gong
Lower layer device driver stop/wake TX by calling ieee80211_stop_queue()/ ieee80211_wake_queue() while hw scan. Sometimes hw scan and PTK rekey are running in parallel, when M4 sent from wpa_supplicant arrive while the TX queue is stopped, then the M4 will pending send, and then new key install from wpa_supplicant. After TX queue wake up by lower layer device driver, the M4 will be dropped by below call stack. When key install started, the current key flag is set KEY_FLAG_TAINTED in ieee80211_pairwise_rekey(), and then mac80211 wait key install complete by lower layer device driver. Meanwhile ieee80211_tx_h_select_key() will return TX_DROP for the M4 in step 12 below, and then ieee80211_free_txskb() called by ieee80211_tx_dequeue(), so the M4 will not send and free, then the rekey process failed becaue AP not receive M4. Please see details in steps below. There are a interval between KEY_FLAG_TAINTED set for current key flag and install key complete by lower layer device driver, the KEY_FLAG_TAINTED is set in this interval, all packet including M4 will be dropped in this interval, the interval is step 8~13 as below. issue steps: TX thread install key thread 1. stop_queue -idle- 2. sending M4 -idle- 3. M4 pending -idle- 4. -idle- starting install key from wpa_supplicant 5. -idle- =>ieee80211_key_replace() 6. -idle- =>ieee80211_pairwise_rekey() and set currently key->flags |= KEY_FLAG_TAINTED 7. -idle- =>ieee80211_key_enable_hw_accel() 8. -idle- =>drv_set_key() and waiting key install complete from lower layer device driver 9. wake_queue -waiting state- 10. re-sending M4 -waiting state- 11. =>ieee80211_tx_h_select_key() -waiting state- 12. drop M4 by KEY_FLAG_TAINTED -waiting state- 13. -idle- install key complete with success/fail success: clear flag KEY_FLAG_TAINTED fail: start disconnect Hence add check in step 11 above to allow the EAPOL send out in the interval. If lower layer device driver use the old key/cipher to encrypt the M4, then AP received/decrypt M4 correctly, after M4 send out, lower layer device driver install the new key/cipher to hardware and return success. If lower layer device driver use new key/cipher to send the M4, then AP will/should drop the M4, then it is same result with this issue, AP will/ should kick out station as well as this issue. issue log: kworker/u16:4-5238 [000] 6456.108926: stop_queue: phy1 queue:0, reason:0 wpa_supplicant-961 [003] 6456.119737: rdev_tx_control_port: wiphy_name=phy1 name=wlan0 ifindex=6 dest=ARRAY[9e, 05, 31, 20, 9b, d0] proto=36488 unencrypted=0 wpa_supplicant-961 [003] 6456.119839: rdev_return_int_cookie: phy1, returned 0, cookie: 504 wpa_supplicant-961 [003] 6456.120287: rdev_add_key: phy1, netdev:wlan0(6), key_index: 0, mode: 0, pairwise: true, mac addr: 9e:05:31:20:9b:d0 wpa_supplicant-961 [003] 6456.120453: drv_set_key: phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 cipher:0xfac04, flags=0x9, keyidx=0, hw_key_idx=0 kworker/u16:9-3829 [001] 6456.168240: wake_queue: phy1 queue:0, reason:0 kworker/u16:9-3829 [001] 6456.168255: drv_wake_tx_queue: phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 ac:0 tid:7 kworker/u16:9-3829 [001] 6456.168305: cfg80211_control_port_tx_status: wdev(1), cookie: 504, ack: false wpa_supplicant-961 [003] 6459.167982: drv_return_int: phy1 - -110 issue call stack: nl80211_frame_tx_status+0x230/0x340 [cfg80211] cfg80211_control_port_tx_status+0x1c/0x28 [cfg80211] ieee80211_report_used_skb+0x374/0x3e8 [mac80211] ieee80211_free_txskb+0x24/0x40 [mac80211] ieee80211_tx_dequeue+0x644/0x954 [mac80211] ath10k_mac_tx_push_txq+0xac/0x238 [ath10k_core] ath10k_mac_op_wake_tx_queue+0xac/0xe0 [ath10k_core] drv_wake_tx_queue+0x80/0x168 [mac80211] __ieee80211_wake_txqs+0xe8/0x1c8 [mac80211] _ieee80211_wake_txqs+0xb4/0x120 [mac80211] ieee80211_wake_txqs+0x48/0x80 [mac80211] tasklet_action_common+0xa8/0x254 tasklet_action+0x2c/0x38 __do_softirq+0xdc/0x384 Signed-off-by: Wen Gong <quic_wgong@quicinc.com> Link: https://lore.kernel.org/r/20230801064751.25803-1-quic_wgong@quicinc.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: add mapping of a periphery register crf for WH RFMukesh Sisodiya
Add the support for prph register RF details and map it to get the RF ID of NIC. Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110727.ccfc4868111f.I94dd75fc82443facf571f2fe8e23c50e9053a35a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: check for iwl_mvm_mld_update_sta() errorsJohannes Berg
The return value of this function is assigned, but then unused. Check for errors here. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110727.a9496c232d48.I74adaa8f3c6fd3252348e79f18605246936ef27d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: support injection antenna controlJohannes Berg
Pull up the injection rate control one layer, and let it control the antenna settings as well. Since mac80211 has already checked that enough antennas are configured, and we only have two bits, it's enough to just copy the data over. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110727.12ab7634dbbc.I5aa16c99864ecd7375011a8996de2564fd01fc30@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: refactor TX rate handlingJohannes Berg
Refactor the injection and other frame TX rate handling to always return the injection rate directly, by factoring the legay rate portion out into a new function called in the two relevant places (injection and non-injection). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110727.dc920357bad0.I5ee8512fb63f0423c1da35b59fea8811d60c1ad3@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: make pldr_sync AX210 specificJohannes Berg
The register here is device specific, so we need to gate the reading/checking to apply only on AX210 family. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.928901700ad8.I648efdc4400d9e537359915a9a8f363d5d255ead@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: fail NIC access fast on dead NICJohannes Berg
If the NIC is already dead, as detected by the transport then there's no point to try to grab the NIC access and time out, we can just fail fast. This may speed up recovery. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.f3d8498c5a60.I5d0c442a731ca4c00716910d215b4bcde6963a65@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: add support for new wowlan_info_notifYedidya Benshimol
This new version of wolan_info_notif supports the handling of bigtk during d3, this patch holds parsing of the new notif version, adding new keys and updating ipn of existing keys during the resume flow. Signed-off-by: Yedidya Benshimol <yedidya.ben.shimol@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.4ebcd244f436.Ib507573d50fa0ac666d09ab71f5241ccbcd7cd00@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: pcie: (re-)assign BAR0 on driver bindJohannes Berg
There's a race with runtime PM getting enabled by userspace: - we rescan the PCI bus - this creates the new PCI device including its sysfs representation - udev sees the new device, and the (OS-specific?) scripting enables runtime PM by writing to power/control; this can happen _before_ the next step - this will runtime-suspend the device which saves the config space, including the BAR0 that wasn't assigned yet - the bus rescan assigns resources to the devices and writes them to the config space of the device (but not the runtime-pm saved copy) - the driver binds and this disallows runtime PM, so the device is resumed, restoring the (incomplete!) config space - the driver cannot work due to BAR0 not being configured Fixing the actual race is hard and deep in the PCI layer, though probably should be done for upstream as well; perhaps runtime PM should only be allowed after resource assignment, or some other TBD way. Work around this in the driver for now by simply (re-)assigning BAR0 when the driver initializes, if it's unset. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.5f5f782a4e97.I4b7bf5c52ba44a8c7f9878009021689bbfa9c5ef@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: implement enable/disable for China 2022 regulatoryAnjaneyulu
China 2022 regulations are enabled by default. Disable only when disabled in BIOS or the firmware don't support this capability. If the firmware has this capability, read BIOS configuration data in function 4 using ACPI API and send GRP_REGULATORY_LARI_CONFIG_CHANGE_CMD to the firmware. Any error while reading BIOS data results in enablement of china 2022 regulations. Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.ba7cb3003e53.If5a180a59ee85ed4a4c9146cfeff841c25b81066@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: handle link-STA allocation in restartJohannes Berg
During HW restart, STA link changes happen while the link-sta is already allocated (had been prior to the restart). Adjust the allocation and checks to handle that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.99b7cc754b00.Iaa0503a3100250489fed8b4bdcf60e24a96d3392@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: iterate active links for STA queuesJohannes Berg
During HW restart in eSR, links allocated in a station and links active in the interface may differ. Use for_each_sta_active_link to capture this. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.7ee1f1a55e1c.I410c512d1fad7d1cf9b2d2a3451a312821dc816d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: iwlwifi: mvm: support set_antenna()Emmanuel Grumbach
set_antenna() is supported only when the device is not started in mac80211 which translates to the firmware not being loaded in iwlwifi. The tricky part is that iwlwifi populates the sband data during its boot and doesn't touch this data afterwards, but if the antenna settings forbid MIMO, we need to update the sband data. Rework the nvm parsing code to allow to get an existing nvm_data and modify the sband with additional constraints (tx / rx chains masks). Suggested-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230921110726.81d94d630c95.I9473da818cbeeb51b2f89dcc59b00019113e7f55@changeid [add bugfix from Benjamin for iwl_mvm_get_valid_rx_ant()] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: reject MLO channel configuration if not supportedBenjamin Berg
Reject configuring a channel for MLO if either EHT is not supported or the BSS does not have the correct ML element. This avoids trying to do a multi-link association with a misconfigured AP. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.80c3b8e5a344.Iaa2d466ee6280994537e1ae7ab9256a27934806f@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: report per-link error during associationBenjamin Berg
With this cfg80211 can report the link that caused the error to userspace which is then able to react to it by e.g. removing the link from the association and retrying. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.275fc7f5c426.I8086c0fdbbf92537d6a8b8e80b33387fcfd5553d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: cfg80211: report per-link errors during associationBenjamin Berg
When one of the links (other than the assoc_link) is misconfigured and cannot work the association will fail. However, userspace was not able to tell that the operation only failed because of a problem with one of the links. Fix this, by allowing the driver to set a per-link error code and reporting the (first) offending link by setting the bad_attr accordingly. This only allows us to report the first error, but that is sufficient for userspace to e.g. remove the offending link and retry. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.ebe63c0bd513.I40799998f02bf987acee1501a2522dc98bb6eb5a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: support antenna control in injectionJohannes Berg
Support antenna control for injection by parsing the antenna radiotap field (which may be presented multiple times) and telling the driver about the resulting antenna bitmap. Of course there's no guarantee the driver will actually honour this, just like any other injection control. If misconfigured, i.e. the injected HT/VHT MCS needs more chains than antennas are configured, the bitmap is reset to zero, indicating no selection. For now this is only set up for two anntenas so we keep more free bits, but that can be trivially extended if any driver implements support for it that can deal with hardware with more antennas. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.f71001aa4da9.I00ccb762a806ea62bc3d728fa3a0d29f4f285eeb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: support handling of advertised TID-to-link mappingAyala Beker
Support handling of advertised TID-to-link mapping elements received in a beacon. These elements are used by AP MLD to disable specific links and force all clients to stop using these links. By default if no TID-to-link mapping is advertised, all TIDs shall be mapped to all links. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.623c4b692ff9.Iab0a6f561d85b8ab6efe541590985a2b6e9e74aa@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: add support for parsing TID to Link mapping elementAyala Beker
Add the relevant definitions for TID to Link mapping element according to the P802.11be_D4.0. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.9ea9b0b4412a.I2281ab2c70e8b43a39032dc115db6a80f1f0b3f4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211_hwsim: Handle BSS_CHANGED_VALID_LINKSIlan Peer
In station mode, set the active links to all the usable links. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.6218307226d3.I249f52b4773423a33c3121e31002abe0a8d98e78@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: Notify the low level driver on change in MLO valid linksIlan Peer
Notify the low level driver when there is change in the valid links. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.4fc85b0a51b0.I64238e0e892709a2bd4764b3bca93cdcf021e2fd@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211_hwsim: move kernel-doc descriptionJohannes Berg
Move the description after the parameter section, to make the kernel-doc script in verbose mode happy about it. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.7f5951a8e327.I5e0cc993acf281d6d90f124c6cce9a2f47000c7d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: describe return values in kernel-docJohannes Berg
Add descriptions for two return values for two functions that are missing them. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.79307c341723.Ibae386f0354f2e215d4955752ac378acc2466b51@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: cfg80211: reg: describe return values in kernel-docJohannes Berg
Describe the function return values in kernel-doc. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.8b1e45c8bab8.I6dbae4f6dfe8f5352bc44565cc5131e73dd1873f@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: allow for_each_sta_active_link() under RCUJohannes Berg
Since we only use this to protect the dereference and with STA mutex, we can also allow this with just RCU. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.73c3e04985f4.I52ef396d693e0e381a73eade06850137d8900948@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: relax RCU check in for_each_vif_active_link()Johannes Berg
To iterate the vif links we don't necessarily need to be in an RCU critical section, it's also possible to hold the sdata/wdev mutex. Annotate for_each_vif_active_link() accordingly. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.858921bd2860.I01f456be8ce2a4fbd15e0d44302e2f7d72e91987@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: don't connect to an AP while it's in a CSA processAyala Beker
Connection to an AP that is running a CSA flow may end up with a failure as the AP might change its channel during the connection flow while we do not track the channel change yet. Avoid that by rejecting a connection to such an AP. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.e5001a762a4a.I9745c695f3403b259ad000ce94110588a836c04a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: update the rx_chains after set_antenna()Emmanuel Grumbach
rx_chains was set only upon registration and it we rely on it for the active chains upon SMPS configuration after association. When we use the set_antenna() API to limit the rx_chains from 2 to 1, this caused issues with iwlwifi since we still had 2 active_chains requested. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.2dde4da246b2.I904223c868c77cf2ba132a3088fe6506fcbb443b@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: use bandwidth indication element for CSAJohannes Berg
In CSA, parse the (EHT) bandwidth indication element and use it (in fact prefer it if present). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230920211508.43ef01920556.If4f24a61cd634ab1e50eba43899b9e992bf25602@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: cfg80211: split struct cfg80211_ap_settingsJohannes Berg
Using the full struct cfg80211_ap_settings for an update is misleading, since most settings cannot be updated. Split the update case off into a new struct cfg80211_ap_update. Change-Id: I3ba4dd9280938ab41252f145227a7005edf327e4 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: ethtool: always hold wiphy mutexJohannes Berg
Drivers should really be able to rely on the wiphy mutex being held all the time, unless otherwise documented. For ethtool, that wasn't quite right. Fix and clarify this in both code and documentation. Reported-by: syzbot+c12a771b218dcbba32e1@syzkaller.appspotmail.com Fixes: 0e8185ce1dde ("wifi: mac80211: check wiphy mutex in ops") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: work around Cisco AP 9115 VHT MPDU lengthJohannes Berg
Cisco AP module 9115 with FW 17.3 has a bug and sends a too large maximum MPDU length in the association response (indicating 12k) that it cannot actually process. Work around that by taking the minimum between what's in the association response and the BSS elements (from beacon or probe response). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230918140607.d1966a9a532e.I090225babb7cd4d1081ee9acd40e7de7e41c15ae@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: cfg80211: Fix 6GHz scan configurationIlan Peer
When the scan request includes a non broadcast BSSID, when adding the scan parameters for 6GHz collocated scanning, do not include entries that do not match the given BSSID. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Gregory Greenman <gregory.greenman@intel.com> Link: https://lore.kernel.org/r/20230918140607.6d31d2a96baf.I6c4e3e3075d1d1878ee41f45190fdc6b86f18708@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: cfg80211: make read-only array centers_80mhz static constColin Ian King
Don't populate the read-only array lanes on the stack, instead make it static const. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20230919095205.24949-1-colin.i.king@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: fix potential key leakJohannes Berg
When returning from ieee80211_key_link(), the key needs to have been freed or successfully installed. This was missed in a number of error paths, fix it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-25wifi: mac80211: fix potential key use-after-freeJohannes Berg
When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-09-22wifi: rtw89: load TX power related tables from FW elementsZong-Zhe Yang
The following FW elements are recognized, and then the valid entries in them are loaded into SW struct case by case. * TX power by rate * TX power limit 2 GHz * TX power limit 5 GHz * TX power limit 6 GHz * TX power limit RU 2 GHz * TX power limit RU 5 GHz * TX power limit RU 6 GHz * TX shape limit * TX shape limit RU One single firmware file can contain multiples of each of the above FW elements. Each of them is configured with a target RFE (RF front end) type. We choose one of the multiples to load based on RFE type. If there are multiples of the same FW elements with the same target RFE type. The last one will be applied. We don't want to have many loading variants for above FW elements. Even if between different chips or between different generations, we would like to maintain only one single set of loadings. So, the loadings are designed to consider compatibility. The main concepts are listed below. * The driver structures, which are used to cast binary entry from FW, cannot insert new members in the middle. If there are something new, they should always be appended at the tail. * Each binary entry from FW uses a dictionary way containing a key set and a data. The keys in the key set indicate where to put the data. * If size of driver struct and size of binary entry do not match when loading, it means the number of keys in the key set are different. Then, we deal with compatibility. No matter which one has more keys, we take/use zero on those mismatched keys. If driver struct is bigger (backward compatibility): e.g. SW uses two keys, but FW is built with one key. Then, put the data of FW(keyX) into SW[keyX][0]. If binary entry is bigger (forward compatibility): e.g. FW is built with two keys, but SW uses one key. Then, only take the data of FW(keyX, keyY = 0) into SW[keyX] Besides, chip info setup flow is tweaked a bit for the following. * Before loading FW elements, we need to determine chip RFE via efuse. * Setting up RFE parameters depends on loading FW elements ahead. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-8-pkshih@realtek.com
2023-09-22wifi: rtw89: phy: extend TX power common stuffs for Wi-Fi 7 chipsZong-Zhe Yang
The following are introduced for Wi-Fi 7 chips. 1. take BW/OFDMA into account on TX power by rate 2. increase TX power offset types up to EHT 3. split TX shape into tx_shape_lmt and tx_shape_lmt_ru If functions which are only for AX, they always access TX power by rate with BW/OFDMA = 0/0, and they don't access tx_shape's lmt_ru section. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-7-pkshih@realtek.com
2023-09-22wifi: rtw89: load TX power by rate when RFE parms setupZong-Zhe Yang
Table of TX power by rate only needs to be loaded once. But, we originally loaded it every time we start core. Now, we load it one time along as RFE (RF Front End) parameters are determined. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-6-pkshih@realtek.com
2023-09-22wifi: rtw89: phy: refine helpers used for raw TX powerZong-Zhe Yang
Originally, these helpers were implemented by macros. We rewrite them by normal functions. In the new function to seek raw TX power by rate, we access the array according to rate section and discard the original pointer arithmetic. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-5-pkshih@realtek.com
2023-09-22wifi: rtw89: indicate TX power by rate table inside RFE parameterZong-Zhe Yang
For next-generation chips, TX power by rate table comes from RFE (RF front end) parameter. It can be different according to RFE type. So, we indicate TX power by rate table inside RFE parameter ahead. For current chips, even with different RFE types, a chip is configured with a single TX power by rate table. So, this commit doesn't really affect these currently supported chips. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-4-pkshih@realtek.com
2023-09-22wifi: rtw89: indicate TX shape table inside RFE parameterZong-Zhe Yang
For next-generation chips, TX shape table comes from RFE (RF front end) parameter. It can be different according to RFE type. So, we indicate TX shape table inside RFE parameter ahead. For current chips, even with different RFE types, a chip is configured with a single TX shape table. So, this commit doesn't really affect these currently supported chips. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-3-pkshih@realtek.com
2023-09-22wifi: rtw89: add subband index of primary channel to struct rtw89_chanPing-Ke Shih
The subband index is a hardware value of relationship between primary channel and bandwidth, and it is used by setting channel/bandwidth to specify the primary channel. Because this index is only needed when bandwidth >= 20 MHz, adjust order of enumerator bandwidth to access offsets array easier. To prevent misuse RTW89_CHANNEL_WIDTH_NUM as size, change it to RTW89_CHANNEL_WIDTH_ORDINARY_NUM that will be the size of array. The enumerator values of bandwidth (before ordinary number) will be also used by upcoming TX power table built in firmware file, so add a comment to remind keeping the order. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230920074322.42898-2-pkshih@realtek.com
2023-09-22wifi: mwifiex: followup PCIE and related cleanupsDmitry Antipov
Introduce a few more (PCIE and generic interface related) cleanups which becomes reasonable after the previous patch. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919132804.73340-2-dmantipov@yandex.ru
2023-09-22wifi: mwifiex: simplify PCIE write operationsDmitry Antipov
Since 'mwifiex_write_reg()' just issues void 'iowrite32()', convert the former to 'void' and simplify all related users (with the only exception of 'read_poll_timeout()' which explicitly requires a non-void function argument). Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919132804.73340-1-dmantipov@yandex.ru
2023-09-22wifi: mt76: mt76x02: fix MT76x0 external LNA gain handlingFelix Fietkau
On MT76x0, LNA gain should be applied for both external and internal LNA. On MT76x2, LNA gain should be treated as 0 for external LNA. Move the LNA type based logic to mt76x2 in order to fix mt76x0. Fixes: 2daa67588f34 ("mt76x0: unify lna_gain parsing") Reported-by: Shiji Yang <yangshiji66@outlook.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230919194747.31647-1-nbd@nbd.name
2023-09-21wifi: ath11k: remove unused members of 'struct ath11k_base'Dmitry Antipov
Remove set but otherwise unused 'wlan_init_status' and 'wmi_ready' members of 'struct ath11k_base', adjust 'ath11k_wmi_tlv_rdy_parse()' accordingly. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230824075121.121144-2-dmantipov@yandex.ru
2023-09-21wifi: ath11k: drop redundant check in ath11k_dp_rx_mon_dest_process()Dmitry Antipov
In 'ath11k_dp_rx_mon_dest_process()', 'mon_dst_srng' points to a member of 'srng_list', which is a fixed-size array inside 'struct ath11k_hal'. This way, if 'ring_id' is valid (i. e. between 0 and HAL_SRNG_RING_ID_MAX - 1 inclusive), 'mon_dst_srng' can't be NULL and so relevant check may be dropped. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230824075121.121144-1-dmantipov@yandex.ru
2023-09-21wifi: ath11k: drop NULL pointer check in ath11k_update_per_peer_tx_stats()Dmitry Antipov
Since 'user_stats' is a fixed-size array of 'struct htt_ppdu_user_stats' in 'struct htt_ppdu_stats', any of its member can't be NULL and so relevant check may be dropped. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230906093704.14001-1-dmantipov@yandex.ru
2023-09-21wifi: ath11k: fix boot failure with one MSI vectorBaochen Qiang
Commit 5b32b6dd96633 ("ath11k: Remove core PCI references from PCI common code") breaks with one MSI vector because it moves affinity setting after IRQ request, see below log: [ 1417.278835] ath11k_pci 0000:02:00.0: failed to receive control response completion, polling.. [ 1418.302829] ath11k_pci 0000:02:00.0: Service connect timeout [ 1418.302833] ath11k_pci 0000:02:00.0: failed to connect to HTT: -110 [ 1418.303669] ath11k_pci 0000:02:00.0: failed to start core: -110 The detail is, if do affinity request after IRQ activated, which is done in request_irq(), kernel caches that request and returns success directly. Later when a subsequent MHI interrupt is fired, kernel will do the real affinity setting work, as a result, changs the MSI vector. However at that time host has configured old vector to hardware, so host never receives CE or DP interrupts. Fix it by setting affinity before registering MHI controller where host is, for the first time, doing IRQ request. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 Fixes: 5b32b6dd9663 ("ath11k: Remove core PCI references from PCI common code") Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20230907015606.16297-1-quic_bqiang@quicinc.com
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-29 16:13:14 +0000