- 08 Nov, 2023 14 commits
-
-
Shiji Yang authored
When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in hardware interface. However, mac80211 will not automatically stop the queue. If we don't manually stop the beacon queue, the queue will be deadlocked and unable to start again. This patch fixes the issue where Apple devices cannot connect to the AP after calling ieee80211_restart_hw(). Signed-off-by:
Shiji Yang <yangshiji66@outlook.com> Acked-by:
Stanislaw Gruszka <stf_xl@wp.pl> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
-
Shiji Yang authored
rt2800 has a lot of registers to control the RTS enable/disable status for different rates. And the driver control them via rt2800_set_rts_threshold(). When RTS was disabled in user interface, this function won't be called at all. This means that the RTS is still 'on' for CCK and OFDM rates. So we'd better to disable them by default because it should be like this. The RTS for HT20 and HT40 is already default off so we don't need to touch them. If we toggle the RTS status, these register bits will be enable/disable again by rt2800_set_rts_threshold(). Signed-off-by:
-
Shiji Yang authored
When I tried to fix the watchdog of rt2800, I found that sometimes the watchdog can not reset the hung device. This is because the queue is not completely stuck, it just becomes very slow. The MTK vendor driver for the new chip MT7603/MT7612 has a DMA busy watchdog to detect device hangs by checking DMA busy status. This watchdog implementation is something similar to it. To reduce unnecessary reset, we can check the INT_SOURCE_CSR register together as I found that when the radio hung, the RX/TX coherent interrupt will always stuck at triggered state. The 'watchdog' module parameter has been extended to control all watchdogs(0=disabled, 1=hang watchdog, 2=DMA watchdog, 3=both). This new watchdog function is a slight schedule and it won't affect the transmission speed. So we can turn on it by default. Due to the INT_SOURCE_CSR register is invalid on rt2800 USB NICs, the DMA busy watchdog will be automatically disabled for them. Tested on MT7620 and RT5350. Signed-off-by:
-
Chih-Kang Chang authored
The broadcast packets will be filtered in the FIF_ALLMULTI flag in the original code, which causes beacon packets to be filtered out and disconnection. Therefore, we fix it. Fixes: e3037485 ("rtw88: new Realtek 802.11ac driver") Signed-off-by:
Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
-
Dmitry Antipov authored
Since 'ieee80211_txq_get_depth()' allows NULL for 2nd and 3rd arguments, simplify '__rtw_tx_work()' by dropping unused 'byte_cnt'. Compile tested only. Signed-off-by:
Dmitry Antipov <dmantipov@yandex.ru> Acked-by:
-
Ping-Ke Shih authored
To notify firmware TDMA timeslot assignment, append TDMA parameters when sending policy H2C firmware command. However, compiler warns we do memcpy() data to val[] field of TLV struct. To avoid this, assign the struct value with simple '=' instead. Compile tested only. rtw89/coex.c: In function '_append_tdma': drivers/net/wireless/realtek/rtw89/coex.c:1585:17: warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=] 1585 | memcpy(&v3->tdma, &dm->tdma, sizeof(v3->tdma)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/wireless/realtek/rtw89/coex.h:8, from drivers/net/wireless/realtek/rtw89/coex.c:5: drivers/net/wireless/realtek/rtw89/core.h:2703:37: note: at offset [5714, 71249] into destination object 'ver' of size 8 2703 | const struct rtw89_btc_ver *ver; | ^~~ drivers/net/wireless/realtek/rtw89/coex.c:1579:17: warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=] 1579 | memcpy(v, &dm->tdma, sizeof(*v)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/realtek/rtw89/core.h:2703:37: note: at offset [5710, 71245] into destination object 'ver' of size 8 2703 | const struct rtw89_btc_ver *ver; | ^~~ Reported-by:kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202310301908.Wrj0diqe-lkp@intel.com/Signed-off-by:
-
Ping-Ke Shih authored
For normal use, we do additional settings than mac_pre_init, such as more TX/RX DMA channels, interrupt mitigation and etc. Signed-off-by:
-
Ping-Ke Shih authored
PCI LTR (Latency Tolerance Reporting) is a capability to yield expected power consumption, and we configure the parameters according to design. Signed-off-by:
-
Ping-Ke Shih authored
Call this function when doing MAC initialization at probe stage. It does partial initial registers only, because we only need basic ability to download firmware. The function to clear index is the sub-function, so set its pointer as well. Signed-off-by:
-
Ping-Ke Shih authored
Use gen_def pointer to call three WiFi 6 specific functions, and add _ax suffix to them. Then, we will implement functions for WiFi 7 chips later. The mac_{pre,post}_init are used to initialize PCI during doing MAC initialization, and clear PCI ring index to make index consistent between driver, firmware and hardware. Signed-off-by: -
Ping-Ke Shih authored
In order to reuse PCI initial and configuration flows, add struct rtw89_pci_gen_def to abstract the differences between WiFi 6/7 generations. Signed-off-by:
-
Dmitry Antipov authored
Simplify 'wilc_scan()' assuming 'struct wilc_priv *' is the only data passed to '(*scan_result)()' callback and thus avoid typeless 'void *' pointers in related code, including 'struct wilc_user_scan_req'. Compile tested only. Signed-off-by:
-
Dmitry Antipov authored
Remove set but otherwise unused 'ch' member of 'struct wilc_conn_info' and avoid typeless 'void *' pointers in '(*conn_result)()' callback. Likewise for 'wilc_parse_join_bss_param()'. Compile tested only. Signed-off-by:
-
Dan Carpenter authored
Check for if the usb_alloc_urb() failed. Fixes: 68d57a07 ("wireless: add plfxlc driver for pureLiFi X, XL, XC devices") Signed-off-by:
Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by:
-
- 30 Oct, 2023 26 commits
-
-
Arnd Bergmann authored
Wireless RNDIS USB is a new-style CFG80211 driver for 802.11b and 802.11g USB hardware from around 2004 to 2006. This makes it more modern than any of the others, but Kalle already classified it as "legacy" in commit 298e50ad ("wifi: move raycs, wl3501 and rndis_wlan to legacy directory"). Jussi Kivilinna worked on this driver between 2008 and 2012, and it has only seen cosmetic updates after that. Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Arnd Bergmann authored
Planet WL3501 is another PCMCIA driver for pre-802.11b interfaces (2Mbit/s) with incomplete CFG80211 support. This was marked as orphaned in 2017 but has been unmaintained for a long time before that. Signed-off-by:
-
Arnd Bergmann authored
Aviator/Raytheon is an early PCMCIA driver, apparently predating 802.11b and only supporting wireless extensions. The driver has been orphaned since 2010 and only seen cosmetic updates long before than. Jean Tourrilhes pointed out in a 2005 changelog that he tested a change on actual hardware, which was apparently already noteworthy back then. Signed-off-by:
-
Arnd Bergmann authored
Orinoco is a PIO-only ISA/PCMCIA 802.11b device with extra bus interface connections for PCI/Cardbus/mini-PCI and a few pre-2002 Apple PowerMac variants. It supports both wireless extensions and CFG80211, but I could not tell if it requires using both. This device used to be one of the most common ones 20 years ago, but has been orphaned for most of the time since then, and the conversion to cfg80211 has stalled in 2010. Signed-off-by:
-
Arnd Bergmann authored
This is a wireless extensions style driver for 802.11b USB dongles, with partial support for cfg80211 interfaces. As these are all external dongles, there are probably few users that have not yet replaced them with cheap 802.11n devices that work better. Signed-off-by:
-
Arnd Bergmann authored
HostAP is an ISA/PCMCIA style 802.11b driver supporting only wireless extensions, and some custom ioctls (already removed). Some devices include a legacy PCI bridge but no DMA. The driver was marked obsolete in 2016 and is highly unlikely to still have any users. Signed-off-by:
-
Arnd Bergmann authored
Cisco Aironet is an 802.11b PCMCIA and mini-PCI with limited support for Cardbus DMA and for CFG80211. Both PCMCIA and WEXT are deprecated, and there is little chance that anyone is still using this driver, so remove it. Signed-off-by:
-
Arnd Bergmann authored
Atmel at76c502/at76c504/at76c506 is a PIO-only (PCMCIA, mini-PCI and Cardbus) 802.11b driver with incomplete CFG80211 support. Both PCMCIA and WEXT are deprecated, and there is little chance that anyone is still using this driver, so remove it. The related at76c50x USB driver uses MAC80211 and remains. Signed-off-by:
-
Arnd Bergmann authored
With all the other PCMCIA WLAN adapters gone from the kernel, this is now the last remaining device with this interface, but as far as I can tell, all the actual libertas users were actually using either SDIO or USB. Signed-off-by:
-
Ping-Ke Shih authored
PHY status IEs is used to have more information about received packets, such as RSSI and EVM. For each PHY IE type, it has different predefined PHY IE length, and the length are changed, so add them for WiFi 7 chips accordingly. Signed-off-by:
-
Ping-Ke Shih authored
For WiFi 7 chips, some fields and predefined length are changed, so add them accordingly. The mac_id field is used to identify peer that send a packet, and we can use it to know RSSI and traffic from the peer. For WiFi 7 chips, RXWD.mac_id of PPDU status packet is not set by hardware. Instead, we should fill it by rxinfo_user[].mac_id of PPDU status content. Also, filter out invalid reports to prevent warning messages keep showing. Signed-off-by:
-
Zong-Zhe Yang authored
Different chip can support different max user in one PPDU report. So, we now configure it in chip info. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Ping-Ke Shih authored
The new chips change hardware design to shrink entry size of address CAM from 0x40 to 0x20, so make this change accordingly. Signed-off-by:
-
Justin Stitt authored
strncpy() is deprecated for use on NUL-terminated destination strings [1] and as such we should prefer more robust and less ambiguous string interfaces. `extra` is clearly supposed to be NUL-terminated which is evident by the manual NUL-byte assignment as well as its immediate usage with strlen(). Moreover, let's NUL-pad since there is deliberate effort (48 instances) made elsewhere to zero-out buffers in these getters and setters: 6050 | memset(local->config.nodeName, 0, sizeof(local->config.nodeName)); 6130 | memset(local->config.rates, 0, 8); 6139 | memset(local->config.rates, 0, 8); 6414 | memset(key.key, 0, MAX_KEY_SIZE); 6497 | memset(extra, 0, 16); (to be clear, strncpy also NUL-padded -- we are matching that behavior) Considering the above, a suitable replacement is `strscpy_pad` due to the fact that it guarantees both NUL-termination and NUL-padding on the destination buffer. We can also replace the hard-coded size of "16" to IW_ESSID_MAX_SIZE because this function is a wext handler. In wext-core.c we have: static const struct iw_ioctl_description standard_ioctl[] = { ... [IW_IOCTL_IDX(SIOCGIWNICKN)] = { .header_type = IW_HEADER_TYPE_POINT, .token_size = 1, .max_tokens = IW_ESSID_MAX_SIZE, }, So the buffer size is (strangely) IW_ESSID_MAX_SIZE Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by:Justin Stitt <justinstitt@google.com> Reviewed-by:
Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by:
-
Dmitry Antipov authored
Ensure 'sdio_release_host()' is always issued on return from 'wilc_sdio_cmd53()'. Compile tested only. Signed-off-by:
Ajay Singh <ajay.kathat@microchip.com> Signed-off-by:
-
Dmitry Antipov authored
For 'struct wilc_remain_ch', drop set but otherwise unused 'duration' field and adjust 'expired' callback assuming that the only data passed to it is 'struct wilc_vif *', thus making 'wilc_remain_on_channel()' a bit simpler as well. Compile tested only. Signed-off-by:
-
Ping-Ke Shih authored
The register to enable/disable PCI DMA IO has many variants, so define and use a field to control it accordingly. Signed-off-by:
-
Ping-Ke Shih authored
To make hardware efficient to determine if RX ring is full, introduce new design that checks if reading and writing indices are equal. Comparing to old design, initial indices of both reading and writing indices are 0 that means empty, and hardware checks full by "writing index + 1 == reading index". The "+1" has extra cost for hardware, so new design is to avoid this. Take ring size is 256 as an example, the initial reading and writing indices are 255 and 0 respectively; the initial values mean empty. If two indices are the same, for example 5 and 5, it means ring is full. wp rp used_cnt state 255 0 0 initial (ring is empty) 255 1 1 receive 1st packet 255 2 2 receive 2nd packet 0 2 1 driver read 1st packet 1 2 0 driver read 2nd packet (ring is empty) : 5 5 255 ring is full Note: 'rp' is hardware writing index Signed-off-by: -
Ping-Ke Shih authored
PCI rings are used to DMA TX/RX packets. The address of WiFi 7 chips are different from previous ones, so add them according to hardware design. Another difference is that driver doesn't need to configure BD (buffer descriptor) RAM table, which is used by hardware to fetch BD ahead before fetching whole TX data. A TX ring contains numbers of TX BD (e.g. 512): TX BD (buffer descriptor; continual memory) +---+---+---+---+ +---+ | | | | | ... | | +-|-+---+---+---+ +---+ | | point to TX WD (WiFi descriptor; metadata of a skb data) v +------+ | | | | +-|----+ | | point to a skb data v +------+ | | | | +------+ Signed-off-by: -
Ping-Ke Shih authored
8922AE is a PCIE 802.11be wireless adapter with PID 0x8922. We add basic configurations including PCI DMA mode, PCI parameters, register address to control TX/RX rings and etc. Signed-off-by:
-
Dmitry Antipov authored
Since 'rtw89_core_tx_kick_off_and_wait()' assumes timeout (actually RTW89_ROC_TX_TIMEOUT) in milliseconds, I suppose that RTW89_ROC_IDLE_TIMEOUT is in milliseconds as well. If so, 'msecs_to_jiffies()' should be used in a call to 'ieee80211_queue_delayed_work()' from 'rtw89_roc_end()'. Compile tested only. Signed-off-by:
-
Dmitry Antipov authored
For rtl8192ee, change 'rtl92ee_dm_dynamic_primary_cca_ckeck()' to 'rtl92ee_dm_dynamic_primary_cca_check()' and so adjust 'rtl92ee_dm_watchdog()' as well. Compile tested only. Signed-off-by:
-
Dmitry Antipov authored
Remove unused and read by otherwise unused 'h2c_box_num', 'rfpienable', 'reserve_0', 'reserve_1', 'iqk_in_progress', 'apk_done' and 'hw_rof_enable' fields of 'struct rtl_phy', adjust related code. Compile tested only. Signed-off-by:
-
Dmitry Antipov authored
Remove unused and set but otherwise unused 'bbrf_ready', 'external_pa', 'pa_mode', 'rx_tag', 'rts_en', 'wow_enable' and 'wow_enabled' fields of 'struct rtl_hal', adjust related code. Compile tested only. Signed-off-by:
-
Justin Stitt authored
Let's move away from using strncpy and instead use the more obvious interface for this context. For wlc->pub->srom_ccode, we're just copying two bytes from ccode into wlc->pub->srom_ccode with no expectation that srom_ccode be NUL-terminated: wlc->pub->srom_ccode is only used in regulatory_hint(): 1193 | if (wl->pub->srom_ccode[0] && 1194 | regulatory_hint(wl->wiphy, wl->pub->srom_ccode)) 1195 | wiphy_err(wl->wiphy, "%s: regulatory hint failed\n", __func__); We can see that only index 0 and index 1 are accessed. 3307 | int regulatory_hint(struct wiphy *wiphy, const char *alpha2) 3308 | { ... | ... 3322 | request->alpha2[0] = alpha2[0]; 3323 | request->alpha2[1] = alpha2[1]; ... | ... 3332 | } Since this is just a simple byte copy with correct lengths, let's use memcpy(). There should be no functional change. In a similar boat, both wlc->country_default and wlc->autocountry_default are just simple byte copies so let's use memcpy. However, FWICT they aren't used anywhere. (they should be used or removed -- not in scope of my patch, though). Signed-off-by:Kees Cook <keescook@chromium.org> Signed-off-by:
-
Justin Stitt authored
Let's move away from using strncpy and instead favor a less ambiguous and more robust interface. For ifp->ndev->name, we expect ifp->ndev->name to be NUL-terminated based on its use in format strings within core.c: 67 | char *brcmf_ifname(struct brcmf_if *ifp) 68 | { 69 | if (!ifp) 70 | return "<if_null>"; 71 | 72 | if (ifp->ndev) 73 | return ifp->ndev->name; 74 | 75 | return "<if_none>"; 76 | } ... 288 | static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, 289 | struct net_device *ndev) { ... 330 | brcmf_dbg(INFO, "%s: insufficient headroom (%d)\n", 331 | brcmf_ifname(ifp), head_delta); ... 336 | bphy_err(drvr, "%s: failed to expand headroom\n", 337 | brcmf_ifname(ifp)); For di->name, we expect di->name to be NUL-terminated based on its usage with format strings: | brcms_dbg_dma(di->core, | "%s: DMA64 tx doesn't have AE set\n", | di->name); Looking at its allocation we can see that it is already zero-allocated which means NUL-padding is not required: | di = kzalloc(sizeof(struct dma_info), GFP_ATOMIC); For wlc->modulecb[i].name, we expect each name in wlc->modulecb to be NUL-terminated based on their usage with strcmp(): | if (!strcmp(wlc->modulecb[i].name, name) && NUL-padding is not required as wlc is zero-allocated in: brcms_c_attach_malloc() -> | wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC); For all these cases, a suitable replacement is `strscpy` due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding. Signed-off-by:
-
