- 31 Jan, 2022 1 commit
-
-
Muhammad Usama Anjum authored
ieee80211_probereq_get() can return NULL. Pointer skb should be checked for validty before use. If it is not valid, list of skbs needs to be freed. Fixes: 10d162b2 ("rtw88: 8822c: add ieee80211_ops::hw_scan") Signed-off-by:
Muhammad Usama Anjum <usama.anjum@collabora.com> Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220121070813.9656-2-pkshih@realtek.com
-
- 28 Jan, 2022 39 commits
-
-
Soontak Lee authored
CYW43570 is a 3-antenna, 2x2 MIMO,802.11a/b/g/n/ac, PCIe 3.0 for WLAN. It is BT/WIFI combo. Signed-off-by:
Soontak Lee <soontak.lee@cypress.com> Signed-off-by:
Chi-Hsien Lin <chi-hsien.lin@infineon.com> Signed-off-by:
Ian Lin <ian.lin-ee@infineon.com> Signed-off-by:
-
Hans de Goede authored
This is a second attempt at honering the country code send out by access points. This was first added in commit b0b524f0 ("brcmfmac: use ISO3166 country code and 0 rev as fallback"). Subsequently this was reverted in commit 151a7c12 ("Revert "brcmfmac: use ISO3166 country code and 0 rev as fallback""), because it was causing issues with AP mode on some brcmfmac models (specifically on BCM4359/9). Many devices ship with a nvram ccode value of X2/XT/XU/XV/ALL which are all special world-wide compatibility ccode-s. Most of these world-wide ccode-s allow passive scan mode only for 2.4GHz channels 12-14, only enabling them when an AP is seen on them. But at least on brcmfmac43455 devices this is not working correctly, these do not see accesspoints on channels 12-14 unless the ccode is changes to a country where these channels are allowed. Translating received country codes to an ISO3166 country code and 0 rev ccreq fixes devices using a brcmfmac43455 with a X2/XT/XU/XV/ALL ccode not seeing accesspoints on channels 12-14. To avoid this causing issues on other brcmfmac models again, the fallback is limited to only brcmfmac4345* chips this time. Cc: Shawn Guo <shawn.guo@linaro.org> Cc: Soeren Moch <smoch@web.de> Cc: Fabio Aiuto <fabioaiuto83@gmail.com> Signed-off-by:
Hans de Goede <hdegoede@redhat.com> Tested-by: Soeren Moch <smoch@web.de> # on BCM4359/9 Signed-off-by:
-
Chin-Yen Lee authored
In the past we use dbi function of wifi mac to read/write pci config space, but the function will be remove in new chip. So use kernel api pci_read/write_config_byte instead. Signed-off-by:
Chin-Yen Lee <timlee@realtek.com> Signed-off-by:
-
Johnson Lin authored
DIG, which is short for dynamic initial gain, is used to adjust gain to get good RX performance. CCK PD feature, a mechanism that adjusts 802.11b CCK packet detection(PD) power threshold based on environment noisy level in order to avoid false alarm. Also, refine related variable naming. Signed-off-by:
Johnson Lin <johnson.lin@realtek.com> Signed-off-by:
-
Íñigo Huguet authored
Call to dle_dfi_qempty might fail, leaving qempty.qempty untouched, which is latter used to control the for loop. If that happens, it's not initialized anywhere. Initialize it so the loop doesn't iterate unless it's modified by the call to dle_dfi_qempty. Signed-off-by:
Íñigo Huguet <ihuguet@redhat.com> Acked-by:
-
Zong-Zhe Yang authored
Make stuffs related to channel be collected in channel_params, and encapsulate the corresponding decision in get_channel_params(). Then, functions that takes channel_params can also notice subband type. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Zong-Zhe Yang authored
For next chipset which can support 6G band, we add the handling of ieee80211_supported_band for 6G band in advance. And a bitmap, support_bands, is added to rtw89_chip_info to declare which NL80211_BAND_* are supported. With the chipset's declaration, we register the corresponding instances of ieee80211_supported_band with wiphy. Signed-off-by:
-
Ping-Ke Shih authored
Each stations connected to AP needs to set an address CAM, so don't combine address and BSSID CAM. Signed-off-by:
-
Ping-Ke Shih authored
One mac_id is corresponding to one connected station, and port ID is a ID of virtual interfaces. With proper mac_id and port ID, firmware and hardware can handle a packet with correct context. Signed-off-by:
-
Ping-Ke Shih authored
If a packet we are going to send is broadcast/multicast and certain STAs are in sleep mode, a flag IEEE80211_TX_CTL_SEND_AFTER_DTIM is added to txinfo. Then, this kind of packets must be sent via HIQ instead of regular AC queues, because they should be sent right after beacon. Signed-off-by:
-
Ping-Ke Shih authored
HIQ is short for high queue that is used to send broadcast/multicast packets right after TBTT in AP mode. Two registers, DTIM and window size, are configured accordingly. Signed-off-by:
-
Ping-Ke Shih authored
The H2C_FUNC_MAC_FWROLE_MAINTAIN also maintains the roles of all connected stations; not just the role of VIF. So, I correct the name, but don't change the logic at all. Signed-off-by:
-
Ping-Ke Shih authored
The h2c_join firmware command is used to indicate a station is connected, and the assoc_cmac_tbl firmware command is used to set CMAC table corresponding to a mac_id. Both commands must work in both station and AP modes. Use the mac_id of rtw89_sta naturally and intuitively. Signed-off-by:
-
Ping-Ke Shih authored
In station mode, mac_id of station is the same as rtwvif's one. In AP mode, each station uses individual mac_id. Signed-off-by:
-
Ping-Ke Shih authored
Update beacon content if TIM bitmap maintained by mac80211 is changed. Since .set_tim must be atomic but driver uses mutex lock, we add a work. Otherwise, kernel says "sched: RT throttling activated" and lock down. Signed-off-by:
-
Ping-Ke Shih authored
This C2H notify driver the beacon count we send out. We don't handle the content for now, so add a dummy handler to avoid messages, like rtw89_pci 0000:03:00.0: c2h class 0 func 3 not support C2H: 00000000: 01 03 01 3f 0f 00 00 00 80 0a 00 00 00 00 a0 rtw89_pci 0000:03:00.0: c2h class 0 func 3 not support C2H: 00000000: 01 03 01 40 0f 00 00 00 00 03 20 00 00 00 a5 Signed-off-by:
-
Ping-Ke Shih authored
Firmware sends out beacon content generated by mac80211, and then stations can receive beacon and work with this AP properly. Also, we download beacon content again if TIM is changed. Signed-off-by:
-
Ping-Ke Shih authored
Since firmware transmits beacon by hardware SSN, driver does it with the same setting, then packets in the air have continual sequence number. Signed-off-by:
-
Ping-Ke Shih authored
With this patch, we can receive probe_req and reply probe_resp, and STA can find us. Signed-off-by:
-
Ping-Ke Shih authored
BA CAM is used to ACK peer's packets, so it must be established when IEEE80211_AMPDU_RX_START, and free it by IEEE80211_AMPDU_RX_STOP. The hardware can support two static BA CAM entries, so I implement a bitmap and a struct to record which entry is used and its corresponding tid. Also, the hardware can learn and create dynamic BA CAM entries automatically if received packets don't match static BA CAM. That means it can still work if we don't use H2C to set static BA CAM. An exception is tid=0 should be always allocated in static BA CAM, so an existing static BA CAM will be replaced if it is full and peer is going to establish a BA with tid=0. The new firmware use new format of this H2C, so I upgrade it as well. Signed-off-by:
-
Ping-Ke Shih authored
We have three points to receive packets to mac80211 with three different kinds of status. Many handlers are common and can be shared, so I move them together, and I don't change the logic at all. Signed-off-by:
-
Ping-Ke Shih authored
8852AE can receive packets with VHT MCS10/11, and we want to know we have received this kind of packets, so show the counter of VHT MCS10/11 in debugfs, like: TP TX: 1 [1] Mbps (lv: 1), RX: 420 [422] Mbps (lv: 4) Beacon: 19 Avg packet length: TX=102, RX=3081 RX count: Legacy: [0, 0, 0, 0] OFDM: [0, 0, 0, 0, 0, 0, 0, 0] HT 0: [0, 0, 0, 0, 0, 0, 0, 0] HT 1: [0, 0, 0, 0, 0, 0, 0, 0] VHT 1SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0][0, 0] VHT 2SS: [0, 0, 0, 0, 0, 0, 0, 4, 624, 4818][29913, 556] HE 1SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] HE 2ss: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] TX rate [0]: VHT 2SS MCS-9 SGI (hw_rate=0x119) ==> agg_wait=1 (3500) RX rate [0]: VHT 2SS MCS-10 SGI (hw_rate=0x11a) RSSI: -30 dBm (raw=161, prev=165) Signed-off-by: -
Ping-Ke Shih authored
RTW89_MAX_HW_PORT_NUM and RTW89_PORT_NUM refer to the same thing, so remove the one of them. Signed-off-by:
-
Zong-Zhe Yang authored
We are planning to support more chipsets, e.g. 8852C. Before that, we consider architecutre to handle multiple kinds of chipsets. Obviosuly, based on original design, rtw89_core module will have large size even if there is only one chipset under running. It is because all chipset related things are put in rtw89_core now. To reduce such overhead, we extract modules of rtw89 and adjust dependencies between modules. The following assumes that 8852AE, 8852AU, and 8852CE are all supported, we describe the difference before and after extraction. [Before extraction] ------------- |------------------------------------ | rtw89_usb | V ------------- --------------------------------------- ------------- | rtw89_core (including 8852A, 8852C) | <--- | rtw89_pci | --------------------------------------- ------------- The data of 8852A and 8852C are built in rtw89_core. And rtw89_pci is the entry of 8852AE and 8852CE. And rtw89_usb is the entry of 8852AU. [After extraction] ------------- ---------------- |----------- | rtw89_usb | <-------- | rtw89_8852au | | ------------- ---------------- V --------------- | -------------- | | <--------------- | rtw89_core | <--- | rtw89_8852a | -------------- | | <--------------- ^ ^ --------------- | | | ------------- ---------------- | | | | <-------- | rtw89_8852ae | | |----------- | rtw89_pci | ---------------- | | | <----------------- | ------------- | | --------------- ---------------- |--------------- | rtw89_8852c | <------ | rtw89_8852ce | --------------- ---------------- The data of 8852A/8852C is extracted to rtw89_8852a/rtw89_8852c. And rtw89_pci/rtw89_usb handles only common flow of pci/usb bus. Finally, 8852AE, 8852AU, and 8852CE have individual entry modules, i.e. rtw89_8852ae, rtw89_8852au, and rtw89_8852ce correspondingly. Signed-off-by: -
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo authored
ath.git patches for v5.18. Major changes: ath11k * add LDPC FEC type in 802.11 radiotap header * enable RX PPDU stats in monitor co-exist mode wcn36xx * implement survey reporting
-
Wen Gong authored
For the NL80211_REGDOM_SET_BY_USER hint from cfg80211, it set the new alpha2 code to ath11k, then ath11k send WMI_SET_INIT_COUNTRY_CMDID to firmware for all chips currently. When test with WCN6855/QCA6390 chips, this WMI CMD leads firmware crash. For AP based chips(ipq8074/qcn9074), WMI_SET_INIT_COUNTRY_CMDID is used to send to firmware, for STATION based chips(WCN6855/QCA6390), it need to use another WMI CMD WMI_SET_CURRENT_COUNTRY_CMDID. Add flag current_cc_support in hardware parameters, it is used to distinguish AP/STA platform. After that, the firmware will work normal and the regulatory feature works well for QCA6390/WCN6855. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Signed-off-by:
Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220119041355.32014-1-quic_wgong@quicinc.com
-
Wen Gong authored
When station connect to AP of 6 GHz with 40 MHz bandwidth, the TX is always stay 20 MHz, it is because the flag WMI_PEER_40MHZ is not set while peer assoc. Add the flag if remote peer is 40 MHz bandwidth. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 Fixes: c3a7d7eb ("ath11k: add 6 GHz params in peer assoc command") Signed-off-by:
-
Pavel Skripkin authored
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 Fixes: fb9987d0 ("ath9k_htc: Support for AR9271 chipset.") Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com Signed-off-by:
Pavel Skripkin <paskripkin@gmail.com> Signed-off-by:
-
Jakub Kicinski authored
Pavel Begunkov says: ==================== udp/ipv6 optimisations Shed some weight from udp/ipv6. Zerocopy benchmarks over dummy showed ~5% tx/s improvement, should be similar for small payload non-zc cases. The performance comes from killing 4 atomics and a couple of big struct memcpy/memset. 1/10 removes a pair of atomics on dst refcounting for cork->skb setup, 9/10 saves another pair on cork init. 5/10 and 8/10 kill extra 88B memset and memcpy respectively. ==================== Link: https://lore.kernel.org/r/cover.1643243772.git.asml.silence@gmail.comSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Pavel Begunkov authored
Inline a part of ipv6_fixup_options() to avoid extra overhead on function call if opt is NULL. Signed-off-by:
Pavel Begunkov <asml.silence@gmail.com> Reviewed-by:
Willem de Bruijn <willemb@google.com> Signed-off-by:
-
Pavel Begunkov authored
udpv6_sendmsg() doesn't need dst after calling ip6_make_skb(), so instead of taking an additional reference inside ip6_setup_cork() and releasing the initial one afterwards, we can hand over a reference into ip6_make_skb() saving two atomics. The only other user of ip6_setup_cork() is ip6_append_data() and it requires an extra dst_hold(). Signed-off-by:
-
Pavel Begunkov authored
udpv6_sendmsg() first initialises an on-stack 88B struct flowi6 and then copies it into cork, which is expensive. Avoid the copy in corkless case by initialising on-stack cork->fl directly. The main part is a couple of lines under !corkreq check. The rest converts fl6 variable to be a pointer. Signed-off-by:
-
Pavel Begunkov authored
Another preparation patch. inet_cork_full already contains a field for iflow, so we can avoid passing a separate struct iflow6 into __ip6_append_data() and ip6_make_skb(), and use the flow stored in inet_cork_full. Make sure callers set cork->fl, i.e. we init it in ip6_append_data() and before calling ip6_make_skb(). Signed-off-by:
-
Pavel Begunkov authored
Convert a struct inet_cork argument in __ip6_append_data() to struct inet_cork_full. As one struct contains another inet_cork is still can be accessed via ->base field. It's a preparation patch making further changes a bit cleaner. Signed-off-by:
-
Pavel Begunkov authored
It doesn't appear there is any reason for ip6_cork_release() to zero cork->fl, it'll be fully filled on next initialisation. This 88 bytes memset accounts to 0.3-0.5% of total CPU cycles. It's also needed in following patches and allows to remove an extar flow copy in udp_v6_push_pending_frames(). Signed-off-by:
-
Pavel Begunkov authored
Clean up ip6_setup_cork() and ip6_cork_release() adding a local variable for v6_cork->opt. It's a preparation patch for further changes. Signed-off-by:
-
Pavel Begunkov authored
ipv6_push_nfrag_opts() doesn't change passed daddr, and so __ip6_make_skb() doesn't actually need to keep an on-stack copy of fl6->daddr. Set initially final_dst to fl6->daddr, ipv6_push_nfrag_opts() will override it if needed, and get rid of extra copies. Signed-off-by:
-
Pavel Begunkov authored
Corked AF_INET for ipv6 socket doesn't appear to be the hottest case, so move it out of the common path under up->pending check to remove overhead. Signed-off-by:
-
Pavel Begunkov authored
__ip6_make_skb() gets a cork->dst ref, hands it over to skb and shortly after puts cork->dst. Save two atomics by stealing it without extra referencing, ip6_cork_release() handles NULL cork->dst. Signed-off-by:
-
