- 17 Nov, 2021 6 commits
-
-
Baochen Qiang authored
Commit 31582373 ("ath11k: Change number of TCL rings to one for QCA6390") avoids initializing the other entries of dp->tx_ring cause the corresponding TX rings on QCA6390/WCN6855 are not used, but leaves those ring masks in ath11k_hw_ring_mask_qca6390.tx unchanged. Normally this is OK because we will only get interrupts from the first TX ring on these chips and thus only the first entry of dp->tx_ring is involved. In case of one MSI vector, all DP rings share the same IRQ. For each interrupt, all rings have to be checked, which means the other entries of dp->tx_ring are involved. However since they are not initialized, system crashes. Fix this issue by simply removing those ring masks. crash stack: [ 102.907438] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 102.907447] #PF: supervisor read access in kernel mode [ 102.907451] #PF: error_code(0x0000) - not-present page [ 102.907453] PGD 1081f0067 P4D 1081f0067 PUD 1081f1067 PMD 0 [ 102.907460] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 102.907465] CPU: 0 PID: 3511 Comm: apt-check Kdump: loaded Tainted: G E 5.15.0-rc4-wt-ath+ #20 [ 102.907470] Hardware name: AMD Celadon-RN/Celadon-RN, BIOS RCD1005E 10/08/2020 [ 102.907472] RIP: 0010:ath11k_dp_tx_completion_handler+0x201/0x830 [ath11k] [ 102.907497] Code: 3c 24 4e 8d ac 37 10 04 00 00 4a 8d bc 37 68 04 00 00 48 89 3c 24 48 63 c8 89 83 84 18 00 00 48 c1 e1 05 48 03 8b 78 18 00 00 <8b> 51 08 89 d6 83 e6 07 89 74 24 24 83 fe 03 74 04 85 f6 75 63 41 [ 102.907501] RSP: 0000:ffff9b7340003e08 EFLAGS: 00010202 [ 102.907505] RAX: 0000000000000001 RBX: ffff8e21530c0100 RCX: 0000000000000020 [ 102.907508] RDX: 0000000000000000 RSI: 00000000fffffe00 RDI: ffff8e21530c1938 [ 102.907511] RBP: ffff8e21530c0000 R08: 0000000000000001 R09: 0000000000000000 [ 102.907513] R10: ffff8e2145534c10 R11: 0000000000000001 R12: ffff8e21530c2938 [ 102.907515] R13: ffff8e21530c18e0 R14: 0000000000000100 R15: ffff8e21530c2978 [ 102.907518] FS: 00007f5d4297e740(0000) GS:ffff8e243d600000(0000) knlGS:0000000000000000 [ 102.907521] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.907524] CR2: 0000000000000028 CR3: 00000001034ea000 CR4: 0000000000350ef0 [ 102.907527] Call Trace: [ 102.907531] <IRQ> [ 102.907537] ath11k_dp_service_srng+0x5c/0x2f0 [ath11k] [ 102.907556] ath11k_pci_ext_grp_napi_poll+0x21/0x70 [ath11k_pci] [ 102.907562] __napi_poll+0x2c/0x160 [ 102.907570] net_rx_action+0x251/0x310 [ 102.907576] __do_softirq+0x107/0x2fc [ 102.907585] irq_exit_rcu+0x74/0x90 [ 102.907593] common_interrupt+0x83/0xa0 [ 102.907600] </IRQ> [ 102.907601] asm_common_interrupt+0x1e/0x40 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by:
Baochen Qiang <bqiang@codeaurora.org> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211026011605.58615-1-quic_bqiang@quicinc.com
-
Venkateswara Naralasetty authored
This change is to add trace log support for, * WMI events * WMI commands * ath11k_dbg messages * ath11k_dbg_dump messages * ath11k_log_info messages * ath11k_log_warn messages * ath11k_log_err messages Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00652-QCAHKSWPL_SILICONZ-1 Signed-off-by:Venkateswara Naralasetty <quic_vnaralas@quicinc.com> Signed-off-by:
-
Anilkumar Kolli authored
Currently many functions do not follow this guidance when qmi_send_request() fails, therefore add missing qmi_txn_cancel() in the qmi_send_request() error path. Also remove initialization on 'struct qmi_txn' since qmi_tx_init() performs all necessary initialization. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Anilkumar Kolli <akolli@codeaurora.org> Signed-off-by:
-
Rameshkumar Sundaram authored
The DMA buffers of dbring which is used for spectral/cfr starts at certain offset from original kmalloc() returned buffer. This is not cache line aligned. And also driver tries to access the data that is immediately before this offset address (i.e. buff->paddr) after doing dma map. This will cause cache line sharing issues and data corruption, if CPU happen to write back cache after HW has dma'ed the data. Fix this by mapping a cache line aligned buffer to dma. Tested on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1 Signed-off-by:
Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by:
-
P Praneesh authored
Firmware credit flow control is enabled for WMI control services, which expects available tokens should be acquired before sending a command to the target. Also the token gets released when firmware receives the command. This credit-based flow limits driver to send WMI command only when the token available which is causing WMI commands to timeout and return -EAGAIN, whereas firmware has enough capability to process the WMI command. To fix this Tx starvation issue, introduce the ability to disable the credit flow for the WMI path. The driver sends WMI configuration for disabling credit flow to firmware by two ways. 1. By using a global flag (HTC_MSG_SETUP_COMPLETE_EX_ID msg type flags) 2. By using a local flag (ATH11K_HTC_CONN_FLAGS_DISABLE_CREDIT_FLOW_CTRL = 1 << 3) Ath11k uses both these configurations to disable credit flow for the WMI path completely. Also added a hw_param member for credit flow control by which we can enable or disable it based on per-target basis. Currently we are disabling credit flow for IPQ8074, IPQ6018, and QCN9074 as recommended by firmware. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ6018 hw1.0 AHB WLAN.HK.2.4.0.1-00330-QCAHKSWPL_SILICONZ-1 Co-developed-by:
Pravas Kumar Panda <kumarpan@codeaurora.org> Signed-off-by:
P Praneesh <quic_ppranees@quicinc.com> Signed-off-by:
-
Sven Eckelmann authored
Some ETSI countries have a small overlap in the wireless-regdb with an ETSI channel (5590-5650). A good example is Australia: country AU: DFS-ETSI (2400 - 2483.5 @ 40), (36) (5150 - 5250 @ 80), (23), NO-OUTDOOR, AUTO-BW (5250 - 5350 @ 80), (20), NO-OUTDOOR, AUTO-BW, DFS (5470 - 5600 @ 80), (27), DFS (5650 - 5730 @ 80), (27), DFS (5730 - 5850 @ 80), (36) (57000 - 66000 @ 2160), (43), NO-OUTDOOR If the firmware (or the BDF) is shipped with these rules then there is only a 10 MHz overlap with the weather radar: * below: 5470 - 5590 * weather radar: 5590 - 5600 * above: (none for the rule "5470 - 5600 @ 80") There are several wrong assumption in the ath11k code: * there is always a valid range below the weather radar (actually: there could be no range below the weather radar range OR range could be smaller than 20 MHz) * intersected range in the weather radar range is valid (actually: the range could be smaller than 20 MHz) * range above weather radar is either empty or valid (actually: the range could be smaller than 20 MHz) These wrong assumption will lead in this example to a rule (5590 - 5600 @ 20), (N/A, 27), (600000 ms), DFS, AUTO-BW which is invalid according to is_valid_reg_rule() because the freq_diff is only 10 MHz but the max_bandwidth is set to 20 MHz. Which results in a rejection like: WARNING: at backports-20210222_001-4.4.60-b157d2276/net/wireless/reg.c:3984 [...] Call trace: [<ffffffbffc3d2e50>] reg_get_max_bandwidth+0x300/0x3a8 [cfg80211] [<ffffffbffc3d3d0c>] regulatory_set_wiphy_regd_sync+0x3c/0x98 [cfg80211] [<ffffffbffc651598>] ath11k_regd_update+0x1a8/0x210 [ath11k] [<ffffffbffc652108>] ath11k_regd_update_work+0x18/0x20 [ath11k] [<ffffffc0000a93e0>] process_one_work+0x1f8/0x340 [<ffffffc0000a9784>] worker_thread+0x25c/0x448 [<ffffffc0000aedc8>] kthread+0xd0/0xd8 [<ffffffc000085550>] ret_from_fork+0x10/0x40 ath11k c000000.wifi: failed to perform regd update : -22 Invalid regulatory domain detected To avoid this, the algorithm has to be changed slightly. Instead of splitting a rule which overlaps with the weather radar range into 3 pieces and accepting the first two parts blindly, it must actually be checked for each piece whether it is a valid range. And only if it is valid, add it to the output array. When these checks are in place, the processed rules for AU would end up as country AU: DFS-ETSI (2400 - 2483 @ 40), (N/A, 36), (N/A) (5150 - 5250 @ 80), (6, 23), (N/A), NO-OUTDOOR, AUTO-BW (5250 - 5350 @ 80), (6, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW (5470 - 5590 @ 80), (6, 27), (0 ms), DFS, AUTO-BW (5650 - 5730 @ 80), (6, 27), (0 ms), DFS, AUTO-BW (5730 - 5850 @ 80), (6, 36), (N/A), AUTO-BW and will be accepted by the wireless regulatory code. Fixes: d5c65159 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by:Sven Eckelmann <sven@narfation.org> Signed-off-by:
-
- 15 Nov, 2021 25 commits
-
-
P Praneesh authored
There is a race condition whereby the tx completion handler can be invoked before the 'num_pending_mgmt_tx" count is incremented. If that occurs, we could get warning trace indicating that 'num_pending_mgmt_tx' is 0 (because it was not yet incremented). Ideally, this trace should be seen only if mgmt tx has not happened but tx completion is received, and it is not expected in this race condition. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1 Co-developed-by:
Lavanya Suresh <lavaks@codeaurora.org> Signed-off-by:
-
P Praneesh authored
Set proper values for max_regpower, max_power, max_antenna_gain as it is because firmware will convert power values to 0.5dbm steps by multiplying it with 2. If txpower is not set, it will lead to cca stuck resulting in latency issues for QCN9074. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
P Praneesh authored
In radio tap header, BAD FCS flag is not updated properly because driver failed to update FCS_ERR flag in monitor mode. In rx_desc, FCS_ERR information is available in rx_attention structure and presence of this field indicates corresponding frame failed FCS check. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Wen Gong authored
When station connect to AP, the wmi command sequence is: peer_create->vdev_start->vdev_up and sequence of station disconnect fo AP is: peer_delete->vdev_down->vdev_stop The sequence of disconnect is not opposite of connect, it caused firmware crash when it handle wmi vdev stop cmd when the AP is support TWT of 802.11 ax, because firmware need access the bss peer for vdev stop cmd. [ 390.438564] ath11k_pci 0000:05:00.0: wmi cmd send 0x6001 ret 0 [ 390.438567] ath11k_pci 0000:05:00.0: WMI peer create vdev_id 0 peer_addr c4:04:15:3b:e0:39 [ 390.472724] ath11k_pci 0000:05:00.0: mac vdev 0 start center_freq 2437 phymode 11ax-he20-2g [ 390.472731] ath11k_pci 0000:05:00.0: wmi cmd send 0x5003 ret 0 [ 390.560849] ath11k_pci 0000:05:00.0: wmi cmd send 0x5005 ret 0 [ 390.560850] ath11k_pci 0000:05:00.0: WMI mgmt vdev up id 0x0 assoc id 1 bssid c4:04:15:3b:e0:39 [ 399.432896] ath11k_pci 0000:05:00.0: WMI peer delete vdev_id 0 peer_addr c4:04:15:3b:e0:39 [ 399.432902] ath11k_pci 0000:05:00.0: wmi cmd send 0x6002 ret 0 [ 399.441380] ath11k_pci 0000:05:00.0: wmi cmd send 0x5007 ret 0 [ 399.441381] ath11k_pci 0000:05:00.0: WMI vdev down id 0x0 [ 399.454681] ath11k_pci 0000:05:00.0: wmi cmd send 0x5006 ret 0 [ 399.454682] ath11k_pci 0000:05:00.0: WMI vdev stop id 0x0 The opposite sequence of disconnect should be: vdev_down->vdev_stop->peer_delete This patch change the sequence of disconnect for station as above opposite sequence for QCA6390, firmware not crash again with this patch. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by:
Wen Gong <quic_wgong@quicinc.com> Signed-off-by:
-
Wen Gong authored
parameter of msecs_to_jiffies should be (3 * 1000) instead of (3 * HZ) Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by:
-
Wen Gong authored
Currently in ath11k_mac_op_sta_statistics() there is the following logic: if (!arsta->txrate.legacy && !arsta->txrate.nss) return; Unfortunately if this condition is true then the function returns without setting parameters that follow the txrate. To address this issue remove the return and instead invert the logic to set the txrate logic if (arsta->txrate.legacy || arsta->txrate.nss). The same was done also in ath10k in commit 1cd6ba8a ("ath10k: remove return for NL80211_STA_INFO_TX_BITRATE"). Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by:Wen Gong <wgong@codeaurora.org> Signed-off-by:
-
Wen Gong authored
When NSS ratio enabled reported by firmware, SUPPORTS_VHT_EXT_NSS_BW is set in ath11k, meanwhile IEEE80211_VHT_EXT_NSS_BW_CAPABLE also need to be set, otherwise it is invalid because spec in IEEE Std 802.11
™ ‐2020 as below. Table 9-273-Supported VHT-MCS and NSS Set subfields, it has subfield VHT Extended NSS BW Capable, its definition is: Indicates whether the STA is capable of interpreting the Extended NSS BW Support subfield of the VHT Capabilities Information field. dmesg have a message without this patch: ieee80211 phy0: copying sband (band 1) due to VHT EXT NSS BW flag It means mac80211 will set IEEE80211_VHT_EXT_NSS_BW_CAPABLE if ath11k not set it in ieee80211_register_hw(). So it is better to set it in ath11k. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 Signed-off-by: -
P Praneesh authored
Avoid unnecessary idr_find calls before the idr_remove calls. Because idr_remove gives the valid ptr if id is valid otherwise return NULL ptr. So removed the idr_find before idr_remove in tx completion path. Also no need to disable the bottom half preempt if it is already in the bottom half context, so modify the spin_lock_bh to spin_lock in the data tx completion path. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2 Co-developed-by:
Karthikeyan Periyasamy <periyasa@codeaurora.org> Signed-off-by:
Jouni Malinen <jouni@codeaurora.org> Signed-off-by:
P Praneesh <ppranees@codeaurora.org> Signed-off-by:
-
P Praneesh authored
Add branch prediction in dp_tx code path in tx and tx completion handlers. Also in ath11k_dp_tx_complete_msdu , the pointer that is returned by rcu_dereference() is not dereferenced. so it is preferable to use rcu_access_pointer() here. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2 Co-developed-by:
Sriram R <srirrama@codeaurora.org> Signed-off-by:
-
P Praneesh authored
Currently while loop is used to find the tx completion ring number and it is not required since the tx ring mask and the group id can be combined to directly fetch the ring number. Hence remove the while loop and directly get the ring number from tx mask and group id. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2 Co-developed-by:
-
P Praneesh authored
Replace use of mod operator with a manual wrap around to avoid additional cost of using mod operation. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2 Co-developed-by:
-
P Praneesh authored
Similar to REO destination ring, also allocate HAL_WBM2SW_RELEASE from cacheable memory so that descriptors could be prefetched during tx completion handling. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01734-QCAHKSWPL_SILICONZ-1 v2 Co-developed-by:
-
P Praneesh authored
In datapath, add branch predictors where required in the process rx(). This protects high value rx path without having performance overhead. Also while processing rx packets, the pointer that is returned by rcu_dereference() is not dereferenced. so it is preferable to use rcu_access_pointer() here. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
P Praneesh authored
The usage of quota variable inside ath11k_dp_rx_process_received_packets() is redundant. Since we would queue only max packets to the list before calling this function so it would never exceed quota. Hence removing usage of quota variable. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
P Praneesh authored
The Active Pdev and CAC check are done for each msdu in ath11k_dp_rx_process_received_packets which is a overhead. To avoid this overhead, collect all msdus in a per mac msdu list and pass to function. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
P Praneesh authored
In ath11k_dp_process_rx(), after processing rx_desc from ath11k_hal_srng_dst_get_next_entry(), ath11k_hal_srng_dst_num_free() is accessed everytime because of done flag is not set. To avoid this additional access to ath11k_hal_srng_dst_num_free(), increment total_msdu_reaped only when continuation is not set and update done flag correspondingly. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
P Praneesh authored
In data path, to reduce the CPU cycles spending on descriptor access wrapper function, changed those functions as static inline. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
P Praneesh authored
tcl_data and reo_dst rings are currently being allocated using dma_allocate_coherent() which is non cacheable. Allocating ring memory from cacheable memory area allows cached descriptor access and prefetch next descriptors to optimize CPU usage during descriptor processing on NAPI. Based on the hardware param we can enable or disable this feature for the corresponding platform. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
Pradeep Kumar Chitrapu <pradeepc@codeaurora.org> Signed-off-by:
-
P Praneesh authored
Host driver doesn't need to process CE8 interrupts (used by target independently) The volume of interrupts is huge within short interval, CPU0 CPU1 CPU2 CPU3 14022188 0 0 0 GIC 71 Edge ce8 Hence disabling unused CE8 interrupt will improve CPU usage. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
Venkateswara Naralasetty authored
Currently the updated bandwidth for the peer will be configured to the firmware after channel switch from the sta_rc_update_wk. If the updated bandwidth is greater than the configured peer phymode during the peer assoc may result firmware assert. For example, initially AP is in HE40 mode and the peer phymode is configured as MODE_11AX_HE40 during peer assoc. Now user change the channel width to HE80 then, the peer bandwidth will be updated as HE80 to the firmware. This will trigger firmware assert due to peer bandwidth is greater than the peer phymode. Fix this issue by sending peer assoc command before setting the updated peer bandwith to firmware. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
Seevalamuthu Mariappan authored
Below compilation error is reported when built with W=1, drivers/net/wireless/ath/ath11k/mac.c:5408:22: error: parameter 'changed_flags' set but not used [-Werror,-Wunused-but-set-parameter] changed_flags is set, but left unused. So, remove unnecessary set. Compile tested only. Reported-by:
kernel test robot <lkp@intel.com> Signed-off-by:
Seevalamuthu Mariappan <quic_seevalam@quicinc.com> Signed-off-by:
-
Karthikeyan Periyasamy authored
In CE pipe cleanup, DMA memory gets freed by the aligned address (base_addr_owner_space) which is wrong. It needs to be freed by the address (base_addr_owner_space_unaligned) returned by dma_alloc. So free the dma memory by the proper address. This was found in code review. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00729-QCAHKSWPL_SILICONZ-3 v2 Signed-off-by:
Karthikeyan Periyasamy <quic_periyasa@quicinc.com> Signed-off-by:
-
Karthikeyan Periyasamy authored
In STA kickout event processing, the peer object is protected under spin lock BH. Release this lock after picking up the vdev_id from the peer object instead after ieee80211_report_low_ack(). This will minimize the lock hold period which will improve performance since base_lock is used across the data path. This was found in code review. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00729-QCAHKSWPL_SILICONZ-3 v2 Signed-off-by:
-
Karthikeyan Periyasamy authored
When there is an error in add interface process from ath11k_mac_set_kickout(), the code attempts to handle a fallback for add_interface. When this fallback succeeds, the driver returns zero rather than error code. This leads to success for the non created VAP. In cleanup, driver gets remove interface callback for the non created VAP and proceeds to self peer delete request which leads to FW assert. Since it was already deleted on the fallback of add interface, return the actual error code instead of fallback return code. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00729-QCAHKSWPL_SILICONZ-3 v2 Signed-off-by:
-
Karthikeyan Periyasamy authored
Firmware expects host to authorize the peer after the successful key install. But host authorize the peer before the key install, this trigger the firmware assert which leads to Q6 crash. To avoid this Q6 crash, host should authorize the peer after the key install. So introduce is_authorized in peer object to identify that peer is authorize or not. When IEEE80211_STA_CONTROL_PORT flag is unset, peer move to authorize state before the vdev up. When the same flag is set then peer move to authorize state after vdev up. So added authorise check in ath11k_bss_assoc() to handle the earlier state transition case. Also added the WMI authorize procedure in ath11k_mac_op_sta_state() to handle the non-earlier state transition case. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01492-QCAHKSWPL_SILICONZ-1 Signed-off-by:
-
- 12 Nov, 2021 3 commits
-
-
Rameshkumar Sundaram authored
AUTH flag is needed when peer assoc command is sent from host in security mode for non-assoc cases. Firmware will handle AUTH flag when client is associating as AUTH flag will be set after key exchange. For internally provided peer assoc commands from host, there won't be any key exchange, so AUTH flag is expected to be set in host. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01838-QCAHKSWPL_SILICONZ-1 Co-developed-by:
-
Rameshkumar Sundaram authored
HTT_PPDU_STATS_CFG_PDEV_ID bit mask for target FW PPDU stats request message was set as bit 8 to 15. Bit 8 is reserved for soc stats and pdev id starts from bit 9. Hence change the bitmask as bit 9 to 15 and fill the proper pdev id in the request message. In commit 701e48a4 ("ath11k: add packet log support for QCA6390"), both HTT_PPDU_STATS_CFG_PDEV_ID and pdev_mask were changed, but this pdev_mask calculation is not valid for platforms which has multiple pdevs with 1 rxdma per pdev, as this is writing same value(i.e. 2) for all pdevs. Hence fixed it to consider pdev_idx as well, to make it compatible for both single and multi pd cases. Tested on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01092-QCAHKSWPL_SILICONZ-1 Tested on: IPQ6018 hw1.0 WLAN.HK.2.5.0.1-01067-QCAHKSWPL_SILICONZ-1 Fixes: 701e48a4 ("ath11k: add packet log support for QCA6390") Co-developed-by:
Sathishkumar Muruganandam <murugana@codeaurora.org> Signed-off-by:
Rameshkumar Sundaram <ramess@codeaurora.org> Signed-off-by:
-
Zekun Shen authored
Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref when ar->tx_cmd->odata is NULL. The patch adds a null check to prevent such case. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] ar5523_cmd+0x46a/0x581 [ar5523] ar5523_probe.cold+0x1b7/0x18da [ar5523] ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523] ? __pm_runtime_set_status+0x54a/0x8f0 ? _raw_spin_trylock_bh+0x120/0x120 ? pm_runtime_barrier+0x220/0x220 ? __pm_runtime_resume+0xb1/0xf0 usb_probe_interface+0x25b/0x710 really_probe+0x209/0x5d0 driver_probe_device+0xc6/0x1b0 device_driver_attach+0xe2/0x120 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START, I got the null-ptr-deref bug. I believe the bug is triggerable whenever cmd->odata is NULL. After patching, I tested with the same input and no longer see the KASAN report. This was NOT tested on a real device. Signed-off-by:
Zekun Shen <bruceshenzk@gmail.com> Signed-off-by:
-
- 10 Nov, 2021 2 commits
-
-
Carl Huang authored
To reduce power consumption enable 802.11 power save mode in station mode. This allows both radio and CPU to sleep more. Only enable the mode on QCA6390 and WCN6855, it's unknown how other hardware families support this feature. To test that power save mode is running run "iw dev wls1 set power_save off", check there is no NULL Data frame seen by a sniffer. And run "iw dev wls1 set power_save on" and check there is a NULL Data frame in sniffer. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by:
Carl Huang <cjhuang@codeaurora.org> Signed-off-by:
-
Kalle Valo authored
It's more descriptive to use the actual enum used by the firmware instead of a boolean so change ath11k_wmi_pdev_set_ps_mode() to use a boolean. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Signed-off-by:
-
- 08 Nov, 2021 4 commits
-
-
Benjamin Li authored
The linear mapping between the BD rate field and the driver's 5GHz legacy rates table (wcn_5ghz_rates) does not only apply for the latter four rates -- it applies to all eight rates. Fixes: 6ea131ac ("wcn36xx: Fix warning due to bad rate_idx") Signed-off-by:
Benjamin Li <benl@squareup.com> Tested-by:
Loic Poulain <loic.poulain@linaro.org> Signed-off-by:
-
Benjamin Li authored
status.band is used in determination of status.rate -- for 5GHz on legacy rates there is a linear shift between the BD descriptor's rate field and the wcn36xx driver's rate table (wcn_5ghz_rates). We have a special clause to populate status.band for hardware scan offload frames. However, this block occurs after status.rate is already populated. Correctly handle this dependency by moving the band block before the rate block. This patch addresses kernel warnings & missing scan results for 5GHz APs that send their beacons/probe responses at the higher four legacy rates (24-54 Mbps), when using hardware scan offload: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:4532 ieee80211_rx_napi+0x744/0x8d8 Modules linked in: wcn36xx [...] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.19.107-g73909fa #1 Hardware name: Square, Inc. T2 (all variants) (DT) Call trace: dump_backtrace+0x0/0x148 show_stack+0x14/0x1c dump_stack+0xb8/0xf0 __warn+0x2ac/0x2d8 warn_slowpath_null+0x44/0x54 ieee80211_rx_napi+0x744/0x8d8 ieee80211_tasklet_handler+0xa4/0xe0 tasklet_action_common+0xe0/0x118 tasklet_action+0x20/0x28 __do_softirq+0x108/0x1ec irq_exit+0xd4/0xd8 __handle_domain_irq+0x84/0xbc gic_handle_irq+0x4c/0xb8 el1_irq+0xe8/0x190 lpm_cpuidle_enter+0x220/0x260 cpuidle_enter_state+0x114/0x1c0 cpuidle_enter+0x34/0x48 do_idle+0x150/0x268 cpu_startup_entry+0x20/0x24 rest_init+0xd4/0xe0 start_kernel+0x398/0x430 ---[ end trace ae28cb759352b403 ]--- Fixes: 8a27ca39 ("wcn36xx: Correct band/freq reporting on RX") Signed-off-by:
-
Bryan O'Donoghue authored
When deiniting the DXE hardware we should reset the block to ensure there is no spurious DMA write transaction from the downstream WCNSS to upstream MSM at a skbuff address we will have released. Fixes: 8e84c258 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") Signed-off-by:
Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by:
-
Bryan O'Donoghue authored
When unloading the driver we are not releasing the DMA descriptors which we previously allocated. Fixes: 8e84c258 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") Signed-off-by:
-
