kevin/linux
1
Fork 0
Code

Regressions:

Browse Source 
* wfx: fix for open network connection
  * iwlwifi: fix for hibernate (due to fast resume feature)
  * iwlwifi: fix for a few warnings that were recently added
    (had previously been messages not warnings)
 
 Previously broken:
  * mwifiex: fix static structures used for per-device data
  * iwlwifi: some harmless FW related messages were tagged
    too high priority
  * iwlwifi: scan buffers weren't checked correctly
  * mac80211: SKB leak on beacon error path
  * iwlwifi: fix ACPI table interop with certain BIOSes
  * iwlwifi: fix locking for link selection
  * mac80211: fix SSID comparison in beacon validation
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmbO9O8ACgkQ10qiO8sP
 aACYDA//TwIfA3+SMUducdNfLjRPa8hoxitZqXUdMVHO/gj6b5isz7g15KgL6UV6
 NtJyPSLfYPY4UHsXvEs6zreLQMoQgjpk58sq8uE0y9KxjNzeVd9Qy0rq66KqZR5p
 N9bM10qx1oT6CkFK8F1GGKKmOVuYm3bLtwcvCZICcMBi1ziuK6A5FoOFdbzXdUET
 QaDFc5P6rtNh0WAtsGjoed+9GQ+AhXcBloohfRZvCHCaY8jMdJyAKACpBQmPUSbX
 b1WVwp/cLNeUBmkhhfPE2xJmur4WiI2s/Xy94b5naUIn33re1AfAu2msuhQCyoHv
 LiF9wG++NW2Gbh7F5vFt4PVPgCKgkhgmPXDy+yFJose4Ay6wpq8nr0XzgG4Y/mWQ
 GYElJrZPQnqxnSMa3VEgLBuGas0KOTfAwXIIGZiFDVlAlPGO1zL5fti25pCQbkKH
 NYcNuWCUX5jPrCLjx0SL9P7BLpr8eiWtvq9h+8DfkNWrcSFllIJzkCKYbP7ps9cE
 KmFp4ilqmKlYKcMLQM8ePgx2vPegQfmPczcqdYAMJcnXmOcQS7s47jI6BV41CVPt
 ls2+/cO2BSexKB4yGWSbF8Xk9+67UL8h10Z0OJ5gD7zWESwyRi2N7q5CiA5XOTLu
 RrbkH3uPzWLP+A/uXkQBMUEihaJSwfAO67Wrzi91kSdyPWmervo=
 =024u
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2024-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Regressions:
 * wfx: fix for open network connection
 * iwlwifi: fix for hibernate (due to fast resume feature)
 * iwlwifi: fix for a few warnings that were recently added
   (had previously been messages not warnings)

Previously broken:
 * mwifiex: fix static structures used for per-device data
 * iwlwifi: some harmless FW related messages were tagged
   too high priority
 * iwlwifi: scan buffers weren't checked correctly
 * mac80211: SKB leak on beacon error path
 * iwlwifi: fix ACPI table interop with certain BIOSes
 * iwlwifi: fix locking for link selection
 * mac80211: fix SSID comparison in beacon validation

* tag 'wireless-2024-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: iwlwifi: clear trans->state earlier upon error
  wifi: wfx: repair open network AP mode
  wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
  wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
  wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan
  wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
  wifi: iwlwifi: fw: fix wgds rev 3 exact size
  wifi: iwlwifi: mvm: take the mutex before running link selection
  wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
  wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
  wifi: iwlwifi: lower message level for FW buffer destination
  wifi: iwlwifi: mvm: fix hibernation
  wifi: mac80211: fix beacon SSID mismatch handling
  wifi: mwifiex: duplicate static structs used in driver instances
====================

Link: https://patch.msgid.link/20240828100151.23662-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2024-08-28 16:54:44 -07:00
commit 41901c227e
14 changed files with 161 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/intel/iwlwifi/fw/acpi.c
View File

@ -725,22 +725,25 @@ int iwl_acpi_get_wgds_table(struct iwl_fw_runtime *fwrt)
entry = &wifi_pkg->package.elements[entry_idx];
entry_idx++;
if (entry->type != ACPI_TYPE_INTEGER ||
entry->integer.value > num_profiles) {
entry->integer.value > num_profiles ||
entry->integer.value <
rev_data[idx].min_profiles) {
ret = -EINVAL;
goto out_free;
}
num_profiles = entry->integer.value;
/*
* this also validates >= min_profiles since we
* otherwise wouldn't have gotten the data when
* looking up in ACPI
* Check to see if we received package count
* same as max # of profiles
*/
if (wifi_pkg->package.count !=
hdr_size + profile_size * num_profiles) {
ret = -EINVAL;
goto out_free;
}
/* Number of valid profiles */
num_profiles = entry->integer.value;
}
goto read_table;
}

2
drivers/net/wireless/intel/iwlwifi/fw/dbg.c
View File

@ -3348,7 +3348,7 @@ void iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt,
{
int ret __maybe_unused = 0;
if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status))
if (!iwl_trans_fw_running(fwrt->trans))
return;
if (fw_has_capa(&fwrt->fw->ucode_capa,

12
drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h
View File

@ -85,6 +85,10 @@ struct iwl_cfg;
* May sleep
* @wimax_active: invoked when WiMax becomes active. May sleep
* @time_point: called when transport layer wants to collect debug data
* @device_powered_off: called upon resume from hibernation but not only.
* Op_mode needs to reset its internal state because the device did not
* survive the system state transition. The firmware is no longer running,
* etc...
*/
struct iwl_op_mode_ops {
struct iwl_op_mode *(*start)(struct iwl_trans *trans,
@ -107,6 +111,7 @@ struct iwl_op_mode_ops {
void (*time_point)(struct iwl_op_mode *op_mode,
enum iwl_fw_ini_time_point tp_id,
union iwl_dbg_tlv_tp_data *tp_data);
void (*device_powered_off)(struct iwl_op_mode *op_mode);
};
int iwl_opmode_register(const char *name, const struct iwl_op_mode_ops *ops);
@ -204,4 +209,11 @@ static inline void iwl_op_mode_time_point(struct iwl_op_mode *op_mode,
op_mode->ops->time_point(op_mode, tp_id, tp_data);
}
static inline void iwl_op_mode_device_powered_off(struct iwl_op_mode *op_mode)
{
if (!op_mode || !op_mode->ops || !op_mode->ops->device_powered_off)
return;
op_mode->ops->device_powered_off(op_mode);
}
#endif /* __iwl_op_mode_h__ */

2
drivers/net/wireless/intel/iwlwifi/iwl-trans.h
View File

@ -1128,8 +1128,8 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans, bool sync)
/* prevent double restarts due to the same erroneous FW */
if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status)) {
iwl_op_mode_nic_error(trans->op_mode, sync);
trans->state = IWL_TRANS_NO_FW;
iwl_op_mode_nic_error(trans->op_mode, sync);
}
}

10
drivers/net/wireless/intel/iwlwifi/mvm/d3.c
View File

@ -3439,6 +3439,16 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
mutex_lock(&mvm->mutex);
/* Apparently, the device went away and device_powered_off() was called,
* don't even try to read the rt_status, the device is currently
* inaccessible.
*/
if (!test_bit(IWL_MVM_STATUS_IN_D3, &mvm->status)) {
IWL_INFO(mvm,
"Can't resume, device_powered_off() was called during wowlan\n");
goto err;
}
mvm->last_reset_or_resume_time_jiffies = jiffies;
/* get the BSS vif pointer again */

9
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
View File

@ -5818,6 +5818,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
int i;
if (!iwl_mvm_has_new_tx_api(mvm)) {
/* we can't ask the firmware anything if it is dead */
if (test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
&mvm->status))
return;
if (drop) {
guard(mvm)(mvm);
iwl_mvm_flush_tx_path(mvm,
@ -5911,8 +5915,11 @@ void iwl_mvm_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
/* this can take a while, and we may need/want other operations
* to succeed while doing this, so do it without the mutex held
* If the firmware is dead, this can't work...
*/
if (!drop && !iwl_mvm_has_new_tx_api(mvm))
if (!drop && !iwl_mvm_has_new_tx_api(mvm) &&
!test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
&mvm->status))
iwl_trans_wait_tx_queues_empty(mvm->trans, msk);
}

21
drivers/net/wireless/intel/iwlwifi/mvm/ops.c
View File

@ -1198,10 +1198,12 @@ static void iwl_mvm_trig_link_selection(struct wiphy *wiphy,
struct iwl_mvm *mvm =
container_of(wk, struct iwl_mvm, trig_link_selection_wk);
mutex_lock(&mvm->mutex);
ieee80211_iterate_active_interfaces(mvm->hw,
IEEE80211_IFACE_ITER_NORMAL,
iwl_mvm_find_link_selection_vif,
NULL);
mutex_unlock(&mvm->mutex);
}
static struct iwl_op_mode *
@ -1511,6 +1513,8 @@ void iwl_mvm_stop_device(struct iwl_mvm *mvm)
clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
iwl_mvm_pause_tcm(mvm, false);
iwl_fw_dbg_stop_sync(&mvm->fwrt);
iwl_trans_stop_device(mvm->trans);
iwl_free_fw_paging(&mvm->fwrt);
@ -2090,6 +2094,20 @@ static void iwl_op_mode_mvm_time_point(struct iwl_op_mode *op_mode,
iwl_dbg_tlv_time_point(&mvm->fwrt, tp_id, tp_data);
}
static void iwl_op_mode_mvm_device_powered_off(struct iwl_op_mode *op_mode)
{
struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
mutex_lock(&mvm->mutex);
clear_bit(IWL_MVM_STATUS_IN_D3, &mvm->status);
mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
iwl_mvm_stop_device(mvm);
#ifdef CONFIG_PM
mvm->fast_resume = false;
#endif
mutex_unlock(&mvm->mutex);
}
#define IWL_MVM_COMMON_OPS \
/* these could be differentiated */ \
.queue_full = iwl_mvm_stop_sw_queue, \
@ -2102,7 +2120,8 @@ static void iwl_op_mode_mvm_time_point(struct iwl_op_mode *op_mode,
/* as we only register one, these MUST be common! */ \
.start = iwl_op_mode_mvm_start, \
.stop = iwl_op_mode_mvm_stop, \
.time_point = iwl_op_mode_mvm_time_point
.time_point = iwl_op_mode_mvm_time_point, \
.device_powered_off = iwl_op_mode_mvm_device_powered_off
static const struct iwl_op_mode_ops iwl_mvm_ops = {
IWL_MVM_COMMON_OPS,

42
drivers/net/wireless/intel/iwlwifi/mvm/scan.c
View File

@ -48,6 +48,8 @@
/* Number of iterations on the channel for mei filtered scan */
#define IWL_MEI_SCAN_NUM_ITER 5U
#define WFA_TPC_IE_LEN 9
struct iwl_mvm_scan_timing_params {
u32 suspend_time;
u32 max_out_time;
@ -303,8 +305,8 @@ static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm)
max_probe_len = SCAN_OFFLOAD_PROBE_REQ_SIZE;
/* we create the 802.11 header and SSID element */
max_probe_len -= 24 + 2;
/* we create the 802.11 header SSID element and WFA TPC element */
max_probe_len -= 24 + 2 + WFA_TPC_IE_LEN;
/* DS parameter set element is added on 2.4GHZ band if required */
if (iwl_mvm_rrm_scan_needed(mvm))
@ -731,8 +733,6 @@ static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,
return newpos;
}
#define WFA_TPC_IE_LEN 9
static void iwl_mvm_add_tpc_report_ie(u8 *pos)
{
pos[0] = WLAN_EID_VENDOR_SPECIFIC;
@ -837,8 +837,8 @@ static inline bool iwl_mvm_scan_fits(struct iwl_mvm *mvm, int n_ssids,
return ((n_ssids <= PROBE_OPTION_MAX) &&
(n_channels <= mvm->fw->ucode_capa.n_scan_channels) &
(ies->common_ie_len +
ies->len[NL80211_BAND_2GHZ] +
ies->len[NL80211_BAND_5GHZ] <=
ies->len[NL80211_BAND_2GHZ] + ies->len[NL80211_BAND_5GHZ] +
ies->len[NL80211_BAND_6GHZ] <=
iwl_mvm_max_scan_ie_fw_cmd_room(mvm)));
}
@ -1659,6 +1659,17 @@ iwl_mvm_umac_scan_cfg_channels_v7(struct iwl_mvm *mvm,
cfg->v2.channel_num = channels[i]->hw_value;
if (cfg80211_channel_is_psc(channels[i]))
cfg->flags = 0;
if (band == NL80211_BAND_6GHZ) {
/* 6 GHz channels should only appear in a scan request
* that has scan_6ghz set. The only exception is MLO
* scan, which has to be passive.
*/
WARN_ON_ONCE(cfg->flags != 0);
cfg->flags =
cpu_to_le32(IWL_UHB_CHAN_CFG_FLAG_FORCE_PASSIVE);
}
cfg->v2.iter_count = 1;
cfg->v2.iter_interval = 0;
if (version < 17)
@ -3168,18 +3179,16 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
params.n_channels = j;
}
if (non_psc_included &&
!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, params.n_channels)) {
kfree(params.channels);
return -ENOBUFS;
if (!iwl_mvm_scan_fits(mvm, req->n_ssids, ies, params.n_channels)) {
ret = -ENOBUFS;
goto out;
}
uid = iwl_mvm_build_scan_cmd(mvm, vif, &hcmd, &params, type);
if (non_psc_included)
kfree(params.channels);
if (uid < 0)
return uid;
if (uid < 0) {
ret = uid;
goto out;
}
ret = iwl_mvm_send_cmd(mvm, &hcmd);
if (!ret) {
@ -3197,6 +3206,9 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
mvm->sched_scan_pass_all = SCHED_SCAN_PASS_ALL_DISABLED;
}
out:
if (non_psc_included)
kfree(params.channels);
return ret;
}

3
drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
View File

@ -89,7 +89,8 @@ iwl_pcie_ctxt_info_dbg_enable(struct iwl_trans *trans,
}
break;
default:
IWL_ERR(trans, "WRT: Invalid buffer destination\n");
IWL_DEBUG_FW(trans, "WRT: Invalid buffer destination (%d)\n",
le32_to_cpu(fw_mon_cfg->buf_location));
}
out:
if (dbg_flags)

41
drivers/net/wireless/intel/iwlwifi/pcie/drv.c
View File

@ -1577,11 +1577,12 @@ static int iwl_pci_suspend(struct device *device)
return 0;
}
static int iwl_pci_resume(struct device *device)
static int _iwl_pci_resume(struct device *device, bool restore)
{
struct pci_dev *pdev = to_pci_dev(device);
struct iwl_trans *trans = pci_get_drvdata(pdev);
struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
bool device_was_powered_off = false;
/* Before you put code here, think about WoWLAN. You cannot check here
* whether WoWLAN is enabled or not, and your code will run even if
@ -1597,6 +1598,26 @@ static int iwl_pci_resume(struct device *device)
if (!trans->op_mode)
return 0;
/*
* Scratch value was altered, this means the device was powered off, we
* need to reset it completely.
* Note: MAC (bits 0:7) will be cleared upon suspend even with wowlan,
* so assume that any bits there mean that the device is usable.
*/
if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ &&
!iwl_read32(trans, CSR_FUNC_SCRATCH))
device_was_powered_off = true;
if (restore || device_was_powered_off) {
trans->state = IWL_TRANS_NO_FW;
/* Hope for the best here ... If one of those steps fails we
* won't really know how to recover.
*/
iwl_pcie_prepare_card_hw(trans);
iwl_finish_nic_init(trans);
iwl_op_mode_device_powered_off(trans->op_mode);
}
/* In WOWLAN, let iwl_trans_pcie_d3_resume do the rest of the work */
if (test_bit(STATUS_DEVICE_ENABLED, &trans->status))
return 0;
@ -1617,9 +1638,23 @@ static int iwl_pci_resume(struct device *device)
return 0;
}
static int iwl_pci_restore(struct device *device)
{
return _iwl_pci_resume(device, true);
}
static int iwl_pci_resume(struct device *device)
{
return _iwl_pci_resume(device, false);
}
static const struct dev_pm_ops iwl_dev_pm_ops = {
SET_SYSTEM_SLEEP_PM_OPS(iwl_pci_suspend,
iwl_pci_resume)
.suspend = pm_sleep_ptr(iwl_pci_suspend),
.resume = pm_sleep_ptr(iwl_pci_resume),
.freeze = pm_sleep_ptr(iwl_pci_suspend),
.thaw = pm_sleep_ptr(iwl_pci_resume),
.poweroff = pm_sleep_ptr(iwl_pci_suspend),
.restore = pm_sleep_ptr(iwl_pci_restore),
};
#define IWL_PM_OPS (&iwl_dev_pm_ops)

32
drivers/net/wireless/marvell/mwifiex/cfg80211.c
View File

@ -4363,11 +4363,27 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info))
wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz;
if (adapter->config_bands & BAND_A)
wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz;
else
wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev,
&mwifiex_band_2ghz,
sizeof(mwifiex_band_2ghz),
GFP_KERNEL);
if (!wiphy->bands[NL80211_BAND_2GHZ]) {
ret = -ENOMEM;
goto err;
}
if (adapter->config_bands & BAND_A) {
wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev,
&mwifiex_band_5ghz,
sizeof(mwifiex_band_5ghz),
GFP_KERNEL);
if (!wiphy->bands[NL80211_BAND_5GHZ]) {
ret = -ENOMEM;
goto err;
}
} else {
wiphy->bands[NL80211_BAND_5GHZ] = NULL;
}
if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info))
wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs;
@ -4461,8 +4477,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
if (ret < 0) {
mwifiex_dbg(adapter, ERROR,
"%s: wiphy_register failed: %d\n", __func__, ret);
wiphy_free(wiphy);
return ret;
goto err;
}
if (!adapter->regd) {
@ -4504,4 +4519,9 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
adapter->wiphy = wiphy;
return ret;
err:
wiphy_free(wiphy);
return ret;
}

5
drivers/net/wireless/silabs/wfx/sta.c
View File

@ -352,8 +352,11 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif)
ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,
skb->len - ieoffset);
if (unlikely(!ptr))
if (!ptr) {
/* No RSN IE is fine in open networks */
ret = 0;
goto free_skb;
}
ptr += pairwise_cipher_suite_count_offset;
if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

2
net/mac80211/mlme.c
View File

@ -6664,7 +6664,7 @@ static bool ieee80211_mgd_ssid_mismatch(struct ieee80211_sub_if_data *sdata,
return true;
/* hidden SSID: zeroed out */
if (memcmp(elems->ssid, zero_ssid, elems->ssid_len))
if (!memcmp(elems->ssid, zero_ssid, elems->ssid_len))
return false;
return memcmp(elems->ssid, cfg->ssid, cfg->ssid_len);

4
net/mac80211/tx.c
View File

@ -5348,8 +5348,10 @@ ieee80211_beacon_get_ap(struct ieee80211_hw *hw,
if (beacon->tail)
skb_put_data(skb, beacon->tail, beacon->tail_len);
if (ieee80211_beacon_protect(skb, local, sdata, link) < 0)
if (ieee80211_beacon_protect(skb, local, sdata, link) < 0) {
dev_kfree_skb(skb);
return NULL;
}
ieee80211_beacon_get_finish(hw, vif, link, offs, beacon, skb,
chanctx_conf, csa_off_base);