Permalink
Commits on Feb 11, 2022
-
ath11k: Register handler for CFR capture event
Firmware sends CFR meta data through the WMI event WMI_PEER_CFR_CAPTURE_EVENT. Parse the meta data coming from the firmware and invoke correlate_and_relay function to correlate the CFR meta data with the CFR payload coming from the other WMI event WMI_PDEV_DMA_RING_BUF_RELEASE_EVENT. Release the buffer to user space once correlate and relay return success. Tested-on: IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-
ath11k: Register DBR event handler for CFR data
Firmware sends an WMI event WMI_PDEV_DMA_RING_BUF_RELEASE_EVENT to host to indicate the CFR data availability in the DB ring. Host will reap the CFR data from the DB ring buffers and invoke correlate_and_relay API to correlate the CFR data with the meta data coming from the other WMI event WMI_PEER_CFR_CAPTURE_EVENT. If correlate and relay function returns success then release the buffer to user space through relayfs, otherwise hold the buffer until other WMI event comes from the firmware. Tested-on: IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-
ath11k: register vendor sub command for CFR configuration
Add support to parse CFR parameters configured through the vendor commands. Also, send the required WMI commands to the firmware based on the CFR configurations. Tested-on: IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-
ath11k: register relayfs entries for CFR dump
Provide a relayfs interface to collect the CFR dump from the user space. '/sys/kernel/debug/ieee80211/phyX/ath11k/cfr_capture' is exposed to user space to get CFR data. CFR format to user space: ___________________________________________ | CFR header | CFR payload | CFR tail data | |____________|_____________|_______________| CFR header contains the following fields, * Start magic number 0xDEADBEAF - 4bytes * vendor id - 4bytes * cfr metadata version - 1byte * cfr data version - 1byte * chip type - 1byte * platform type - 1byte * CFR metadata length - 4bytes * metadata - 92bytes peer mac - 6bytes capture status - 1byte (1 for success 0 for failure) capture_bw - 1byte channel_bw - 1byte phy_mode - 1byte prim20_chan - 2bytes center_freq1 - 2bytes center_freq2 - 2bytes capture_mode - 1byte capture_type - 1byte sts_count - 1byte num_rx_chain - 1byte timestamp - 4bytes length - 4bytes chain_rssi - 32bytes (4bytes for each chain) chain_phase - 16bytes (2bytes for each chain) cfo_measurement - 4bytes agc_gain - 8bytes (1 bytes for each chain) rx_start_ts - 4bytes CFR payload: CFR payload contains 8bytes of ucode header followed by the tone information. Tone order is positive tones, followed by PHY memory garbage, followed by negative tones. Dummy tones are uploaded to make number of tones always integer number of 64. Number of tones is not preamble type dependent. Each CFR tone has 14-bit I component and 14-bit Q component and is sign extended to 16-bit I/Q. Two tones are packed into one 64-bit unit as: [63:0] = [Tone1_Q(63:48) Tone1_I(47:32) Tone0_Q(31:16) Tone0_I(15:0)] CFR tail: end magic number 0xBEAFDEAD Tested-on: IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com> -
ath11k: CFR module initialization and deinitialization for IPQ8074
Add initialization and deinitialization sequence for CFR module. CFR module will be initialized only when the following criteria passes, * enabled CFR support for the hardware through the hardware param 'cfr_support' * WMI service enabled for the CFR support 'WMI_TLV_SERVICE_CFR_CAPTURE_SUPPORT' Also, provide a configuration option CONFIG_ATH11K_CFR to enable CFR feature support during the compilation time. CFR module initialization includes Direct Buffer(DB) ring initialization where HW uses the DB ring buffers to copy CFR data to host. Number of buffers and buffer size of the ring is based on the DB ring capabilities advertised by the firmware through WMI service ready. Also ring configurations are sent to firmware through ath11k_dbring_wmi_cfg_setup(). Tested-on: IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1 Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
-
nl80211: vendor-cmd: qca: add command for CFR configuration
This patch is to add vendor command support to configure per peer CFR parameters. An example of usage: iw dev wlanx vendor send 0x1374 0xad cfr-en <val> bw <bw> method <method> periodicity <period> addr <mac_addr> 0x1374: vendor id 0xad: : vendor subcmd id val: 0 to disable CFR capture 1 to enable CFR capture bw: CFR capture bandwidth(use the values in enum nl80211_chan_width) 1 - 20MHZ 2 - 40MHZ 3 - 80MHZ method: Method used by hardware to collect the CFR dump 0 - from the ACKs of QOS NULL packets 1 - from the ACKs of QOS NULL packets with phase 2 - from the ACK of probe response packet periodicity: Periodicity in ms at which CFR dump need to be collect 0 - single shot capture non zero - for Periodic captures mac_addr: mac address of the peer for which CFR capture is requested. Signed-off-by: Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
Commits on Feb 10, 2022
-
wcn36xx: Uninitialized variable in wcn36xx_change_opchannel()
This code needs "channel" to be initialized to NULL for it to work correctly. Fixes: d6f2746 ("wcn36xx: Track the band and channel we are tuned to") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Bryan O'Donoghue <bryan.odonghue@linaro.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220201125941.GA22458@kili
Commits on Feb 3, 2022
Commits on Feb 1, 2022
-
ath11k: add debugfs for TWT debug calls
New debugfs files to manually add/delete/pause/resume TWT dialogs for test/debug purposes. The debugfs files expect the following parameters - Add dialog echo '<Peer_MAC> <Dialog_ID> <Wake_Interval_Usec> <Wake_Interval_Mantis> <Wake_Duration_Usec> <First_SP_Offset> <TWT_Command> <1:Broadcast /0:Individual> <1:Triggered / 0:Untriggered> <1:Unannounced /0:Announced> <1:Protected / 0:Unprotected>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/add_dialog Example (Non-triggered and un-announced): echo '00:03:7F:20:13:52 1 102400 100 30720 20480 4 0 0 1 0' > /sys/kernel/debug/ieee80211/phy0/netdev:wlan0/twt/add_dialog - Delete dialog echo '<Peer_MAC> <Dialog_ID>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/del_dialog - Pause dialog echo '<Peer_MAC> <Dialog_ID>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/pause_dialog - Resume dialog echo '<Peer_MAC> <Dialog_ID> <SP_Offset_Usec> <Next_TWT_Size>' > /sys/kernel/debug/ieee80211/phyX/netdev:wlanX/twt/resume_dialog Example: echo '00:03:7F:20:13:52 1 2000000 3' > /sys/kernel/debug/ieee80211/phy0/netdev:wlan0/twt/resume_dialog Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01179-QCAHKSWPL_SILICONZ-1 Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220131031043.1295-2-alokad@codeaurora.org
-
ath11k: add WMI calls to manually add/del/pause/resume TWT dialogs
These calls are used for debugging and will be required for WFA certification tests. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01179-QCAHKSWPL_SILICONZ-1 Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Aloka Dixit <alokad@codeaurora.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220131031043.1295-1-alokad@codeaurora.org
Commits on Jan 31, 2022
-
carl9170: fix missing bit-wise or operator for tx_params
Currently tx_params is being re-assigned with a new value and the previous setting IEEE80211_HT_MCS_TX_RX_DIFF is being overwritten. The assignment operator is incorrect, the original intent was to bit-wise or the value in. Fix this by replacing the = operator with |= instead. Kudos to Christian Lamparter for suggesting the correct fix. Fixes: fe8ee9a ("carl9170: mac80211 glue and command interface") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Cc: <Stable@vger.kernel.org> Acked-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220125004406.344422-1-colin.i.king@gmail.com
-
wcn36xx: Differentiate wcn3660 from wcn3620
The spread of capability between the three WiFi silicon parts wcn36xx supports is: wcn3620 - 802.11 a/b/g wcn3660 - 802.11 a/b/g/n wcn3680 - 802.11 a/b/g/n/ac We currently treat wcn3660 as wcn3620 thus limiting it to 2GHz channels. Fix this regression by ensuring we differentiate between all three parts. Fixes: 8490987 ("wcn36xx: Hook and identify RF_IRIS_WCN3680") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@linaro.org> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220125004046.4058284-1-bryan.odonoghue@linaro.org
Commits on Jan 28, 2022
-
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 Fixes: fb9987d ("ath9k_htc: Support for AR9271 chipset.") Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/20220115122733.11160-1-paskripkin@gmail.com
-
ipv6: partially inline ipv6_fixup_options
Inline a part of ipv6_fixup_options() to avoid extra overhead on function call if opt is NULL. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
ipv6: optimise dst refcounting on cork init
udpv6_sendmsg() doesn't need dst after calling ip6_make_skb(), so instead of taking an additional reference inside ip6_setup_cork() and releasing the initial one afterwards, we can hand over a reference into ip6_make_skb() saving two atomics. The only other user of ip6_setup_cork() is ip6_append_data() and it requires an extra dst_hold(). Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
udp6: don't make extra copies of iflow
udpv6_sendmsg() first initialises an on-stack 88B struct flowi6 and then copies it into cork, which is expensive. Avoid the copy in corkless case by initialising on-stack cork->fl directly. The main part is a couple of lines under !corkreq check. The rest converts fl6 variable to be a pointer. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
udp6: pass flow in ip6_make_skb together with cork
Another preparation patch. inet_cork_full already contains a field for iflow, so we can avoid passing a separate struct iflow6 into __ip6_append_data() and ip6_make_skb(), and use the flow stored in inet_cork_full. Make sure callers set cork->fl, i.e. we init it in ip6_append_data() and before calling ip6_make_skb(). Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
ipv6: pass full cork into __ip6_append_data()
Convert a struct inet_cork argument in __ip6_append_data() to struct inet_cork_full. As one struct contains another inet_cork is still can be accessed via ->base field. It's a preparation patch making further changes a bit cleaner. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
ipv6: don't zero inet_cork_full::fl after use
It doesn't appear there is any reason for ip6_cork_release() to zero cork->fl, it'll be fully filled on next initialisation. This 88 bytes memset accounts to 0.3-0.5% of total CPU cycles. It's also needed in following patches and allows to remove an extar flow copy in udp_v6_push_pending_frames(). Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
ipv6: clean up cork setup/release
Clean up ip6_setup_cork() and ip6_cork_release() adding a local variable for v6_cork->opt. It's a preparation patch for further changes. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
ipv6: remove daddr temp buffer in __ip6_make_skb
ipv6_push_nfrag_opts() doesn't change passed daddr, and so __ip6_make_skb() doesn't actually need to keep an on-stack copy of fl6->daddr. Set initially final_dst to fl6->daddr, ipv6_push_nfrag_opts() will override it if needed, and get rid of extra copies. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
udp6: shuffle up->pending AF_INET bits
Corked AF_INET for ipv6 socket doesn't appear to be the hottest case, so move it out of the common path under up->pending check to remove overhead. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-
ipv6: optimise dst refcounting on skb init
__ip6_make_skb() gets a cork->dst ref, hands it over to skb and shortly after puts cork->dst. Save two atomics by stealing it without extra referencing, ip6_cork_release() handles NULL cork->dst. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
