Skip to content

Commit 9ef902a

Browse files
ptalbertptalbert
committed
Merge: Wireless bugfixes (v6.12)
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6167 JIRA: https://issues.redhat.com/browse/RHEL-73817 JIRA: https://issues.redhat.com/browse/RHEL-72322 CVE: CVE-2024-56535 JIRA: https://issues.redhat.com/browse/RHEL-72111 CVE: CVE-2024-53156 JIRA: https://issues.redhat.com/browse/RHEL-72421 CVE: CVE-2024-53190 JIRA: https://issues.redhat.com/browse/RHEL-73669 CVE: CVE-2024-48873 JIRA: https://issues.redhat.com/browse/RHEL-72282 CVE: CVE-2024-56602 JIRA: https://issues.redhat.com/browse/RHEL-74089 CVE: CVE-2024-57898 Tested: basic testing with several supported WiFi cards (Intel, Qualcomm, Mediatek and Realtek). Wireless bugfixes (v6.12) Upstream status: linux.git, wireless-next.git Not important commits of related series: Omitted-fix: 0572b77 wifi: iwlwifi: be less noisy if the NIC is dead in S3 Omitted-fix: 7bf2f8f wifi: rtw89: 8852c: rfk: remove unnecessary assignment of return value of _dpk_dgain_read() Not important fix to be included in the next update: Omitted-fix: e47f0a5 wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: mheib <mheib@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Patrick Talbert <ptalbert@redhat.com>
2 parents 2cd2767 + 52137e5 commit 9ef902a

File tree

32 files changed

+266
-182
lines changed

32 files changed

+266
-182
lines changed

‎drivers/bus/mhi/host/trace.h‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
#if !defined(_TRACE_EVENT_MHI_HOST_H) || defined(TRACE_HEADER_MULTI_READ)
1010
#define _TRACE_EVENT_MHI_HOST_H
1111

12+
#include <linux/byteorder/generic.h>
1213
#include <linux/tracepoint.h>
1314
#include <linux/trace_seq.h>
1415
#include "../common.h"
@@ -97,18 +98,18 @@ TRACE_EVENT(mhi_gen_tre,
9798
__string(name, mhi_cntrl->mhi_dev->name)
9899
__field(int, ch_num)
99100
__field(void *, wp)
100-
__field(__le64, tre_ptr)
101-
__field(__le32, dword0)
102-
__field(__le32, dword1)
101+
__field(uint64_t, tre_ptr)
102+
__field(uint32_t, dword0)
103+
__field(uint32_t, dword1)
103104
),
104105

105106
TP_fast_assign(
106107
__assign_str(name, mhi_cntrl->mhi_dev->name);
107108
__entry->ch_num = mhi_chan->chan;
108109
__entry->wp = mhi_tre;
109-
__entry->tre_ptr = mhi_tre->ptr;
110-
__entry->dword0 = mhi_tre->dword[0];
111-
__entry->dword1 = mhi_tre->dword[1];
110+
__entry->tre_ptr = le64_to_cpu(mhi_tre->ptr);
111+
__entry->dword0 = le32_to_cpu(mhi_tre->dword[0]);
112+
__entry->dword1 = le32_to_cpu(mhi_tre->dword[1]);
112113
),
113114

114115
TP_printk("%s: Chan: %d TRE: 0x%p TRE buf: 0x%llx DWORD0: 0x%08x DWORD1: 0x%08x\n",
@@ -176,19 +177,19 @@ DECLARE_EVENT_CLASS(mhi_process_event_ring,
176177

177178
TP_STRUCT__entry(
178179
__string(name, mhi_cntrl->mhi_dev->name)
179-
__field(__le32, dword0)
180-
__field(__le32, dword1)
180+
__field(uint32_t, dword0)
181+
__field(uint32_t, dword1)
181182
__field(int, state)
182-
__field(__le64, ptr)
183+
__field(uint64_t, ptr)
183184
__field(void *, rp)
184185
),
185186

186187
TP_fast_assign(
187188
__assign_str(name, mhi_cntrl->mhi_dev->name);
188189
__entry->rp = rp;
189-
__entry->ptr = rp->ptr;
190-
__entry->dword0 = rp->dword[0];
191-
__entry->dword1 = rp->dword[1];
190+
__entry->ptr = le64_to_cpu(rp->ptr);
191+
__entry->dword0 = le32_to_cpu(rp->dword[0]);
192+
__entry->dword1 = le32_to_cpu(rp->dword[1]);
192193
__entry->state = MHI_TRE_GET_EV_STATE(rp);
193194
),
194195

‎drivers/net/wireless/ath/ath11k/qmi.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2180,6 +2180,9 @@ static int ath11k_qmi_request_device_info(struct ath11k_base *ab)
21802180
ab->mem = bar_addr_va;
21812181
ab->mem_len = resp.bar_size;
21822182

2183+
if (!ab->hw_params.ce_remap)
2184+
ab->mem_ce = ab->mem;
2185+
21832186
return 0;
21842187
out:
21852188
return ret;

‎drivers/net/wireless/ath/ath12k/dp.c‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1202,10 +1202,16 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)
12021202
if (!skb)
12031203
continue;
12041204

1205-
skb_cb = ATH12K_SKB_CB(skb);
1206-
ar = skb_cb->ar;
1207-
if (atomic_dec_and_test(&ar->dp.num_tx_pending))
1208-
wake_up(&ar->dp.tx_empty_waitq);
1205+
/* if we are unregistering, hw would've been destroyed and
1206+
* ar is no longer valid.
1207+
*/
1208+
if (!(test_bit(ATH12K_FLAG_UNREGISTERING, &ab->dev_flags))) {
1209+
skb_cb = ATH12K_SKB_CB(skb);
1210+
ar = skb_cb->ar;
1211+
1212+
if (atomic_dec_and_test(&ar->dp.num_tx_pending))
1213+
wake_up(&ar->dp.tx_empty_waitq);
1214+
}
12091215

12101216
dma_unmap_single(ab->dev, ATH12K_SKB_CB(skb)->paddr,
12111217
skb->len, DMA_TO_DEVICE);

‎drivers/net/wireless/ath/ath12k/hal.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -385,13 +385,13 @@ static u8 ath12k_hw_qcn9274_rx_desc_get_msdu_pkt_type(struct hal_rx_desc *desc)
385385
static u8 ath12k_hw_qcn9274_rx_desc_get_msdu_nss(struct hal_rx_desc *desc)
386386
{
387387
return le32_get_bits(desc->u.qcn9274.msdu_end.info12,
388-
RX_MSDU_END_QCN9274_INFO12_MIMO_SS_BITMAP);
388+
RX_MSDU_END_INFO12_MIMO_SS_BITMAP);
389389
}
390390

391391
static u8 ath12k_hw_qcn9274_rx_desc_get_mpdu_tid(struct hal_rx_desc *desc)
392392
{
393393
return le16_get_bits(desc->u.qcn9274.msdu_end.info5,
394-
RX_MSDU_END_QCN9274_INFO5_TID);
394+
RX_MSDU_END_INFO5_TID);
395395
}
396396

397397
static u16 ath12k_hw_qcn9274_rx_desc_get_mpdu_peer_id(struct hal_rx_desc *desc)
@@ -846,13 +846,13 @@ static u8 ath12k_hw_qcn9274_compact_rx_desc_get_msdu_pkt_type(struct hal_rx_desc
846846
static u8 ath12k_hw_qcn9274_compact_rx_desc_get_msdu_nss(struct hal_rx_desc *desc)
847847
{
848848
return le32_get_bits(desc->u.qcn9274_compact.msdu_end.info12,
849-
RX_MSDU_END_QCN9274_INFO12_MIMO_SS_BITMAP);
849+
RX_MSDU_END_INFO12_MIMO_SS_BITMAP);
850850
}
851851

852852
static u8 ath12k_hw_qcn9274_compact_rx_desc_get_mpdu_tid(struct hal_rx_desc *desc)
853853
{
854854
return le16_get_bits(desc->u.qcn9274_compact.msdu_end.info5,
855-
RX_MSDU_END_QCN9274_INFO5_TID);
855+
RX_MSDU_END_INFO5_TID);
856856
}
857857

858858
static u16 ath12k_hw_qcn9274_compact_rx_desc_get_mpdu_peer_id(struct hal_rx_desc *desc)
@@ -1198,7 +1198,7 @@ static u8 ath12k_hw_wcn7850_rx_desc_get_msdu_pkt_type(struct hal_rx_desc *desc)
11981198
static u8 ath12k_hw_wcn7850_rx_desc_get_msdu_nss(struct hal_rx_desc *desc)
11991199
{
12001200
return le32_get_bits(desc->u.wcn7850.msdu_end.info12,
1201-
RX_MSDU_END_WCN7850_INFO12_MIMO_SS_BITMAP);
1201+
RX_MSDU_END_INFO12_MIMO_SS_BITMAP);
12021202
}
12031203

12041204
static u8 ath12k_hw_wcn7850_rx_desc_get_mpdu_tid(struct hal_rx_desc *desc)
@@ -1216,7 +1216,7 @@ static void ath12k_hw_wcn7850_rx_desc_copy_end_tlv(struct hal_rx_desc *fdesc,
12161216
struct hal_rx_desc *ldesc)
12171217
{
12181218
memcpy(&fdesc->u.wcn7850.msdu_end, &ldesc->u.wcn7850.msdu_end,
1219-
sizeof(struct rx_msdu_end_wcn7850));
1219+
sizeof(struct rx_msdu_end_qcn9274));
12201220
}
12211221

12221222
static u32 ath12k_hw_wcn7850_rx_desc_get_mpdu_start_tag(struct hal_rx_desc *desc)

‎drivers/net/wireless/ath/ath12k/mac.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -917,7 +917,10 @@ void ath12k_mac_peer_cleanup_all(struct ath12k *ar)
917917

918918
spin_lock_bh(&ab->base_lock);
919919
list_for_each_entry_safe(peer, tmp, &ab->peers, list) {
920-
ath12k_dp_rx_peer_tid_cleanup(ar, peer);
920+
/* Skip Rx TID cleanup for self peer */
921+
if (peer->sta)
922+
ath12k_dp_rx_peer_tid_cleanup(ar, peer);
923+
921924
list_del(&peer->list);
922925
kfree(peer);
923926
}

‎drivers/net/wireless/ath/ath12k/rx_desc.h‎

Lines changed: 14 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -684,18 +684,17 @@ enum rx_msdu_start_reception_type {
684684

685685
#define RX_MSDU_END_INFO5_SA_IDX_TIMEOUT BIT(0)
686686
#define RX_MSDU_END_INFO5_DA_IDX_TIMEOUT BIT(1)
687+
#define RX_MSDU_END_INFO5_TO_DS BIT(2)
688+
#define RX_MSDU_END_INFO5_TID GENMASK(6, 3)
687689
#define RX_MSDU_END_INFO5_SA_IS_VALID BIT(7)
688690
#define RX_MSDU_END_INFO5_DA_IS_VALID BIT(8)
689691
#define RX_MSDU_END_INFO5_DA_IS_MCBC BIT(9)
690692
#define RX_MSDU_END_INFO5_L3_HDR_PADDING GENMASK(11, 10)
691693
#define RX_MSDU_END_INFO5_FIRST_MSDU BIT(12)
692694
#define RX_MSDU_END_INFO5_LAST_MSDU BIT(13)
695+
#define RX_MSDU_END_INFO5_FROM_DS BIT(14)
693696
#define RX_MSDU_END_INFO5_IP_CHKSUM_FAIL_COPY BIT(15)
694697

695-
#define RX_MSDU_END_QCN9274_INFO5_TO_DS BIT(2)
696-
#define RX_MSDU_END_QCN9274_INFO5_TID GENMASK(6, 3)
697-
#define RX_MSDU_END_QCN9274_INFO5_FROM_DS BIT(14)
698-
699698
#define RX_MSDU_END_INFO6_MSDU_DROP BIT(0)
700699
#define RX_MSDU_END_INFO6_REO_DEST_IND GENMASK(5, 1)
701700
#define RX_MSDU_END_INFO6_FLOW_IDX GENMASK(25, 6)
@@ -709,14 +708,14 @@ enum rx_msdu_start_reception_type {
709708
#define RX_MSDU_END_INFO7_FLOW_AGGR_CONTN BIT(8)
710709
#define RX_MSDU_END_INFO7_FISA_TIMEOUT BIT(9)
711710

712-
#define RX_MSDU_END_QCN9274_INFO7_TCPUDP_CSUM_FAIL_CPY BIT(10)
713-
#define RX_MSDU_END_QCN9274_INFO7_MSDU_LIMIT_ERROR BIT(11)
714-
#define RX_MSDU_END_QCN9274_INFO7_FLOW_IDX_TIMEOUT BIT(12)
715-
#define RX_MSDU_END_QCN9274_INFO7_FLOW_IDX_INVALID BIT(13)
716-
#define RX_MSDU_END_QCN9274_INFO7_CCE_MATCH BIT(14)
717-
#define RX_MSDU_END_QCN9274_INFO7_AMSDU_PARSER_ERR BIT(15)
711+
#define RX_MSDU_END_INFO7_TCPUDP_CSUM_FAIL_CPY BIT(10)
712+
#define RX_MSDU_END_INFO7_MSDU_LIMIT_ERROR BIT(11)
713+
#define RX_MSDU_END_INFO7_FLOW_IDX_TIMEOUT BIT(12)
714+
#define RX_MSDU_END_INFO7_FLOW_IDX_INVALID BIT(13)
715+
#define RX_MSDU_END_INFO7_CCE_MATCH BIT(14)
716+
#define RX_MSDU_END_INFO7_AMSDU_PARSER_ERR BIT(15)
718717

719-
#define RX_MSDU_END_QCN9274_INFO8_KEY_ID GENMASK(7, 0)
718+
#define RX_MSDU_END_INFO8_KEY_ID GENMASK(7, 0)
720719

721720
#define RX_MSDU_END_INFO9_SERVICE_CODE GENMASK(14, 6)
722721
#define RX_MSDU_END_INFO9_PRIORITY_VALID BIT(15)
@@ -758,8 +757,8 @@ enum rx_msdu_start_reception_type {
758757
#define RX_MSDU_END_INFO12_RECV_BW GENMASK(20, 18)
759758
#define RX_MSDU_END_INFO12_RECEPTION_TYPE GENMASK(23, 21)
760759

761-
#define RX_MSDU_END_QCN9274_INFO12_MIMO_SS_BITMAP GENMASK(30, 24)
762-
#define RX_MSDU_END_QCN9274_INFO12_MIMO_DONE_COPY BIT(31)
760+
#define RX_MSDU_END_INFO12_MIMO_SS_BITMAP GENMASK(30, 24)
761+
#define RX_MSDU_END_INFO12_MIMO_DONE_COPY BIT(31)
763762

764763
#define RX_MSDU_END_INFO13_FIRST_MPDU BIT(0)
765764
#define RX_MSDU_END_INFO13_MCAST_BCAST BIT(2)
@@ -791,7 +790,7 @@ enum rx_msdu_start_reception_type {
791790
#define RX_MSDU_END_INFO13_UNDECRYPT_FRAME_ERR BIT(30)
792791
#define RX_MSDU_END_INFO13_FCS_ERR BIT(31)
793792

794-
#define RX_MSDU_END_QCN9274_INFO13_WIFI_PARSER_ERR BIT(15)
793+
#define RX_MSDU_END_INFO13_WIFI_PARSER_ERR BIT(15)
795794

796795
#define RX_MSDU_END_INFO14_DECRYPT_STATUS_CODE GENMASK(12, 10)
797796
#define RX_MSDU_END_INFO14_RX_BITMAP_NOT_UPDED BIT(13)
@@ -889,65 +888,6 @@ struct rx_msdu_end_qcn9274_compact {
889888
__le32 info14;
890889
} __packed;
891890

892-
/* These macro definitions are only used for WCN7850 */
893-
#define RX_MSDU_END_WCN7850_INFO2_KEY_ID BIT(7, 0)
894-
895-
#define RX_MSDU_END_WCN7850_INFO5_MSDU_LIMIT_ERR BIT(2)
896-
#define RX_MSDU_END_WCN7850_INFO5_IDX_TIMEOUT BIT(3)
897-
#define RX_MSDU_END_WCN7850_INFO5_IDX_INVALID BIT(4)
898-
#define RX_MSDU_END_WCN7850_INFO5_WIFI_PARSE_ERR BIT(5)
899-
#define RX_MSDU_END_WCN7850_INFO5_AMSDU_PARSER_ERR BIT(6)
900-
#define RX_MSDU_END_WCN7850_INFO5_TCPUDP_CSUM_FAIL_CPY BIT(14)
901-
902-
#define RX_MSDU_END_WCN7850_INFO12_MIMO_SS_BITMAP GENMASK(31, 24)
903-
904-
#define RX_MSDU_END_WCN7850_INFO13_FRAGMENT_FLAG BIT(13)
905-
#define RX_MSDU_END_WCN7850_INFO13_CCE_MATCH BIT(15)
906-
907-
struct rx_msdu_end_wcn7850 {
908-
__le16 info0;
909-
__le16 phy_ppdu_id;
910-
__le16 ip_hdr_cksum;
911-
__le16 info1;
912-
__le16 info2;
913-
__le16 cumulative_l3_checksum;
914-
__le32 rule_indication0;
915-
__le32 rule_indication1;
916-
__le16 info3;
917-
__le16 l3_type;
918-
__le32 ipv6_options_crc;
919-
__le32 tcp_seq_num;
920-
__le32 tcp_ack_num;
921-
__le16 info4;
922-
__le16 window_size;
923-
__le16 tcp_udp_chksum;
924-
__le16 info5;
925-
__le16 sa_idx;
926-
__le16 da_idx_or_sw_peer_id;
927-
__le32 info6;
928-
__le32 fse_metadata;
929-
__le16 cce_metadata;
930-
__le16 sa_sw_peer_id;
931-
__le16 info7;
932-
__le16 rsvd0;
933-
__le16 cumulative_l4_checksum;
934-
__le16 cumulative_ip_length;
935-
__le32 info9;
936-
__le32 info10;
937-
__le32 info11;
938-
__le32 toeplitz_hash_2_or_4;
939-
__le32 flow_id_toeplitz;
940-
__le32 info12;
941-
__le32 ppdu_start_timestamp_31_0;
942-
__le32 ppdu_start_timestamp_63_32;
943-
__le32 phy_meta_data;
944-
__le16 vlan_ctag_ci;
945-
__le16 vlan_stag_ci;
946-
__le32 rsvd[3];
947-
__le32 info13;
948-
__le32 info14;
949-
} __packed;
950-
951891
/* rx_msdu_end
952892
*
953893
* rxpcu_mpdu_filter_in_category
@@ -1578,7 +1518,7 @@ struct rx_pkt_hdr_tlv {
15781518

15791519
struct hal_rx_desc_wcn7850 {
15801520
__le64 msdu_end_tag;
1581-
struct rx_msdu_end_wcn7850 msdu_end;
1521+
struct rx_msdu_end_qcn9274 msdu_end;
15821522
u8 rx_padding0[RX_BE_PADDING0_BYTES];
15831523
__le64 mpdu_start_tag;
15841524
struct rx_mpdu_start_qcn9274 mpdu_start;

‎drivers/net/wireless/ath/ath12k/wow.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ ath12k_wow_convert_8023_to_80211(struct ath12k *ar,
191191
memcpy(bytemask, eth_bytemask, eth_pat_len);
192192

193193
pat_len = eth_pat_len;
194-
} else if (eth_pkt_ofs + eth_pat_len < prot_ofs) {
194+
} else if (size_add(eth_pkt_ofs, eth_pat_len) < prot_ofs) {
195195
memcpy(pat, eth_pat, ETH_ALEN - eth_pkt_ofs);
196196
memcpy(bytemask, eth_bytemask, ETH_ALEN - eth_pkt_ofs);
197197

‎drivers/net/wireless/ath/ath9k/htc_hst.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,9 @@ int htc_connect_service(struct htc_target *target,
294294
return -ETIMEDOUT;
295295
}
296296

297+
if (target->conn_rsp_epid < 0 || target->conn_rsp_epid >= ENDPOINT_MAX)
298+
return -EINVAL;
299+
297300
*conn_rsp_epid = target->conn_rsp_epid;
298301
return 0;
299302
err:

‎drivers/net/wireless/intel/iwlwifi/cfg/bz.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ const struct iwl_cfg_trans_params iwl_gl_trans_cfg = {
161161

162162
const char iwl_bz_name[] = "Intel(R) TBD Bz device";
163163
const char iwl_fm_name[] = "Intel(R) Wi-Fi 7 BE201 320MHz";
164+
const char iwl_wh_name[] = "Intel(R) Wi-Fi 7 BE211 320MHz";
164165
const char iwl_gl_name[] = "Intel(R) Wi-Fi 7 BE200 320MHz";
165166
const char iwl_mtp_name[] = "Intel(R) Wi-Fi 7 BE202 160MHz";
166167

‎drivers/net/wireless/intel/iwlwifi/iwl-config.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -545,6 +545,7 @@ extern const char iwl_ax231_name[];
545545
extern const char iwl_ax411_name[];
546546
extern const char iwl_bz_name[];
547547
extern const char iwl_fm_name[];
548+
extern const char iwl_wh_name[];
548549
extern const char iwl_gl_name[];
549550
extern const char iwl_mtp_name[];
550551
extern const char iwl_sc_name[];

0 commit comments

Comments
 (0)