linux/drivers/net/wireless/ath/ath12k/p2p.c

148 lines
4 KiB
C
Raw Permalink Normal View History

// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks. ========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO") Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20250618185635.750470-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-06-19 00:26:35 +05:30
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <net/mac80211.h>
#include "core.h"
#include "mac.h"
#include "p2p.h"
static void ath12k_p2p_noa_ie_fill(u8 *data, size_t len,
const struct ath12k_wmi_p2p_noa_info *noa)
{
struct ieee80211_p2p_noa_attr *noa_attr;
u8 ctwindow = le32_get_bits(noa->noa_attr, WMI_P2P_NOA_INFO_CTWIN_TU);
bool oppps = le32_get_bits(noa->noa_attr, WMI_P2P_NOA_INFO_OPP_PS);
__le16 *noa_attr_len;
u16 attr_len;
u8 noa_descriptors = le32_get_bits(noa->noa_attr,
WMI_P2P_NOA_INFO_DESC_NUM);
int i;
/* P2P IE */
data[0] = WLAN_EID_VENDOR_SPECIFIC;
data[1] = len - 2;
data[2] = (WLAN_OUI_WFA >> 16) & 0xff;
data[3] = (WLAN_OUI_WFA >> 8) & 0xff;
data[4] = (WLAN_OUI_WFA >> 0) & 0xff;
data[5] = WLAN_OUI_TYPE_WFA_P2P;
/* NOA ATTR */
data[6] = IEEE80211_P2P_ATTR_ABSENCE_NOTICE;
noa_attr_len = (__le16 *)&data[7]; /* 2 bytes */
noa_attr = (struct ieee80211_p2p_noa_attr *)&data[9];
noa_attr->index = le32_get_bits(noa->noa_attr,
WMI_P2P_NOA_INFO_INDEX);
noa_attr->oppps_ctwindow = ctwindow;
if (oppps)
noa_attr->oppps_ctwindow |= IEEE80211_P2P_OPPPS_ENABLE_BIT;
for (i = 0; i < noa_descriptors; i++) {
noa_attr->desc[i].count =
__le32_to_cpu(noa->descriptors[i].type_count);
noa_attr->desc[i].duration = noa->descriptors[i].duration;
noa_attr->desc[i].interval = noa->descriptors[i].interval;
noa_attr->desc[i].start_time = noa->descriptors[i].start_time;
}
attr_len = 2; /* index + oppps_ctwindow */
attr_len += noa_descriptors * sizeof(struct ieee80211_p2p_noa_desc);
*noa_attr_len = __cpu_to_le16(attr_len);
}
static size_t ath12k_p2p_noa_ie_len_compute(const struct ath12k_wmi_p2p_noa_info *noa)
{
size_t len = 0;
if (!(le32_get_bits(noa->noa_attr, WMI_P2P_NOA_INFO_DESC_NUM)) &&
!(le32_get_bits(noa->noa_attr, WMI_P2P_NOA_INFO_OPP_PS)))
return 0;
len += 1 + 1 + 4; /* EID + len + OUI */
len += 1 + 2; /* noa attr + attr len */
len += 1 + 1; /* index + oppps_ctwindow */
len += le32_get_bits(noa->noa_attr, WMI_P2P_NOA_INFO_DESC_NUM) *
sizeof(struct ieee80211_p2p_noa_desc);
return len;
}
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
static void ath12k_p2p_noa_ie_assign(struct ath12k_link_vif *arvif, void *ie,
size_t len)
{
struct ath12k *ar = arvif->ar;
lockdep_assert_held(&ar->data_lock);
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
kfree(arvif->ahvif->u.ap.noa_data);
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
arvif->ahvif->u.ap.noa_data = ie;
arvif->ahvif->u.ap.noa_len = len;
}
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
static void __ath12k_p2p_noa_update(struct ath12k_link_vif *arvif,
const struct ath12k_wmi_p2p_noa_info *noa)
{
struct ath12k *ar = arvif->ar;
void *ie;
size_t len;
lockdep_assert_held(&ar->data_lock);
ath12k_p2p_noa_ie_assign(arvif, NULL, 0);
len = ath12k_p2p_noa_ie_len_compute(noa);
if (!len)
return;
ie = kmalloc(len, GFP_ATOMIC);
if (!ie)
return;
ath12k_p2p_noa_ie_fill(ie, len, noa);
ath12k_p2p_noa_ie_assign(arvif, ie, len);
}
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
void ath12k_p2p_noa_update(struct ath12k_link_vif *arvif,
const struct ath12k_wmi_p2p_noa_info *noa)
{
struct ath12k *ar = arvif->ar;
spin_lock_bh(&ar->data_lock);
__ath12k_p2p_noa_update(arvif, noa);
spin_unlock_bh(&ar->data_lock);
}
static void ath12k_p2p_noa_update_vdev_iter(void *data, u8 *mac,
struct ieee80211_vif *vif)
{
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
struct ath12k_vif *ahvif = ath12k_vif_to_ahvif(vif);
struct ath12k_p2p_noa_arg *arg = data;
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
struct ath12k_link_vif *arvif;
wifi: ath12k: prepare vif data structure for MLO handling To prepare the driver for MLO support, split the driver vif data structure to scale for multiple links. This requires changing the use of arvif to per link and not per hw which can now comprise of multiple links. Also since most configurations from mac80211 are done per link, do refactoring of the driver functions to apply these configurations at link level. Split ath12k_vif which is the driver private of ieee80211_vif to store link specific information as ath12k_link_vif. For default use cases the ath12k vif will have a preallocated link vif called deflink which will be used by non ML and the first link vif of ML vif. With MLO support to be added, remaining link vifs will be allocated during channel assignment where vdev create/start happens. These link vifs will be freed during interface down. Current ath12k_vif(arvif) structure +---------------+ +---------------+ +---------------+ | ieee80211_vif | | ieee80211_vif | | ieee80211_vif | | private data | | private data | | private data | | | | | | | | ath12k_vif | | ath12k_vif | | ath12k_vif | | (arvif) | | (arvif) | | (arvif) | | | | | | | | +----------+ | | +----------+ | | +----------+ | | |*ar (2GHz)| | | |*ar (5GHz)| | | |*ar (2GHz)| | | +----------+ | | +----------+ | | +----------+ | | | | | | | +---------------+ +---------------+ +---------------+ The new ath12k_vif (ahvif) containing ath12k_link_vif(s) (arvif) (deflink is preallocated member which is always the first link if ieee80211_vif is MLD and is the only link otherwise): +---------------------------------+ | ieee80211_vif | | private data | | | | ath12k_vif(ahvif) | | | | +-------------------------------+ | |ath12k_link_vif deflink (arvif)| | | +---------------+ | | | | *ar(2GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(5GHz) | | | +-------------------------------+ | +-------------------------------+ | | ath12k_link_vif *link (arvif)| | | +---------------+ | | | | *ar(6GHz) | | | +-------------------------------+ | | +---------------------------------+ To refactor existing ath12k_vif to make use of link vifs, following changes are made: 1. ath12k_vif now called by variable name ahvif storing multiple arvifs (struct ah12k_link_vif) and also has a back pointer to ieee80211_vif. 2. In this patch set, only deflink is used to be on par with the existing code. When MLO support is added the link id will be used to fetch the arvif. 3. For mac80211 ops which doesn't use specific link_id, the config or info is common for the vif, hence apply the config to all link vifs. The links_map in the ahvif, will be used to identify all the link vifs that are setup. 4. Change ath12k_vif_to_arvif() as ath12k_vif_to_ahvif() to fetch the hw level vif. The link vif can be fetched from ahvif->link[], or the deflink can be accessed via ahvif->deflink. API to access link vif (arvif) by passing link_id can be introduced with MLO Support. 5. The ieee80211_vif can be accessed from ahvif using ath12k_ahvif_to_vif(). The locking continues to use wiphy_lock() for protecting access to most data in struct ath12k&co, there are no changes in that regard. Though struct ath12k_vif::link[] is protected with RCU. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R <quic_srirrama@quicinc.com> Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://patch.msgid.link/20241015171416.518022-2-kvalo@kernel.org Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2024-10-15 20:14:06 +03:00
WARN_ON(!rcu_read_lock_any_held());
arvif = &ahvif->deflink;
wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks. ========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO") Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20250618185635.750470-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-06-19 00:26:35 +05:30
if (!arvif->is_created || arvif->ar != arg->ar || arvif->vdev_id != arg->vdev_id)
return;
ath12k_p2p_noa_update(arvif, arg->noa);
}
void ath12k_p2p_noa_update_by_vdev_id(struct ath12k *ar, u32 vdev_id,
const struct ath12k_wmi_p2p_noa_info *noa)
{
struct ath12k_p2p_noa_arg arg = {
.vdev_id = vdev_id,
.ar = ar,
.noa = noa,
};
ieee80211_iterate_active_interfaces_atomic(ath12k_ar_to_hw(ar),
IEEE80211_IFACE_ITER_NORMAL,
ath12k_p2p_noa_update_vdev_iter,
&arg);
}