Add macros (and an exported function) to allow checking some
link RCU protected accesses that are happening in callbacks
from mac80211 and are thus under the correct lock.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In hwsim we now track when we receive NDP (or other frames
carrying a PM bit) to see if a link should be active, but
then of course we also need to transmit NDPs to at least
set a link to inactive when we deacivate it. Implement that
as well as sending an NDP when we activate a link, which
allows receiving frames before transmitting any.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Add a link_id parameter to ieee80211_nullfunc_get() to be
able to obtain a correctly addressed frame.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Track the powersave bit on frames where we can look up
the STA by link addresses and set the links active or
inactive accordingly, and use this information to TX
only on links that are actually active in the peer.

Note that this doesn't implement powersave fully so
if no link is active things will not work right.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

With the link activation handling in mac80211, skip
any inactive links on TX.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The SMPS power save mode needs to be per-link rather than being shared
for all links. As such, move it into struct ieee80211_link_sta.
Signed-off-by: NBenjamin Berg <benjamin.berg@intel.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

In netlink RX, now that we can actually have multiple
channel contexts for MLO, things don't work well as we
only keep a single pointer, and then on link switching
we might NULL it, and hit the return if the channel is
NULL.

However, we already use mac80211_hwsim_tx_iter() which
deals with all this, so remove the test and adjust the
remaining code a bit.

This then means we no longer use the chanctx pointer,
so remove it as well.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Catch the bugs fixed in mac80211 by the previous commits
and warn if an invalid address is added (or removed).
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Refactor some common RX functionality between the netlink
and non-netlink paths, adding the special hwsim TLV (if
compiled) also in the netlink path.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Just as an additional check that mac80211 isn't doing
anything strange, add a check of the STA magic (which
gets assigned when the station is added, and cleared
when the station is removed).
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Now that we have proper multicast TX in mac80211, there's
no longer a need to fake something here.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

An invalid packet with a length shorter than the specified length in the
netlink header can lead to use-after-frees and slab-out-of-bounds in the
processing of the netlink attributes, such as the following:

  BUG: KASAN: slab-out-of-bounds in __nla_validate_parse+0x1258/0x2010
  Read of size 2 at addr ffff88800ac7952c by task kworker/0:1/12

  Workqueue: events hwsim_virtio_rx_work
  Call Trace:
   <TASK>
   dump_stack_lvl+0x45/0x5d
   print_report.cold+0x5e/0x5e5
   kasan_report+0xb1/0x1c0
   __nla_validate_parse+0x1258/0x2010
   __nla_parse+0x22/0x30
   hwsim_virtio_handle_cmd.isra.0+0x13f/0x2d0
   hwsim_virtio_rx_work+0x1b2/0x370
   process_one_work+0x8df/0x1530
   worker_thread+0x575/0x11a0
   kthread+0x29d/0x340
   ret_from_fork+0x22/0x30
 </TASK>

Discarding packets with an invalid length solves this.
Therefore, skb->len must be set at reception.

Change-Id: Ieaeb9a4c62d3beede274881a7c2722c6c6f477b6
Signed-off-by: NSoenke Huster <soenke.huster@eknoes.de>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Follow the advice of the below link and prefer 'strscpy' in this
subsystem. Conversion is 1:1 because the return value is not used.
Generated by a coccinelle script.

Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/Signed-off-by: NWolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220830201457.7984-2-wsa+renesas@sang-engineering.com

Return value from cfg80211_rx_mgmt() directly instead of
taking this in another redundant variable.
Reported-by: NZeal Robot <zealci@zte.com.cn>
Signed-off-by: NJinpeng Cui <cui.jinpeng2@zte.com.cn>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220830105505.287564-1-cui.jinpeng2@zte.com.cn

Add the missing destroy_workqueue() before return from rtw_core_init()
in error path.

Fixes: fe101716 ("rtw88: replace tx tasklet with work queue")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220826023817.3908255-1-yangyingliang@huawei.com

This does a "chunk_len - 4" subtraction later when it calls:

	ret = wfx_hif_configuration(wdev, buf + 4, chunk_len - 4);

so check for "chunk_len" is less than 4.

Fixes: dcbecb49 ("staging: wfx: allow new PDS format")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NJérôme Pouiller <jerome.pouiller@silabs.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/Yv8eX7Xv2ubUOvW7@kili

There some bounds checking to ensure that "map_addr" is not out of
bounds before the start of the loop.  But the checking needs to be
done as we iterate through the loop because "map_addr" gets larger as
we iterate.

Fixes: 26f1fad2 ("New driver: rtl8xxxu (mac80211)")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NJes Sorensen <Jes.Sorensen@gmail.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/Yv8eGLdBslLAk3Ct@kili

Declare this to tell AP we can support beamformee over bandwidth 160M,
and then yield better performance in field.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220826061011.9037-3-pkshih@realtek.com

Writing address to kick hardware to initialize address CAM, and then poll
ready bit to determine completed. Old wrong code poll wrong register
address, so it can lead error and fail to bring up interface.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220826061011.9037-2-pkshih@realtek.com

Packets containing HTC field with legacy rate could be dropped by AP. If
TX rate of report is lower than MCS2, hardware might fall back rate to
legacy. Therefore, add a checking rule to avoid HTC field in this
situation.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220826061011.9037-1-pkshih@realtek.com

Number of TX resource must be minimum of TX_BD and TX_WD. Only considering
TX_BD could drop TX packets pulled from mac80211 if TX_WD is unavailable.

Fixes: 52edbb9f ("rtw89: ps: access TX/RX rings via another registers in low power mode")
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220824063312.15784-2-pkshih@realtek.com

We turn off interrupt in ISR, and re-enable interrupt in threadfn or
napi_poll according to the mode it stays. If we are turning off interrupt,
rtwpci->running flag is unset and interrupt handler stop processing even
if it was called, so disallow to re-enable interrupt in this situation.
Or, wifi chip doesn't trigger interrupt events anymore because interrupt
status (ISR) isn't clear by interrupt handler anymore.

Fixes: c83dcd05 ("rtw89: pci: add a separate interrupt handler for low power mode")
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220824063312.15784-1-pkshih@realtek.com

The calibration value of XTAL offset may be too large in some wifi
modules, that the CFO tracking mechanism under the existing tracking
boundary can not adjust the CFO to the tolerable range. So we enlarge it.
Signed-off-by: NCheng-Chieh Hsieh <cj.hsieh@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220824061425.13764-1-pkshih@realtek.com

We find that suspend/resume tests cause 8852CE lost, because some pci
registers are changed for 8852CE. So, correct them accordingly.
Signed-off-by: NChin-Yen Lee <timlee@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220819064811.37700-6-pkshih@realtek.com

8852CE controls CLKREQ, ASPM L1, L1ss via wifi registers
instead, so change them accordingly.
Signed-off-by: NChin-Yen Lee <timlee@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220819064811.37700-5-pkshih@realtek.com

There is chance that PCI PHY auto adaption fail. When first time boot up,
software restore the right adaption value and close PHY auto adaption
mechanism.
Signed-off-by: NChia-Yuan Li <leo.li@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220819064811.37700-4-pkshih@realtek.com

It is found that 8852ce loses some beacon after
enabling deep ps mode. We set TBTT shift to wake up
firmware early to open RF/BB for receiving beacon in time.
Signed-off-by: NChia-Yuan Li <leo.li@realtek.com>
Signed-off-by: NPo-Hao Huang <phhuang@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220819064811.37700-3-pkshih@realtek.com

When starting to send heavy traffic in low power mode,
driver will call multiple tx wake notify to wake firmware
within a short time. In this situation, firmware may miss
power mode change request from driver and leads to status
error. So we change driver to call power_mode_change at most
three times to make sure firmware could get the request.
Signed-off-by: NChin-Yen Lee <timlee@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220819064811.37700-2-pkshih@realtek.com

BA CAM entries are global resource of hardware, so move the bitmap and
instances to rtw89_cam_info, and then use link list from rtw89_sta to
these instances.

To check the allocation, add ba_cam to debugfs:

  map:
  	mac_id:    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  	addr_cam:  01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  	bssid_cam: 01 00 00 00 00 00 00 00
  	sec_cam:   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  	ba_cam:    03 00 00 00 00 00 00 00
  VIF [0] 94:08:53:8e:ef:21
  	bssid_cam_idx=0
  	addr_cam_idx=0
  	-> bssid_cam_idx=0
  	sec_cam_bitmap=00 00 00 00 00 00 00 00
  STA [0] 38:78:62:8b:cb:c6
  	addr_cam_idx=0
  	-> bssid_cam_idx=0
  	sec_cam_bitmap=00 00 00 00 00 00 00 00
  	ba_cam tid[6]=0, tid[1]=1
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220816013247.6243-4-pkshih@realtek.com

The bacam_v1 must do additional initialization, and H2C content of BA CAM
is also different. So, correct them accordingly.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220816013247.6243-3-pkshih@realtek.com

8852A has 2 BA CAM entries, but 8852C has 8 entries. Add a field to
discriminate their differences.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220816013247.6243-2-pkshih@realtek.com

TX power byrate:
	doesn't change

TX power limit:
	configure values for KCC and UK
	refine a bit configuration vales

TX power limit_ru:
	configure values for KCC and UK
	refine a bit configuration values
	change 6GHz to follow indoor setting
	configure 6GHz values for ETSI

TX power shape:
	change with TX power limit/limit_ru
Signed-off-by: NZong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220812093116.56791-4-pkshih@realtek.com

Update 8852c radio A/B parameters from internal HALRF_027_00_071 R49.
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220812093116.56791-3-pkshih@realtek.com

Some chips' RF TX power limit/limit_ru tables start to configure some
negative values. Fix the setting logic to prevent negative values from
polluting fields of others.
Signed-off-by: NZong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220812093116.56791-2-pkshih@realtek.com

Because RTL8852c firmware handshake use different structure definition
with RTL8852a, so it's necessary to update a version for RTL8852c.
Signed-off-by: NChing-Te Ku <ku920601@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220725023509.43114-10-pkshih@realtek.com

Because the later firmware had patched some new feature, it can control
the Wi-Fi/BT slots more efficiently. This patch enhance it for better
Wi-Fi SCC mode performance.
Signed-off-by: NChing-Te Ku <ku920601@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220725023509.43114-9-pkshih@realtek.com

Due to the difference of Wi-Fi firmware supported feature, RTL8852C
need to defined more policy to enable the features.
(Ex: DBCC, Wi-Fi multi-role, TDMA instant and so on)
Signed-off-by: NChing-Te Ku <ku920601@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220725023509.43114-8-pkshih@realtek.com

The H2C format and support feature are different. The newer Wi-Fi firmware
and driver branch need to handshake more information like DBCC or P2P
connection info.
Signed-off-by: NChing-Te Ku <ku920601@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220725023509.43114-7-pkshih@realtek.com

RTL8852C use a later version Wi-Fi firmware, there are some parameters
need to be defined. These new parameter can avoid some unexpected
TDMA mode while Wi-Fi enter/leave lps.
Signed-off-by: NChing-Te Ku <ku920601@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220725023509.43114-6-pkshih@realtek.com

It is for setting up BT slot max length at BT auto slot mechanism.
Signed-off-by: NChing-Te Ku <ku920601@realtek.com>
Signed-off-by: NPing-Ke Shih <pkshih@realtek.com>
Signed-off-by: NKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220725023509.43114-5-pkshih@realtek.com