[PATCH 00/13] cfg80211/mac80211 patches from our internal tree 2020-11-29

[PATCH 00/13] cfg80211/mac80211 patches from our internal tree 2020-11-29

[Luca Coelho]

From: Luca Coelho <luciano.coelho@intel.com>

Hi,

A bunch of patches with mac80211 and cfg80211 changes from our
internal tree.

Please review, though you have already reviewed most if not all of
them ;)

Cheers,
Luca.


Avraham Stern (2):
  nl80211: always accept scan request with the duration set
  ieee80211: update reduced neighbor report TBTT info length

Ayala Beker (1):
  cfg80211: scan PSC channels in case of scan with wildcard SSID

Borwankar, Antara (1):
  mac80211: set sdata state once vif is up after restart

Ilan Peer (4):
  cfg80211: Parse SAE H2E only membership selector
  mac80211: Skip entries with SAE H2E only membership selector
  cfg80211: Update TSF and TSF BSSID for multi BSS
  cfg80211: Save the regulatory domain when setting custom regulatory

Johannes Berg (3):
  mac80211: support MIC error/replay detected counters driver update
  mac80211: disallow band-switch during CSA
  cfg80211: include block-tx flag in channel switch started event

Sara Sharon (1):
  cfg80211: initialize rekey_data

Shaul Triebitz (1):
  mac80211: he: remove non-bss-conf fields from bss_conf

 include/linux/ieee80211.h    | 10 +++++---
 include/net/cfg80211.h       |  6 +++--
 include/net/mac80211.h       | 22 ++++++++++++++--
 include/uapi/linux/nl80211.h |  3 ++-
 net/mac80211/cfg.c           |  2 +-
 net/mac80211/iface.c         |  2 ++
 net/mac80211/key.c           | 49 ++++++++++++++++++++++++++++++++++++
 net/mac80211/mlme.c          | 35 +++++++++++++++-----------
 net/wireless/nl80211.c       | 27 ++++++++++----------
 net/wireless/reg.c           |  8 ++++++
 net/wireless/scan.c          | 21 ++++++++--------
 11 files changed, 137 insertions(+), 48 deletions(-)

-- 
2.29.2

[PATCH 01/13] mac80211: he: remove non-bss-conf fields from bss_conf

[Luca Coelho]

From: Shaul Triebitz <shaul.triebitz@intel.com>

ack_enabled and multi_sta_back_32bit are station capabilities
and should not be in the bss_conf structure.

Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 include/net/mac80211.h | 2 --
 net/mac80211/mlme.c    | 8 --------
 2 files changed, 10 deletions(-)

diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 05c7524bab26..1328b7166460 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -635,9 +635,7 @@ struct ieee80211_fils_discovery {
 struct ieee80211_bss_conf {
 	const u8 *bssid;
 	u8 htc_trig_based_pkt_ext;
-	bool multi_sta_back_32bit;
 	bool uora_exists;
-	bool ack_enabled;
 	u8 uora_ocw_range;
 	u16 frame_time_rts_th;
 	bool he_support;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6adfcb9c06dc..b0afb61d9e84 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3494,14 +3494,6 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 			le32_get_bits(elems->he_operation->he_oper_params,
 			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
 
-		bss_conf->multi_sta_back_32bit =
-			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
-			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;
-
-		bss_conf->ack_enabled =
-			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
-			IEEE80211_HE_MAC_CAP2_ACK_EN;
-
 		bss_conf->uora_exists = !!elems->uora_element;
 		if (elems->uora_element)
 			bss_conf->uora_ocw_range = elems->uora_element[0];
-- 
2.29.2

[PATCH 02/13] cfg80211: initialize rekey_data

[Luca Coelho]

From: Sara Sharon <sara.sharon@intel.com>

In case we have old supplicant, the akm field is uninitialized.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/wireless/nl80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 8811a4b69f21..cf37cea1ff42 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -12644,7 +12644,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
 	struct net_device *dev = info->user_ptr[1];
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
-	struct cfg80211_gtk_rekey_data rekey_data;
+	struct cfg80211_gtk_rekey_data rekey_data = {};
 	int err;
 
 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
-- 
2.29.2

[PATCH 03/13] mac80211: support MIC error/replay detected counters driver update

[Luca Coelho]

From: Johannes Berg <johannes.berg@intel.com>

Support the driver incrementing MIC error and replay detected
counters when having detected a bad frame, if it drops it directly
instead of relying on mac80211 to do the checks.

These are then exposed to userspace, though currently only in some
cases and in debugfs.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 include/net/mac80211.h | 20 +++++++++++++++++
 net/mac80211/key.c     | 49 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)

diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 1328b7166460..2d01280c0564 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -5321,6 +5321,26 @@ ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
 void ieee80211_gtk_rekey_notify(struct ieee80211_vif *vif, const u8 *bssid,
 				const u8 *replay_ctr, gfp_t gfp);
 
+/**
+ * ieee80211_key_mic_failure - increment MIC failure counter for the key
+ *
+ * Note: this is really only safe if no other RX function is called
+ * at the same time.
+ *
+ * @keyconf: the key in question
+ */
+void ieee80211_key_mic_failure(struct ieee80211_key_conf *keyconf);
+
+/**
+ * ieee80211_key_replay - increment replay counter for the key
+ *
+ * Note: this is really only safe if no other RX function is called
+ * at the same time.
+ *
+ * @keyconf: the key in question
+ */
+void ieee80211_key_replay(struct ieee80211_key_conf *keyconf);
+
 /**
  * ieee80211_wake_queue - wake specific queue
  * @hw: pointer as obtained from ieee80211_alloc_hw().
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 8c5f829ff6d7..a4817aa4b171 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -1300,3 +1300,52 @@ ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
 	return &key->conf;
 }
 EXPORT_SYMBOL_GPL(ieee80211_gtk_rekey_add);
+
+void ieee80211_key_mic_failure(struct ieee80211_key_conf *keyconf)
+{
+	struct ieee80211_key *key;
+
+	key = container_of(keyconf, struct ieee80211_key, conf);
+
+	switch (key->conf.cipher) {
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
+		key->u.aes_cmac.icverrors++;
+		break;
+	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
+	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
+		key->u.aes_gmac.icverrors++;
+		break;
+	default:
+		/* ignore the others for now, we don't keep counters now */
+		break;
+	}
+}
+EXPORT_SYMBOL_GPL(ieee80211_key_mic_failure);
+
+void ieee80211_key_replay(struct ieee80211_key_conf *keyconf)
+{
+	struct ieee80211_key *key;
+
+	key = container_of(keyconf, struct ieee80211_key, conf);
+
+	switch (key->conf.cipher) {
+	case WLAN_CIPHER_SUITE_CCMP:
+	case WLAN_CIPHER_SUITE_CCMP_256:
+		key->u.ccmp.replays++;
+		break;
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
+		key->u.aes_cmac.replays++;
+		break;
+	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
+	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
+		key->u.aes_gmac.replays++;
+		break;
+	case WLAN_CIPHER_SUITE_GCMP:
+	case WLAN_CIPHER_SUITE_GCMP_256:
+		key->u.gcmp.replays++;
+		break;
+	}
+}
+EXPORT_SYMBOL_GPL(ieee80211_key_replay);
-- 
2.29.2

[PATCH 04/13] cfg80211: Parse SAE H2E only membership selector

[Luca Coelho]

From: Ilan Peer <ilan.peer@intel.com>

This extends the support for drivers that rebuild IEs in the
FW (same as with HT/VHT/HE).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 include/linux/ieee80211.h | 2 ++
 include/net/cfg80211.h    | 3 ++-
 net/wireless/nl80211.c    | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 5e8cc9c3d45a..9b99a5afe097 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1261,6 +1261,8 @@ struct ieee80211_mgmt {
 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY	127
 #define BSS_MEMBERSHIP_SELECTOR_VHT_PHY	126
 #define BSS_MEMBERSHIP_SELECTOR_HE_PHY	122
+#define BSS_MEMBERSHIP_SELECTOR_SAE_H2E 123
+
 
 /* mgmt header + 1 byte category code */
 #define IEEE80211_MIN_ACTION_SIZE offsetof(struct ieee80211_mgmt, u.action.u)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index ab249ca5d5d1..4a5ae7fb7d59 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1186,6 +1186,7 @@ enum cfg80211_ap_settings_flags {
  * @vht_required: stations must support VHT
  * @twt_responder: Enable Target Wait Time
  * @he_required: stations must support HE
+ * @sae_h2e_required: stations must support direct H2E technique in SAE
  * @flags: flags, as defined in enum cfg80211_ap_settings_flags
  * @he_obss_pd: OBSS Packet Detection settings
  * @he_bss_color: BSS Color settings
@@ -1217,7 +1218,7 @@ struct cfg80211_ap_settings {
 	const struct ieee80211_vht_cap *vht_cap;
 	const struct ieee80211_he_cap_elem *he_cap;
 	const struct ieee80211_he_operation *he_oper;
-	bool ht_required, vht_required, he_required;
+	bool ht_required, vht_required, he_required, sae_h2e_required;
 	bool twt_responder;
 	u32 flags;
 	struct ieee80211_he_obss_pd he_obss_pd;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cf37cea1ff42..643000200a1b 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5017,6 +5017,8 @@ static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
 			params->vht_required = true;
 		if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
 			params->he_required = true;
+		if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
+			params->sae_h2e_required = true;
 	}
 }
 
-- 
2.29.2

[PATCH 05/13] mac80211: Skip entries with SAE H2E only membership selector

[Luca Coelho]

From: Ilan Peer <ilan.peer@intel.com>

When parsing supported rates IE.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/mac80211/mlme.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index b0afb61d9e84..6de63ba6b1c8 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3199,8 +3199,8 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
 			*have_higher_than_11mbit = true;
 
 		/*
-		 * Skip HT, VHT and HE BSS membership selectors since they're
-		 * not rates.
+		 * Skip HT, VHT, HE and SAE H2E only BSS membership selectors
+		 * since they're not rates.
 		 *
 		 * Note: Even though the membership selector and the basic
 		 *	 rate flag share the same bit, they are not exactly
@@ -3208,7 +3208,8 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
 		 */
 		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
 		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
-		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY))
+		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY) ||
+		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_SAE_H2E))
 			continue;
 
 		for (j = 0; j < sband->n_bitrates; j++) {
-- 
2.29.2

[PATCH 06/13] cfg80211: scan PSC channels in case of scan with wildcard SSID

[Luca Coelho]

From: Ayala Beker <ayala.beker@intel.com>

In case of scan request with wildcard SSID, or in case of more
than one SSID in scan request, need to scan PSC channels even though
all the co-located APs found during the legacy bands scan indicated
that all the APs in their ESS are co-located, as we might find different
networks on the PSC channels.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/wireless/scan.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 3409f37d838b..5f92d85acf45 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -726,7 +726,7 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
 	int n_channels, count = 0, err;
 	struct cfg80211_scan_request *request, *rdev_req = rdev->scan_req;
 	LIST_HEAD(coloc_ap_list);
-	bool need_scan_psc;
+	bool need_scan_psc = true;
 	const struct ieee80211_sband_iftype_data *iftd;
 
 	rdev_req->scan_6ghz = true;
@@ -770,20 +770,18 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
 		(void *)&request->channels[n_channels];
 
 	/*
-	 * PSC channels should not be scanned if all the reported co-located APs
-	 * are indicating that all APs in the same ESS are co-located
+	 * PSC channels should not be scanned in case of direct scan with 1 SSID
+	 * and at least one of the reported co-located APs with same SSID
+	 * indicating that all APs in the same ESS are co-located
 	 */
-	if (count) {
-		need_scan_psc = false;
-
+	if (count && request->n_ssids == 1 && request->ssids[0].ssid_len) {
 		list_for_each_entry(ap, &coloc_ap_list, list) {
-			if (!ap->colocated_ess) {
-				need_scan_psc = true;
+			if (ap->colocated_ess &&
+			    cfg80211_find_ssid_match(ap, request)) {
+				need_scan_psc = false;
 				break;
 			}
 		}
-	} else {
-		need_scan_psc = true;
 	}
 
 	/*
-- 
2.29.2

[PATCH 07/13] cfg80211: Update TSF and TSF BSSID for multi BSS

[Luca Coelho]

From: Ilan Peer <ilan.peer@intel.com>

When a new BSS entry is created based on multi BSS IE, the
TSF and the TSF BSSID were not updated. Fix it.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/wireless/scan.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 5f92d85acf45..1b7fec3b53cd 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1899,6 +1899,9 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
 	tmp.pub.beacon_interval = beacon_interval;
 	tmp.pub.capability = capability;
 	tmp.ts_boottime = data->boottime_ns;
+	tmp.parent_tsf = data->parent_tsf;
+	ether_addr_copy(tmp.parent_bssid, data->parent_bssid);
+
 	if (non_tx_data) {
 		tmp.pub.transmitted_bss = non_tx_data->tx_bss;
 		ts = bss_from_pub(non_tx_data->tx_bss)->ts;
-- 
2.29.2

[PATCH 08/13] nl80211: always accept scan request with the duration set

[Luca Coelho]

From: Avraham Stern <avraham.stern@intel.com>

Accept a scan request with the duration set even if the driver
does not support setting the scan dwell. The duration can be used
as a hint to the driver, but the driver may use its internal logic
for setting the scan dwell.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/wireless/nl80211.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 643000200a1b..67c52f4b45fa 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -8243,12 +8243,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 	}
 
 	if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
-		if (!wiphy_ext_feature_isset(wiphy,
-					NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
-			err = -EOPNOTSUPP;
-			goto out_free;
-		}
-
 		request->duration =
 			nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
 		request->duration_mandatory =
-- 
2.29.2

[PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Luca Coelho]

From: Ilan Peer <ilan.peer@intel.com>

When custom regulatory was set, only the channels setting was updated, but
the regulatory domain was not saved. Fix it by saving it.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/wireless/reg.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index a04fdfb35f07..094492b62f8a 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2547,6 +2547,7 @@ static void handle_band_custom(struct wiphy *wiphy,
 void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
 				   const struct ieee80211_regdomain *regd)
 {
+	const struct ieee80211_regdomain *new_regd, *tmp;
 	enum nl80211_band band;
 	unsigned int bands_set = 0;
 
@@ -2566,6 +2567,13 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
 	 * on your device's supported bands.
 	 */
 	WARN_ON(!bands_set);
+	new_regd = reg_copy_regd(regd);
+	if (IS_ERR(new_regd))
+		return;
+
+	tmp = get_wiphy_regdom(wiphy);
+	rcu_assign_pointer(wiphy->regd, new_regd);
+	rcu_free_regdom(tmp);
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
-- 
2.29.2

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Marek Szyprowski]

Hi Luca,

On 29.11.2020 16:30, Luca Coelho wrote:
> From: Ilan Peer <ilan.peer@intel.com>
>
> When custom regulatory was set, only the channels setting was updated, but
> the regulatory domain was not saved. Fix it by saving it.
>
> Signed-off-by: Ilan Peer <ilan.peer@intel.com>
> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

This patch landed recently in linux-next as commit beee24695157 
("cfg80211: Save the regulatory domain when setting custom regulatory"). 
It triggers the following warning on all boards I have, which use 
Broadcom chips. Here is an example from Raspberry Pi4:

cfg80211: Loading compiled-in X.509 certificates for regulatory database
cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
cfg80211: loaded regulatory.db is malformed or signature is missing/invalid
brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip 
BCM4345/6
brcmfmac mmc1:0001:1: Direct firmware load for 
brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt failed with error -2
brcmfmac mmc1:0001:1: Falling back to sysfs fallback for: 
brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt
brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip 
BCM4345/6
brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-11), 
device may have limited channels available
brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Mar  1 2015 
07:29:38 version 7.45.18 (r538002) FWID 01-6a2c8ad4
Bluetooth: hci0: BCM: chip id 107
Bluetooth: hci0: BCM: features 0x2f
Bluetooth: hci0: BCM4345C0
Bluetooth: hci0: BCM4345C0 (003.001.025) build 0000
Bluetooth: hci0: BCM4345C0 'brcm/BCM4345C0.hcd' Patch

=============================
WARNING: suspicious RCU usage
5.10.0-next-20201215+ #9962 Not tainted
-----------------------------
net/wireless/reg.c:144 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
2 locks held by kworker/1:1/32:
  #0: ffff000003405738 ((wq_completion)events){+.+.}-{0:0}, at: 
process_one_work+0x200/0x728
  #1: ffff80001321bdc0 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, 
at: process_one_work+0x200/0x728

stack backtrace:
CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.10.0-next-20201215+ #9962
Hardware name: Raspberry Pi 4 Model B (DT)
Workqueue: events request_firmware_work_func
Call trace:
  dump_backtrace+0x0/0x1d0
  show_stack+0x14/0x60
  dump_stack+0xf4/0x15c
  lockdep_rcu_suspicious+0xd4/0xf8
  get_wiphy_regdom+0x6c/0x70 [cfg80211]
  wiphy_apply_custom_regulatory+0x80/0xc8 [cfg80211]
  brcmf_cfg80211_attach+0xb44/0x1330 [brcmfmac]
  brcmf_attach+0x174/0x4b8 [brcmfmac]
  brcmf_sdio_firmware_callback+0x670/0x7c8 [brcmfmac]
  brcmf_fw_request_done+0x7c/0x100 [brcmfmac]
  request_firmware_work_func+0x4c/0xd8
  process_one_work+0x2a8/0x728
  worker_thread+0x48/0x460
  kthread+0x134/0x160
  ret_from_fork+0x10/0x18

Reverting this patch on top of linux next-20201215 hides this issue.

I compiled kernel for arm64 with defconfig with some additional options 
(I left only those that might be relevant to this issue):

./scripts/config --set-val CMA_SIZE_MBYTES 96 -e PROVE_LOCKING -e 
DEBUG_ATOMIC_SLEEP -e COMPILE_TEST -e PM_DEBUG -e PM_ADVANCED_DEBUG -e 
CONFIG_BRCMFMAC_PCIE

Best regards

-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Luca Coelho]

On Wed, 2020-12-16 at 11:20 +0100, Marek Szyprowski wrote:
> Hi Luca,

Hi Marek,


> On 29.11.2020 16:30, Luca Coelho wrote:
> > From: Ilan Peer <ilan.peer@intel.com>
> > 
> > When custom regulatory was set, only the channels setting was updated, but
> > the regulatory domain was not saved. Fix it by saving it.
> > 
> > Signed-off-by: Ilan Peer <ilan.peer@intel.com>
> > Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
> 
> This patch landed recently in linux-next as commit beee24695157 
> ("cfg80211: Save the regulatory domain when setting custom regulatory"). 
> It triggers the following warning on all boards I have, which use 
> Broadcom chips. Here is an example from Raspberry Pi4:
> 
> cfg80211: Loading compiled-in X.509 certificates for regulatory database
> cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
> cfg80211: loaded regulatory.db is malformed or signature is missing/invalid
> brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip 
> BCM4345/6
> brcmfmac mmc1:0001:1: Direct firmware load for 
> brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt failed with error -2
> brcmfmac mmc1:0001:1: Falling back to sysfs fallback for: 
> brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt
> brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip 
> BCM4345/6
> brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-11), 
> device may have limited channels available
> brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Mar  1 2015 
> 07:29:38 version 7.45.18 (r538002) FWID 01-6a2c8ad4
> Bluetooth: hci0: BCM: chip id 107
> Bluetooth: hci0: BCM: features 0x2f
> Bluetooth: hci0: BCM4345C0
> Bluetooth: hci0: BCM4345C0 (003.001.025) build 0000
> Bluetooth: hci0: BCM4345C0 'brcm/BCM4345C0.hcd' Patch
> 
> =============================
> WARNING: suspicious RCU usage
> 5.10.0-next-20201215+ #9962 Not tainted
> -----------------------------
> net/wireless/reg.c:144 suspicious rcu_dereference_check() usage!
> 
> other info that might help us debug this:
> 
> 
> rcu_scheduler_active = 2, debug_locks = 1
> 2 locks held by kworker/1:1/32:
>   #0: ffff000003405738 ((wq_completion)events){+.+.}-{0:0}, at: 
> process_one_work+0x200/0x728
>   #1: ffff80001321bdc0 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, 
> at: process_one_work+0x200/0x728
> 
> stack backtrace:
> CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.10.0-next-20201215+ #9962
> Hardware name: Raspberry Pi 4 Model B (DT)
> Workqueue: events request_firmware_work_func
> Call trace:
>   dump_backtrace+0x0/0x1d0
>   show_stack+0x14/0x60
>   dump_stack+0xf4/0x15c
>   lockdep_rcu_suspicious+0xd4/0xf8
>   get_wiphy_regdom+0x6c/0x70 [cfg80211]
>   wiphy_apply_custom_regulatory+0x80/0xc8 [cfg80211]
>   brcmf_cfg80211_attach+0xb44/0x1330 [brcmfmac]
>   brcmf_attach+0x174/0x4b8 [brcmfmac]
>   brcmf_sdio_firmware_callback+0x670/0x7c8 [brcmfmac]
>   brcmf_fw_request_done+0x7c/0x100 [brcmfmac]
>   request_firmware_work_func+0x4c/0xd8
>   process_one_work+0x2a8/0x728
>   worker_thread+0x48/0x460
>   kthread+0x134/0x160
>   ret_from_fork+0x10/0x18
> 
> Reverting this patch on top of linux next-20201215 hides this issue.

This is indeed an issue.  Now syzbot also reported it.  We currently
have an issue with our test machinery that is not enabling lockdep and
other lock checks...

We'll fix this asap.

--
Cheers,
Luca.

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Nicolas Cavallari]

On 29/11/2020 16:30, Luca Coelho wrote:
> From: Ilan Peer <ilan.peer@intel.com>
> 
> When custom regulatory was set, only the channels setting was updated, but
> the regulatory domain was not saved. Fix it by saving it.
> 
> Signed-off-by: Ilan Peer <ilan.peer@intel.com>
> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
> ---
>   net/wireless/reg.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/net/wireless/reg.c b/net/wireless/reg.c
> index a04fdfb35f07..094492b62f8a 100644
> --- a/net/wireless/reg.c
> +++ b/net/wireless/reg.c
> @@ -2547,6 +2547,7 @@ static void handle_band_custom(struct wiphy *wiphy,
>   void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
>   				   const struct ieee80211_regdomain *regd)
>   {
> +	const struct ieee80211_regdomain *new_regd, *tmp;
>   	enum nl80211_band band;
>   	unsigned int bands_set = 0;
>   
> @@ -2566,6 +2567,13 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
>   	 * on your device's supported bands.
>   	 */
>   	WARN_ON(!bands_set);
> +	new_regd = reg_copy_regd(regd);
> +	if (IS_ERR(new_regd))
> +		return;
> +
> +	tmp = get_wiphy_regdom(wiphy);
> +	rcu_assign_pointer(wiphy->regd, new_regd);
> +	rcu_free_regdom(tmp);
>   }
>   EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
>   
> 

Hello,

This patch somehow appears to break ath9k's eeprom hints and restrict it to the 
world regulatory domain on v5.12.10.

ath9k calls wiphy_apply_custom_regulatory() with its own kind of world 
regulatory domain, before it decodes hints from the eeprom and uses 
regulatory_hint() to request a specific alpha2.

With this patch, applying the hint fails because wiphy->regd is already set.
If i revert this patch, ath9k works again.

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Kalle Valo]

Nicolas Cavallari <Nicolas.Cavallari@green-communications.fr> writes:

> On 29/11/2020 16:30, Luca Coelho wrote:
>> From: Ilan Peer <ilan.peer@intel.com>
>>
>> When custom regulatory was set, only the channels setting was updated, but
>> the regulatory domain was not saved. Fix it by saving it.
>>
>> Signed-off-by: Ilan Peer <ilan.peer@intel.com>
>> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
>> ---
>>   net/wireless/reg.c | 8 ++++++++
>>   1 file changed, 8 insertions(+)
>>
>> diff --git a/net/wireless/reg.c b/net/wireless/reg.c
>> index a04fdfb35f07..094492b62f8a 100644
>> --- a/net/wireless/reg.c
>> +++ b/net/wireless/reg.c
>> @@ -2547,6 +2547,7 @@ static void handle_band_custom(struct wiphy *wiphy,
>>   void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
>>   				   const struct ieee80211_regdomain *regd)
>>   {
>> +	const struct ieee80211_regdomain *new_regd, *tmp;
>>   	enum nl80211_band band;
>>   	unsigned int bands_set = 0;
>>   @@ -2566,6 +2567,13 @@ void wiphy_apply_custom_regulatory(struct
>> wiphy *wiphy,
>>   	 * on your device's supported bands.
>>   	 */
>>   	WARN_ON(!bands_set);
>> +	new_regd = reg_copy_regd(regd);
>> +	if (IS_ERR(new_regd))
>> +		return;
>> +
>> +	tmp = get_wiphy_regdom(wiphy);
>> +	rcu_assign_pointer(wiphy->regd, new_regd);
>> +	rcu_free_regdom(tmp);
>>   }
>>   EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
>>   
>>
>
> Hello,
>
> This patch somehow appears to break ath9k's eeprom hints and restrict
> it to the world regulatory domain on v5.12.10.
>
> ath9k calls wiphy_apply_custom_regulatory() with its own kind of world
> regulatory domain, before it decodes hints from the eeprom and uses
> regulatory_hint() to request a specific alpha2.
>
> With this patch, applying the hint fails because wiphy->regd is already set.
> If i revert this patch, ath9k works again.

I have lost track, is this regression fixed now or is it sill
unresolved?

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Nicolas Cavallari]

On 11/10/2021 12:51, Kalle Valo wrote:
> Nicolas Cavallari <Nicolas.Cavallari@green-communications.fr> writes:
> 
>> On 29/11/2020 16:30, Luca Coelho wrote:
>>> From: Ilan Peer <ilan.peer@intel.com>
>>>
>>> When custom regulatory was set, only the channels setting was updated, but
>>> the regulatory domain was not saved. Fix it by saving it.
>>>
>>> Signed-off-by: Ilan Peer <ilan.peer@intel.com>
>>> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
>>> ---
>>>    net/wireless/reg.c | 8 ++++++++
>>>    1 file changed, 8 insertions(+)
>>>
>>> diff --git a/net/wireless/reg.c b/net/wireless/reg.c
>>> index a04fdfb35f07..094492b62f8a 100644
>>> --- a/net/wireless/reg.c
>>> +++ b/net/wireless/reg.c
>>> @@ -2547,6 +2547,7 @@ static void handle_band_custom(struct wiphy *wiphy,
>>>    void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
>>>    				   const struct ieee80211_regdomain *regd)
>>>    {
>>> +	const struct ieee80211_regdomain *new_regd, *tmp;
>>>    	enum nl80211_band band;
>>>    	unsigned int bands_set = 0;
>>>    @@ -2566,6 +2567,13 @@ void wiphy_apply_custom_regulatory(struct
>>> wiphy *wiphy,
>>>    	 * on your device's supported bands.
>>>    	 */
>>>    	WARN_ON(!bands_set);
>>> +	new_regd = reg_copy_regd(regd);
>>> +	if (IS_ERR(new_regd))
>>> +		return;
>>> +
>>> +	tmp = get_wiphy_regdom(wiphy);
>>> +	rcu_assign_pointer(wiphy->regd, new_regd);
>>> +	rcu_free_regdom(tmp);
>>>    }
>>>    EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
>>>    
>>>
>>
>> Hello,
>>
>> This patch somehow appears to break ath9k's eeprom hints and restrict
>> it to the world regulatory domain on v5.12.10.
>>
>> ath9k calls wiphy_apply_custom_regulatory() with its own kind of world
>> regulatory domain, before it decodes hints from the eeprom and uses
>> regulatory_hint() to request a specific alpha2.
>>
>> With this patch, applying the hint fails because wiphy->regd is already set.
>> If i revert this patch, ath9k works again.
> 
> I have lost track, is this regression fixed now or is it sill
> unresolved?

I admit i forgot about it after reverting the patch and haven't tried a new 
kernel with ath9k since then, but from a quick glance, the code hasn't changed. 
I'll try a new kernel tomorrow.

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Nicolas Cavallari]

On 11/10/2021 12:51, Kalle Valo wrote:
> Nicolas Cavallari <Nicolas.Cavallari@green-communications.fr> writes:
> 
>> On 29/11/2020 16:30, Luca Coelho wrote:
>>> From: Ilan Peer <ilan.peer@intel.com>
>>>
>>> When custom regulatory was set, only the channels setting was updated, but
>>> the regulatory domain was not saved. Fix it by saving it.
>>>
>>> Signed-off-by: Ilan Peer <ilan.peer@intel.com>
>>> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
>>> ---
>>>    net/wireless/reg.c | 8 ++++++++
>>>    1 file changed, 8 insertions(+)
>>>
>>> diff --git a/net/wireless/reg.c b/net/wireless/reg.c
>>> index a04fdfb35f07..094492b62f8a 100644
>>> --- a/net/wireless/reg.c
>>> +++ b/net/wireless/reg.c
>>> @@ -2547,6 +2547,7 @@ static void handle_band_custom(struct wiphy *wiphy,
>>>    void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
>>>    				   const struct ieee80211_regdomain *regd)
>>>    {
>>> +	const struct ieee80211_regdomain *new_regd, *tmp;
>>>    	enum nl80211_band band;
>>>    	unsigned int bands_set = 0;
>>>    @@ -2566,6 +2567,13 @@ void wiphy_apply_custom_regulatory(struct
>>> wiphy *wiphy,
>>>    	 * on your device's supported bands.
>>>    	 */
>>>    	WARN_ON(!bands_set);
>>> +	new_regd = reg_copy_regd(regd);
>>> +	if (IS_ERR(new_regd))
>>> +		return;
>>> +
>>> +	tmp = get_wiphy_regdom(wiphy);
>>> +	rcu_assign_pointer(wiphy->regd, new_regd);
>>> +	rcu_free_regdom(tmp);
>>>    }
>>>    EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
>>>    
>>>
>>
>> Hello,
>>
>> This patch somehow appears to break ath9k's eeprom hints and restrict
>> it to the world regulatory domain on v5.12.10.
>>
>> ath9k calls wiphy_apply_custom_regulatory() with its own kind of world
>> regulatory domain, before it decodes hints from the eeprom and uses
>> regulatory_hint() to request a specific alpha2.
>>
>> With this patch, applying the hint fails because wiphy->regd is already set.
>> If i revert this patch, ath9k works again.
> 
> I have lost track, is this regression fixed now or is it sill
> unresolved?
> 

It appears to be still unresolved on 5.14.11 :

ath: EEPROM regdomain: 0x80fa
ath: EEPROM indicates we should expect a country code
ath: doing EEPROM country->regdmn map search
ath: country maps to regdmn code: 0x37
ath: Country alpha2 being used: FR
ath: Regpair used: 0x37

yet,

$ iw reg get
global
country 00: DFS-UNSET
         (2402 - 2472 @ 40), (N/A, 20), (N/A)
         (2457 - 2482 @ 20), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
         (2474 - 2494 @ 20), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
         (5170 - 5250 @ 80), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN
         (5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW, PASSIVE-SCAN
         (5490 - 5730 @ 160), (N/A, 20), (0 ms), DFS, PASSIVE-SCAN
         (5735 - 5835 @ 80), (N/A, 20), (N/A), PASSIVE-SCAN
         (57240 - 63720 @ 2160), (N/A, 0), (N/A)

phy#1
country 99: DFS-UNSET
         (2402 - 2472 @ 40), (N/A, 20), (N/A)
         (5140 - 5360 @ 80), (N/A, 30), (N/A), PASSIVE-SCAN
         (5715 - 5860 @ 80), (N/A, 30), (N/A), PASSIVE-SCAN

If i revert this patch, i get this instead:

global
country FR: DFS-ETSI
         (2400 - 2483 @ 40), (N/A, 20), (N/A)
         (5150 - 5250 @ 80), (N/A, 23), (N/A), NO-OUTDOOR, AUTO-BW
         (5250 - 5350 @ 80), (N/A, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW
         (5470 - 5725 @ 160), (N/A, 26), (0 ms), DFS
         (5725 - 5875 @ 80), (N/A, 13), (N/A)
         (57000 - 66000 @ 2160), (N/A, 40), (N/A)

phy#2
country FR: DFS-ETSI
         (2400 - 2483 @ 40), (N/A, 20), (N/A)
         (5150 - 5250 @ 80), (N/A, 23), (N/A), NO-OUTDOOR, AUTO-BW
         (5250 - 5350 @ 80), (N/A, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW
         (5470 - 5725 @ 160), (N/A, 26), (0 ms), DFS
         (5725 - 5875 @ 80), (N/A, 13), (N/A)
         (57000 - 66000 @ 2160), (N/A, 40), (N/A)

I'm not familiar with the regd code, but looking at where ath9k calls 
wiphy_apply_custom_regulatory in ath_regd_init_wiphy() 
(drivers/net/wireless/ath/regd.c):

           wiphy->regulatory_flags |= REGULATORY_STRICT_REG |
                                      REGULATORY_CUSTOM_REG;

           if (ath_is_world_regd(reg)) {
                   /*
                    * Anything applied here (prior to wiphy registration) gets
                    * saved on the wiphy orig_* parameters
                    */
                   regd = ath_world_regdomain(reg);
                   wiphy->regulatory_flags |= REGULATORY_COUNTRY_IE_FOLLOW_POWER;
           } else {
                   /*
                    * This gets applied in the case of the absence of CRDA,
                    * it's our own custom world regulatory domain, similar to
                    * cfg80211's but we enable passive scanning.
                    */
                   regd = ath_default_world_regdomain();
           }

           wiphy_apply_custom_regulatory(wiphy, regd);

Probably not calling wiphy_apply_custom_regulatory() in the non-world-regd case 
would solve the problem ? i'm not sure if the comment is still valid.

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Johannes Berg]

On Tue, 2021-10-12 at 12:24 +0200, Nicolas Cavallari wrote:
> > > 
> > > This patch somehow appears to break ath9k's eeprom hints and restrict
> > > it to the world regulatory domain on v5.12.10.
> > > 
> > > ath9k calls wiphy_apply_custom_regulatory() with its own kind of world
> > > regulatory domain, before it decodes hints from the eeprom and uses
> > > regulatory_hint() to request a specific alpha2.
> > > 
> > > With this patch, applying the hint fails because wiphy->regd is already set.
> > > If i revert this patch, ath9k works again.
> > 

Hm. It stands to reason that perhaps ath9k should call
wiphy_apply_custom_regulatory(NULL) (if that's possible) to reset the
knowledge of having a custom regulatory domain, before requesting the
correct one be applied by cfg80211 (and possibly even crda userspace).

I can't really say that I think the patch itself is wrong, even if it
caused this problem.

johannes

Re: [PATCH 09/13] cfg80211: Save the regulatory domain when setting custom regulatory

[Nicolas Cavallari]

On 03/02/2022 23:30, Johannes Berg wrote:
> On Tue, 2021-10-12 at 12:24 +0200, Nicolas Cavallari wrote:
>>>>
>>>> This patch somehow appears to break ath9k's eeprom hints and restrict
>>>> it to the world regulatory domain on v5.12.10.
>>>>
>>>> ath9k calls wiphy_apply_custom_regulatory() with its own kind of world
>>>> regulatory domain, before it decodes hints from the eeprom and uses
>>>> regulatory_hint() to request a specific alpha2.
>>>>
>>>> With this patch, applying the hint fails because wiphy->regd is already set.
>>>> If i revert this patch, ath9k works again.
>>>
> 
> Hm. It stands to reason that perhaps ath9k should call
> wiphy_apply_custom_regulatory(NULL) (if that's possible) to reset the
> knowledge of having a custom regulatory domain, before requesting the
> correct one be applied by cfg80211 (and possibly even crda userspace).

wiphy_apply_custom_regulatory(NULL) is apparently not possible.
The regulatory code is still a black box to me...

[PATCH 10/13] ieee80211: update reduced neighbor report TBTT info length

[Luca Coelho]

From: Avraham Stern <avraham.stern@intel.com>

A new field (20MHz PSD - 1 byte) was added to the RNR TBTT info field.
Adjust the expected TBTT info length accordingly.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 include/linux/ieee80211.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 9b99a5afe097..37b7dde6173d 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -3837,15 +3837,15 @@ static inline bool for_each_element_completed(const struct element *element,
 #define WLAN_RSNX_CAPA_SAE_H2E BIT(5)
 
 /*
- * reduced neighbor report, based on Draft P802.11ax_D5.0,
- * section 9.4.2.170
+ * reduced neighbor report, based on Draft P802.11ax_D6.1,
+ * section 9.4.2.170 and accepted contributions.
  */
 #define IEEE80211_AP_INFO_TBTT_HDR_TYPE				0x03
 #define IEEE80211_AP_INFO_TBTT_HDR_FILTERED			0x04
 #define IEEE80211_AP_INFO_TBTT_HDR_COLOC			0x08
 #define IEEE80211_AP_INFO_TBTT_HDR_COUNT			0xF0
-#define IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM		8
-#define IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM	12
+#define IEEE80211_TBTT_INFO_OFFSET_BSSID_BSS_PARAM		9
+#define IEEE80211_TBTT_INFO_OFFSET_BSSID_SSSID_BSS_PARAM	13
 
 #define IEEE80211_RNR_TBTT_PARAMS_OCT_RECOMMENDED		0x01
 #define IEEE80211_RNR_TBTT_PARAMS_SAME_SSID			0x02
-- 
2.29.2

[PATCH 11/13] mac80211: set sdata state once vif is up after restart

[Luca Coelho]

From: "Borwankar, Antara" <antara.borwankar@intel.com>

On FW recovery mac80211 is supposed to reconfigure the driver.
In the scanario when vif is of monitor type, after FW assert the vif
was getting added and channel context was getting created but this
channel context was not getting assigned to the vif.

This was fixed by setting the monitor sdata state bit to running once
the vif is up and running after the virtual monitor is added.

Signed-off-by: Borwankar, Antara <antara.borwankar@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/mac80211/iface.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index f5d4ceb72882..3b9ec4ef81c3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -940,6 +940,8 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 		return ret;
 	}
 
+	set_bit(SDATA_STATE_RUNNING, &sdata->state);
+
 	ret = ieee80211_check_queues(sdata, NL80211_IFTYPE_MONITOR);
 	if (ret) {
 		kfree(sdata);
-- 
2.29.2

[PATCH 12/13] mac80211: disallow band-switch during CSA

[Luca Coelho]

From: Johannes Berg <johannes.berg@intel.com>

If the AP advertises a band switch during CSA, we will not have
the right information to continue working with it, since it will
likely (have to) change its capabilities and we don't track any
capability changes at all. Additionally, we store e.g. supported
rates per band, and that information would become invalid.

Since this is a fringe scenario, just disconnect explicitly.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 net/mac80211/mlme.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6de63ba6b1c8..67829667d394 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1417,6 +1417,17 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 		return;
 	}
 
+	if (sdata->vif.bss_conf.chandef.chan->band !=
+	    csa_ie.chandef.chan->band) {
+		sdata_info(sdata,
+			   "AP %pM switches to different band (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
+			   ifmgd->associated->bssid,
+			   csa_ie.chandef.chan->center_freq,
+			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
+			   csa_ie.chandef.center_freq2);
+		goto lock_and_drop_connection;
+	}
+
 	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
 				     IEEE80211_CHAN_DISABLED)) {
 		sdata_info(sdata,
@@ -1429,9 +1440,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
 			   csa_ie.chandef.freq1_offset,
 			   csa_ie.chandef.center_freq2);
-		ieee80211_queue_work(&local->hw,
-				     &ifmgd->csa_connection_drop_work);
-		return;
+		goto lock_and_drop_connection;
 	}
 
 	if (cfg80211_chandef_identical(&csa_ie.chandef,
@@ -1516,6 +1525,9 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 			  TU_TO_EXP_TIME((csa_ie.count - 1) *
 					 cbss->beacon_interval));
 	return;
+ lock_and_drop_connection:
+	mutex_lock(&local->mtx);
+	mutex_lock(&local->chanctx_mtx);
  drop_connection:
 	/*
 	 * This is just so that the disconnect flow will know that
-- 
2.29.2

[PATCH 13/13] cfg80211: include block-tx flag in channel switch started event

[Luca Coelho]

From: Johannes Berg <johannes.berg@intel.com>

In the NL80211_CMD_CH_SWITCH_STARTED_NOTIFY event, include the
NL80211_ATTR_CH_SWITCH_BLOCK_TX flag attribute if block-tx was
requested by the AP.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
 include/net/cfg80211.h       |  3 ++-
 include/uapi/linux/nl80211.h |  3 ++-
 net/mac80211/cfg.c           |  2 +-
 net/mac80211/mlme.c          |  2 +-
 net/wireless/nl80211.c       | 17 +++++++++++------
 5 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 4a5ae7fb7d59..23bc74d2523f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -7531,6 +7531,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
  * @dev: the device on which the channel switch started
  * @chandef: the future channel definition
  * @count: the number of TBTTs until the channel switch happens
+ * @quiet: whether or not immediate quiet was requested by the AP
  *
  * Inform the userspace about the channel switch that has just
  * started, so that it can take appropriate actions (eg. starting
@@ -7538,7 +7539,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
  */
 void cfg80211_ch_switch_started_notify(struct net_device *dev,
 				       struct cfg80211_chan_def *chandef,
-				       u8 count);
+				       u8 count, bool quiet);
 
 /**
  * ieee80211_operating_class_to_band - convert operating class to band
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 3e0d4a038ab6..83c860395dd6 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2079,7 +2079,8 @@ enum nl80211_commands {
  *	until the channel switch event.
  * @NL80211_ATTR_CH_SWITCH_BLOCK_TX: flag attribute specifying that transmission
  *	must be blocked on the current channel (before the channel switch
- *	operation).
+ *	operation). Also included in the channel switch started event if quiet
+ *	was requested by the AP.
  * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information
  *	for the time while performing a channel switch.
  * @NL80211_ATTR_CNTDWN_OFFS_BEACON: An array of offsets (u16) to the channel
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 454432ced0c9..f9d8ebf96e92 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3448,7 +3448,7 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 					  IEEE80211_QUEUE_STOP_REASON_CSA);
 
 	cfg80211_ch_switch_started_notify(sdata->dev, &sdata->csa_chandef,
-					  params->count);
+					  params->count, params->block_tx);
 
 	if (changed) {
 		ieee80211_bss_info_change_notify(sdata, changed);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 67829667d394..d4da9822a111 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1509,7 +1509,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 	mutex_unlock(&local->mtx);
 
 	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
-					  csa_ie.count);
+					  csa_ie.count, csa_ie.mode);
 
 	if (local->ops->channel_switch) {
 		/* use driver's channel switch callback */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 67c52f4b45fa..ff9b162259fb 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -17061,7 +17061,7 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
 				     struct cfg80211_chan_def *chandef,
 				     gfp_t gfp,
 				     enum nl80211_commands notif,
-				     u8 count)
+				     u8 count, bool quiet)
 {
 	struct sk_buff *msg;
 	void *hdr;
@@ -17082,9 +17082,13 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
 	if (nl80211_send_chandef(msg, chandef))
 		goto nla_put_failure;
 
-	if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
-	    (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
+	if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
+		if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
 			goto nla_put_failure;
+		if (quiet &&
+		    nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
+			goto nla_put_failure;
+	}
 
 	genlmsg_end(msg, hdr);
 
@@ -17117,13 +17121,13 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
 	cfg80211_sched_dfs_chan_update(rdev);
 
 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
-				 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
+				 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
 }
 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
 
 void cfg80211_ch_switch_started_notify(struct net_device *dev,
 				       struct cfg80211_chan_def *chandef,
-				       u8 count)
+				       u8 count, bool quiet)
 {
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	struct wiphy *wiphy = wdev->wiphy;
@@ -17132,7 +17136,8 @@ void cfg80211_ch_switch_started_notify(struct net_device *dev,
 	trace_cfg80211_ch_switch_started_notify(dev, chandef);
 
 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
-				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
+				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
+				 count, quiet);
 }
 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
 
-- 
2.29.2