From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 24F1CC5AD49 for ; Wed, 4 Jun 2025 01:28:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=DrCIuoV59NTpDVVYgO390Ziz5zVtlYh8I4BEFWNO+tI=; b=CxEsUCyokWGs30EO2o3DA7kvkj PfS1Jm7xyYRd2hRdNDgp8XTyvHoLCiWGpiSPPTbFrNfSuKXiRaD+CsaCfDB/CbK25mVX83pIMOfAT UUwgO0sesPfsr1Q1qfn27EvRyAiNBMyT8FuvaK4bgE7fWBCBX4RW1S0+WudkDNjKm+4mGllrizMs6 +mzzIWu2KYsPVuwTfNWF9jer4SXJwcIFHoDV5gKMrPEGHtWD5xqjFRhTMIKMPbR10wxoyh08SsE5Y prZq7rK11zOzllYDSQMa7WIxJw0C8h32X9x8tEUnVGyJycBRPv+nbsYeA8J4Tm4mIOzJXJwm5/DGN ze+fFZmQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1uMcvo-0000000CCQw-3YBs; Wed, 04 Jun 2025 01:28:40 +0000 Received: from nyc.source.kernel.org ([147.75.193.91]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1uMcPL-0000000C6x9-1acn for ath12k@lists.infradead.org; Wed, 04 Jun 2025 00:55:08 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by nyc.source.kernel.org (Postfix) with ESMTP id 65A6EA4FE58; Wed, 4 Jun 2025 00:55:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D22EFC4CEED; Wed, 4 Jun 2025 00:55:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748998506; bh=rRJ1IdUddSNusaHPahoNTTOUgTjB3hUIBuyEY83FMh4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h90uTgah+G3cLeXuhCkjOTLSE2Tz+phoXnTDb9tTvu3SejGT/JMI18/Lz/trWRxbL 1Ecy1BQX7sXbQY3eRxCKpL+6EeS2CH7lcjQjWrajkptwUsZxdy8vXsiNMNpRCaVb1a ZOoKb8yH3mv3J7DGpsYVB7vMU8HLgxsKRQf0dekjix09E1sW9rKcykrriqOiM5/avX G3tofFELojX3aLmBZzGXE6OQKjyMkGXMI9hhEwkm6mj9VueavDrw+gInG5NoBuPSw0 4um/Jiqa9kATqcGYsft2XoaeaGyDKBdslMs4BtTuoDOWC4AQ/C6jaF3Als3QEKovBj p5A06Jpuho12w== From: Sasha Levin To: patches@lists.linux.dev, stable@vger.kernel.org Cc: Pradeep Kumar Chitrapu , Roopni Devanathan , Vasanthakumar Thiagarajan , Ping-Ke Shih , Jeff Johnson , Sasha Levin , jjohnson@kernel.org, linux-wireless@vger.kernel.org, ath12k@lists.infradead.org Subject: [PATCH AUTOSEL 6.15 111/118] wifi: ath12k: Fix incorrect rates sent to firmware Date: Tue, 3 Jun 2025 20:50:42 -0400 Message-Id: <20250604005049.4147522-111-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250604005049.4147522-1-sashal@kernel.org> References: <20250604005049.4147522-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.15 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250603_175507_578158_2718FFCB X-CRM114-Status: GOOD ( 16.43 ) X-BeenThere: ath12k@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "ath12k" Errors-To: ath12k-bounces+ath12k=archiver.kernel.org@lists.infradead.org From: Pradeep Kumar Chitrapu [ Upstream commit cb1790249361ba9396b06b1af2500147e6e42e5e ] Before firmware assert, if there is a station interface in the device which is not associated with an AP, the basic rates are set to zero. Following this, during firmware recovery, when basic rates are zero, ath12k driver is sending invalid rate codes, which are negative values, to firmware. This results in firmware assert. Fix this by checking if rate codes are valid, before sending them to the firmware. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Pradeep Kumar Chitrapu Signed-off-by: Roopni Devanathan Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Ping-Ke Shih Link: https://patch.msgid.link/20250320112426.1956961-1-quic_rdevanat@quicinc.com Signed-off-by: Jeff Johnson Signed-off-by: Sasha Levin --- **YES** This commit should be backported to stable kernel trees. ## Analysis This commit fixes a critical bug that causes firmware crashes during firmware recovery scenarios, making it an important candidate for stable backporting. ### Issue Analysis **The Problem:** The commit addresses a scenario where during firmware recovery, when a station interface exists but is not associated with an AP, the `basic_rates` field becomes zero. The original code uses `ffs(bss_conf->basic_rates) - 1` to calculate the basic rate index, which produces a negative value (-1) when `basic_rates` is zero, since `ffs(0)` returns 0. **Code Changes Analysis:** 1. **In `ath12k_recalculate_mgmt_rate()`:** ```c - basic_rate_idx = ffs(bss_conf->basic_rates) - 1; + if (bss_conf->basic_rates) + basic_rate_idx = __ffs(bss_conf->basic_rates); + else + basic_rate_idx = 0; ``` 2. **In `ath12k_mac_bss_info_changed()`:** ```c - if (mcast_rate > 0) + if (mcast_rate > 0) { rateidx = mcast_rate - 1; - else - rateidx = ffs(info->basic_rates) - 1; + } else { + if (info->basic_rates) + rateidx = __ffs(info->basic_rates); + else + rateidx = 0; + } ``` ### Why This Should Be Backported **1. Firmware Crash Prevention:** The commit directly prevents firmware crashes by ensuring invalid rate codes (negative values) are never sent to firmware. This is a critical stability fix. **2. Small and Contained Fix:** The changes are minimal and focused - just adding proper validation for the `basic_rates` field before using it in rate calculations. The fix doesn't introduce new features or architectural changes. **3. Common Scenario Impact:** The issue occurs during firmware recovery when station interfaces exist but aren't associated - a scenario that can happen during normal operation, especially in environments with frequent disconnections or recovery events. **4. Consistent with Stable Tree Criteria:** - Fixes an important bug affecting users (firmware crashes) - Changes are minimal and low-risk - No new functionality introduced - Confined to the ath12k subsystem **5. Similarity to Backported Commits:** This fix follows the same pattern as the historical examples that were backported (marked "YES"): - Similar Commit #1: Fixed incorrect multicast/broadcast rate setting that caused broken mesh paths - Similar Commit #3: Fixed invalid AMPDU factor calculation - Similar Commit #4: Fixed failed frame transmission handling to prevent metric calculation issues - Similar Commit #5: Fixed firmware crash due to invalid peer NSS values **6. Low Regression Risk:** The fix uses safe fallback behavior (defaulting to rate index 0) when `basic_rates` is zero, which is much safer than sending negative rate codes to firmware. The commit addresses a clear bug that causes firmware stability issues in a common operational scenario, with a minimal and safe fix that follows established patterns for stable tree inclusion. drivers/net/wireless/ath/ath12k/mac.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c index 3d925f208176b..17415f7a1f51d 100644 --- a/drivers/net/wireless/ath/ath12k/mac.c +++ b/drivers/net/wireless/ath/ath12k/mac.c @@ -3450,7 +3450,10 @@ static void ath12k_recalculate_mgmt_rate(struct ath12k *ar, } sband = hw->wiphy->bands[def->chan->band]; - basic_rate_idx = ffs(bss_conf->basic_rates) - 1; + if (bss_conf->basic_rates) + basic_rate_idx = __ffs(bss_conf->basic_rates); + else + basic_rate_idx = 0; bitrate = sband->bitrates[basic_rate_idx].bitrate; hw_rate_code = ath12k_mac_get_rate_hw_value(bitrate); @@ -4014,10 +4017,14 @@ static void ath12k_mac_bss_info_changed(struct ath12k *ar, band = def.chan->band; mcast_rate = info->mcast_rate[band]; - if (mcast_rate > 0) + if (mcast_rate > 0) { rateidx = mcast_rate - 1; - else - rateidx = ffs(info->basic_rates) - 1; + } else { + if (info->basic_rates) + rateidx = __ffs(info->basic_rates); + else + rateidx = 0; + } if (ar->pdev->cap.supported_bands & WMI_HOST_WLAN_5G_CAP) rateidx += ATH12K_MAC_FIRST_OFDM_RATE_IDX; -- 2.39.5