[PATCH v3 0/8] wfx: implement Remain On Channel

[PATCH v3 0/8] wfx: implement Remain On Channel

[Jérôme Pouiller]

Hello,

Apart from the 3 first patch, this series implements Remain On Channel for
WF200 chips. The implementation is a bit twisted (I hijack the scan feature
to implements RoC). However, it has been extensively tested with
DPP/EasyConnect and I have not noticed any issue.

v3:
  - Patch 5 and 6 has been squashed.
  - Reordered patches 5 to 9. It was not so easy, but I guarantee the final
    code is the same and every patch compile.
v2:
  - Rebase on last stable tree

Jérôme Pouiller (8):
  wifi: wfx: fix power_save setting when AP is stopped
  wifi: wfx: relocate wfx_rate_mask_to_hw()
  wifi: wfx: move wfx_skb_*() out of the header file
  wifi: wfx: introduce hif_scan_uniq()
  wifi: wfx: simplify exclusion between scan and Rx filters
  wifi: wfx: scan_lock is global to the device
  wifi: wfx: allow to send frames during ROC
  wifi: wfx: implement wfx_remain_on_channel()

 drivers/net/wireless/silabs/wfx/data_tx.c | 54 ++++++++++++++++---
 drivers/net/wireless/silabs/wfx/data_tx.h | 21 ++------
 drivers/net/wireless/silabs/wfx/hif_tx.c  | 43 +++++++++++++++
 drivers/net/wireless/silabs/wfx/hif_tx.h  |  1 +
 drivers/net/wireless/silabs/wfx/main.c    |  5 ++
 drivers/net/wireless/silabs/wfx/queue.c   | 38 ++++++++++---
 drivers/net/wireless/silabs/wfx/queue.h   |  1 +
 drivers/net/wireless/silabs/wfx/scan.c    | 66 ++++++++++++++++++++++-
 drivers/net/wireless/silabs/wfx/scan.h    |  6 +++
 drivers/net/wireless/silabs/wfx/sta.c     | 41 +++++---------
 drivers/net/wireless/silabs/wfx/sta.h     |  1 -
 drivers/net/wireless/silabs/wfx/wfx.h     |  8 +--
 12 files changed, 218 insertions(+), 67 deletions(-)

-- 
2.39.2

[PATCH v3 1/8] wifi: wfx: fix power_save setting when AP is stopped

[Jérôme Pouiller]

The WF200 allow to start two network interfaces (one AP, one station) on
two different channels. Since magic does not exist, it only works if the
station interface enables power save.

Thus, the driver detects this case and enforce power save as necessary.

This patch fixes the case where the AP interface is stopped and it is no
more necessary to enforce power saving on the station interface.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/sta.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
index 626dfb4b7a55d..9c0a11c277e97 100644
--- a/drivers/net/wireless/silabs/wfx/sta.c
+++ b/drivers/net/wireless/silabs/wfx/sta.c
@@ -402,7 +402,12 @@ void wfx_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		 struct ieee80211_bss_conf *link_conf)
 {
 	struct wfx_vif *wvif = (struct wfx_vif *)vif->drv_priv;
+	struct wfx_dev *wdev = wvif->wdev;
 
+	wvif =  NULL;
+	while ((wvif = wvif_iterate(wdev, wvif)) != NULL)
+		wfx_update_pm(wvif);
+	wvif = (struct wfx_vif *)vif->drv_priv;
 	wfx_reset(wvif);
 }
 
-- 
2.39.2

[PATCH v3 2/8] wifi: wfx: relocate wfx_rate_mask_to_hw()

[Jérôme Pouiller]

wfx_rate_mask_to_hw() is only used in hif_tx.c. So relocate it into
hif_tx.c and mark it static.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/hif_tx.c | 18 ++++++++++++++++++
 drivers/net/wireless/silabs/wfx/sta.c    | 18 ------------------
 drivers/net/wireless/silabs/wfx/sta.h    |  1 -
 3 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.c b/drivers/net/wireless/silabs/wfx/hif_tx.c
index 9402503fbde3c..de5a31482df38 100644
--- a/drivers/net/wireless/silabs/wfx/hif_tx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_tx.c
@@ -45,6 +45,24 @@ static void *wfx_alloc_hif(size_t body_len, struct wfx_hif_msg **hif)
 		return NULL;
 }
 
+static u32 wfx_rate_mask_to_hw(struct wfx_dev *wdev, u32 rates)
+{
+	int i;
+	u32 ret = 0;
+	/* The device only supports 2GHz */
+	struct ieee80211_supported_band *sband = wdev->hw->wiphy->bands[NL80211_BAND_2GHZ];
+
+	for (i = 0; i < sband->n_bitrates; i++) {
+		if (rates & BIT(i)) {
+			if (i >= sband->n_bitrates)
+				dev_warn(wdev->dev, "unsupported basic rate\n");
+			else
+				ret |= BIT(sband->bitrates[i].hw_value);
+		}
+	}
+	return ret;
+}
+
 int wfx_cmd_send(struct wfx_dev *wdev, struct wfx_hif_msg *request,
 		 void *reply, size_t reply_len, bool no_reply)
 {
diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
index 9c0a11c277e97..c58db2bcea87b 100644
--- a/drivers/net/wireless/silabs/wfx/sta.c
+++ b/drivers/net/wireless/silabs/wfx/sta.c
@@ -20,24 +20,6 @@
 
 #define HIF_MAX_ARP_IP_ADDRTABLE_ENTRIES 2
 
-u32 wfx_rate_mask_to_hw(struct wfx_dev *wdev, u32 rates)
-{
-	int i;
-	u32 ret = 0;
-	/* The device only supports 2GHz */
-	struct ieee80211_supported_band *sband = wdev->hw->wiphy->bands[NL80211_BAND_2GHZ];
-
-	for (i = 0; i < sband->n_bitrates; i++) {
-		if (rates & BIT(i)) {
-			if (i >= sband->n_bitrates)
-				dev_warn(wdev->dev, "unsupported basic rate\n");
-			else
-				ret |= BIT(sband->bitrates[i].hw_value);
-		}
-	}
-	return ret;
-}
-
 void wfx_cooling_timeout_work(struct work_struct *work)
 {
 	struct wfx_dev *wdev = container_of(to_delayed_work(work), struct wfx_dev,
diff --git a/drivers/net/wireless/silabs/wfx/sta.h b/drivers/net/wireless/silabs/wfx/sta.h
index 888db5cd3206b..c478ddcb934bd 100644
--- a/drivers/net/wireless/silabs/wfx/sta.h
+++ b/drivers/net/wireless/silabs/wfx/sta.h
@@ -66,6 +66,5 @@ int wfx_update_pm(struct wfx_vif *wvif);
 
 /* Other Helpers */
 void wfx_reset(struct wfx_vif *wvif);
-u32 wfx_rate_mask_to_hw(struct wfx_dev *wdev, u32 rates);
 
 #endif
-- 
2.39.2

[PATCH v3 3/8] wifi: wfx: move wfx_skb_*() out of the header file

[Jérôme Pouiller]

There is no real reasons to keep these function in the header file.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/data_tx.c | 18 ++++++++++++++++++
 drivers/net/wireless/silabs/wfx/data_tx.h | 19 ++-----------------
 2 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/drivers/net/wireless/silabs/wfx/data_tx.c b/drivers/net/wireless/silabs/wfx/data_tx.c
index 6a5e52a96d183..ce2b5dcfd8d89 100644
--- a/drivers/net/wireless/silabs/wfx/data_tx.c
+++ b/drivers/net/wireless/silabs/wfx/data_tx.c
@@ -208,6 +208,24 @@ static bool wfx_is_action_back(struct ieee80211_hdr *hdr)
 	return true;
 }
 
+struct wfx_tx_priv *wfx_skb_tx_priv(struct sk_buff *skb)
+{
+	struct ieee80211_tx_info *tx_info;
+
+	if (!skb)
+		return NULL;
+	tx_info = IEEE80211_SKB_CB(skb);
+	return (struct wfx_tx_priv *)tx_info->rate_driver_data;
+}
+
+struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb)
+{
+	struct wfx_hif_msg *hif = (struct wfx_hif_msg *)skb->data;
+	struct wfx_hif_req_tx *req = (struct wfx_hif_req_tx *)hif->body;
+
+	return req;
+}
+
 static u8 wfx_tx_get_link_id(struct wfx_vif *wvif, struct ieee80211_sta *sta,
 			     struct ieee80211_hdr *hdr)
 {
diff --git a/drivers/net/wireless/silabs/wfx/data_tx.h b/drivers/net/wireless/silabs/wfx/data_tx.h
index 983470705e4bb..a5b80eacce39a 100644
--- a/drivers/net/wireless/silabs/wfx/data_tx.h
+++ b/drivers/net/wireless/silabs/wfx/data_tx.h
@@ -45,22 +45,7 @@ void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control, struc
 void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct wfx_hif_cnf_tx *arg);
 void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, bool drop);
 
-static inline struct wfx_tx_priv *wfx_skb_tx_priv(struct sk_buff *skb)
-{
-	struct ieee80211_tx_info *tx_info;
-
-	if (!skb)
-		return NULL;
-	tx_info = IEEE80211_SKB_CB(skb);
-	return (struct wfx_tx_priv *)tx_info->rate_driver_data;
-}
-
-static inline struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb)
-{
-	struct wfx_hif_msg *hif = (struct wfx_hif_msg *)skb->data;
-	struct wfx_hif_req_tx *req = (struct wfx_hif_req_tx *)hif->body;
-
-	return req;
-}
+struct wfx_tx_priv *wfx_skb_tx_priv(struct sk_buff *skb);
+struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb);
 
 #endif
-- 
2.39.2

[PATCH v3 4/8] wifi: wfx: introduce hif_scan_uniq()

[Jérôme Pouiller]

Like hof_scan(), hif_scan_uniq() invoke HIF_SCAN. However, it only
allows to probe one channel and disable probe requests. It works very
well to implement Remain-On-Channel.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/hif_tx.c | 25 ++++++++++++++++++++++++
 drivers/net/wireless/silabs/wfx/hif_tx.h |  1 +
 2 files changed, 26 insertions(+)

diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.c b/drivers/net/wireless/silabs/wfx/hif_tx.c
index de5a31482df38..9f403d275cb13 100644
--- a/drivers/net/wireless/silabs/wfx/hif_tx.c
+++ b/drivers/net/wireless/silabs/wfx/hif_tx.c
@@ -238,6 +238,31 @@ int wfx_hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val, s
 	return ret;
 }
 
+/* Hijack scan request to implement Remain-On-Channel */
+int wfx_hif_scan_uniq(struct wfx_vif *wvif, struct ieee80211_channel *chan, int duration)
+{
+	int ret;
+	struct wfx_hif_msg *hif;
+	size_t buf_len = sizeof(struct wfx_hif_req_start_scan_alt) + sizeof(u8);
+	struct wfx_hif_req_start_scan_alt *body = wfx_alloc_hif(buf_len, &hif);
+
+	if (!hif)
+		return -ENOMEM;
+	body->num_of_ssids = HIF_API_MAX_NB_SSIDS;
+	body->maintain_current_bss = 1;
+	body->disallow_ps = 1;
+	body->tx_power_level = cpu_to_le32(chan->max_power);
+	body->num_of_channels = 1;
+	body->channel_list[0] = chan->hw_value;
+	body->max_transmit_rate = API_RATE_INDEX_B_1MBPS;
+	body->min_channel_time = cpu_to_le32(duration);
+	body->max_channel_time = cpu_to_le32(duration * 110 / 100);
+	wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len);
+	ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false);
+	kfree(hif);
+	return ret;
+}
+
 int wfx_hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,
 		 int chan_start_idx, int chan_num)
 {
diff --git a/drivers/net/wireless/silabs/wfx/hif_tx.h b/drivers/net/wireless/silabs/wfx/hif_tx.h
index 71817a6571f0b..aab54df6aafa6 100644
--- a/drivers/net/wireless/silabs/wfx/hif_tx.h
+++ b/drivers/net/wireless/silabs/wfx/hif_tx.h
@@ -54,6 +54,7 @@ int wfx_hif_beacon_transmit(struct wfx_vif *wvif, bool enable);
 int wfx_hif_update_ie_beacon(struct wfx_vif *wvif, const u8 *ies, size_t ies_len);
 int wfx_hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211,
 		 int chan_start, int chan_num);
+int wfx_hif_scan_uniq(struct wfx_vif *wvif, struct ieee80211_channel *chan, int duration);
 int wfx_hif_stop_scan(struct wfx_vif *wvif);
 int wfx_hif_configuration(struct wfx_dev *wdev, const u8 *conf, size_t len);
 int wfx_hif_shutdown(struct wfx_dev *wdev);
-- 
2.39.2

[PATCH v3 5/8] wifi: wfx: simplify exclusion between scan and Rx filters

[Jérôme Pouiller]

The device ignore the rx filters during the scan operation.
wfx_configure_filter() acquires scan_lock to reflect this restriction.
However, it is not really necessary since mac80211 don't try to
configure Rx filters during scan.

However, the things are changing. The scan operation is going to be used
to implement remain-on-channel. In this case, wfx_configure_filter() can
be called during the scan. Currently, this scenario generate a delay
that end with a timeout in the upper layers. For the final user, some
scenario of the EasyConnect specification end with a failure.

So, avoid acquiring the scan_lock and just return.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/sta.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
index c58db2bcea87b..cb03a5cf7ffa4 100644
--- a/drivers/net/wireless/silabs/wfx/sta.c
+++ b/drivers/net/wireless/silabs/wfx/sta.c
@@ -96,10 +96,12 @@ void wfx_configure_filter(struct ieee80211_hw *hw, unsigned int changed_flags,
 	*total_flags &= FIF_BCN_PRBRESP_PROMISC | FIF_ALLMULTI | FIF_OTHER_BSS |
 			FIF_PROBE_REQ | FIF_PSPOLL;
 
+	/* Filters are ignored during the scan. No frames are filtered. */
+	if (mutex_is_locked(&wvif->scan_lock))
+		return;
+
 	mutex_lock(&wdev->conf_mutex);
 	while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
-		mutex_lock(&wvif->scan_lock);
-
 		/* Note: FIF_BCN_PRBRESP_PROMISC covers probe response and
 		 * beacons from other BSS
 		 */
@@ -126,8 +128,6 @@ void wfx_configure_filter(struct ieee80211_hw *hw, unsigned int changed_flags,
 		else
 			filter_prbreq = true;
 		wfx_hif_set_rx_filter(wvif, filter_bssid, filter_prbreq);
-
-		mutex_unlock(&wvif->scan_lock);
 	}
 	mutex_unlock(&wdev->conf_mutex);
 }
-- 
2.39.2

[PATCH v3 6/8] wifi: wfx: scan_lock is global to the device

[Jérôme Pouiller]

Currently, one scan_lock is associated to each vif. However, concurrent
scan on vifs is explicitly prohibited by the device. Currently,
scan_lock is associated with a vif but it is always locked with
conf_mutex (there is a case where conf_mutex is not associated to
scan_lock but scan_lock is tested on all interfaces). So concurrent scan
on vifs cannot happen.

So, this patch relocate scan_lock to the device and simplify the code.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/main.c |  2 ++
 drivers/net/wireless/silabs/wfx/scan.c |  4 ++--
 drivers/net/wireless/silabs/wfx/sta.c  | 11 +++--------
 drivers/net/wireless/silabs/wfx/wfx.h  |  3 +--
 4 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/drivers/net/wireless/silabs/wfx/main.c b/drivers/net/wireless/silabs/wfx/main.c
index ede822d771aaf..4bf16bceb0bbc 100644
--- a/drivers/net/wireless/silabs/wfx/main.c
+++ b/drivers/net/wireless/silabs/wfx/main.c
@@ -246,6 +246,7 @@ static void wfx_free_common(void *data)
 
 	mutex_destroy(&wdev->tx_power_loop_info_lock);
 	mutex_destroy(&wdev->rx_stats_lock);
+	mutex_destroy(&wdev->scan_lock);
 	mutex_destroy(&wdev->conf_mutex);
 	ieee80211_free_hw(wdev->hw);
 }
@@ -314,6 +315,7 @@ struct wfx_dev *wfx_init_common(struct device *dev, const struct wfx_platform_da
 		gpiod_set_consumer_name(wdev->pdata.gpio_wakeup, "wfx wakeup");
 
 	mutex_init(&wdev->conf_mutex);
+	mutex_init(&wdev->scan_lock);
 	mutex_init(&wdev->rx_stats_lock);
 	mutex_init(&wdev->tx_power_loop_info_lock);
 	init_completion(&wdev->firmware_ready);
diff --git a/drivers/net/wireless/silabs/wfx/scan.c b/drivers/net/wireless/silabs/wfx/scan.c
index 16f619ed22e00..d6f98035f6844 100644
--- a/drivers/net/wireless/silabs/wfx/scan.c
+++ b/drivers/net/wireless/silabs/wfx/scan.c
@@ -95,7 +95,7 @@ void wfx_hw_scan_work(struct work_struct *work)
 	int chan_cur, ret, err;
 
 	mutex_lock(&wvif->wdev->conf_mutex);
-	mutex_lock(&wvif->scan_lock);
+	mutex_lock(&wvif->wdev->scan_lock);
 	if (wvif->join_in_progress) {
 		dev_info(wvif->wdev->dev, "abort in-progress REQ_JOIN");
 		wfx_reset(wvif);
@@ -116,7 +116,7 @@ void wfx_hw_scan_work(struct work_struct *work)
 			ret = -ETIMEDOUT;
 		}
 	} while (ret >= 0 && chan_cur < hw_req->req.n_channels);
-	mutex_unlock(&wvif->scan_lock);
+	mutex_unlock(&wvif->wdev->scan_lock);
 	mutex_unlock(&wvif->wdev->conf_mutex);
 	wfx_ieee80211_scan_completed_compat(wvif->wdev->hw, ret < 0);
 }
diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
index cb03a5cf7ffa4..8533bad6caeae 100644
--- a/drivers/net/wireless/silabs/wfx/sta.c
+++ b/drivers/net/wireless/silabs/wfx/sta.c
@@ -97,7 +97,7 @@ void wfx_configure_filter(struct ieee80211_hw *hw, unsigned int changed_flags,
 			FIF_PROBE_REQ | FIF_PSPOLL;
 
 	/* Filters are ignored during the scan. No frames are filtered. */
-	if (mutex_is_locked(&wvif->scan_lock))
+	if (mutex_is_locked(&wdev->scan_lock))
 		return;
 
 	mutex_lock(&wdev->conf_mutex);
@@ -621,18 +621,14 @@ int wfx_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta, bool set)
 
 void wfx_suspend_resume_mc(struct wfx_vif *wvif, enum sta_notify_cmd notify_cmd)
 {
-	struct wfx_vif *wvif_it;
-
 	if (notify_cmd != STA_NOTIFY_AWAKE)
 		return;
 
 	/* Device won't be able to honor CAB if a scan is in progress on any interface. Prefer to
 	 * skip this DTIM and wait for the next one.
 	 */
-	wvif_it = NULL;
-	while ((wvif_it = wvif_iterate(wvif->wdev, wvif_it)) != NULL)
-		if (mutex_is_locked(&wvif_it->scan_lock))
-			return;
+	if (mutex_is_locked(&wvif->wdev->scan_lock))
+		return;
 
 	if (!wfx_tx_queues_has_cab(wvif) || wvif->after_dtim_tx_allowed)
 		dev_warn(wvif->wdev->dev, "incorrect sequence (%d CAB in queue)",
@@ -730,7 +726,6 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 	complete(&wvif->set_pm_mode_complete);
 	INIT_WORK(&wvif->tx_policy_upload_work, wfx_tx_policy_upload_work);
 
-	mutex_init(&wvif->scan_lock);
 	init_completion(&wvif->scan_complete);
 	INIT_WORK(&wvif->scan_work, wfx_hw_scan_work);
 
diff --git a/drivers/net/wireless/silabs/wfx/wfx.h b/drivers/net/wireless/silabs/wfx/wfx.h
index 13ba84b3b2c33..a41b2c35fa415 100644
--- a/drivers/net/wireless/silabs/wfx/wfx.h
+++ b/drivers/net/wireless/silabs/wfx/wfx.h
@@ -43,6 +43,7 @@ struct wfx_dev {
 	struct delayed_work        cooling_timeout_work;
 	bool                       poll_irq;
 	bool                       chip_frozen;
+	struct mutex               scan_lock;
 	struct mutex               conf_mutex;
 
 	struct wfx_hif_cmd         hif_cmd;
@@ -80,8 +81,6 @@ struct wfx_vif {
 
 	unsigned long              uapsd_mask;
 
-	/* avoid some operations in parallel with scan */
-	struct mutex               scan_lock;
 	struct work_struct         scan_work;
 	struct completion          scan_complete;
 	int                        scan_nb_chan_done;
-- 
2.39.2

[PATCH v3 7/8] wifi: wfx: allow to send frames during ROC

[Jérôme Pouiller]

Until now, all the traffic was blocked during scan operation. However,
scan operation is going to be used to implement Remain On Channel (ROC).
In this case, special frames (marked with IEEE80211_TX_CTL_TX_OFFCHAN)
must be sent during the operation.

These frames need to be sent on the virtual interface #2. Until now,
this interface was only used by the device for internal purpose. But
since API 3.9, it can be used to send data during scan operation (we
hijack the scan process to implement ROC).

Thus, we need to change a bit the way we match the frames with the
interface.

Fortunately, the frames received during the scan are marked with the
correct interface number. So there is no change to do on this part.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/data_tx.c | 36 ++++++++++++++++-----
 drivers/net/wireless/silabs/wfx/data_tx.h |  2 ++
 drivers/net/wireless/silabs/wfx/queue.c   | 38 ++++++++++++++++++-----
 drivers/net/wireless/silabs/wfx/queue.h   |  1 +
 4 files changed, 62 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/silabs/wfx/data_tx.c b/drivers/net/wireless/silabs/wfx/data_tx.c
index ce2b5dcfd8d89..e8b6d41f55196 100644
--- a/drivers/net/wireless/silabs/wfx/data_tx.c
+++ b/drivers/net/wireless/silabs/wfx/data_tx.c
@@ -226,6 +226,18 @@ struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb)
 	return req;
 }
 
+struct wfx_vif *wfx_skb_wvif(struct wfx_dev *wdev, struct sk_buff *skb)
+{
+	struct wfx_tx_priv *tx_priv = wfx_skb_tx_priv(skb);
+	struct wfx_hif_msg *hif = (struct wfx_hif_msg *)skb->data;
+
+	if (tx_priv->vif_id != hif->interface && hif->interface != 2) {
+		dev_err(wdev->dev, "corrupted skb");
+		return wdev_to_wvif(wdev, hif->interface);
+	}
+	return wdev_to_wvif(wdev, tx_priv->vif_id);
+}
+
 static u8 wfx_tx_get_link_id(struct wfx_vif *wvif, struct ieee80211_sta *sta,
 			     struct ieee80211_hdr *hdr)
 {
@@ -352,6 +364,7 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
 	/* Fill tx_priv */
 	tx_priv = (struct wfx_tx_priv *)tx_info->rate_driver_data;
 	tx_priv->icv_size = wfx_tx_get_icv_len(hw_key);
+	tx_priv->vif_id = wvif->id;
 
 	/* Fill hif_msg */
 	WARN(skb_headroom(skb) < wmsg_len, "not enough space in skb");
@@ -362,7 +375,10 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
 	hif_msg = (struct wfx_hif_msg *)skb->data;
 	hif_msg->len = cpu_to_le16(skb->len);
 	hif_msg->id = HIF_REQ_ID_TX;
-	hif_msg->interface = wvif->id;
+	if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+		hif_msg->interface = 2;
+	else
+		hif_msg->interface = wvif->id;
 	if (skb->len > le16_to_cpu(wvif->wdev->hw_caps.size_inp_ch_buf)) {
 		dev_warn(wvif->wdev->dev,
 			 "requested frame size (%d) is larger than maximum supported (%d)\n",
@@ -383,9 +399,15 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
 	req->fc_offset = offset;
 	/* Queue index are inverted between firmware and Linux */
 	req->queue_id = 3 - queue_id;
-	req->peer_sta_id = wfx_tx_get_link_id(wvif, sta, hdr);
-	req->retry_policy_index = wfx_tx_get_retry_policy_id(wvif, tx_info);
-	req->frame_format = wfx_tx_get_frame_format(tx_info);
+	if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
+		req->peer_sta_id = HIF_LINK_ID_NOT_ASSOCIATED;
+		req->retry_policy_index = HIF_TX_RETRY_POLICY_INVALID;
+		req->frame_format = HIF_FRAME_FORMAT_NON_HT;
+	} else {
+		req->peer_sta_id = wfx_tx_get_link_id(wvif, sta, hdr);
+		req->retry_policy_index = wfx_tx_get_retry_policy_id(wvif, tx_info);
+		req->frame_format = wfx_tx_get_frame_format(tx_info);
+	}
 	if (tx_info->driver_rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
 		req->short_gi = 1;
 	if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
@@ -501,7 +523,7 @@ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct wfx_hif_cnf_tx *arg)
 	}
 	tx_info = IEEE80211_SKB_CB(skb);
 	tx_priv = wfx_skb_tx_priv(skb);
-	wvif = wdev_to_wvif(wdev, ((struct wfx_hif_msg *)skb->data)->interface);
+	wvif = wfx_skb_wvif(wdev, skb);
 	WARN_ON(!wvif);
 	if (!wvif)
 		return;
@@ -563,7 +585,6 @@ void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, b
 	struct wfx_dev *wdev = hw->priv;
 	struct sk_buff_head dropped;
 	struct wfx_vif *wvif;
-	struct wfx_hif_msg *hif;
 	struct sk_buff *skb;
 
 	skb_queue_head_init(&dropped);
@@ -579,8 +600,7 @@ void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, b
 	if (wdev->chip_frozen)
 		wfx_pending_drop(wdev, &dropped);
 	while ((skb = skb_dequeue(&dropped)) != NULL) {
-		hif = (struct wfx_hif_msg *)skb->data;
-		wvif = wdev_to_wvif(wdev, hif->interface);
+		wvif = wfx_skb_wvif(wdev, skb);
 		ieee80211_tx_info_clear_status(IEEE80211_SKB_CB(skb));
 		wfx_skb_dtor(wvif, skb);
 	}
diff --git a/drivers/net/wireless/silabs/wfx/data_tx.h b/drivers/net/wireless/silabs/wfx/data_tx.h
index a5b80eacce39a..0621b82103bef 100644
--- a/drivers/net/wireless/silabs/wfx/data_tx.h
+++ b/drivers/net/wireless/silabs/wfx/data_tx.h
@@ -36,6 +36,7 @@ struct wfx_tx_policy_cache {
 struct wfx_tx_priv {
 	ktime_t xmit_timestamp;
 	unsigned char icv_size;
+	unsigned char vif_id;
 };
 
 void wfx_tx_policy_init(struct wfx_vif *wvif);
@@ -47,5 +48,6 @@ void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, b
 
 struct wfx_tx_priv *wfx_skb_tx_priv(struct sk_buff *skb);
 struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb);
+struct wfx_vif *wfx_skb_wvif(struct wfx_dev *wdev, struct sk_buff *skb);
 
 #endif
diff --git a/drivers/net/wireless/silabs/wfx/queue.c b/drivers/net/wireless/silabs/wfx/queue.c
index 37f492e5d3bea..e61b86f211e53 100644
--- a/drivers/net/wireless/silabs/wfx/queue.c
+++ b/drivers/net/wireless/silabs/wfx/queue.c
@@ -68,13 +68,16 @@ void wfx_tx_queues_init(struct wfx_vif *wvif)
 	for (i = 0; i < IEEE80211_NUM_ACS; ++i) {
 		skb_queue_head_init(&wvif->tx_queue[i].normal);
 		skb_queue_head_init(&wvif->tx_queue[i].cab);
+		skb_queue_head_init(&wvif->tx_queue[i].offchan);
 		wvif->tx_queue[i].priority = priorities[i];
 	}
 }
 
 bool wfx_tx_queue_empty(struct wfx_vif *wvif, struct wfx_queue *queue)
 {
-	return skb_queue_empty_lockless(&queue->normal) && skb_queue_empty_lockless(&queue->cab);
+	return skb_queue_empty_lockless(&queue->normal) &&
+	       skb_queue_empty_lockless(&queue->cab) &&
+	       skb_queue_empty_lockless(&queue->offchan);
 }
 
 void wfx_tx_queues_check_empty(struct wfx_vif *wvif)
@@ -103,8 +106,9 @@ static void __wfx_tx_queue_drop(struct wfx_vif *wvif,
 void wfx_tx_queue_drop(struct wfx_vif *wvif, struct wfx_queue *queue,
 		       struct sk_buff_head *dropped)
 {
-	__wfx_tx_queue_drop(wvif, &queue->cab, dropped);
 	__wfx_tx_queue_drop(wvif, &queue->normal, dropped);
+	__wfx_tx_queue_drop(wvif, &queue->cab, dropped);
+	__wfx_tx_queue_drop(wvif, &queue->offchan, dropped);
 	wake_up(&wvif->wdev->tx_dequeue);
 }
 
@@ -113,7 +117,9 @@ void wfx_tx_queues_put(struct wfx_vif *wvif, struct sk_buff *skb)
 	struct wfx_queue *queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
 
-	if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
+	if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+		skb_queue_tail(&queue->offchan, skb);
+	else if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
 		skb_queue_tail(&queue->cab, skb);
 	else
 		skb_queue_tail(&queue->normal, skb);
@@ -123,13 +129,11 @@ void wfx_pending_drop(struct wfx_dev *wdev, struct sk_buff_head *dropped)
 {
 	struct wfx_queue *queue;
 	struct wfx_vif *wvif;
-	struct wfx_hif_msg *hif;
 	struct sk_buff *skb;
 
 	WARN(!wdev->chip_frozen, "%s should only be used to recover a frozen device", __func__);
 	while ((skb = skb_dequeue(&wdev->tx_pending)) != NULL) {
-		hif = (struct wfx_hif_msg *)skb->data;
-		wvif = wdev_to_wvif(wdev, hif->interface);
+		wvif = wfx_skb_wvif(wdev, skb);
 		if (wvif) {
 			queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
 			WARN_ON(skb_get_queue_mapping(skb) > 3);
@@ -155,7 +159,7 @@ struct sk_buff *wfx_pending_get(struct wfx_dev *wdev, u32 packet_id)
 		if (req->packet_id != packet_id)
 			continue;
 		spin_unlock_bh(&wdev->tx_pending.lock);
-		wvif = wdev_to_wvif(wdev, hif->interface);
+		wvif = wfx_skb_wvif(wdev, skb);
 		if (wvif) {
 			queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
 			WARN_ON(skb_get_queue_mapping(skb) > 3);
@@ -246,6 +250,26 @@ static struct sk_buff *wfx_tx_queues_get_skb(struct wfx_dev *wdev)
 		}
 	}
 
+	wvif = NULL;
+	while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
+		for (i = 0; i < num_queues; i++) {
+			skb = skb_dequeue(&queues[i]->offchan);
+			if (!skb)
+				continue;
+			hif = (struct wfx_hif_msg *)skb->data;
+			/* Offchan frames are assigned to a special interface.
+			 * The only interface allowed to send data during scan.
+			 */
+			WARN_ON(hif->interface != 2);
+			atomic_inc(&queues[i]->pending_frames);
+			trace_queues_stats(wdev, queues[i]);
+			return skb;
+		}
+	}
+
+	if (mutex_is_locked(&wdev->scan_lock))
+		return NULL;
+
 	wvif = NULL;
 	while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
 		if (!wvif->after_dtim_tx_allowed)
diff --git a/drivers/net/wireless/silabs/wfx/queue.h b/drivers/net/wireless/silabs/wfx/queue.h
index 4731debca93d2..6857fbd60fbad 100644
--- a/drivers/net/wireless/silabs/wfx/queue.h
+++ b/drivers/net/wireless/silabs/wfx/queue.h
@@ -17,6 +17,7 @@ struct wfx_vif;
 struct wfx_queue {
 	struct sk_buff_head normal;
 	struct sk_buff_head cab; /* Content After (DTIM) Beacon */
+	struct sk_buff_head offchan;
 	atomic_t            pending_frames;
 	int                 priority;
 };
-- 
2.39.2

[PATCH v3 8/8] wifi: wfx: implement wfx_remain_on_channel()

[Jérôme Pouiller]

With some conditions, the device is able to send/receive frames during
scan operation. So, it is possible to use it implement the "remain on
channel" feature. We just ask for a passive scan (without sending any
probe request) on one channel.

This architecture allows to leverage some interesting features:
  - if the device is AP, the device switches channel just after the next
    beacon and the beacons are stopped during the off-channel interval.
  - if the device is connected, it advertises it is asleep before to
    switch channel (so the AP should stop to try to send data)

Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/main.c |  3 ++
 drivers/net/wireless/silabs/wfx/scan.c | 62 ++++++++++++++++++++++++++
 drivers/net/wireless/silabs/wfx/scan.h |  6 +++
 drivers/net/wireless/silabs/wfx/sta.c  |  1 +
 drivers/net/wireless/silabs/wfx/wfx.h  |  5 ++-
 5 files changed, 76 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/silabs/wfx/main.c b/drivers/net/wireless/silabs/wfx/main.c
index 4bf16bceb0bbc..e7198520bdffc 100644
--- a/drivers/net/wireless/silabs/wfx/main.c
+++ b/drivers/net/wireless/silabs/wfx/main.c
@@ -151,6 +151,8 @@ static const struct ieee80211_ops wfx_ops = {
 	.change_chanctx          = wfx_change_chanctx,
 	.assign_vif_chanctx      = wfx_assign_vif_chanctx,
 	.unassign_vif_chanctx    = wfx_unassign_vif_chanctx,
+	.remain_on_channel       = wfx_remain_on_channel,
+	.cancel_remain_on_channel = wfx_cancel_remain_on_channel,
 };
 
 bool wfx_api_older_than(struct wfx_dev *wdev, int major, int minor)
@@ -289,6 +291,7 @@ struct wfx_dev *wfx_init_common(struct device *dev, const struct wfx_platform_da
 	hw->wiphy->features |= NL80211_FEATURE_AP_SCAN;
 	hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
 	hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
+	hw->wiphy->max_remain_on_channel_duration = 5000;
 	hw->wiphy->max_ap_assoc_sta = HIF_LINK_ID_MAX;
 	hw->wiphy->max_scan_ssids = 2;
 	hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
diff --git a/drivers/net/wireless/silabs/wfx/scan.c b/drivers/net/wireless/silabs/wfx/scan.c
index d6f98035f6844..c3c103ff88cce 100644
--- a/drivers/net/wireless/silabs/wfx/scan.c
+++ b/drivers/net/wireless/silabs/wfx/scan.c
@@ -145,3 +145,65 @@ void wfx_scan_complete(struct wfx_vif *wvif, int nb_chan_done)
 	wvif->scan_nb_chan_done = nb_chan_done;
 	complete(&wvif->scan_complete);
 }
+
+void wfx_remain_on_channel_work(struct work_struct *work)
+{
+	struct wfx_vif *wvif = container_of(work, struct wfx_vif, remain_on_channel_work);
+	struct ieee80211_channel *chan = wvif->remain_on_channel_chan;
+	int duration = wvif->remain_on_channel_duration;
+	int ret;
+
+	/* Hijack scan request to implement Remain-On-Channel */
+	mutex_lock(&wvif->wdev->conf_mutex);
+	mutex_lock(&wvif->wdev->scan_lock);
+	if (wvif->join_in_progress) {
+		dev_info(wvif->wdev->dev, "abort in-progress REQ_JOIN");
+		wfx_reset(wvif);
+	}
+	wfx_tx_flush(wvif->wdev);
+
+	reinit_completion(&wvif->scan_complete);
+	ret = wfx_hif_scan_uniq(wvif, chan, duration);
+	if (ret)
+		goto end;
+	ieee80211_ready_on_channel(wvif->wdev->hw);
+	ret = wait_for_completion_timeout(&wvif->scan_complete,
+					  msecs_to_jiffies(duration * 120 / 100));
+	if (!ret) {
+		wfx_hif_stop_scan(wvif);
+		ret = wait_for_completion_timeout(&wvif->scan_complete, 1 * HZ);
+		dev_dbg(wvif->wdev->dev, "roc timeout\n");
+	}
+	if (!ret)
+		dev_err(wvif->wdev->dev, "roc didn't stop\n");
+	ieee80211_remain_on_channel_expired(wvif->wdev->hw);
+end:
+	mutex_unlock(&wvif->wdev->scan_lock);
+	mutex_unlock(&wvif->wdev->conf_mutex);
+	wfx_bh_request_tx(wvif->wdev);
+}
+
+int wfx_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+			  struct ieee80211_channel *chan, int duration,
+			  enum ieee80211_roc_type type)
+{
+	struct wfx_dev *wdev = hw->priv;
+	struct wfx_vif *wvif = (struct wfx_vif *)vif->drv_priv;
+
+	if (wfx_api_older_than(wdev, 3, 10))
+		return -EOPNOTSUPP;
+
+	wvif->remain_on_channel_duration = duration;
+	wvif->remain_on_channel_chan = chan;
+	schedule_work(&wvif->remain_on_channel_work);
+	return 0;
+}
+
+int wfx_cancel_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+{
+	struct wfx_vif *wvif = (struct wfx_vif *)vif->drv_priv;
+
+	wfx_hif_stop_scan(wvif);
+	flush_work(&wvif->remain_on_channel_work);
+	return 0;
+}
diff --git a/drivers/net/wireless/silabs/wfx/scan.h b/drivers/net/wireless/silabs/wfx/scan.h
index 78e3b984f375c..995ab8c6cb5ef 100644
--- a/drivers/net/wireless/silabs/wfx/scan.h
+++ b/drivers/net/wireless/silabs/wfx/scan.h
@@ -19,4 +19,10 @@ int wfx_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 void wfx_cancel_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 void wfx_scan_complete(struct wfx_vif *wvif, int nb_chan_done);
 
+void wfx_remain_on_channel_work(struct work_struct *work);
+int wfx_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+			  struct ieee80211_channel *chan, int duration,
+			  enum ieee80211_roc_type type);
+int wfx_cancel_remain_on_channel(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
+
 #endif
diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
index 8533bad6caeae..1b6c158457b42 100644
--- a/drivers/net/wireless/silabs/wfx/sta.c
+++ b/drivers/net/wireless/silabs/wfx/sta.c
@@ -728,6 +728,7 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
 	init_completion(&wvif->scan_complete);
 	INIT_WORK(&wvif->scan_work, wfx_hw_scan_work);
+	INIT_WORK(&wvif->remain_on_channel_work, wfx_remain_on_channel_work);
 
 	wfx_tx_queues_init(wvif);
 	wfx_tx_policy_init(wvif);
diff --git a/drivers/net/wireless/silabs/wfx/wfx.h b/drivers/net/wireless/silabs/wfx/wfx.h
index a41b2c35fa415..bd0df2e1ea990 100644
--- a/drivers/net/wireless/silabs/wfx/wfx.h
+++ b/drivers/net/wireless/silabs/wfx/wfx.h
@@ -70,6 +70,7 @@ struct wfx_vif {
 
 	bool                       after_dtim_tx_allowed;
 	bool                       join_in_progress;
+	struct completion          set_pm_mode_complete;
 
 	struct delayed_work        beacon_loss_work;
 
@@ -87,7 +88,9 @@ struct wfx_vif {
 	bool                       scan_abort;
 	struct ieee80211_scan_request *scan_req;
 
-	struct completion          set_pm_mode_complete;
+	struct ieee80211_channel   *remain_on_channel_chan;
+	int                        remain_on_channel_duration;
+	struct work_struct         remain_on_channel_work;
 };
 
 static inline struct ieee80211_vif *wvif_to_vif(struct wfx_vif *wvif)
-- 
2.39.2

Re: [PATCH v3 1/8] wifi: wfx: fix power_save setting when AP is stopped

[Kalle Valo]

Jérôme Pouiller  <jerome.pouiller@silabs.com> wrote:

> The WF200 allow to start two network interfaces (one AP, one station) on
> two different channels. Since magic does not exist, it only works if the
> station interface enables power save.
> 
> Thus, the driver detects this case and enforce power save as necessary.
> 
> This patch fixes the case where the AP interface is stopped and it is no
> more necessary to enforce power saving on the station interface.
> 
> Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>

8 patches applied to wireless-next.git, thanks.

8b27aed225ca wifi: wfx: fix power_save setting when AP is stopped
94c104d51830 wifi: wfx: relocate wfx_rate_mask_to_hw()
cf0cc05c8c23 wifi: wfx: move wfx_skb_*() out of the header file
fc5cb24fd50e wifi: wfx: introduce hif_scan_uniq()
f091bcb62dc6 wifi: wfx: simplify exclusion between scan and Rx filters
04106ec5bb02 wifi: wfx: scan_lock is global to the device
f7385a20249e wifi: wfx: allow to send frames during ROC
fc627dad3f01 wifi: wfx: implement wfx_remain_on_channel()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20231004172843.195332-2-jerome.pouiller@silabs.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH v3 7/8] wifi: wfx: allow to send frames during ROC

[Sverdlin, Alexander]

Hi Jerome,

I've just got this (with CONFIG_PROVE_LOCKING) in idle,
without any traffic on the wlan interface:

[119012.104386] INFO: trying to register non-static key.
[119012.109730] The code is fine but needs lockdep annotation, or maybe
[119012.116313] you didn't initialize this object before use?
[119012.121992] turning off the locking correctness validator.
[119012.127778] CPU: 0 UID: 0 PID: 336 Comm: kworker/0:1H Tainted: G           O       6.11.0
[119012.139802] Tainted: [O]=OOT_MODULE
[119012.148547] Workqueue: wfx_bh_wq bh_work [wfx]
[119012.153591] Call trace:
[119012.156282]  dump_backtrace+0xa0/0x128
[119012.160340]  show_stack+0x20/0x38
[119012.163939]  dump_stack_lvl+0x8c/0xd0
[119012.167890]  dump_stack+0x18/0x28
[119012.171472]  register_lock_class+0x4b0/0x4c0
[119012.176033]  __lock_acquire+0xa0/0x1f50
[119012.180148]  lock_acquire+0x1f8/0x330
[119012.184083]  _raw_spin_lock_irqsave+0x68/0x98
[119012.188731]  skb_dequeue+0x2c/0xa8
[119012.192390]  wfx_tx_queues_get+0x20c/0x5a0 [wfx]
[119012.197525]  bh_work+0x3bc/0x950 [wfx]
[119012.201749]  process_one_work+0x234/0x658
[119012.206040]  worker_thread+0x1bc/0x360
[119012.210056]  kthread+0x124/0x130
[119012.213535]  ret_from_fork+0x10/0x20

the uptime is pretty high, as you can see, it's not in startup.
But I've noticed that NetworkManeger closes and opens
the interface from time to time, which leads to 
wfx_remove_interface() of wvif->id 0 and consequent
wfx_add_interface() of wvif->id 0. And only 0, which seems to be relevant,
see below...

On Wed, 2023-10-04 at 19:28 +0200, Jérôme Pouiller wrote:
> Until now, all the traffic was blocked during scan operation. However,
> scan operation is going to be used to implement Remain On Channel (ROC).
> In this case, special frames (marked with IEEE80211_TX_CTL_TX_OFFCHAN)
> must be sent during the operation.
> 
> These frames need to be sent on the virtual interface #2. Until now,
> this interface was only used by the device for internal purpose. But
> since API 3.9, it can be used to send data during scan operation (we
> hijack the scan process to implement ROC).
> 
> Thus, we need to change a bit the way we match the frames with the
> interface.
> 
> Fortunately, the frames received during the scan are marked with the
> correct interface number. So there is no change to do on this part.
> 
> Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
> ---
>  drivers/net/wireless/silabs/wfx/data_tx.c | 36 ++++++++++++++++-----
>  drivers/net/wireless/silabs/wfx/data_tx.h |  2 ++
>  drivers/net/wireless/silabs/wfx/queue.c   | 38 ++++++++++++++++++-----
>  drivers/net/wireless/silabs/wfx/queue.h   |  1 +
>  4 files changed, 62 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/net/wireless/silabs/wfx/data_tx.c b/drivers/net/wireless/silabs/wfx/data_tx.c
> index ce2b5dcfd8d89..e8b6d41f55196 100644
> --- a/drivers/net/wireless/silabs/wfx/data_tx.c
> +++ b/drivers/net/wireless/silabs/wfx/data_tx.c
> @@ -226,6 +226,18 @@ struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb)
>  	return req;
>  }
>  
> +struct wfx_vif *wfx_skb_wvif(struct wfx_dev *wdev, struct sk_buff *skb)
> +{
> +	struct wfx_tx_priv *tx_priv = wfx_skb_tx_priv(skb);
> +	struct wfx_hif_msg *hif = (struct wfx_hif_msg *)skb->data;
> +
> +	if (tx_priv->vif_id != hif->interface && hif->interface != 2) {
> +		dev_err(wdev->dev, "corrupted skb");
> +		return wdev_to_wvif(wdev, hif->interface);
> +	}
> +	return wdev_to_wvif(wdev, tx_priv->vif_id);
> +}
> +
>  static u8 wfx_tx_get_link_id(struct wfx_vif *wvif, struct ieee80211_sta *sta,
>  			     struct ieee80211_hdr *hdr)
>  {
> @@ -352,6 +364,7 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
>  	/* Fill tx_priv */
>  	tx_priv = (struct wfx_tx_priv *)tx_info->rate_driver_data;
>  	tx_priv->icv_size = wfx_tx_get_icv_len(hw_key);
> +	tx_priv->vif_id = wvif->id;
>  
>  	/* Fill hif_msg */
>  	WARN(skb_headroom(skb) < wmsg_len, "not enough space in skb");
> @@ -362,7 +375,10 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
>  	hif_msg = (struct wfx_hif_msg *)skb->data;
>  	hif_msg->len = cpu_to_le16(skb->len);
>  	hif_msg->id = HIF_REQ_ID_TX;
> -	hif_msg->interface = wvif->id;
> +	if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
> +		hif_msg->interface = 2;

I never actually see wfx_add_interface() with id 2...
Which leaves all the queues uninitialized....

> +	else
> +		hif_msg->interface = wvif->id;
>  	if (skb->len > le16_to_cpu(wvif->wdev->hw_caps.size_inp_ch_buf)) {
>  		dev_warn(wvif->wdev->dev,
>  			 "requested frame size (%d) is larger than maximum supported (%d)\n",
> @@ -383,9 +399,15 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
>  	req->fc_offset = offset;
>  	/* Queue index are inverted between firmware and Linux */
>  	req->queue_id = 3 - queue_id;
> -	req->peer_sta_id = wfx_tx_get_link_id(wvif, sta, hdr);
> -	req->retry_policy_index = wfx_tx_get_retry_policy_id(wvif, tx_info);
> -	req->frame_format = wfx_tx_get_frame_format(tx_info);
> +	if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
> +		req->peer_sta_id = HIF_LINK_ID_NOT_ASSOCIATED;
> +		req->retry_policy_index = HIF_TX_RETRY_POLICY_INVALID;
> +		req->frame_format = HIF_FRAME_FORMAT_NON_HT;
> +	} else {
> +		req->peer_sta_id = wfx_tx_get_link_id(wvif, sta, hdr);
> +		req->retry_policy_index = wfx_tx_get_retry_policy_id(wvif, tx_info);
> +		req->frame_format = wfx_tx_get_frame_format(tx_info);
> +	}
>  	if (tx_info->driver_rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
>  		req->short_gi = 1;
>  	if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
> @@ -501,7 +523,7 @@ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct wfx_hif_cnf_tx *arg)
>  	}
>  	tx_info = IEEE80211_SKB_CB(skb);
>  	tx_priv = wfx_skb_tx_priv(skb);
> -	wvif = wdev_to_wvif(wdev, ((struct wfx_hif_msg *)skb->data)->interface);
> +	wvif = wfx_skb_wvif(wdev, skb);
>  	WARN_ON(!wvif);
>  	if (!wvif)
>  		return;
> @@ -563,7 +585,6 @@ void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, b
>  	struct wfx_dev *wdev = hw->priv;
>  	struct sk_buff_head dropped;
>  	struct wfx_vif *wvif;
> -	struct wfx_hif_msg *hif;
>  	struct sk_buff *skb;
>  
>  	skb_queue_head_init(&dropped);
> @@ -579,8 +600,7 @@ void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, b
>  	if (wdev->chip_frozen)
>  		wfx_pending_drop(wdev, &dropped);
>  	while ((skb = skb_dequeue(&dropped)) != NULL) {
> -		hif = (struct wfx_hif_msg *)skb->data;
> -		wvif = wdev_to_wvif(wdev, hif->interface);
> +		wvif = wfx_skb_wvif(wdev, skb);
>  		ieee80211_tx_info_clear_status(IEEE80211_SKB_CB(skb));
>  		wfx_skb_dtor(wvif, skb);
>  	}
> diff --git a/drivers/net/wireless/silabs/wfx/data_tx.h b/drivers/net/wireless/silabs/wfx/data_tx.h
> index a5b80eacce39a..0621b82103bef 100644
> --- a/drivers/net/wireless/silabs/wfx/data_tx.h
> +++ b/drivers/net/wireless/silabs/wfx/data_tx.h
> @@ -36,6 +36,7 @@ struct wfx_tx_policy_cache {
>  struct wfx_tx_priv {
>  	ktime_t xmit_timestamp;
>  	unsigned char icv_size;
> +	unsigned char vif_id;
>  };
>  
>  void wfx_tx_policy_init(struct wfx_vif *wvif);
> @@ -47,5 +48,6 @@ void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u32 queues, b
>  
>  struct wfx_tx_priv *wfx_skb_tx_priv(struct sk_buff *skb);
>  struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb);
> +struct wfx_vif *wfx_skb_wvif(struct wfx_dev *wdev, struct sk_buff *skb);
>  
>  #endif
> diff --git a/drivers/net/wireless/silabs/wfx/queue.c b/drivers/net/wireless/silabs/wfx/queue.c
> index 37f492e5d3bea..e61b86f211e53 100644
> --- a/drivers/net/wireless/silabs/wfx/queue.c
> +++ b/drivers/net/wireless/silabs/wfx/queue.c
> @@ -68,13 +68,16 @@ void wfx_tx_queues_init(struct wfx_vif *wvif)
>  	for (i = 0; i < IEEE80211_NUM_ACS; ++i) {
>  		skb_queue_head_init(&wvif->tx_queue[i].normal);
>  		skb_queue_head_init(&wvif->tx_queue[i].cab);
> +		skb_queue_head_init(&wvif->tx_queue[i].offchan);
>  		wvif->tx_queue[i].priority = priorities[i];
>  	}
>  }
>  
>  bool wfx_tx_queue_empty(struct wfx_vif *wvif, struct wfx_queue *queue)
>  {
> -	return skb_queue_empty_lockless(&queue->normal) && skb_queue_empty_lockless(&queue->cab);
> +	return skb_queue_empty_lockless(&queue->normal) &&
> +	       skb_queue_empty_lockless(&queue->cab) &&
> +	       skb_queue_empty_lockless(&queue->offchan);
>  }
>  
>  void wfx_tx_queues_check_empty(struct wfx_vif *wvif)
> @@ -103,8 +106,9 @@ static void __wfx_tx_queue_drop(struct wfx_vif *wvif,
>  void wfx_tx_queue_drop(struct wfx_vif *wvif, struct wfx_queue *queue,
>  		       struct sk_buff_head *dropped)
>  {
> -	__wfx_tx_queue_drop(wvif, &queue->cab, dropped);
>  	__wfx_tx_queue_drop(wvif, &queue->normal, dropped);
> +	__wfx_tx_queue_drop(wvif, &queue->cab, dropped);
> +	__wfx_tx_queue_drop(wvif, &queue->offchan, dropped);
>  	wake_up(&wvif->wdev->tx_dequeue);
>  }
>  
> @@ -113,7 +117,9 @@ void wfx_tx_queues_put(struct wfx_vif *wvif, struct sk_buff *skb)
>  	struct wfx_queue *queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
>  	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
>  
> -	if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
> +	if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
> +		skb_queue_tail(&queue->offchan, skb);
> +	else if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM)
>  		skb_queue_tail(&queue->cab, skb);
>  	else
>  		skb_queue_tail(&queue->normal, skb);
> @@ -123,13 +129,11 @@ void wfx_pending_drop(struct wfx_dev *wdev, struct sk_buff_head *dropped)
>  {
>  	struct wfx_queue *queue;
>  	struct wfx_vif *wvif;
> -	struct wfx_hif_msg *hif;
>  	struct sk_buff *skb;
>  
>  	WARN(!wdev->chip_frozen, "%s should only be used to recover a frozen device", __func__);
>  	while ((skb = skb_dequeue(&wdev->tx_pending)) != NULL) {
> -		hif = (struct wfx_hif_msg *)skb->data;
> -		wvif = wdev_to_wvif(wdev, hif->interface);
> +		wvif = wfx_skb_wvif(wdev, skb);
>  		if (wvif) {
>  			queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
>  			WARN_ON(skb_get_queue_mapping(skb) > 3);
> @@ -155,7 +159,7 @@ struct sk_buff *wfx_pending_get(struct wfx_dev *wdev, u32 packet_id)
>  		if (req->packet_id != packet_id)
>  			continue;
>  		spin_unlock_bh(&wdev->tx_pending.lock);
> -		wvif = wdev_to_wvif(wdev, hif->interface);
> +		wvif = wfx_skb_wvif(wdev, skb);
>  		if (wvif) {
>  			queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
>  			WARN_ON(skb_get_queue_mapping(skb) > 3);
> @@ -246,6 +250,26 @@ static struct sk_buff *wfx_tx_queues_get_skb(struct wfx_dev *wdev)
>  		}
>  	}
>  
> +	wvif = NULL;
> +	while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Is there actually any point in iterating over wvifs here?
It has been done right before and all the queues are now sorted in
the common "queues"?

> +		for (i = 0; i < num_queues; i++) {
> +			skb = skb_dequeue(&queues[i]->offchan);
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Nevertheless, the lockdep splat comes from here, because
wfx_tx_queues_init() has never been called for wvif->id == 2.

What was your original plan for this to happen?
Do we need an explicit analogue of wfx_add_interface() for vif->id 2 somewhere?

I still have not come with a reproducer yet, but you definitely have more
insight into this code, maybe this will ring some bells on your side...

PS. It's v6.11, even though it's exactly the same splan as in
"staging: wfx: fix potential use before init", but the patch in indeed inside.

> +			if (!skb)
> +				continue;
> +			hif = (struct wfx_hif_msg *)skb->data;
> +			/* Offchan frames are assigned to a special interface.
> +			 * The only interface allowed to send data during scan.
> +			 */
> +			WARN_ON(hif->interface != 2);
> +			atomic_inc(&queues[i]->pending_frames);
> +			trace_queues_stats(wdev, queues[i]);
> +			return skb;
> +		}
> +	}
> +
> +	if (mutex_is_locked(&wdev->scan_lock))
> +		return NULL;
> +
>  	wvif = NULL;
>  	while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
>  		if (!wvif->after_dtim_tx_allowed)
> diff --git a/drivers/net/wireless/silabs/wfx/queue.h b/drivers/net/wireless/silabs/wfx/queue.h
> index 4731debca93d2..6857fbd60fbad 100644
> --- a/drivers/net/wireless/silabs/wfx/queue.h
> +++ b/drivers/net/wireless/silabs/wfx/queue.h
> @@ -17,6 +17,7 @@ struct wfx_vif;
>  struct wfx_queue {
>  	struct sk_buff_head normal;
>  	struct sk_buff_head cab; /* Content After (DTIM) Beacon */
> +	struct sk_buff_head offchan;
>  	atomic_t            pending_frames;
>  	int                 priority;
>  };

-- 
Alexander Sverdlin
Siemens AG
www.siemens.com

Re: [PATCH v3 7/8] wifi: wfx: allow to send frames during ROC

[Jérôme Pouiller]

On Tuesday 26 November 2024 08:27:43 CET Sverdlin, Alexander wrote:
> 
> Hi Jerome,
> 
> I've just got this (with CONFIG_PROVE_LOCKING) in idle,
> without any traffic on the wlan interface:
> 
> [119012.104386] INFO: trying to register non-static key.
> [119012.109730] The code is fine but needs lockdep annotation, or maybe
> [119012.116313] you didn't initialize this object before use?
> [119012.121992] turning off the locking correctness validator.
> [119012.127778] CPU: 0 UID: 0 PID: 336 Comm: kworker/0:1H Tainted: G           O       6.11.0
> [119012.139802] Tainted: [O]=OOT_MODULE
> [119012.148547] Workqueue: wfx_bh_wq bh_work [wfx]
> [119012.153591] Call trace:
> [119012.156282]  dump_backtrace+0xa0/0x128
> [119012.160340]  show_stack+0x20/0x38
> [119012.163939]  dump_stack_lvl+0x8c/0xd0
> [119012.167890]  dump_stack+0x18/0x28
> [119012.171472]  register_lock_class+0x4b0/0x4c0
> [119012.176033]  __lock_acquire+0xa0/0x1f50
> [119012.180148]  lock_acquire+0x1f8/0x330
> [119012.184083]  _raw_spin_lock_irqsave+0x68/0x98
> [119012.188731]  skb_dequeue+0x2c/0xa8
> [119012.192390]  wfx_tx_queues_get+0x20c/0x5a0 [wfx]
> [119012.197525]  bh_work+0x3bc/0x950 [wfx]
> [119012.201749]  process_one_work+0x234/0x658
> [119012.206040]  worker_thread+0x1bc/0x360
> [119012.210056]  kthread+0x124/0x130
> [119012.213535]  ret_from_fork+0x10/0x20
> 
> the uptime is pretty high, as you can see, it's not in startup.
> But I've noticed that NetworkManeger closes and opens
> the interface from time to time, which leads to
> wfx_remove_interface() of wvif->id 0 and consequent
> wfx_add_interface() of wvif->id 0. And only 0, which seems to be relevant,
> see below...

Thank you for the report. Let's dive into this.


> On Wed, 2023-10-04 at 19:28 +0200, Jérôme Pouiller wrote:
> > Until now, all the traffic was blocked during scan operation. However,
> > scan operation is going to be used to implement Remain On Channel (ROC).
> > In this case, special frames (marked with IEEE80211_TX_CTL_TX_OFFCHAN)
> > must be sent during the operation.
> >
> > These frames need to be sent on the virtual interface #2. Until now,
> > this interface was only used by the device for internal purpose. But
> > since API 3.9, it can be used to send data during scan operation (we
> > hijack the scan process to implement ROC).
> >
> > Thus, we need to change a bit the way we match the frames with the
> > interface.
> >
> > Fortunately, the frames received during the scan are marked with the
> > correct interface number. So there is no change to do on this part.
> >
> > Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
> > ---
> >  drivers/net/wireless/silabs/wfx/data_tx.c | 36 ++++++++++++++++-----
> >  drivers/net/wireless/silabs/wfx/data_tx.h |  2 ++
> >  drivers/net/wireless/silabs/wfx/queue.c   | 38 ++++++++++++++++++-----
> >  drivers/net/wireless/silabs/wfx/queue.h   |  1 +
> >  4 files changed, 62 insertions(+), 15 deletions(-)
> >
> > diff --git a/drivers/net/wireless/silabs/wfx/data_tx.c b/drivers/net/wireless/silabs/wfx/data_tx.c
> > index ce2b5dcfd8d89..e8b6d41f55196 100644
> > --- a/drivers/net/wireless/silabs/wfx/data_tx.c
> > +++ b/drivers/net/wireless/silabs/wfx/data_tx.c
> > @@ -226,6 +226,18 @@ struct wfx_hif_req_tx *wfx_skb_txreq(struct sk_buff *skb)
> >       return req;
> >  }
> >
> > +struct wfx_vif *wfx_skb_wvif(struct wfx_dev *wdev, struct sk_buff *skb)
> > +{
> > +     struct wfx_tx_priv *tx_priv = wfx_skb_tx_priv(skb);
> > +     struct wfx_hif_msg *hif = (struct wfx_hif_msg *)skb->data;
> > +
> > +     if (tx_priv->vif_id != hif->interface && hif->interface != 2) {
> > +             dev_err(wdev->dev, "corrupted skb");
> > +             return wdev_to_wvif(wdev, hif->interface);
> > +     }
> > +     return wdev_to_wvif(wdev, tx_priv->vif_id);
> > +}
> > +
> >  static u8 wfx_tx_get_link_id(struct wfx_vif *wvif, struct ieee80211_sta *sta,
> >                            struct ieee80211_hdr *hdr)
> >  {
> > @@ -352,6 +364,7 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
> >       /* Fill tx_priv */
> >       tx_priv = (struct wfx_tx_priv *)tx_info->rate_driver_data;
> >       tx_priv->icv_size = wfx_tx_get_icv_len(hw_key);
> > +     tx_priv->vif_id = wvif->id;
> >
> >       /* Fill hif_msg */
> >       WARN(skb_headroom(skb) < wmsg_len, "not enough space in skb");
> > @@ -362,7 +375,10 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta, struct
> >       hif_msg = (struct wfx_hif_msg *)skb->data;
> >       hif_msg->len = cpu_to_le16(skb->len);
> >       hif_msg->id = HIF_REQ_ID_TX;
> > -     hif_msg->interface = wvif->id;
> > +     if (tx_info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
> > +             hif_msg->interface = 2;
> 
> I never actually see wfx_add_interface() with id 2...
> Which leaves all the queues uninitialized....

This is expected. Interface 2 is not a real interface. You can consider
it as a special queue (for offchannel packets) on the device.

[...]

> > @@ -246,6 +250,26 @@ static struct sk_buff *wfx_tx_queues_get_skb(struct wfx_dev *wdev)
> >               }
> >       }
> >
> > +     wvif = NULL;
> > +     while ((wvif = wvif_iterate(wdev, wvif)) != NULL) {
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> Is there actually any point in iterating over wvifs here?
> It has been done right before and all the queues are now sorted in
> the common "queues"?

hmm... you're probably right.

> 
> > +             for (i = 0; i < num_queues; i++) {
> > +                     skb = skb_dequeue(&queues[i]->offchan);
>                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> Nevertheless, the lockdep splat comes from here, because
> wfx_tx_queues_init() has never been called for wvif->id == 2.
>
> What was your original plan for this to happen?
> Do we need an explicit analogue of wfx_add_interface() for vif->id 2 somewhere?
> 
> I still have not come with a reproducer yet, but you definitely have more
> insight into this code, maybe this will ring some bells on your side...
> 
> PS. It's v6.11, even though it's exactly the same splan as in
> "staging: wfx: fix potential use before init", but the patch in indeed inside.

Yes, probably a very similar issue to "staging: wfx: fix potential use 
before init". I don't believe the issue is related to wvif->id == 2.

You have only produced this issue once, that's it?

I wonder why this does not happen with queues[i]->normal and
queues[i]->cab. Is it because queues[i]->offchan is the first to be
checked? Or mutex_is_locked(&wdev->scan_lock) has an impact in the
process?

In wfx_add_interface(), the list of wvif is protected by conf_lock.
However, wfx_tx_queues_get_skb() is not protected by conf_lock. We
initialize struct wvif before to add it to the wvif list and we
consider it is sufficient. However, after reading memory-barriers.txt
again, it's probably a wrong assumption.


So, maybe this could fix the issue:

diff --git i/drivers/net/wireless/silabs/wfx/sta.c w/drivers/net/wireless/silabs/wfx/sta.c
index a904602f02ce..b22ea4243c0f 100644
--- i/drivers/net/wireless/silabs/wfx/sta.c
+++ w/drivers/net/wireless/silabs/wfx/sta.c
@@ -748,6 +748,7 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)

        for (i = 0; i < ARRAY_SIZE(wdev->vif); i++) {
                if (!wdev->vif[i]) {
+                       smp_mb();
                        wdev->vif[i] = vif;
                        wvif->id = i;
                        break;


However, I am not confident in playing with memory barriers.

-- 
Jérôme Pouiller

Re: [PATCH v3 7/8] wifi: wfx: allow to send frames during ROC

[Sverdlin, Alexander]

Hi Jerome,

On Tue, 2024-11-26 at 15:45 +0100, Jérôme Pouiller wrote:
> In wfx_add_interface(), the list of wvif is protected by conf_lock.
> However, wfx_tx_queues_get_skb() is not protected by conf_lock. We
> initialize struct wvif before to add it to the wvif list and we
> consider it is sufficient. However, after reading memory-barriers.txt
> again, it's probably a wrong assumption.
> 
> 
> So, maybe this could fix the issue:
> 
> diff --git i/drivers/net/wireless/silabs/wfx/sta.c w/drivers/net/wireless/silabs/wfx/sta.c
> index a904602f02ce..b22ea4243c0f 100644
> --- i/drivers/net/wireless/silabs/wfx/sta.c
> +++ w/drivers/net/wireless/silabs/wfx/sta.c
> @@ -748,6 +748,7 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
> 
>         for (i = 0; i < ARRAY_SIZE(wdev->vif); i++) {
>                 if (!wdev->vif[i]) {
> +                       smp_mb();
>                         wdev->vif[i] = vif;
>                         wvif->id = i;
>                         break;
> 
> 
> However, I am not confident in playing with memory barriers.

yes, I'd consider the whole TX path very racy again VIF add/remove.
But this is a separate topic...

-- 
Alexander Sverdlin
Siemens AG
www.siemens.com

Re: [PATCH v3 7/8] wifi: wfx: allow to send frames during ROC

[Sverdlin, Alexander]

Thanks for the quick reply Jerome,

On Tue, 2024-11-26 at 15:45 +0100, Jérôme Pouiller wrote:
> > > +             for (i = 0; i < num_queues; i++) {
> > > +                     skb = skb_dequeue(&queues[i]->offchan);
> >                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > 
> > Nevertheless, the lockdep splat comes from here, because
> > wfx_tx_queues_init() has never been called for wvif->id == 2.
> > 
> > What was your original plan for this to happen?
> > Do we need an explicit analogue of wfx_add_interface() for vif->id 2 somewhere?
> > 
> > I still have not come with a reproducer yet, but you definitely have more
> > insight into this code, maybe this will ring some bells on your side...
> > 
> > PS. It's v6.11, even though it's exactly the same splan as in
> > "staging: wfx: fix potential use before init", but the patch in indeed inside.
> 
> Yes, probably a very similar issue to "staging: wfx: fix potential use 
> before init". I don't believe the issue is related to wvif->id == 2.
> 
> You have only produced this issue once, that's it?
> 
> I wonder why this does not happen with queues[i]->normal and
> queues[i]->cab. Is it because queues[i]->offchan is the first to be
> checked? Or mutex_is_locked(&wdev->scan_lock) has an impact in the
> process?
> 
> In wfx_add_interface(), the list of wvif is protected by conf_lock.
> However, wfx_tx_queues_get_skb() is not protected by conf_lock. We
> initialize struct wvif before to add it to the wvif list and we
> consider it is sufficient. However, after reading memory-barriers.txt
> again, it's probably a wrong assumption.

I've actually disassembled the stack trace exactly to offchan processing.
I have no idea why kernel sends offchan on a non-configured idle interface,
I still need to come up with a reproducer.

But as soon as there is an offchan in the sorted list of "queues" (coming
originally from VIF 0:

void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control, struct sk_buff *skb)
{
...
        if (tx_info->control.vif)
                wvif = (struct wfx_vif *)tx_info->control.vif->drv_priv;
        else
                wvif = wvif_iterate(wdev, NULL);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Puts any offchan into offchan not of VIF 2, but of the only VIF 0...

I think you are right, this could only be offchan queue of VIF 0.
But then it's just a race of TX workqueue against
wfx_remove_interface()/wfx_add_interface() pair (which I see regularly).

We probably need RCU in the TX path and NetLink lock in the VIF add/remove
path similar to other network drivers...
I can try to come up with a patch for this...

-- 
Alexander Sverdlin
Siemens AG
www.siemens.com

Re: [PATCH v3 7/8] wifi: wfx: allow to send frames during ROC

[Jérôme Pouiller]

On Tuesday 26 November 2024 16:54:12 CET Sverdlin, Alexander wrote:
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
> 
> 
> Thanks for the quick reply Jerome,
> 
> On Tue, 2024-11-26 at 15:45 +0100, Jérôme Pouiller wrote:
> > > > +             for (i = 0; i < num_queues; i++) {
> > > > +                     skb = skb_dequeue(&queues[i]->offchan);
> > >                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > >
> > > Nevertheless, the lockdep splat comes from here, because
> > > wfx_tx_queues_init() has never been called for wvif->id == 2.
> > >
> > > What was your original plan for this to happen?
> > > Do we need an explicit analogue of wfx_add_interface() for vif->id 2 somewhere?
> > >
> > > I still have not come with a reproducer yet, but you definitely have more
> > > insight into this code, maybe this will ring some bells on your side...
> > >
> > > PS. It's v6.11, even though it's exactly the same splan as in
> > > "staging: wfx: fix potential use before init", but the patch in indeed inside.
> >
> > Yes, probably a very similar issue to "staging: wfx: fix potential use
> > before init". I don't believe the issue is related to wvif->id == 2.
> >
> > You have only produced this issue once, that's it?
> >
> > I wonder why this does not happen with queues[i]->normal and
> > queues[i]->cab. Is it because queues[i]->offchan is the first to be
> > checked? Or mutex_is_locked(&wdev->scan_lock) has an impact in the
> > process?
> >
> > In wfx_add_interface(), the list of wvif is protected by conf_lock.
> > However, wfx_tx_queues_get_skb() is not protected by conf_lock. We
> > initialize struct wvif before to add it to the wvif list and we
> > consider it is sufficient. However, after reading memory-barriers.txt
> > again, it's probably a wrong assumption.
> 
> I've actually disassembled the stack trace exactly to offchan processing.
> I have no idea why kernel sends offchan on a non-configured idle interface,
> I still need to come up with a reproducer.
> 
> But as soon as there is an offchan in the sorted list of "queues" (coming
> originally from VIF 0:
> 
> void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control, struct sk_buff *skb)
> {
> ...
>         if (tx_info->control.vif)
>                 wvif = (struct wfx_vif *)tx_info->control.vif->drv_priv;
>         else
>                 wvif = wvif_iterate(wdev, NULL);
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> Puts any offchan into offchan not of VIF 2, but of the only VIF 0...

Note skb_dequeue(&queues[i]->offchan) is called whatever there is a frame
in the offchan queue. In fact, wfx_tx_queues_get_skb() can be called even
if all the tx queues are empty (and this happen when the wake up event
comes from the device).

So the reproducer involves wfx_add_interface() and a not-yet-identified
event (that could be an IRQ and a Tx frame) that wake up the bh workqueue.

> I think you are right, this could only be offchan queue of VIF 0.
> But then it's just a race of TX workqueue against
> wfx_remove_interface()/wfx_add_interface() pair (which I see regularly).

We have the same conclusion.

> We probably need RCU in the TX path and NetLink lock in the VIF add/remove
> path similar to other network drivers...
> I can try to come up with a patch for this...

I wonder if there is a way to iterate over the vif using the cfg80211/mac80211
API rather than maintaining a list of vif in the driver.

[...]

-- 
Jérôme Pouiller