wifi: rtw89: mcc: stop TX during MCC prepare

[ Upstream commit 182c7ff8b87e4edbb2227ede39ae0952da7a0f4a ]

Stop TX during the MCC configuration period to prevent packet leakage.
The stop time is defined as 'start_tsf - tsf', which means the duration
from when MCC configuration begins until MCC starts.

Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250610130034.14692-6-pkshih@realtek.com
Stable-dep-of: 3e31a6bc0731 ("wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c
index b18019b53181c7c5d1e24ce6a08e3a3e892521e1..17daf93fec0a4449b7ec3fc40caed042d114e309 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/chan.c
+++ b/drivers/net/wireless/realtek/rtw89/chan.c
@@ -1595,6 +1595,35 @@ static bool rtw89_mcc_duration_decision_on_bt(struct rtw89_dev *rtwdev)
        return false;
 }
 
+void rtw89_mcc_prepare_done_work(struct wiphy *wiphy, struct wiphy_work *work)
+{
+       struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev,
+                                               mcc_prepare_done_work.work);
+
+       lockdep_assert_wiphy(wiphy);
+
+       ieee80211_wake_queues(rtwdev->hw);
+}
+
+static void rtw89_mcc_prepare(struct rtw89_dev *rtwdev, bool start)
+{
+       struct rtw89_mcc_info *mcc = &rtwdev->mcc;
+       struct rtw89_mcc_config *config = &mcc->config;
+
+       if (start) {
+               ieee80211_stop_queues(rtwdev->hw);
+
+               wiphy_delayed_work_queue(rtwdev->hw->wiphy,
+                                        &rtwdev->mcc_prepare_done_work,
+                                        usecs_to_jiffies(config->prepare_delay));
+       } else {
+               wiphy_delayed_work_queue(rtwdev->hw->wiphy,
+                                        &rtwdev->mcc_prepare_done_work, 0);
+               wiphy_delayed_work_flush(rtwdev->hw->wiphy,
+                                        &rtwdev->mcc_prepare_done_work);
+       }
+}
+
 static int rtw89_mcc_fill_start_tsf(struct rtw89_dev *rtwdev)
 {
        struct rtw89_mcc_info *mcc = &rtwdev->mcc;
@@ -1630,6 +1659,8 @@ static int rtw89_mcc_fill_start_tsf(struct rtw89_dev *rtwdev)
 
        config->start_tsf = start_tsf;
        config->start_tsf_in_aux_domain = tsf_aux + start_tsf - tsf;
+       config->prepare_delay = start_tsf - tsf;
+
        return 0;
 }
 
@@ -2219,6 +2250,8 @@ static int rtw89_mcc_start(struct rtw89_dev *rtwdev)
        rtw89_chanctx_notify(rtwdev, RTW89_CHANCTX_STATE_MCC_START);
 
        rtw89_mcc_start_beacon_noa(rtwdev);
+
+       rtw89_mcc_prepare(rtwdev, true);
        return 0;
 }
 
@@ -2307,6 +2340,8 @@ static void rtw89_mcc_stop(struct rtw89_dev *rtwdev,
        rtw89_chanctx_notify(rtwdev, RTW89_CHANCTX_STATE_MCC_STOP);
 
        rtw89_mcc_stop_beacon_noa(rtwdev);
+
+       rtw89_mcc_prepare(rtwdev, false);
 }
 
 static int rtw89_mcc_update(struct rtw89_dev *rtwdev)

diff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h
index 2a25563593af93ccbafb1ce3fcf922831fa16b43..be998fdd8724be610e95c9bfbb03b049202d5e04 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/chan.h
+++ b/drivers/net/wireless/realtek/rtw89/chan.h
@@ -129,6 +129,8 @@ const struct rtw89_chan *__rtw89_mgnt_chan_get(struct rtw89_dev *rtwdev,
 #define rtw89_mgnt_chan_get(rtwdev, link_index) \
        __rtw89_mgnt_chan_get(rtwdev, __func__, link_index)
 
+void rtw89_mcc_prepare_done_work(struct wiphy *wiphy, struct wiphy_work *work);
+
 int rtw89_chanctx_ops_add(struct rtw89_dev *rtwdev,
                          struct ieee80211_chanctx_conf *ctx);
 void rtw89_chanctx_ops_remove(struct rtw89_dev *rtwdev,

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 894ab7ab94ccb6ec9aa203784340e4c18a03eb0b..0e4d5679e426c98822d6468adeea7b28897d823f 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -4816,6 +4816,7 @@ void rtw89_core_stop(struct rtw89_dev *rtwdev)
        wiphy_delayed_work_cancel(wiphy, &rtwdev->coex_bt_devinfo_work);
        wiphy_delayed_work_cancel(wiphy, &rtwdev->coex_rfk_chk_work);
        wiphy_delayed_work_cancel(wiphy, &rtwdev->cfo_track_work);
+       wiphy_delayed_work_cancel(wiphy, &rtwdev->mcc_prepare_done_work);
        cancel_delayed_work_sync(&rtwdev->forbid_ba_work);
        wiphy_delayed_work_cancel(wiphy, &rtwdev->antdiv_work);
 
@@ -5042,6 +5043,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev)
        wiphy_delayed_work_init(&rtwdev->coex_bt_devinfo_work, rtw89_coex_bt_devinfo_work);
        wiphy_delayed_work_init(&rtwdev->coex_rfk_chk_work, rtw89_coex_rfk_chk_work);
        wiphy_delayed_work_init(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work);
+       wiphy_delayed_work_init(&rtwdev->mcc_prepare_done_work, rtw89_mcc_prepare_done_work);
        INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work);
        wiphy_delayed_work_init(&rtwdev->antdiv_work, rtw89_phy_antdiv_work);
        rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0);

diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index 1c8f3b9b7c4c661224634b6dfb43d3cbc02e7d5e..f505fe6da4a24c0ac8b032daaf9b85e2161dc0b2 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -5728,6 +5728,7 @@ struct rtw89_mcc_config {
        struct rtw89_mcc_sync sync;
        u64 start_tsf;
        u64 start_tsf_in_aux_domain;
+       u64 prepare_delay;
        u16 mcc_interval; /* TU */
        u16 beacon_offset; /* TU */
 };
@@ -5858,6 +5859,7 @@ struct rtw89_dev {
        struct wiphy_delayed_work coex_bt_devinfo_work;
        struct wiphy_delayed_work coex_rfk_chk_work;
        struct wiphy_delayed_work cfo_track_work;
+       struct wiphy_delayed_work mcc_prepare_done_work;
        struct delayed_work forbid_ba_work;
        struct wiphy_delayed_work antdiv_work;
        struct rtw89_ppdu_sts_info ppdu_sts;