[RFC PATCH ath-next] wifi: ath11k: refuse a peer whose address exists on another pdev

[RFC PATCH ath-next] wifi: ath11k: refuse a peer whose address exists on another pdev

[John Macias]

On a Netgear RAX120 v1 (IPQ8074 v1, firmware WLAN.HK.2.0-01792) a
client that roams between the 5 GHz and 2.4 GHz BSSes of one SSID
crashes the firmware. hostapd adds the station to the new radio at
authentication, while it is still associated on the old one, so
ath11k_peer_create() finds the address on the other pdev, takes the
"transitioning to another band" path and asks the firmware for a
second peer. The firmware then asserts:

  ar_wal_ast.c:286 Assertion 0 failed

followed by "Failed to add peer ... for VDEV: 1" and "ce desc not
available for wmi command". Both radios stay down until a reboot.
This happened with FT-SAE and with plain SAE.

Refuse the peer with -EEXIST when the existing one is on a different
pdev. The station then fails authentication on the new band instead of
taking both radios down. Moves between vdevs of the same pdev still
take the existing path.

Tested only with this firmware. The hostapd side is being fixed
separately (do not add the station to the driver at authentication
while it is associated on another radio). With that change band moves
work (24 of 24) and this check is not reached.

Assisted-by: LLM
Signed-off-by: John Macias <dencity7@gmail.com>
---
RFC because the existing code deliberately lets a peer move to another
pdev ("Assume sta is transitioning to another band"), and I could test
only one old firmware (the RAX120 v1 has early IPQ8074 silicon that
needs it). Questions:
- Does newer IPQ8074/IPQ6018 firmware accept a second peer with the
  same address on another pdev? If it does, this check should probably
  depend on a firmware or hardware flag rather than apply to everyone.
- Or is the hostapd change alone the preferred fix, with no driver
  change?

 drivers/net/wireless/ath/ath11k/peer.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/peer.c b/drivers/net/wireless/ath/ath11k/peer.c
index b30a90698..42686e41c 100644
--- a/drivers/net/wireless/ath/ath11k/peer.c
+++ b/drivers/net/wireless/ath/ath11k/peer.c
@@ -392,6 +392,20 @@ int ath11k_peer_create(struct ath11k *ar, struct ath11k_vif *arvif,
 			return -EINVAL;
 		}
 
+		/* IPQ8074 firmware WLAN.HK.2.0-01792 asserts in its AST
+		 * table when an address that still has a peer on one pdev
+		 * is created on another pdev. Refuse it; the old peer has
+		 * to be removed first.
+		 */
+		if (peer->pdev_idx != ar->pdev_idx) {
+			spin_unlock_bh(&ar->ab->base_lock);
+			mutex_unlock(&ar->ab->tbl_mtx_lock);
+			ath11k_warn(ar->ab,
+				    "peer %pM exists on pdev %d, not creating it on pdev %d\n",
+				    param->peer_addr, peer->pdev_idx, ar->pdev_idx);
+			return -EEXIST;
+		}
+
 		/* Assume sta is transitioning to another band.
 		 * Remove here the peer from rhash.
 		 */
-- 
2.47.3