1. 28 4月, 2017 8 次提交
    • M
      mac80211: Fix possible sband related NULL pointer de-reference · 21a8e9dd
      Mohammed Shafi Shajakhan 提交于
      Existing API 'ieee80211_get_sdata_band' returns default 2 GHz band even
      if the channel context configuration is NULL. This crashes for chipsets
      which support 5 Ghz alone when it tries to access members of 'sband'.
      Channel context configuration can be NULL in multivif case and when
      channel switch is in progress (or) when it fails. Fix this by replacing
      the API 'ieee80211_get_sdata_band' with  'ieee80211_get_sband' which
      returns a NULL pointer for sband when the channel configuration is NULL.
      
      An example scenario is as below:
      
      In multivif mode (AP + STA) with drivers like ath10k, when we do a
      channel switch in the AP vif (which has a number of clients connected)
      and a STA vif which is connected to some other AP, when the channel
      switch in AP vif fails, while the STA vifs tries to connect to the
      other AP, there is a window where the channel context is NULL/invalid
      and this results in a crash  while the clients connected to the AP vif
      tries to reconnect and this race is very similar to the one investigated
      by Michal in https://patchwork.kernel.org/patch/3788161/ and this does
      happens with hardware that supports 5Ghz alone after long hours of
      testing with continuous channel switch on the AP vif
      
      ieee80211 phy0: channel context reservation cannot be finalized because
      some interfaces aren't switching
      wlan0: failed to finalize CSA, disconnecting
      wlan0-1: deauthenticating from 8c:fd:f0:01:54:9c by local choice
      	(Reason: 3=DEAUTH_LEAVING)
      
      	WARNING: CPU: 1 PID: 19032 at net/mac80211/ieee80211_i.h:1013 sta_info_alloc+0x374/0x3fc [mac80211]
      	[<bf77272c>] (sta_info_alloc [mac80211])
      	[<bf78776c>] (ieee80211_add_station [mac80211]))
      	[<bf73cc50>] (nl80211_new_station [cfg80211])
      
      	Unable to handle kernel NULL pointer dereference at virtual
      	address 00000014
      	pgd = d5f4c000
      	Internal error: Oops: 17 [#1] PREEMPT SMP ARM
      	PC is at sta_info_alloc+0x380/0x3fc [mac80211]
      	LR is at sta_info_alloc+0x37c/0x3fc [mac80211]
      	[<bf772738>] (sta_info_alloc [mac80211])
      	[<bf78776c>] (ieee80211_add_station [mac80211])
      	[<bf73cc50>] (nl80211_new_station [cfg80211]))
      
      Cc: Michal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      21a8e9dd
    • F
      mac80211: add ieee80211_tx_status_ext · 5fe49a9d
      Felix Fietkau 提交于
      This allows the driver to pass in struct ieee80211_tx_status directly.
      Make ieee80211_tx_status_noskb a wrapper around it.
      
      As with ieee80211_tx_status_noskb, there is no _ni variant of this call,
      because it probably won't be needed.
      
      Even if the driver won't provide any extra status info other than what's
      in struct ieee80211_tx_info already, it can optimize status reporting
      this way by passing in the station pointer.
      Signed-off-by: NFelix Fietkau <nbd@nbd.name>
      [use C99 initializers]
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      5fe49a9d
    • F
      mac80211: move ieee80211_tx_status_noskb below ieee80211_tx_status · eefebd31
      Felix Fietkau 提交于
      Makes further cleanups more readable
      Signed-off-by: NFelix Fietkau <nbd@nbd.name>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      eefebd31
    • F
      mac80211: make rate control tx status API more extensible · 18fb84d9
      Felix Fietkau 提交于
      Rename .tx_status_noskb to .tx_status_ext and pass a new on-stack
      struct ieee80211_tx_status instead of struct ieee80211_tx_info.
      
      This struct can be used to pass extra information, e.g. for dynamic tx
      power control
      Signed-off-by: NFelix Fietkau <nbd@nbd.name>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      18fb84d9
    • J
      mac80211: use bitfield macros for encoded rate · dcba665b
      Johannes Berg 提交于
      Instead of hand-coding the bit manipulations, use the bitfield
      macros to generate the code for the encoded bitrate.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      dcba665b
    • J
      mac80211: rename ieee80211_rx_status::vht_nss to just nss · 8613c948
      Johannes Berg 提交于
      This field will need to be used again for HE, so rename it now.
      
      Again, mostly done with this spatch:
      
      @@
      expression status;
      @@
      -status->vht_nss
      +status->nss
      @@
      expression status;
      @@
      -status.vht_nss
      +status.nss
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      8613c948
    • J
      mac80211: separate encoding/bandwidth from flags · da6a4352
      Johannes Berg 提交于
      We currently use a lot of flags that are mutually incompatible,
      separate this out into actual encoding and bandwidth enum values.
      
      Much of this again done with spatch, with manual post-editing,
      mostly to add the switch statements and get rid of the conversions.
      
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_80MHZ
      +status->bw = RATE_INFO_BW_80
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_40MHZ
      +status->bw = RATE_INFO_BW_40
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_20MHZ
      +status->bw = RATE_INFO_BW_20
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_160MHZ
      +status->bw = RATE_INFO_BW_160
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_5MHZ
      +status->bw = RATE_INFO_BW_5
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_10MHZ
      +status->bw = RATE_INFO_BW_10
      
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_VHT
      +status->encoding = RX_ENC_VHT
      @@
      expression status;
      @@
      -status->enc_flags |= RX_ENC_FLAG_HT
      +status->encoding = RX_ENC_HT
      @@
      expression status;
      @@
      -status.enc_flags |= RX_ENC_FLAG_VHT
      +status.encoding = RX_ENC_VHT
      @@
      expression status;
      @@
      -status.enc_flags |= RX_ENC_FLAG_HT
      +status.encoding = RX_ENC_HT
      
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_HT)
      +(status->encoding == RX_ENC_HT)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_VHT)
      +(status->encoding == RX_ENC_VHT)
      
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_5MHZ)
      +(status->bw == RATE_INFO_BW_5)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_10MHZ)
      +(status->bw == RATE_INFO_BW_10)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_40MHZ)
      +(status->bw == RATE_INFO_BW_40)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_80MHZ)
      +(status->bw == RATE_INFO_BW_80)
      @@
      expression status;
      @@
      -(status->enc_flags & RX_ENC_FLAG_160MHZ)
      +(status->bw == RATE_INFO_BW_160)
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      da6a4352
    • J
      mac80211: clean up rate encoding bits in RX status · 7fdd69c5
      Johannes Berg 提交于
      In preparation for adding support for HE rates, clean up
      the driver report encoding for rate/bandwidth reporting
      on RX frames.
      
      Much of this patch was done with the following spatch:
      
      @@
      expression status;
      @@
      -status->flag & (RX_FLAG_HT | RX_FLAG_VHT)
      +status->enc_flags & (RX_ENC_FLAG_HT | RX_ENC_FLAG_VHT)
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_SHORTPRE
      +status->enc_flags op RX_ENC_FLAG_SHORTPRE
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_SHORTPRE
      +status->enc_flags & RX_ENC_FLAG_SHORTPRE
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_HT
      +status->enc_flags op RX_ENC_FLAG_HT
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_HT
      +status->enc_flags & RX_ENC_FLAG_HT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_40MHZ
      +status->enc_flags op RX_ENC_FLAG_40MHZ
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_40MHZ
      +status->enc_flags & RX_ENC_FLAG_40MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_SHORT_GI
      +status->enc_flags op RX_ENC_FLAG_SHORT_GI
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_SHORT_GI
      +status->enc_flags & RX_ENC_FLAG_SHORT_GI
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_HT_GF
      +status->enc_flags op RX_ENC_FLAG_HT_GF
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_HT_GF
      +status->enc_flags & RX_ENC_FLAG_HT_GF
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_VHT
      +status->enc_flags op RX_ENC_FLAG_VHT
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_VHT
      +status->enc_flags & RX_ENC_FLAG_VHT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_STBC_MASK
      +status->enc_flags op RX_ENC_FLAG_STBC_MASK
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_STBC_MASK
      +status->enc_flags & RX_ENC_FLAG_STBC_MASK
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_LDPC
      +status->enc_flags op RX_ENC_FLAG_LDPC
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_LDPC
      +status->enc_flags & RX_ENC_FLAG_LDPC
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_10MHZ
      +status->enc_flags op RX_ENC_FLAG_10MHZ
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_10MHZ
      +status->enc_flags & RX_ENC_FLAG_10MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->flag op RX_FLAG_5MHZ
      +status->enc_flags op RX_ENC_FLAG_5MHZ
      @@
      expression status;
      @@
      -status->flag & RX_FLAG_5MHZ
      +status->enc_flags & RX_ENC_FLAG_5MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->vht_flag op RX_VHT_FLAG_80MHZ
      +status->enc_flags op RX_ENC_FLAG_80MHZ
      @@
      expression status;
      @@
      -status->vht_flag & RX_VHT_FLAG_80MHZ
      +status->enc_flags & RX_ENC_FLAG_80MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->vht_flag op RX_VHT_FLAG_160MHZ
      +status->enc_flags op RX_ENC_FLAG_160MHZ
      @@
      expression status;
      @@
      -status->vht_flag & RX_VHT_FLAG_160MHZ
      +status->enc_flags & RX_ENC_FLAG_160MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status->vht_flag op RX_VHT_FLAG_BF
      +status->enc_flags op RX_ENC_FLAG_BF
      @@
      expression status;
      @@
      -status->vht_flag & RX_VHT_FLAG_BF
      +status->enc_flags & RX_ENC_FLAG_BF
      
      @@
      assignment operator op;
      expression status, STBC;
      @@
      -status->flag op STBC << RX_FLAG_STBC_SHIFT
      +status->enc_flags op STBC << RX_ENC_FLAG_STBC_SHIFT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_SHORTPRE
      +status.enc_flags op RX_ENC_FLAG_SHORTPRE
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_SHORTPRE
      +status.enc_flags & RX_ENC_FLAG_SHORTPRE
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_HT
      +status.enc_flags op RX_ENC_FLAG_HT
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_HT
      +status.enc_flags & RX_ENC_FLAG_HT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_40MHZ
      +status.enc_flags op RX_ENC_FLAG_40MHZ
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_40MHZ
      +status.enc_flags & RX_ENC_FLAG_40MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_SHORT_GI
      +status.enc_flags op RX_ENC_FLAG_SHORT_GI
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_SHORT_GI
      +status.enc_flags & RX_ENC_FLAG_SHORT_GI
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_HT_GF
      +status.enc_flags op RX_ENC_FLAG_HT_GF
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_HT_GF
      +status.enc_flags & RX_ENC_FLAG_HT_GF
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_VHT
      +status.enc_flags op RX_ENC_FLAG_VHT
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_VHT
      +status.enc_flags & RX_ENC_FLAG_VHT
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_STBC_MASK
      +status.enc_flags op RX_ENC_FLAG_STBC_MASK
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_STBC_MASK
      +status.enc_flags & RX_ENC_FLAG_STBC_MASK
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_LDPC
      +status.enc_flags op RX_ENC_FLAG_LDPC
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_LDPC
      +status.enc_flags & RX_ENC_FLAG_LDPC
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_10MHZ
      +status.enc_flags op RX_ENC_FLAG_10MHZ
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_10MHZ
      +status.enc_flags & RX_ENC_FLAG_10MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.flag op RX_FLAG_5MHZ
      +status.enc_flags op RX_ENC_FLAG_5MHZ
      @@
      expression status;
      @@
      -status.flag & RX_FLAG_5MHZ
      +status.enc_flags & RX_ENC_FLAG_5MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.vht_flag op RX_VHT_FLAG_80MHZ
      +status.enc_flags op RX_ENC_FLAG_80MHZ
      @@
      expression status;
      @@
      -status.vht_flag & RX_VHT_FLAG_80MHZ
      +status.enc_flags & RX_ENC_FLAG_80MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.vht_flag op RX_VHT_FLAG_160MHZ
      +status.enc_flags op RX_ENC_FLAG_160MHZ
      @@
      expression status;
      @@
      -status.vht_flag & RX_VHT_FLAG_160MHZ
      +status.enc_flags & RX_ENC_FLAG_160MHZ
      
      @@
      assignment operator op;
      expression status;
      @@
      -status.vht_flag op RX_VHT_FLAG_BF
      +status.enc_flags op RX_ENC_FLAG_BF
      @@
      expression status;
      @@
      -status.vht_flag & RX_VHT_FLAG_BF
      +status.enc_flags & RX_ENC_FLAG_BF
      
      @@
      assignment operator op;
      expression status, STBC;
      @@
      -status.flag op STBC << RX_FLAG_STBC_SHIFT
      +status.enc_flags op STBC << RX_ENC_FLAG_STBC_SHIFT
      
      @@
      @@
      -RX_FLAG_STBC_SHIFT
      +RX_ENC_FLAG_STBC_SHIFT
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      7fdd69c5
  2. 27 4月, 2017 10 次提交
  3. 26 4月, 2017 4 次提交
    • J
      mac80211: rewrite monitor mode delivery logic · 127f60bf
      Johannes Berg 提交于
      The monitor mode delivery logic makes it hard to add any
      kind of filtering in an efficient way, because the monitor
      SKB is created first and then passed to all interfaces.
      
      Rewrite the logic to create the monitor SKB the first time
      it's actually needed, and then keep delivering it.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      127f60bf
    • V
      cfg80211: Fix dfs state propagation for non-DFS center channel · cd50ac0f
      Vasanthakumar Thiagarajan 提交于
      When part of a bigger bandwidth (160 MHz) channel falls in DFS
      channel range it is possible that the  center frequency may not
      necessarily be a radar channel. Remove the sanity check on channel
      flag for IEEE80211_CHAN_RADAR in regulatory_propagate_dfs_state(),
      this should fix the dfs state propagation for non-DFS center freq
      which has DFS channels in it's bandwidth, should also fix unnecessary
      WARN_ON() spam in regulatory_propagate_dfs_state().
      
      Fixes: 89766727 ("cfg80211: Share Channel DFS state across wiphys of same DFS domain")
      Reported-by: NJohannes Berg <johannes@sipsolutions.net>
      Signed-off-by: NVasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      cd50ac0f
    • W
      drivers: net: xgene-v2: Fix error return code in xge_mdio_config() · 5e1fc7c5
      Wei Yongjun 提交于
      Fix to return error code -ENODEV from the no PHY found error
      handling case instead of 0, as done elsewhere in this function.
      Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      5e1fc7c5
    • D
      net: Generic XDP · b5cdae32
      David S. Miller 提交于
      This provides a generic SKB based non-optimized XDP path which is used
      if either the driver lacks a specific XDP implementation, or the user
      requests it via a new IFLA_XDP_FLAGS value named XDP_FLAGS_SKB_MODE.
      
      It is arguable that perhaps I should have required something like
      this as part of the initial XDP feature merge.
      
      I believe this is critical for two reasons:
      
      1) Accessibility.  More people can play with XDP with less
         dependencies.  Yes I know we have XDP support in virtio_net, but
         that just creates another depedency for learning how to use this
         facility.
      
         I wrote this to make life easier for the XDP newbies.
      
      2) As a model for what the expected semantics are.  If there is a pure
         generic core implementation, it serves as a semantic example for
         driver folks adding XDP support.
      
      One thing I have not tried to address here is the issue of
      XDP_PACKET_HEADROOM, thanks to Daniel for spotting that.  It seems
      incredibly expensive to do a skb_cow(skb, XDP_PACKET_HEADROOM) or
      whatever even if the XDP program doesn't try to push headers at all.
      I think we really need the verifier to somehow propagate whether
      certain XDP helpers are used or not.
      
      v5:
       - Handle both negative and positive offset after running prog
       - Fix mac length in XDP_TX case (Alexei)
       - Use rcu_dereference_protected() in free_netdev (kbuild test robot)
      
      v4:
       - Fix MAC header adjustmnet before calling prog (David Ahern)
       - Disable LRO when generic XDP is installed (Michael Chan)
       - Bypass qdisc et al. on XDP_TX and record the event (Alexei)
       - Do not perform generic XDP on reinjected packets (DaveM)
      
      v3:
       - Make sure XDP program sees packet at MAC header, push back MAC
         header if we do XDP_TX.  (Alexei)
       - Elide GRO when generic XDP is in use.  (Alexei)
       - Add XDP_FLAG_SKB_MODE flag which the user can use to request generic
         XDP even if the driver has an XDP implementation.  (Alexei)
       - Report whether SKB mode is in use in rtnl_xdp_fill() via XDP_FLAGS
         attribute.  (Daniel)
      
      v2:
       - Add some "fall through" comments in switch statements based
         upon feedback from Andrew Lunn
       - Use RCU for generic xdp_prog, thanks to Johannes Berg.
      Tested-by: NAndy Gospodarek <andy@greyhouse.net>
      Tested-by: NJesper Dangaard Brouer <brouer@redhat.com>
      Tested-by: NDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b5cdae32
  4. 25 4月, 2017 18 次提交