1. 29 3月, 2018 1 次提交
  2. 23 2月, 2018 2 次提交
    • T
      mac80211: Adjust TSQ pacing shift · 36148c2b
      Toke Høiland-Jørgensen 提交于
      Since we now have the convenient helper to do so, actually adjust the
      TSQ pacing shift for packets going out over a WiFi interface. This
      significantly improves throughput for locally-originated TCP
      connections. The default pacing shift of 10 corresponds to ~1ms of
      queued packet data. Adjusting this to a shift of 8 (i.e. ~4ms) improves
      1-hop throughput for ath9k by a factor of 3, whereas increasing it more
      has diminishing returns.
      
      Achieved throughput for different values of sk_pacing_shift (average of
      5 iterations of 10-sec netperf runs to a host on the other side of the
      WiFi hop):
      
      sk_pacing_shift 10:  43.21 Mbps (pre-patch)
      sk_pacing_shift  9:  78.17 Mbps
      sk_pacing_shift  8: 123.94 Mbps
      sk_pacing_shift  7: 128.31 Mbps
      
      Latency for competing flows increases from ~3 ms to ~10 ms with this
      change. This is about the same magnitude of queueing latency induced by
      flows that are not originated on the WiFi device itself (and so are not
      limited by TSQ).
      Signed-off-by: NToke Høiland-Jørgensen <toke@toke.dk>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      36148c2b
    • S
      mac80211: add get TID helper · a1f2ba04
      Sara Sharon 提交于
      Extracting the TID from the QOS header is common enough
      to justify helper.
      Signed-off-by: NSara Sharon <sara.sharon@intel.com>
      Signed-off-by: NLuca Coelho <luciano.coelho@intel.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      a1f2ba04
  3. 19 2月, 2018 1 次提交
  4. 19 12月, 2017 2 次提交
  5. 11 12月, 2017 3 次提交
  6. 27 11月, 2017 1 次提交
  7. 11 10月, 2017 1 次提交
  8. 05 9月, 2017 1 次提交
    • J
      mac80211: fix VLAN handling with TXQs · 53168215
      Johannes Berg 提交于
      With TXQs, the AP_VLAN interfaces are resolved to their owner AP
      interface when enqueuing the frame, which makes sense since the
      frame really goes out on that as far as the driver is concerned.
      
      However, this introduces a problem: frames to be encrypted with
      a VLAN-specific GTK will now be encrypted with the AP GTK, since
      the information about which virtual interface to use to select
      the key is taken from the TXQ.
      
      Fix this by preserving info->control.vif and using that in the
      dequeue function. This now requires doing the driver-mapping
      in the dequeue as well.
      
      Since there's no way to filter the frames that are sitting on a
      TXQ, drop all frames, which may affect other interfaces, when an
      AP_VLAN is removed.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      53168215
  9. 16 6月, 2017 4 次提交
    • J
      networking: make skb_push & __skb_push return void pointers · d58ff351
      Johannes Berg 提交于
      It seems like a historic accident that these return unsigned char *,
      and in many places that means casts are required, more often than not.
      
      Make these functions return void * and remove all the casts across
      the tree, adding a (u8 *) cast only where the unsigned char pointer
      was used directly, all done with the following spatch:
      
          @@
          expression SKB, LEN;
          typedef u8;
          identifier fn = { skb_push, __skb_push, skb_push_rcsum };
          @@
          - *(fn(SKB, LEN))
          + *(u8 *)fn(SKB, LEN)
      
          @@
          expression E, SKB, LEN;
          identifier fn = { skb_push, __skb_push, skb_push_rcsum };
          type T;
          @@
          - E = ((T *)(fn(SKB, LEN)))
          + E = fn(SKB, LEN)
      
          @@
          expression SKB, LEN;
          identifier fn = { skb_push, __skb_push, skb_push_rcsum };
          @@
          - fn(SKB, LEN)[0]
          + *(u8 *)fn(SKB, LEN)
      
      Note that the last part there converts from push(...)[0] to the
      more idiomatic *(u8 *)push(...).
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d58ff351
    • J
      networking: make skb_put & friends return void pointers · 4df864c1
      Johannes Berg 提交于
      It seems like a historic accident that these return unsigned char *,
      and in many places that means casts are required, more often than not.
      
      Make these functions (skb_put, __skb_put and pskb_put) return void *
      and remove all the casts across the tree, adding a (u8 *) cast only
      where the unsigned char pointer was used directly, all done with the
      following spatch:
      
          @@
          expression SKB, LEN;
          typedef u8;
          identifier fn = { skb_put, __skb_put };
          @@
          - *(fn(SKB, LEN))
          + *(u8 *)fn(SKB, LEN)
      
          @@
          expression E, SKB, LEN;
          identifier fn = { skb_put, __skb_put };
          type T;
          @@
          - E = ((T *)(fn(SKB, LEN)))
          + E = fn(SKB, LEN)
      
      which actually doesn't cover pskb_put since there are only three
      users overall.
      
      A handful of stragglers were converted manually, notably a macro in
      drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many
      instances in net/bluetooth/hci_sock.c. In the former file, I also
      had to fix one whitespace problem spatch introduced.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4df864c1
    • J
      networking: introduce and use skb_put_data() · 59ae1d12
      Johannes Berg 提交于
      A common pattern with skb_put() is to just want to memcpy()
      some data into the new space, introduce skb_put_data() for
      this.
      
      An spatch similar to the one for skb_put_zero() converts many
      of the places using it:
      
          @@
          identifier p, p2;
          expression len, skb, data;
          type t, t2;
          @@
          (
          -p = skb_put(skb, len);
          +p = skb_put_data(skb, data, len);
          |
          -p = (t)skb_put(skb, len);
          +p = skb_put_data(skb, data, len);
          )
          (
          p2 = (t2)p;
          -memcpy(p2, data, len);
          |
          -memcpy(p, data, len);
          )
      
          @@
          type t, t2;
          identifier p, p2;
          expression skb, data;
          @@
          t *p;
          ...
          (
          -p = skb_put(skb, sizeof(t));
          +p = skb_put_data(skb, data, sizeof(t));
          |
          -p = (t *)skb_put(skb, sizeof(t));
          +p = skb_put_data(skb, data, sizeof(t));
          )
          (
          p2 = (t2)p;
          -memcpy(p2, data, sizeof(*p));
          |
          -memcpy(p, data, sizeof(*p));
          )
      
          @@
          expression skb, len, data;
          @@
          -memcpy(skb_put(skb, len), data, len);
          +skb_put_data(skb, data, len);
      
      (again, manually post-processed to retain some comments)
      Reviewed-by: NStephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      59ae1d12
    • J
      networking: convert many more places to skb_put_zero() · b080db58
      Johannes Berg 提交于
      There were many places that my previous spatch didn't find,
      as pointed out by yuan linyu in various patches.
      
      The following spatch found many more and also removes the
      now unnecessary casts:
      
          @@
          identifier p, p2;
          expression len;
          expression skb;
          type t, t2;
          @@
          (
          -p = skb_put(skb, len);
          +p = skb_put_zero(skb, len);
          |
          -p = (t)skb_put(skb, len);
          +p = skb_put_zero(skb, len);
          )
          ... when != p
          (
          p2 = (t2)p;
          -memset(p2, 0, len);
          |
          -memset(p, 0, len);
          )
      
          @@
          type t, t2;
          identifier p, p2;
          expression skb;
          @@
          t *p;
          ...
          (
          -p = skb_put(skb, sizeof(t));
          +p = skb_put_zero(skb, sizeof(t));
          |
          -p = (t *)skb_put(skb, sizeof(t));
          +p = skb_put_zero(skb, sizeof(t));
          )
          ... when != p
          (
          p2 = (t2)p;
          -memset(p2, 0, sizeof(*p));
          |
          -memset(p, 0, sizeof(*p));
          )
      
          @@
          expression skb, len;
          @@
          -memset(skb_put(skb, len), 0, len);
          +skb_put_zero(skb, len);
      
      Apply it to the tree (with one manual fixup to keep the
      comment in vxlan.c, which spatch removed.)
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b080db58
  10. 17 5月, 2017 1 次提交
    • T
      mac80211: Dynamically set CoDel parameters per station · 484a54c2
      Toke Høiland-Jørgensen 提交于
      CoDel can be too aggressive if a station sends at a very low rate,
      leading reduced throughput. This gets worse the more stations are
      present, as each station gets more bursty the longer the round-robin
      scheduling between stations takes.
      
      This adds dynamic adjustment of CoDel parameters per station. It uses
      the rate selection information to estimate throughput and sets more
      lenient CoDel parameters if the estimated throughput is below a
      threshold (modified by the number of active stations).
      
      A new callback is added that drivers can use to notify mac80211 about
      changes in expected throughput, so the same adjustment can be made for
      cards that implement rate control in firmware. Drivers that don't use
      this will just get the default parameters.
      Signed-off-by: NToke Høiland-Jørgensen <toke@toke.dk>
      [remove currently unnecessary EXPORT_SYMBOL, fix kernel-doc, remove
      inline annotation]
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      484a54c2
  11. 28 4月, 2017 1 次提交
    • M
      mac80211: Fix possible sband related NULL pointer de-reference · 21a8e9dd
      Mohammed Shafi Shajakhan 提交于
      Existing API 'ieee80211_get_sdata_band' returns default 2 GHz band even
      if the channel context configuration is NULL. This crashes for chipsets
      which support 5 Ghz alone when it tries to access members of 'sband'.
      Channel context configuration can be NULL in multivif case and when
      channel switch is in progress (or) when it fails. Fix this by replacing
      the API 'ieee80211_get_sdata_band' with  'ieee80211_get_sband' which
      returns a NULL pointer for sband when the channel configuration is NULL.
      
      An example scenario is as below:
      
      In multivif mode (AP + STA) with drivers like ath10k, when we do a
      channel switch in the AP vif (which has a number of clients connected)
      and a STA vif which is connected to some other AP, when the channel
      switch in AP vif fails, while the STA vifs tries to connect to the
      other AP, there is a window where the channel context is NULL/invalid
      and this results in a crash  while the clients connected to the AP vif
      tries to reconnect and this race is very similar to the one investigated
      by Michal in https://patchwork.kernel.org/patch/3788161/ and this does
      happens with hardware that supports 5Ghz alone after long hours of
      testing with continuous channel switch on the AP vif
      
      ieee80211 phy0: channel context reservation cannot be finalized because
      some interfaces aren't switching
      wlan0: failed to finalize CSA, disconnecting
      wlan0-1: deauthenticating from 8c:fd:f0:01:54:9c by local choice
      	(Reason: 3=DEAUTH_LEAVING)
      
      	WARNING: CPU: 1 PID: 19032 at net/mac80211/ieee80211_i.h:1013 sta_info_alloc+0x374/0x3fc [mac80211]
      	[<bf77272c>] (sta_info_alloc [mac80211])
      	[<bf78776c>] (ieee80211_add_station [mac80211]))
      	[<bf73cc50>] (nl80211_new_station [cfg80211])
      
      	Unable to handle kernel NULL pointer dereference at virtual
      	address 00000014
      	pgd = d5f4c000
      	Internal error: Oops: 17 [#1] PREEMPT SMP ARM
      	PC is at sta_info_alloc+0x380/0x3fc [mac80211]
      	LR is at sta_info_alloc+0x37c/0x3fc [mac80211]
      	[<bf772738>] (sta_info_alloc [mac80211])
      	[<bf78776c>] (ieee80211_add_station [mac80211])
      	[<bf73cc50>] (nl80211_new_station [cfg80211]))
      
      Cc: Michal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      21a8e9dd
  12. 07 3月, 2017 1 次提交
  13. 26 1月, 2017 1 次提交
  14. 13 1月, 2017 1 次提交
    • M
      mac80211: prevent skb/txq mismatch · dbef5362
      Michal Kazior 提交于
      Station structure is considered as not uploaded
      (to driver) until drv_sta_state() finishes. This
      call is however done after the structure is
      attached to mac80211 internal lists and hashes.
      This means mac80211 can lookup (and use) station
      structure before it is uploaded to a driver.
      
      If this happens (structure exists, but
      sta->uploaded is false) fast_tx path can still be
      taken. Deep in the fastpath call the sta->uploaded
      is checked against to derive "pubsta" argument for
      ieee80211_get_txq(). If sta->uploaded is false
      (and sta is actually non-NULL) ieee80211_get_txq()
      effectively downgraded to vif->txq.
      
      At first glance this may look innocent but coerces
      mac80211 into a state that is almost guaranteed
      (codel may drop offending skb) to crash because a
      station-oriented skb gets queued up on
      vif-oriented txq. The ieee80211_tx_dequeue() ends
      up looking at info->control.flags and tries to use
      txq->sta which in the fail case is NULL.
      
      It's probably pointless to pretend one can
      downgrade skb from sta-txq to vif-txq.
      
      Since downgrading unicast traffic to vif->txq must
      not be done there's no txq to put a frame on if
      sta->uploaded is false. Therefore the code is made
      to fall back to regular tx() op path if the
      described condition is hit.
      
      Only drivers using wake_tx_queue were affected.
      
      Example crash dump before fix:
      
       Unable to handle kernel paging request at virtual address ffffe26c
       PC is at ieee80211_tx_dequeue+0x204/0x690 [mac80211]
       [<bf4252a4>] (ieee80211_tx_dequeue [mac80211]) from
       [<bf4b1388>] (ath10k_mac_tx_push_txq+0x54/0x1c0 [ath10k_core])
       [<bf4b1388>] (ath10k_mac_tx_push_txq [ath10k_core]) from
       [<bf4bdfbc>] (ath10k_htt_txrx_compl_task+0xd78/0x11d0 [ath10k_core])
       [<bf4bdfbc>] (ath10k_htt_txrx_compl_task [ath10k_core])
       [<bf51c5a4>] (ath10k_pci_napi_poll+0x54/0xe8 [ath10k_pci])
       [<bf51c5a4>] (ath10k_pci_napi_poll [ath10k_pci]) from
       [<c0572e90>] (net_rx_action+0xac/0x160)
      Reported-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      dbef5362
  15. 02 1月, 2017 1 次提交
    • J
      mac80211: initialize fast-xmit 'info' later · 35f432a0
      Johannes Berg 提交于
      In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
      that's passed in, but that skb may later be replaced by a clone (if
      it was shared), leading to an invalid pointer.
      
      This can lead to use-after-free and also later crashes since the
      real SKB's info->hw_queue doesn't get initialized properly.
      
      Fix this by assigning info only later, when it's needed, after the
      skb replacement (may have) happened.
      
      Cc: stable@vger.kernel.org
      Reported-by: NBen Greear <greearb@candelatech.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      35f432a0
  16. 15 12月, 2016 1 次提交
  17. 13 12月, 2016 2 次提交
  18. 15 11月, 2016 3 次提交
  19. 19 10月, 2016 1 次提交
  20. 17 10月, 2016 2 次提交
  21. 12 10月, 2016 1 次提交
    • M
      mac80211: filter multicast data packets on AP / AP_VLAN · 72f15d53
      Michael Braun 提交于
      This patch adds filtering for multicast data packets on AP_VLAN
      interfaces that have no authorized station connected and changes
      filtering on AP interfaces to not count stations assigned to
      AP_VLAN interfaces.
      
      This saves airtime and avoids waking up other stations currently
      authorized in this BSS. When using WPA, the packets dropped could
      not be decrypted by any station.
      
      The behaviour when there are no AP_VLAN interfaces is left unchanged.
      
      When there are AP_VLAN interfaces, this patch
      1. adds filtering multicast data packets sent on AP_VLAN interfaces
         that have no authorized station connected.
         No filtering happens on 4addr AP_VLAN interfaces.
      2. makes filtering of multicast data packets sent on AP interfaces
         depend on the number of authorized stations in this bss not
         assigned to an AP_VLAN interface.
      
      Therefore, a new num_mcast_sta counter is added for AP_VLAN interfaces.
      The existing one for AP interfaces is altered to not track stations
      assigned to an AP_VLAN interface.
      
      The new counter is exposed in debugfs.
      Signed-off-by: NMichael Braun <michael-dev@fami-braun.de>
      [reformat commit message a bit, unline ieee80211_vif_{inc,dec}_num_mcast]
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      72f15d53
  22. 30 9月, 2016 3 次提交
  23. 14 9月, 2016 1 次提交
  24. 13 9月, 2016 2 次提交
  25. 12 9月, 2016 2 次提交