1. 07 5月, 2019 2 次提交
  2. 23 4月, 2019 2 次提交
    • K
      ath10k: fix use-after-free on SDIO data frames · 30382dd1
      Kalle Valo 提交于
      With SDIO there's a use after free after a data frame is transfered, call stack
      below. This happens because ath10k_htt_tx_hl() directly transmits the skb
      provided by mac80211 using ath10k_htc_send(), all other HTT functions use
      separate skb created with ath10k_htc_alloc_skb() to transmit the HTC packet.
      After the packet is transmitted mac80211 frees the skb in ieee80211_tx_status()
      but HTT layer expects  that it still owns the skb, and frees it in
      ath10k_htt_htc_tx_complete().
      
      To fix this take a reference of skb before sending it to HTC layer to make sure
      we still own the skb.
      
      Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1.
      ath10k_htt_tx_hl() is only used by SDIO and USB so other busses (PCI, AHB and
      SNOC) should be unaffected.
      
      call stack of use-after-free:
      dump_backtrace+0x0/0x2d8
      show_stack+0x20/0x2c
      __dump_stack+0x20/0x28
      dump_stack+0xc8/0xec
      print_address_description+0x74/0x240
      kasan_report+0x258/0x274
      __asan_report_load4_noabort+0x20/0x28
      skb_pull+0xbc/0x114
      ath10k_htc_notify_tx_completion+0x190/0x2a4 [ath10k_core]
      ath10k_sdio_write_async_work+0x1e4/0x2c4 [ath10k_sdio]
      process_one_work+0x3d8/0x8b0
      worker_thread+0x518/0x7e0
      kthread+0x260/0x278
      ret_from_fork+0x10/0x18
      
      Allocated by one task:
      kasan_kmalloc+0xa0/0x13c
      kasan_slab_alloc+0x14/0x1c
      kmem_cache_alloc+0x144/0x208
      __alloc_skb+0xec/0x394
      alloc_skb_with_frags+0x8c/0x374
      sock_alloc_send_pskb+0x520/0x5d4
      sock_alloc_send_skb+0x40/0x50
      __ip_append_data+0xf5c/0x1858
      ip_make_skb+0x194/0x1d4
      udp_sendmsg+0xf24/0x1ab8
      inet_sendmsg+0x1b0/0x2e0
      sock_sendmsg+0x88/0xa0
      __sys_sendto+0x220/0x3a8
      __arm64_sys_sendto+0x78/0x80
      el0_svc_common+0x120/0x1e0
      el0_svc_compat_handler+0x64/0x80
      el0_svc_compat+0x8/0x18
      
      Freed by another task:
      __kasan_slab_free+0x120/0x1d4
      kasan_slab_free+0x10/0x1c
      kmem_cache_free+0x74/0x504
      kfree_skbmem+0x88/0xc8
      __kfree_skb+0x24/0x2c
      consume_skb+0x114/0x18c
      __ieee80211_tx_status+0xb7c/0xf60 [mac80211]
      ieee80211_tx_status+0x224/0x270 [mac80211]
      ath10k_txrx_tx_unref+0x564/0x950 [ath10k_core]
      ath10k_htt_t2h_msg_handler+0x178c/0x2a38 [ath10k_core]
      ath10k_htt_htc_t2h_msg_handler+0x20/0x30 [ath10k_core]
      ath10k_sdio_irq_handler+0xcc0/0x1654 [ath10k_sdio]
      process_sdio_pending_irqs+0xec/0x358
      sdio_run_irqs+0x68/0xe4
      sdio_irq_work+0x1c/0x28
      process_one_work+0x3d8/0x8b0
      worker_thread+0x518/0x7e0
      kthread+0x260/0x278
      ret_from_fork+0x10/0x18
      Reported-by: NWen Gong <wgong@codeaurora.org>
      Tested-by: NWen Gong <wgong@codeaurora.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      30382dd1
    • A
      ath10k: htt: support MSDU ids with SDIO · 8ea51e40
      Alagu Sankar 提交于
      Transmit completion for SDIO is similar to PCIe, modify the high
      latency path to allow SDIO modules to use the msdu id.
      
      kvalo: the original patch from Alagu enabled this only for SDIO but I'm not
      sure should we also enable this with USB. I'll use bus params to enable this
      for so that it's easy to enable also for USB later.
      
      Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1.
      Co-developed-by: NWen Gong <wgong@codeaurora.org>
      Signed-off-by: NAlagu Sankar <alagusankar@silex-india.com>
      Signed-off-by: Wen Gong <wgong@codeaurora.org>.
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      8ea51e40
  3. 20 2月, 2019 1 次提交
  4. 12 2月, 2019 1 次提交
  5. 04 2月, 2019 2 次提交
  6. 07 9月, 2018 4 次提交
  7. 31 7月, 2018 1 次提交
  8. 28 6月, 2018 1 次提交
  9. 13 6月, 2018 1 次提交
  10. 24 4月, 2018 1 次提交
    • R
      ath10k: enable hw checksum for wcn3990 · 20529b33
      Rakesh Pillai 提交于
      By default ath10k driver enables the support for HW_CHECKSUM
      (NETIF_F_HW_CSUM). Since the TCP/UDP checksum calculation is not enabled
      in the wcn3990 firmware the checksum is incorrect in the TCP/UDP packets
      and all patckets are dropped. But due note that wcn3990 support in
      ath10k is still incomplete so this isn't a critical fix (yet).
      
      Enable hw checksum calculations in wcn3990 hardware by
      setting the proper flags in msdu descriptor tso flags.
      Signed-off-by: NRakesh Pillai <pillair@codeaurora.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      20529b33
  11. 20 4月, 2018 1 次提交
  12. 27 12月, 2017 4 次提交
  13. 05 4月, 2017 1 次提交
  14. 15 12月, 2016 1 次提交
    • M
      ath10k: Avoid potential page alloc BUG_ON in tx free path · 02a9e08d
      Mohammed Shafi Shajakhan 提交于
      'ath10k_htt_tx_free_cont_txbuf' and 'ath10k_htt_tx_free_cont_frag_desc'
      have NULL pointer checks to avoid crash if they are called twice
      but this is as of now not sufficient as these pointers are not assigned
      to NULL once the contiguous DMA memory allocation is freed, fix this.
      Though this may not be hit with the explicity check of state variable
      'tx_mem_allocated' check, good to have this addressed as well.
      
      Below BUG_ON is hit when the above scenario is simulated
      with kernel debugging enabled
      
       page:f6d09a00 count:0 mapcount:-127 mapping:  (null)
      index:0x0
       flags: 0x40000000()
       page dumped because: VM_BUG_ON_PAGE(page_ref_count(page)
      == 0)
       ------------[ cut here ]------------
       kernel BUG at ./include/linux/mm.h:445!
       invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
       EIP is at put_page_testzero.part.88+0xd/0xf
       Call Trace:
        [<c118a2cc>] __free_pages+0x3c/0x40
        [<c118a30e>] free_pages+0x3e/0x50
        [<c10222b4>] dma_generic_free_coherent+0x24/0x30
        [<f8c1d9a8>] ath10k_htt_tx_free_cont_txbuf+0xf8/0x140
      
        [<f8c1e2a9>] ath10k_htt_tx_destroy+0x29/0xa0
      
        [<f8c143e0>] ath10k_core_destroy+0x60/0x80 [ath10k_core]
        [<f8acd7e9>] ath10k_pci_remove+0x79/0xa0 [ath10k_pci]
        [<c13ed7a8>] pci_device_remove+0x38/0xb0
        [<c14d3492>] __device_release_driver+0x72/0x100
        [<c14d36b7>] driver_detach+0x97/0xa0
        [<c14d29c0>] bus_remove_driver+0x40/0x80
        [<c14d427a>] driver_unregister+0x2a/0x60
        [<c13ec768>] pci_unregister_driver+0x18/0x70
        [<f8aced4f>] ath10k_pci_exit+0xd/0x2be [ath10k_pci]
        [<c1101e78>] SyS_delete_module+0x158/0x210
        [<c11b34f1>] ? __might_fault+0x41/0xa0
        [<c11b353b>] ? __might_fault+0x8b/0xa0
        [<c1001a4b>] do_fast_syscall_32+0x9b/0x1c0
        [<c178da34>] sysenter_past_esp+0x45/0x74
      Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      02a9e08d
  15. 01 12月, 2016 1 次提交
    • M
      ath10k: fix Tx DMA alloc failure during continuous wifi down/up · 9ec34a86
      Mohammed Shafi Shajakhan 提交于
      With maximum number of vap's configured in a two radio supported
      systems of ~256 Mb RAM, doing a continuous wifi down/up and
      intermittent traffic streaming from the connected stations results
      in failure to allocate contiguous memory for tx buffers. This results
      in the disappearance of all VAP's and a manual reboot is needed as
      this is not a crash (or) OOM(for OOM killer to be invoked). To address
      this allocate contiguous memory for tx buffers one time and re-use them
      until the modules are unloaded but this results in a slight increase in
      memory footprint of ath10k when the wifi is down, but the modules are
      still loaded. Also as of now we use a separate bool 'tx_mem_allocated'
      to keep track of the one time memory allocation, as we cannot come up
      with something like 'ath10k_tx_{register,unregister}' before
      'ath10k_probe_fw' is called as 'ath10k_htt_tx_alloc_cont_frag_desc'
      memory allocation is dependent on the hw_param 'continuous_frag_desc'
      
      a) memory footprint of ath10k without the change
      
      lsmod | grep ath10k
      ath10k_core           414498  1 ath10k_pci
      ath10k_pci             38236  0
      
      b) memory footprint of ath10k with the change
      
      ath10k_core           414980  1 ath10k_pci
      ath10k_pci             38236  0
      
      Memory Failure Call trace:
      
      hostapd: page allocation failure: order:6, mode:0xd0
       [<c021f150>] (__dma_alloc_buffer.isra.23) from
      [<c021f23c>] (__alloc_remap_buffer.isra.26+0x14/0xb8)
      [<c021f23c>] (__alloc_remap_buffer.isra.26) from
      [<c021f664>] (__dma_alloc+0x224/0x2b8)
      [<c021f664>] (__dma_alloc) from [<c021f810>]
      (arm_dma_alloc+0x84/0x90)
      [<c021f810>] (arm_dma_alloc) from [<bf954764>]
      (ath10k_htt_tx_alloc+0xe0/0x2e4 [ath10k_core])
      [<bf954764>] (ath10k_htt_tx_alloc [ath10k_core]) from
      [<bf94e6ac>] (ath10k_core_start+0x538/0xcf8 [ath10k_core])
      [<bf94e6ac>] (ath10k_core_start [ath10k_core]) from
      [<bf947eec>] (ath10k_start+0xbc/0x56c [ath10k_core])
      [<bf947eec>] (ath10k_start [ath10k_core]) from
      [<bf8a7a04>] (drv_start+0x40/0x5c [mac80211])
      [<bf8a7a04>] (drv_start [mac80211]) from [<bf8b7cf8>]
      (ieee80211_do_open+0x170/0x82c [mac80211])
      [<bf8b7cf8>] (ieee80211_do_open [mac80211]) from
      [<c056afc8>] (__dev_open+0xa0/0xf4)
      [21053.491752] Normal: 641*4kB (UEMR) 505*8kB (UEMR) 330*16kB (UEMR)
      126*32kB (UEMR) 762*64kB (UEMR) 237*128kB (UEMR) 1*256kB (M) 0*512kB
      0*1024kB 0*2048kB 0*4096kB = 95276kB
      Signed-off-by: NMohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      9ec34a86
  16. 15 11月, 2016 2 次提交
  17. 09 9月, 2016 1 次提交
    • R
      ath10k: implement NAPI support · 3c97f5de
      Rajkumar Manoharan 提交于
      Add NAPI support for rx and tx completion. NAPI poll is scheduled
      from interrupt handler. The design is as below
      
       - on interrupt
           - schedule napi and mask interrupts
       - on poll
         - process all pipes (no actual Tx/Rx)
         - process Rx within budget
         - if quota exceeds budget reschedule napi poll by returning budget
         - process Tx completions and update budget if necessary
         - process Tx fetch indications (pull-push)
         - push any other pending Tx (if possible)
         - before resched or napi completion replenish htt rx ring buffer
         - if work done < budget, complete napi poll and unmask interrupts
      
      This change also get rid of two tasklets (intr_tq and txrx_compl_task).
      
      Measured peak throughput with NAPI on IPQ4019 platform in controlled
      environment. No noticeable reduction in throughput is seen and also
      observed improvements in CPU usage. Approx. 15% CPU usage got reduced
      in UDP uplink case.
      
      DL: AP DUT Tx
      UL: AP DUT Rx
      
      IPQ4019 (avg. cpu usage %)
      
      ========
                      TOT              +NAPI
                    ===========      =============
      TCP DL       644 Mbps (42%)    645 Mbps (36%)
      TCP UL       673 Mbps (30%)    675 Mbps (26%)
      UDP DL       682 Mbps (49%)    680 Mbps (49%)
      UDP UL       720 Mbps (28%)    717 Mbps (11%)
      Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      3c97f5de
  18. 08 7月, 2016 1 次提交
  19. 30 6月, 2016 1 次提交
    • B
      ath10k: fix potential null dereference bugs · a66cd733
      Bob Copeland 提交于
      Smatch warns about a number of cases in ath10k where a pointer is
      null-checked after it has already been dereferenced, in code involving
      ath10k private virtual interface pointers.
      
      Fix these by making the dereference happen later.
      
      Addresses the following smatch warnings:
      
      drivers/net/wireless/ath/ath10k/mac.c:3651 ath10k_mac_txq_init() warn: variable dereferenced before check 'txq' (see line 3649)
      drivers/net/wireless/ath/ath10k/mac.c:3664 ath10k_mac_txq_unref() warn: variable dereferenced before check 'txq' (see line 3659)
      drivers/net/wireless/ath/ath10k/htt_tx.c:70 __ath10k_htt_tx_txq_recalc() warn: variable dereferenced before check 'txq->sta' (see line 52)
      drivers/net/wireless/ath/ath10k/htt_tx.c:740 ath10k_htt_tx_get_vdev_id() warn: variable dereferenced before check 'cb->vif' (see line 736)
      drivers/net/wireless/ath/ath10k/txrx.c:86 ath10k_txrx_tx_unref() warn: variable dereferenced before check 'txq' (see line 84)
      drivers/net/wireless/ath/ath10k/wmi.c:1837 ath10k_wmi_op_gen_mgmt_tx() warn: variable dereferenced before check 'cb->vif' (see line 1825)
      Signed-off-by: NBob Copeland <me@bobcopeland.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      a66cd733
  20. 21 4月, 2016 1 次提交
  21. 04 4月, 2016 1 次提交
  22. 18 3月, 2016 1 次提交
    • R
      ath10k: move mgmt descriptor limit handle under mgmt_tx · cac08552
      Rajkumar Manoharan 提交于
      Frames that are transmitted via MGMT_TX are using reserved descriptor
      slots in firmware. This limitation is for the htt_mgmt_tx path itself,
      not for mgmt frames per se. In 16 MBSSID scenario, these reserved slots
      will be easy exhausted due to frequent probe responses. So for 10.4
      based solutions, probe responses are limited by a threshold (24).
      
      management tx path is separate for all except tlv based solutions. Since
      tlv solutions (qca6174 & qca9377) do not support 16 AP interfaces, it is
      safe to move management descriptor limitation check under mgmt_tx
      function. Though CPU improvement is negligible, unlikely conditions or
      never hit conditions in hot path can be avoided on data transmission.
      Signed-off-by: NRajkumar Manoharan <rmanohar@qti.qualcomm.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      cac08552
  23. 06 3月, 2016 4 次提交
    • M
      ath10k: implement push-pull tx · 426e10ea
      Michal Kazior 提交于
      The current/old tx path design was that host, at
      its own leisure, pushed tx frames to the device.
      For HTT there was ~1000-1400 msdu queue depth.
      
      After reaching that limit the driver would request
      mac80211 to stop queues. There was little control
      over what packets got in there as far as
      DA/RA was considered so it was rather easy to
      starve per-station traffic flows.
      
      With MU-MIMO this became a significant problem
      because the queue depth was insufficient to buffer
      frames from multiple clients (which could have
      different signal quality and capabilities) in an
      efficient fashion.
      
      Hence the new tx path in 10.4 was introduced: a
      pull-push mode.
      
      Firmware and host can share tx queue state via
      DMA. The state is logically a 2 dimensional array
      addressed via peer_id+tid pair. Each entry is a
      counter (either number of bytes or packets. Host
      keeps it updated and firmware uses it for
      scheduling Tx pull requests to host.
      
      This allows MU-MIMO to become a lot more effective
      with 10+ clients.
      Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      426e10ea
    • M
      ath10k: implement updating shared htt txq state · c1a43d97
      Michal Kazior 提交于
      Firmware 10.4.3 onwards can support a pull-push Tx
      model where it shares a Tx queue state with the
      host.
      
      The host updates the DMA region it pointed to
      during HTT setup whenever number of software
      queued from (on host) changes. Based on this
      information firmware issues fetch requests to the
      host telling the host how many frames from a list
      of given stations/tids should be submitted to the
      firmware.
      
      The code won't be called because not all
      appropriate HTT events are processed yet.
      Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      c1a43d97
    • M
      ath10k: add new htt message generation/parsing logic · 839ae637
      Michal Kazior 提交于
      This merely adds some parsing, generation and
      sanity checks with placeholders for real
      code/functionality to be added later.
      Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      839ae637
    • M
      ath10k: refactor tx pending management · 6421969f
      Michal Kazior 提交于
      Tx pending counter logic assumed that the sk_buff
      is already known and hence was performed in HTT
      functions themselves.
      
      However, for the sake of future wake_tx_queue()
      usage the driver must be able to tell whether it
      can submit more frames to firmware before it
      dequeues frame from ieee80211_txq (and thus long
      before HTT Tx functions are called) because once a
      frame is dequeued it cannot be requeud back to
      mac80211.
      
      This prepares the driver for future changes.
      Signed-off-by: NMichal Kazior <michal.kazior@tieto.com>
      Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
      6421969f
  24. 28 1月, 2016 2 次提交
  25. 30 11月, 2015 1 次提交
  26. 23 11月, 2015 1 次提交