* Re: [PATCH v2] net: mwifiex: fix a NULL pointer dereference
From: Kalle Valo @ 2019-03-12 5:41 UTC (permalink / raw)
To: Kangjie Lu
Cc: pakki001, Amitkumar Karwar, Nishant Sarmukadam, Ganapathi Bhat,
Xinming Hu, David S. Miller, linux-wireless, netdev, linux-kernel
In-Reply-To: <20190312053107.5790-1-kjlu@umn.edu>
Kangjie Lu <kjlu@umn.edu> writes:
> In case dev_alloc_skb fails, the fix returns -ENOMEM to avoid
> NULL pointer dereference.
>
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
No changelog, please always add a changelog:
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches#changelog_missing
--
Kalle Valo
^ permalink raw reply
* [PATCH v2] net: mwifiex: fix a NULL pointer dereference
From: Kangjie Lu @ 2019-03-12 5:31 UTC (permalink / raw)
To: kjlu
Cc: pakki001, Amitkumar Karwar, Nishant Sarmukadam, Ganapathi Bhat,
Xinming Hu, Kalle Valo, David S. Miller, linux-wireless, netdev,
linux-kernel
In case dev_alloc_skb fails, the fix returns -ENOMEM to avoid
NULL pointer dereference.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
drivers/net/wireless/marvell/mwifiex/cmdevt.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
index 60db2b969e20..8c35441fd9b7 100644
--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
@@ -341,6 +341,12 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter)
sleep_cfm_tmp =
dev_alloc_skb(sizeof(struct mwifiex_opt_sleep_confirm)
+ MWIFIEX_TYPE_LEN);
+ if (!sleep_cfm_tmp) {
+ mwifiex_dbg(adapter, ERROR,
+ "SLEEP_CFM: dev_alloc_skb failed\n");
+ return -ENOMEM;
+ }
+
skb_put(sleep_cfm_tmp, sizeof(struct mwifiex_opt_sleep_confirm)
+ MWIFIEX_TYPE_LEN);
put_unaligned_le32(MWIFIEX_USB_TYPE_CMD, sleep_cfm_tmp->data);
--
2.17.1
^ permalink raw reply related
* Re: [PATCH v7 00/14] rtw88: mac80211 driver for Realtek 802.11ac wireless network chips
From: Kalle Valo @ 2019-03-12 5:14 UTC (permalink / raw)
To: yhchuang
Cc: johannes, gregkh, linux-wireless, Larry.Finger, sgruszka, pkshih,
tehuang, briannorris
In-Reply-To: <1552139302-20476-1-git-send-email-yhchuang@realtek.com>
<yhchuang@realtek.com> writes:
> From: Yan-Hsuan Chuang <yhchuang@realtek.com>
>
> This is a new mac80211 driver for Realtek 802.11ac wireless network chips.
> rtw88 now supports RTL8822BE/RTL8822CE now, with basic station mode
> functionalities. The firmware for both can be found at linux-firmware.
>
> https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
> For RTL8822BE: rtw88/rtw8822b_fw.bin
> For RTL8822CE: rtw88/rtw8822c_fw.bin
>
> And for now, only PCI buses (RTL8xxxE) are supported. We will add support
> for USB and SDIO in the future. The bus interface abstraction can be seen
> in this driver such as hci.h. Most of the hardware setting are the same
> except for some TRX path or probing setup should be separated.
>
> Supported:
>
> * Basic STA/AP/ADHOC mode, and TDLS (STA is well tested)
>
> Missing feature:
>
> * WOW/PNO
> * USB & SDIO bus (such as RTL8xxxU/RTL8xxxS)
> * BT coexistence (8822B/8822C are combo ICs)
> * Multiple interfaces (for now single STA is better supported)
> * Dynamic hardware calibrations (to improve/stabilize performance)
>
> Potential problems:
>
> * static calibration spends too much time, and it is painful for
> driver to leave IDLE state. And slows down associate process.
> But reload function are under development, will be added soon!
> * TRX statictics misleading, as we are not reporting status correctly,
> or say, not reporting for "every" packet.
>
>
> The next patch set should have BT coexistence code since RTL8822B/C are
> combo ICs, and the driver for BT can be found after Linux Kernel v4.20.
> So it is better to add it first to make WiFi + BT work concurrently.
>
> Although now rtw88 is simple but we are developing more features for it.
> Even we want to add support for more chips such as RTL8821C/RTL8814B.
As we are getting closer to getting the driver accepted first few ground
rules to simplify the review: please don't send a new version until I
explicitly ask for it. Also don't make any changes to the driver unless
explicitly asked by Johannes or me, all other cleanup can be submitted
as followup patches after the driver is accepted.
I applied this now to the pending branch[1] and kbuild bot found one
problem, please fix that in the next version:
tree: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git pending
head: d5ae36c5064e6c036d86da20b5835df5225ba9ff
commit: 72a54e89a08d8747360b4c731c41871e22b6d84e [44/54] rtw88: add 8822c tx agc support
config: x86_64-allyesconfig (attached as .config)
compiler: gcc-8 (Debian 8.3.0-2) 8.3.0
reproduce:
git checkout 72a54e89a08d8747360b4c731c41871e22b6d84e
# save the attached .config to linux build tree
make ARCH=x86_64
All errors (new ones prefixed by >>):
>> ld: drivers/net/wireless/realtek/rtw88/phy.o:(.data+0x360):
>> multiple definition of `cck_rates';
>> drivers/net/wireless/broadcom/brcm80211/brcmsmac/rate.o:(.rodata+0x60):
>> first defined here
>> ld: drivers/net/wireless/realtek/rtw88/phy.o:(.data+0x320):
>> multiple definition of `ofdm_rates';
>> drivers/net/wireless/broadcom/brcm80211/brcmsmac/rate.o:(.rodata+0xc0):
>> first defined here
--
Kalle Valo
^ permalink raw reply
* [PATCH v2] net: brcm80211: fix missing checks for kmemdup
From: Kangjie Lu @ 2019-03-12 4:39 UTC (permalink / raw)
To: kjlu
Cc: pakki001, Arend van Spriel, Franky Lin, Hante Meuleman,
Chi-Hsien Lin, Wright Feng, Kalle Valo, David S. Miller,
Rafał Miłecki, Stefan Wahren, Chung-Hsien Hsu,
linux-wireless, brcm80211-dev-list.pdl, brcm80211-dev-list,
netdev, linux-kernel
In case kmemdup fails, the fix sets conn_info->req_ie_len to zero
to avoid buffer overflows.
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index e92f6351bd22..5d9a3c35fef5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5464,6 +5464,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
conn_info->req_ie =
kmemdup(cfg->extra_buf, conn_info->req_ie_len,
GFP_KERNEL);
+ if (!conn_info->req_ie)
+ conn_info->req_ie_len = 0;
} else {
conn_info->req_ie_len = 0;
conn_info->req_ie = NULL;
@@ -5480,6 +5482,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
conn_info->resp_ie =
kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
GFP_KERNEL);
+ if (!conn_info->resp_ie)
+ conn_info->req_ie_len = 0;
} else {
conn_info->resp_ie_len = 0;
conn_info->resp_ie = NULL;
--
2.17.1
^ permalink raw reply related
* [PATCH] ath10k: Fix the tx stats bytes & packets parsing
From: Brandon Huang @ 2019-03-12 4:33 UTC (permalink / raw)
To: ath10k; +Cc: linux-wireless, Brandon Huang
In tx_stats debugfs, txrate->flags may contain multiple bits. For
example, RATE_INFO_FLAGS_SHORT_GI could be set, and tx stats bytes
and packets will be not updated correctly.
Fix this issue by using bit operation to check txrate->flags.
Tested HW: QCA9984
Tested Firmware: 10.4-3.9.0.1-00007
Signed-off-by: Brandon Huang <yanghuan@codeaurora.org>
---
drivers/net/wireless/ath/ath10k/htt_rx.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index a20ea27..584b86b 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2938,14 +2938,14 @@ static inline s8 ath10k_get_legacy_rate_idx(struct ath10k *ar, u8 rate)
#define STATS_OP_FMT(name) tx_stats->stats[ATH10K_STATS_TYPE_##name]
- if (txrate->flags == RATE_INFO_FLAGS_VHT_MCS) {
+ if (txrate->flags & RATE_INFO_FLAGS_VHT_MCS) {
STATS_OP_FMT(SUCC).vht[0][mcs] += pstats->succ_bytes;
STATS_OP_FMT(SUCC).vht[1][mcs] += pstats->succ_pkts;
STATS_OP_FMT(FAIL).vht[0][mcs] += pstats->failed_bytes;
STATS_OP_FMT(FAIL).vht[1][mcs] += pstats->failed_pkts;
STATS_OP_FMT(RETRY).vht[0][mcs] += pstats->retry_bytes;
STATS_OP_FMT(RETRY).vht[1][mcs] += pstats->retry_pkts;
- } else if (txrate->flags == RATE_INFO_FLAGS_MCS) {
+ } else if (txrate->flags & RATE_INFO_FLAGS_MCS) {
STATS_OP_FMT(SUCC).ht[0][ht_idx] += pstats->succ_bytes;
STATS_OP_FMT(SUCC).ht[1][ht_idx] += pstats->succ_pkts;
STATS_OP_FMT(FAIL).ht[0][ht_idx] += pstats->failed_bytes;
@@ -2966,7 +2966,7 @@ static inline s8 ath10k_get_legacy_rate_idx(struct ath10k *ar, u8 rate)
if (ATH10K_HW_AMPDU(pstats->flags)) {
tx_stats->ba_fails += ATH10K_HW_BA_FAIL(pstats->flags);
- if (txrate->flags == RATE_INFO_FLAGS_MCS) {
+ if (txrate->flags & RATE_INFO_FLAGS_MCS) {
STATS_OP_FMT(AMPDU).ht[0][ht_idx] +=
pstats->succ_bytes + pstats->retry_bytes;
STATS_OP_FMT(AMPDU).ht[1][ht_idx] +=
--
1.9.1
^ permalink raw reply related
* Re: FW: [PATCH] ath10k: fix return value check in wake_tx_q op
From: Yibo Zhao @ 2019-03-12 2:23 UTC (permalink / raw)
To: Erik Stromdahl; +Cc: Kalle Valo, linux-wireless, ath10k, linux-wireless-owner
In-Reply-To: <8c882c7d-41e3-cdc9-34ae-6446970dbc52@gmail.com>
On 2019-03-11 14:44, Erik Stromdahl wrote:
> Hi Yibo,
>
> Sorry for a late reply, but I have been busy with other projects
> lately.
> I have added my comments below
>
> On 3/4/19 2:56 AM, Yibo Zhao wrote:
>> 在 2019-02-25 12:40，Yibo Zhao 写道：
>>> 在 2019-02-07 22:25，Kalle Valo 写道：
>>>> Yibo Zhao <yiboz@codeaurora.org> writes:
>
> I have a few patches related to bundling of TX packets on my private
> repo.
> I have not yet had the time to prepare them for submission.
> This patch is related to that work, but I decided to submit it
> separately
> since I considered it a bugfix.
Great! Really looking forward to your new patch.
>
> <snip>
>
>>>
>>> IMHO, with Erik's change, Erik's change has changed the way fq's
>>> schedule behavior and it looks like there is no other packets in the
>>> fq after a packet has been dequeued. And as a result, this flow's
>>> deficit will be refill and then removed from fq list at once in the
>>> same CPU. And during this time, the other CPU could be blocked. When
>>> new packet comes, same thing happens. So we get equal new flows and
>>> tx-packets.
>>>
>>> Things would be different without Erik's change. After a packet has
>>> been dequeued, this flow's deficit will not be refill immediately in
>>> CPU0. It is possible that the deficit to be refilled in CPU1 while at
>>> the same time CPU0 can fetch data from ethernet. So we can see more
>>> tx-packets delivered to FW from aqm.
>>>
>>>
>>>> Why does this happen only WDS mode? Did you test other modes, like
>>>> AP or
>>>> client mode?
>>> AP mode has same issue. UDP throughput drops more than 10%. As for
>>> TCP, CPU usage rising a lot although throughput stays similiar.
>>> So, I'd say Erik's change does not work for us.
>>
>> Hi Kalle,
>>
>> May I have your comments?
>>
>
> As I wrote in the commit message, the original code will always break
> out of
> the loop after just one iteration.
>
> It is OK with me to bring back the old logic, but I think we should
> skip the
> loop entirely then.
>
> Something like this:
>
> if (ath10k_mac_tx_can_push(hw, txq)) {
> ath10k_mac_tx_push_txq(hw, txq);
> }
Yes, it is the exact way we tried in our private repo. And it works fine
in our setup so far. Not sure it is ok for other situations. Have you
tested on your sdio setup with this change? Any issue observed?
>
>
> Btw, I noticed that the "fair scheduling" mechanism (derived from
> ath9k) from
> Toke have been integrated.
>
> I haven't rebased my tree for a while, so I will most likely have to
> rewrite
> my patches anyway in order to make them work with the new TX
> scheduling.
--
Yibo
^ permalink raw reply
* Re: [PATCH 1/2] ath10k: Fix rate table updation in tx stats
From: kbuild test robot @ 2019-03-11 23:01 UTC (permalink / raw)
To: Rakesh Pillai; +Cc: kbuild-all, ath10k, linux-wireless, Rakesh Pillai
In-Reply-To: <1552319602-17795-2-git-send-email-pillair@codeaurora.org>
[-- Attachment #1: Type: text/plain, Size: 2420 bytes --]
Hi Rakesh,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on ath6kl/ath-next]
[also build test ERROR on next-20190306]
[cannot apply to v5.0]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Rakesh-Pillai/Fix-tx-stats-inconsistencies/20190312-061743
base: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath-next
config: xtensa-allyesconfig (attached as .config)
compiler: xtensa-linux-gcc (GCC) 8.2.0
reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=8.2.0 make.cross ARCH=xtensa
All errors (new ones prefixed by >>):
drivers/net//wireless/ath/ath10k/htt_rx.c: In function 'ath10k_accumulate_per_peer_tx_stats':
>> drivers/net//wireless/ath/ath10k/htt_rx.c:2934:14: error: implicit declaration of function 'ath10k_get_bw'; did you mean 'ath10k_get_tid'? [-Werror=implicit-function-declaration]
rtable_bw = ath10k_get_bw(&ar->hw_params, pstats->flags);
^~~~~~~~~~~~~
ath10k_get_tid
cc1: some warnings being treated as errors
vim +2934 drivers/net//wireless/ath/ath10k/htt_rx.c
2914
2915 static void
2916 ath10k_accumulate_per_peer_tx_stats(struct ath10k *ar,
2917 struct ath10k_sta *arsta,
2918 struct ath10k_per_peer_tx_stats *pstats,
2919 s8 legacy_rate_idx)
2920 {
2921 struct rate_info *txrate = &arsta->txrate;
2922 struct ath10k_htt_tx_stats *tx_stats;
2923 int idx, ht_idx, gi, mcs, bw, nss;
2924 unsigned long flags;
2925 int rtable_bw;
2926
2927 if (!arsta->tx_stats)
2928 return;
2929
2930 tx_stats = arsta->tx_stats;
2931 flags = txrate->flags;
2932 gi = test_bit(ATH10K_RATE_INFO_FLAGS_SGI_BIT, &flags);
2933 mcs = ATH10K_HW_MCS_RATE(pstats->ratecode);
> 2934 rtable_bw = ath10k_get_bw(&ar->hw_params, pstats->flags);
2935 bw = txrate->bw;
2936 nss = txrate->nss;
2937 ht_idx = mcs + (nss - 1) * 8;
2938 idx = mcs * 8 + 8 * 10 * (nss - 1);
2939 idx += rtable_bw * 2 + gi;
2940
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 56340 bytes --]
^ permalink raw reply
* Re: [PATCH 1/2] ath10k: Fix rate table updation in tx stats
From: kbuild test robot @ 2019-03-11 22:58 UTC (permalink / raw)
To: Rakesh Pillai; +Cc: kbuild-all, ath10k, linux-wireless, Rakesh Pillai
In-Reply-To: <1552319602-17795-2-git-send-email-pillair@codeaurora.org>
[-- Attachment #1: Type: text/plain, Size: 2368 bytes --]
Hi Rakesh,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on ath6kl/ath-next]
[also build test ERROR on next-20190306]
[cannot apply to v5.0]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Rakesh-Pillai/Fix-tx-stats-inconsistencies/20190312-061743
base: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath-next
config: nds32-allyesconfig (attached as .config)
compiler: nds32le-linux-gcc (GCC) 6.4.0
reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=6.4.0 make.cross ARCH=nds32
All errors (new ones prefixed by >>):
drivers/net/wireless/ath/ath10k/htt_rx.c: In function 'ath10k_accumulate_per_peer_tx_stats':
>> drivers/net/wireless/ath/ath10k/htt_rx.c:2934:14: error: implicit declaration of function 'ath10k_get_bw' [-Werror=implicit-function-declaration]
rtable_bw = ath10k_get_bw(&ar->hw_params, pstats->flags);
^~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +/ath10k_get_bw +2934 drivers/net/wireless/ath/ath10k/htt_rx.c
2914
2915 static void
2916 ath10k_accumulate_per_peer_tx_stats(struct ath10k *ar,
2917 struct ath10k_sta *arsta,
2918 struct ath10k_per_peer_tx_stats *pstats,
2919 s8 legacy_rate_idx)
2920 {
2921 struct rate_info *txrate = &arsta->txrate;
2922 struct ath10k_htt_tx_stats *tx_stats;
2923 int idx, ht_idx, gi, mcs, bw, nss;
2924 unsigned long flags;
2925 int rtable_bw;
2926
2927 if (!arsta->tx_stats)
2928 return;
2929
2930 tx_stats = arsta->tx_stats;
2931 flags = txrate->flags;
2932 gi = test_bit(ATH10K_RATE_INFO_FLAGS_SGI_BIT, &flags);
2933 mcs = ATH10K_HW_MCS_RATE(pstats->ratecode);
> 2934 rtable_bw = ath10k_get_bw(&ar->hw_params, pstats->flags);
2935 bw = txrate->bw;
2936 nss = txrate->nss;
2937 ht_idx = mcs + (nss - 1) * 8;
2938 idx = mcs * 8 + 8 * 10 * (nss - 1);
2939 idx += rtable_bw * 2 + gi;
2940
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 49922 bytes --]
^ permalink raw reply
* [PATCH AUTOSEL 4.20 28/52] mac80211: call drv_ibss_join() on restart
From: Sasha Levin @ 2019-03-11 19:54 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
In-Reply-To: <20190311195516.137772-1-sashal@kernel.org>
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 4926b51bfaa6d36bd6f398fb7698679d3962e19d ]
If a driver does any significant activity in its ibss_join method,
then it will very well expect that to be called during restart,
before any stations are added. Do that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/util.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index dddfff7cf44f..57ad01560023 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -5,7 +5,7 @@
* Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright (C) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -2144,6 +2144,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MONITOR:
break;
+ case NL80211_IFTYPE_ADHOC:
+ if (sdata->vif.bss_conf.ibss_joined)
+ WARN_ON(drv_join_ibss(local, sdata));
+ /* fall through */
default:
ieee80211_reconfig_stations(sdata);
/* fall through */
--
2.19.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.20 30/52] mac80211: Fix Tx aggregation session tear down with ITXQs
From: Sasha Levin @ 2019-03-11 19:54 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190311195516.137772-1-sashal@kernel.org>
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 6157ca0d6bfe437691b1e98a62e2efe12b6714da ]
When mac80211 requests the low level driver to stop an ongoing
Tx aggregation, the low level driver is expected to call
ieee80211_stop_tx_ba_cb_irqsafe() to indicate that it is ready
to stop the session. The callback in turn schedules a worker
to complete the session tear down, which in turn also handles
the relevant state for the intermediate Tx queue.
However, as this flow in asynchronous, the intermediate queue
should be stopped and not continue servicing frames, as in
such a case frames that are dequeued would be marked as part
of an aggregation, although the aggregation is already been
stopped.
Fix this by stopping the intermediate Tx queue, before
calling the low level driver to stop the Tx aggregation.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/agg-tx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 69e831bc317b..54821fb1a960 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,7 +8,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+ ieee80211_agg_stop_txq(sta, tid);
+
spin_unlock_bh(&sta->lock);
ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
--
2.19.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.20 29/52] cfg80211: prevent speculation on cfg80211_classify8021d() return
From: Sasha Levin @ 2019-03-11 19:54 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
In-Reply-To: <20190311195516.137772-1-sashal@kernel.org>
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 1fc9b7253382ce1a83d9a3e63e88d656eb63f263 ]
It's possible that the caller of cfg80211_classify8021d() uses the
value to index an array, like mac80211 in ieee80211_downgrade_queue().
Prevent speculation on the return value.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/util.c | 35 ++++++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d473bd135da8..d8b7eb75bade 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -5,7 +5,7 @@
* Copyright 2007-2009 Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright 2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
*/
#include <linux/export.h>
#include <linux/bitops.h>
@@ -19,6 +19,7 @@
#include <linux/mpls.h>
#include <linux/gcd.h>
#include <linux/bitfield.h>
+#include <linux/nospec.h>
#include "core.h"
#include "rdev-ops.h"
@@ -715,20 +716,25 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
{
unsigned int dscp;
unsigned char vlan_priority;
+ unsigned int ret;
/* skb->priority values from 256->263 are magic values to
* directly indicate a specific 802.1d priority. This is used
* to allow 802.1d priority to be passed directly in from VLAN
* tags, etc.
*/
- if (skb->priority >= 256 && skb->priority <= 263)
- return skb->priority - 256;
+ if (skb->priority >= 256 && skb->priority <= 263) {
+ ret = skb->priority - 256;
+ goto out;
+ }
if (skb_vlan_tag_present(skb)) {
vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
>> VLAN_PRIO_SHIFT;
- if (vlan_priority > 0)
- return vlan_priority;
+ if (vlan_priority > 0) {
+ ret = vlan_priority;
+ goto out;
+ }
}
switch (skb->protocol) {
@@ -747,8 +753,9 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
if (!mpls)
return 0;
- return (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
+ ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
>> MPLS_LS_TC_SHIFT;
+ goto out;
}
case htons(ETH_P_80221):
/* 802.21 is always network control traffic */
@@ -761,18 +768,24 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
unsigned int i, tmp_dscp = dscp >> 2;
for (i = 0; i < qos_map->num_des; i++) {
- if (tmp_dscp == qos_map->dscp_exception[i].dscp)
- return qos_map->dscp_exception[i].up;
+ if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
+ ret = qos_map->dscp_exception[i].up;
+ goto out;
+ }
}
for (i = 0; i < 8; i++) {
if (tmp_dscp >= qos_map->up[i].low &&
- tmp_dscp <= qos_map->up[i].high)
- return i;
+ tmp_dscp <= qos_map->up[i].high) {
+ ret = i;
+ goto out;
+ }
}
}
- return dscp >> 5;
+ ret = dscp >> 5;
+out:
+ return array_index_nospec(ret, IEEE80211_NUM_TIDS);
}
EXPORT_SYMBOL(cfg80211_classify8021d);
--
2.19.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.19 26/44] mac80211: call drv_ibss_join() on restart
From: Sasha Levin @ 2019-03-11 19:56 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johannes Berg, Luca Coelho, Sasha Levin, linux-wireless, netdev
In-Reply-To: <20190311195700.138462-1-sashal@kernel.org>
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 4926b51bfaa6d36bd6f398fb7698679d3962e19d ]
If a driver does any significant activity in its ibss_join method,
then it will very well expect that to be called during restart,
before any stations are added. Do that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/util.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 716cd6442d86..3deaa01ebee4 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -5,7 +5,7 @@
* Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright (C) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -2020,6 +2020,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MONITOR:
break;
+ case NL80211_IFTYPE_ADHOC:
+ if (sdata->vif.bss_conf.ibss_joined)
+ WARN_ON(drv_join_ibss(local, sdata));
+ /* fall through */
default:
ieee80211_reconfig_stations(sdata);
/* fall through */
--
2.19.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.19 27/44] mac80211: Fix Tx aggregation session tear down with ITXQs
From: Sasha Levin @ 2019-03-11 19:56 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190311195700.138462-1-sashal@kernel.org>
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 6157ca0d6bfe437691b1e98a62e2efe12b6714da ]
When mac80211 requests the low level driver to stop an ongoing
Tx aggregation, the low level driver is expected to call
ieee80211_stop_tx_ba_cb_irqsafe() to indicate that it is ready
to stop the session. The callback in turn schedules a worker
to complete the session tear down, which in turn also handles
the relevant state for the intermediate Tx queue.
However, as this flow in asynchronous, the intermediate queue
should be stopped and not continue servicing frames, as in
such a case frames that are dequeued would be marked as part
of an aggregation, although the aggregation is already been
stopped.
Fix this by stopping the intermediate Tx queue, before
calling the low level driver to stop the Tx aggregation.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/agg-tx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 69e831bc317b..54821fb1a960 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,7 +8,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+ ieee80211_agg_stop_txq(sta, tid);
+
spin_unlock_bh(&sta->lock);
ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
--
2.19.1
^ permalink raw reply related
* [PATCH AUTOSEL 4.14 16/27] mac80211: Fix Tx aggregation session tear down with ITXQs
From: Sasha Levin @ 2019-03-11 19:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilan Peer, Luca Coelho, Johannes Berg, Sasha Levin,
linux-wireless, netdev
In-Reply-To: <20190311195824.139043-1-sashal@kernel.org>
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 6157ca0d6bfe437691b1e98a62e2efe12b6714da ]
When mac80211 requests the low level driver to stop an ongoing
Tx aggregation, the low level driver is expected to call
ieee80211_stop_tx_ba_cb_irqsafe() to indicate that it is ready
to stop the session. The callback in turn schedules a worker
to complete the session tear down, which in turn also handles
the relevant state for the intermediate Tx queue.
However, as this flow in asynchronous, the intermediate queue
should be stopped and not continue servicing frames, as in
such a case frames that are dequeued would be marked as part
of an aggregation, although the aggregation is already been
stopped.
Fix this by stopping the intermediate Tx queue, before
calling the low level driver to stop the Tx aggregation.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/agg-tx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 197947a07f83..ed57db9b6086 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,7 +8,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -361,6 +361,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+ ieee80211_agg_stop_txq(sta, tid);
+
spin_unlock_bh(&sta->lock);
ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
--
2.19.1
^ permalink raw reply related
* [PATCH v2 3/3] mac80211: probe unexercised mesh links
From: Rajkumar Manoharan @ 2019-03-11 18:49 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, julanhsu, kevinhayes, Rajkumar Manoharan
In-Reply-To: <1552330142-23228-1-git-send-email-rmanohar@codeaurora.org>
The requirement for mesh link metric refreshing, is that from one
mesh point we be able to send some data frames to other mesh points
which are not currently selected as a primary traffic path, but which
are only 1 hop away. The absence of the primary path to the chosen node
makes it necessary to apply some form of marking on a chosen packet
stream so that the packets can be properly steered to the selected node
for testing, and not by the regular mesh path lookup.
Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
---
v2: fix addr1 for injected frames
include/net/mac80211.h | 2 ++
net/mac80211/cfg.c | 1 +
net/mac80211/ieee80211_i.h | 2 ++
net/mac80211/mesh_hwmp.c | 4 ++++
net/mac80211/tx.c | 36 ++++++++++++++++++++++++++++++++++++
5 files changed, 45 insertions(+)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 88219cc137c3..65a5889be6b0 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -786,6 +786,7 @@ enum mac80211_tx_info_flags {
* @IEEE80211_TX_CTRL_RATE_INJECT: This frame is injected with rate information
* @IEEE80211_TX_CTRL_AMSDU: This frame is an A-MSDU frame
* @IEEE80211_TX_CTRL_FAST_XMIT: This frame is going through the fast_xmit path
+ * @IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP: This frame skips mesh path lookup
*
* These flags are used in tx_info->control.flags.
*/
@@ -795,6 +796,7 @@ enum mac80211_tx_control_flags {
IEEE80211_TX_CTRL_RATE_INJECT = BIT(2),
IEEE80211_TX_CTRL_AMSDU = BIT(3),
IEEE80211_TX_CTRL_FAST_XMIT = BIT(4),
+ IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP = BIT(5),
};
/*
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 96496b2c1670..23df122d14a6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3978,4 +3978,5 @@ static int ieee80211_get_txq_stats(struct wiphy *wiphy,
.get_ftm_responder_stats = ieee80211_get_ftm_responder_stats,
.start_pmsr = ieee80211_start_pmsr,
.abort_pmsr = ieee80211_abort_pmsr,
+ .probe_mesh_link = ieee80211_probe_mesh_link,
};
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index a1638a5d4188..974b651e3fbe 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1754,6 +1754,8 @@ void ieee80211_tx_monitor(struct ieee80211_local *local, struct sk_buff *skb,
int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
const u8 *buf, size_t len,
const u8 *dest, __be16 proto, bool unencrypted);
+int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
+ const u8 *buf, size_t len);
/* HT */
void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 6950cd0bf594..fe11bbd137ef 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1118,6 +1118,10 @@ int mesh_nexthop_resolve(struct ieee80211_sub_if_data *sdata,
if (ieee80211_is_qos_nullfunc(hdr->frame_control))
return 0;
+ /* Allow injected packets to bypass mesh routing */
+ if (info->control.flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP)
+ return 0;
+
rcu_read_lock();
err = mesh_nexthop_lookup(sdata, skb);
if (!err)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c2ee5678b2d8..dd4728b3d844 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2594,6 +2594,13 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
goto free;
}
band = chanctx_conf->def.chan->band;
+
+ /* For injected frames, fill RA right away as nexthop lookup
+ * will be skipped.
+ */
+ if ((ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP) &&
+ is_zero_ether_addr(hdr.addr1))
+ memcpy(hdr.addr1, skb->data + ETH_ALEN, ETH_ALEN);
break;
#endif
case NL80211_IFTYPE_STATION:
@@ -4916,3 +4923,32 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
return 0;
}
+
+int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
+ const u8 *buf, size_t len)
+{
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ struct ieee80211_local *local = sdata->local;
+ struct sk_buff *skb;
+
+ skb = dev_alloc_skb(local->hw.extra_tx_headroom + len +
+ 30 + /* header size */
+ 18); /* 11s header size */
+ if (!skb)
+ return -ENOMEM;
+
+ skb_reserve(skb, local->hw.extra_tx_headroom);
+ skb_put_data(skb, buf, len);
+
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_802_3);
+ skb_reset_network_header(skb);
+ skb_reset_mac_header(skb);
+
+ local_bh_disable();
+ __ieee80211_subif_start_xmit(skb, skb->dev, 0,
+ IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP);
+ local_bh_enable();
+
+ return 0;
+}
--
1.9.1
^ permalink raw reply related
* [PATCH v2 2/3] mac80211: add option for setting control flags
From: Rajkumar Manoharan @ 2019-03-11 18:49 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, julanhsu, kevinhayes, Rajkumar Manoharan
In-Reply-To: <1552330142-23228-1-git-send-email-rmanohar@codeaurora.org>
Allows setting of control flags of skb cb - if needed -
when calling ieee80211_subif_start_xmit().
Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
---
net/mac80211/ieee80211_i.h | 3 ++-
net/mac80211/tdls.c | 2 +-
net/mac80211/tx.c | 18 +++++++++++-------
3 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 7dfb4e2f98b2..a1638a5d4188 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1736,7 +1736,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
struct net_device *dev);
void __ieee80211_subif_start_xmit(struct sk_buff *skb,
struct net_device *dev,
- u32 info_flags);
+ u32 info_flags,
+ u32 ctrl_flags);
void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
struct sk_buff_head *skbs);
struct sk_buff *
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index 6c647f425e05..044dad3e0423 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -1055,7 +1055,7 @@ static void ieee80211_tdls_add_ies(struct ieee80211_sub_if_data *sdata,
/* disable bottom halves when entering the Tx path */
local_bh_disable();
- __ieee80211_subif_start_xmit(skb, dev, flags);
+ __ieee80211_subif_start_xmit(skb, dev, flags, 0);
local_bh_enable();
return ret;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 928f13a208b0..c2ee5678b2d8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2424,6 +2424,7 @@ static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
* @sdata: virtual interface to build the header for
* @skb: the skb to build the header in
* @info_flags: skb flags to set
+ * @ctrl_flags: info control flags to set
*
* This function takes the skb with 802.3 header and reformats the header to
* the appropriate IEEE 802.11 header based on which interface the packet is
@@ -2439,7 +2440,7 @@ static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
*/
static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb, u32 info_flags,
- struct sta_info *sta)
+ struct sta_info *sta, u32 ctrl_flags)
{
struct ieee80211_local *local = sdata->local;
struct ieee80211_tx_info *info;
@@ -2811,6 +2812,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
info->flags = info_flags;
info->ack_frame_id = info_id;
info->band = band;
+ info->control.flags = ctrl_flags;
return skb;
free:
@@ -3638,7 +3640,8 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
void __ieee80211_subif_start_xmit(struct sk_buff *skb,
struct net_device *dev,
- u32 info_flags)
+ u32 info_flags,
+ u32 ctrl_flags)
{
struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
struct sta_info *sta;
@@ -3703,7 +3706,8 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
skb->prev = NULL;
skb->next = NULL;
- skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
+ skb = ieee80211_build_hdr(sdata, skb, info_flags,
+ sta, ctrl_flags);
if (IS_ERR(skb))
goto out;
@@ -3843,9 +3847,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
__skb_queue_head_init(&queue);
ieee80211_convert_to_unicast(skb, dev, &queue);
while ((skb = __skb_dequeue(&queue)))
- __ieee80211_subif_start_xmit(skb, dev, 0);
+ __ieee80211_subif_start_xmit(skb, dev, 0, 0);
} else {
- __ieee80211_subif_start_xmit(skb, dev, 0);
+ __ieee80211_subif_start_xmit(skb, dev, 0, 0);
}
return NETDEV_TX_OK;
@@ -3870,7 +3874,7 @@ struct sk_buff *
goto out;
}
- skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
+ skb = ieee80211_build_hdr(sdata, skb, info_flags, sta, 0);
if (IS_ERR(skb))
goto out;
@@ -4907,7 +4911,7 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
skb_reset_mac_header(skb);
local_bh_disable();
- __ieee80211_subif_start_xmit(skb, skb->dev, flags);
+ __ieee80211_subif_start_xmit(skb, skb->dev, flags, 0);
local_bh_enable();
return 0;
--
1.9.1
^ permalink raw reply related
* [PATCH v2 1/3] cfg80211: add support to probe unexercised mesh link
From: Rajkumar Manoharan @ 2019-03-11 18:49 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, julanhsu, kevinhayes, Rajkumar Manoharan
In-Reply-To: <1552330142-23228-1-git-send-email-rmanohar@codeaurora.org>
Adding support to allow mesh HWMP to measure link metrics on unexercised
direct mesh path by sending some data frames to other mesh points which
are not currently selected as a primary traffic path but only 1 hop away.
The absence of the primary path to the chosen node makes it necessary to
apply some form of marking on a chosen packet stream so that the packets
can be properly steered to the selected node for testing, and not by the
regular mesh path lookup.
Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
---
include/net/cfg80211.h | 6 +++++
include/uapi/linux/nl80211.h | 16 +++++++++++++
net/wireless/nl80211.c | 54 ++++++++++++++++++++++++++++++++++++++++++++
net/wireless/rdev-ops.h | 13 +++++++++++
net/wireless/trace.h | 19 ++++++++++++++++
5 files changed, 108 insertions(+)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index e0c41eb1c860..24ee3fc3e1f5 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3379,6 +3379,9 @@ struct cfg80211_pmsr_request {
* Statistics should be cumulative, currently no way to reset is provided.
* @start_pmsr: start peer measurement (e.g. FTM)
* @abort_pmsr: abort peer measurement
+ *
+ * @probe_mesh_link: Probe direct Mesh peer's link quality by sending data frame
+ * and overrule HWMP path selection algorithm.
*/
struct cfg80211_ops {
int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -3693,6 +3696,9 @@ struct cfg80211_ops {
struct cfg80211_pmsr_request *request);
void (*abort_pmsr)(struct wiphy *wiphy, struct wireless_dev *wdev,
struct cfg80211_pmsr_request *request);
+
+ int (*probe_mesh_link)(struct wiphy *wiphy, struct net_device *dev,
+ const u8 *buf, size_t len);
};
/*
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 31ae5c7f10e3..e9184381cbdf 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1065,6 +1065,21 @@
* indicated by %NL80211_ATTR_WIPHY_FREQ and other attributes
* determining the width and type.
*
+ * @NL80211_CMD_PROBE_MESH_LINK: The requirement for mesh link metric
+ * refreshing, is that from one mesh point we be able to send some data
+ * frames to other mesh points which are not currently selected as a
+ * primary traffic path, but which are only 1 hop away. The absence of
+ * the primary path to the chosen node makes it necessary to apply some
+ * form of marking on a chosen packet stream so that the packets can be
+ * properly steered to the selected node for testing, and not by the
+ * regular mesh path lookup. Further, the packets must be of type data
+ * so that the rate control (often embedded in firmware) is used for
+ * rate selection.
+ *
+ * Here attribute %NL80211_ATTR_MAC is used to specify connected mesh
+ * peer MAC address and %NL80211_ATTR_FRAME is used to specify the frame
+ * content. The frame is ethernet data.
+ *
* @NL80211_CMD_MAX: highest used command number
* @__NL80211_CMD_AFTER_LAST: internal use
*/
@@ -1284,6 +1299,7 @@ enum nl80211_commands {
NL80211_CMD_PEER_MEASUREMENT_COMPLETE,
NL80211_CMD_NOTIFY_RADAR,
+ NL80211_CMD_PROBE_MESH_LINK,
/* add new commands above here */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d91a408db113..c138bc817af8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13205,6 +13205,52 @@ static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
return -ENOBUFS;
}
+static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
+{
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ struct net_device *dev = info->user_ptr[1];
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+ struct station_info sinfo = {};
+ const u8 *buf;
+ size_t len;
+ u8 *dest;
+ int err;
+
+ if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
+ return -EOPNOTSUPP;
+
+ if (!info->attrs[NL80211_ATTR_MAC] ||
+ !info->attrs[NL80211_ATTR_FRAME]) {
+ GENL_SET_ERR_MSG(info, "Frame or MAC missing");
+ return -EINVAL;
+ }
+
+ wdev_lock(wdev);
+ if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
+ wdev_unlock(wdev);
+ err = -EOPNOTSUPP;
+ return err;
+ }
+ wdev_unlock(wdev);
+
+ dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
+ buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
+ len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
+
+ if (len < sizeof(struct ethhdr))
+ return -EINVAL;
+
+ if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
+ !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
+ return -EINVAL;
+
+ err = rdev_get_station(rdev, dev, dest, &sinfo);
+ if (err)
+ return err;
+
+ return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
+}
+
#define NL80211_FLAG_NEED_WIPHY 0x01
#define NL80211_FLAG_NEED_NETDEV 0x02
#define NL80211_FLAG_NEED_RTNL 0x04
@@ -14139,6 +14185,14 @@ static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
NL80211_FLAG_NEED_RTNL,
},
+ {
+ .cmd = NL80211_CMD_PROBE_MESH_LINK,
+ .doit = nl80211_probe_mesh_link,
+ .policy = nl80211_policy,
+ .flags = GENL_UNS_ADMIN_PERM,
+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+ NL80211_FLAG_NEED_RTNL,
+ },
};
static struct genl_family nl80211_fam __ro_after_init = {
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 5cb48d135fab..ec1b4800872f 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -1272,4 +1272,17 @@ static inline int rdev_del_pmk(struct cfg80211_registered_device *rdev,
trace_rdev_return_void(&rdev->wiphy);
}
+static inline int
+rdev_probe_mesh_link(struct cfg80211_registered_device *rdev,
+ struct net_device *dev, const u8 *dest,
+ const void *buf, size_t len)
+{
+ int ret;
+
+ trace_rdev_probe_mesh_link(&rdev->wiphy, dev, dest, buf, len);
+ ret = rdev->ops->probe_mesh_link(&rdev->wiphy, dev, buf, len);
+ trace_rdev_return_int(&rdev->wiphy, ret);
+ return ret;
+}
+
#endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 44b2ce1bb13a..274a844c7ea9 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -3362,6 +3362,25 @@
WIPHY_PR_ARG, WDEV_PR_ARG,
(unsigned long long)__entry->cookie)
);
+
+TRACE_EVENT(rdev_probe_mesh_link,
+ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+ const u8 *dest, const u8 *buf, size_t len),
+ TP_ARGS(wiphy, netdev, dest, buf, len),
+ TP_STRUCT__entry(
+ WIPHY_ENTRY
+ NETDEV_ENTRY
+ MAC_ENTRY(dest)
+ ),
+ TP_fast_assign(
+ WIPHY_ASSIGN;
+ NETDEV_ASSIGN;
+ MAC_ASSIGN(dest, dest);
+ ),
+ TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " MAC_PR_FMT,
+ WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(dest))
+);
+
#endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
#undef TRACE_INCLUDE_PATH
--
1.9.1
^ permalink raw reply related
* [PATCH v2 0/3] wireless: Add support to probe unexercised mesh link
From: Rajkumar Manoharan @ 2019-03-11 18:48 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, julanhsu, kevinhayes, Rajkumar Manoharan
Consider below mesh topology.
MP1
/ \
/ \
MP2 --- MP3
Assume that even though MP1 & MP3 have direct mesh links, the path was
established via MP2. (MP1 <-> MP2 <-> MP3). The 1-hop mesh link MP1 <-> MP3
never be excercised till the current path is terminated. As of now, there
is no option to send data frame to pick other than primary path. So mesh
link metric between MP1 & MP3 never be updated. This series allows user
to send data to 1-hop mesh peers through unexercised mesh path.
-Rajkumar
Rajkumar Manoharan (3):
cfg80211: add support to probe unexercised mesh link
mac80211: add option for setting control flags
mac80211: probe unexercised mesh links
include/net/cfg80211.h | 6 +++++
include/net/mac80211.h | 2 ++
include/uapi/linux/nl80211.h | 16 +++++++++++++
net/mac80211/cfg.c | 1 +
net/mac80211/ieee80211_i.h | 5 +++-
net/mac80211/mesh_hwmp.c | 4 ++++
net/mac80211/tdls.c | 2 +-
net/mac80211/tx.c | 54 ++++++++++++++++++++++++++++++++++++++------
net/wireless/nl80211.c | 54 ++++++++++++++++++++++++++++++++++++++++++++
net/wireless/rdev-ops.h | 13 +++++++++++
net/wireless/trace.h | 19 ++++++++++++++++
11 files changed, 167 insertions(+), 9 deletions(-)
--
1.9.1
^ permalink raw reply
* Re: [PATCH] net: mwifiex: fix a NULL pointer dereference
From: Brian Norris @ 2019-03-11 17:24 UTC (permalink / raw)
To: Kangjie Lu
Cc: pakki001, Amitkumar Karwar, Nishant Sarmukadam, Ganapathi Bhat,
Xinming Hu, Kalle Valo, David S. Miller, linux-wireless, netdev,
linux-kernel
In-Reply-To: <20190311074347.32003-1-kjlu@umn.edu>
On Mon, Mar 11, 2019 at 02:43:47AM -0500, Kangjie Lu wrote:
> In case dev_alloc_skb fails, the fix returns -ENOMEM to avoid
> NULL pointer dereference.
>
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---
> drivers/net/wireless/marvell/mwifiex/cmdevt.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
> index 60db2b969e20..5565f18039ab 100644
> --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
> +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
> @@ -341,6 +341,12 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter)
> sleep_cfm_tmp =
> dev_alloc_skb(sizeof(struct mwifiex_opt_sleep_confirm)
> + MWIFIEX_TYPE_LEN);
> + if (!sleep_cfm_tmp) {
> + mwifiex_dbg(adapter, ERROR,
You have trailing whitespace. Please run your patches through
scripts/checkpatch.pl.
> + "SLEEP_CFM: dev_alloc_skb failed\n");
> + return -ENOMEM;
It's not exactly a problem with your patch, but nobody really checks the
return status of this function. I think in most (all?) cases, that's
probably OK, because we also implicitly communicate the success/failure
of this function by modifying the ->ps_state field (basically, a state
machine). So this is probably OK.
Other than the whitespace:
Reviewed-by: Brian Norris <briannorris@chromium.org>
> + }
> +
> skb_put(sleep_cfm_tmp, sizeof(struct mwifiex_opt_sleep_confirm)
> + MWIFIEX_TYPE_LEN);
> put_unaligned_le32(MWIFIEX_USB_TYPE_CMD, sleep_cfm_tmp->data);
> --
> 2.17.1
>
^ permalink raw reply
* [PATCH 2/2] ath10k: Fix NSS tx stats for legacy rates
From: Rakesh Pillai @ 2019-03-11 15:53 UTC (permalink / raw)
To: ath10k; +Cc: linux-wireless, Rakesh Pillai
In-Reply-To: <1552319602-17795-1-git-send-email-pillair@codeaurora.org>
The ratecode field given by firmware in the tx stats
gives the details of NSS and MCS, if the preamble
specifies that it is HT/VHT. In case of OFDM/CCK, as
specified by the preamble, the ratecode indicates the
legacy rate instead of NSS/MCS data. For OFDM/CCK cases,
the NSS should always be 1, i.e. 1x1 mode for 11g and 11b.
Currently the legacy rate is misinterpreted as NSS & MCS, leading
to incorrect updation of tx stats corresponding to NSS, which is
displayed in the tx stats via debugfs.
Fix the nss value to 1 for 11b and 11g modes by checking
the preamble indication in the ratecode provided by the firmware.
Tested HW: WCN3990
Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
Fixes: e88975ca37d1 ("ath10k: dump tx stats in rate table format")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
---
drivers/net/wireless/ath/ath10k/htt_rx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 8c3c940..c1308a6 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2955,6 +2955,8 @@ ath10k_accumulate_per_peer_tx_stats(struct ath10k *ar,
STATS_OP_FMT(RETRY).ht[0][ht_idx] += pstats->retry_bytes;
STATS_OP_FMT(RETRY).ht[1][ht_idx] += pstats->retry_pkts;
} else {
+ /* For 11g and 11b, NSS is 1x1 */
+ nss = 1;
mcs = legacy_rate_idx;
STATS_OP_FMT(SUCC).legacy[0][mcs] += pstats->succ_bytes;
--
2.7.4
^ permalink raw reply related
* [PATCH 1/2] ath10k: Fix rate table updation in tx stats
From: Rakesh Pillai @ 2019-03-11 15:53 UTC (permalink / raw)
To: ath10k; +Cc: linux-wireless, Rakesh Pillai
In-Reply-To: <1552319602-17795-1-git-send-email-pillair@codeaurora.org>
The index for updating rate table, which is displayed
in the tx stats via debugfs, is calculated using the
bandwidth value. The bandwidth values do not map
correctly with the bandwidth values shown in the rate table.
Correct the bandwidth value calculation which is used
to calculate the index for rate table updation for tx stats.
Tested HW: WCN3990
Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
Fixes: e88975ca37d1 ("ath10k: dump tx stats in rate table format")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
---
drivers/net/wireless/ath/ath10k/htt_rx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index a20ea27..8c3c940 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2922,6 +2922,7 @@ ath10k_accumulate_per_peer_tx_stats(struct ath10k *ar,
struct ath10k_htt_tx_stats *tx_stats;
int idx, ht_idx, gi, mcs, bw, nss;
unsigned long flags;
+ int rtable_bw;
if (!arsta->tx_stats)
return;
@@ -2930,11 +2931,12 @@ ath10k_accumulate_per_peer_tx_stats(struct ath10k *ar,
flags = txrate->flags;
gi = test_bit(ATH10K_RATE_INFO_FLAGS_SGI_BIT, &flags);
mcs = ATH10K_HW_MCS_RATE(pstats->ratecode);
+ rtable_bw = ath10k_get_bw(&ar->hw_params, pstats->flags);
bw = txrate->bw;
nss = txrate->nss;
ht_idx = mcs + (nss - 1) * 8;
idx = mcs * 8 + 8 * 10 * (nss - 1);
- idx += bw * 2 + gi;
+ idx += rtable_bw * 2 + gi;
#define STATS_OP_FMT(name) tx_stats->stats[ATH10K_STATS_TYPE_##name]
--
2.7.4
^ permalink raw reply related
* [PATCH 0/2] Fix tx stats inconsistencies
From: Rakesh Pillai @ 2019-03-11 15:53 UTC (permalink / raw)
To: ath10k; +Cc: linux-wireless, Rakesh Pillai
The rate table indexes and the NSS values are
incorrect, causing the tx stats to be displayed
incorrectly.
This patchset fix these issues in the tx stats
displayed via debugfs.
Rakesh Pillai (2):
ath10k: Fix rate table updation in tx stats
ath10k: Fix NSS tx stats for legacy rates
drivers/net/wireless/ath/ath10k/htt_rx.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--
2.7.4
^ permalink raw reply
* Re: [PATCH] iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
From: Alexander Duyck @ 2019-03-11 15:47 UTC (permalink / raw)
To: Stanislaw Gruszka, Rosen Penev, Joerg Roedel
Cc: Lorenzo Bianconi, linux-wireless, Samuel Sieb, iommu,
linux-kernel, linux-nvme, jan.viktorin
In-Reply-To: <20190311090314.GB3310@redhat.com>
On Mon, 2019-03-11 at 10:03 +0100, Stanislaw Gruszka wrote:
> Take into account that sg->offset can be bigger than PAGE_SIZE when
> setting segment sg->dma_address. Otherwise sg->dma_address will point
> at diffrent page, what makes DMA not possible with erros like this:
>
> xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa70c0 flags=0x0020]
> xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7040 flags=0x0020]
> xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7080 flags=0x0020]
> xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7100 flags=0x0020]
> xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7000 flags=0x0020]
>
> Additinally with wrong sg->dma_address unmap_sg will free wrong pages,
> what what can cause crashes like this:
>
> Feb 28 19:27:45 kernel: BUG: Bad page state in process cinnamon pfn:39e8b1
> Feb 28 19:27:45 kernel: Disabling lock debugging due to kernel taint
> Feb 28 19:27:45 kernel: flags: 0x2ffff0000000000()
> Feb 28 19:27:45 kernel: raw: 02ffff0000000000 0000000000000000 ffffffff00000301 0000000000000000
> Feb 28 19:27:45 kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
> Feb 28 19:27:45 kernel: page dumped because: nonzero _refcount
> Feb 28 19:27:45 kernel: Modules linked in: ccm fuse arc4 nct6775 hwmon_vid amdgpu nls_iso8859_1 nls_cp437 edac_mce_amd vfat fat kvm_amd ccp rng_core kvm mt76x0u mt76x0_common mt76x02_usb irqbypass mt76_usb mt76x02_lib mt76 crct10dif_pclmul crc32_pclmul chash mac80211 amd_iommu_v2 ghash_clmulni_intel gpu_sched i2c_algo_bit ttm wmi_bmof snd_hda_codec_realtek snd_hda_codec_generic drm_kms_helper snd_hda_codec_hdmi snd_hda_intel drm snd_hda_codec aesni_intel snd_hda_core snd_hwdep aes_x86_64 crypto_simd snd_pcm cfg80211 cryptd mousedev snd_timer glue_helper pcspkr r8169 input_leds realtek agpgart libphy rfkill snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore sp5100_tco k10temp i2c_piix4 wmi evdev gpio_amdpt pinctrl_amd mac_hid pcc_cpufreq acpi_cpufreq sg ip_tables x_tables ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) dm_mod(E) serio_raw(E) atkbd(E) libps2(E) crc32c_intel(E) ahci(E) libahci(E) libata(E) xhci_pci(E
) xhci_hcd(E)
> Feb 28 19:27:45 kernel: scsi_mod(E) i8042(E) serio(E) bcache(E) crc64(E)
> Feb 28 19:27:45 kernel: CPU: 2 PID: 896 Comm: cinnamon Tainted: G B W E 4.20.12-arch1-1-custom #1
> Feb 28 19:27:45 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B450M Pro4, BIOS P1.20 06/26/2018
> Feb 28 19:27:45 kernel: Call Trace:
> Feb 28 19:27:45 kernel: dump_stack+0x5c/0x80
> Feb 28 19:27:45 kernel: bad_page.cold.29+0x7f/0xb2
> Feb 28 19:27:45 kernel: __free_pages_ok+0x2c0/0x2d0
> Feb 28 19:27:45 kernel: skb_release_data+0x96/0x180
> Feb 28 19:27:45 kernel: __kfree_skb+0xe/0x20
> Feb 28 19:27:45 kernel: tcp_recvmsg+0x894/0xc60
> Feb 28 19:27:45 kernel: ? reuse_swap_page+0x120/0x340
> Feb 28 19:27:45 kernel: ? ptep_set_access_flags+0x23/0x30
> Feb 28 19:27:45 kernel: inet_recvmsg+0x5b/0x100
> Feb 28 19:27:45 kernel: __sys_recvfrom+0xc3/0x180
> Feb 28 19:27:45 kernel: ? handle_mm_fault+0x10a/0x250
> Feb 28 19:27:45 kernel: ? syscall_trace_enter+0x1d3/0x2d0
> Feb 28 19:27:45 kernel: ? __audit_syscall_exit+0x22a/0x290
> Feb 28 19:27:45 kernel: __x64_sys_recvfrom+0x24/0x30
> Feb 28 19:27:45 kernel: do_syscall_64+0x5b/0x170
> Feb 28 19:27:45 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Cc: stable@vger.kernel.org
> Reported-and-tested-by: jan.viktorin@gmail.com
> Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
> ---
> drivers/iommu/amd_iommu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
> index 6b0760dafb3e..949621f33624 100644
> --- a/drivers/iommu/amd_iommu.c
> +++ b/drivers/iommu/amd_iommu.c
> @@ -2604,7 +2604,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
>
> /* Everything is mapped - write the right values into s->dma_address */
> for_each_sg(sglist, s, nelems, i) {
> - s->dma_address += address + s->offset;
> + s->dma_address += address + (s->offset & ~PAGE_MASK);
> s->dma_length = s->length;
> }
>
You should add a comment calling out that this is needed because the
sg_phys(s) call above this is masked with PAGE_MASK. Then this makes
much more sense. Otherwise I would have assumed you needed either the
full offset or none.
Other than that, from that I can tell the code itself looks to be
correct, but just difficult to read.
Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
^ permalink raw reply
* Re: [PATCH RFC v2] mac80211: debugfs option to force TX status frames
From: Jeremy Sowden @ 2019-03-11 14:52 UTC (permalink / raw)
To: Kalle Valo
Cc: ga58taw, Julius Niedworok, linux-wireless, david, nc,
Johannes Berg, David S. Miller, netdev, linux-kernel
In-Reply-To: <87h8c98q4l.fsf@codeaurora.org>
[-- Attachment #1: Type: text/plain, Size: 1537 bytes --]
On 2019-03-11, at 16:03:38 +0200, Kalle Valo wrote:
> ga58taw@mytum.de writes:
> > On Thu, Mar 07, 2019 at 05:42:04PM +0200, Kalle Valo wrote:
> > > > + len = scnprintf(buf, sizeof(buf), "%d\n",
> > > > (int)local->force_tx_status);
> > >
> > > I wonder about the cast, is it guaranteed that a bool is always of
> > > the same size as an int?
> >
> > Why is this a problem? If a bool is smaller than an int, the
> > compiler emits code that will prepend the value of force_tx_status
> > with zeros.
>
> Let's say that a bool is a byte and int is four bytes. If you use "%d"
> I would guess that in that case scnprintf() writes 4 bytes, meaning
> that 3 bytes will be overwriting either padding or some other field in
> the struct.
It's the value that matters, not the type. It will only be too big for
the buffer if the result of casting local->force_tx_status to int is
less than -9 or greeater than 99.
scnprintf(buf, size(buf), "%lld\n", (long long)local->force_tx_status)
would also be fine if the value were in range. Note also that scnprintf
will not overrun the buffer: it will truncate the string.
> But I'm no compiler expert so I'm not going to argue about this
> anymore. I just wanted to point out that that the cast looks
> dangerous and I would not do it.
As it happens, arguments to variadic functions are subject to the
"default argument promotions," so if local->force_tx_status is in fact a
bool (I can't find the definition), it would be promoted to int and the
cast is superfluous.
J.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH 2/4] mt76: mmio: move mt76_insert_hdr_pad in mt76_dma_tx_queue_skb
From: Lorenzo Bianconi @ 2019-03-11 15:01 UTC (permalink / raw)
To: Stanislaw Gruszka
Cc: Lorenzo Bianconi, nbd, ryder.lee, roychl666, linux-wireless
In-Reply-To: <20190311145852.GF6089@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 2052 bytes --]
> On Mon, Mar 11, 2019 at 03:25:18PM +0100, Lorenzo Bianconi wrote:
> > On Mar 11, Stanislaw Gruszka wrote:
> > > On Mon, Mar 11, 2019 at 01:35:24PM +0100, Lorenzo Bianconi wrote:
> > > > Introduce tx_aligned4_skbs in mt76_driver_ops and move
> > > > mt76_insert_hdr_pad in mt76_dma_tx_queue_skb. This is a preliminary
> > > > patch in order to unify tx dma mapping for mt76x02 and new chipsets
> > > >
> > > > Signed-off-by: Felix Fietkau <nbd@nbd.name>
> > > > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> > > > ---
> > > > drivers/net/wireless/mediatek/mt76/dma.c | 3 +++
> > > > drivers/net/wireless/mediatek/mt76/mt76.h | 1 +
> > > > drivers/net/wireless/mediatek/mt76/mt76x0/pci.c | 1 +
> > > > drivers/net/wireless/mediatek/mt76/mt76x02_txrx.c | 13 +++++--------
> > > > drivers/net/wireless/mediatek/mt76/mt76x2/pci.c | 1 +
> > > > 5 files changed, 11 insertions(+), 8 deletions(-)
> > > >
> > > > diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
> > > > index a66832a02281..14dd6585bab4 100644
> > > > --- a/drivers/net/wireless/mediatek/mt76/dma.c
> > > > +++ b/drivers/net/wireless/mediatek/mt76/dma.c
> > > > @@ -300,6 +300,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
> > > > }
> > > >
> > > > skb->prev = skb->next = NULL;
> > > > + if (dev->drv->tx_aligned4_skbs)
> > > > + mt76_insert_hdr_pad(skb);
> > >
> > > We need 4 bytes aligned skbs for mt76x02 or we just need header
> > > lenght be multiple of 4 ?
> >
> > I think IV/LLC should be 4 byte aligned
>
> mt76_insert_hdr_pad() does not change alignment of IV/LLC , it only
> moves header.
>
> I'm not sure what is actually needed (4 bytes alignment or 4 bytes
> lenght), but I just saw Felix sent 2 mac80211 patches that hopfully
> do the right thing, so this code after appling mac80211 changes
> and set TX_NEEDS_ALIGNED4_SKBS can be removed.
this is the plan :)
Regards,
Lorenzo
>
> Stanislaw
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox