summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
AgeCommit message (Collapse)AuthorFilesLines
2018-05-30iwlwifi: mvm: fix security bug in PN checkingSara Sharon1-19/+20
[ Upstream commit 5ab2ba931255d8bf03009c06d58dce97de32797c ] A previous patch allowed the same PN for packets originating from the same AMSDU by copying PN only for the last packet in the series. This however is bogus since we cannot assume the last frame will be received on the same queue, and if it is received on a different ueue we will end up not incrementing the PN and possibly let the next packet to have the same PN and pass through. Change the logic instead to driver explicitly indicate for the second sub frame and on to be allowed to have the same PN as the first subframe. Indicate it to mac80211 as well for the fallback queue. Fixes: f1ae02b186d9 ("iwlwifi: mvm: allow same PN for de-aggregated AMSDU") Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-05-14iwlwifi: mvm: fix reorder timer re-armingSara Sharon1-1/+2
commit 5351f9ab254c30d41659924265f1ecd7b4758d9e upstream. When NSSN is behind the reorder buffer due to timeout the reorder timer isn't getting re-armed until NSSN catches up. Fix it. Fixes: 0690405fef29 ("iwlwifi: mvm: add reorder timeout per frame") Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-10-19iwlwifi: mvm: wake the wait queue when the RX sync counter is zeroSara Sharon1-1/+2
When we sync the RX queues the driver waits to receive echo notification on all the RX queues. The wait queue is set with timeout until all queues have received the notification. However, iwl_mvm_rx_queue_notif() never woke up the wait queue, with the result of the counter value being checked only when the timeout expired. This may cause a latency of up to 1 second. Fixes: 0636b938214c ("iwlwifi: mvm: implement driver RX queues sync command") Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-09-19iwlwifi: mvm: document passing unexpected Block Ack Request framesJohannes Berg1-0/+5
When we get an unexpected Block Ack Request frame, the BAID from the hardware will be invalid, and we'll pass it to mac80211 for further handling (sending a delBA action frame.) Add a comment explaining that, in case anyone looks in the future. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-09-19iwlwifi: mvm: support BAR in reorder bufferSara Sharon1-3/+9
On default queue we will not receive frame release notification, but the BAR itself. Upon receiving the BAR driver should look at the NSSN and adjust window accordingly. Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue") Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-09-19iwlwifi: mvm: cleanup skb queue functions useSara Sharon1-6/+7
Use skb_queue_empty() and not skb_peek_tail() to check for empty list. Avoid a redundant check as well - loop will take care of it. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-09-16iwlwifi: mvm: tighten BAID range checkJohannes Berg1-1/+1
As pointed out by smatch, checking the BAID for just >= INVALID is a bad idea since only 32 (IWL_MAX_BAID) actually exist. Check the range for that and print invalid ones in the warning. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-09-16iwlwifi: mvm: remove pointless _bh from spinlock in timerJohannes Berg1-3/+3
Inside the reorder timer expire function, there's no point in disabling BHs since it is in BH context. Remove that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-08-29iwlwifi: mvm: allow same PN for de-aggregated AMSDUSara Sharon1-1/+5
The 9000 hardware will de-aggregate AMSDUs. In the process it will copy the mac header "as is" to the new MPDUs. This means driver should allow the same PN for MPDUs originated from the same AMSDU. Do that by incrementing the PN only for the last MPDU in the sequence. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-07-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.gitKalle Valo1-1/+3
This is to fix some conflicts in iwlwifi. Conflicts: drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c drivers/net/wireless/intel/iwlwifi/mvm/scan.c
2016-07-06iwlwifi: mvm: add RX aggregation printsSara Sharon1-0/+6
Add some prints to track BAID assignment. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-07-01iwlwifi: mvm: Support CSA countdown offloadingAndrei Otcheretianski1-2/+11
Add support CSA countdown offloading. When CSA starts, the driver specifies the offsets to the eCSA and CSA IEs in the beacon template command and the fw performs the countdown. The fw notifies the driver when the channel switch flow should be performed. Beacon sent notifications are not used anymore. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-07-01iwlwifi: mvm: update mpdu metadata APISara Sharon1-16/+35
rx_phy notification is no longer sent in devices with multiple rx queues. All the needed data is now set in the metadata - update code accordingly to reflect all the features as in the previous RX path. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-07-01iwlwifi: mvm: remove RX_PHY support for 9000 deviceSara Sharon1-13/+0
In multiple RX queues architecture, the RX_PHY notification is no longer useful as it is received in the default queue even for packets that are received on RSS queue, and cannot be accessed without locking. All the needed data is in the new RX packet metadata and firmware will no longer send this notification for 9000 devices. Remove support of it. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-07-01iwlwifi: mvm: do not trust NSSN for amsdu sub-framesSara Sharon1-2/+18
We cannot trust NSSN for AMSDU sub-frames that are not the last. The reason is that NSSN advances on the first sub-frame, and may cause the reorder buffer to advance before all the sub-frames arrive. Example: Reorder buffer contains SN 0 & 2. We receive AMSDU with SN 1 and NSSN for first sub frame 3. The result us that driver releases SN 0,1, 2. When sub-frame 1 arrives - reorder buffer is already ahead and it will be dropped. If the last sub-frame is not on this queue - we will get frame release notification with up to date NSSN. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-06-10iwlwifi: mvm: fix potential NULL-dereference in iwl_mvm_reorder()Luca Coelho1-1/+3
We try to access sta before we check for IS_ERR_OR_NULL(), so we may end up accessing a NULL pointer. To prevent that, move the conversion from sta to mvm_sta below the check. Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: loosen nssn comparison to reorder buffer headSara Sharon1-4/+18
Up till now, the reorder buffer uses standard spec based comparison when comparing the buffer status to NSSN. This indeed works for the regular case, since we shouldn't cross the 2048 boundary without getting a frame release notification. However, this is problematic due to packet filtering that may be performed by the FW while we are in d0i3. Theoretically we may filter over 2048 packets, and then the check of the NSSN will get incorrect. Change the comparison to always trust nssn unless it is 64 or less frames behind the head - which might happen due to a timeout. This new comparison is to be used only when comparing reorder buffer head with nssn, and not when comparing the packet SN to nssn or reorder buffer head. Put this in a separate commit as the logic is a bit tricky and stands for its own commit message. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: pass station to mac80211 RX where knownJohannes Berg1-1/+1
When we've already looked up the transmitter station, we can just pass it to mac80211 using the new ieee80211_rx_napi(). This saves the overhead of looking it up in mac80211 again. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: utilize the frame release infrastructureSara Sharon1-2/+31
The firmware will send frame release notification in order to release "stuck" frames on a queue where no more frames arrive on. Upon receiving the message the driver shall indicate the frames up to the NSSN. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: add reorder timeout per frameSara Sharon1-1/+80
Add a timer in order to release expired frames from the reorder buffer. This is needed since some APs do not retransmit frames to fill in the reorder holes and in TCP it results with a complete stall of traffic. This has a few side effects on the general design: The nssn may not reflect the the head of the reorder buffer. This situation is valid, and packets with SN lower than the reorder buffer head will be dropped. Another side effect is that since the reorder timer might expire we need to lock the reorder buffer. This however is fine since the locking is only inside a single reorder buffer between RX path and reorder timeout and there is no outside contention. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: add reorder buffer per queueSara Sharon1-1/+180
Next hardware will direct packets to core based on the TCP/UDP streams. This logic can create holes in reorder buffer since packets that belong to other stream were directed to a different core. However, those are valid holes and the packets can be indicated in L3 order. The hardware will utilize a mechanism of informing the driver of the normalized ssn and the driver shall release all packets that SN is lower than the nssn. This enables managing the reorder across the queues without sharing any data between them. The reorder buffer is allocated and released directly in the RX path in order to avoid various races between control path and rx path. The code utilizes the internal messaging to notify rx queues of when to delete the reorder buffer. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: add infrastructure for tracking BA session in driverSara Sharon1-0/+35
According to the spec when a BA session is started there is a timeout set for the session in the ADDBA request. If there is not activity on the TA/TID then the session expires and a DELBA is sent. In order to check for the timeout, data must be shared among the rx queues. Add a timer that runs as long as BA session is active for the station and stops aggregation session if needed. This patch also lays the infrastructure for the reordering buffer which will be enabled in the next patches. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: change RX sync notification to be an attribute and not a typeSara Sharon1-6/+9
Currently the sync notification is a type of notification. However, it is better fitted as an attribute of a notification, since there might be another message in the payload (delba for instance) that should be sent while control path is waiting for all queues to process. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-05-10iwlwifi: mvm: implement driver RX queues sync commandSara Sharon1-0/+7
mac80211 will call the driver whenever there is a race between RSS queues and control path that requires a processing of all pending frames in RSS queues. Implement that by utilizing the internal notification mechanism: queue a message to all queues. When the message is received on a queue it decrements the atomic counter. This guarantees that all pending frames in the RX queue were processed since the message is in order inside the queue. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2016-04-12cfg80211: remove enum ieee80211_bandJohannes Berg1-2/+2
This enum is already perfectly aliased to enum nl80211_band, and the only reason for it is that we get IEEE80211_NUM_BANDS out of it. There's no really good reason to not declare the number of bands in nl80211 though, so do that and remove the cfg80211 one. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-04-11Merge tag 'wireless-drivers-next-for-davem-2016-04-11' of ↵David S. Miller1-2/+7
git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers patches for 4.7 Major changes: iwlwifi * support for Link Quality measurement * more work 9000 devices and MSIx * continuation of the Dynamic Queue Allocation work * make the paging less memory hungry * 9000 new Rx path * removal of IWLWIFI_UAPSD Kconfig option ath10k * implement push-pull tx model using mac80211 software queuing support * enable scan in AP mode (NL80211_FEATURE_AP_SCAN) wil6210 * add basic PBSS (Personal Basic Service Set) support * add initial P2P support * add oob_mode module parameter ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2016-04-06mac80211: allow passing transmitter station on RXJohannes Berg1-1/+1
Sometimes drivers already looked up, or know out-of-band from their device, which station transmitted a given RX frame. Allow them to pass the station pointer to mac80211 to save the extra lookup. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-03-30iwlwifi: mvm: report checksum is done also for IPv6 packetsSara Sharon1-2/+7
Currently the code checks if hardware reported both L4 and L3 checksums as valid, and only then reports it as validated to the stack. However, IPv6 does not have checksum at all and the L3 checksum valid bit is always off for IPv6 packets, with the result of the stack re-validating L4 checksum. Fix code to set CHECKSUM_UNNECESSARY also for IPv6 packets whose TCP/UDP checksum was verified. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-03-09iwlwifi: mvm: turn off AMSDU bit in QoS control for de-aggregated AMSDUsSara Sharon1-0/+12
Our hardware de-aggregates AMSDUs but copies the mac header as it to the de-aggregated MPDUs. We need to turn off the AMSDU bit in the QoS control ourselves. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-02-27iwlwifi: mvm: take care of padded packetsSara Sharon1-7/+23
To ensure that the SNAP/TCP/IP headers are DW aligned, the firmware may add 2-byte pad at the end of the mac header - after the IV, before the SNAP. In that case the mpdu descriptor pad bit will be turned on. Driver should take it into consideration, and remove the padding before passing the packet to mac80211. Do that. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-02-27iwlwifi: mvm: add RSS queues notification infrastructureSara Sharon1-0/+48
In multi rx queue HW, without execessive locking, there is no sync between the ctrl path (default queue) and the rest of the rx queues. This might cause issues on certain situations. For example, in case a delBA was processed on a default queue but out of order packets still wait for processing on the other queue. The solution is to introduce internal messaging between the CTRL path and the other rx queues. The driver will send a message to the firmware, which will echo it to all the requested queues. The message will be in order inside the queue. This way we can avoid CTRL path and RSS queues races. Add support for this messaging mechanism. As the firmware is agnostic to the data sent, add internal representation of the data as well. Although currently only delBA flow will use it, the internal representation will enable generic use of this infrastructure for future uses. Next patch will utilize this messaging mechanism for the reorder buffer delBA flow. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-02-27iwlwifi: mvm: add duplicate packet detection per rx queueSara Sharon1-0/+66
Next hardware will direct TCP/UDP streams to different cores. Packets belonging to the same stream will be directed to the same core. The result is that duplicates will be always directed to the same rx queue were the first packet was received. This enabled parallelizing the duplicate packet detection across the different cores, without sharing data between the rx queues. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-02-27iwlwifi: mvm: update rx_status with mactime flagSara Sharon1-0/+2
When forming IBSS, mac80211 scans in order to find an already existing cell to join. In case the scan does not find any existing cell a new IBSS cell is formed. When receiving the beacons of another IBSS cell we should merge if the other IBSS cell's TSF is higher than ours. However, currently iwlmvm does not set any timestamp flag in rx_status so there is no valid rx timestamp to compare the beacon's TSF to. The reason for that is that TSF as indicated by the firmware is at INA time, but up till now mac80211 expected the TSF at the beginning or end of the MPDU. Set the flag to the newly added RX_FLAG_MACTIME_PLCP_START flag. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-02-01iwlwifi: pcie: update iwl_mpdu_desc fieldsSara Sharon1-7/+4
Final API of iwl_mpdu_desc has a change in the order of the fields and does not include energy from the third antenna (which is perfectly fine, since we don't have one). Update the structure accordingly. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-02-01iwlwifi: mvm: change access to ieee80211_hdrSara Sharon1-1/+1
Make the code clearer. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2016-01-07iwlwifi: mvm: check PN for CCMP/GCMP in the driverJohannes Berg1-13/+93
As we're working on multi-queue RX, we want to parallelise checking the PN in order to avoid having to serialise the RX processing. It may seem that doing parallel PN checking is insecure, but it turns out to be OK because queue assignment is done based on the data in the frame (IP/TCP) and thus cannot be manipulated by an attacker, since the data is encrypted and must first have been decrypted successfully. There are some corner cases, in particular when the peer starts using fragmentation which redirects the packet to the default queue. However this redirection is remembered (for the STA, per TID) and thus cannot be exploited by an attacker either. Leave checking on the default queue (queue 0) to mac80211, since we get fragmented packets there and those are subject to stricter checks during reassembly. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-12-21iwlwifi: mvm: infrastructure for frame-release messageSara Sharon1-0/+6
Incoming hardware will send frame release notifications to the reorder buffer in order to update with the BA session status and up to date NSSN. This patch enables the API. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2015-12-21iwlwifi: mvm: add 9000 series RX processingJohannes Berg1-0/+372
Convert the convert the new infrastructure added by previous patches to actually use the new RX descriptor layout. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>