Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
header, and if so dropping the complete A-MSDU frame. This mitigates
known attacks, although new (unknown) aggregation-based attacks may
remain possible.
This defense works because in A-MSDU aggregation injection attacks, a
normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
header. In other words, the destination MAC address of the first A-MSDU
subframe contains the start of an RFC1042 header during an aggregation
attack. We can detect this and thereby prevent this specific attack.
For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
Through Frame Aggregation and Fragmentation".
Signed-off-by: Felix Fietkau <[email protected]>
In order to remove duplicated code, move mt76_token_init in
mt76_alloc_device routine
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Frame reception timestamp (low 32-bits) that indicates the value of the
local TSF timer value at the time the first bit of the MAC header in the
received frame (PPDU unit) arriving at the MAC.
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
When receiving an A-MSDU containing only a single subframe, status->last_amsdu
is set, but no previous head is present in the rx A-MSDU queue.
In this case, the A-MSDU subframe will be held until the next one is received,
potentially causing significant extra latency.
Rework the code to make it easier to read and less convoluted, and release the
newly created head if status->last_amsdu is set.
Signed-off-by: Felix Fietkau <[email protected]>
Enable hw rx-amsdu de-aggregation support available in 7915 devices.
This is a preliminary patch to enable rx checksum offload
Signed-off-by: Lorenzo Bianconi <[email protected]>
Only clear dev->phy2 after the phy is gone, the driver may still need to access
it until shutdown is complete
Signed-off-by: Felix Fietkau <[email protected]>
Add testmode support for DBDC NICs (both MT7615D and MT7915D work).
Testmode data and parameters are moved from per-dev to per-phy
for maintaining the value of each band.
Signed-off-by: Shayne Chen <[email protected]>
Acked-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This is a preliminary patch to properly support mt7915 dbdc
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This is a preliminary patch to introduce dbdc support to mt7915 devices
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This is a preliminary patch to properly support mt7915 dbdc
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This is a preliminary patch to move properly support mt7915 dbdc
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move hw data queues in mt76_phy from mt76_dev since mt7915 supports per
phy hw queues in dbdc mode
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Introduce mt76_init_mcu_queue utility routine in order to allocate
dedicate q_mcu pointers for mcu hw queues. This is a preliminary patch
to move data queues in mt76_phy and add dbdc support to mt7915 driver
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_init_tx_queue in mac80211.c since it is shared by all
drivers.
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
It was accidentally dropped while adding multiple wiphy support
Fixes fast-rx support and avoids handling reordering in both mac80211
and the driver
Cc: [email protected]
Fixes: c89d36254155 ("mt76: add function for allocating an extra wiphy")
Signed-off-by: Felix Fietkau <[email protected]>
The newer chipsets can deal with the same STA on multiple interfaces
Preparation for supporting more station interfaces
Signed-off-by: Felix Fietkau <[email protected]>
Introduce sdio tx aggregation to reduce bus transaction ands improve tx
throughput. For the moment the skb are copied in a dedicated buffer
since mmc APIs do not support sg table for zero-copy.
Since skb data are already copied in xmit_buff[], avoid linearization in
ma80211 layer. Relying on tx aggregation, we improve tx tpt of ~65%.
Tested-by: Sean Wang <[email protected]>
Co-developed-by: Sean Wang <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
On MT7615 and MT7915, packets received from DMA can include TX_FREE events,
which free up space for tx. In order to process those packets faster, keep
keep a longer internal queue of packets and pass as many packets to the
stack as the NAPI budget allows
Signed-off-by: Felix Fietkau <[email protected]>
Since the switch to using AQL by default, mtxq->retry_q is never filled anymore
Remove it to get rid of a few more unnecessary cycles in the tx path
Signed-off-by: Felix Fietkau <[email protected]>
Introduce mt76_sdio module as common layer to add mt7663s support
Co-developed-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Introduce mt7615_update_survey utility routine in order to compute
survey stats without waking up the device since it runs holding mt76 lock.
Run mt7615_pm_wake directly in mt7615_update_channel since it can run
with mt76.mutex held if called by mac80211
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76 workqueue from usb to common code in order to be reused adding
low-power support for mt7663 chipset
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This can be used for calibration in the manufacturing process.
It supports sending a configurable number of packets with a specific rate
and configurable tx power levels / antenna settings.
It also supports receiving packets and showing some statistics, including
packet counters and detailed RSSI information.
It will only be compiled in if CONFIG_NL80211_TESTMODE is enabled
Signed-off-by: Felix Fietkau <[email protected]>
Introduce U-APSD support in mt76 driver for AP interface
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
While looking at the ETSI regulatory domain definitions
and a patch, which allows more channels for ath10k, I also
checked the channels allowed for mt76.
ETSI regulations would possibly allow to add channels 32, 68,
96, 144, 169 and 173. IEEE 802.11-2016 defines no operating class
for channels 32, 68 and 96. This leaves us channels 144, 169 and 173,
which are included in this patch.
I tested 169 and 173 with a mt76 based USB dongle (AVM AC 860) and they
worked fine. If I saw that right, these channels are also covered by
register definitions inside the driver.
Channel 144 should also work, but gets disabled by the kernel as of now.
Signed-off-by: Markus Theil <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Enable mac80211 TDLS support by default. Disable TDLS hw filtering for
mt7615 devices
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
The hardware requirements for A-MPDU density are entirely on the tx side,
not the rx side. Because of that, the IE value should stay at 0 and the
minimum value should instead be enforced in WTBL/TXWI
MT7615 has no restrictions here
Signed-off-by: Felix Fietkau <[email protected]>
remove IEEE80211_HW_PS_NULLFUNC_STACK capability from mt76_phy_init
routine since 802.11 ps is not currently supported by any devices and it
will conflict with mt7663 ps fw support
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Introduce mt76_mcu data structure to contain common fields between
mt76u_mcu and mt76e_mcu.
Initialize mcu common fields in mt76_alloc_device().
Rely on mt76_mcu in mt76_mcu_rx_event and in mt76_mcu_get_response
in order to reuse them in usb code
Signed-off-by: Lorenzo Bianconi <[email protected]>
The mt76_led_cleanup() function is called unconditionally, which
leads to a link error when CONFIG_LEDS is a loadable module or
disabled but mt76 is built-in:
drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_unregister_device':
mac80211.c:(.text+0x2ac): undefined reference to `led_classdev_unregister'
Use the same trick that is guarding the registration, using an
IS_ENABLED() check for the CONFIG_MT76_LEDS symbol that indicates
whether LEDs can be used or not.
Fixes: 36f7e2b2bb1d ("mt76: do not use devm API for led classdev")
Signed-off-by: Arnd Bergmann <[email protected]>
Acked-by: Felix Fietkau <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Unify code converting between the different txpower values. Always add/remove
the combined txpower delta before dividing half-dB values.
Also fix the combined txpower delta values. The correct half-dB delta for
3 chains is 9, not 8.
Signed-off-by: Felix Fietkau <[email protected]>
Move WIPHY_FLAG_HAS_CHANNEL_SWITCH in mt76-core module since now all
drivers support Channel Switch Announcement
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
