* [PATCH 2/2] iw: show STA flags in station dump
From: Helmut Schaa @ 2011-10-18 9:18 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Helmut Schaa
In-Reply-To: <1318929507-11447-1-git-send-email-helmut.schaa@googlemail.com>
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
---
Couldn't come up with a nice/short wording for "Managment frame
protection" and "Wireless Multimedia Extension" so I just used MFP
and WME/WMM instead.
station.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 48 insertions(+), 0 deletions(-)
diff --git a/station.c b/station.c
index 6581d50..26a2b7c 100644
--- a/station.c
+++ b/station.c
@@ -37,6 +37,7 @@ static int print_sta_handler(struct nl_msg *msg, void *arg)
struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
char mac_addr[20], state_name[10], dev[20];
+ struct nl80211_sta_flag_update *sta_flags;
static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
[NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
[NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
@@ -50,6 +51,8 @@ static int print_sta_handler(struct nl_msg *msg, void *arg)
[NL80211_STA_INFO_PLINK_STATE] = { .type = NLA_U8 },
[NL80211_STA_INFO_TX_RETRIES] = { .type = NLA_U32 },
[NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
+ [NL80211_STA_INFO_STA_FLAGS] =
+ { .minlen = sizeof(struct nl80211_sta_flag_update) },
};
static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
@@ -167,6 +170,51 @@ static int print_sta_handler(struct nl_msg *msg, void *arg)
printf("\n\tmesh plink:\t%s", state_name);
}
+ if (sinfo[NL80211_STA_INFO_STA_FLAGS]) {
+ sta_flags = (struct nl80211_sta_flag_update *)
+ nla_data(sinfo[NL80211_STA_INFO_STA_FLAGS]);
+
+ if (sta_flags->mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
+ printf("\n\tauthorized:\t");
+ if (sta_flags->set & BIT(NL80211_STA_FLAG_AUTHORIZED))
+ printf("yes");
+ else
+ printf("no");
+ }
+
+ if (sta_flags->mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+ printf("\n\tauthenticated:\t");
+ if (sta_flags->set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
+ printf("yes");
+ else
+ printf("no");
+ }
+
+ if (sta_flags->mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
+ printf("\n\tpreamble:\t");
+ if (sta_flags->set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
+ printf("short");
+ else
+ printf("long");
+ }
+
+ if (sta_flags->mask & BIT(NL80211_STA_FLAG_WME)) {
+ printf("\n\tWMM/WME:\t");
+ if (sta_flags->set & BIT(NL80211_STA_FLAG_WME))
+ printf("yes");
+ else
+ printf("no");
+ }
+
+ if (sta_flags->mask & BIT(NL80211_STA_FLAG_MFP)) {
+ printf("\n\tMFP:\t\t");
+ if (sta_flags->set & BIT(NL80211_STA_FLAG_MFP))
+ printf("yes");
+ else
+ printf("no");
+ }
+ }
+
printf("\n");
return NL_SKIP;
}
--
1.7.3.4
^ permalink raw reply related
* [PATCH 1/2] iw: Update nl80211.h
From: Helmut Schaa @ 2011-10-18 9:18 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Helmut Schaa
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
---
nl80211.h | 46 ++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 46 insertions(+), 0 deletions(-)
diff --git a/nl80211.h b/nl80211.h
index c73582f..013ec4b 100644
--- a/nl80211.h
+++ b/nl80211.h
@@ -506,6 +506,9 @@
* @NL80211_CMD_PMKSA_CANDIDATE: This is used as an event to inform userspace
* of PMKSA caching dandidates.
*
+ * @NL80211_CMD_TDLS_OPER: Perform a high-level TDLS command (e.g. link setup).
+ * @NL80211_CMD_TDLS_MGMT: Send a TDLS management frame.
+ *
* @NL80211_CMD_MAX: highest used command number
* @__NL80211_CMD_AFTER_LAST: internal use
*/
@@ -632,6 +635,9 @@ enum nl80211_commands {
NL80211_CMD_PMKSA_CANDIDATE,
+ NL80211_CMD_TDLS_OPER,
+ NL80211_CMD_TDLS_MGMT,
+
/* add new commands above here */
/* used to define NL80211_CMD_MAX below */
@@ -1089,6 +1095,20 @@ enum nl80211_commands {
* This attribute is used with %NL80211_CMD_TRIGGER_SCAN and
* %NL80211_CMD_FRAME commands.
*
+ * @NL80211_ATTR_TDLS_ACTION: Low level TDLS action code (e.g. link setup
+ * request, link setup confirm, link teardown, etc.). Values are
+ * described in the TDLS (802.11z) specification.
+ * @NL80211_ATTR_TDLS_DIALOG_TOKEN: Non-zero token for uniquely identifying a
+ * TDLS conversation between two devices.
+ * @NL80211_ATTR_TDLS_OPERATION: High level TDLS operation; see
+ * &enum nl80211_tdls_operation, represented as a u8.
+ * @NL80211_ATTR_TDLS_SUPPORT: A flag indicating the device can operate
+ * as a TDLS peer sta.
+ * @NL80211_ATTR_TDLS_EXTERNAL_SETUP: The TDLS discovery/setup and teardown
+ * procedures should be performed by sending TDLS packets via
+ * %NL80211_CMD_TDLS_MGMT. Otherwise %NL80211_CMD_TDLS_OPER should be
+ * used for asking the driver to perform a TDLS operation.
+ *
* @NL80211_ATTR_MAX: highest attribute number currently defined
* @__NL80211_ATTR_AFTER_LAST: internal use
*/
@@ -1311,6 +1331,12 @@ enum nl80211_attrs {
NL80211_ATTR_TX_NO_CCK_RATE,
+ NL80211_ATTR_TDLS_ACTION,
+ NL80211_ATTR_TDLS_DIALOG_TOKEN,
+ NL80211_ATTR_TDLS_OPERATION,
+ NL80211_ATTR_TDLS_SUPPORT,
+ NL80211_ATTR_TDLS_EXTERNAL_SETUP,
+
/* add attributes here, update the policy in nl80211.c */
__NL80211_ATTR_AFTER_LAST,
@@ -1408,6 +1434,7 @@ enum nl80211_iftype {
* @NL80211_STA_FLAG_WME: station is WME/QoS capable
* @NL80211_STA_FLAG_MFP: station uses management frame protection
* @NL80211_STA_FLAG_AUTHENTICATED: station is authenticated
+ * @NL80211_STA_FLAG_TDLS_PEER: station is a TDLS peer
* @NL80211_STA_FLAG_MAX: highest station flag number currently defined
* @__NL80211_STA_FLAG_AFTER_LAST: internal use
*/
@@ -1418,6 +1445,7 @@ enum nl80211_sta_flags {
NL80211_STA_FLAG_WME,
NL80211_STA_FLAG_MFP,
NL80211_STA_FLAG_AUTHENTICATED,
+ NL80211_STA_FLAG_TDLS_PEER,
/* keep last */
__NL80211_STA_FLAG_AFTER_LAST,
@@ -1520,6 +1548,7 @@ enum nl80211_sta_bss_param {
* @NL80211_STA_INFO_BSS_PARAM: current station's view of BSS, nested attribute
* containing info as possible, see &enum nl80211_sta_bss_param
* @NL80211_STA_INFO_CONNECTED_TIME: time since the station is last connected
+ * @NL80211_STA_INFO_STA_FLAGS: Contains a struct nl80211_sta_flag_update.
* @__NL80211_STA_INFO_AFTER_LAST: internal
* @NL80211_STA_INFO_MAX: highest possible station info attribute
*/
@@ -1541,6 +1570,7 @@ enum nl80211_sta_info {
NL80211_STA_INFO_RX_BITRATE,
NL80211_STA_INFO_BSS_PARAM,
NL80211_STA_INFO_CONNECTED_TIME,
+ NL80211_STA_INFO_STA_FLAGS,
/* keep last */
__NL80211_STA_INFO_AFTER_LAST,
@@ -2604,4 +2634,20 @@ enum nl80211_pmksa_candidate_attr {
MAX_NL80211_PMKSA_CANDIDATE = NUM_NL80211_PMKSA_CANDIDATE - 1
};
+/**
+ * enum nl80211_tdls_operation - values for %NL80211_ATTR_TDLS_OPERATION
+ * @NL80211_TDLS_DISCOVERY_REQ: Send a TDLS discovery request
+ * @NL80211_TDLS_SETUP: Setup TDLS link
+ * @NL80211_TDLS_TEARDOWN: Teardown a TDLS link which is already established
+ * @NL80211_TDLS_ENABLE_LINK: Enable TDLS link
+ * @NL80211_TDLS_DISABLE_LINK: Disable TDLS link
+ */
+enum nl80211_tdls_operation {
+ NL80211_TDLS_DISCOVERY_REQ,
+ NL80211_TDLS_SETUP,
+ NL80211_TDLS_TEARDOWN,
+ NL80211_TDLS_ENABLE_LINK,
+ NL80211_TDLS_DISABLE_LINK,
+};
+
#endif /* __LINUX_NL80211_H */
--
1.7.3.4
^ permalink raw reply related
* wl1251 and NoA protocol
From: Andrés García Saavedra @ 2011-10-18 9:13 UTC (permalink / raw)
To: linux-wireless
Hi all,
I would like to test Notice of Absence powersaving protocol for
802.11abg WLANs on some current android smartphone. My question is
regarding the wl1251 driver implementation for TI chipsets:
* Does the chipset/current implementation support sleep/awake
triggers? (or at least quiet elements?) -> This means, can I command
the NIC to stay quiet (slept) for certain duration of time?
My plan is to implement/test a Notice of Absence protocol where the
driver would trigger absent (quiet/sleep) periods according to the
beacon's NoA IE. Ive seen in the code the wl1251_ps_elp_sleep/wakeup
functions that might be reused for this purpose (?)
* Last (lazy) question. AFAIK only the google dev 1 phone uses this
chipset. Is there any 1ghz android device that could benefit of this
driver?
Thanks for your answer,
Andrés
^ permalink raw reply
* Re: [patch] iwmc3200wifi: add some more range checks
From: Samuel Ortiz @ 2011-10-18 8:39 UTC (permalink / raw)
To: Dan Carpenter
Cc: Intel Linux Wireless, John W. Linville, linux-wireless,
kernel-janitors
In-Reply-To: <20111018065043.GB25814@longonot.mountain>
Hi Dan,
On Tue, Oct 18, 2011 at 09:50:43AM +0300, Dan Carpenter wrote:
> My previous patch added a check to get_key() but missed a couple
> other places which need range checks.
>
> The problem here is that wifi drivers have different numbers of keys.
> The lower levels assume that they can have up to 4 default keys and
> 2 management keys but this driver only has the default keys so we
> could go past the end of the ->keys[] array.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Cheers,
Samuel.
--
Intel Open Source Technology Centre
http://oss.intel.com/
---------------------------------------------------------------------
Intel Corporation SAS (French simplified joint stock company)
Registered headquarters: "Les Montalets"- 2, rue de Paris,
92196 Meudon Cedex, France
Registration Number: 302 456 199 R.C.S. NANTERRE
Capital: 4,572,000 Euros
This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
^ permalink raw reply
* Re: brcmfmac driver implementation: Questions
From: Andrés García Saavedra @ 2011-10-18 8:31 UTC (permalink / raw)
To: Arend Van Spriel; +Cc: linux-wireless@vger.kernel.org
In-Reply-To: <400C43189542CE41BC0A5B252FC90136BC0DF4A03E@SJEXCHCCR02.corp.ad.broadcom.com>
Thank you for your answers, been very helpful.
2011/10/17 Arend Van Spriel <arend@broadcom.com>:
>> Sent: maandag 17 oktober 2011 19:59
>>
>> Hi all,
>>
>> I would like to test some custom powersaving algorithms for 802.11abg
>> WLANs on some current android smartphone (e.g., nexus one). My
>> question is regarding the brcmfmac driver implementation for BCM4329
>> chipsets:
>>
>> * The current open source implementation of the driver, brcmfmac, does
>> ONLY support 11n PHY?
>
> Yes. It supports the bcm4329 device which comes with a 11n phy, which
> can connect to a non-11n AP without problems.
>
>> * Does this driver interfaces the mac80211 operations or "acts as" a
>> mac80211 driver itself talking to cfg80211/nl80211?
>
> The brcmfmac does not require mac80211, but interfaces with cfg80211.
>
>> * Does the chipset/current implementation support sleep/awake
>> triggers? (or at least quiet elements?)
>
> Nope. All powersaving the device does is done on the device as it
> knows best what parts of the device can be put to sleep. Who or what
> is going to fire those triggers?
What I basically mean here to force the wifi interface stay quiet (or
sleep) for a certain duration of time (the way Notice of Absence
protocol proposes or 802.11h's Quiet Element does). For example, the
ath5k driver supports quiet elements and the card offers registers
that can be edited within the driver to force a station be quiet for a
certain duration at certain intervals of time. A (local) test
implementation i've performed on ath5k "understands" the NoA IE from a
beacon and edits those registers accordingly in order to stay quiet
accordingly for powersaving purposes.
For the case of a potential BCM4329 implementation of NoA, the
brcmfmac should be the one to trigger those scheduled quiet intervals
on the HW (or is there a lower layer to interface the HW?) when it
receives each beacon NoA IE.
Thanks again, and excuses for my vague knowledge on the bcm4329 drivers.
Andrés
>
>> Thanks for your answer,
>> Andrés
>
> Hope that helps.
>
> Gr. AvS
>
>
^ permalink raw reply
* [PATCH] Set IEEE80211_TX_RC_MCS on MCS rates on TX complete.
From: Pontus Fuchs @ 2011-10-18 8:28 UTC (permalink / raw)
To: linux-wireless
IEEE80211_TX_RC_MCS was not set correctly leading to incorrect link
speed calculation.
Reviewed-by: Luciano Coelho <coelho@ti.com>
---
drivers/net/wireless/wl12xx/conf.h | 4 ++++
drivers/net/wireless/wl12xx/tx.c | 12 +++++++++++-
2 files changed, 15 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/wl12xx/conf.h b/drivers/net/wireless/wl12xx/conf.h
index 04bb8fb..b3f9592 100644
--- a/drivers/net/wireless/wl12xx/conf.h
+++ b/drivers/net/wireless/wl12xx/conf.h
@@ -91,6 +91,10 @@ enum {
CONF_HW_RXTX_RATE_UNSUPPORTED = 0xff
};
+/* Rates between and including these are MCS rates */
+#define CONF_HW_RXTX_RATE_MCS_MIN CONF_HW_RXTX_RATE_MCS7
+#define CONF_HW_RXTX_RATE_MCS_MAX CONF_HW_RXTX_RATE_MCS0
+
enum {
CONF_SG_DISABLE = 0,
CONF_SG_PROTECTIVE,
diff --git a/drivers/net/wireless/wl12xx/tx.c b/drivers/net/wireless/wl12xx/tx.c
index c7ad4f5..40c5669 100644
--- a/drivers/net/wireless/wl12xx/tx.c
+++ b/drivers/net/wireless/wl12xx/tx.c
@@ -798,6 +798,14 @@ out:
mutex_unlock(&wl->mutex);
}
+static u8 wl1271_tx_get_rate_flags(u8 rate_class_index)
+{
+ if (rate_class_index >= CONF_HW_RXTX_RATE_MCS_MIN &&
+ rate_class_index <= CONF_HW_RXTX_RATE_MCS_MAX)
+ return IEEE80211_TX_RC_MCS;
+ return 0;
+}
+
static void wl1271_tx_complete_packet(struct wl1271 *wl,
struct wl1271_tx_hw_res_descr *result)
{
@@ -807,6 +815,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
struct sk_buff *skb;
int id = result->id;
int rate = -1;
+ u8 rate_flags = 0;
u8 retries = 0;
/* check for id legality */
@@ -833,6 +842,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
info->flags |= IEEE80211_TX_STAT_ACK;
rate = wl1271_rate_to_idx(result->rate_class_index,
wlvif->band);
+ rate_flags = wl1271_tx_get_rate_flags(result->rate_class_index);
retries = result->ack_failures;
} else if (result->status == TX_RETRY_EXCEEDED) {
wl->stats.excessive_retries++;
@@ -841,7 +851,7 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
info->status.rates[0].idx = rate;
info->status.rates[0].count = retries;
- info->status.rates[0].flags = 0;
+ info->status.rates[0].flags = rate_flags;
info->status.ack_signal = -1;
wl->stats.retry_count += result->ack_failures;
--
1.7.4.1
^ permalink raw reply related
* compat-wireless: backporting kfree_rcu()?
From: Johannes Berg @ 2011-10-18 8:18 UTC (permalink / raw)
To: linux-wireless
So I was looking at backporting kfree_rcu(), and came up with this:
#define kfree_rcu(data, rcuhead) do { \
void __kfree_rcu_fn(struct rcu_head *rcu_head) \
{ \
void *___ptr; \
___ptr = container_of(rcu_head, typeof(*(data)), rcuhead);\
kfree(___ptr); \
} \
call_rcu(&(data)->rcuhead, __kfree_rcu_fn); \
} while (0)
This works, thanks to gcc supporting nested functions, but has one major
issue: any module using call_rcu() must have an rcu_barrier() in its
module_exit() because __kfree_rcu_fn() might be called after the module
is unloaded. For kfree_rcu() this isn't needed since the function called
lives in the base kernel.
I played around with injecting a call to rcu_barrier() into module exit
by modifying module_exit() but I couldn't make the CPP do that. Anyone
else have any ideas?
Another idea I had was to insert the __kfree_rcu_fn() code into the
compat module instead, but I can't see how to do that short of using
some source post-processing scripts.
johannes
^ permalink raw reply
* [PATCH] compat-wireless: add iwlwifi RCU compat
From: Johannes Berg @ 2011-10-18 8:07 UTC (permalink / raw)
To: Luis R. Rodriguez; +Cc: Hauke Mehrtens, linux-wireless
From: Johannes Berg <johannes.berg@intel.com>
We need to patch the new kfree_rcu() reference in
iwlwifi out and add rcu_barrier() to make it safe.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
Obviously the patch needing this isn't upstream yet, but I wanted to
give you this patch for when it comes upstream. If you prefer we hold
the compat patch and send it together with the kernel patch let me know
we can try to do that.
diff --git a/patches/41-no-kfree-rcu.patch b/patches/41-no-kfree-rcu.patch
index c18b50d..37c5c1b 100644
--- a/patches/41-no-kfree-rcu.patch
+++ b/patches/41-no-kfree-rcu.patch
@@ -81,3 +81,42 @@
static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
struct ieee80211_supported_band *sband,
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c 2011-10-17 18:29:19.000000000 +0200
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c 2011-10-18 10:00:27.000000000 +0200
+@@ -1032,6 +1032,14 @@ static int iwlagn_rx_reply_rx(struct iwl
+ return 0;
+ }
+
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,40))
++static void kfree_noa_data(struct rcu_head *head)
++{
++ void *data = container_of(head, struct iwl_wipan_noa_data, rcu_head);
++ kfree(data);
++}
++#endif
++
+ static int iwlagn_rx_noa_notification(struct iwl_priv *priv,
+ struct iwl_rx_mem_buffer *rxb,
+ struct iwl_device_cmd *cmd)
+@@ -1071,7 +1079,11 @@ static int iwlagn_rx_noa_notification(st
+ rcu_assign_pointer(priv->noa_data, new_data);
+
+ if (old_data)
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,40))
++ call_rcu(&old_data->rcu_head, kfree_noa_data);
++#else
+ kfree_rcu(old_data, rcu_head);
++#endif
+
+ return 0;
+ }
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-10-17 18:29:19.000000000 +0200
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-10-18 10:00:44.000000000 +0200
+@@ -3460,6 +3460,7 @@ static void __exit iwl_exit(void)
+ {
+ iwl_pci_unregister_driver();
+ iwlagn_rate_control_unregister();
++ rcu_barrier();
+ }
+
+ module_exit(iwl_exit);
^ permalink raw reply related
* Re: [patch] rndis_wlan: add range check in del_key()
From: Johannes Berg @ 2011-10-18 7:33 UTC (permalink / raw)
To: Dan Carpenter
Cc: Jussi Kivilinna, John W. Linville, linux-wireless,
kernel-janitors
In-Reply-To: <20111018072201.GC25814@longonot.mountain>
On Tue, 2011-10-18 at 10:22 +0300, Dan Carpenter wrote:
> On Tue, Oct 18, 2011 at 08:54:47AM +0200, Johannes Berg wrote:
> > On Tue, 2011-10-18 at 09:47 +0300, Dan Carpenter wrote:
> > > Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
> > > it needs to have its own checks to make sure we don't go out of
> > > bounds. The add_key() function already checks but I added some
> > > checks to del_key() and set_default_key().
> >
> > Semantically, that shouldn't be possible unless it advertises support
> > for WLAN_CIPHER_SUITE_AES_CMAC. Is there a bug in those checks?
> >
>
> You know I'm a newbie at this networking... I obviously had no idea
> about WLAN_CIPHER_SUITE_AES_CMAC until you mentioned it. I just
> looked at the other implementations of del_key() etc and they checked
> it. Monkey see, monkey do.
>
> My concern when I wrote this patch was places like __cfg80211_clear_ibss()
> which just do:
>
> for (i = 0; i < 6; i++)
> rdev->ops->del_key(wdev->wiphy, dev, i, false, NULL);
>
> That's what triggers the Smatch warning as well. But as I said, I'm
> quite a newbie at this code.
Ah ok, I didn't know they didn't check. That's reasonable, thanks!
I was just thinking that we wouldn't have keys 4/5 w/o CMAC to start
with, but it makes some sense that the code would just try to clear all
keys.
johannes
^ permalink raw reply
* Re: [patch] rndis_wlan: add range check in del_key()
From: Dan Carpenter @ 2011-10-18 7:22 UTC (permalink / raw)
To: Johannes Berg
Cc: Jussi Kivilinna, John W. Linville, linux-wireless,
kernel-janitors
In-Reply-To: <1318920887.3958.0.camel@jlt3.sipsolutions.net>
On Tue, Oct 18, 2011 at 08:54:47AM +0200, Johannes Berg wrote:
> On Tue, 2011-10-18 at 09:47 +0300, Dan Carpenter wrote:
> > Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
> > it needs to have its own checks to make sure we don't go out of
> > bounds. The add_key() function already checks but I added some
> > checks to del_key() and set_default_key().
>
> Semantically, that shouldn't be possible unless it advertises support
> for WLAN_CIPHER_SUITE_AES_CMAC. Is there a bug in those checks?
>
You know I'm a newbie at this networking... I obviously had no idea
about WLAN_CIPHER_SUITE_AES_CMAC until you mentioned it. I just
looked at the other implementations of del_key() etc and they checked
it. Monkey see, monkey do.
My concern when I wrote this patch was places like __cfg80211_clear_ibss()
which just do:
for (i = 0; i < 6; i++)
rdev->ops->del_key(wdev->wiphy, dev, i, false, NULL);
That's what triggers the Smatch warning as well. But as I said, I'm
quite a newbie at this code.
regards,
dan carpenter
^ permalink raw reply
* [PATCH 2/2] wl12xx: Check buffer bound when processing nvs data
From: Pontus Fuchs @ 2011-10-18 7:23 UTC (permalink / raw)
To: linux-wireless; +Cc: Pontus Fuchs, stable
In-Reply-To: <1318922622-8356-1-git-send-email-pontus.fuchs@gmail.com>
An nvs with malformed contents could cause the processing of the
calibration data to read beyond the end of the buffer. Prevent this
from happening by adding bound checking.
Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
Cc: stable@kernel.org
Reviewed-by: Luciano Coelho <coelho@ti.com>
---
drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++
1 files changed, 14 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
index 4ce634b..c9c8b69 100644
--- a/drivers/net/wireless/wl12xx/boot.c
+++ b/drivers/net/wireless/wl12xx/boot.c
@@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
nvs_ptr += 3;
for (i = 0; i < burst_len; i++) {
+ if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
+ goto out_badnvs;
+
val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
| (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
@@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
nvs_ptr += 4;
dest_addr += 4;
}
+
+ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+ goto out_badnvs;
}
/*
@@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
*/
nvs_ptr = (u8 *)wl->nvs +
ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
+
+ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+ goto out_badnvs;
+
nvs_len -= nvs_ptr - (u8 *)wl->nvs;
/* Now we must set the partition correctly */
@@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
kfree(nvs_aligned);
return 0;
+
+out_badnvs:
+ wl1271_error("nvs data is malformed");
+ return -EILSEQ;
}
static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
--
1.7.4.1
^ permalink raw reply related
* [PATCH 1/2] wl12xx: Validate FEM index from ini file and FW
From: Pontus Fuchs @ 2011-10-18 7:23 UTC (permalink / raw)
To: linux-wireless; +Cc: Pontus Fuchs, stable
In-Reply-To: <1318922622-8356-1-git-send-email-pontus.fuchs@gmail.com>
Check for out of bound FEM index to prevent reading beyond ini
memory end.
Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
Cc: stable@kernel.org
Reviewed-by: Luciano Coelho <coelho@ti.com>
---
drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++
1 files changed, 22 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
index 2413c43..38a21a3 100644
--- a/drivers/net/wireless/wl12xx/cmd.c
+++ b/drivers/net/wireless/wl12xx/cmd.c
@@ -121,6 +121,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
if (!wl->nvs)
return -ENODEV;
+ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+ wl1271_warning("FEM index from INI out of bounds");
+ return -EINVAL;
+ }
+
gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
if (!gen_parms)
return -ENOMEM;
@@ -144,6 +149,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
gp->tx_bip_fem_manufacturer =
gen_parms->general_params.tx_bip_fem_manufacturer;
+ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+ wl1271_warning("FEM index from FW out of bounds");
+ ret = -EINVAL;
+ goto out;
+ }
+
wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
@@ -163,6 +174,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
if (!wl->nvs)
return -ENODEV;
+ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+ wl1271_warning("FEM index from ini out of bounds");
+ return -EINVAL;
+ }
+
gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
if (!gen_parms)
return -ENOMEM;
@@ -187,6 +203,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
gp->tx_bip_fem_manufacturer =
gen_parms->general_params.tx_bip_fem_manufacturer;
+ if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+ wl1271_warning("FEM index from FW out of bounds");
+ ret = -EINVAL;
+ goto out;
+ }
+
wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
--
1.7.4.1
^ permalink raw reply related
* [PATCH 0/2] wl12xx: Fix problems in nvs file parsing
From: Pontus Fuchs @ 2011-10-18 7:23 UTC (permalink / raw)
To: linux-wireless; +Cc: Pontus Fuchs
A crafted nvs file could trick the driver into reading and writing
beyond end of buffers.
Pontus Fuchs (2):
wl12xx: Validate FEM index from ini file and FW
wl12xx: Check buffer bound when processing nvs data
drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++
drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++
2 files changed, 36 insertions(+), 0 deletions(-)
--
1.7.4.1
^ permalink raw reply
* Re: [patch] rndis_wlan: add range check in del_key()
From: Jussi Kivilinna @ 2011-10-18 7:07 UTC (permalink / raw)
To: Dan Carpenter; +Cc: John W. Linville, linux-wireless, kernel-janitors
In-Reply-To: <20111018064729.GQ27732@elgon.mountain>
Quoting Dan Carpenter <dan.carpenter@oracle.com>:
> Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
> it needs to have its own checks to make sure we don't go out of
> bounds. The add_key() function already checks but I added some
> checks to del_key() and set_default_key().
Looks ok, thanks.
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/net/wireless/rndis_wlan.c
> b/drivers/net/wireless/rndis_wlan.c
> index 0c13840..da78369 100644
> --- a/drivers/net/wireless/rndis_wlan.c
> +++ b/drivers/net/wireless/rndis_wlan.c
> @@ -414,6 +414,7 @@ struct ndis_80211_pmkid {
> #define RNDIS_WLAN_ALG_TKIP (1<<1)
> #define RNDIS_WLAN_ALG_CCMP (1<<2)
>
> +#define RNDIS_WLAN_NUM_KEYS 4
> #define RNDIS_WLAN_KEY_MGMT_NONE 0
> #define RNDIS_WLAN_KEY_MGMT_802_1X (1<<0)
> #define RNDIS_WLAN_KEY_MGMT_PSK (1<<1)
> @@ -516,7 +517,7 @@ struct rndis_wlan_private {
>
> /* encryption stuff */
> int encr_tx_key_index;
> - struct rndis_wlan_encr_key encr_keys[4];
> + struct rndis_wlan_encr_key encr_keys[RNDIS_WLAN_NUM_KEYS];
> int wpa_version;
>
> u8 command_buffer[COMMAND_BUFFER_SIZE];
> @@ -1535,6 +1536,9 @@ static int remove_key(struct usbnet *usbdev,
> int index, const u8 *bssid)
> bool is_wpa;
> int ret;
>
> + if (index >= RNDIS_WLAN_NUM_KEYS)
> + return -ENOENT;
> +
> if (priv->encr_keys[index].len == 0)
> return 0;
>
> @@ -2451,6 +2455,9 @@ static int rndis_set_default_key(struct wiphy
> *wiphy, struct net_device *netdev,
>
> netdev_dbg(usbdev->net, "%s(%i)\n", __func__, key_index);
>
> + if (key_index >= RNDIS_WLAN_NUM_KEYS)
> + return -ENOENT;
> +
> priv->encr_tx_key_index = key_index;
>
> if (is_wpa_key(priv, key_index))
>
>
^ permalink raw reply
* Re: ath9k: irq storm after suspend/resume
From: Adrian Chadd @ 2011-10-18 7:05 UTC (permalink / raw)
To: Clemens Buchacher; +Cc: Mohammed Shafi, linux-wireless
In-Reply-To: <20111018064459.GA1442@ecki>
Hm, which version of the AR9285 is it, exactly?
Would you just do a quick check (or code hack) and see if it matches
the AR_SREV_9285SE_20 (or similar) macro?
(I see a WAR in the reference code for that particular model AR9285,
that isn't in ath9k.)
I'm honestly still not convinced that it's (soley) the AR9285. You
_could_ do something naughty like disabling all interrupts and then
powering off the NIC (but not detaching it from the bus glue, like
unloading the module does.)
Good luck,
Adrian
^ permalink raw reply
* Re: [patch] rndis_wlan: add range check in del_key()
From: Johannes Berg @ 2011-10-18 6:54 UTC (permalink / raw)
To: Dan Carpenter
Cc: Jussi Kivilinna, John W. Linville, linux-wireless,
kernel-janitors
In-Reply-To: <20111018064729.GQ27732@elgon.mountain>
On Tue, 2011-10-18 at 09:47 +0300, Dan Carpenter wrote:
> Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
> it needs to have its own checks to make sure we don't go out of
> bounds. The add_key() function already checks but I added some
> checks to del_key() and set_default_key().
Semantically, that shouldn't be possible unless it advertises support
for WLAN_CIPHER_SUITE_AES_CMAC. Is there a bug in those checks?
The checks don't hurt, obviously.
johannes
^ permalink raw reply
* [patch] iwmc3200wifi: add some more range checks
From: Dan Carpenter @ 2011-10-18 6:50 UTC (permalink / raw)
To: Samuel Ortiz
Cc: Intel Linux Wireless, John W. Linville, linux-wireless,
kernel-janitors
In-Reply-To: <20111012082656.GA13878@sortiz-mobl>
My previous patch added a check to get_key() but missed a couple
other places which need range checks.
The problem here is that wifi drivers have different numbers of keys.
The lower levels assume that they can have up to 4 default keys and
2 management keys but this driver only has the default keys so we
could go past the end of the ->keys[] array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index ed57e44..e20a38d 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -165,11 +165,15 @@ static int iwm_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
struct key_params *params)
{
struct iwm_priv *iwm = ndev_to_iwm(ndev);
- struct iwm_key *key = &iwm->keys[key_index];
+ struct iwm_key *key;
int ret;
IWM_DBG_WEXT(iwm, DBG, "Adding key for %pM\n", mac_addr);
+ if (key_index >= IWM_NUM_KEYS)
+ return -ENOENT;
+
+ key = &iwm->keys[key_index];
memset(key, 0, sizeof(struct iwm_key));
ret = iwm_key_init(key, key_index, mac_addr, params);
if (ret < 0) {
@@ -210,8 +214,12 @@ static int iwm_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
u8 key_index, bool pairwise, const u8 *mac_addr)
{
struct iwm_priv *iwm = ndev_to_iwm(ndev);
- struct iwm_key *key = &iwm->keys[key_index];
+ struct iwm_key *key;
+ if (key_index >= IWM_NUM_KEYS)
+ return -ENOENT;
+
+ key = &iwm->keys[key_index];
if (!iwm->keys[key_index].key_len) {
IWM_DBG_WEXT(iwm, DBG, "Key %d not used\n", key_index);
return 0;
@@ -232,6 +240,9 @@ static int iwm_cfg80211_set_default_key(struct wiphy *wiphy,
IWM_DBG_WEXT(iwm, DBG, "Default key index is: %d\n", key_index);
+ if (key_index >= IWM_NUM_KEYS)
+ return -ENOENT;
+
if (!iwm->keys[key_index].key_len) {
IWM_ERR(iwm, "Key %d not used\n", key_index);
return -EINVAL;
^ permalink raw reply related
* [patch] rndis_wlan: add range check in del_key()
From: Dan Carpenter @ 2011-10-18 6:47 UTC (permalink / raw)
To: Jussi Kivilinna; +Cc: John W. Linville, linux-wireless, kernel-janitors
Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
it needs to have its own checks to make sure we don't go out of
bounds. The add_key() function already checks but I added some
checks to del_key() and set_default_key().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 0c13840..da78369 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -414,6 +414,7 @@ struct ndis_80211_pmkid {
#define RNDIS_WLAN_ALG_TKIP (1<<1)
#define RNDIS_WLAN_ALG_CCMP (1<<2)
+#define RNDIS_WLAN_NUM_KEYS 4
#define RNDIS_WLAN_KEY_MGMT_NONE 0
#define RNDIS_WLAN_KEY_MGMT_802_1X (1<<0)
#define RNDIS_WLAN_KEY_MGMT_PSK (1<<1)
@@ -516,7 +517,7 @@ struct rndis_wlan_private {
/* encryption stuff */
int encr_tx_key_index;
- struct rndis_wlan_encr_key encr_keys[4];
+ struct rndis_wlan_encr_key encr_keys[RNDIS_WLAN_NUM_KEYS];
int wpa_version;
u8 command_buffer[COMMAND_BUFFER_SIZE];
@@ -1535,6 +1536,9 @@ static int remove_key(struct usbnet *usbdev, int index, const u8 *bssid)
bool is_wpa;
int ret;
+ if (index >= RNDIS_WLAN_NUM_KEYS)
+ return -ENOENT;
+
if (priv->encr_keys[index].len == 0)
return 0;
@@ -2451,6 +2455,9 @@ static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
netdev_dbg(usbdev->net, "%s(%i)\n", __func__, key_index);
+ if (key_index >= RNDIS_WLAN_NUM_KEYS)
+ return -ENOENT;
+
priv->encr_tx_key_index = key_index;
if (is_wpa_key(priv, key_index))
^ permalink raw reply related
* Re: ath9k: irq storm after suspend/resume
From: Clemens Buchacher @ 2011-10-18 6:44 UTC (permalink / raw)
To: Adrian Chadd; +Cc: Mohammed Shafi, linux-wireless
In-Reply-To: <CAJ-VmokQBcXyDByWgMfGRFvW_z_9YU4oPUrXJpfPY9J4riEuBQ@mail.gmail.com>
On Sat, Oct 15, 2011 at 06:01:38PM +0800, Adrian Chadd wrote:
>
> Are you able to completely and utterly disable any/all power saving on
> ath9k, including APSM if you have it enabled?
Unfortunately, no change with the following options disabled:
PCIEAER y -> n
PCIEASPM y -> n
PM_RUNTIME y -> n
Anything else I should disable?
Clemens
^ permalink raw reply
* Re: Looking for driver; Intel Pro 2915ABG wireless card
From: Julian Calaby @ 2011-10-18 6:23 UTC (permalink / raw)
To: J C; +Cc: linux-wireless
In-Reply-To: <1318887043.75699.YahooMailClassic@web39406.mail.mud.yahoo.com>
Hi J C,
On Tue, Oct 18, 2011 at 08:30, J C <excelsior415@yahoo.com> wrote:
> Hello, I'm looking to install the most appropriate wireless driver in my Ubuntu 10.04. It's likely the file is "w29n51.inf" but I cannot find it online. The Windows Drivers software is installed on this machine, but if there is a Linux file or direct placement of this driver I'd be also interested.
You're asking on the wrong mailing list. This mailing list is about
the development of wireless drivers for Linux, not the usage of
Windows drivers through some compatibility layer.
That said, this card is supported by the ipw2200 driver, which has
been part of the Linux kernel for years, providing you have
appropriate firmware.
The driver is usually loaded automatically when the card is detected,
and your Linux distribution should have a package containing this
firmware, or it can be downloaded at
http://ipw2200.sourceforge.net/
Thanks,
--
Julian Calaby
Email: julian.calaby@gmail.com
Profile: http://www.google.com/profiles/julian.calaby/
.Plan: http://sites.google.com/site/juliancalaby/
^ permalink raw reply
* [patch 4/4] mwifiex: return -ENOMEM if kzalloc() fails
From: Dan Carpenter @ 2011-10-18 6:19 UTC (permalink / raw)
To: Bing Zhao; +Cc: John W. Linville, linux-wireless, kernel-janitors
Sorry, I've decided to hold this one back. It was written in a lazy
way and only fixed the return codes that Smatch complained about.
I'll redo it and send it later.
regards,
dan carpenter
^ permalink raw reply
* [patch 3/4] mwifiex: prevent corruption instead of just warning
From: Dan Carpenter @ 2011-10-18 6:15 UTC (permalink / raw)
To: Bing Zhao; +Cc: John W. Linville, linux-wireless, kernel-janitors
We may as well put a return here instead of just printing a warning
message and then corrupting memory. The caller doesn't check the
return code.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index d12d440..40b154d 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1228,9 +1228,11 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
if (!skb)
return 0;
- if (rdptr >= MWIFIEX_MAX_EVT_BD)
+ if (rdptr >= MWIFIEX_MAX_EVT_BD) {
dev_err(adapter->dev, "event_complete: Invalid rdptr 0x%x\n",
rdptr);
+ return -EINVAL;
+ }
/* Read the event ring write pointer set by firmware */
if (mwifiex_read_reg(adapter, REG_EVTBD_WRPTR, &wrptr)) {
^ permalink raw reply related
* [patch 2/4] mwifiex: remove an unneeded NULL check
From: Dan Carpenter @ 2011-10-18 6:14 UTC (permalink / raw)
To: Bing Zhao; +Cc: John W. Linville, linux-wireless, kernel-janitors
We dereference adapter in the error handling code so this needed to
be fixed. This function is always called like:
adapter->if_ops.host_to_card(adapter, ...);
so adapter can never be NULL and I've removed the NULL check.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 4466976..d12d440 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1671,9 +1671,8 @@ static int mwifiex_pcie_host_to_card(struct mwifiex_adapter *adapter, u8 type,
struct sk_buff *skb,
struct mwifiex_tx_param *tx_param)
{
- if (!adapter || !skb) {
- dev_err(adapter->dev, "Invalid parameter in %s <%p, %p>\n",
- __func__, adapter, skb);
+ if (!skb) {
+ dev_err(adapter->dev, "Passed NULL skb to %s\n", __func__);
return -1;
}
^ permalink raw reply related
* [patch 1/4] mwifiex: remove unneeded kfree(NULL);
From: Dan Carpenter @ 2011-10-18 6:13 UTC (permalink / raw)
To: Bing Zhao; +Cc: John W. Linville, linux-wireless, kernel-janitors
The previous if statement means this that pointer is NULL so there
is no need to free it.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index d34acf0..4466976 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -386,7 +386,6 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
card->txbd_ring_vbase = kzalloc(card->txbd_ring_size, GFP_KERNEL);
if (!card->txbd_ring_vbase) {
dev_err(adapter->dev, "Unable to allocate buffer for txbd ring.\n");
- kfree(card->txbd_ring_vbase);
return -1;
}
card->txbd_ring_pbase = virt_to_phys(card->txbd_ring_vbase);
^ permalink raw reply related
* Re: Alfa AWUS036NHR with RTL8188RU chipset
From: Larry Finger @ 2011-10-18 3:23 UTC (permalink / raw)
To: v4mp; +Cc: linux-wireless
In-Reply-To: <loom.20111017T190430-717@post.gmane.org>
On 10/17/2011 12:09 PM, v4mp wrote:
>
>
> ok, i've checked the md5 checksum of the firmware and is ok,
> i give you dmesg at pastebin.com
>
> it has 2 parts: in the second part i can't see what is in previous of the error
>
> the link is: http://pastebin.com/7tfcBfbD
Please try blacklisting xhci-hcd by adding a line containing
"blacklist xhci-hcd" to the end of /etc/modprobe.d/50-blacklist.conf.
Thanks,
Larry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox