* Re: RTL8187B is racy
From: Alexandre Oliva @ 2013-10-22 19:30 UTC (permalink / raw)
To: Larry Finger; +Cc: linux-wireless
In-Reply-To: <52669A94.3070600@lwfinger.net>
On Oct 22, 2013, Larry Finger <Larry.Finger@lwfinger.net> wrote:
> After inspecting the code in rtl8187b_status_cb, I did notice that it
> does a lot of things that should be done by mac80211. As you have been
> testing code modifications, I assume that you will be able to test any
> patches that I generate.
Yeah, I can easily build and test patches here, at my workplace at home.
The only catch is that the module already works here; it seems to fail
only at busier environments, which I only get into once a month or so.
As long as we're not in much of a hurry, I can have things set up so
that, whenever I hit the problem with the module as it is now, I have a
patched module handy to test. So, I'm looking forward to your patches
and/or suggestions on what else to try. Just please make sure you Cc:
me, so that I won't miss it.
Thanks a lot!
--
Alexandre Oliva, freedom fighter http://FSFLA.org/~lxoliva/
You must be the change you wish to see in the world. -- Gandhi
Be Free! -- http://FSFLA.org/ FSF Latin America board member
Free Software Evangelist Red Hat Brazil Compiler Engineer
^ permalink raw reply
* [PATCH 3.12] cfg80211: fix ibss wext chandef creation
From: Simon Wunderlich @ 2013-10-22 20:02 UTC (permalink / raw)
To: linux-wireless
Cc: Mathias Kretschmer, Dirk Gouders, Linux Kernel, Johannes Berg,
Simon Wunderlich
The wext internal chandefs for ibss should be created using the
cfg80211_chandef_create() functions. Otherwise the center_freq1 field
will not be set and cfg80211_chandef_valid() will spit a warning and
report the chandef as invalid when it should be used.
Reported-by: Dirk Gouders <dirk@gouders.net>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Cc: Johannes Berg <johannes.berg@intel.com>
---
net/wireless/ibss.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 39bff7d..a710019 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -246,7 +246,7 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
/* try to find an IBSS channel if none requested ... */
if (!wdev->wext.ibss.chandef.chan) {
- wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+ struct ieee80211_channel *new_chan = NULL;
for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
struct ieee80211_supported_band *sband;
@@ -262,16 +262,19 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
continue;
if (chan->flags & IEEE80211_CHAN_DISABLED)
continue;
- wdev->wext.ibss.chandef.chan = chan;
+ new_chan = chan;
break;
}
- if (wdev->wext.ibss.chandef.chan)
+ if (new_chan)
break;
}
- if (!wdev->wext.ibss.chandef.chan)
+ if (!new_chan)
return -EINVAL;
+
+ cfg80211_chandef_create(&wdev->wext.ibss.chandef, new_chan,
+ NL80211_CHAN_NO_HT);
}
/* don't join -- SSID is not there */
@@ -345,8 +348,8 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
return err;
if (chan) {
- wdev->wext.ibss.chandef.chan = chan;
- wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+ cfg80211_chandef_create(&wdev->wext.ibss.chandef, chan,
+ NL80211_CHAN_NO_HT);
wdev->wext.ibss.channel_fixed = true;
} else {
/* cfg80211_ibss_wext_join will pick one if needed */
--
1.7.10.4
^ permalink raw reply related
* RE: [PATCH 07/14] mwifiex: consolidate no-ibss and passive scan to no-ir
From: Bing Zhao @ 2013-10-22 22:21 UTC (permalink / raw)
To: Luis R. Rodriguez, linville@tuxdriver.com,
johannes@sipsolutions.net
Cc: linux-wireless@vger.kernel.org, janusz.dziedzic@tieto.com,
smihir@qti.qualcomm.com, tushnimb@qca.qualcomm.com,
Amitkumar Karwar
In-Reply-To: <1382376158-25586-8-git-send-email-mcgrof@do-not-panic.com>
Hi Luis,
> Subject: [PATCH 07/14] mwifiex: consolidate no-ibss and passive scan to no-ir
>
> Cc: Amitkumar Karwar <akarwar@marvell.com>
> Cc: Bing Zhao <bzhao@marvell.com>
> Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Thanks,
Bing
^ permalink raw reply
* Re: ath10k hits warning in sta_info.c:839.
From: Ben Greear @ 2013-10-22 22:22 UTC (permalink / raw)
To: ath10k, linux-wireless@vger.kernel.org
In-Reply-To: <5266C321.7000103@candelatech.com>
On 10/22/2013 11:25 AM, Ben Greear wrote:
> Kernel is stock 'ath' tree, with small printk to debug an ath10k
> crash.
>
> This is FYI for now...will be looking at other ath10k crash bugs
> before digging into this tone.
>
> Setup is 2 stations trying to associate to same AP, which causes
> endless failures and firmware crashes. Good for chasing bugs :)
>
>
> DMAR:[fault reason 05] PTE Write access is not set
> dmar: DRHD: handling fault status reg 3
> dmar: DMAR:[DMA Write] Request device [05:00.0] fault addr ffd52000
> DMAR:[fault reason 05] PTE Write access is not set
> dmar: DRHD: handling fault status reg 3
> dmar: DMAR:[DMA Write] Request device [05:00.0] fault addr ffd52000
> DMAR:[fault reason 05] PTE Write access is not set
>
> sta300: authentication with 00:03:83:3d:30:aa timed out
> [root@ct523-9292 ~]# ath10k: Failed to delete peer: 00:03:83:3d:30:aa for VDEV: 1
> ath10k: WMI vdev stop failed: ret -108
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 6 at /mnt/sda/home/greearb/git/ath/net/mac80211/sta_info.c:839 __sta_info_destroy+0x12)
> Modules linked in: nf_nat_ipv4 nf_nat veth 8021q garp stp mrp llc macvlan pktgen lockd f71882fg coretemp hw]
I think this may be a result of whatever bug or limitation
caused the firmware to error and/or crash when adding a second
station VIF and trying to associate it to the same AP.
Probably not a problem with the rest of the wifi stacks.
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply
* [PATCH 3/6] mwifiex: fix invalid memory access in mwifiex_get_power_level()
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
In-Reply-To: <1382480687-12720-1-git-send-email-bzhao@marvell.com>
From: Amitkumar Karwar <akarwar@marvell.com>
With "while (length)" check we may end up in accessing invalid
memory in last iteration.
This patch makes sure that tlv length is not less than the length
of structure mwifiex_power_group when min/max power is calculated.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/sta_cmdresp.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index bdf50fd..5edea4d 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -341,12 +341,16 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
pg = (struct mwifiex_power_group *)
((u8 *) pg_tlv_hdr + sizeof(struct mwifiex_types_power_group));
length = le16_to_cpu(pg_tlv_hdr->length);
- if (length > 0) {
- max_power = pg->power_max;
- min_power = pg->power_min;
- length -= sizeof(struct mwifiex_power_group);
- }
- while (length) {
+
+ /* At least one structure required to update power */
+ if (length < sizeof(struct mwifiex_power_group))
+ return 0;
+
+ max_power = pg->power_max;
+ min_power = pg->power_min;
+ length -= sizeof(struct mwifiex_power_group);
+
+ while (length >= sizeof(struct mwifiex_power_group)) {
pg++;
if (max_power < pg->power_max)
max_power = pg->power_max;
@@ -356,10 +360,8 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
length -= sizeof(struct mwifiex_power_group);
}
- if (le16_to_cpu(pg_tlv_hdr->length) > 0) {
- priv->min_tx_power_level = (u8) min_power;
- priv->max_tx_power_level = (u8) max_power;
- }
+ priv->min_tx_power_level = (u8) min_power;
+ priv->max_tx_power_level = (u8) max_power;
return 0;
}
--
1.8.2.3
^ permalink raw reply related
* [PATCH 4/6] mwifiex: fix invalid memory access in mwifiex_ret_tx_rate_cfg()
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
In-Reply-To: <1382480687-12720-1-git-send-email-bzhao@marvell.com>
From: Amitkumar Karwar <akarwar@marvell.com>
As tlv_buf_len is decremented at the end of the loop, we may have
accessed invalid memory in the last iteration.
Modify the while condition and add a break statement at the
begining of the loop to fix the problem.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/sta_cmdresp.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 5edea4d..2675ca7 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -274,17 +274,20 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
struct host_cmd_ds_tx_rate_cfg *rate_cfg = &resp->params.tx_rate_cfg;
struct mwifiex_rate_scope *rate_scope;
struct mwifiex_ie_types_header *head;
- u16 tlv, tlv_buf_len;
+ u16 tlv, tlv_buf_len, tlv_buf_left;
u8 *tlv_buf;
u32 i;
- tlv_buf = ((u8 *)rate_cfg) +
- sizeof(struct host_cmd_ds_tx_rate_cfg);
- tlv_buf_len = le16_to_cpu(*(__le16 *) (tlv_buf + sizeof(u16)));
+ tlv_buf = ((u8 *)rate_cfg) + sizeof(struct host_cmd_ds_tx_rate_cfg);
+ tlv_buf_left = le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*rate_cfg);
- while (tlv_buf && tlv_buf_len > 0) {
- tlv = (*tlv_buf);
- tlv = tlv | (*(tlv_buf + 1) << 8);
+ while (tlv_buf_left >= sizeof(*head)) {
+ head = (struct mwifiex_ie_types_header *)tlv_buf;
+ tlv = le16_to_cpu(head->type);
+ tlv_buf_len = le16_to_cpu(head->len);
+
+ if (tlv_buf_left < (sizeof(*head) + tlv_buf_len))
+ break;
switch (tlv) {
case TLV_TYPE_RATE_SCOPE:
@@ -304,9 +307,8 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
/* Add RATE_DROP tlv here */
}
- head = (struct mwifiex_ie_types_header *) tlv_buf;
- tlv_buf += le16_to_cpu(head->len) + sizeof(*head);
- tlv_buf_len -= le16_to_cpu(head->len);
+ tlv_buf += (sizeof(*head) + tlv_buf_len);
+ tlv_buf_left -= (sizeof(*head) + tlv_buf_len);
}
priv->is_data_rate_auto = mwifiex_is_rate_auto(priv);
--
1.8.2.3
^ permalink raw reply related
* [PATCH 2/6] mwifiex: replace u16 with __le16 in struct mwifiex_types_power_group
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
In-Reply-To: <1382480687-12720-1-git-send-email-bzhao@marvell.com>
From: Amitkumar Karwar <akarwar@marvell.com>
__le16 to u16 conversion is missing for "pg_tlv_hdr->length"
in mwifiex_get_power_level(). This creates a problem on big
endian machines.
It is resolved by changing definition of the structure
and making required endianness changes.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/fw.h | 4 ++--
drivers/net/wireless/mwifiex/sta_cmd.c | 4 ++--
drivers/net/wireless/mwifiex/sta_cmdresp.c | 4 ++--
drivers/net/wireless/mwifiex/sta_ioctl.c | 5 +++--
4 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index f80f30b..c8385ec 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -1020,8 +1020,8 @@ struct mwifiex_power_group {
} __packed;
struct mwifiex_types_power_group {
- u16 type;
- u16 length;
+ __le16 type;
+ __le16 length;
} __packed;
struct host_cmd_ds_txpwr_cfg {
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 7d66018..2181ee2 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -239,14 +239,14 @@ static int mwifiex_cmd_tx_power_cfg(struct host_cmd_ds_command *cmd,
memmove(cmd_txp_cfg, txp,
sizeof(struct host_cmd_ds_txpwr_cfg) +
sizeof(struct mwifiex_types_power_group) +
- pg_tlv->length);
+ le16_to_cpu(pg_tlv->length));
pg_tlv = (struct mwifiex_types_power_group *) ((u8 *)
cmd_txp_cfg +
sizeof(struct host_cmd_ds_txpwr_cfg));
cmd->size = cpu_to_le16(le16_to_cpu(cmd->size) +
sizeof(struct mwifiex_types_power_group) +
- pg_tlv->length);
+ le16_to_cpu(pg_tlv->length));
} else {
memmove(cmd_txp_cfg, txp, sizeof(*txp));
}
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 58a6013..bdf50fd 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -340,7 +340,7 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
((u8 *) data_buf + sizeof(struct host_cmd_ds_txpwr_cfg));
pg = (struct mwifiex_power_group *)
((u8 *) pg_tlv_hdr + sizeof(struct mwifiex_types_power_group));
- length = pg_tlv_hdr->length;
+ length = le16_to_cpu(pg_tlv_hdr->length);
if (length > 0) {
max_power = pg->power_max;
min_power = pg->power_min;
@@ -356,7 +356,7 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
length -= sizeof(struct mwifiex_power_group);
}
- if (pg_tlv_hdr->length > 0) {
+ if (le16_to_cpu(pg_tlv_hdr->length) > 0) {
priv->min_tx_power_level = (u8) min_power;
priv->max_tx_power_level = (u8) max_power;
}
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index f084412..c8e029d 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -638,8 +638,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
txp_cfg->mode = cpu_to_le32(1);
pg_tlv = (struct mwifiex_types_power_group *)
(buf + sizeof(struct host_cmd_ds_txpwr_cfg));
- pg_tlv->type = TLV_TYPE_POWER_GROUP;
- pg_tlv->length = 4 * sizeof(struct mwifiex_power_group);
+ pg_tlv->type = cpu_to_le16(TLV_TYPE_POWER_GROUP);
+ pg_tlv->length =
+ cpu_to_le16(4 * sizeof(struct mwifiex_power_group));
pg = (struct mwifiex_power_group *)
(buf + sizeof(struct host_cmd_ds_txpwr_cfg)
+ sizeof(struct mwifiex_types_power_group));
--
1.8.2.3
^ permalink raw reply related
* [PATCH 0/6] mwifiex: potential integer underflow and invalid mem access
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
This patch series fixes potential integer underflow and invalid memory access issues reported by Dan Carpenter.
Amitkumar Karwar (5):
mwifiex: replace u16 with __le16 in struct mwifiex_types_power_group
mwifiex: fix invalid memory access in mwifiex_get_power_level()
mwifiex: fix invalid memory access in mwifiex_ret_tx_rate_cfg()
mwifiex: fix invalid memory access in mwifiex_update_autoindex_ies()
mwifiex: improvements in mwifiex_ret_tx_power_cfg()
Dan Carpenter (1):
mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status()
drivers/net/wireless/mwifiex/fw.h | 4 +-
drivers/net/wireless/mwifiex/ie.c | 11 ++--
drivers/net/wireless/mwifiex/sta_cmd.c | 4 +-
drivers/net/wireless/mwifiex/sta_cmdresp.c | 81 +++++++++++++++---------------
drivers/net/wireless/mwifiex/sta_ioctl.c | 5 +-
drivers/net/wireless/mwifiex/wmm.c | 3 ++
6 files changed, 58 insertions(+), 50 deletions(-)
--
1.8.2.3
^ permalink raw reply
* [PATCH 6/6] mwifiex: improvements in mwifiex_ret_tx_power_cfg()
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
In-Reply-To: <1382480687-12720-1-git-send-email-bzhao@marvell.com>
From: Amitkumar Karwar <akarwar@marvell.com>
1) Move common code out of switch case handling
2) Return from the function if number of bytes left in response buffer
are less than tlv size
3) Pass pg_tlv_hdr directly instead of txp_cfg to mwifiex_get_power_level()
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/sta_cmdresp.c | 35 ++++++++++++++----------------
1 file changed, 16 insertions(+), 19 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 2675ca7..5511946 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -338,8 +338,7 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
if (!data_buf)
return -1;
- pg_tlv_hdr = (struct mwifiex_types_power_group *)
- ((u8 *) data_buf + sizeof(struct host_cmd_ds_txpwr_cfg));
+ pg_tlv_hdr = (struct mwifiex_types_power_group *)((u8 *)data_buf);
pg = (struct mwifiex_power_group *)
((u8 *) pg_tlv_hdr + sizeof(struct mwifiex_types_power_group));
length = le16_to_cpu(pg_tlv_hdr->length);
@@ -383,19 +382,25 @@ static int mwifiex_ret_tx_power_cfg(struct mwifiex_private *priv,
struct mwifiex_types_power_group *pg_tlv_hdr;
struct mwifiex_power_group *pg;
u16 action = le16_to_cpu(txp_cfg->action);
+ u16 tlv_buf_left;
- switch (action) {
- case HostCmd_ACT_GEN_GET:
- pg_tlv_hdr = (struct mwifiex_types_power_group *)
- ((u8 *) txp_cfg +
- sizeof(struct host_cmd_ds_txpwr_cfg));
+ pg_tlv_hdr = (struct mwifiex_types_power_group *)
+ ((u8 *)txp_cfg +
+ sizeof(struct host_cmd_ds_txpwr_cfg));
- pg = (struct mwifiex_power_group *)
- ((u8 *) pg_tlv_hdr +
- sizeof(struct mwifiex_types_power_group));
+ pg = (struct mwifiex_power_group *)
+ ((u8 *)pg_tlv_hdr +
+ sizeof(struct mwifiex_types_power_group));
+ tlv_buf_left = le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*txp_cfg);
+ if (tlv_buf_left <
+ le16_to_cpu(pg_tlv_hdr->length) + sizeof(*pg_tlv_hdr))
+ return 0;
+
+ switch (action) {
+ case HostCmd_ACT_GEN_GET:
if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING)
- mwifiex_get_power_level(priv, txp_cfg);
+ mwifiex_get_power_level(priv, pg_tlv_hdr);
priv->tx_power_level = (u16) pg->power_min;
break;
@@ -404,14 +409,6 @@ static int mwifiex_ret_tx_power_cfg(struct mwifiex_private *priv,
if (!le32_to_cpu(txp_cfg->mode))
break;
- pg_tlv_hdr = (struct mwifiex_types_power_group *)
- ((u8 *) txp_cfg +
- sizeof(struct host_cmd_ds_txpwr_cfg));
-
- pg = (struct mwifiex_power_group *)
- ((u8 *) pg_tlv_hdr +
- sizeof(struct mwifiex_types_power_group));
-
if (pg->power_max == pg->power_min)
priv->tx_power_level = (u16) pg->power_min;
break;
--
1.8.2.3
^ permalink raw reply related
* [PATCH 5/6] mwifiex: fix invalid memory access in mwifiex_update_autoindex_ies()
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
In-Reply-To: <1382480687-12720-1-git-send-email-bzhao@marvell.com>
From: Amitkumar Karwar <akarwar@marvell.com>
While parsing TLVs, return failure if number of remaining bytes
are less than current tlv length. This avoids invalid memory
access.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/ie.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index 220af4f..81ac001 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -82,7 +82,7 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
struct mwifiex_ie_list *ie_list)
{
u16 travel_len, index, mask;
- s16 input_len;
+ s16 input_len, tlv_len;
struct mwifiex_ie *ie;
u8 *tmp;
@@ -91,11 +91,13 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
ie_list->len = 0;
- while (input_len > 0) {
+ while (input_len >= sizeof(struct mwifiex_ie_types_header)) {
ie = (struct mwifiex_ie *)(((u8 *)ie_list) + travel_len);
- input_len -= le16_to_cpu(ie->ie_length) + MWIFIEX_IE_HDR_SIZE;
- travel_len += le16_to_cpu(ie->ie_length) + MWIFIEX_IE_HDR_SIZE;
+ tlv_len = le16_to_cpu(ie->ie_length);
+ travel_len += tlv_len + MWIFIEX_IE_HDR_SIZE;
+ if (input_len < tlv_len + MWIFIEX_IE_HDR_SIZE)
+ return -1;
index = le16_to_cpu(ie->ie_index);
mask = le16_to_cpu(ie->mgmt_subtype_mask);
@@ -132,6 +134,7 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
le16_add_cpu(&ie_list->len,
le16_to_cpu(priv->mgmt_ie[index].ie_length) +
MWIFIEX_IE_HDR_SIZE);
+ input_len -= tlv_len + MWIFIEX_IE_HDR_SIZE;
}
if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
--
1.8.2.3
^ permalink raw reply related
* [PATCH 1/6] mwifiex: potential integer underflow in mwifiex_ret_wmm_get_status()
From: Bing Zhao @ 2013-10-22 22:24 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Dan Carpenter, Amitkumar Karwar, Avinash Patil,
Nishant Sarmukadam, Frank Huang, Bing Zhao
In-Reply-To: <1382480687-12720-1-git-send-email-bzhao@marvell.com>
From: Dan Carpenter <dan.carpenter@oracle.com>
Before we loop for next iteration we adjust the buffer pointer and
"resp_len":
curr += (tlv_len + sizeof(tlv_hdr->header));
resp_len -= (tlv_len + sizeof(tlv_hdr->header));
If "resp_len" gets set to negative then it counts as a high positive
value.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/wmm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 5dd0ccc..13eaeed 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -722,6 +722,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
tlv_hdr = (struct mwifiex_ie_types_data *) curr;
tlv_len = le16_to_cpu(tlv_hdr->header.len);
+ if (resp_len < tlv_len + sizeof(tlv_hdr->header))
+ break;
+
switch (le16_to_cpu(tlv_hdr->header.type)) {
case TLV_TYPE_WMMQSTATUS:
tlv_wmm_qstatus =
--
1.8.2.3
^ permalink raw reply related
* Fwd: Problem with ALFA AWUS036h and openwrt
From: rl @ 2013-10-22 22:44 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <CA+fsWUr=_MT+m9P_=XRj_mnUzcmvgAZA0tME8CP+3ho8pGY5qQ@mail.gmail.com>
---------- Forwarded message ----------
From: rl <rl608742063@gmail.com>
Date: 2013/10/23
Subject: Problem with ALFA AWUS036h and openwrt
To: linux-wireless <linux-wireless@vger.kernel.org>
To: linux-wireless@vger.kernel.org
Hi,
I am trying to use ALFA AWUS036h
in openwrt kernel 3.3.8
#1 -OpenWrt revision r38455 Attitude_addiustement - card is connected to
usb port and there is a problem with drivers. The rtl8187 is installed.
There is short description of actions
WWPA2 PSK log shows when I am trying to connect to AP
Oct 21 17:01:43 OpenWrt kern.info kernel: [ 796.610000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.890000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.910000] wlan0: authenticated
Oct 21 17:01:44 OpenWrt daemon.notice hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: did not acknowledge authentication
response
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.940000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:44 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: associated (aid 1)
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.970000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 797.010000] wlan0: associated
Oct 21 17:01:46 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:47 OpenWrt kern.info kernel: [ 800.110000] wlan0:
deauthenticated from 00:0c:03:10:1e:6d (Reason: 2)
Oct 21 17:01:49 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:52 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: deauthenticated due to local deauth
request
Oct 21 17:01:52 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:55 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:58 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:01 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:01 OpenWrt cron.info crond[1311]: crond: USER root pid
4731 cmd /bin/tester.sh
Oct 21 17:02:02 OpenWrt daemon.notice netifd: Interface 'wan' is now down
Oct 21 17:02:04 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:07 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 821.940000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.230000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.450000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.670000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 3/3)
Oct 21 17:02:09 OpenWrt daemon.notice hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: did not acknowledge authentication
response
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.700000] wlan0: authenticated
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.710000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:02:09 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: associated (aid 1)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.750000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.780000] wlan0: associated
Oct 21 17:02:10 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:12 OpenWrt kern.info kernel: [ 825.860000] wlan0:
deauthenticated from 00:0c:03:10:1e:6d (Reason: 2)
Oct 21 17:02:13 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:16 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:17 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: deauthenticated due to local deauth
request
Oct 21 17:02:19 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:22 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:25 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:29 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:32 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:34 OpenWrt kern.info kernel: [ 847.760000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:02:35 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:35 OpenWrt kern.info kernel: [ 848.060000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:02:35 OpenWrt kern.info kernel: [ 848.280000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:02:35 OpenWrt kern.info kernel: [ 848.500000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 3/3)
root@OpenWrt:/# logread
Oct 21 16:58:51 OpenWrt kern.info kernel: [ 624.290000] br-lan: port
2(wlan1) entered disabled state
Oct 21 16:58:51 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:58:52 OpenWrt daemon.notice netifd: Interface 'wwan' is now down
Oct 21 16:58:54 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:58:57 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:58:58 OpenWrt kern.info kernel: [ 631.210000]
ADDRCONF(NETDEV_UP): wlan1: link is not ready
Oct 21 16:58:58 OpenWrt kern.info kernel: [ 631.260000] device wlan1
entered promiscuous mode
Oct 21 16:58:58 OpenWrt kern.info kernel: [ 631.410000]
ADDRCONF(NETDEV_UP): wlan1: link is not ready
Oct 21 16:58:59 OpenWrt kern.info kernel: [ 632.360000] br-lan: port
2(wlan1) entered forwarding state
Oct 21 16:58:59 OpenWrt kern.info kernel: [ 632.370000] br-lan: port
2(wlan1) entered forwarding state
Oct 21 16:58:59 OpenWrt kern.info kernel: [ 632.380000]
ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
Oct 21 16:59:00 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:01 OpenWrt kern.info kernel: [ 634.370000] br-lan: port
2(wlan1) entered forwarding state
Oct 21 16:59:03 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:06 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:07 OpenWrt kern.info kernel: [ 640.350000]
ADDRCONF(NETDEV_UP): wlan0: link is not ready
Oct 21 16:59:09 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:11 OpenWrt daemon.notice netifd: Interface 'wwan' is now up
Oct 21 16:59:12 OpenWrt daemon.info dnsmasq[3130]: exiting on receipt of SIGTERM
Oct 21 16:59:13 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:13 OpenWrt user.notice firewall: Reloading firewall due
to ifup of wwan (wlan0)
Oct 21 16:59:16 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:17 OpenWrt user.notice dnsmasq: DNS rebinding protection
is active, will discard upstream RFC1918 responses!
Oct 21 16:59:17 OpenWrt user.notice dnsmasq: Allowing 127.0.0.0/8 responses
Oct 21 16:59:19 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:21 OpenWrt daemon.info dnsmasq[3830]: started, version
2.66 cachesize 150
Oct 21 16:59:21 OpenWrt daemon.info dnsmasq[3830]: compile time
options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua
TFTP no-conntrack no-ipset no-auth
Oct 21 16:59:21 OpenWrt daemon.info dnsmasq-dhcp[3830]: DHCP, IP range
192.168.1.100 -- 192.168.1.249, lease time 12h
Oct 21 16:59:21 OpenWrt daemon.info dnsmasq[3830]: using local
addresses only for domain lan
Oct 21 16:59:21 OpenWrt daemon.warn dnsmasq[3830]: no servers found in
/tmp/resolv.conf.auto, will retry
Oct 21 16:59:21 OpenWrt daemon.info dnsmasq[3830]: read /etc/hosts - 1 addresses
Oct 21 16:59:21 OpenWrt daemon.info dnsmasq-dhcp[3830]: read
/etc/ethers - 0 addresses
Oct 21 16:59:22 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:25 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:28 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:31 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:34 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:37 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:40 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:43 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:46 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:49 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:52 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:55 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 16:59:58 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:01 OpenWrt cron.info crond[1311]: crond: USER root pid
4039 cmd /bin/tester.sh
Oct 21 17:00:02 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:02 OpenWrt daemon.notice netifd: Interface 'wan' is now down
Oct 21 17:00:05 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:08 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:11 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:14 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:17 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:20 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:23 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:26 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:29 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:32 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:35 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:38 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:41 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:44 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:47 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:50 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:52 OpenWrt daemon.notice netifd: Interface 'wwan' is now down
Oct 21 17:00:53 OpenWrt kern.info kernel: [ 746.150000] device wlan1
left promiscuous mode
Oct 21 17:00:53 OpenWrt kern.info kernel: [ 746.160000] br-lan: port
2(wlan1) entered disabled state
Oct 21 17:00:54 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:57 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:00:59 OpenWrt kern.info kernel: [ 752.710000]
ADDRCONF(NETDEV_UP): wlan1: link is not ready
Oct 21 17:00:59 OpenWrt kern.info kernel: [ 752.730000] device wlan1
entered promiscuous mode
Oct 21 17:00:59 OpenWrt kern.info kernel: [ 752.870000]
ADDRCONF(NETDEV_UP): wlan1: link is not ready
Oct 21 17:01:00 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:01 OpenWrt kern.info kernel: [ 753.950000] br-lan: port
2(wlan1) entered forwarding state
Oct 21 17:01:01 OpenWrt kern.info kernel: [ 753.960000] br-lan: port
2(wlan1) entered forwarding state
Oct 21 17:01:01 OpenWrt kern.info kernel: [ 753.970000]
ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
Oct 21 17:01:03 OpenWrt kern.info kernel: [ 755.960000] br-lan: port
2(wlan1) entered forwarding state
Oct 21 17:01:03 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:06 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:08 OpenWrt kern.info kernel: [ 761.870000]
ADDRCONF(NETDEV_UP): wlan0: link is not ready
Oct 21 17:01:09 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:12 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:14 OpenWrt kern.info kernel: [ 767.440000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:01:14 OpenWrt kern.info kernel: [ 767.750000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:14 OpenWrt kern.info kernel: [ 767.780000] wlan0: authenticated
Oct 21 17:01:14 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: authenticated
Oct 21 17:01:14 OpenWrt kern.info kernel: [ 767.820000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:15 OpenWrt kern.info kernel: [ 767.880000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:01:15 OpenWrt kern.info kernel: [ 767.940000] wlan0: associated
Oct 21 17:01:15 OpenWrt kern.info kernel: [ 767.940000]
ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
Oct 21 17:01:15 OpenWrt daemon.info dnsmasq[3830]: exiting on receipt of SIGTERM
Oct 21 17:01:15 OpenWrt daemon.notice netifd: wwan (4472): udhcpc
(v1.19.4) started
Oct 21 17:01:15 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:15 OpenWrt daemon.notice netifd: wwan (4472): Sending discover...
Oct 21 17:01:17 OpenWrt user.notice dnsmasq: DNS rebinding protection
is active, will discard upstream RFC1918 responses!
Oct 21 17:01:17 OpenWrt user.notice dnsmasq: Allowing 127.0.0.0/8 responses
Oct 21 17:01:18 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:18 OpenWrt daemon.notice netifd: wwan (4472): Sending discover...
Oct 21 17:01:20 OpenWrt daemon.info dnsmasq[4513]: started, version
2.66 cachesize 150
Oct 21 17:01:20 OpenWrt daemon.info dnsmasq[4513]: compile time
options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua
TFTP no-conntrack no-ipset no-auth
Oct 21 17:01:20 OpenWrt daemon.info dnsmasq-dhcp[4513]: DHCP, IP range
192.168.1.100 -- 192.168.1.249, lease time 12h
Oct 21 17:01:20 OpenWrt daemon.info dnsmasq[4513]: using local
addresses only for domain lan
Oct 21 17:01:20 OpenWrt daemon.warn dnsmasq[4513]: no servers found in
/tmp/resolv.conf.auto, will retry
Oct 21 17:01:20 OpenWrt daemon.info dnsmasq[4513]: read /etc/hosts - 1 addresses
Oct 21 17:01:20 OpenWrt daemon.info dnsmasq-dhcp[4513]: read
/etc/ethers - 0 addresses
Oct 21 17:01:21 OpenWrt daemon.notice netifd: wwan (4472): Sending discover...
Oct 21 17:01:21 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:25 OpenWrt kern.info kernel: [ 777.960000] wlan0:
deauthenticating from 00:0c:03:10:1e:6d by local choice (reason=3)
Oct 21 17:01:25 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:27 OpenWrt kern.info kernel: [ 780.530000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:01:27 OpenWrt kern.info kernel: [ 780.810000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:28 OpenWrt kern.info kernel: [ 781.030000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:01:28 OpenWrt kern.info kernel: [ 781.040000] wlan0: authenticated
Oct 21 17:01:28 OpenWrt daemon.notice hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: did not acknowledge authentication
response
Oct 21 17:01:28 OpenWrt kern.info kernel: [ 781.060000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:28 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:28 OpenWrt kern.info kernel: [ 781.280000] wlan0:
associate with 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:01:28 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: associated (aid 1)
Oct 21 17:01:28 OpenWrt kern.info kernel: [ 781.320000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:01:28 OpenWrt kern.info kernel: [ 781.360000] wlan0: associated
Oct 21 17:01:31 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:31 OpenWrt kern.info kernel: [ 784.480000] wlan0:
deauthenticated from 00:0c:03:10:1e:6d (Reason: 2)
Oct 21 17:01:34 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:36 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: deauthenticated due to local deauth
request
Oct 21 17:01:37 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:40 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:43 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:43 OpenWrt kern.info kernel: [ 796.610000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.890000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.910000] wlan0: authenticated
Oct 21 17:01:44 OpenWrt daemon.notice hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: did not acknowledge authentication
response
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.940000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:01:44 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: associated (aid 1)
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 796.970000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:01:44 OpenWrt kern.info kernel: [ 797.010000] wlan0: associated
Oct 21 17:01:46 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:47 OpenWrt kern.info kernel: [ 800.110000] wlan0:
deauthenticated from 00:0c:03:10:1e:6d (Reason: 2)
Oct 21 17:01:49 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:52 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: deauthenticated due to local deauth
request
Oct 21 17:01:52 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:55 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:01:58 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:01 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:01 OpenWrt cron.info crond[1311]: crond: USER root pid
4731 cmd /bin/tester.sh
Oct 21 17:02:02 OpenWrt daemon.notice netifd: Interface 'wan' is now down
Oct 21 17:02:04 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:07 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 821.940000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.230000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.450000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.670000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 3/3)
Oct 21 17:02:09 OpenWrt daemon.notice hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: did not acknowledge authentication
response
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.700000] wlan0: authenticated
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.710000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:02:09 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: associated (aid 1)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.750000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:02:09 OpenWrt kern.info kernel: [ 822.780000] wlan0: associated
Oct 21 17:02:10 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:12 OpenWrt kern.info kernel: [ 825.860000] wlan0:
deauthenticated from 00:0c:03:10:1e:6d (Reason: 2)
Oct 21 17:02:13 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:16 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:17 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: deauthenticated due to local deauth
request
Oct 21 17:02:19 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:22 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:25 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:29 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:32 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:34 OpenWrt kern.info kernel: [ 847.760000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:02:35 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:02:35 OpenWrt kern.info kernel: [ 848.060000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:02:35 OpenWrt kern.info kernel: [ 848.280000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:02:35 OpenWrt kern.info kernel: [ 848.500000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 3/3)
WPA PSK
Oct 21 17:08:20 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: deauthenticated due to local deauth
request
Oct 21 17:08:23 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:08:26 OpenWrt user.info sysinit: ping: bad address 'google.com'
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1200.900000] wlan0:
authenticate with 00:0c:03:10:1e:6d
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1201.180000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1201.400000] wlan0: send
auth to 00:0c:03:10:1e:6d (try 2/3)
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1201.410000] wlan0: authenticated
Oct 21 17:08:28 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: authenticated
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1201.430000] wlan0:
associate with 00:0c:03:10:1e:6d (try 1/3)
Oct 21 17:08:28 OpenWrt daemon.info hostapd: wlan1: STA
00:c0:ca:66:66:6a IEEE 802.11: associated (aid 1)
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1201.460000] wlan0: RX
AssocResp from 00:0c:03:10:1e:6d (capab=0x431 status=0 aid=1)
Oct 21 17:08:28 OpenWrt kern.info kernel: [ 1201.480000] wlan0: associated
Oct 21 17:08:29 OpenWrt user.info sysinit: ping: bad address 'google.com'
WWPA-PSK/WPA2-PSK MIXEDMODE
WORK for other OpenWrt master mode AP for different AP with this
setting sometimes work
only when radio is set as radio1
config wifi-device 'radio0'
option type 'mac80211'
option channel '11'
option hwmode '11ng'
option macaddr '00:0c:03:10:1e:6d'
option htmode 'HT20'
list ht_capab 'GF'
list ht_capab 'SHORT-GI-20'
list ht_capab 'SHORT-GI-40'
list ht_capab 'RX-STBC1'
option txpower '20'
option country '00'
config wifi-iface
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'psk-mixed+tkip+ccmp'
option key 'dupadupa'
config wifi-device 'radio1'
option type 'mac80211'
option channel '11'
option hwmode '11g'
option macaddr '00:c0:ca:66:66:6a'
option txpower '20'
option country '00'
option disabled '0'
config wifi-iface
option network 'wwan'
option ssid 'rl_aero2'
option encryption 'psk2'
option device 'radio1'
option mode 'sta'
option bssid '78:1D:BA:12:74:C8'
option key 'xxxxxxxxxxx'
when the lan is set to bridge usualy there is such info during bring
up (openwrt trunk)
root@OpenWrt:/# ifup wwan
command failed: Device or resource busy (-16)
wpa_supplicant_setup_vif(
wlan0): Refusing to bridge sta mode interface
enable_mac80211(radio1): Failed to set up wpa_supplicant for interface wlan0
WEP
works sometimes
Open network works and I am able to connect
iw comman shows
root@OpenWrt:~# iw phy0 info
Wiphy phy0
Band 1:
Frequencies:
* 2412 MHz [1] (30.0 dBm)
* 2417 MHz [2] (30.0 dBm)
* 2422 MHz [3] (30.0 dBm)
* 2427 MHz [4] (30.0 dBm)
* 2432 MHz [5] (30.0 dBm)
* 2437 MHz [6] (30.0 dBm)
* 2442 MHz [7] (30.0 dBm)
* 2447 MHz [8] (30.0 dBm)
* 2452 MHz [9] (30.0 dBm)
* 2457 MHz [10] (30.0 dBm)
* 2462 MHz [11] (30.0 dBm)
* 2467 MHz [12] (30.0 dBm)
* 2472 MHz [13] (30.0 dBm)
* 2484 MHz [14] (disabled)
Bitrates (non-HT):
* 1.0 Mbps
* 2.0 Mbps
* 5.5 Mbps
* 11.0 Mbps
* 6.0 Mbps
* 9.0 Mbps
* 12.0 Mbps
* 18.0 Mbps
* 24.0 Mbps
* 36.0 Mbps
* 48.0 Mbps
* 54.0 Mbps
max # scan SSIDs: 4
max scan IEs length: 2285 bytes
Fragmentation threshold: 2346
RTS threshold: 2347
Coverage class: 0 (up to 0m)
Supported Ciphers:
* WEP40 (00-0f-ac:1)
* WEP104 (00-0f-ac:5)
* TKIP (00-0f-ac:2)
* CCMP (00-0f-ac:4)
Available Antennas: TX 0 RX 0
Supported interface modes:
* IBSS
* managed
* monitor
software interface modes (can always be added):
* monitor
interface combinations are not supported
Supported commands:
* new_interface
* set_interface
* new_key
* start_ap
* new_station
* new_mpath
* set_mesh_config
* set_bss
* authenticate
* associate
* deauthenticate
* disassociate
* join_ibss
* join_mesh
* set_tx_bitrate_mask
* frame
* frame_wait_cancel
* set_wiphy_netns
* set_channel
* set_wds_peer
* probe_client
* set_noack_map
* register_beacons
* Unknown command (89)
* Unknown command (92)
* testmode
* connect
* disconnect
Supported TX frame types:
* IBSS: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80
0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70
0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80
0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* AP/VLAN: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70
0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* mesh point: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70
0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70
0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70
0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
* (null): 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70
0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0
Supported RX frame types:
* IBSS: 0x40 0xb0 0xc0 0xd0
* managed: 0x40 0xd0
* AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
* AP/VLAN: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
* mesh point: 0xb0 0xc0 0xd0
* P2P-client: 0x40 0xd0
* P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0
* (null): 0x40 0xd0
Device supports RSN-IBSS.
HT Capability overrides:
* MCS: ff ff ff ff ff ff ff ff ff ff
* maximum A-MSDU length
* supported channel width
* short GI for 40 MHz
* max A-MPDU length exponent
* min MPDU start spacing
Device supports TX status socket option.
Device supports HT-IBSS.
^ permalink raw reply
* Re: [PATCH 11/13] wlcore: memset wl->rx_filter_enabled to zero after recovery
From: Luca Coelho @ 2013-10-23 5:23 UTC (permalink / raw)
To: Eliad Peller; +Cc: linux-wireless
In-Reply-To: <1378718684-14430-11-git-send-email-eliad@wizery.com>
On Mon, 2013-09-09 at 12:24 +0300, Eliad Peller wrote:
> From: Nadim Zubidat <nadimz@ti.com>
>
> zero rx_filter_enabled array after recovery to avoid
> cases were the driver will keep trying to clear a
> filter which is not configured in FW.
>
> Such case will cause consecutive recoveries due to
> command execution failures.
>
> Signed-off-by: Nadim Zubidat <nadimz@ti.com>
> Signed-off-by: Eliad Peller <eliad@wizery.com>
> ---
> drivers/net/wireless/ti/wlcore/main.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
> index 60b2113..acb3502 100644
> --- a/drivers/net/wireless/ti/wlcore/main.c
> +++ b/drivers/net/wireless/ti/wlcore/main.c
> @@ -1915,6 +1915,7 @@ static void wlcore_op_stop_locked(struct wl1271 *wl)
> memset(wl->links_map, 0, sizeof(wl->links_map));
> memset(wl->roc_map, 0, sizeof(wl->roc_map));
> memset(wl->session_ids, 0, sizeof(wl->session_ids));
> + memset(wl->rx_filter_enabled, 0, sizeof(wl->rx_filter_enabled));
> wl->active_sta_count = 0;
> wl->active_link_count = 0;
This causes a sparse warning:
drivers/net/wireless/ti/wlcore/main.c:1918:42: error: cannot size expression
Booleans cannot be sized. :(
I won't apply this patch.
--
Luca.
^ permalink raw reply
* Re: [PATCH 3.12] cfg80211: fix ibss wext chandef creation
From: Dirk Gouders @ 2013-10-23 5:46 UTC (permalink / raw)
To: Simon Wunderlich
Cc: linux-wireless, Mathias Kretschmer, Linux Kernel, Johannes Berg
In-Reply-To: <1382472166-19563-1-git-send-email-sw@simonwunderlich.de>
Simon Wunderlich <sw@simonwunderlich.de> writes:
> The wext internal chandefs for ibss should be created using the
> cfg80211_chandef_create() functions. Otherwise the center_freq1 field
> will not be set and cfg80211_chandef_valid() will spit a warning and
> report the chandef as invalid when it should be used.
Thanks a lot, Simon, I don't see anymore traces here.
Tested-by: Dirk Gouders <dirk@gouders.net>
> Reported-by: Dirk Gouders <dirk@gouders.net>
> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
> Cc: Johannes Berg <johannes.berg@intel.com>
> ---
> net/wireless/ibss.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
> index 39bff7d..a710019 100644
> --- a/net/wireless/ibss.c
> +++ b/net/wireless/ibss.c
> @@ -246,7 +246,7 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
>
> /* try to find an IBSS channel if none requested ... */
> if (!wdev->wext.ibss.chandef.chan) {
> - wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
> + struct ieee80211_channel *new_chan = NULL;
>
> for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
> struct ieee80211_supported_band *sband;
> @@ -262,16 +262,19 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
> continue;
> if (chan->flags & IEEE80211_CHAN_DISABLED)
> continue;
> - wdev->wext.ibss.chandef.chan = chan;
> + new_chan = chan;
> break;
> }
>
> - if (wdev->wext.ibss.chandef.chan)
> + if (new_chan)
> break;
> }
>
> - if (!wdev->wext.ibss.chandef.chan)
> + if (!new_chan)
> return -EINVAL;
> +
> + cfg80211_chandef_create(&wdev->wext.ibss.chandef, new_chan,
> + NL80211_CHAN_NO_HT);
> }
>
> /* don't join -- SSID is not there */
> @@ -345,8 +348,8 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
> return err;
>
> if (chan) {
> - wdev->wext.ibss.chandef.chan = chan;
> - wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
> + cfg80211_chandef_create(&wdev->wext.ibss.chandef, chan,
> + NL80211_CHAN_NO_HT);
> wdev->wext.ibss.channel_fixed = true;
> } else {
> /* cfg80211_ibss_wext_join will pick one if needed */
^ permalink raw reply
* Re: [PATCH 01/13] wl18xx: default config alignment with phy defaults
From: Luca Coelho @ 2013-10-23 7:07 UTC (permalink / raw)
To: Eliad Peller; +Cc: linux-wireless
In-Reply-To: <1378718684-14430-1-git-send-email-eliad@wizery.com>
On Mon, 2013-09-09 at 12:24 +0300, Eliad Peller wrote:
> From: Igal Chernobelsky <igalc@ti.com>
>
> Driver default config is aligned with phy default parameters.
>
> Now that RDL1_3 has 2 antennas defined by default we need to explicitly
> define ht.mode to HT_MODE_WIDE to have SISO40 as default.
>
> Signed-off-by: Yair Shapira <yair.shapira@ti.com>
> Signed-off-by: Igal Chernobelsky <igalc@ti.com>
> Signed-off-by: Eliad Peller <eliad@wizery.com>
> ---
Applied the whole series except for 11/13 due to a sparse warning.
Sorry for the huge delay, at least I found the time to do it before the
merge window opened. ;)
--
Cheers,
Luca.
^ permalink raw reply
* pull request: TI wireless drivers 2013-10-23 (for 3.13)
From: Luca Coelho @ 2013-10-23 7:10 UTC (permalink / raw)
To: linville; +Cc: linux-wireless, Eliad Peller
[-- Attachment #1: Type: text/plain, Size: 2489 bytes --]
Hi John,
Some patches intended for 3.13. Eliad continues upstreaming pending
patches from the internal tree.
Please let me know if you have any problems with it!
The following changes since commit a1b13b9ad3759dca24c6b721ee026c540a4e6564:
rt2x00: rt2800pci: use module_pci_driver macro (2013-10-18 14:07:00 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx.git for-linville
for you to fetch changes up to 8d3c1fd8c3a4a4a1a319491cdd09bd7eca23ba3b:
wlcore: save last regdom configuration on stop (2013-10-23 09:47:45 +0300)
----------------------------------------------------------------
Barak Bercovitz (3):
wlcore: read fw panic log only in host mode
wlcore: Allow stopping fw log in recovery
wlcore: wakeup from ELP before starting recovery
Eliad Peller (3):
wlcore: add ap_event_mask
wlcore: fix started_vifs calculation
wlcore: save last regdom configuration on stop
Ido Reis (2):
wlcore: fwlog dynamic mem_block control
wl12xx/wl18xx: update default fw logger's settings
Igal Chernobelsky (3):
wl18xx: default config alignment with phy defaults
wlcore: fix interrogate command length
wlcore/wl18xx/wl12xx: FW log params per chip arch
Victor Goldenshtein (1):
wlcore: print active channel in the driver_state
drivers/net/wireless/ti/wl12xx/main.c | 16 +++++++++---
drivers/net/wireless/ti/wl18xx/main.c | 32 +++++++++++++++--------
drivers/net/wireless/ti/wlcore/acx.c | 10 +++++---
drivers/net/wireless/ti/wlcore/cmd.c | 12 +++++----
drivers/net/wireless/ti/wlcore/cmd.h | 3 ++-
drivers/net/wireless/ti/wlcore/conf.h | 5 +++-
drivers/net/wireless/ti/wlcore/debugfs.c | 18 ++++++++++++-
drivers/net/wireless/ti/wlcore/event.c | 1 +
drivers/net/wireless/ti/wlcore/hw_ops.h | 9 +++++++
drivers/net/wireless/ti/wlcore/init.c | 6 +++++
drivers/net/wireless/ti/wlcore/io.h | 4 +--
drivers/net/wireless/ti/wlcore/main.c | 74 ++++++++++++++++++++++++++++++++++++++----------------
drivers/net/wireless/ti/wlcore/scan.c | 24 +++++++++++++++++-
drivers/net/wireless/ti/wlcore/testmode.c | 3 ++-
drivers/net/wireless/ti/wlcore/wlcore.h | 9 +++++++
drivers/net/wireless/ti/wlcore/wlcore_i.h | 2 --
16 files changed, 175 insertions(+), 53 deletions(-)
--
Cheers,
Luca.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply
* Re: [PATCH 11/13] wlcore: memset wl->rx_filter_enabled to zero after recovery
From: Eliad Peller @ 2013-10-23 7:37 UTC (permalink / raw)
To: Luca Coelho; +Cc: linux-wireless@vger.kernel.org
In-Reply-To: <1382505837.21526.12.camel@porter.coelho.fi>
On Wed, Oct 23, 2013 at 8:23 AM, Luca Coelho <luca@coelho.fi> wrote:
> On Mon, 2013-09-09 at 12:24 +0300, Eliad Peller wrote:
>> From: Nadim Zubidat <nadimz@ti.com>
>>
>> zero rx_filter_enabled array after recovery to avoid
>> cases were the driver will keep trying to clear a
>> filter which is not configured in FW.
>>
>> Such case will cause consecutive recoveries due to
>> command execution failures.
>>
>> Signed-off-by: Nadim Zubidat <nadimz@ti.com>
>> Signed-off-by: Eliad Peller <eliad@wizery.com>
>> ---
>> drivers/net/wireless/ti/wlcore/main.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
>> index 60b2113..acb3502 100644
>> --- a/drivers/net/wireless/ti/wlcore/main.c
>> +++ b/drivers/net/wireless/ti/wlcore/main.c
>> @@ -1915,6 +1915,7 @@ static void wlcore_op_stop_locked(struct wl1271 *wl)
>> memset(wl->links_map, 0, sizeof(wl->links_map));
>> memset(wl->roc_map, 0, sizeof(wl->roc_map));
>> memset(wl->session_ids, 0, sizeof(wl->session_ids));
>> + memset(wl->rx_filter_enabled, 0, sizeof(wl->rx_filter_enabled));
>> wl->active_sta_count = 0;
>> wl->active_link_count = 0;
>
> This causes a sparse warning:
>
> drivers/net/wireless/ti/wlcore/main.c:1918:42: error: cannot size expression
>
> Booleans cannot be sized. :(
>
err...
i'll fix it (probably simply replacing the bool with int) and add the
updated patch to the next patchset i'll send.
thanks,
Eliad.
^ permalink raw reply
* Re: ath10k hits warning in sta_info.c:839.
From: Michal Kazior @ 2013-10-23 7:42 UTC (permalink / raw)
To: Ben Greear; +Cc: ath10k, linux-wireless@vger.kernel.org
In-Reply-To: <5266FAAD.3010800@candelatech.com>
On 23 October 2013 00:22, Ben Greear <greearb@candelatech.com> wrote:
> On 10/22/2013 11:25 AM, Ben Greear wrote:
>> Kernel is stock 'ath' tree, with small printk to debug an ath10k
>> crash.
>>
>> This is FYI for now...will be looking at other ath10k crash bugs
>> before digging into this tone.
>>
>> Setup is 2 stations trying to associate to same AP, which causes
>> endless failures and firmware crashes. Good for chasing bugs :)
>>
>>
>> DMAR:[fault reason 05] PTE Write access is not set
>> dmar: DRHD: handling fault status reg 3
>> dmar: DMAR:[DMA Write] Request device [05:00.0] fault addr ffd52000
>> DMAR:[fault reason 05] PTE Write access is not set
>> dmar: DRHD: handling fault status reg 3
>> dmar: DMAR:[DMA Write] Request device [05:00.0] fault addr ffd52000
>> DMAR:[fault reason 05] PTE Write access is not set
>>
>> sta300: authentication with 00:03:83:3d:30:aa timed out
>> [root@ct523-9292 ~]# ath10k: Failed to delete peer: 00:03:83:3d:30:aa for VDEV: 1
>> ath10k: WMI vdev stop failed: ret -108
>
>> ------------[ cut here ]------------
>> WARNING: CPU: 1 PID: 6 at /mnt/sda/home/greearb/git/ath/net/mac80211/sta_info.c:839 __sta_info_destroy+0x12)
>> Modules linked in: nf_nat_ipv4 nf_nat veth 8021q garp stp mrp llc macvlan pktgen lockd f71882fg coretemp hw]
>
> I think this may be a result of whatever bug or limitation
> caused the firmware to error and/or crash when adding a second
> station VIF and trying to associate it to the same AP.
>
> Probably not a problem with the rest of the wifi stacks.
Yup. This originates from the firmware limitation. It's unable to
handle two peer nodes with same mac addr on different vdevs. That's
why it's impossible to associate 2 (or more) station interfaces to the
same BSS.
Michał
^ permalink raw reply
* [PATCH] ath9k: Add WB335 PCI IDs
From: Sujith Manoharan @ 2013-10-23 9:15 UTC (permalink / raw)
To: John Linville; +Cc: linux-wireless
From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
---
drivers/net/wireless/ath/ath9k/pci.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 7e4c252..04e6507 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -361,6 +361,11 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
.driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
0x0036,
+ 0x11AD, /* LITEON */
+ 0x0682),
+ .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0036,
PCI_VENDOR_ID_AZWAVE,
0x213A),
.driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -371,6 +376,11 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
.driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
0x0036,
+ PCI_VENDOR_ID_LENOVO,
+ 0x4026),
+ .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0036,
PCI_VENDOR_ID_HP,
0x18E3),
.driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -381,6 +391,11 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
.driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
0x0036,
+ PCI_VENDOR_ID_HP,
+ 0x2005),
+ .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0036,
PCI_VENDOR_ID_DELL,
0x020E),
.driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -458,6 +473,16 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
0x185F, /* WNC */
0x3027),
.driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0036,
+ 0x185F, /* WNC */
+ 0xA120),
+ .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0036,
+ PCI_VENDOR_ID_FOXCONN,
+ 0xE07F),
+ .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
/* PCI-E AR9565 (WB335) */
{ PCI_VDEVICE(ATHEROS, 0x0036),
--
1.8.4.1
^ permalink raw reply related
* [PATCH] ath9k: Identify Killer Wireless cards
From: Sujith Manoharan @ 2013-10-23 9:16 UTC (permalink / raw)
To: John Linville; +Cc: linux-wireless
From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
---
drivers/net/wireless/ath/ath9k/ath9k.h | 1 +
drivers/net/wireless/ath/ath9k/init.c | 3 +++
drivers/net/wireless/ath/ath9k/pci.c | 20 ++++++++++++++++++++
3 files changed, 24 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 4c3bbe4..f48cfe8 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -641,6 +641,7 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
#define ATH9K_PCI_D3_L1_WAR 0x0040
#define ATH9K_PCI_AR9565_1ANT 0x0080
#define ATH9K_PCI_AR9565_2ANT 0x0100
+#define ATH9K_PCI_KILLER 0x0200
/*
* Default cache line size, in bytes.
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e89db64..17502b4 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -589,6 +589,9 @@ static void ath9k_init_platform(struct ath_softc *sc)
if (sc->driver_data & ATH9K_PCI_AR9565_2ANT)
ath_info(common, "WB335 2-ANT card detected\n");
+ if (sc->driver_data & ATH9K_PCI_KILLER)
+ ath_info(common, "Killer Wireless card detected\n");
+
/*
* Some WB335 cards do not support antenna diversity. Since
* we use a hardcoded value for AR9565 instead of using the
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 04e6507..4a7a456 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -87,6 +87,19 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
{ PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
{ PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI */
{ PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
+
+ /* Killer Wireless (3x3) */
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0030,
+ 0x1A56,
+ 0x2000),
+ .driver_data = ATH9K_PCI_KILLER },
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0030,
+ 0x1A56,
+ 0x2001),
+ .driver_data = ATH9K_PCI_KILLER },
+
{ PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E AR9300 */
/* PCI-E CUS198 */
@@ -267,6 +280,13 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
0x1783),
.driver_data = ATH9K_PCI_WOW },
+ /* Killer Wireless (2x2) */
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x0030,
+ 0x1A56,
+ 0x2003),
+ .driver_data = ATH9K_PCI_KILLER },
+
{ PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E AR9462 */
{ PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E AR1111/AR9485 */
--
1.8.4.1
^ permalink raw reply related
* iwl3945 filling kern.log when HW switch is off
From: Dietmar Rudolph @ 2013-10-23 9:24 UTC (permalink / raw)
To: linux-wireless
Hello, I hope this is the correct place to put a bug report in. I do
not subscribe to this mailing list, but feel free to send PM in case
you need additional info. You shoudn't :-)
After installing Ubuntu 13.10, I noticed kern.log growing faster
than you could look at. Within a few working hours, kern.log was >6GB!
The reason is that I intentionally disabled WiFi on this laptop by
turning the HW switch off. However, this makes iwl3945 write a log
entry into kern.log every few microseconds!
The workaround is to turn the HW switch on. The bug fix would be to
write just a single line to kern.log.
Regards
Dietmar
- - - from kern.log:
Oct 22 18:28:52 C50 kernel: [ 141.144085] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.144214] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.145167] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.145304] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.146184] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.146315] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.147164] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.147304] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.148254] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.148387] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.149217] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.149347] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.150165] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.150294] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.151113] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.151243] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.152097] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
Oct 22 18:28:52 C50 kernel: [ 141.152227] iwl3945 0000:02:00.0:
Radio disabled by HW RF Kill switch
--
Dietmar Rudolph
Geschäftsführer/President
CR/LF GmbH
Obere Fuhr 27, 45136 Essen, Germany
phone: ++49 201 254566
mailto: dietmar@crlf.de, http://www.crlf.de
CR/LF Beratungsgesellschaft für EDV-Anwendungen mbH
Essen HRB 7016 - GF: Dipl.-Math. Dietmar Rudolph
^ permalink raw reply
* [PATCH 1/1] mac80211:Resetting connection monitor timers in transmit path
From: Dhahira Thesneem @ 2013-10-23 10:12 UTC (permalink / raw)
To: Johannes Berg, John W. Linville, David S. Miller, linux-wireless,
netdev, linux-kernel
Cc: Dhahira Thesneem
Reset connection monitor timers when we are able to successfully transmit data to an AP.
Signed-off-by: Dhahira Thesneem <dhahira.thesneem@mistralsolutions.com>
---
net/mac80211/tx.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3456c04..e7725cf 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1700,7 +1700,8 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
ieee80211_xmit(sdata, skb, chan->band);
rcu_read_unlock();
-
+ /*To reset connection monitor timers, after successful transmission*/
+ ieee80211_sta_reset_conn_monitor(sdata);
return NETDEV_TX_OK;
fail_rcu:
@@ -2139,7 +2140,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
ieee80211_xmit(sdata, skb, band);
rcu_read_unlock();
-
+ /*To reset connection monitor timers, after successful transmission*/
+ ieee80211_sta_reset_conn_monitor(sdata);
return NETDEV_TX_OK;
fail_rcu:
--
1.7.5.4
^ permalink raw reply related
* Re: [PATCH 1/1] mac80211:Resetting connection monitor timers in transmit path
From: Krishna Chaitanya @ 2013-10-23 10:54 UTC (permalink / raw)
To: Dhahira Thesneem
Cc: Johannes Berg, John W. Linville, David S. Miller, linux-wireless,
netdev, linux-kernel
In-Reply-To: <1382523145-2302-1-git-send-email-dhahira.thesneem@mistralsolutions.com>
On Wed, Oct 23, 2013 at 3:42 PM, Dhahira Thesneem
<dhahira.thesneem@mistralsolutions.com> wrote:
>
> Reset connection monitor timers when we are able to successfully transmit data to an AP.
>
> Signed-off-by: Dhahira Thesneem <dhahira.thesneem@mistralsolutions.com>
> ---
> net/mac80211/tx.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
> index 3456c04..e7725cf 100644
> --- a/net/mac80211/tx.c
> +++ b/net/mac80211/tx.c
> @@ -1700,7 +1700,8 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
>
> ieee80211_xmit(sdata, skb, chan->band);
> rcu_read_unlock();
> -
> + /*To reset connection monitor timers, after successful transmission*/
> + ieee80211_sta_reset_conn_monitor(sdata);
> return NETDEV_TX_OK;
>
> fail_rcu:
> @@ -2139,7 +2140,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
>
> ieee80211_xmit(sdata, skb, band);
> rcu_read_unlock();
> -
> + /*To reset connection monitor timers, after successful transmission*/
> + ieee80211_sta_reset_conn_monitor(sdata);
> return NETDEV_TX_OK;
>
> fail_rcu:
> --
Successful data transmission should be checked in the tx_status not
after we transmit.
In fact its already taken care in status.c: through ieee80211_sta_tx_notify.
NACK.
^ permalink raw reply
* [PATCH 1/3] ath10k: setup min channel power to a reasonable value
From: Michal Kazior @ 2013-10-23 11:02 UTC (permalink / raw)
To: ath10k; +Cc: linux-wireless, Michal Kazior
In-Reply-To: <1382526135-3215-1-git-send-email-michal.kazior@tieto.com>
This will be needed for proper support of (user)
configurable tx power level.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
---
drivers/net/wireless/ath/ath10k/mac.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index da23c3f..35d5d3a 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -450,7 +450,7 @@ static int ath10k_vdev_start(struct ath10k_vif *arvif)
arg.channel.mode = chan_to_phymode(&conf->chandef);
- arg.channel.min_power = channel->max_power * 3;
+ arg.channel.min_power = 0;
arg.channel.max_power = channel->max_power * 4;
arg.channel.max_reg_power = channel->max_reg_power * 4;
arg.channel.max_antenna_gain = channel->max_antenna_gain;
@@ -529,7 +529,7 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
don't have any vifs? */
arg.channel.mode = chan_to_phymode(&ar->hw->conf.chandef);
- arg.channel.min_power = channel->max_power * 3;
+ arg.channel.min_power = 0;
arg.channel.max_power = channel->max_power * 4;
arg.channel.max_reg_power = channel->max_reg_power * 4;
arg.channel.max_antenna_gain = channel->max_antenna_gain;
@@ -1375,7 +1375,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
ch->passive = passive;
ch->freq = channel->center_freq;
- ch->min_power = channel->max_power * 3;
+ ch->min_power = 0;
ch->max_power = channel->max_power * 4;
ch->max_reg_power = channel->max_reg_power * 4;
ch->max_antenna_gain = channel->max_antenna_gain;
--
1.8.4.rc3
^ permalink raw reply related
* [PATCH 0/3] ath10k: tx power fixes
From: Michal Kazior @ 2013-10-23 11:02 UTC (permalink / raw)
To: ath10k; +Cc: linux-wireless, Michal Kazior
Hi,
This patchset fixes power units used in ath10k and
also make it respect (user) configurable tx power.
Michal Kazior (3):
ath10k: setup min channel power to a reasonable value
ath10k: use proper tx power unit
ath10k: respect power_level values
drivers/net/wireless/ath/ath10k/mac.c | 44 +++++++++++++++++++++++++----------
drivers/net/wireless/ath/ath10k/wmi.h | 3 ++-
2 files changed, 34 insertions(+), 13 deletions(-)
--
1.8.4.rc3
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox