- 19 Jan, 2024 1 commit
-
-
Arend van Spriel authored
With multi-vendor support the vendor-specific module may need to use the firmware interface functions so export them using the macro BRCMF_EXPORT_SYMBOL_GPL() which exports them to driver namespace. Signed-off-by:
Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://msgid.link/20240103095704.135651-2-arend.vanspriel@broadcom.com
-
- 18 Jan, 2024 25 commits
-
-
Zheng Wang authored
This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. Fixes: e756af5b ("brcmfmac: add e-scan support.") Signed-off-by:
Zheng Wang <zyytlz.wz@163.com> Cc: stable@vger.kernel.org [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free] Signed-off-by:
-
Dmitry Antipov authored
In 'rt2x00crypto_rx_insert_iv()', added alignment can't exceed 3 bytes and ICV size is either 4 or 8 bytes, so skb space adjustment may be simplified. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by:
Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by:
-
Jinjie Ruan authored
debugfs_create_dir() returns ERR_PTR and never return NULL. As Russell suggested, this patch removes the error checking for debugfs_create_dir(). This is because the DebugFS kernel API is developed in a way that the caller can safely ignore the errors that occur during the creation of DebugFS nodes. The debugfs APIs have a IS_ERR() judge in start_creating() which can handle it gracefully. So these checks are unnecessary. Fixes: 5e6e3a92 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by:
Jinjie Ruan <ruanjinjie@huawei.com> Suggested-by:
Russell King (Oracle) <linux@armlinux.org.uk> Signed-off-by:
-
Ruan Jinjie authored
Use is_multicast_ether_addr() and is_unicast_ether_addr() to check the addresses. Signed-off-by:
-
Artem Chernyshev authored
wlc_phy_txpwr_srom_read_nphy() in wlc_phy_attach_nphy() can not return false, so it's impossible to get true value in this if-statement. Also change those functions return types to void since no one using it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by:
Artem Chernyshev <artem.chernyshev@red-soft.ru> Reviewed-by:
Jonas Gorski <jonas.gorski@gmail.com> Signed-off-by:
-
Ping-Ke Shih authored
rtl8xxxu_limits and rtl8xxxu_combinations can be static const, so add modifiers as desire. Otherwise, Sparse reports warnings rtl8xxxu_core.c:7677:30: warning: symbol 'rtl8xxxu_limits' was not declared. Should it be static? rtl8xxxu_core.c:7682:36: warning: symbol 'rtl8xxxu_combinations' was not declared. Should it be static? Signed-off-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
-
Ping-Ke Shih authored
Fields of TX descriptor are little-endian order, so correct EN_DESC_ID field to le32 type. Fixes: b837f78f ("wifi: rtl8xxxu: add hw crypto support for AP mode") Reported-by:
kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202401161318.YtXoCkjU-lkp@intel.com/ Cc: Martin Kaistra <martin.kaistra@linutronix.de> Signed-off-by:
-
Ajay Singh authored
Adding then removing a second vif currently makes the first vif not working anymore. This is visible for example when we have a first interface connected to some access point: - create a wpa_supplicant.conf with some AP credentials - wpa_supplicant -Dnl80211 -c /etc/wpa_supplicant.conf -i wlan0 - dhclient wlan0 - iw phy phy0 interface add wlan1 type managed - iw dev wlan1 del wlan0 does not manage properly traffic anymore (eg: ping not working) This is due to vif mode being incorrectly reconfigured with some default values in del_virtual_intf, affecting by default first vif. Prevent first vif from being affected on second vif removal by removing vif mode change command in del_virtual_intf Fixes: 9bc061e8 ("staging: wilc1000: added support to dynamically add/remove interfaces") Signed-off-by:
Ajay Singh <ajay.kathat@microchip.com> Co-developed-by:
Alexis Lothoré <alexis.lothore@bootlin.com> Signed-off-by:
-
Ajay Singh authored
Use the correct register configuration when the WILC chip is down so the successive interface up operation is successful. The modified registers values during chip down helps to avoid the "FW not responding" debug message which sometimes occurs because of temporary bus communication failure during the next start. Also, make sure on first communication with the chip that it is indeed woken up. Reported-by:
Michael Walle <mwalle@kernel.org> Closes: https://lore.kernel.org/linux-wireless/20221026085415.6jgwrhq4sunqaypm@0002.3ffe.de/Signed-off-by:
-
Ajay Singh authored
Commit 09ed8bfc ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"") moved workqueue creation in wilc_netdev_ifc_init in order to set the interface name in the workqueue name. However, while the driver needs only one workqueue, the wilc_netdev_ifc_init is called each time we add an interface over a phy, which in turns overwrite the workqueue with a new one. This can be observed with the following commands: for i in $(seq 0 10) do iw phy phy0 interface add wlan1 type managed iw dev wlan1 del done ps -eo pid,comm|grep wlan 39 kworker/R-wlan0 98 kworker/R-wlan1 102 kworker/R-wlan1 105 kworker/R-wlan1 108 kworker/R-wlan1 111 kworker/R-wlan1 114 kworker/R-wlan1 117 kworker/R-wlan1 120 kworker/R-wlan1 123 kworker/R-wlan1 126 kworker/R-wlan1 129 kworker/R-wlan1 Fix this leakage by putting back hif_workqueue allocation in wilc_cfg80211_init. Regarding the workqueue name, it is indeed relevant to set it lowercase, however it is not attached to a specific netdev, so enforcing netdev name in the name is not so relevant. Still, enrich the name with the wiphy name to make it clear which phy is using the workqueue. Fixes: 09ed8bfc ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"") Signed-off-by:
-
Ajay Singh authored
During firmware initial configuration in wilc_init_fw_config, the special driver_handler 0 should be used instead of targeting a specific virtual interface (either 1 or 2) The issue does not seem to have real consequence (both virtual interfaces seems to answer correctly to a Add Block Ack request with the Immediate policy), but lets make everything homogeneous Signed-off-by:
-
Bitterblue Smith authored
Instead of reading bit 9 of RFPGA0_XA_HSSIPARAMETER2 every time a frame is received, just use rtlphy->cck_high_power, which is initialised in _rtl92d_phy_bb_config(). That bit never changes anyway. With this change _rtl92de_query_rxphystatus() can be shared with the upcoming USB driver. The USB driver can't read registers in this function because register reading can sleep. Compile tested only. Signed-off-by:
Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by:
-
Ping-Ke Shih authored
WiFi 7 chips will support MLD, so there are more fields about that. But currently we don't support MLD yet, just define fields and bits by this patch ahead, and fill STA_TYPE only. Signed-off-by:
-
Ping-Ke Shih authored
The JOIN command is used to tell firmware an new station is joining, and create an entry for it. This patch is only to convert to set data via struct, and don't change logic at all. Signed-off-by:
-
Ping-Ke Shih authored
Reset DMAC table, so we get expected behavior instead of random values at early stage. Signed-off-by:
-
Ping-Ke Shih authored
Do reset on CMAC tables by mac_id, so we don't get random values when powering on. Therefore, add the same function for WiFi 7 chips. Signed-off-by:
-
Ping-Ke Shih authored
The CMAC table is used to define how hardware TX a certain packet, and we can specify TX AMPDU size, so hardware can prepare proper retry window buffer. Otherwise, it can't transmit with expected aggregation number. Since each TID could have different aggregation number, the smallest number is adopted to prevent over peer's receiving buffer. Signed-off-by:
-
Ping-Ke Shih authored
For WiFi 7 chips, we add H2C command with rich fields to support MLO, so add a chip_ops to generalize calling of update CMAC table. Signed-off-by:
-
Ping-Ke Shih authored
When a station get connected, fill hardware CMAC table via H2C command to tell hardware arguments related to transmit, such as the lowest rate, packet padding and so on. Signed-off-by:
-
Ping-Ke Shih authored
To have secure connection, set key information into security CAM including key index, entry index and valid map. This new introduced H2C command can support MLO, but currently not implement yet. Signed-off-by:
-
Ping-Ke Shih authored
According to IEEE Std. 802.11, it defines: Indicates whether the STA is capable of interpreting the Extended NSS BW Support subfield of the VHT Capabilities Information field. Some AP such as TP-LINK BE19000 would check it for bandwidth settings, so causes 80MHz rate when associating on 160 MHz bandwidth. Declare this capability to yield expected result. Signed-off-by:
-
Ping-Ke Shih authored
The coming WiFi 7 chip 8922A will support EHT, so declare EHT along with hardware capabilities. Signed-off-by:
-
Ping-Ke Shih authored
Basically, all chips can support 20/40/80MHz bandwidth, and 8952C can support 160MHz bandwidth, which is why we introduced support_bw160 before. The coming WiFi 7 chips will support 320MHz optionally, so change it to bit mask instead of adding another support_bw320. Signed-off-by:
-
Ping-Ke Shih authored
EHT capabilities are also stored in struct ieee80211_sband_iftype_data, so adjust allocation of iftype_data as common part named init_he_eht_cap(), and then init_eht_cap() can be added later. Don't change logic at all by this patch. Signed-off-by:
-
Dmitry Antipov authored
When 'sscanf()' is not needed to scan an input, prefer common 'kstrtoX_from_user()' over 'rtw_debugfs_copy_from_user()' with following 'kstrtoX()'. Minor adjustments, compile tested only. Signed-off-by:
-
- 14 Jan, 2024 2 commits
-
-
Martin Kaistra authored
The CSA countdown in the beacon frames, which are sent out by firmware, needs to get updated by the driver. To achieve this, convert update_beacon_work to delayed_work and schedule it with the beacon interval in case CSA is active and the countdown is not complete. Signed-off-by:
Martin Kaistra <martin.kaistra@linutronix.de> Reviewed-by:
-
Martin Kaistra authored
The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop(). Fixes: e542e66b ("rtl8xxxu: add bluetooth co-existence support for single antenna") Signed-off-by:
-
- 12 Jan, 2024 12 commits
-
-
Bitterblue Smith authored
Currently rtl_usb performs register writes using the async usb_submit_urb() function. This appears to work fine for the RTL8192CU, but the RTL8192DU (soon to be supported by rtlwifi) has a problem: it transmits everything at the 1M rate in the 2.4 GHz band. (The 5 GHz band is still untested.) With this patch, rtl_usb performs the register writes using the synchronous usb_control_msg() function, and the RTL8192DU works normally. The RTL8192CU still works. The vendor drivers use the async writes in only one function, rtl8192du_trigger_gpio_0 / rtl8192cu_trigger_gpio_0, which probably doesn't even run in real life. They use sync writes everywhere else. Also, remove "sync" and "async" from the names of the members of struct rtl_io to avoid confusion: write{8,16,32}_async -> write{8,16,32} read{8,16,32}_sync -> read{8,16,32} Signed-off-by: -
Dmitry Antipov authored
Remove unreachable branches in 'rtl92ce_tx_fill_desc()', 'rtl92cu_tx_fill_desc()' and 'rtl8723e_tx_fill_desc()'. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by:
-
Ping-Ke Shih authored
Since coming WiFi 7 and existing chips use different update_beacon() format, add to abstract selection of H2C command. Signed-off-by:
-
Ping-Ke Shih authored
The firmware of coming WiFi 7 chips can support more AP functions, like virtual AP, so extend format of download beacon frame to configure them. Currently rtw89 only enables AP mode as old chips, so leave new fields zeros. Signed-off-by:
-
Ping-Ke Shih authored
Download beacon frame via H2C command for AP mode, and then firmware can issues beacon periodically. Originally TIM offset minus fixed 24 bytes of frame header implicitly in macro, and this patch explicitly uses ieee80211_hdrlen() to get header length, but expected to change nothing at all. Signed-off-by:
-
Ping-Ke Shih authored
New H2C command is introduced to pause/sleep transmitting. That extends more bits to support more MAC ID, and currently we still configure 256 MAC ID at most. This new command is always used by coming WiFi 7 chips, and existing chips can use old or new command because firmware still preserves the old one. Add a firmware feature flag to determine which command is adopted according to firmware version. Signed-off-by:
-
Ping-Ke Shih authored
To reuse this function to support extended H2C command that is used by newer chip, change to use a pointer to fill pause ID and mask. Signed-off-by:
-
Ping-Ke Shih authored
The WiFi 6 chips use these commands to create BA CAM entry when RX BA session is established, this BA CAM can record whether packets are received or not, then reply BA for current status. This patch doesn't change logic. Signed-off-by:
-
Ping-Ke Shih authored
The total BA CAM number of 8922a is 32 instead of 16, and initial 8 entries are dynamic, so update the entry number to 24. Signed-off-by:
-
Ping-Ke Shih authored
Since chips could use different version of BA CAM H2C command, add a chip_ops to abstract the operation. Signed-off-by:
-
Ping-Ke Shih authored
Add a call of feature_init() when bringing interface up. For now, the feature is to reset BA CAM V1 that is only used by upcoming 8922A. Signed-off-by:
-
Ping-Ke Shih authored
BA CAM is used to generate BA frame for received AMPDU packets. To support WiFi 7, change format from V0 to have more fields and enlarge entry number for new need. Signed-off-by:
-
