| Age | Commit message (Collapse) | Author |
|---|
|
The receive byte count comes from device-controlled status registers, but
the packet splitter unconditionally consumes a four-byte delimiter. A count
of one to three bytes therefore makes bytes_remaining negative. If the
reused receive buffer contains a valid delimiter, the negative value is
passed to memcpy() and converted to a near-SIZE_MAX length, corrupting
kernel memory.
YAPS streams are word aligned, so reject byte counts that cannot contain
complete delimiters. Also reject delimiter sizes which do not leave any
packet data after removing the reserved metadata page.
Assisted-by: LLM
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
Link: https://patch.msgid.link/20261007093021.17132-1-f3lix.dev@gmx.de
[remove Suggested-by and fix Assisted-by]
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
the sband information existed as a single static struct and was
directly modified in place by both the stack and the driver. If the
regdom was ever changed to 00 where all the S1G channels are NO_IR
and a bus module then removed, these flags would remain even after
changing the regdom and prevent channels from being used.
Instead, make sure we copy the sband each time we init our mac80211
hw such that when a bus module is removed the state is reset and
flags don't persist.
Link: https://patch.msgid.link/20261007050000.127009-4-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Introduce monitor mode support by extending the command to add a
monitor interface to the firmware and inserting the S1G radiotap TLV.
Also rework the .configure_filter() callback to better handle frame
filtering when we are in monitor mode. This implementation works best
as a standalone sniffer currently, as support is yet to be added in
mac80211 to handle building the radiotap for tx frames (i.e if you
bind a monitor interface to an existing station or AP).
Right now the S1G radiotap header is not really complete and lacks
the ability to convey the frequency offset and correct NDP reporting.
The process to amend the S1G TLV will begin after this initial
support is complete.
Link: https://patch.msgid.link/20261007050000.127009-3-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Right now we look up the station on rx to update its average RSSI but
then hand the frame to mac80211 without it, leaving mac80211 to look
the station up again. Use ieee80211_rx_napi() and rework the code a
bit so we pass the station directly to mac80211 to prevent another
lookup.
Link: https://patch.msgid.link/20261007050000.127009-2-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
mm81x_yaps_hw_read_pkts() reads a full 4-byte delimiter and then
subtracts sizeof(delim) from bytes_remaining on every loop iteration,
guarded only by "bytes_remaining > 0". If 1-3 bytes are left in the
window, this reads past the end of the valid data and then subtracts
4 from a value smaller than 4, driving bytes_remaining negative.
A negative bytes_remaining then reaches the total_len > bytes_remaining
branch, where "bytes_remaining" is passed to memcpy() as the copy
length. Implicitly converted to size_t, a negative int becomes a
huge value, turning that memcpy() into a massive out-of-bounds copy.
Bail out of the split loop once fewer than sizeof(delim) bytes remain,
the same way the existing "end of stream" check bails on a zero
delimiter.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260919192231.272078-1-meatuni001@gmail.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
mm81x_mac_check_fw_disabled_chans() iterates over n_channels entries of
the firmware response without validating the response length against
the array size. A firmware response with n_channels larger than
ARRAY_SIZE(mors_s1ghz_channels) reads past the end of the response
buffer. To fix, make sure we validate the length prior to use.
Assisted-by: LLM
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Aamir Ahmed <elb12345@hotmail.co.uk>
Link: https://patch.msgid.link/AS8P251MB00015A3FFF9F9A9628CB0BB0C8BE2@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM
[slightly reword commit message]
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Count the set bits through bit_pos with hweight16() and an inclusive
mask. Preserve the zero fallback and zero-based index.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
Link: https://patch.msgid.link/20260925195908.252810-3-ynorov@nvidia.com
[remove morsemicro prefix from commit message]
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Replace the local nth_bit() helper with fns(), which provides the same
zero-based set-bit selection for rate capability masks.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
Link: https://patch.msgid.link/20260925195908.252810-2-ynorov@nvidia.com
[remove morsemicro prefix from commit message]
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Currently we only initialise and start the beaconing process when the
AP interface is first added. If the BSS alone is reconfigured and
beaconing is temporarily stopped, the subsequent call to re-enable
the beacon via BSS_CHANGED_BEACON_ENABLED is ignored and beaconing will
be permanently stopped until the interface is completely re-added.
To fix, move the beaconing start/stop to mm81x_mac_ops_bss_info_changed
and react accordingly to info->enable_beacon and just keep the per-vif
work item init in the add_interface callback.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Samuele Yang <samuele.yang@morsemicro.com>
Link: https://patch.msgid.link/20260929033408.69266-1-samuele.yang@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
https://github.com/MorseMicroLabs/linux-wireless
Lachlan Hodges says:
====================
mm81x 7.4 PR #1:
- buffered multicast improvements
- tx bandwidth selection improvements
- misc minor bug fixes (mostly LLM)
====================
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci
This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.
Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.
Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
|
|
When mm81x_dm_write() fails while downloading a PT_LOAD segment,
mm81x_fw_load_fw() sets ret to -EIO and breaks out of the loop. The
boot address write at the end of the function then overwrites ret, so a
partially downloaded image is reported as loaded and the chip is
triggered on it instead of the load being retried.
Leave the function as soon as a segment fails.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260812060740.1275280-3-lilinmao@kylinos.cn
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
mm81x_fw_load_fw() allocates fw_buf before it inspects the image, but
releases it only on the success path. The two early returns taken for a
malformed image leave one firmware-sized allocation attached to the
device, and mm81x_fw_flash() retries the load three times.
Release it on those paths too, the way mm81x_fw_load_bcf() already does.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260812060740.1275280-2-lilinmao@kylinos.cn
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
The sdio_readl() and sdio_writel() functions, instead of returning kernel
error codes, instead stores the error codes in a parameter. These caller
functions pass should pass an int pointer to store the error code but
instead pass a signed long.
This will not work on big endian systems. On little endian systems
passing a ssize_t means negative error codes are converted to positive
values near UINT_MAX. This doesn't cause a problem at runtime because
in mm81x_sdio_reg32_write() the error codes are discarded and we always
return -EIO. In mm81x_sdio_reg32_read() the high bits are truncated
away so the positive value is re-converted back to negative and the
code works as intended.
Either way, passing an int is the correct thing and is a cleanup.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/aoa7Hj1W7ETOrOzO@stanley.mountain
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
If an AP has stations that are operating on a sub-primary (i.e using
the 4MHz primary of the 8MHz operating) multicast frames sent on the
operating width will be lost. Make sure we tx them on the primary width
to ensure all stations are capabile of receiving them.
Link: https://patch.msgid.link/20260827054917.255584-9-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
max_bw_mhz is not populated with the stas maximum supported width
during association. This means data frames are sent at the operating
width, regardless of whether the sta can support the operating width.
For example a STA that supports up to 4MHz receiving frames from an AP
running on an 8MHz operating channel will be sent frames at 8MHz which
it cannot receive.
Make sure we initialise the stas maximum support bandwidth and while
we are here rename it to max_rx_bw_mhz to indicate its the maximum
bandwidth the sta can receive frames from.
Note: This should be conveyed via ieee80211_link_sta::bandwidth, but
the ieee80211_sta_rx_bandwidth enum does not support S1G widths as of
now and will require some non-trivial work to support in the future.
Link: https://patch.msgid.link/20260827054917.255584-8-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Right now port control frames such as EAPOLs are sent at the operating
width which, within noisier environments, can lead to increased
association times and at higher attenuation potentially prevent
association from occurring altogether. Make sure we send EAPOLs and
any other port control frames at the primary width.
Link: https://patch.msgid.link/20260827054917.255584-7-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
The tx mac op is getting busy, lets factor out tx width selection to
prepare for some future tx width selection fixes.
No functional changes.
Link: https://patch.msgid.link/20260827054917.255584-6-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Implement .tx_frames_pending() to assist mac80211 when deciding whether
we should enter powersave such that we don't enter when there are
pending tx frames.
Link: https://patch.msgid.link/20260827054917.255584-5-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
When the firmware reports a frame as filtered because the station has
entered power save, the AP-mode path dropped the frame and returned
"handled". In AP mode mac80211 owns the per-station power-save
re-buffering, so the frame must instead be reported with
IEEE80211_TX_STAT_TX_FILTERED and left for mac80211 to re-queue once
the station wakes.
Return false for AP interfaces so the tx-status path flags the frame as
filtered rather than silently dropping it.
Assisted-by: Claude:claude-opus-5
Link: https://patch.msgid.link/20260827054917.255584-4-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Since we set the HOST_BROADCAST_PS_BUFFERING, mac80211 handles the
buffering of broadcast frames. Make sure after each beacon we call
ieee80211_get_buffered_bc() to release buffered broadcast frames
after each DTIM beacon.
Link: https://patch.msgid.link/20260827054917.255584-3-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Move mm81x_mac_beacon_work() and mm81x_mac_beacon_init() to below
mm81x_mac_ops_tx() to prepare for future multicast handling such that
we avoid a forward declaration. No functional change.
Link: https://patch.msgid.link/20260827054917.255584-2-lachlan.hodges@morsemicro.com
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
Morse Micro MM81x wireless devices can have either SDIO or USB
interfaces. Hence there is no point in asking the user about these
devices when configuring a kernel without MMC or USB support.
Fix this by making the core driver symbol invisible, and selecting it by
its users when needed.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/3415bda97c2faf7c56eff7fe79a91b218d0d6731.1786010705.git.geert+renesas@glider.be
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
The three timer teardown paths call timer_delete_sync_try() and ignore
its return value. If a callback is running on another CPU it returns -1
without waiting, and it does not prevent a later rearm even when it does
deactivate a pending timer. mm81x_skbq_tx_complete() can rearm the
stale-status timer, and the rc and yaps callbacks queue work that rearms
their timers. Teardown can therefore continue with a callback still
running or the timer rearmed, so it fires after the associated state has
been freed.
Use timer_shutdown_sync() for these permanent teardowns: it waits for an
in-flight callback and prevents any future rearm. In mm81x_rc_deinit()
shut the timer down before cancel_work_sync() so the work can no longer
recreate the timer/work cycle.
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Dan Callaghan <dan.callaghan@morsemicro.com>
Link: https://patch.msgid.link/20260723113927.2370301-1-lilinmao@kylinos.cn
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
|
mm81x is the first Wi-Fi HaLow driver to support the Morse Micro mm81x
chip family via USB and SDIO.
S1G support in the kernel is only new, and as a result this driver has
been scoped to be simple and only support station and AP interface.
The Wi-Fi specific features only cover the minimum required for basic
use such as powersave, aggregation, rate control and so on. The driver
will be extended into the future as S1G support for operations such as
ACS, channel switching and so on are added into the wireless stack.
The driver has been build tested on a long list of architectures and
compilers via Intels LKP.
The driver currently supports IEEE80211-2024 US channels only, with
AU 2020 also available. In order for this to be expanded additional
non-trivial kernel work is required which will begin once the
driver is upstream.
The driver has had many authors who are listed below in
alphabetical order:
Co-developed-by: Andrew Pope <andrew.pope@morsemicro.com>
Signed-off-by: Andrew Pope <andrew.pope@morsemicro.com>
Co-developed-by: Arien Judge <arien.judge@morsemicro.com>
Signed-off-by: Arien Judge <arien.judge@morsemicro.com>
Co-developed-by: Ayman Grais <ayman.grais@morsemicro.com>
Signed-off-by: Ayman Grais <ayman.grais@morsemicro.com>
Co-developed-by: Bassem Dawood <bassem@morsemicro.com>
Signed-off-by: Bassem Dawood <bassem@morsemicro.com>
Co-developed-by: Chetan Mistry <chetan.mistry@morsemicro.com>
Signed-off-by: Chetan Mistry <chetan.mistry@morsemicro.com>
Co-developed-by: Dan Callaghan <dan.callaghan@morsemicro.com>
Signed-off-by: Dan Callaghan <dan.callaghan@morsemicro.com>
Co-developed-by: James Herbert <james.herbert@morsemicro.com>
Signed-off-by: James Herbert <james.herbert@morsemicro.com>
Co-developed-by: Sahand Maleki <sahand.maleki@morsemicro.com>
Signed-off-by: Sahand Maleki <sahand.maleki@morsemicro.com>
Co-developed-by: Simon Wadsworth <simon@morsemicro.com>
Signed-off-by: Simon Wadsworth <simon@morsemicro.com>
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
|
