Loading drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 −1 Original line number Diff line number Diff line Loading @@ -6809,7 +6809,7 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy, return; /* ignore non-ISO3166 country codes */ for (i = 0; i < sizeof(req->alpha2); i++) for (i = 0; i < 2; i++) if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') { brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n", req->alpha2[0], req->alpha2[1]); Loading drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +5 −0 Original line number Diff line number Diff line Loading @@ -76,6 +76,10 @@ static int brcmf_roamoff; module_param_named(roamoff, brcmf_roamoff, int, 0400); MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine"); static int brcmf_iapp_enable; module_param_named(iapp, brcmf_iapp_enable, int, 0); MODULE_PARM_DESC(iapp, "Enable partial support for the obsoleted Inter-Access Point Protocol"); #ifdef DEBUG /* always succeed brcmf_bus_started() */ static int brcmf_ignore_probe_fail; Loading Loading @@ -418,6 +422,7 @@ struct brcmf_mp_device *brcmf_get_module_param(struct device *dev, settings->feature_disable = brcmf_feature_disable; settings->fcmode = brcmf_fcmode; settings->roamoff = !!brcmf_roamoff; settings->iapp = !!brcmf_iapp_enable; #ifdef DEBUG settings->ignore_probe_fail = !!brcmf_ignore_probe_fail; #endif Loading drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h +1 −0 Original line number Diff line number Diff line Loading @@ -58,6 +58,7 @@ struct brcmf_mp_device { unsigned int feature_disable; int fcmode; bool roamoff; bool iapp; bool ignore_probe_fail; struct brcmfmac_pd_cc *country_codes; union { Loading drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +57 −0 Original line number Diff line number Diff line Loading @@ -230,6 +230,37 @@ static void brcmf_netdev_set_multicast_list(struct net_device *ndev) schedule_work(&ifp->multicast_work); } /** * brcmf_skb_is_iapp - checks if skb is an IAPP packet * * @skb: skb to check */ static bool brcmf_skb_is_iapp(struct sk_buff *skb) { static const u8 iapp_l2_update_packet[6] __aligned(2) = { 0x00, 0x01, 0xaf, 0x81, 0x01, 0x00, }; unsigned char *eth_data; #if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) const u16 *a, *b; #endif if (skb->len - skb->mac_len != 6 || !is_multicast_ether_addr(eth_hdr(skb)->h_dest)) return false; eth_data = skb_mac_header(skb) + ETH_HLEN; #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) | ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4)))); #else a = (const u16 *)eth_data; b = (const u16 *)iapp_l2_update_packet; return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2])); #endif } static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev) { Loading @@ -250,6 +281,23 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, goto done; } /* Some recent Broadcom's firmwares disassociate STA when they receive * an 802.11f ADD frame. This behavior can lead to a local DoS security * issue. Attacker may trigger disassociation of any STA by sending a * proper Ethernet frame to the wireless interface. * * Moreover this feature may break AP interfaces in some specific * setups. This applies e.g. to the bridge with hairpin mode enabled and * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware * will get passed back to the wireless interface and cause immediate * disassociation of a just-connected STA. */ if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) { dev_kfree_skb(skb); ret = -EINVAL; goto done; } /* Make sure there's enough writeable headroom */ if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) { head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0); Loading Loading @@ -325,6 +373,15 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp, void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb) { /* Most of Broadcom's firmwares send 802.11f ADD frame every time a new * STA connects to the AP interface. This is an obsoleted standard most * users don't use, so don't pass these frames up unless requested. */ if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) { brcmu_pkt_buf_free_skb(skb); return; } if (skb->pkt_type == PACKET_MULTICAST) ifp->ndev->stats.multicast++; Loading drivers/net/wireless/intel/iwlwifi/cfg/9000.c +62 −0 Original line number Diff line number Diff line Loading @@ -53,6 +53,7 @@ #include <linux/stringify.h> #include "iwl-config.h" #include "iwl-agn-hw.h" #include "fw/file.h" /* Highest firmware API version supported */ #define IWL9000_UCODE_API_MAX 36 Loading Loading @@ -265,6 +266,67 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = { .integrated = true, .soc_latency = 5000, }; const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9460", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; const struct iwl_cfg iwl9461_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9461", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; const struct iwl_cfg iwl9462_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9462", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9560", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); Loading Loading
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 −1 Original line number Diff line number Diff line Loading @@ -6809,7 +6809,7 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy, return; /* ignore non-ISO3166 country codes */ for (i = 0; i < sizeof(req->alpha2); i++) for (i = 0; i < 2; i++) if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') { brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n", req->alpha2[0], req->alpha2[1]); Loading
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +5 −0 Original line number Diff line number Diff line Loading @@ -76,6 +76,10 @@ static int brcmf_roamoff; module_param_named(roamoff, brcmf_roamoff, int, 0400); MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine"); static int brcmf_iapp_enable; module_param_named(iapp, brcmf_iapp_enable, int, 0); MODULE_PARM_DESC(iapp, "Enable partial support for the obsoleted Inter-Access Point Protocol"); #ifdef DEBUG /* always succeed brcmf_bus_started() */ static int brcmf_ignore_probe_fail; Loading Loading @@ -418,6 +422,7 @@ struct brcmf_mp_device *brcmf_get_module_param(struct device *dev, settings->feature_disable = brcmf_feature_disable; settings->fcmode = brcmf_fcmode; settings->roamoff = !!brcmf_roamoff; settings->iapp = !!brcmf_iapp_enable; #ifdef DEBUG settings->ignore_probe_fail = !!brcmf_ignore_probe_fail; #endif Loading
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h +1 −0 Original line number Diff line number Diff line Loading @@ -58,6 +58,7 @@ struct brcmf_mp_device { unsigned int feature_disable; int fcmode; bool roamoff; bool iapp; bool ignore_probe_fail; struct brcmfmac_pd_cc *country_codes; union { Loading
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +57 −0 Original line number Diff line number Diff line Loading @@ -230,6 +230,37 @@ static void brcmf_netdev_set_multicast_list(struct net_device *ndev) schedule_work(&ifp->multicast_work); } /** * brcmf_skb_is_iapp - checks if skb is an IAPP packet * * @skb: skb to check */ static bool brcmf_skb_is_iapp(struct sk_buff *skb) { static const u8 iapp_l2_update_packet[6] __aligned(2) = { 0x00, 0x01, 0xaf, 0x81, 0x01, 0x00, }; unsigned char *eth_data; #if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) const u16 *a, *b; #endif if (skb->len - skb->mac_len != 6 || !is_multicast_ether_addr(eth_hdr(skb)->h_dest)) return false; eth_data = skb_mac_header(skb) + ETH_HLEN; #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) | ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4)))); #else a = (const u16 *)eth_data; b = (const u16 *)iapp_l2_update_packet; return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2])); #endif } static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev) { Loading @@ -250,6 +281,23 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, goto done; } /* Some recent Broadcom's firmwares disassociate STA when they receive * an 802.11f ADD frame. This behavior can lead to a local DoS security * issue. Attacker may trigger disassociation of any STA by sending a * proper Ethernet frame to the wireless interface. * * Moreover this feature may break AP interfaces in some specific * setups. This applies e.g. to the bridge with hairpin mode enabled and * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware * will get passed back to the wireless interface and cause immediate * disassociation of a just-connected STA. */ if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) { dev_kfree_skb(skb); ret = -EINVAL; goto done; } /* Make sure there's enough writeable headroom */ if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) { head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0); Loading Loading @@ -325,6 +373,15 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp, void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb) { /* Most of Broadcom's firmwares send 802.11f ADD frame every time a new * STA connects to the AP interface. This is an obsoleted standard most * users don't use, so don't pass these frames up unless requested. */ if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) { brcmu_pkt_buf_free_skb(skb); return; } if (skb->pkt_type == PACKET_MULTICAST) ifp->ndev->stats.multicast++; Loading
drivers/net/wireless/intel/iwlwifi/cfg/9000.c +62 −0 Original line number Diff line number Diff line Loading @@ -53,6 +53,7 @@ #include <linux/stringify.h> #include "iwl-config.h" #include "iwl-agn-hw.h" #include "fw/file.h" /* Highest firmware API version supported */ #define IWL9000_UCODE_API_MAX 36 Loading Loading @@ -265,6 +266,67 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = { .integrated = true, .soc_latency = 5000, }; const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9460", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; const struct iwl_cfg iwl9461_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9461", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; const struct iwl_cfg iwl9462_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9462", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = { .name = "Intel(R) Dual Band Wireless AC 9560", .fw_name_pre = IWL9000A_FW_PRE, .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, IWL_DEVICE_9000, .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION, .nvm_calib_ver = IWL9000_TX_POWER_VERSION, .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .integrated = true, .soc_latency = 5000, .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK }; MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); Loading