OpenCloudOS-Kernel/drivers/net/wireless/marvell/mwifiex
Johan Hovold 89f8765a11 mwifiex: fix division by zero in fw download path
Add the missing endpoint sanity checks to probe() to avoid division by
zero in mwifiex_write_data_sync() in case a malicious device has broken
descriptors (or when doing descriptor fuzz testing).

Only add checks for the firmware-download boot stage, which require both
command endpoints, for now. The driver looks like it will handle a
missing endpoint during normal operation without oopsing, albeit not
very gracefully as it will try to submit URBs to the default pipe and
fail.

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4f ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 4daffe3543 ("mwifiex: add support for Marvell USB8797 chipset")
Cc: stable@vger.kernel.org      # 3.5
Cc: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-4-johan@kernel.org
2021-10-28 16:27:25 +03:00
..
11ac.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
11ac.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
11h.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
11n.c mwifiex: Send DELBA requests according to spec 2021-10-20 11:51:21 +03:00
11n.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
11n_aggr.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
11n_aggr.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
11n_rxreorder.c mwifiex: 11n_rxreorder: Remove unnecessary cast in kfree() 2020-08-02 17:56:09 +03:00
11n_rxreorder.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile mwifiex: pcie: add DMI-based quirk implementation for Surface devices 2021-08-29 14:46:40 +03:00
README mwifiex: change license text of Makefile and README from MARVELL to NXP 2020-12-07 18:33:51 +02:00
cfg80211.c mwifiex: Log an error on command failure during key-material upload 2021-10-20 11:51:21 +03:00
cfg80211.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
cfp.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
cmdevt.c mwifiex: Deactive host sleep using HSCFG after it was activated manually 2021-10-20 11:51:22 +03:00
debugfs.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
decl.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
ethtool.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
fw.h mwifiex: Avoid memset() over-write of WEP key_material 2021-06-22 18:24:50 +03:00
ie.c mwifiex: Use fallthrough pseudo-keyword 2020-08-27 12:59:17 +03:00
init.c mwifiex: remove function pointer check 2020-09-09 10:30:28 +03:00
ioctl.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
join.c mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start 2020-12-08 09:33:27 +02:00
main.c wireless: use eth_hw_addr_set() instead of ether_addr_copy() 2021-10-20 12:39:42 +03:00
main.h mwifiex: Deactive host sleep using HSCFG after it was activated manually 2021-10-20 11:51:22 +03:00
pcie.c mwifiex: Try waking the firmware until we get an interrupt 2021-10-18 15:29:52 +03:00
pcie.h mwifiex: pcie: add DMI-based quirk implementation for Surface devices 2021-08-29 14:46:40 +03:00
pcie_quirks.c mwifiex: pcie: add reset_d3cold quirk for Surface gen4+ devices 2021-08-29 14:46:41 +03:00
pcie_quirks.h mwifiex: pcie: add reset_d3cold quirk for Surface gen4+ devices 2021-08-29 14:46:41 +03:00
scan.c mwifiex: Remove unneeded variable: "ret" 2021-04-17 20:53:40 +03:00
sdio.c mwifiex: fix double free 2020-10-08 13:46:25 +03:00
sdio.h mwifiex: Remove duplicated REG_PORT definition 2020-11-24 17:07:09 +02:00
sta_cmd.c mwifiex: Deactive host sleep using HSCFG after it was activated manually 2021-10-20 11:51:22 +03:00
sta_cmdresp.c mwifiex: Fix fall-through warnings for Clang 2020-11-24 17:05:56 +02:00
sta_event.c mwifiex: Fix fall-through warnings for Clang 2020-11-24 17:05:56 +02:00
sta_ioctl.c mwifiex: make arrays static const, makes object smaller 2021-08-21 20:50:23 +03:00
sta_rx.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
sta_tx.c mwifiex: avoid null-pointer-subtraction warning 2021-09-28 17:42:26 +03:00
tdls.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
txrx.c mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
uap_cmd.c mwifiex: Fix fall-through warnings for Clang 2020-11-24 17:05:56 +02:00
uap_event.c wireless: use eth_hw_addr_set() 2021-10-20 12:39:42 +03:00
uap_txrx.c mwifiex: avoid null-pointer-subtraction warning 2021-09-28 17:42:26 +03:00
usb.c mwifiex: fix division by zero in fw download path 2021-10-28 16:27:25 +03:00
usb.h mwifiex: usb: Replace one-element array with flexible-array member 2021-08-21 20:49:56 +03:00
util.c net: mwifiex: Use netif_rx_any_context(). 2020-09-29 14:02:55 -07:00
util.h mwifiex: change license text from MARVELL to NXP 2020-02-14 14:41:54 +02:00
wmm.c mwifiex: Fix fall-through warnings for Clang 2020-11-24 17:05:56 +02:00
wmm.h mwifiex: wmm: Fix -Wunused-const-variable warnings 2020-09-07 11:31:52 +03:00

README

#
# Copyright 2011-2020 NXP
#
# This software file (the "File") is distributed by NXP
# under the terms of the GNU General Public License Version 2, June 1991
# (the "License").  You may use, redistribute and/or modify this File in
# accordance with the terms and conditions of the License, a copy of which
# is available by writing to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
# worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
#
# THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
# IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
# ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
# this warranty disclaimer.


===============================================================================
			U S E R  M A N U A L

1) FOR DRIVER INSTALL

	a) Copy sd8787.bin to /lib/firmware/mrvl/ directory,
	   create the directory if it doesn't exist.
	b) Install WLAN driver,
		insmod mwifiex.ko
	c) Uninstall WLAN driver,
		ifconfig mlanX down
		rmmod mwifiex


2) FOR DRIVER CONFIGURATION AND INFO
	The configurations can be done either using the 'iw' user space
	utility or debugfs.

	a) 'iw' utility commands

	Following are some useful iw commands:-

iw dev mlan0 scan

	This command will trigger a scan.
	The command will then display the scan table entries

iw dev mlan0 connect -w <SSID> [<freq in MHz>] [<bssid>] [key 0:abcde d:1123456789a]
	The above command can be used to connect to an AP with a particular SSID.
	Ap's operating frequency can be specified or even the bssid. If the AP is using
	WEP encryption, wep keys can be specified in the command.
	Note: Every time before connecting to an AP scan command (iw dev mlan0 scan) should be used by user.

iw dev mlan0 disconnect
	This command will be used to disconnect from an AP.


iw dev mlan0 ibss join <SSID> <freq in MHz> [fixed-freq] [fixed-bssid] [key 0:abcde]
	The command will be used to join or create an ibss. Optionally, operating frequency,
	bssid and the security related parameters can be specified while joining/creating
	and ibss.

iw dev mlan0 ibss leave
	The command will be used to leave an ibss network.

iw dev mlan0 link
	The command will be used to get the connection status. The command will return parameters
	such as SSID, operating frequency, rx/tx packets, signal strength, tx bitrate.

	Apart from the iw utility all standard configurations using the 'iwconfig' utility are also supported.

	b) Debugfs interface

	The debugfs interface can be used for configurations and for getting
	some useful information from the driver.
	The section below explains the configurations that can be
	done.

	Mount debugfs to /debugfs mount point:

		mkdir /debugfs
		mount -t debugfs debugfs /debugfs

	The information is provided in /debugfs/mwifiex/mlanX/:

iw reg set <country code>
	The command will be used to change the regulatory domain.

iw reg get
	The command will be used to get current regulatory domain.

info
	This command is used to get driver info.

	Usage:
		cat info

	driver_name = "mwifiex"
	driver_version = <driver_name, driver_version, (firmware_version)>
	interface_name = "mlanX"
	bss_mode = "Ad-hoc" | "Managed" | "Auto" | "Unknown"
	media_state = "Disconnected" | "Connected"
	mac_address = <6-byte adapter MAC address>
	multicase_count = <multicast address count>
	essid = <current SSID>
	bssid = <current BSSID>
	channel = <current channel>
	region_code = <current region code>
	multicasr_address[n] = <multicast address>
	num_tx_bytes = <number of bytes sent to device>
	num_rx_bytes = <number of bytes received from device and sent to kernel>
	num_tx_pkts = <number of packets sent to device>
	num_rx_pkts = <number of packets received from device and sent to kernel>
	num_tx_pkts_dropped = <number of Tx packets dropped by driver>
	num_rx_pkts_dropped = <number of Rx packets dropped by driver>
	num_tx_pkts_err = <number of Tx packets failed to send to device>
	num_rx_pkts_err = <number of Rx packets failed to receive from device>
	carrier "on" | "off"
	tx queue "stopped" | "started"

	The following debug info are provided in /debugfs/mwifiex/mlanX/debug:

	int_counter = <interrupt count, cleared when interrupt handled>
	wmm_ac_vo = <number of packets sent to device from WMM AcVo queue>
	wmm_ac_vi = <number of packets sent to device from WMM AcVi queue>
	wmm_ac_be = <number of packets sent to device from WMM AcBE queue>
	wmm_ac_bk = <number of packets sent to device from WMM AcBK queue>
	tx_buf_size = <current Tx buffer size>
	curr_tx_buf_size = <current Tx buffer size>
	ps_mode = <0/1, CAM mode/PS mode>
	ps_state = <0/1/2/3, full power state/awake state/pre-sleep state/sleep state>
	is_deep_sleep = <0/1, not deep sleep state/deep sleep state>
	wakeup_dev_req = <0/1, wakeup device not required/required>
	wakeup_tries = <wakeup device count, cleared when device awake>
	hs_configured = <0/1, host sleep not configured/configured>
	hs_activated = <0/1, extended host sleep not activated/activated>
	num_tx_timeout = <number of Tx timeout>
	is_cmd_timedout = <0/1 command timeout not occurred/occurred>
	timeout_cmd_id = <command id of the last timeout command>
	timeout_cmd_act = <command action of the last timeout command>
	last_cmd_id = <command id of the last several commands sent to device>
	last_cmd_act = <command action of the last several commands sent to device>
	last_cmd_index = <0 based last command index>
	last_cmd_resp_id = <command id of the last several command responses received from device>
	last_cmd_resp_index = <0 based last command response index>
	last_event = <event id of the last several events received from device>
	last_event_index = <0 based last event index>
	num_cmd_h2c_fail = <number of commands failed to send to device>
	num_cmd_sleep_cfm_fail = <number of sleep confirm failed to send to device>
	num_tx_h2c_fail = <number of data packets failed to send to device>
	num_evt_deauth = <number of deauthenticated events received from device>
	num_evt_disassoc = <number of disassociated events received from device>
	num_evt_link_lost = <number of link lost events received from device>
	num_cmd_deauth = <number of deauthenticate commands sent to device>
	num_cmd_assoc_ok = <number of associate commands with success return>
	num_cmd_assoc_fail = <number of associate commands with failure return>
	cmd_sent = <0/1, send command resources available/sending command to device>
	data_sent = <0/1, send data resources available/sending data to device>
	mp_rd_bitmap = <SDIO multi-port read bitmap>
	mp_wr_bitmap = <SDIO multi-port write bitmap>
	cmd_resp_received = <0/1, no cmd response to process/response received and yet to process>
	event_received = <0/1, no event to process/event received and yet to process>
	cmd_pending = <number of cmd pending>
	tx_pending = <number of Tx packet pending>
	rx_pending = <number of Rx packet pending>


3) FOR DRIVER CONFIGURATION

regrdwr
	This command is used to read/write the adapter register.

	Usage:
		echo " <type> <offset> [value]" > regrdwr
		cat regrdwr

	where the parameters are,
		<type>:     1:MAC/SOC, 2:BBP, 3:RF, 4:PMIC, 5:CAU
		<offset>:   offset of register
		[value]:    value to be written

	Examples:
		echo "1 0xa060" > regrdwr           : Read the MAC register
		echo "1 0xa060 0x12" > regrdwr      : Write the MAC register
		echo "1 0xa794 0x80000000" > regrdwr
		                                    : Write 0x80000000 to MAC register

memrw
	This command is used to read/write the firmware memory.

	Usage:
		1) For reading firmware memory location.
			echo r <address> 0 > /sys/kernel/debug/mwifiex/mlan0/memrw
			cat /sys/kernel/debug/mwifiex/mlan0/memrw
		2) For writing value to firmware memory location.
			echo w <address> [value] > /sys/kernel/debug/mwifiex/mlan0/memrw

	where the parameters are,
		<address>:  memory address
		[value]:    value to be written

	Examples:
		echo r 0x4cf70 0 > /sys/kernel/debug/mwifiex/mlan0/memrw
		cat /sys/kernel/debug/mwifiex/mlan0/memrw
						: Read memory address 0x4cf70
		iwpriv mlan0 memrdwr -0x7fff6000 -0x40000000
		echo w 0x8000a000 0xc0000000 > /sys/kernel/debug/mwifiex/mlan0/memrw
						: Write 0xc0000000 to memory address 0x8000a000

rdeeprom
	This command is used to read the EEPROM contents of the card.

	Usage:
		echo "<offset> <length>" > rdeeprom
		cat rdeeprom

	where the parameters are,
		<offset>:   multiples of 4
		<length>:   4-20, multiples of 4

	Example:
		echo "0 20" > rdeeprom      : Read 20 bytes of EEPROM data from offset 0

hscfg
	This command is used to debug/simulate host sleep feature using
	different configuration parameters.

	Usage:
		echo "<condition> [GPIO# [gap]]]" > hscfg
		cat hscfg

	where the parameters are,
		<condition>: bit 0 = 1   -- broadcast data
			     bit 1 = 1   -- unicast data
			     bit 2 = 1   -- mac event
			     bit 3 = 1   -- multicast data
		[GPIO#]: pin number of GPIO used to wakeup the host.
			 GPIO pin# (e.g. 0-7) or 0xff (interface, e.g. SDIO
			 will be used instead).
		[gap]:   the gap in milliseconds between wakeup signal and
			 wakeup event or 0xff for special setting (host
			 acknowledge required) when GPIO is used to wakeup host.

	Examples:
		echo "-1" > hscfg        : Cancel host sleep mode
		echo "3" > hscfg         : Broadcast and unicast data;
					   Use GPIO and gap set previously
		echo "2 3" > hscfg       : Unicast data and GPIO 3;
					   Use gap set previously
		echo "2 1 160" > hscfg   : Unicast data, GPIO 1 and gap 160 ms
		echo "2 1 0xff" > hscfg  : Unicast data, GPIO 1; Wait for host
					   to ack before sending wakeup event

getlog
        This command is used to get the statistics available in the station.
	Usage:

	cat getlog

device_dump
	This command is used to dump driver information and firmware memory
	segments.
	Usage:

	cat fw_dump

verext
	This command is used to get extended firmware version string using
	different configuration parameters.

	Usage:
		echo "[version_str_sel]" > verext
		cat verext

		[version_str_sel]: firmware support several extend version
				   string cases, include 0/1/10/20/21/99
===============================================================================