1. 20 4月, 2017 1 次提交
    • B
      mwifiex: MAC randomization should not be persistent · 7e2f18f0
      Brian Norris 提交于
      nl80211 provides the NL80211_SCAN_FLAG_RANDOM_ADDR for every scan
      request that should be randomized; the absence of such a flag means we
      should not randomize. However, mwifiex was stashing the latest
      randomization request and *always* using it for future scans, even those
      that didn't set the flag.
      
      Let's zero out the randomization info whenever we get a scan request
      without NL80211_SCAN_FLAG_RANDOM_ADDR. I'd prefer to remove
      priv->random_mac entirely (and plumb the randomization MAC properly
      through the call sequence), but the spaghetti is a little difficult to
      unravel here for me.
      
      Fixes: c2a8f0ff ("mwifiex: support random MAC address for scanning")
      Cc: <stable@vger.kernel.org> # 4.9+
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      7e2f18f0
  2. 13 4月, 2017 1 次提交
  3. 05 4月, 2017 6 次提交
  4. 21 3月, 2017 7 次提交
  5. 16 3月, 2017 3 次提交
    • B
      mwifiex: uninit wakeup info when removing device · 36908c4e
      Brian Norris 提交于
      We manually init wakeup info, but we don't detach it on device removal.
      This means that if we (for example) rmmod + modprobe the driver, the
      device framework might return -EEXIST the second time, and we'll
      complain in the logs:
      
      [  839.311881] mwifiex_pcie 0000:01:00.0: fail to init wakeup for mwifiex
      
      AFAICT, there's no other negative effect.
      
      But we can fix this by disabling wakeup on remove, similar to what a few
      other drivers do (e.g., the power supply framework).
      
      This code (and bug) has existed on SDIO for a while, but it got moved
      around and enabled for PCIe with commit 853402a0 ("mwifiex: Enable
      WoWLAN for both sdio and pcie").
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      36908c4e
    • B
      mwifiex: set adapter->dev before starting to use mwifiex_dbg() · ba1c7e45
      Brian Norris 提交于
      The mwifiex_dbg() log handler utilizes the struct device in
      adapter->dev. Without it, it decides not to print anything.
      
      As of commit 2e02b581 ("mwifiex: Allow mwifiex early access to device
      structure"), we started assigning that pointer only after we finished
      mwifiex_register() -- this effectively neuters any mwifiex_dbg() logging
      done before this point.
      
      Let's move the device assignment into mwifiex_register().
      
      Fixes: 2e02b581 ("mwifiex: Allow mwifiex early access to device structure")
      Cc: Rajat Jain <rajatja@google.com>
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      ba1c7e45
    • B
      mwifiex: pcie: don't leak DMA buffers when removing · 4e841d3e
      Brian Norris 提交于
      When PCIe FLR support was added, much of the remove/release code for
      PCIe was migrated to ->down_dev(), but ->down_dev() is never called for
      device removal. Let's refactor the cleanup to be done in both cases.
      
      Also, drop the comments above mwifiex_cleanup_pcie(), because they were
      clearly wrong, and it's better to have clear and obvious code than to
      detail the code steps in comments anyway.
      
      Fixes: 4c5dae59 ("mwifiex: add PCIe function level reset support")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      4e841d3e
  6. 28 2月, 2017 1 次提交
  7. 15 2月, 2017 1 次提交
    • B
      mwifiex: don't enable/disable IRQ 0 during suspend/resume · 2447e2ca
      Brian Norris 提交于
      If we don't have an out-of-band wakeup IRQ configured through DT (as
      most platforms don't), then we fall out of this function with
      'irq_wakeup == 0'. Other code (e.g., mwifiex_disable_wake() and
      mwifiex_enable_wake()) treats 'irq_wakeup >= 0' as a valid IRQ, and so
      we end up calling {enable,disable}_irq() on IRQ 0.
      
      That seems bad, so let's not do that.
      
      Same problem as fixed in this patch:
      
      https://patchwork.kernel.org/patch/9531693/
      [PATCH v2 2/3] btmrvl: set irq_bt to -1 when failed to parse it
      
      with the difference that:
      (a) this one is actually a regression and
      (b) this affects both device tree and non-device-tree systems
      
      While fixing the regression, also drop the verbosity on the parse
      failure, so we don't see this when a DT node is present but doesn't have
      an interrupt property (this is perfectly legal):
      
      [   21.999000] mwifiex_pcie 0000:01:00.0: fail to parse irq_wakeup from device tree
      
      Fixes: 853402a0 ("mwifiex: Enable WoWLAN for both sdio and pcie")
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Acked-by: NRajat Jain <rajatja@google.com>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      2447e2ca
  8. 14 2月, 2017 1 次提交
  9. 08 2月, 2017 1 次提交
    • A
      cfg80211: Pass new RSSI level in CQM RSSI notification · bee427b8
      Andrzej Zaborowski 提交于
      Update the drivers to pass the RSSI level as a cfg80211_cqm_rssi_notify
      parameter and pass this value to userspace in a new nl80211 attribute.
      This helps both userspace and also helps in the implementation of the
      multiple RSSI thresholds CQM mechanism.
      
      Note for marvell/mwifiex I pass 0 for the RSSI value because the new
      RSSI value is not available to the driver at the time of the
      cfg80211_cqm_rssi_notify call, but the driver queries the new value
      immediately after that, so it is actually available just a moment later
      if we wanted to defer caling cfg80211_cqm_rssi_notify until that moment.
      Without this, the new cfg80211 code (patch 3) will call .get_station
      which will send a duplicate HostCmd_CMD_RSSI_INFO command to the hardware.
      Signed-off-by: NAndrew Zaborowski <andrew.zaborowski@intel.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      bee427b8
  10. 07 2月, 2017 2 次提交
  11. 28 1月, 2017 2 次提交
  12. 20 1月, 2017 4 次提交
    • B
      mwifiex: don't complain about 'unknown event id: 0x63' · 0ed917d0
      Brian Norris 提交于
      Marvell folks tell me this is a debugging event that the driver doesn't
      need to handle, but on 8997 w/ firmware 16.68.1.p97, I see several of
      these sorts of messages at (for instance) boot time:
      
      [   13.825848] mwifiex_pcie 0000:01:00.0: event: unknown event id: 0x63
      [   14.838561] mwifiex_pcie 0000:01:00.0: event: unknown event id: 0x63
      [   14.850397] mwifiex_pcie 0000:01:00.0: event: unknown event id: 0x63
      [   32.529923] mwifiex_pcie 0000:01:00.0: event: unknown event id: 0x63
      
      Let's handle this "event" with a much lower verbosity.
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      0ed917d0
    • B
      mwifiex: pcie: read FROMDEVICE DMA-able memory with READ_ONCE() · fe116788
      Brian Norris 提交于
      In mwifiex_delay_for_sleep_cookie(), we're looping and waiting for the
      PCIe endpoint to write a magic value back to memory, to signal that it
      has finished going to sleep. We're not letting the compiler know that
      this might change underneath our feet though. Let's do that, for good
      hygiene.
      
      I'm not aware of this fixing any concrete problems. I also give no
      guarantee that this loop is actually correct in any other way, but at
      least this looks like an improvement to me.
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      fe116788
    • B
      mwifiex: pcie: don't loop/retry interrupt status checks · 5d5ddb5e
      Brian Norris 提交于
      The following sequence occurs when using IEEE power-save on 8997:
      (a) driver sees SLEEP event
      (b) driver issues SLEEP CONFIRM
      (c) driver recevies CMD interrupt; within the interrupt processing loop,
          we do (d) and (e):
      (d) wait for FW sleep cookie (and often time out; it takes a while), FW
          is putting card into low power mode
      (e) re-check PCIE_HOST_INT_STATUS register; quit loop with 0 value
      
      But at (e), no one actually signaled an interrupt (i.e., we didn't check
      adapter->int_status). And what's more, because the card is going to
      sleep, this register read appears to take a very long time in some cases
      -- 3 milliseconds in my case!
      
      Now, I propose that (e) is completely unnecessary. If there were any
      additional interrupts signaled after the start of this loop, then the
      interrupt handler would have set adapter->int_status to non-zero and
      queued more work for the main loop -- and we'd catch it on the next
      iteration of the main loop.
      
      So this patch drops all the looping/re-reading of PCIE_HOST_INT_STATUS,
      which avoids the problematic (and slow) register read in step (e).
      
      Incidentally, this is a very similar issue to the one fixed in commit
      ec815dd2 ("mwifiex: prevent register accesses after host is
      sleeping"), except that the register read is just very slow instead of
      fatal in this case.
      
      Tested on 8997 in both MSI and (though not technically supported at the
      moment) MSI-X mode.
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      5d5ddb5e
    • B
      mwifiex: pcie: use posted write to wake up firmware · 062e008a
      Brian Norris 提交于
      Depending on system factors (e.g., the PCIe link PM state), the first
      read to wake up the Wifi firmware can take a long time. There is no
      reason to use a (blocking, non-posted) read at this point, so let's just
      use a write instead. Write vs. read doesn't matter functionality-wise --
      it's just a dummy operation. But let's make sure to re-write with the
      correct "ready" signature, since we check for that in other parts of the
      driver.
      
      This has been shown to decrease the time spent blocking in this function
      on RK3399.
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      062e008a
  13. 19 1月, 2017 2 次提交
    • X
      mwifiex: remove redundant dma padding in AMSDU · 5f0a221f
      Xinming Hu 提交于
      We already ensure 64 bytes alignment and add padding if required
      during skb_aggr allocation.
      
      Alignment and padding in mwifiex_11n_form_amsdu_txpd() is redundant.
      We may end up accessing more data than allocated size with this.
      
      This patch fixes following issue by removing redundant padding.
      
      [  370.241338] skbuff: skb_over_panic: text:ffffffffc046946a len:3550
      put:72 head:ffff880000110000 data:ffff8800001100e4 tail:0xec2 end:0xec0 dev:<NULL>
      [  370.241374] ------------[ cut here ]------------
      [  370.241382] kernel BUG at net/core/skbuff.c:104!
        370.244032] Call Trace:
      [  370.244041]  [<ffffffff8c3df5ec>] skb_put+0x44/0x45
      [  370.244055]  [<ffffffffc046946a>]
      mwifiex_11n_aggregate_pkt+0x1e9/0xa50 [mwifiex]
      [  370.244067]  [<ffffffffc0467c16>] mwifiex_wmm_process_tx+0x44a/0x6b7
      [mwifiex]
      [  370.244074]  [<ffffffffc0411eb8>] ? 0xffffffffc0411eb8
      [  370.244084]  [<ffffffffc046116b>] mwifiex_main_process+0x476/0x5a5
      [mwifiex]
      [  370.244098]  [<ffffffffc0461298>] mwifiex_main_process+0x5a3/0x5a5
      [mwifiex]
      [  370.244113]  [<ffffffff8be7e9ff>] process_one_work+0x1a4/0x309
      [  370.244123]  [<ffffffff8be7f4ca>] worker_thread+0x20c/0x2ee
      [  370.244130]  [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383
      [  370.244136]  [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383
      [  370.244143]  [<ffffffff8be83742>] kthread+0x11c/0x124
      [  370.244150]  [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24
      [  370.244157]  [<ffffffff8c4da1ef>] ret_from_fork+0x3f/0x70
      [  370.244168]  [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24
      
      Fixes: 84b313b3 ("mwifiex: make tx packet 64 byte DMA aligned")
      Signed-off-by: NXinming Hu <huxm@marvell.com>
      Signed-off-by: NAmitkumar Karwar <akarwar@marvell.com>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      5f0a221f
    • P
      libertas: fix improper return value · 259010c5
      Pan Bian 提交于
      Function lbs_cmd_802_11_sleep_params() always return 0, even if the call
      to lbs_cmd_with_response() fails. In this case, the parameter @sp will
      keep uninitialized. Because the return value is 0, its caller (say
      lbs_sleepparams_read()) will not detect the error, and will copy the
      uninitialized stack memory to user sapce, resulting in stack information
      leak. To avoid the bug, this patch returns variable ret (which takes
      the return value of lbs_cmd_with_response()) instead of 0.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451Signed-off-by: NPan Bian <bianpan2016@163.com>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      259010c5
  14. 17 1月, 2017 2 次提交
    • B
      mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print · 6183468a
      Brian Norris 提交于
      Similar to commit fcd2042e ("mwifiex: printk() overflow with 32-byte
      SSIDs"), we failed to account for the existence of 32-char SSIDs in our
      debugfs code. Unlike in that case though, we zeroed out the containing
      struct first, and I'm pretty sure we're guaranteed to have some padding
      after the 'ssid.ssid' and 'ssid.ssid_len' fields (the struct is 33 bytes
      long).
      
      So, this is the difference between:
      
        # cat /sys/kernel/debug/mwifiex/mlan0/info
        ...
        essid="0123456789abcdef0123456789abcdef "
        ...
      
      and the correct output:
      
        # cat /sys/kernel/debug/mwifiex/mlan0/info
        ...
        essid="0123456789abcdef0123456789abcdef"
        ...
      
      Fixes: 5e6e3a92 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
      Signed-off-by: NBrian Norris <briannorris@chromium.org>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      6183468a
    • A
      mwifiex: fix uninitialized variable access in pcie_remove · 0e8edb9a
      Arnd Bergmann 提交于
      Checking the firmware status from PCIe register only works
      if the register is available, otherwise we end up with
      random behavior:
      
      drivers/net/wireless/marvell/mwifiex/pcie.c: In function 'mwifiex_pcie_remove':
      drivers/net/wireless/marvell/mwifiex/pcie.c:585:5: error: 'fw_status' may be used uninitialized in this function [-Werror=maybe-uninitialized]
      
      This makes sure we treat the absence of the register as a failure.
      
      Fixes: 045f0c1b ("mwifiex: get rid of global user_rmmod flag")
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
      0e8edb9a
  15. 12 1月, 2017 6 次提交