summaryrefslogtreecommitdiffstats
path: root/drivers (follow)
Commit message (Collapse)AuthorAgeFilesLines
* wil6210: add support for PCIe D3hot in system suspendMaya Erez2017-06-2111-49/+603
| | | | | | | | | | | | | In order to preserve the connection in suspend/resume flow, wil6210 host allows going to PCIe D3hot state in suspend, instead of performing a full wil6210 device reset. This requires the platform ability to initiate wakeup in case of RX data. To check that, a new platform API is added. In addition, add cfg80211 suspend/resume callbacks implementation. Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* wil6210: prevent platform callbacks after uninitDedy Lansky2017-06-211-4/+9
| | | | | | | | | | After calling platform_ops.uninit() it is still possible to invoke platform callbacks. To prevent this, zero platform_ops right after invoking uninit. Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com> Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: set rxnss_override for QCA9888Sven Eckelmann2017-06-211-2/+6
| | | | | | | | | | QCA9888 supports VHT80 with 2x2. But it only support 1x1 with VHT160 or VHT80+80. Inform userspace and the the QCA firmware about that limitation whenever VHT80+80 or VHT160 is configured. Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com> [kvalo@qca.qualcomm.com: use hw_params] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: configure rxnss_override for QCA9984Ben Greear2017-06-215-1/+69
| | | | | | | | | | | | | | | | | | | | | | QCA9984 hardware can do 4x4 at 80Mhz, but only 2x2 at 160Mhz. First, report this to user-space by setting the max-tx-speed and max-rx-speed vht capabilities. Second, if the peer rx-speed is configured, and if we are in 160 or 80+80 mode, and the peer rx-speed matches the max speed for 2x2 or 1x1 at 160Mhz (long guard interval), then use that info to set the peer_bw_rxnss_override appropriately. Without this, a 9984 firmware will not use 2x2 ratesets when transmitting to peer (it will be stuck at 1x1), because the firmware would not have configured the rxnss_override. Signed-off-by: Ben Greear <greearb@candelatech.com> [sven.eckelmann@openmesh.com: rebase, cleanup, drop 160Mhz workaround cleanup] Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com> [kvalo@qca.qualcomm.com: use hw_params, rename the title] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: use complete VHT chan width for 160MHz workaroundBen Greear2017-06-211-1/+1
| | | | | | | | | | | | | | | | | | | | The ath10k firmware doesn't announce its VHT channel width capabilities in the vht_cap information from the "service ready event" arguments. The driver must therefore check whether the 160MHz short GI bit is set and whether the driver still doesn't set the bits for the 160/80+80 MHz capabilities. The two bits for the channel width are a two bit integer and not two separate bits which cannot be parsed without the knowledge of the other bit. Using IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ (b10..) as a mask for this task doesn't make any sense. The correct mask for the VHT channel width should be used instead to make this check more readable. Signed-off-by: Ben Greear <greearb@candelatech.com> [sven.eckelmann@openmesh.com: separate 160Mhz workaround cleanup, add commit message] Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath6kl: fix spelling mistake: "Indicat" -> "Indicate"Colin Ian King2017-06-161-1/+1
| | | | | | | | Trivial fix to spelling mistake in ath6kl_dbg debug message Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Steve deRosier <derosier@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: add per chain RSSI reportingNorik Dzhandzhapanyan2017-06-161-0/+13
| | | | | | | | Report per chain RSSI to mac80211. Signed-off-by: Norik Dzhandzhapanyan <norikd@gmail.com> [kvalo@qca.qualcomm.com: fix conflicts and style] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: define structures for CE ctrl/misc registerSarada Prasanna Garnayak2017-06-166-195/+325
| | | | | | | | | | | | | Define structures for the copy engine ctrl/misc registers, that includes CE CMD halt, watermark source, watermark destination, host IE ring, source, destination and dmax ring. This adds support to avoid the conditional compilation, code optimization and dynamic configuration of the copy engine register map for respective hardware bus interface. Signed-off-by: Sarada Prasanna Garnayak <c_sgarna@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: fix the logic of limiting tdls peer countsRyan Hsu2017-06-011-28/+21
| | | | | | | | | | | | | The original idea is to limit the maximum TDLS peer link, but the logic is always false, and never be able to restrict the number of TDLS peer creation. Fix the logic here and also move the checking earlier, so that it could avoid to handle the failure case, e.g disable the tdls peer, delete the peer and also vdev count cleanup. Signed-off-by: Ryan Hsu <ryanhsu@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: add BMI parameters to fix calibration from DT/pre-calAnilkumar Kolli2017-06-012-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | QCA99X0, QCA9888, QCA9984 supports calibration data in either OTP or DT/pre-cal file. Current ath10k supports Calibration data from OTP only. If caldata is loaded from DT/pre-cal file, fetching board id and applying calibration parameters like tx power gets failed. error log: [ 15.733663] ath10k_pci 0000:01:00.0: failed to fetch board file: -2 [ 15.741474] ath10k_pci 0000:01:00.0: could not probe fw (-2) This patch adds calibration data support from DT/pre-cal file. Below parameters are used to get board id and applying calibration parameters from cal data. EEPROM[OTP] FLASH[DT/pre-cal file] Cal param 0x700 0x10000 Board id 0x10 0x8000 Tested on QCA9888 with pre-cal file. Signed-off-by: Anilkumar Kolli <akolli@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: initialize nbytes to 0Ben Greear2017-06-011-0/+4
| | | | | | | | | | ath10k firmware checks nbytes == 0 as part of determining if DMA has completed successfully. To help make this work more often, have the driver initialize nbytes to zero when freeing the descriptor slot. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: log when longer bmi cmds happenBen Greear2017-06-011-6/+21
| | | | | | | | This lets one have a clue that maybe timeouts are happening when we just aren't waiting long enough. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: increase BMI timeoutBen Greear2017-06-011-2/+2
| | | | | | | | | | | | | | | When testing a 9888 chipset NIC, I notice it often takes almost 2 seconds, and then many times OTP fails, probably due to the two-second timeout. [ 2269.841842] ath10k_pci 0000:05:00.0: bmi cmd took: 1984 jiffies (HZ: 1000), rv: 0 [ 2273.608185] ath10k_pci 0000:05:00.0: bmi cmd took: 1986 jiffies (HZ: 1000), rv: 0 [ 2277.294732] ath10k_pci 0000:05:00.0: bmi cmd took: 1989 jiffies (HZ: 1000), rv: 0 So, increase the BMI timeout to 3 seconds. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: go back to using dma_alloc_coherent() for firmware scratch memoryAdrian Chadd2017-05-311-25/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit b057886524be ("ath10k: do not use coherent memory for allocated device memory chunks") in 2015 which converted this allocation from dma_map_coherent() to kzalloc() / dma_map_single(). The current problem manifests when using later model NICs with larger (>700KiB) scratch spaces in memory. Although the kzalloc call succeeds, the software IOMMU TLB code (via dma_map_single()) panics because it can't find 700KiB of linear physmem bounce buffers for DMA. Now, this is a bit of a silly failure mode for the dma map API, but it's what we currently have to play with. In these cases, doing kzalloc() works fine, but the dma_map_single() call fails. After chatting with Linus briefly about this, it indeed should be using dma_alloc_coherent() for doing larger device memory allocation that requires some kind of physical address mapping. You're not supposed to be using kzalloc and dma_map_* calls for large memory regions, and I'm guessing not for long-held mappings either. Typically dma mappings should be temporary for DMA, not long held like these. Now, since hopefully the major annoying underlying problem has also been addressed (ie, ath10k is no longer tears down all of these allocations and reallocates them every time the vdevs are brought down) fragmentation should stop being such a touchy issue. If it is though, using dma_alloc_coherent() use gets us access to the CMB APIs too relatively easily and ideally we would be allocating memory early in boot for exactly these reasons. Signed-off-by: Adrian Chadd <adrian@FreeBSD.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* wil6210: support devices with different PCIe bar sizeMaya Erez2017-05-234-12/+17
| | | | | | | | wil6210 devices can have different PCIe bar size, hence get the bar size from PCIe device instead of using a constant bar size. Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* wil6210: Improve AP stop handlingHamad Kadmany2017-05-231-0/+2
| | | | | | | | | | Set resetting flag early when stopping AP to avoid disconnect events as a result of disconnect command sent during AP stop procedure. Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com> Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* wil6210: add option to load FTM FWHamad Kadmany2017-05-232-7/+20
| | | | | | | | | Module parameter allows to load specific FW used for FTM testing. Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com> Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* wil6210: low level RF sector APILior David2017-05-231-0/+573
| | | | | | | | | | | | | | | Added vendor commands for low level control over RF sectors. It allows user space a fine-grained control over RF characteristics for TX and RX, such as direction and gain of TX/RX. Main usages are debugging and diagnostics, but also operational use cases. API includes getting/setting a specific RF sector configuration, as well as getting/setting the selected sector which is used to communicate with a station. Signed-off-by: Lior David <qca_liord@qca.qualcomm.com> Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: fix reported HT MCS rates with NSS > 1Sven Eckelmann2017-05-231-4/+10
| | | | | | | | | | | | | | | | | | | | | | The QCA4019 firmware 10.4-3.2.1-00050 reports only HT MCS rates between 0-9. But 802.11n MCS rates can be larger than that. For example a 2x2 device can send with up to MCS 15. The firmware encodes the higher MCS rates using the NSS field. The actual calculation is not documented by QCA but it seems like the NSS field can be mapped for HT rates to following MCS offsets: * NSS 1: 0 * NSS 2: 8 * NSS 3: 16 * NSS 4: 24 This offset therefore has to be added for HT rates before they are stored in the rate_info struct. Fixes: cec17c382140 ("ath10k: add per peer htt tx stats support for 10.4") Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* ath10k: remove unnecessary codeGustavo A. R. Silva2017-05-231-9/+0
| | | | | | | | | | | The array fields in struct wmi_start_scan_arg that are checked here are fixed size arrays so they can never be NULL. Addresses-Coverity-ID: 1260031 Cc: Arend Van Spriel <arend.vanspriel@broadcom.com> Cc: Kalle Valo <kvalo@qca.qualcomm.com> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo2017-05-1922-104/+2782
|\ | | | | | | | | | | | | | | ath.git patches for 4.13. Major changes: ath10k * add initial SDIO support (still work in progress)
| * ath9k: check ah->curchan when updating tx powerStanislaw Gruszka2017-05-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When driver fail to reset card ah->curchan value stay NULL. When later driver try to update tx power it oops by using ah->curchan (calltrace is shown below). This problem were reported at various places and for some it was fixed by making ath9k_hw_chip_reset() do not fail. I have this bug report on some oldish RHEL kernel with AR9285, however it's hard to debug where reset fail when kernel OOPS, so I think this patch should be applied. Hopefully ah->curchan is not used unconditionally on other places until is initialized on ath9k_config(). ath: phy0: Chip reset failed ath: phy0: Unable to reset hardware; reset status -22 (freq 2412 MHz) BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<f8a35585>] ath9k_hw_set_txpowerlimit+0x25/0x80 [ath9k_hw] Oops: 0000 [#1] SMP <snip> Call Trace: [<f8aac1aa>] ? ath9k_cmn_update_txpow+0x1a/0x30 [ath9k_common] [<f8cf4f4e>] ? ath_complete_reset+0x4e/0x130 [ath9k] [<f8cf54d7>] ? ath9k_start+0x127/0x1e0 [ath9k] [<f8c2e52f>] ? ieee80211_do_open+0x30f/0x910 [mac80211] [<c07bd96d>] ? dev_open+0x8d/0xf0 Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: remove unnecessary codeGustavo A. R. Silva2017-05-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | The array field eeprom_data in struct th9k_platform_data is a fixed size array so it can never be NULL. Addresses-Coverity-ID: 1364903 Cc: Arend Van Spriel <arend.vanspriel@broadcom.com> Cc: Kalle Valo <kvalo@qca.qualcomm.com> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * wil6210: use memdup_userGeliang Tang2017-05-191-8/+4
| | | | | | | | | | | | | | Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang <geliangtang@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath5k: fix memory leak on buf on failed eeprom readColin Ian King2017-05-191-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | The AR5K_EEPROM_READ macro returns with -EIO if a read error occurs causing a memory leak on the allocated buffer buf. Fix this by explicitly calling ath5k_hw_nvram_read and exiting on the via the freebuf label that performs the necessary free'ing of buf when a read error occurs. Detected by CoverityScan, CID#1248782 ("Resource Leak") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath9k: fix spelling in ath9k_tx99_init()Ammly Fredrick2017-05-191-1/+1
| | | | | | | | | | | | | | | | It's spelled hardware, not harware. Signed-off-by: Ammly Fredrick <ammlyf@gmail.com> [kvalo@qca.qualcomm.com: improve commit log] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath6kl: assure headroom of skbuff is writable in .start_xmit()Arend Van Spriel2017-05-191-9/+4
| | | | | | | | | | | | | | | | | | | | | | An issue was found brcmfmac driver in which a skbuff in .start_xmit() callback was actually cloned. So instead of checking for sufficient headroom it should also be writable. Hence use skb_cow_head() to check and expand the headroom appropriately. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Tested-by: Steve deRosier <derosier@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: append the wmi_op_version to testmode get_version cmdRyan Hsu2017-05-042-0/+8
| | | | | | | | | | | | | | | | | | QCA9xxx and QCA61x4/QCA93xx are using different wmi operation, in order for userspace to differentiate it, appends the wmi_op_version information alone with the get_version command. Signed-off-by: Ryan Hsu <ryanhsu@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: fix out of bounds access to local bufferMichael Mera2017-05-041-6/+10
| | | | | | | | | | | | | | | | | | | | During write to debugfs file simulate_fw_crash, fixed-size local buffer 'buf' is accessed and modified at index 'count-1', where 'count' is the size of the write (so potentially out of bounds). This patch fixes this problem. Signed-off-by: Michael Mera <dev@michaelmera.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: add initial SDIO supportErik Stromdahl2017-05-044-0/+2352
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Chipsets like QCA6584 have support for SDIO so add initial SDIO bus support to ath10k. With this patch we have the low level HTC protocol working and it's possible to boot the firmware, but it's still not possible to connect or anything like. More changes are needed for full functionality. For that reason we print during initialisation: WARNING: ath10k SDIO support is incomplete, don't expect anything to work! Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> [kvalo@qca.qualcomm.com: refactoring, cleanup, commit log] Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: different fw file name for sdioErik Stromdahl2017-05-041-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since both SDIO based chipsets will use different firmware from the PCIe and AHB chipsets, the fw file name must be different depending on bus type. The new firmware names are: For PCIe and AHB: firmware-<api_version>.bin (same as before) For SDIO: firmware-sdio-<api_version>.bin Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: htc: ready_ext msg supportErik Stromdahl2017-05-042-6/+27
| | | | | | | | | | | | | | | | | | | | | | | | Added support for extended ready message. The extended ready message contains the maximum bundle count supported by SDIO chipsets. It is transmitted by SDIO chipset only and replaces the "standard" ready message in this case. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: sdio get target infoErik Stromdahl2017-05-043-1/+77
| | | | | | | | | | | | | | Special BMI get target info function for SDIO. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: add sdio extra initializationsErik Stromdahl2017-05-041-0/+18
| | | | | | | | | | | | | | | | Extra initializations needed by all sdio boards. Derived from qcacld. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: various sdio related definitionsErik Stromdahl2017-05-044-0/+82
| | | | | | | | | | | | | | | | | | Debug masks for SDIO HIF layer. Address definitions for SDIO/mbox based chipsets. Augmented struct host_interest with more members. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: htc: refactorizationErik Stromdahl2017-05-041-40/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Code refactorization: Moved the code for ep 0 in ath10k_htc_rx_completion_handler to ath10k_htc_control_rx_complete. This eases the implementation of SDIO/mbox significantly since the ep_rx_complete cb is invoked directly from the SDIO/mbox hif layer. Since the ath10k_htc_control_rx_complete already is present (only containing a warning message) there is no reason for not using it (instead of having a special case for ep 0 in ath10k_htc_rx_completion_handler). Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: htc: move htc ctrl ep connect to htc_initErik Stromdahl2017-05-041-22/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch moves the HTC ctrl service connect from htc_wait_target to htc_init. This is done in order to make sure the htc ctrl service is setup properly before hif_start is called. The reason for this is that we want the HTC ctrl service callback to be initialized before the target sends the HTC ready message. The ready message will always be transmitted on endpoint 0 (which is always assigned to the HTC control service) so it makes more sense if HTC control has been connected before the ready message is received. Since the service to pipe mapping is done as a part of the service connect, the get_default_pipe call is redundant and was removed. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: htc: rx trailer lookahead supportErik Stromdahl2017-05-042-5/+120
| | | | | | | | | | | | | | | | | | | | | | | | The RX trailer parsing is now capable of parsing lookahead reports. A lookahead contains the first 4 bytes of the next HTC message (that will be read in the next SDIO read operation). Lookaheads are used by the SDIO/mbox HIF layer to determine if the next message is part of a bundle, which endpoint it belongs to and how long it is. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
| * ath10k: htc: made static function publicErik Stromdahl2017-05-042-6/+14
| | | | | | | | | | | | | | | | | | | | Changed ath10k_htc_notify_tx_completion and ath10k_htc_process_trailer from static to non static. These functions are needed by SDIO/mbox. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
* | mwifiex: add missing USB-descriptor endianness conversionJohan Hovold2017-05-191-1/+2
| | | | | | | | | | | | | | | | Add the missing endianness conversions to a debug statement printing the USB device-descriptor bcdUSB field during probe. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: pcie: stop setting/clearing 'surprise_removed'Brian Norris2017-05-191-2/+0
| | | | | | | | | | | | | | | | | | These are already handled by mwifiex_shutdown_sw() and mwifiex_reinit_sw(). Ideally, we'll kill the flag entirely eventually, as I suspect it breeds race conditions. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: pcie: remove useless pdev checkBrian Norris2017-05-191-5/+0
| | | | | | | | | | Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: 11h: drop unnecessary check for '!priv'Brian Norris2017-05-191-6/+0
| | | | | | | | | | | | | | | | These pointers are retrieved via container_of(). There's no way they are NULL. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: remove redundant 'adapter' check in mwifiex_adapter_cleanupBrian Norris2017-05-191-5/+0
| | | | | | | | | | | | | | | | We're using 'adapter' right before calling this. Stop being unnecessarily paranoid. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: remove useless 'mwifiex_lock'Brian Norris2017-05-192-6/+0
| | | | | | | | | | | | | | | | If mwifiex_shutdown_drv() is racing with another mwifiex_shutdown_drv(), we *really* have problems. Kill the lock. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: don't leak stashed beacon buffer on resetBrian Norris2017-05-191-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When removing or resetting an mwifiex device, we don't remember to free the saved beacon buffer. Use the (somewhat misleadingly-named) mwifiex_free_priv() helper to handle this. Noticed by kmemleak during tests: echo 1 > /sys/bus/pci/devices/.../reset unreferenced object 0xffffffc09d034a00 (size 256): ... backtrace: [<ffffffc0003cdce4>] create_object+0x228/0x3c4 [<ffffffc000c0b9d8>] kmemleak_alloc+0x54/0x88 [<ffffffc0003c0848>] __kmalloc+0x1cc/0x2dc [<ffffffbffc1500c4>] mwifiex_save_curr_bcn+0x80/0x308 [mwifiex] [<ffffffbffc1516b8>] mwifiex_ret_802_11_associate+0x4ec/0x5fc [mwifiex] [<ffffffbffc15da90>] mwifiex_process_sta_cmdresp+0xaf8/0x1fa4 [mwifiex] [<ffffffbffc1411e0>] mwifiex_process_cmdresp+0x40c/0x510 [mwifiex] [<ffffffbffc13b8f4>] mwifiex_main_process+0x4a4/0xb00 [mwifiex] [<ffffffbffc13bf84>] mwifiex_main_work_queue+0x34/0x40 [mwifiex] Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: don't drop lock between list-retrieval / list-deletionBrian Norris2017-05-191-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mwifiex_exec_next_cmd() seems to have a classic TOCTOU race, where we drop the list lock in between retrieving the next command and deleting it from the list. This potentially leaves room for someone else to also retrieve / steal this node from the list (e.g., mwifiex_cancel_all_pending_cmd()). Let's keep holding the lock while we do our 'ps_state' sanity checks. There should be no harm in continuing to hold this lock for a bit more. Noticed only by code inspection. Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: Add locking to mwifiex_11n_delbaDouglas Anderson2017-05-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The mwifiex_11n_delba() function walked the rx_reorder_tbl_ptr without holding the lock, which was an obvious violation. Grab the lock. NOTE: we hold the lock while calling mwifiex_send_delba(). There's also several callers in 11n_rxreorder.c that hold the lock and the comments in the struct sound just like very other list/lock pair -- as if the lock should definitely be help for all operations like this. Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: Don't release cmd_pending_q_lock while iteratingDouglas Anderson2017-05-191-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Just like in the previous patch ("mwifiex: Don't release tx_ba_stream_tbl_lock while iterating"), in mwifiex_cancel_all_pending_cmd() we were itearting over a list protected by a spinlock. Again, it is not safe to release the spinlock while iterating. Don't do it. Luckily in this case there should be no need to release the spinlock. This is evidenced by: 1. The only function called while the spinlock was released was mwifiex_recycle_cmd_node() 2. Aside from atomic functions (which are safe to call), the only function called by mwifiex_recycle_cmd_node() was mwifiex_insert_cmd_to_free_q(). 3. It can be seen in mwifiex_cancel_pending_scan_cmd() that it's OK to call mwifiex_insert_cmd_to_free_q() while holding a different spinlock (scan_pending_q_lock), so in general holding a spinlock should be OK. 4. It doesn't appear that mwifiex_insert_cmd_to_free_q() has any interaction with the cmd_pending_q_lock No known bugs are fixed with this change, but as with other similar changes this could fix random list corruption. Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | mwifiex: Don't release tx_ba_stream_tbl_lock while iteratingDouglas Anderson2017-05-191-7/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Despite the macro list_for_each_entry_safe() having the word "safe" in the name, it's still not actually safe to release the list spinlock while iterating over the list. The "safe" in the macro name actually only means that it's safe to delete the current entry while iterating over the list. Releasing the spinlock while iterating over the list means that someone else could come in and adjust the list while we don't have the spinlock. If they do that it can totally mix up our iteration and fully corrupt the list. Later iterating over a corrupted list while holding a spinlock and having IRQs off can cause all sorts of hard to debug problems. As evidenced by the other call to mwifiex_11n_delete_tx_ba_stream_tbl_entry() in mwifiex_11n_delete_all_tx_ba_stream_tbl(), it's actually safe to skip the spinlock release. Let's do that. No known problems are fixed by this patch, but it could fix all sorts of weird problems and it should be very safe. Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-13 08:01:46 +0100