aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/marvell
Commit message (Collapse)AuthorAge
* mwifiex: pcie: fix cmd_buf use-after-free in remove/resetBrian Norris2017-05-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 3c8cb9ad032d737b874e402c59eb51e3c991a144 upstream. Command buffers (skb's) are allocated by the main driver, and freed upon the last use. That last use is often in mwifiex_free_cmd_buffer(). In the meantime, if the command buffer gets used by the PCI driver, we map it as DMA-able, and store the mapping information in the 'cb' memory. However, if a command was in-flight when resetting the device (and therefore was still mapped), we don't get a chance to unmap this memory until after the core has cleaned up its command handling. Let's keep a refcount within the PCI driver, so we ensure the memory only gets freed after we've finished unmapping it. Noticed by KASAN when forcing a reset via: echo 1 > /sys/bus/pci/.../reset The same code path can presumably be exercised in remove() and shutdown(). [ 205.390377] mwifiex_pcie 0000:01:00.0: info: shutdown mwifiex... [ 205.400393] ================================================================== [ 205.407719] BUG: KASAN: use-after-free in mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] at addr ffffffc0ad471b28 [ 205.419040] Read of size 16 by task bash/1913 [ 205.423421] ============================================================================= [ 205.431625] BUG skbuff_head_cache (Tainted: G B ): kasan: bad access detected [ 205.439815] ----------------------------------------------------------------------------- [ 205.439815] [ 205.449534] INFO: Allocated in __build_skb+0x48/0x114 age=1311 cpu=4 pid=1913 [ 205.456709] alloc_debug_processing+0x124/0x178 [ 205.461282] ___slab_alloc.constprop.58+0x528/0x608 [ 205.466196] __slab_alloc.isra.54.constprop.57+0x44/0x54 [ 205.471542] kmem_cache_alloc+0xcc/0x278 [ 205.475497] __build_skb+0x48/0x114 [ 205.479019] __netdev_alloc_skb+0xe0/0x170 [ 205.483244] mwifiex_alloc_cmd_buffer+0x68/0xdc [mwifiex] [ 205.488759] mwifiex_init_fw+0x40/0x6cc [mwifiex] [ 205.493584] _mwifiex_fw_dpc+0x158/0x520 [mwifiex] [ 205.498491] mwifiex_reinit_sw+0x2c4/0x398 [mwifiex] [ 205.503510] mwifiex_pcie_reset_notify+0x114/0x15c [mwifiex_pcie] [ 205.509643] pci_reset_notify+0x5c/0x6c [ 205.513519] pci_reset_function+0x6c/0x7c [ 205.517567] reset_store+0x68/0x98 [ 205.521003] dev_attr_store+0x54/0x60 [ 205.524705] sysfs_kf_write+0x9c/0xb0 [ 205.528413] INFO: Freed in __kfree_skb+0xb0/0xbc age=131 cpu=4 pid=1913 [ 205.535064] free_debug_processing+0x264/0x370 [ 205.539550] __slab_free+0x84/0x40c [ 205.543075] kmem_cache_free+0x1c8/0x2a0 [ 205.547030] __kfree_skb+0xb0/0xbc [ 205.550465] consume_skb+0x164/0x178 [ 205.554079] __dev_kfree_skb_any+0x58/0x64 [ 205.558304] mwifiex_free_cmd_buffer+0xa0/0x158 [mwifiex] [ 205.563817] mwifiex_shutdown_drv+0x578/0x5c4 [mwifiex] [ 205.569164] mwifiex_shutdown_sw+0x178/0x310 [mwifiex] [ 205.574353] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie] [ 205.580398] pci_reset_notify+0x5c/0x6c [ 205.584274] pci_dev_save_and_disable+0x24/0x6c [ 205.588837] pci_reset_function+0x30/0x7c [ 205.592885] reset_store+0x68/0x98 [ 205.596324] dev_attr_store+0x54/0x60 [ 205.600017] sysfs_kf_write+0x9c/0xb0 ... [ 205.800488] Call trace: [ 205.802980] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190 [ 205.808415] [<ffffffc00020a96c>] show_stack+0x20/0x28 [ 205.813506] [<ffffffc0005d020c>] dump_stack+0xa4/0xcc [ 205.818598] [<ffffffc0003be44c>] print_trailer+0x158/0x168 [ 205.824120] [<ffffffc0003be5f0>] object_err+0x4c/0x5c [ 205.829210] [<ffffffc0003c45bc>] kasan_report+0x334/0x500 [ 205.834641] [<ffffffc0003c3994>] check_memory_region+0x20/0x14c [ 205.840593] [<ffffffc0003c3b14>] __asan_loadN+0x14/0x1c [ 205.845879] [<ffffffbffc46171c>] mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] [ 205.854282] [<ffffffbffc461864>] mwifiex_pcie_delete_cmdrsp_buf+0x94/0xa8 [mwifiex_pcie] [ 205.862421] [<ffffffbffc462028>] mwifiex_pcie_free_buffers+0x11c/0x158 [mwifiex_pcie] [ 205.870302] [<ffffffbffc4620d4>] mwifiex_pcie_down_dev+0x70/0x80 [mwifiex_pcie] [ 205.877736] [<ffffffbffc1397a8>] mwifiex_shutdown_sw+0x190/0x310 [mwifiex] [ 205.884658] [<ffffffbffc4606b4>] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie] [ 205.892446] [<ffffffc000635f54>] pci_reset_notify+0x5c/0x6c [ 205.898048] [<ffffffc00063a044>] pci_dev_save_and_disable+0x24/0x6c [ 205.904350] [<ffffffc00063cf0c>] pci_reset_function+0x30/0x7c [ 205.910134] [<ffffffc000641118>] reset_store+0x68/0x98 [ 205.915312] [<ffffffc000771588>] dev_attr_store+0x54/0x60 [ 205.920750] [<ffffffc00046f53c>] sysfs_kf_write+0x9c/0xb0 [ 205.926182] [<ffffffc00046dfb0>] kernfs_fop_write+0x184/0x1f8 [ 205.931963] [<ffffffc0003d64f4>] __vfs_write+0x6c/0x17c [ 205.937221] [<ffffffc0003d7164>] vfs_write+0xf0/0x1c4 [ 205.942310] [<ffffffc0003d7da0>] SyS_write+0x78/0xd8 [ 205.947312] [<ffffffc000204634>] el0_svc_naked+0x24/0x28 ... [ 205.998268] ================================================================== This bug has been around in different forms for a while. It was sort of noticed in commit 955ab095c51a ("mwifiex: Do not kfree cmd buf while unregistering PCIe"), but it just fixed the double-free, without acknowledging the potential for use-after-free. Fixes: fc3314609047 ("mwifiex: use pci_alloc/free_consistent APIs for PCIe") Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mwifiex: MAC randomization should not be persistentBrian Norris2017-05-25
| | | | | | | | | | | | | | | | | | | | | | commit 7e2f18f06408ff56d7f75e68de8064777137b319 upstream. nl80211 provides the NL80211_SCAN_FLAG_RANDOM_ADDR for every scan request that should be randomized; the absence of such a flag means we should not randomize. However, mwifiex was stashing the latest randomization request and *always* using it for future scans, even those that didn't set the flag. Let's zero out the randomization info whenever we get a scan request without NL80211_SCAN_FLAG_RANDOM_ADDR. I'd prefer to remove priv->random_mac entirely (and plumb the randomization MAC properly through the call sequence), but the spaghetti is a little difficult to unravel here for me. Fixes: c2a8f0ff9c6c ("mwifiex: support random MAC address for scanning") Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mwifiex: Avoid skipping WEP key deletion for APGanapathi Bhat2017-05-14
| | | | | | | | | | | | | | | | | | | commit a5b60de6972decc6b50a39abb376077c3c3621c8 upstream. This patch fixes the issue specific to AP. AP is started with WEP security and external station is connected to it. Data path works in this case. Now if AP is restarted with WPA/WPA2 security, station is able to connect but ping fails. Driver skips the deletion of WEP keys if interface type is AP. Removing that redundant check resolves the issue. Fixes: e57f1734d87a ("mwifiex: add key material v2 support") Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mwifiex: remove redundant dma padding in AMSDUXinming Hu2017-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5f0a221f59ad6b72202ef9c6e232086de8c336f2 upstream. We already ensure 64 bytes alignment and add padding if required during skb_aggr allocation. Alignment and padding in mwifiex_11n_form_amsdu_txpd() is redundant. We may end up accessing more data than allocated size with this. This patch fixes following issue by removing redundant padding. [ 370.241338] skbuff: skb_over_panic: text:ffffffffc046946a len:3550 put:72 head:ffff880000110000 data:ffff8800001100e4 tail:0xec2 end:0xec0 dev:<NULL> [ 370.241374] ------------[ cut here ]------------ [ 370.241382] kernel BUG at net/core/skbuff.c:104! 370.244032] Call Trace: [ 370.244041] [<ffffffff8c3df5ec>] skb_put+0x44/0x45 [ 370.244055] [<ffffffffc046946a>] mwifiex_11n_aggregate_pkt+0x1e9/0xa50 [mwifiex] [ 370.244067] [<ffffffffc0467c16>] mwifiex_wmm_process_tx+0x44a/0x6b7 [mwifiex] [ 370.244074] [<ffffffffc0411eb8>] ? 0xffffffffc0411eb8 [ 370.244084] [<ffffffffc046116b>] mwifiex_main_process+0x476/0x5a5 [mwifiex] [ 370.244098] [<ffffffffc0461298>] mwifiex_main_process+0x5a3/0x5a5 [mwifiex] [ 370.244113] [<ffffffff8be7e9ff>] process_one_work+0x1a4/0x309 [ 370.244123] [<ffffffff8be7f4ca>] worker_thread+0x20c/0x2ee [ 370.244130] [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383 [ 370.244136] [<ffffffff8be7f2be>] ? rescuer_thread+0x383/0x383 [ 370.244143] [<ffffffff8be83742>] kthread+0x11c/0x124 [ 370.244150] [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24 [ 370.244157] [<ffffffff8c4da1ef>] ret_from_fork+0x3f/0x70 [ 370.244168] [<ffffffff8be83626>] ? kthread_parkme+0x24/0x24 Fixes: 84b313b35f8158d ("mwifiex: make tx packet 64 byte DMA aligned") Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mwifiex: debugfs: Fix (sometimes) off-by-1 SSID printBrian Norris2017-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 6183468a23fc6b6903f8597982017ad2c7fdefcf upstream. Similar to commit fcd2042e8d36 ("mwifiex: printk() overflow with 32-byte SSIDs"), we failed to account for the existence of 32-char SSIDs in our debugfs code. Unlike in that case though, we zeroed out the containing struct first, and I'm pretty sure we're guaranteed to have some padding after the 'ssid.ssid' and 'ssid.ssid_len' fields (the struct is 33 bytes long). So, this is the difference between: # cat /sys/kernel/debug/mwifiex/mlan0/info ... essid="0123456789abcdef0123456789abcdef " ... and the correct output: # cat /sys/kernel/debug/mwifiex/mlan0/info ... essid="0123456789abcdef0123456789abcdef" ... Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mwifiex: pcie: don't leak DMA buffers when removingBrian Norris2017-03-30
| | | | | | | | | | | | | | | | | | commit 4e841d3eb9294ce4137fdb5d0a88f1bceab9c212 upstream. When PCIe FLR support was added, much of the remove/release code for PCIe was migrated to ->down_dev(), but ->down_dev() is never called for device removal. Let's refactor the cleanup to be done in both cases. Also, drop the comments above mwifiex_cleanup_pcie(), because they were clearly wrong, and it's better to have clear and obvious code than to detail the code steps in comments anyway. Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support") Signed-off-by: Brian Norris <briannorris@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mwifiex: printk() overflow with 32-byte SSIDsBrian Norris2016-11-17
| | | | | | | | | | | | | | | | | | SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length when we print them out. This can be easily noticed by connecting to a network with a 32-octet SSID: [ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to '0123456789abcdef0123456789abcdef <uninitialized mem>' bssid xx:xx:xx:xx:xx:xx Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Brian Norris <briannorris@chromium.org> Cc: <stable@vger.kernel.org> Acked-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* cfg80211: add ability to check DA/SA in A-MSDU decapsulationJohannes Berg2016-10-12
| | | | | | | | | | | We should not accept arbitrary DA/SA inside A-MSDUs, it could be used to circumvent protections, like allowing a station to send frames and make them seem to come from somewhere else. Add the necessary infrastructure in cfg80211 to allow such checks, in further patches we'll start using them. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* cfg80211: let ieee80211_amsdu_to_8023s() take only header-less SKBJohannes Berg2016-10-12
| | | | | | | | | There's only a single case where has_80211_header is passed as true, which is in mac80211. Given that there's only simple code that needs to be done before calling it, export that function from cfg80211 instead and let mac80211 call it itself. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
* mwifiex: code rearrangement in mwifiex_usb_host_to_card()Amitkumar Karwar2016-09-26
| | | | | | | | This patch helps get rid of goto statement and improves readability. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: fix race condition causing tx timeoutCathy Luo2016-09-26
| | | | | | | | | | | | | | | It's been observed that in a corner case mwifiex_usb_tx_complete() gets called before we exit from mwifiex_usb_host_to_card() after submitting the urb. 'data_sent' flag remains set in this case. It blocks further Tx packets and triggers watchdog timeout. The problem is fixed by setting data_sent and port_block flag at correct place. Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Shengzhen Li <szli@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: fix kernel crash for USB chipsetsCathy Luo2016-09-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Following crash issue is observed during TCP traffic stress test [ 2253.625439] NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [kworker/u17:1:5191] [ 2253.625520] Call Trace: [ 2253.625527] [<ffffffffc0b47030>] ? moal_spin_lock+0x30/0x30 [usb8xxx] [ 2253.625533] [<ffffffffc0ac3ceb>] ? wlan_wmm_lists_empty+0xb/0xf0 [mlan] [ 2253.625537] [<ffffffffc0ab0ea3>] mlan_main_process+0x1b3/0x720 [mlan] [ 2253.625540] [<ffffffffc0b337f5>] woal_main_work_queue+0x45/0x80 [usb8xxx] [ 2253.625543] [<ffffffff8108aaf0>] process_one_work+0x150/0x3f0 [ 2253.625545] [<ffffffff8108b1e1>] worker_thread+0x121/0x520 [ 2253.625547] [<ffffffff8108b0c0>] ? rescuer_thread+0x330/0x330 [ 2253.625549] [<ffffffff81090222>] kthread+0xd2/0xf0 [ 2253.625551] [<ffffffff81090150>] ? kthread_create_on_node+0x1c0/0x1c0 [ 2253.625553] [<ffffffff8179423c>] ret_from_fork+0x7c/0xb0 [ 2253.625555] [<ffffffff81090150>] ? kthread_create_on_node+0x1c0/0x1c0 In mwifiex_usb_tx_complete(), we are updating port->block_status first and then freeing the skb attached to that URB. We may end up attaching new skb to URB in a corner case and same will be freed. This results in the kernel crash. The problem is solved by changing the sequence. Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Shengzhen Li <szli@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: cfg80211 set_default_mgmt_key handlerGanapathi Bhat2016-09-26
| | | | | | | | | | Previously device used to start using IGTK key as Tx key as soon as it gets downloaded in add_key(). This patch implements set_default_mgmt_key handler. We will update Tx key ID in set_default_mgmt_key(). Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: fix null pointer deference when adapter is nullColin Ian King2016-09-17
| | | | | | | | | | | | | If adapter is null the error exit path in mwifiex_shutdown_sw is to down the semaphore sem and print some debug via mwifiex_dbg. However, passing a NULL adapter to mwifiex_dbg causes a null pointer deference when accessing adapter->dev. This fix checks for a null adapter at the start of the function and to exit without the need to up the semaphore and we also skip the debug to avoid the null pointer dereference. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: fix error handling in mwifiex_create_custom_regdomainBob Copeland2016-09-17
| | | | | | | | | | | | | | | | | | | | | | smatch reports: sta_cmdresp.c:1053 mwifiex_create_custom_regdomain() warn: possible memory leak of 'regd' Indeed, mwifiex_create_custom_regdomain() returns NULL in the case that channel is missing in the TLV without freeing regd. Moreover, some other error paths in this function return ERR_PTR values which are assigned without checking to the regd field in the mwifiex_adapter struct. The latter is only null-checked where used. Fix by freeing regd in the error path, and only update priv->adapter->regd if the returned pointer is valid. Cc: Amitkumar Karwar <akarwar@marvell.com> Cc: Nishant Sarmukadam <nishants@marvell.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: firmware name correction for usb8997 chipsetGanapathi Bhat2016-09-14
| | | | | | | | | | Similar to pcie8997 chipset, first firmware submitted for usb8997 chipset will be usbusb8997_combo_v4.bin. This patch corrects the name used in driver. Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: Command 7 handling for USB chipsetsGanapathi Bhat2016-09-14
| | | | | | | | | | Firmware image for newer USB chipsets starts with a command 7 block (special command). It doesn't contain data length field. This patch adds necessary handling. Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: correction in Rx STBC field of htcapinfoAmitkumar Karwar2016-09-14
| | | | | | | | Currently Rx STBC in assoc request frame is advertised as 3. It should be 2, as our chipsets support two spatial streams. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: handle error if IRQ request fails in mwifiex_sdio_of()Amitkumar Karwar2016-09-14
| | | | | | | | | | | When this failure occurs, we will clear card->plt_wake_cfg so that device would initialize without wake up on external interrupt feature. This feature specific code in suspend and resume handlers will be skipped. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo2016-09-14
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ath.git patches for 4.9. Major changes: ath10k * add nl80211 testmode support for 10.4 firmware * hide kernel addresses from logs using %pK format specifier * implement NAPI support * enable peer stats by default ath9k * use ieee80211_tx_status_noskb where possible wil6210 * extract firmware capabilities from the firmware file ath6kl * enable firmware crash dumps on the AR6004 ath-current is also merged to fix a conflict in ath10k.
| * Merge branch 'ath-current' into ath-nextKalle Valo2016-09-09
| |\ | | | | | | | | | | | | | | | | | | | | | Commit 3c97f5de1f28 ("ath10k: implement NAPI support") conflicts with ath-current. To avoid any merge problems merge ath-current to ath-next already now. Conflicts: drivers/net/wireless/ath/ath10k/htt_rx.c
| | * mwifiex: fix large amsdu packets causing firmware hangCathy Luo2016-08-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes host prepares and downloads a large amsdu packet to firmware which leads to a memory corruption in firmware. The reason is __dev_alloc_skb() may allocate larger buffer than required size. This patch solves the problem by checking "adapter->tx_buf_size" instead of relying on skb_tailroom(). Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: PCIe8997 chip specific handlingAmitkumar Karwar2016-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch corrects the revision id register and uses it along with magic value and chip version registers to download appropriate firmware image. PCIe8997 Z chipset variant code has been removed, as it won't be used in production. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: scan: Simplify codeChristophe Jaillet2016-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch: - improves code layout - removes a useless memset(0) for some memory allocated with kzalloc - removes a useless if. We know that 'if (chan_band_tlv)' will succeed because it has been tested a few lines above Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add PCIe function level reset supportAmitkumar Karwar2016-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements pre and post FLR handlers to support PCIe FLR functionality. Software cleanup is performed in pre-FLR whereas firmware is downloaded and software is re-initialised in post-FLR handler. Following command triggers FLR. echo "1" > /sys/bus/pci/devices/$NUMBER/reset This feature can be used as a recovery mechanism when firmware gets hang. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add cfg80211 testmode supportXinming Hu2016-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds cfg80211 testmode support so that userspace tools can download necessary commands to firmware during manufacturing mode tests. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add manufacturing mode supportXinming Hu2016-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default normal mode is chosen when driver is loaded. This patch adds a provision to choose manufacturing mode via module parameters. Below command loads driver in manufacturing mode insmod mwifiex.ko mfg_mode=1. Tested-by: chunfan chen <jeffc@marvell.com> Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: do not print dot when downloading FWStanislaw Gruszka2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Printing about 3000 lines like this [ 20.691850] mwifiex_pcie 0000:02:00.0: . [ 20.693466] mwifiex_pcie 0000:02:00.0: . is not useful. If FW downloading will be interrupted, we will get proper error message about that. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: print status of FW ready eventStanislaw Gruszka2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | For debugging purpose print content of reg->fw_status register and other variables values when waiting for firmware ready event. Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: make "PCI-E is not the winner" print more informativeStanislaw Gruszka2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Printing ret and adapter->winner do not provide any useful information as those are always 0 at point where the massage is printed. Print value read from reg->fw_status register instead. Stanislaw Gruszka <sgruszka@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: fix missing break on IEEE80211_STYPE_ACTION caseColin Ian King2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The IEEE80211_STYPE_ACTION case is missing a break in the switch statement, causing it to fall through to the default case that reports a debug message about an unknown frame subtype. Fix this by adding in the missing break statement. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add custom regulatory domain supportAmitkumar Karwar2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | This patch creates custom regulatory rules based on the information received from firmware and enable them during wiphy registration. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add CHAN_REGION_CFG commandAmitkumar Karwar2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds command preparation and response handling for CHAN_REGION_CFG command. These changes are prerequisites for adding custom regulatory domain support. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: correct aid value during tdls setupXinming Hu2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AID gets updated during TDLS setup, but modified value isn't reflected in "priv->assoc_rsp_buf". This causes TDLS setup failure. The problem is fixed here. Fixes: 4aff53ef18e4a4 ("mwifiex: parsing aid while receiving..") Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: simplify length computation for some memsetChristophe Jaillet2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | This patch should be a no-op. It just simplifies code by using the name of a variable instead of its type when calling 'sizeof'. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: fix the length parameter of a memsetChristophe Jaillet2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In 'mwifiex_get_ver_ext', we have: struct mwifiex_ver_ext ver_ext; memset(&ver_ext, 0, sizeof(struct host_cmd_ds_version_ext)); This is likely that memset'ing sizeof(struct mwifiex_ver_ext) was expected. Remove the ambiguity by using the variable name directly instead of its type. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: key_material_v2 remove superfluous conditionHeinrich Schuchardt2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | We are using mac as source address in a memcpy. In the lines below we can assume mac is not NULL. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Acked-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: remove superfluous conditionHeinrich Schuchardt2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | for_each_property_of_node is only executed if the property prop is not NULL. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Acked-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: fix radar detection issueGanapathi Bhat2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's been observed that firmware sends RADAR detected event without specifying bss_num/bss_type. Also, the event body is empty. Currently the event is being ignored by driver. This patch checks on which interface 11H is active, accordingly fills bss_num/bss_type and handles the event. Condition "if (le32_to_cpu(rdr_event->passed))" which always fails is also removed. Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add HT aggregation support for adhoc modeXinming Hu2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds HT support for adhoc station. Firmware will upload ibss sta connect event with beacon data, whenever new station joins the adhoc network. Driver will check the HT IE and decide whether to support HT aggreagation or not. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: remove misleading disconnect messageAmitkumar Karwar2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Disconnect message in mwifiex_reset_connect_state() would displays necessary information. We unnecessarily have exactly same message in cfg80211_disconnect(). As priv->cfg_bssid is cleared at this point of time, it prints incorrect(all zero) MAC. This message is removed here. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: process rxba_sync eventXinming Hu2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Firmware may filter and drop packets under certain condition, for example, ARP SA=DA packet. this event will be used to synchronize the Rx Block Acknowledgment (BA) window bitmap and to fill any holes in driver side. Signed-off-by: Xinming Hu <huxm@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: support random MAC address for scanningGanapathi Bhat2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch advertises RANDOM_MAC_ADDR feature to cfg80211. It allow the application to issue scan with a MAC address and mask. Random MACs are generated and used in probe requests sent for scanning until it is changed by the application or device is restarted. Signed-off-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: fix failed to reconnect after interface disabled/enabledAmitkumar Karwar2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recent patch "mwifiex: fix NULL pointer" skips extended scan event handling when suspend is in progress. It created a problem for scan after interface disabled/enabled case. This patch solves the problem by checking netif_running() status. Fixes:16d25da94f3d654 ("mwifiex: fix NULL pointer dereference during suspend") Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: add region code information in debugfsKarthik D A2016-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | region code is an EEPROM setting received from firmware. Let's display this in debugfs along with other information. Signed-off-by: Karthik D A <karthida@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | | mwifiex: Fixed endianness problem for big endian platformKarthik D A2016-09-03
|/ / | | | | | | | | | | | | | | | | | | The driver sends and recives information to and from the firmware. Correct endianness should be ensured as firmware follows little endian format and host can be little/big endian. Signed-off-by: Karthik D A <karthida@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* | net: wireless: marvell: mwifiex: usb: don't print error when allocating urb ↵Wolfram Sang2016-08-13
| | | | | | | | | | | | | | | | | | fails kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | net: wireless: marvell: libertas_tf: if_usb: don't print error when ↵Wolfram Sang2016-08-13
|/ | | | | | | | | allocating urb fails kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* mwifiex: update command response skb length correctlyAmitkumar Karwar2016-07-18
| | | | | | | | | Same skb is being reused for storing command response from firmware in PCIe chipsets. There was a bug while updating the skb length. This patch ensures skb length correctly gets updated based on rx_len. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
* mwifiex: fix PCIe legacy interrupt problemAmitkumar Karwar2016-07-18
| | | | | | | | | | | | | | | | | | In corner case, we may end up processing same interrupt twice. We have a logic to read pending interrupts at the end of interrupt processing routine. It has a race with interrupts read in interrupt handler. This patch solves the problem by ORing the interrupt bitmap in this case. The symptom for this bug is below messages in dmesg log. [ 11.522123] mwifiex_pcie 0000:01:00.0: CMD_RESP: invalid cmd resp [ 11.680412] mwifiex_pcie 0000:01:00.0: There is no command but got cmdrsp Link: https://bugzilla.kernel.org/show_bug.cgi?id=109681 Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Cathy Luo <cluo@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
generated by cgit v1.2.2 (git 2.25.0) at 2025-04-04 22:05:50 -0400