| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200701150707.222985-4-Jerome.Pouiller@silabs.com>
Date: Wed, 1 Jul 2020 17:06:57 +0200
From: Jerome Pouiller <Jerome.Pouiller@...abs.com>
To: devel@...verdev.osuosl.org, linux-wireless@...r.kernel.org
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Kalle Valo <kvalo@...eaurora.org>,
"David S . Miller" <davem@...emloft.net>,
Jérôme Pouiller
<jerome.pouiller@...abs.com>
Subject: [PATCH 03/13] staging: wfx: correctly retrieve vif ID from Tx confirmation
From: Jérôme Pouiller <jerome.pouiller@...abs.com>
The device is able to send multiple Tx confirmations in the one reply.
In this case, there is only one vif identifier for all the
confirmations.
Unfortunately, to generate this kind of messages the device squashes all
the confirmations whatever their vif ID and use the vif ID of the first
confirmation. So, the driver cannot rely on the vif ID mentioned in the
header. Fortunately, using the packet_id, the driver can retrieve the Tx
request and the associated vif.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@...abs.com>
---
drivers/staging/wfx/data_tx.c | 16 ++++++++++------
drivers/staging/wfx/data_tx.h | 2 +-
drivers/staging/wfx/hif_rx.c | 14 ++------------
drivers/staging/wfx/queue.c | 22 ++++++++++++----------
drivers/staging/wfx/queue.h | 2 +-
5 files changed, 26 insertions(+), 30 deletions(-)
diff --git a/drivers/staging/wfx/data_tx.c b/drivers/staging/wfx/data_tx.c
index ce3048c94961c..dcec722afb174 100644
--- a/drivers/staging/wfx/data_tx.c
+++ b/drivers/staging/wfx/data_tx.c
@@ -533,25 +533,29 @@ static void wfx_tx_fill_rates(struct wfx_dev *wdev,
dev_dbg(wdev->dev, "%d more retries than expected\n", tx_count);
}
-void wfx_tx_confirm_cb(struct wfx_vif *wvif, const struct hif_cnf_tx *arg)
+void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
{
struct ieee80211_tx_info *tx_info;
const struct wfx_tx_priv *tx_priv;
+ struct wfx_vif *wvif;
struct sk_buff *skb;
- skb = wfx_pending_get(wvif, arg->packet_id);
+ skb = wfx_pending_get(wdev, arg->packet_id);
if (!skb) {
- dev_warn(wvif->wdev->dev, "received unknown packet_id (%#.8x) from chip\n",
+ dev_warn(wdev->dev, "received unknown packet_id (%#.8x) from chip\n",
arg->packet_id);
return;
}
+ wvif = wdev_to_wvif(wdev, ((struct hif_msg *)skb->data)->interface);
+ WARN_ON(!wvif);
+ if (!wvif)
+ return;
tx_info = IEEE80211_SKB_CB(skb);
tx_priv = wfx_skb_tx_priv(skb);
- _trace_tx_stats(arg, skb,
- wfx_pending_get_pkt_us_delay(wvif->wdev, skb));
+ _trace_tx_stats(arg, skb, wfx_pending_get_pkt_us_delay(wdev, skb));
// You can touch to tx_priv, but don't touch to tx_info->status.
- wfx_tx_fill_rates(wvif->wdev, tx_info, arg);
+ wfx_tx_fill_rates(wdev, tx_info, arg);
if (tx_priv->has_sta)
wfx_tx_update_sta(wvif, wfx_skb_hdr80211(skb));
skb_trim(skb, skb->len - wfx_tx_get_icv_len(tx_priv->hw_key));
diff --git a/drivers/staging/wfx/data_tx.h b/drivers/staging/wfx/data_tx.h
index 54fff24508fb9..b1727ddecd5e2 100644
--- a/drivers/staging/wfx/data_tx.h
+++ b/drivers/staging/wfx/data_tx.h
@@ -44,7 +44,7 @@ void wfx_tx_policy_upload_work(struct work_struct *work);
void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
struct sk_buff *skb);
-void wfx_tx_confirm_cb(struct wfx_vif *wvif, const struct hif_cnf_tx *arg);
+void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg);
void wfx_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
u32 queues, bool drop);
diff --git a/drivers/staging/wfx/hif_rx.c b/drivers/staging/wfx/hif_rx.c
index bb156033d1e16..e3ebd910fabfd 100644
--- a/drivers/staging/wfx/hif_rx.c
+++ b/drivers/staging/wfx/hif_rx.c
@@ -63,13 +63,8 @@ static int hif_tx_confirm(struct wfx_dev *wdev,
const struct hif_msg *hif, const void *buf)
{
const struct hif_cnf_tx *body = buf;
- struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);
- WARN_ON(!wvif);
- if (!wvif)
- return -EFAULT;
-
- wfx_tx_confirm_cb(wvif, body);
+ wfx_tx_confirm_cb(wdev, body);
return 0;
}
@@ -77,16 +72,11 @@ static int hif_multi_tx_confirm(struct wfx_dev *wdev,
const struct hif_msg *hif, const void *buf)
{
const struct hif_cnf_multi_transmit *body = buf;
- struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);
int i;
WARN(body->num_tx_confs <= 0, "corrupted message");
- WARN_ON(!wvif);
- if (!wvif)
- return -EFAULT;
-
for (i = 0; i < body->num_tx_confs; i++)
- wfx_tx_confirm_cb(wvif, &body->tx_conf_payload[i]);
+ wfx_tx_confirm_cb(wdev, &body->tx_conf_payload[i]);
return 0;
}
diff --git a/drivers/staging/wfx/queue.c b/drivers/staging/wfx/queue.c
index 6069143369f30..678f622639093 100644
--- a/drivers/staging/wfx/queue.c
+++ b/drivers/staging/wfx/queue.c
@@ -138,30 +138,32 @@ void wfx_pending_drop(struct wfx_dev *wdev, struct sk_buff_head *dropped)
}
}
-struct sk_buff *wfx_pending_get(struct wfx_vif *wvif, u32 packet_id)
+struct sk_buff *wfx_pending_get(struct wfx_dev *wdev, u32 packet_id)
{
struct wfx_queue *queue;
struct hif_req_tx *req;
+ struct wfx_vif *wvif;
struct hif_msg *hif;
struct sk_buff *skb;
- spin_lock_bh(&wvif->wdev->tx_pending.lock);
- skb_queue_walk(&wvif->wdev->tx_pending, skb) {
+ spin_lock_bh(&wdev->tx_pending.lock);
+ skb_queue_walk(&wdev->tx_pending, skb) {
hif = (struct hif_msg *)skb->data;
req = (struct hif_req_tx *)hif->body;
- if (req->packet_id == packet_id) {
- spin_unlock_bh(&wvif->wdev->tx_pending.lock);
+ if (req->packet_id != packet_id)
+ continue;
+ spin_unlock_bh(&wdev->tx_pending.lock);
+ wvif = wdev_to_wvif(wdev, hif->interface);
+ if (wvif) {
queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
- WARN(hif->interface != wvif->id, "sent frame %08x on vif %d, but get reply on vif %d",
- req->packet_id, hif->interface, wvif->id);
WARN_ON(skb_get_queue_mapping(skb) > 3);
WARN_ON(!atomic_read(&queue->pending_frames));
atomic_dec(&queue->pending_frames);
- skb_unlink(skb, &wvif->wdev->tx_pending);
- return skb;
}
+ skb_unlink(skb, &wdev->tx_pending);
+ return skb;
}
- spin_unlock_bh(&wvif->wdev->tx_pending.lock);
+ spin_unlock_bh(&wdev->tx_pending.lock);
WARN(1, "cannot find packet in pending queue");
return NULL;
}
diff --git a/drivers/staging/wfx/queue.h b/drivers/staging/wfx/queue.h
index dfbbe4b111113..22d7c936907f4 100644
--- a/drivers/staging/wfx/queue.h
+++ b/drivers/staging/wfx/queue.h
@@ -35,7 +35,7 @@ bool wfx_tx_queue_empty(struct wfx_vif *wvif, struct wfx_queue *queue);
void wfx_tx_queue_drop(struct wfx_vif *wvif, struct wfx_queue *queue,
struct sk_buff_head *dropped);
-struct sk_buff *wfx_pending_get(struct wfx_vif *wvif, u32 packet_id);
+struct sk_buff *wfx_pending_get(struct wfx_dev *wdev, u32 packet_id);
void wfx_pending_drop(struct wfx_dev *wdev, struct sk_buff_head *dropped);
unsigned int wfx_pending_get_pkt_us_delay(struct wfx_dev *wdev,
struct sk_buff *skb);
--
2.27.0
Powered by blists - more mailing lists