netdev - [PATCH v2 1/2] mwifiex: Use non-posted PCI write when setting TX ring write pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Sep 2021 13:48:12 +0200
From:   Jonas Dreßler <verdre@...d.nl>
To:     Amitkumar Karwar <amitkarwar@...il.com>,
        Ganapathi Bhat <ganapathi017@...il.com>,
        Xinming Hu <huxinming820@...il.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
Cc:     Jonas Dreßler <verdre@...d.nl>,
        Tsuchiya Yuto <kitakar@...il.com>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-pci@...r.kernel.org,
        Maximilian Luz <luzmaximilian@...il.com>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Pali Rohár <pali@...nel.org>,
        Heiner Kallweit <hkallweit1@...il.com>,
        Johannes Berg <johannes@...solutions.net>,
        Brian Norris <briannorris@...omium.org>, stable@...r.kernel.org
Subject: [PATCH v2 1/2] mwifiex: Use non-posted PCI write when setting TX ring write pointer

On the 88W8897 card it's very important the TX ring write pointer is
updated correctly to its new value before setting the TX ready
interrupt, otherwise the firmware appears to crash (probably because
it's trying to DMA-read from the wrong place). The issue is present in
the latest firmware version 15.68.19.p21 of the pcie+usb card.

Since PCI uses "posted writes" when writing to a register, it's not
guaranteed that a write will happen immediately. That means the pointer
might be outdated when setting the TX ready interrupt, leading to
firmware crashes especially when ASPM L1 and L1 substates are enabled
(because of the higher link latency, the write will probably take
longer).

So fix those firmware crashes by always using a non-posted write for
this specific register write. We do that by simply reading back the
register after writing it, just as a few other PCI drivers do.

This fixes a bug where during rx/tx traffic and with ASPM L1 substates
enabled (the enabled substates are platform dependent), the firmware
crashes and eventually a command timeout appears in the logs.

Cc: stable@...r.kernel.org
Signed-off-by: Jonas Dreßler <verdre@...d.nl>
---
 drivers/net/wireless/marvell/mwifiex/pcie.c | 26 ++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index c6ccce426b49..0eff717ac5fa 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -240,6 +240,20 @@ static int mwifiex_write_reg(struct mwifiex_adapter *adapter, int reg, u32 data)
 	return 0;
 }
 
+/*
+ * This function does a non-posted write into a PCIE card register, ensuring
+ * it's completion before returning.
+ */
+static int mwifiex_write_reg_np(struct mwifiex_adapter *adapter, int reg, u32 data)
+{
+	struct pcie_service_card *card = adapter->card;
+
+	iowrite32(data, card->pci_mmap1 + reg);
+	ioread32(card->pci_mmap1 + reg);
+
+	return 0;
+}
+
 /* This function reads data from PCIE card register.
  */
 static int mwifiex_read_reg(struct mwifiex_adapter *adapter, int reg, u32 *data)
@@ -1482,9 +1496,15 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
 						reg->tx_rollover_ind);
 
 		rx_val = card->rxbd_rdptr & reg->rx_wrap_mask;
-		/* Write the TX ring write pointer in to reg->tx_wrptr */
-		if (mwifiex_write_reg(adapter, reg->tx_wrptr,
-				      card->txbd_wrptr | rx_val)) {
+		/* Write the TX ring write pointer in to reg->tx_wrptr.
+		 * The firmware (latest version 15.68.19.p21) of the 88W8897
+		 * pcie+usb card seems to crash when getting the TX ready
+		 * interrupt but the TX ring write pointer points to an outdated
+		 * address, so it's important we do a non-posted write here to
+		 * force the completion of the write.
+		 */
+		if (mwifiex_write_reg_np(adapter, reg->tx_wrptr,
+				        card->txbd_wrptr | rx_val)) {
 			mwifiex_dbg(adapter, ERROR,
 				    "SEND DATA: failed to write reg->tx_wrptr\n");
 			ret = -1;
-- 
2.31.1