[PATCH 0/3] fix mt76x0u driver hw stop sequence

[PATCH 0/3] fix mt76x0u driver hw stop sequence

[Lorenzo Bianconi]

Fix two issue introduced in mt76x0u driver with latest rework to
share hw initialization between mt760 and mt76x2 drivers

Lorenzo Bianconi (2):
  mt76: usb: fix hw initialization sequence
  mt76x0: usb: stop cal/mac workqueues at hw stop

Stanislaw Gruszka (1):
  mt76: fix frag length allocation for usb

 .../net/wireless/mediatek/mt76/mt76x0/usb.c   | 24 +++++++++----------
 .../wireless/mediatek/mt76/mt76x2/usb_init.c  |  2 +-
 drivers/net/wireless/mediatek/mt76/usb.c      |  2 +-
 3 files changed, 14 insertions(+), 14 deletions(-)

-- 
2.17.1

[PATCH 1/3] mt76: fix frag length allocation for usb

[Lorenzo Bianconi]

From: Stanislaw Gruszka <sgruszka@redhat.com>

This is correct fix for c12128ce44b0 ("mt76: use a per rx queue page
fragment cache"). We use wrong length when we allocate segments for
MCU transmissions, which require bigger segment size than e->buf_size.

Commit 481bb0432414 ("mt76: usb: make rx page_frag_cache access atomic")
partially solved the problem or actually mask it by changing
mt76u_mcu_init_rx() and mt76u_alloc_queues() sequence, so e->buf_size
become non zero any longer, but still not big enough to handle MCU data.

Patch fixes memory corruption which can manifest itself as random,
not easy to reproduce crashes, during mt76 driver load or unload.

Fixes: c12128ce44b0 ("mt76: use a per rx queue page fragment cache")
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
 drivers/net/wireless/mediatek/mt76/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index de7785c4f6af..6b643ea701e3 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -286,7 +286,7 @@ mt76u_fill_rx_sg(struct mt76_dev *dev, struct mt76u_buf *buf,
 		void *data;
 		int offset;
 
-		data = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
+		data = page_frag_alloc(&q->rx_page, len, GFP_ATOMIC);
 		if (!data)
 			break;
 
-- 
2.17.1

[PATCH 2/3] mt76: usb: fix hw initialization sequence

[Lorenzo Bianconi]

mt76u_alloc_queues need to be called before mt76u_mcu_init_rx
since it initializes rx_page_lock spinlock used in mt76u_buf_alloc
routine.

Fixes: b11e19694dc9 ("mt76x0: add ieee80211_ops ops pointer to
mt76x0_alloc_device signature")

Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
 .../net/wireless/mediatek/mt76/mt76x0/usb.c    | 18 +++++++++---------
 .../wireless/mediatek/mt76/mt76x2/usb_init.c   |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index a76043213f55..dd437e77009f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -179,28 +179,28 @@ static int mt76x0u_register_device(struct mt76x0_dev *dev)
 	struct ieee80211_hw *hw = dev->mt76.hw;
 	int err;
 
-	err = mt76u_mcu_init_rx(&dev->mt76);
+	err = mt76u_alloc_queues(&dev->mt76);
 	if (err < 0)
-		return err;
+		goto out_err;
 
-	err = mt76u_alloc_queues(&dev->mt76);
+	err = mt76u_mcu_init_rx(&dev->mt76);
 	if (err < 0)
-		return err;
+		goto out_err;
 
 	mt76x0_chip_onoff(dev, true, true);
 	if (!mt76x02_wait_for_mac(&dev->mt76)) {
 		err = -ETIMEDOUT;
-		goto err;
+		goto out_err;
 	}
 
 	err = mt76x0u_mcu_init(dev);
 	if (err < 0)
-		goto err;
+		goto out_err;
 
 	mt76x0_init_usb_dma(dev);
 	err = mt76x0_init_hardware(dev);
 	if (err < 0)
-		goto err;
+		goto out_err;
 
 	mt76_rmw(dev, MT_US_CYC_CFG, MT_US_CYC_CNT, 0x1e);
 	mt76_wr(dev, MT_TXOP_CTRL_CFG,
@@ -209,7 +209,7 @@ static int mt76x0u_register_device(struct mt76x0_dev *dev)
 
 	err = mt76x0_register_device(dev);
 	if (err < 0)
-		goto err;
+		goto out_err;
 
 	/* check hw sg support in order to enable AMSDU */
 	if (mt76u_check_sg(&dev->mt76))
@@ -221,7 +221,7 @@ static int mt76x0u_register_device(struct mt76x0_dev *dev)
 
 	return 0;
 
-err:
+out_err:
 	mt76x0u_cleanup(dev);
 	return err;
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
index 55e0dea568b8..a8222447d805 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c
@@ -262,7 +262,7 @@ int mt76x2u_register_device(struct mt76x2_dev *dev)
 
 	err = mt76u_mcu_init_rx(&dev->mt76);
 	if (err < 0)
-		return err;
+		goto fail;
 
 	err = mt76x2u_init_hardware(dev);
 	if (err < 0)
-- 
2.17.1

[PATCH 3/3] mt76x0: usb: stop cal/mac workqueues at hw stop

[Lorenzo Bianconi]

Stop mac and calibration work stopping the hw even if the
device has been removed

Fixes: b11e19694dc9 ("mt76x0: add ieee80211_ops ops pointer to
mt76x0_alloc_device signature")

Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
---
 drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index dd437e77009f..57862cacf22a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -86,14 +86,14 @@ static void mt76x0u_cleanup(struct mt76x0_dev *dev)
 
 static void mt76x0u_mac_stop(struct mt76x0_dev *dev)
 {
-	if (test_bit(MT76_REMOVED, &dev->mt76.state))
-		return;
-
 	clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);
 	cancel_delayed_work_sync(&dev->cal_work);
 	cancel_delayed_work_sync(&dev->mac_work);
 	mt76u_stop_stat_wk(&dev->mt76);
 
+	if (test_bit(MT76_REMOVED, &dev->mt76.state))
+		return;
+
 	mt76_clear(dev, MT_BEACON_TIME_CFG, MT_BEACON_TIME_CFG_TIMER_EN |
 		   MT_BEACON_TIME_CFG_SYNC_MODE | MT_BEACON_TIME_CFG_TBTT_EN |
 		   MT_BEACON_TIME_CFG_BEACON_TX);
-- 
2.17.1

Re: [PATCH 0/3] fix mt76x0u driver hw stop sequence

[Felix Fietkau]

On 2018-10-03 12:52, Lorenzo Bianconi wrote:
> Fix two issue introduced in mt76x0u driver with latest rework to
> share hw initialization between mt760 and mt76x2 drivers
Merged, thanks.

- Felix