* [PATCH 3.9 0/3] mwifiex: patchset to fix cmd timeout on XO-4
@ 2013-03-16 1:47 Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 1/3] mwifiex: fix race when queuing commands Bing Zhao
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Bing Zhao @ 2013-03-16 1:47 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Daniel Drake, Paul Fox, John Rhodes,
Marco Cesarano, Yogesh Powar, Avinash Patil, Amitkumar Karwar,
Nishant Sarmukadam, Frank Huang, Bing Zhao
This patch series fixes command timeout issue reproduced on XO-4
with SD8787 during driver load/unload tests.
The cmd_pending leak will be addressed separately.
Amitkumar Karwar (1):
mwifiex: fix race when queuing commands
Bing Zhao (2):
mwifiex: skip pending commands after function shutdown
mwifiex: cancel cmd timer and free curr_cmd in shutdown process
drivers/net/wireless/mwifiex/cmdevt.c | 22 ++++++++++++++++------
drivers/net/wireless/mwifiex/init.c | 8 ++++++++
drivers/net/wireless/mwifiex/main.h | 4 ++--
drivers/net/wireless/mwifiex/scan.c | 8 ++++----
drivers/net/wireless/mwifiex/sta_ioctl.c | 10 ++--------
5 files changed, 32 insertions(+), 20 deletions(-)
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 3.9 1/3] mwifiex: fix race when queuing commands
2013-03-16 1:47 [PATCH 3.9 0/3] mwifiex: patchset to fix cmd timeout on XO-4 Bing Zhao
@ 2013-03-16 1:47 ` Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 2/3] mwifiex: skip pending commands after function shutdown Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 3/3] mwifiex: cancel cmd timer and free curr_cmd in shutdown process Bing Zhao
2 siblings, 0 replies; 4+ messages in thread
From: Bing Zhao @ 2013-03-16 1:47 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Daniel Drake, Paul Fox, John Rhodes,
Marco Cesarano, Yogesh Powar, Avinash Patil, Amitkumar Karwar,
Nishant Sarmukadam, Frank Huang, Bing Zhao
From: Amitkumar Karwar <akarwar@marvell.com>
Running the following script repeatedly on XO-4 with SD8787
produces command timeout and system lockup.
insmod mwifiex_sdio.ko
sleep 1
ifconfig eth0 up
iwlist eth0 scan &
sleep 0.5
rmmod mwifiex_sdio
mwifiex_send_cmd_async() is called for sync as well as async
commands. (mwifiex_send_cmd_sync() internally calls it for
sync command.)
"adapter->cmd_queued" gets filled inside mwifiex_send_cmd_async()
routine for both types of commands. But it is used only for sync
commands in mwifiex_wait_queue_complete(). This could lead to a
race when two threads try to queue a sync command with another
sync/async command simultaneously.
Get rid of global variable and pass command node as a parameter
to mwifiex_wait_queue_complete() to fix the problem.
Cc: <stable@vger.kernel.org> # 3.8
Reported-by: Daniel Drake <dsd@laptop.org>
Tested-by: Daniel Drake <dsd@laptop.org>
Tested-by: Marco Cesarano <marco@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/cmdevt.c | 5 ++---
drivers/net/wireless/mwifiex/main.h | 4 ++--
drivers/net/wireless/mwifiex/scan.c | 8 ++++----
drivers/net/wireless/mwifiex/sta_ioctl.c | 10 ++--------
4 files changed, 10 insertions(+), 17 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index d19a88c..f47ad3a 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -484,8 +484,6 @@ int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
ret = mwifiex_send_cmd_async(priv, cmd_no, cmd_action, cmd_oid,
data_buf);
- if (!ret)
- ret = mwifiex_wait_queue_complete(adapter);
return ret;
}
@@ -588,9 +586,10 @@ int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
if (cmd_no == HostCmd_CMD_802_11_SCAN) {
mwifiex_queue_scan_cmd(priv, cmd_node);
} else {
- adapter->cmd_queued = cmd_node;
mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
queue_work(adapter->workqueue, &adapter->main_work);
+ if (cmd_node->wait_q_enabled)
+ ret = mwifiex_wait_queue_complete(adapter, cmd_node);
}
return ret;
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 9206575..7255289 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -728,7 +728,6 @@ struct mwifiex_adapter {
u16 cmd_wait_q_required;
struct mwifiex_wait_queue cmd_wait_q;
u8 scan_wait_q_woken;
- struct cmd_ctrl_node *cmd_queued;
spinlock_t queue_lock; /* lock for tx queues */
struct completion fw_load;
u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
@@ -1023,7 +1022,8 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
struct mwifiex_multicast_list *mcast_list);
int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
struct net_device *dev);
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter);
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+ struct cmd_ctrl_node *cmd_queued);
int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
struct cfg80211_ssid *req_ssid);
int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index bb60c27..d215b4d 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1388,10 +1388,13 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
list_del(&cmd_node->list);
spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
flags);
- adapter->cmd_queued = cmd_node;
mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
true);
queue_work(adapter->workqueue, &adapter->main_work);
+
+ /* Perform internal scan synchronously */
+ if (!priv->scan_request)
+ mwifiex_wait_queue_complete(adapter, cmd_node);
} else {
spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
flags);
@@ -1946,9 +1949,6 @@ int mwifiex_request_scan(struct mwifiex_private *priv,
/* Normal scan */
ret = mwifiex_scan_networks(priv, NULL);
- if (!ret)
- ret = mwifiex_wait_queue_complete(priv->adapter);
-
up(&priv->async_sem);
return ret;
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 76d31de..8c943b6 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -54,16 +54,10 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
* This function waits on a cmd wait queue. It also cancels the pending
* request after waking up, in case of errors.
*/
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+ struct cmd_ctrl_node *cmd_queued)
{
int status;
- struct cmd_ctrl_node *cmd_queued;
-
- if (!adapter->cmd_queued)
- return 0;
-
- cmd_queued = adapter->cmd_queued;
- adapter->cmd_queued = NULL;
dev_dbg(adapter->dev, "cmd pending\n");
atomic_inc(&adapter->cmd_pending);
--
1.7.0.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 3.9 2/3] mwifiex: skip pending commands after function shutdown
2013-03-16 1:47 [PATCH 3.9 0/3] mwifiex: patchset to fix cmd timeout on XO-4 Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 1/3] mwifiex: fix race when queuing commands Bing Zhao
@ 2013-03-16 1:47 ` Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 3/3] mwifiex: cancel cmd timer and free curr_cmd in shutdown process Bing Zhao
2 siblings, 0 replies; 4+ messages in thread
From: Bing Zhao @ 2013-03-16 1:47 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Daniel Drake, Paul Fox, John Rhodes,
Marco Cesarano, Yogesh Powar, Avinash Patil, Amitkumar Karwar,
Nishant Sarmukadam, Frank Huang, Bing Zhao
During rmmod mwifiex_sdio processing FUNC_SHUTDOWN command is
sent to firmware. Firmware expcets only FUNC_INIT once WLAN
function is shut down.
Any command pending in the command queue should be ignored and
freed.
Cc: <stable@vger.kernel.org> # 3.8
Tested-by: Daniel Drake <dsd@laptop.org>
Tested-by: Marco Cesarano <marco@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
---
drivers/net/wireless/mwifiex/cmdevt.c | 17 ++++++++++++++---
1 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index f47ad3a..9a1302b 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -157,6 +157,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
return -1;
}
+ cmd_code = le16_to_cpu(host_cmd->command);
+ cmd_size = le16_to_cpu(host_cmd->size);
+
+ if (adapter->hw_status == MWIFIEX_HW_STATUS_RESET &&
+ cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
+ cmd_code != HostCmd_CMD_FUNC_INIT) {
+ dev_err(adapter->dev,
+ "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
+ cmd_code);
+ mwifiex_complete_cmd(adapter, cmd_node);
+ mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+ return -1;
+ }
+
/* Set command sequence number */
adapter->seq_num++;
host_cmd->seq_num = cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
@@ -168,9 +182,6 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
adapter->curr_cmd = cmd_node;
spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
- cmd_code = le16_to_cpu(host_cmd->command);
- cmd_size = le16_to_cpu(host_cmd->size);
-
/* Adjust skb length */
if (cmd_node->cmd_skb->len > cmd_size)
/*
--
1.7.0.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 3.9 3/3] mwifiex: cancel cmd timer and free curr_cmd in shutdown process
2013-03-16 1:47 [PATCH 3.9 0/3] mwifiex: patchset to fix cmd timeout on XO-4 Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 1/3] mwifiex: fix race when queuing commands Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 2/3] mwifiex: skip pending commands after function shutdown Bing Zhao
@ 2013-03-16 1:47 ` Bing Zhao
2 siblings, 0 replies; 4+ messages in thread
From: Bing Zhao @ 2013-03-16 1:47 UTC (permalink / raw)
To: linux-wireless
Cc: John W. Linville, Daniel Drake, Paul Fox, John Rhodes,
Marco Cesarano, Yogesh Powar, Avinash Patil, Amitkumar Karwar,
Nishant Sarmukadam, Frank Huang, Bing Zhao
curr_cmd points to the command that is in processing or waiting
for its command response from firmware. If the function shutdown
happens to occur at this time we should cancel the cmd timer and
put the command back to free queue.
Cc: <stable@vger.kernel.org> # 3.8
Tested-by: Marco Cesarano <marco@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
---
drivers/net/wireless/mwifiex/init.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index cab3434..daf8801 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -709,6 +709,14 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
return ret;
}
+ /* cancel current command */
+ if (adapter->curr_cmd) {
+ dev_warn(adapter->dev, "curr_cmd is still in processing\n");
+ del_timer(&adapter->cmd_timer);
+ mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+ adapter->curr_cmd = NULL;
+ }
+
/* shut down mwifiex */
dev_dbg(adapter->dev, "info: shutdown mwifiex...\n");
--
1.7.0.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-03-16 1:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-03-16 1:47 [PATCH 3.9 0/3] mwifiex: patchset to fix cmd timeout on XO-4 Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 1/3] mwifiex: fix race when queuing commands Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 2/3] mwifiex: skip pending commands after function shutdown Bing Zhao
2013-03-16 1:47 ` [PATCH 3.9 3/3] mwifiex: cancel cmd timer and free curr_cmd in shutdown process Bing Zhao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.