[PATCH 0/6] brcmfmac: fixes from Cypress/Infineon

[PATCH 0/6] brcmfmac: fixes from Cypress/Infineon

[Alvin Šipraga]

From: Alvin Šipraga <alsi@bang-olufsen.dk>

We have been using the following patches from Infineon (formerly
Cypress) on our CYW8935-based platform. They originate from the FMAC
driver release packages maintained by Infineon. Please consider these
for inclusion in the mainline as they address genuine issues.

NOTE: I got a checkpatch warning about author/S-o-b mismatch on the
patch from Syed:

    WARNING: From:/Signed-off-by: email address mismatch: 'From: Syed Rafiuddeen <syed.rafiuddeen@cypress.com>' != 'Signed-off-by: Syed Rafiuddeen <syed.rafiuddeen@infineon.com>'

This is a technicality because the company changed its name. I can
re-spin if you want, but I am hesistant to change author/S-o-b of
somebody else, so any alternative suggestions are welcome. Thanks.

Syed Rafiuddeen (1):
  brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211
    layer

Wataru Gohda (2):
  brcmfmac: Fix to add brcmf_clear_assoc_ies when rmmod
  brcmfmac: Fix to add skb free for TIM update info when tx is completed

Wright Feng (3):
  brcmfmac: fix continuous 802.1x tx pending timeout error
  brcmfmac: fix scheduling while atomic issue when deleting flowring
  brcmfmac: fix invalid address access when enabling SCAN log level

 .../broadcom/brcm80211/brcmfmac/bcdc.c        |  3 +--
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    |  8 ++++++
 .../broadcom/brcm80211/brcmfmac/core.c        |  4 ++-
 .../broadcom/brcm80211/brcmfmac/flowring.c    |  5 +---
 .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 16 +++++++-----
 .../broadcom/brcm80211/brcmfmac/fwsignal.h    |  3 ++-
 .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 25 ++++++++++++++++++-
 .../broadcom/brcm80211/brcmfmac/pno.c         | 12 ++++-----
 8 files changed, 55 insertions(+), 21 deletions(-)

-- 
2.37.0

[PATCH 1/6] brcmfmac: fix continuous 802.1x tx pending timeout error

[Alvin Šipraga]

From: Wright Feng <wright.feng@cypress.com>

The race condition in brcmf_msgbuf_txflow and brcmf_msgbuf_delete_flowring
makes tx_msghdr writing after brcmf_msgbuf_remove_flowring. Host
driver should delete flowring after txflow complete and all txstatus back,
or pend_8021x_cnt will never be zero and cause every connection 950
milliseconds(MAX_WAIT_FOR_8021X_TX) delay.

Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
 .../broadcom/brcm80211/brcmfmac/core.c        |  4 +++-
 .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 23 ++++++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 87aef211b35f..8ca259ace001 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1484,8 +1484,10 @@ int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
 				 !brcmf_get_pend_8021x_cnt(ifp),
 				 MAX_WAIT_FOR_8021X_TX);
 
-	if (!err)
+	if (!err) {
 		bphy_err(drvr, "Timed out waiting for no pending 802.1x packets\n");
+		atomic_set(&ifp->pend_8021x_cnt, 0);
+	}
 
 	return !err;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index b2d0f7570aa9..174584b42972 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -71,6 +71,7 @@
 #define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS	32
 #define BRCMF_MSGBUF_UPDATE_RX_PTR_THRS		48
 
+#define BRCMF_MAX_TXSTATUS_WAIT_RETRIES		10
 
 struct msgbuf_common_hdr {
 	u8				msgtype;
@@ -806,8 +807,12 @@ static int brcmf_msgbuf_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
 	flowid = brcmf_flowring_lookup(flow, eh->h_dest, skb->priority, ifidx);
 	if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 		flowid = brcmf_msgbuf_flowring_create(msgbuf, ifidx, skb);
-		if (flowid == BRCMF_FLOWRING_INVALID_ID)
+		if (flowid == BRCMF_FLOWRING_INVALID_ID) {
 			return -ENOMEM;
+		} else {
+			brcmf_flowring_enqueue(flow, flowid, skb);
+			return 0;
+		}
 	}
 	queue_count = brcmf_flowring_enqueue(flow, flowid, skb);
 	force = ((queue_count % BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) == 0);
@@ -1395,9 +1400,25 @@ void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 	struct msgbuf_tx_flowring_delete_req *delete;
 	struct brcmf_commonring *commonring;
+	struct brcmf_commonring *commonring_del;
+
 	void *ret_ptr;
 	u8 ifidx;
 	int err;
+	int retry = BRCMF_MAX_TXSTATUS_WAIT_RETRIES;
+
+	/* wait for commonring txflow finished */
+	commonring_del = msgbuf->flowrings[flowid];
+	brcmf_commonring_lock(commonring_del);
+	while (retry && atomic_read(&commonring_del->outstanding_tx)) {
+		usleep_range(5000, 10000);
+		retry--;
+	}
+	brcmf_commonring_unlock(commonring_del);
+	if (!retry && atomic_read(&commonring_del->outstanding_tx)) {
+		brcmf_err("timed out waiting for txstatus\n");
+		atomic_set(&commonring_del->outstanding_tx, 0);
+	}
 
 	/* no need to submit if firmware can not be reached */
 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
-- 
2.37.0

Re: [1/6] wifi: brcmfmac: fix continuous 802.1x tx pending timeout error

[Kalle Valo]

Alvin Šipraga <alvin@pqrs.dk> wrote:

> From: Wright Feng <wright.feng@cypress.com>
> 
> The race condition in brcmf_msgbuf_txflow and brcmf_msgbuf_delete_flowring
> makes tx_msghdr writing after brcmf_msgbuf_remove_flowring. Host
> driver should delete flowring after txflow complete and all txstatus back,
> or pend_8021x_cnt will never be zero and cause every connection 950
> milliseconds(MAX_WAIT_FOR_8021X_TX) delay.
> 
> Signed-off-by: Wright Feng <wright.feng@cypress.com>
> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>

5 patches applied to wireless-next.git, thanks.

0fa24196e425 wifi: brcmfmac: fix continuous 802.1x tx pending timeout error
09be7546a602 wifi: brcmfmac: fix scheduling while atomic issue when deleting flowring
aa666b68e73f wifi: brcmfmac: fix invalid address access when enabling SCAN log level
5606aeaad01e wifi: brcmfmac: Fix to add brcmf_clear_assoc_ies when rmmod
2eee3db784a0 wifi: brcmfmac: Fix to add skb free for TIM update info when tx is completed

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20220722115632.620681-2-alvin@pqrs.dk/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [1/6] wifi: brcmfmac: fix continuous 802.1x tx pending timeout error

[Alvin Šipraga]

Hi Kalle,

On Wed, Aug 10, 2022 at 05:48:01AM +0000, Kalle Valo wrote:
> Alvin Šipraga <alvin@pqrs.dk> wrote:
> 
> > From: Wright Feng <wright.feng@cypress.com>
> > 
> > The race condition in brcmf_msgbuf_txflow and brcmf_msgbuf_delete_flowring
> > makes tx_msghdr writing after brcmf_msgbuf_remove_flowring. Host
> > driver should delete flowring after txflow complete and all txstatus back,
> > or pend_8021x_cnt will never be zero and cause every connection 950
> > milliseconds(MAX_WAIT_FOR_8021X_TX) delay.
> > 
> > Signed-off-by: Wright Feng <wright.feng@cypress.com>
> > Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
> > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> > Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
> 
> 5 patches applied to wireless-next.git, thanks.
> 
> 0fa24196e425 wifi: brcmfmac: fix continuous 802.1x tx pending timeout error
> 09be7546a602 wifi: brcmfmac: fix scheduling while atomic issue when deleting flowring
> aa666b68e73f wifi: brcmfmac: fix invalid address access when enabling SCAN log level
> 5606aeaad01e wifi: brcmfmac: Fix to add brcmf_clear_assoc_ies when rmmod
> 2eee3db784a0 wifi: brcmfmac: Fix to add skb free for TIM update info when tx is completed

Thanks. Do you mind elaborating on why the 6th patch:

    brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211 layer

was not applied?

Kind regards,
Alvin

Re: [1/6] wifi: brcmfmac: fix continuous 802.1x tx pending timeout error

[Kalle Valo]

Alvin Šipraga <ALSI@bang-olufsen.dk> writes:

> Hi Kalle,
>
> On Wed, Aug 10, 2022 at 05:48:01AM +0000, Kalle Valo wrote:
>> Alvin Šipraga <alvin@pqrs.dk> wrote:
>> 
>> > From: Wright Feng <wright.feng@cypress.com>
>> > 
>> > The race condition in brcmf_msgbuf_txflow and brcmf_msgbuf_delete_flowring
>> > makes tx_msghdr writing after brcmf_msgbuf_remove_flowring. Host
>> > driver should delete flowring after txflow complete and all txstatus back,
>> > or pend_8021x_cnt will never be zero and cause every connection 950
>> > milliseconds(MAX_WAIT_FOR_8021X_TX) delay.
>> > 
>> > Signed-off-by: Wright Feng <wright.feng@cypress.com>
>> > Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
>> > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
>> > Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
>> 
>> 5 patches applied to wireless-next.git, thanks.
>> 
>> 0fa24196e425 wifi: brcmfmac: fix continuous 802.1x tx pending timeout error
>> 09be7546a602 wifi: brcmfmac: fix scheduling while atomic issue when
>> deleting flowring
>> aa666b68e73f wifi: brcmfmac: fix invalid address access when enabling SCAN log level
>> 5606aeaad01e wifi: brcmfmac: Fix to add brcmf_clear_assoc_ies when rmmod
>> 2eee3db784a0 wifi: brcmfmac: Fix to add skb free for TIM update info
>> when tx is completed
>
> Thanks. Do you mind elaborating on why the 6th patch:
>
>     brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211 layer
>
> was not applied?

Because of mismatch between From and s-o-b. I will look at that in
detail after my vacation.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [1/6] wifi: brcmfmac: fix continuous 802.1x tx pending timeout error

[Alvin Šipraga]

On Wed, Aug 17, 2022 at 01:41:47PM +0300, Kalle Valo wrote:
> Alvin Šipraga <ALSI@bang-olufsen.dk> writes:
> 
> > Hi Kalle,
> >
> > On Wed, Aug 10, 2022 at 05:48:01AM +0000, Kalle Valo wrote:
> >> Alvin Šipraga <alvin@pqrs.dk> wrote:
> >> 
> >> > From: Wright Feng <wright.feng@cypress.com>
> >> > 
> >> > The race condition in brcmf_msgbuf_txflow and brcmf_msgbuf_delete_flowring
> >> > makes tx_msghdr writing after brcmf_msgbuf_remove_flowring. Host
> >> > driver should delete flowring after txflow complete and all txstatus back,
> >> > or pend_8021x_cnt will never be zero and cause every connection 950
> >> > milliseconds(MAX_WAIT_FOR_8021X_TX) delay.
> >> > 
> >> > Signed-off-by: Wright Feng <wright.feng@cypress.com>
> >> > Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
> >> > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> >> > Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
> >> 
> >> 5 patches applied to wireless-next.git, thanks.
> >> 
> >> 0fa24196e425 wifi: brcmfmac: fix continuous 802.1x tx pending timeout error
> >> 09be7546a602 wifi: brcmfmac: fix scheduling while atomic issue when
> >> deleting flowring
> >> aa666b68e73f wifi: brcmfmac: fix invalid address access when enabling SCAN log level
> >> 5606aeaad01e wifi: brcmfmac: Fix to add brcmf_clear_assoc_ies when rmmod
> >> 2eee3db784a0 wifi: brcmfmac: Fix to add skb free for TIM update info
> >> when tx is completed
> >
> > Thanks. Do you mind elaborating on why the 6th patch:
> >
> >     brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211 layer
> >
> > was not applied?
> 
> Because of mismatch between From and s-o-b. I will look at that in
> detail after my vacation.

OK, thanks. FYI Syed has left Infineon - not sure what his new email is...

[PATCH 2/6] brcmfmac: fix scheduling while atomic issue when deleting flowring

[Alvin Šipraga]

From: Wright Feng <wright.feng@cypress.com>

We should not sleep while holding the spin lock. It makes
'scheduling while atomic' in brcmf_msgbuf_delete_flowring.
And to avoid race condition between deleting flowring and txflow,
we only hold spin lock when seting flowring status to RING_CLOSING.

Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
 .../broadcom/brcm80211/brcmfmac/flowring.c         |  5 +----
 .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  | 14 ++++++++------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
index 096f6b969dd8..e1127d7e086d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
@@ -419,7 +419,6 @@ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx,
 				flowid = flow->hash[i].flowid;
 				if (flow->rings[flowid]->status != RING_OPEN)
 					continue;
-				flow->rings[flowid]->status = RING_CLOSING;
 				brcmf_msgbuf_delete_flowring(drvr, flowid);
 			}
 		}
@@ -458,10 +457,8 @@ void brcmf_flowring_delete_peer(struct brcmf_flowring *flow, int ifidx,
 		if ((sta || (memcmp(hash[i].mac, peer, ETH_ALEN) == 0)) &&
 		    (hash[i].ifidx == ifidx)) {
 			flowid = flow->hash[i].flowid;
-			if (flow->rings[flowid]->status == RING_OPEN) {
-				flow->rings[flowid]->status = RING_CLOSING;
+			if (flow->rings[flowid]->status == RING_OPEN)
 				brcmf_msgbuf_delete_flowring(drvr, flowid);
-			}
 		}
 	}
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 174584b42972..cec53f934940 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1400,22 +1400,24 @@ void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid)
 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
 	struct msgbuf_tx_flowring_delete_req *delete;
 	struct brcmf_commonring *commonring;
-	struct brcmf_commonring *commonring_del;
-
+	struct brcmf_commonring *commonring_del = msgbuf->flowrings[flowid];
+	struct brcmf_flowring *flow = msgbuf->flow;
 	void *ret_ptr;
 	u8 ifidx;
 	int err;
 	int retry = BRCMF_MAX_TXSTATUS_WAIT_RETRIES;
 
-	/* wait for commonring txflow finished */
-	commonring_del = msgbuf->flowrings[flowid];
+	/* make sure it is not in txflow */
 	brcmf_commonring_lock(commonring_del);
+	flow->rings[flowid]->status = RING_CLOSING;
+	brcmf_commonring_unlock(commonring_del);
+
+	/* wait for commonring txflow finished */
 	while (retry && atomic_read(&commonring_del->outstanding_tx)) {
 		usleep_range(5000, 10000);
 		retry--;
 	}
-	brcmf_commonring_unlock(commonring_del);
-	if (!retry && atomic_read(&commonring_del->outstanding_tx)) {
+	if (!retry) {
 		brcmf_err("timed out waiting for txstatus\n");
 		atomic_set(&commonring_del->outstanding_tx, 0);
 	}
-- 
2.37.0

[PATCH 3/6] brcmfmac: fix invalid address access when enabling SCAN log level

[Alvin Šipraga]

From: Wright Feng <wright.feng@cypress.com>

The variable i is changed when setting random MAC address and causes
invalid address access when printing the value of pi->reqs[i]->reqid.

We replace reqs index with ri to fix the issue.

[  136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
[  136.737365] Mem abort info:
[  136.740172]   ESR = 0x96000004
[  136.743359]   Exception class = DABT (current EL), IL = 32 bits
[  136.749294]   SET = 0, FnV = 0
[  136.752481]   EA = 0, S1PTW = 0
[  136.755635] Data abort info:
[  136.758514]   ISV = 0, ISS = 0x00000004
[  136.762487]   CM = 0, WnR = 0
[  136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000005c4e2577
[  136.772265] [0000000000000000] pgd=0000000000000000
[  136.777160] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[  136.782732] Modules linked in: brcmfmac(O) brcmutil(O) cfg80211(O) compat(O)
[  136.789788] Process wificond (pid: 3175, stack limit = 0x00000000053048fb)
[  136.796664] CPU: 3 PID: 3175 Comm: wificond Tainted: G           O      4.19.42-00001-g531a5f5 #1
[  136.805532] Hardware name: Freescale i.MX8MQ EVK (DT)
[  136.810584] pstate: 60400005 (nZCv daif +PAN -UAO)
[  136.815429] pc : brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac]
[  136.821811] lr : brcmf_pno_config_sched_scans+0x67c/0xa80 [brcmfmac]
[  136.828162] sp : ffff00000e9a3880
[  136.831475] x29: ffff00000e9a3890 x28: ffff800020543400
[  136.836786] x27: ffff8000b1008880 x26: ffff0000012bf6a0
[  136.842098] x25: ffff80002054345c x24: ffff800088d22400
[  136.847409] x23: ffff0000012bf638 x22: ffff0000012bf6d8
[  136.852721] x21: ffff8000aced8fc0 x20: ffff8000ac164400
[  136.858032] x19: ffff00000e9a3946 x18: 0000000000000000
[  136.863343] x17: 0000000000000000 x16: 0000000000000000
[  136.868655] x15: ffff0000093f3b37 x14: 0000000000000050
[  136.873966] x13: 0000000000003135 x12: 0000000000000000
[  136.879277] x11: 0000000000000000 x10: ffff000009a61888
[  136.884589] x9 : 000000000000000f x8 : 0000000000000008
[  136.889900] x7 : 303a32303d726464 x6 : ffff00000a1f957d
[  136.895211] x5 : 0000000000000000 x4 : ffff00000e9a3942
[  136.900523] x3 : 0000000000000000 x2 : ffff0000012cead8
[  136.905834] x1 : ffff0000012bf6d8 x0 : 0000000000000000
[  136.911146] Call trace:
[  136.913623]  brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac]
[  136.919658]  brcmf_pno_start_sched_scan+0xa4/0x118 [brcmfmac]
[  136.925430]  brcmf_cfg80211_sched_scan_start+0x80/0xe0 [brcmfmac]
[  136.931636]  nl80211_start_sched_scan+0x140/0x308 [cfg80211]
[  136.937298]  genl_rcv_msg+0x358/0x3f4
[  136.940960]  netlink_rcv_skb+0xb4/0x118
[  136.944795]  genl_rcv+0x34/0x48
[  136.947935]  netlink_unicast+0x264/0x300
[  136.951856]  netlink_sendmsg+0x2e4/0x33c
[  136.955781]  __sys_sendto+0x120/0x19c

Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
index fabfbb0b40b0..d0a7465be586 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
@@ -158,12 +158,12 @@ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi)
 	struct brcmf_pno_macaddr_le pfn_mac;
 	u8 *mac_addr = NULL;
 	u8 *mac_mask = NULL;
-	int err, i;
+	int err, i, ri;
 
-	for (i = 0; i < pi->n_reqs; i++)
-		if (pi->reqs[i]->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
-			mac_addr = pi->reqs[i]->mac_addr;
-			mac_mask = pi->reqs[i]->mac_addr_mask;
+	for (ri = 0; ri < pi->n_reqs; ri++)
+		if (pi->reqs[ri]->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+			mac_addr = pi->reqs[ri]->mac_addr;
+			mac_mask = pi->reqs[ri]->mac_addr_mask;
 			break;
 		}
 
@@ -185,7 +185,7 @@ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi)
 	pfn_mac.mac[0] |= 0x02;
 
 	brcmf_dbg(SCAN, "enabling random mac: reqid=%llu mac=%pM\n",
-		  pi->reqs[i]->reqid, pfn_mac.mac);
+		  pi->reqs[ri]->reqid, pfn_mac.mac);
 	err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
 				       sizeof(pfn_mac));
 	if (err)
-- 
2.37.0

[PATCH 4/6] brcmfmac: Fix to add brcmf_clear_assoc_ies when rmmod

[Alvin Šipraga]

From: Wataru Gohda <wataru.gohda@cypress.com>

Conn_info->req_ie/resp_ie is used to indicate the assoc_req_ies /
assoc_resp_ies to cfg80211 layer when connection is done. The buffer is
freed and allocated again at next connection establishment. The buffers
also needs to be freed at the timing of rmmod as well.

Signed-off-by: Wataru Gohda <wataru.gohda@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 605206abe424..6ef574d69755 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6429,6 +6429,7 @@ static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
 	cfg->dongle_up = false;	/* dongle down */
 	brcmf_abort_scanning(cfg);
 	brcmf_deinit_priv_mem(cfg);
+	brcmf_clear_assoc_ies(cfg);
 }
 
 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
-- 
2.37.0

[PATCH 5/6] brcmfmac: Fix to add skb free for TIM update info when tx is completed

[Alvin Šipraga]

From: Wataru Gohda <wataru.gohda@cypress.com>

The skb will be allocated to send TIM update info in brcmf_fws_tim_update.
Currently the skb will be freed when tx is failed but it will not be freed
when tx is completed successfully. The fix is to free the skb when tx is
completed always.

Signed-off-by: Wataru Gohda <wataru.gohda@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
 .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  |  3 +--
 .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++++++++------
 .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 ++-
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
index 2c95a08a5871..02a56edf08ba 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
@@ -368,8 +368,7 @@ brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
 
 	/* await txstatus signal for firmware if active */
 	if (brcmf_fws_fc_active(bcdc->fws)) {
-		if (!success)
-			brcmf_fws_bustxfail(bcdc->fws, txp);
+		brcmf_fws_bustxcomplete(bcdc->fws, txp, success);
 	} else {
 		if (brcmf_proto_bcdc_hdrpull(bus_if->drvr, false, txp, &ifp))
 			brcmu_pkt_buf_free_skb(txp);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
index d58525ebe618..85e3b953b0a9 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
@@ -2475,7 +2475,8 @@ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
 	return fws->fcmode != BRCMF_FWS_FCMODE_NONE;
 }
 
-void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
+void brcmf_fws_bustxcomplete(struct brcmf_fws_info *fws, struct sk_buff *skb,
+			     bool success)
 {
 	u32 hslot;
 
@@ -2483,11 +2484,14 @@ void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
 		brcmu_pkt_buf_free_skb(skb);
 		return;
 	}
-	brcmf_fws_lock(fws);
-	hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
-	brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0,
-			      1);
-	brcmf_fws_unlock(fws);
+
+	if (!success) {
+		brcmf_fws_lock(fws);
+		hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+		brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot,
+				      0, 0, 1);
+		brcmf_fws_unlock(fws);
+	}
 }
 
 void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
index b16a9d1c0508..f9c36cd8f1de 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
@@ -40,7 +40,8 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb);
 void brcmf_fws_reset_interface(struct brcmf_if *ifp);
 void brcmf_fws_add_interface(struct brcmf_if *ifp);
 void brcmf_fws_del_interface(struct brcmf_if *ifp);
-void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb);
+void brcmf_fws_bustxcomplete(struct brcmf_fws_info *fws, struct sk_buff *skb,
+			     bool success);
 void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked);
 void brcmf_fws_rxreorder(struct brcmf_if *ifp, struct sk_buff *skb);
 
-- 
2.37.0

[PATCH 6/6] brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211 layer

[Alvin Šipraga]

From: Syed Rafiuddeen <syed.rafiuddeen@cypress.com>

cfg80211 layer on DUT STA is disconnecting ongoing connection attempt after
receiving association response, because cfg80211 layer does not have valid
AP bss information. On association response event, brcmfmac communicates
the AP bss information to cfg80211 layer, but SSID seem to be empty in AP
bss information, and cfg80211 layer prints kernel warning and then
disconnects the ongoing connection attempt.

SSID is empty in SSID IE, but 'bi->SSID' contains a valid SSID, so
updating the SSID for hidden AP while informing its bss information
to cfg80211 layer.

Signed-off-by: Syed Rafiuddeen <syed.rafiuddeen@infineon.com>
Signed-off-by: Chung-Hsien Hsu <chung-hsien.hsu@infineon.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@infineon.com>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 6ef574d69755..d6127b855060 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -2989,6 +2989,7 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
 	u8 *notify_ie;
 	size_t notify_ielen;
 	struct cfg80211_inform_bss bss_data = {};
+	const struct brcmf_tlv *ssid = NULL;
 
 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
 		bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
@@ -3018,6 +3019,12 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
 	notify_ielen = le32_to_cpu(bi->ie_length);
 	bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
 
+	ssid = brcmf_parse_tlvs(notify_ie, notify_ielen, WLAN_EID_SSID);
+	if (ssid && ssid->data[0] == '\0' && ssid->len == bi->SSID_len) {
+		/* Update SSID for hidden AP */
+		memcpy((u8 *)ssid->data, bi->SSID, bi->SSID_len);
+	}
+
 	brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
 	brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
 	brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
-- 
2.37.0

Re: [PATCH 6/6] brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211 layer

[Kalle Valo]

Alvin Šipraga <alvin@pqrs.dk> writes:

> From: Syed Rafiuddeen <syed.rafiuddeen@cypress.com>
>
> cfg80211 layer on DUT STA is disconnecting ongoing connection attempt after
> receiving association response, because cfg80211 layer does not have valid
> AP bss information. On association response event, brcmfmac communicates
> the AP bss information to cfg80211 layer, but SSID seem to be empty in AP
> bss information, and cfg80211 layer prints kernel warning and then
> disconnects the ongoing connection attempt.
>
> SSID is empty in SSID IE, but 'bi->SSID' contains a valid SSID, so
> updating the SSID for hidden AP while informing its bss information
> to cfg80211 layer.
>
> Signed-off-by: Syed Rafiuddeen <syed.rafiuddeen@infineon.com>
> Signed-off-by: Chung-Hsien Hsu <chung-hsien.hsu@infineon.com>
> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@infineon.com>
> Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>

Infineon now submitted the same patch, I'll continue the review there:

https://patchwork.kernel.org/project/linux-wireless/patch/20220914033620.12742-5-ian.lin@infineon.com/

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 6/6] brcmfmac: Update SSID of hidden AP while informing its bss to cfg80211 layer

[Kalle Valo]

Alvin Šipraga <alvin@pqrs.dk> writes:

> From: Syed Rafiuddeen <syed.rafiuddeen@cypress.com>
>
> cfg80211 layer on DUT STA is disconnecting ongoing connection attempt after
> receiving association response, because cfg80211 layer does not have valid
> AP bss information. On association response event, brcmfmac communicates
> the AP bss information to cfg80211 layer, but SSID seem to be empty in AP
> bss information, and cfg80211 layer prints kernel warning and then
> disconnects the ongoing connection attempt.
>
> SSID is empty in SSID IE, but 'bi->SSID' contains a valid SSID, so
> updating the SSID for hidden AP while informing its bss information
> to cfg80211 layer.
>
> Signed-off-by: Syed Rafiuddeen <syed.rafiuddeen@infineon.com>

Syed's email address in From and s-o-b doesn't match.

> @@ -3018,6 +3019,12 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
>  	notify_ielen = le32_to_cpu(bi->ie_length);
>  	bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
>  
> +	ssid = brcmf_parse_tlvs(notify_ie, notify_ielen, WLAN_EID_SSID);
> +	if (ssid && ssid->data[0] == '\0' && ssid->len == bi->SSID_len) {
> +		/* Update SSID for hidden AP */
> +		memcpy((u8 *)ssid->data, bi->SSID, bi->SSID_len);
> +	}

memcpy() takes a void pointer so the cast is not needed.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches