linux/drivers/net/wireless/mwifiex
Bing Zhao 346ece0b7b mwifiex: fix NULL pointer dereference in usb suspend handler
Bug 60815 - Interface hangs in mwifiex_usb
https://bugzilla.kernel.org/show_bug.cgi?id=60815

[ 2.883807] BUG: unable to handle kernel NULL pointer dereference
            at 0000000000000048
[ 2.883813] IP: [<ffffffff815a65e0>] pfifo_fast_enqueue+0x90/0x90

[ 2.883834] CPU: 1 PID: 3220 Comm: kworker/u8:90 Not tainted
            3.11.1-monotone-l0 #6
[ 2.883834] Hardware name: Microsoft Corporation Surface with
            Windows 8 Pro/Surface with Windows 8 Pro,
            BIOS 1.03.0450 03/29/2013

On Surface Pro, suspend to ram gives a NULL pointer dereference in
pfifo_fast_enqueue(). The stack trace reveals that the offending
call is clearing carrier in mwifiex_usb suspend handler.

Since commit 1499d9f "mwifiex: don't drop carrier flag over suspend"
has removed the carrier flag handling over suspend/resume in SDIO
and PCIe drivers, I'm removing it in USB driver too. This also fixes
the bug for Surface Pro.

Cc: <stable@vger.kernel.org> # 3.5+
Tested-by: Dmitry Khromov <icechrome@gmail.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-09-26 14:02:33 -04:00
..
11ac.c mwifiex: correct bss_mode check while appending vht operation IE 2013-04-22 15:20:28 -04:00
11ac.h mwifiex: add support to configure VHT for AP mode 2013-03-25 16:43:39 -04:00
11h.c mwifiex: add basic 11h support for station 2013-06-19 15:28:33 -04:00
11n_aggr.c mwifiex: fix hang issue for USB chipsets 2013-09-26 14:02:32 -04:00
11n_aggr.h mwifiex: fix hang issue for USB chipsets 2013-09-26 14:02:32 -04:00
11n_rxreorder.c mwifiex: make use of msecs_to_jiffies() 2013-04-22 15:20:28 -04:00
11n_rxreorder.h mwifiex: enhance RX reordering to avoid packet drop during host sleep 2012-09-28 13:54:10 -04:00
11n.c mwifiex: drop gratuitous ARP frames 2013-08-26 14:09:05 -04:00
11n.h mwifiex: add 802.11AC support 2013-02-18 15:30:39 -05:00
cfg80211.c mwifiex: drop gratuitous ARP frames 2013-08-26 14:09:05 -04:00
cfg80211.h mwifiex: support for creation of AP interface 2012-05-16 12:46:34 -04:00
cfp.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2013-08-09 15:06:28 -04:00
cmdevt.c mwifiex: fix PCIe hs_cfg cancel cmd timeout 2013-09-26 14:02:31 -04:00
debugfs.c mwifiex: debugfs: Fix out of bounds array access 2013-06-12 10:20:55 -04:00
decl.h mwifiex: drop gratuitous ARP frames 2013-08-26 14:09:05 -04:00
ethtool.c mwifiex: add "ethtool wol" command support 2013-03-06 16:29:15 -05:00
fw.h mwifiex: fix ext_capab IE structure definition 2013-08-26 14:09:05 -04:00
ie.c mwifiex: remove duplicate structure host_cmd_tlv 2013-07-24 11:02:38 -04:00
init.c mwifiex: drop gratuitous ARP frames 2013-08-26 14:09:05 -04:00
ioctl.h mwifiex: add packet coalesce support 2013-08-09 15:57:51 -04:00
join.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2013-08-09 15:06:28 -04:00
Kconfig mwifiex: add support for Marvell SD8897 chipset 2013-05-22 15:09:14 -04:00
main.c mwifiex: do not create AP and P2P interfaces upon driver loading 2013-08-22 14:30:30 -04:00
main.h mwifiex: add missing endian conversions 2013-08-26 14:10:38 -04:00
Makefile mwifiex: add basic 11h support for station 2013-06-19 15:28:33 -04:00
pcie.c mwifiex: correction in mwifiex_check_fw_status() return status 2013-07-24 11:02:10 -04:00
pcie.h mwifiex: device specific sleep cookie handling for PCIe 2013-02-14 14:24:07 -05:00
README mwifiex: remove max_tx_buf_size 2013-02-01 14:27:23 -05:00
scan.c mwifiex: populate rates in probe request using cfg80211_scan_request 2013-08-01 15:34:35 -04:00
sdio.c mwifiex: add missing endian conversions 2013-08-26 14:10:38 -04:00
sdio.h mwifiex: fix IRQ enable/disable 2013-07-22 16:04:07 -04:00
sta_cmd.c mwifiex: add packet coalesce support 2013-08-09 15:57:51 -04:00
sta_cmdresp.c mwifiex: add missing endian conversions 2013-08-26 14:10:38 -04:00
sta_event.c mwifiex: discard deauth and disassoc event during WPS session 2013-07-24 11:02:06 -04:00
sta_ioctl.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2013-08-09 15:06:28 -04:00
sta_rx.c mwifiex: drop gratuitous ARP frames 2013-08-26 14:09:05 -04:00
sta_tx.c mwifiex: implement cfg80211 mgmt_tx handler 2012-09-28 13:54:03 -04:00
txrx.c mwifiex: Trigger a card reset on reaching tx_timeout threshold 2013-03-08 16:02:48 -05:00
uap_cmd.c mwifiex: remove duplicate structure host_cmd_tlv 2013-07-24 11:02:38 -04:00
uap_event.c mwifiex: add del_station handler 2013-05-22 15:08:54 -04:00
uap_txrx.c mwifiex: delete AP TX queues when bridged packets reach threshold 2013-07-24 11:02:05 -04:00
usb.c mwifiex: fix NULL pointer dereference in usb suspend handler 2013-09-26 14:02:33 -04:00
usb.h mwifiex: add support for Marvell USB8797 chipset 2012-04-23 15:34:08 -04:00
util.c cfg80211: add flags to cfg80211_rx_mgmt() 2013-08-23 16:06:03 +02:00
util.h mwifiex: use pci_alloc/free_consistent APIs for PCIe 2013-01-07 15:18:30 -05:00
wmm.c mwifiex: fix hang issue for USB chipsets 2013-09-26 14:02:32 -04:00
wmm.h mwifiex: replace ra_list_curr by list rotation. 2013-04-23 15:18:40 -04:00

# Copyright (C) 2011, Marvell International Ltd.
#
# This software file (the "File") is distributed by Marvell International
# Ltd. under the terms of the GNU General Public License Version 2, June 1991
# (the "License").  You may use, redistribute and/or modify this File in
# accordance with the terms and conditions of the License, a copy of which
# is available by writing to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
# worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
#
# THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
# IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
# ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
# this warranty disclaimer.


===============================================================================
			U S E R  M A N U A L

1) FOR DRIVER INSTALL

	a) Copy sd8787.bin to /lib/firmware/mrvl/ directory,
	   create the directory if it doesn't exist.
	b) Install WLAN driver,
		insmod mwifiex.ko
	c) Uninstall WLAN driver,
		ifconfig mlanX down
		rmmod mwifiex


2) FOR DRIVER CONFIGURATION AND INFO
	The configurations can be done either using the 'iw' user space
	utility or debugfs.

	a) 'iw' utility commands

	Following are some useful iw commands:-

iw dev mlan0 scan

	This command will trigger a scan.
	The command will then display the scan table entries

iw dev mlan0 connect -w <SSID> [<freq in MHz>] [<bssid>] [key 0:abcde d:1123456789a]
	The above command can be used to connect to an AP with a particular SSID.
	Ap's operating frequency can be specified or even the bssid. If the AP is using
	WEP encryption, wep keys can be specified in the command.
	Note: Every time before connecting to an AP scan command (iw dev mlan0 scan) should be used by user.

iw dev mlan0 disconnect
	This command will be used to disconnect from an AP.


iw dev mlan0 ibss join <SSID> <freq in MHz> [fixed-freq] [fixed-bssid] [key 0:abcde]
	The command will be used to join or create an ibss. Optionally, operating frequency,
	bssid and the security related parameters can be specified while joining/creating
	and ibss.

iw dev mlan0 ibss leave
	The command will be used to leave an ibss network.

iw dev mlan0 link
	The command will be used to get the connection status. The command will return parameters
	such as SSID, operating frequency, rx/tx packets, signal strength, tx bitrate.

	Apart from the iw utility all standard configurations using the 'iwconfig' utility are also supported.

	b) Debugfs interface

	The debugfs interface can be used for configurations and for getting
	some useful information from the driver.
	The section below explains the configurations that can be
	done.

	Mount debugfs to /debugfs mount point:

		mkdir /debugfs
		mount -t debugfs debugfs /debugfs

	The information is provided in /debugfs/mwifiex/mlanX/:

iw reg set <country code>
	The command will be used to change the regulatory domain.

iw reg get
	The command will be used to get current regulatory domain.

info
	This command is used to get driver info.

	Usage:
		cat info

	driver_name = "mwifiex"
	driver_version = <driver_name, driver_version, (firmware_version)>
	interface_name = "mlanX"
	bss_mode = "Ad-hoc" | "Managed" | "Auto" | "Unknown"
	media_state = "Disconnected" | "Connected"
	mac_address = <6-byte adapter MAC address>
	multicase_count = <multicast address count>
	essid = <current SSID>
	bssid = <current BSSID>
	channel = <current channel>
	region_code = <current region code>
	multicasr_address[n] = <multicast address>
	num_tx_bytes = <number of bytes sent to device>
	num_rx_bytes = <number of bytes received from device and sent to kernel>
	num_tx_pkts = <number of packets sent to device>
	num_rx_pkts = <number of packets received from device and sent to kernel>
	num_tx_pkts_dropped = <number of Tx packets dropped by driver>
	num_rx_pkts_dropped = <number of Rx packets dropped by driver>
	num_tx_pkts_err = <number of Tx packets failed to send to device>
	num_rx_pkts_err = <number of Rx packets failed to receive from device>
	carrier "on" | "off"
	tx queue "stopped" | "started"

	The following debug info are provided in /debugfs/mwifiex/mlanX/debug:

	int_counter = <interrupt count, cleared when interrupt handled>
	wmm_ac_vo = <number of packets sent to device from WMM AcVo queue>
	wmm_ac_vi = <number of packets sent to device from WMM AcVi queue>
	wmm_ac_be = <number of packets sent to device from WMM AcBE queue>
	wmm_ac_bk = <number of packets sent to device from WMM AcBK queue>
	tx_buf_size = <current Tx buffer size>
	curr_tx_buf_size = <current Tx buffer size>
	ps_mode = <0/1, CAM mode/PS mode>
	ps_state = <0/1/2/3, full power state/awake state/pre-sleep state/sleep state>
	is_deep_sleep = <0/1, not deep sleep state/deep sleep state>
	wakeup_dev_req = <0/1, wakeup device not required/required>
	wakeup_tries = <wakeup device count, cleared when device awake>
	hs_configured = <0/1, host sleep not configured/configured>
	hs_activated = <0/1, extended host sleep not activated/activated>
	num_tx_timeout = <number of Tx timeout>
	num_cmd_timeout = <number of timeout commands>
	timeout_cmd_id = <command id of the last timeout command>
	timeout_cmd_act = <command action of the last timeout command>
	last_cmd_id = <command id of the last several commands sent to device>
	last_cmd_act = <command action of the last several commands sent to device>
	last_cmd_index = <0 based last command index>
	last_cmd_resp_id = <command id of the last several command responses received from device>
	last_cmd_resp_index = <0 based last command response index>
	last_event = <event id of the last several events received from device>
	last_event_index = <0 based last event index>
	num_cmd_h2c_fail = <number of commands failed to send to device>
	num_cmd_sleep_cfm_fail = <number of sleep confirm failed to send to device>
	num_tx_h2c_fail = <number of data packets failed to send to device>
	num_evt_deauth = <number of deauthenticated events received from device>
	num_evt_disassoc = <number of disassociated events received from device>
	num_evt_link_lost = <number of link lost events received from device>
	num_cmd_deauth = <number of deauthenticate commands sent to device>
	num_cmd_assoc_ok = <number of associate commands with success return>
	num_cmd_assoc_fail = <number of associate commands with failure return>
	cmd_sent = <0/1, send command resources available/sending command to device>
	data_sent = <0/1, send data resources available/sending data to device>
	mp_rd_bitmap = <SDIO multi-port read bitmap>
	mp_wr_bitmap = <SDIO multi-port write bitmap>
	cmd_resp_received = <0/1, no cmd response to process/response received and yet to process>
	event_received = <0/1, no event to process/event received and yet to process>
	cmd_pending = <number of cmd pending>
	tx_pending = <number of Tx packet pending>
	rx_pending = <number of Rx packet pending>


3) FOR DRIVER CONFIGURATION

regrdwr
	This command is used to read/write the adapter register.

	Usage:
		echo " <type> <offset> [value]" > regrdwr
		cat regrdwr

	where the parameters are,
		<type>:     1:MAC/SOC, 2:BBP, 3:RF, 4:PMIC, 5:CAU
		<offset>:   offset of register
		[value]:    value to be written

	Examples:
		echo "1 0xa060" > regrdwr           : Read the MAC register
		echo "1 0xa060 0x12" > regrdwr      : Write the MAC register
		echo "1 0xa794 0x80000000" > regrdwr
		                                    : Write 0x80000000 to MAC register
rdeeprom
	This command is used to read the EEPROM contents of the card.

	Usage:
		echo "<offset> <length>" > rdeeprom
		cat rdeeprom

	where the parameters are,
		<offset>:   multiples of 4
		<length>:   4-20, multiples of 4

	Example:
		echo "0 20" > rdeeprom      : Read 20 bytes of EEPROM data from offset 0

getlog
        This command is used to get the statistics available in the station.
	Usage:

	cat getlog

===============================================================================