Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 test0r
|
f12e870025 | ||
|
test0r
|
822a5f1bab | ||
|
test0r
|
c57c77e446 | ||
|
test0r
|
db4ea70fb5 |
@@ -511,9 +511,6 @@ struct bes2600_common {
|
||||
struct list_head coex_event_list;
|
||||
spinlock_t coex_event_lock;
|
||||
|
||||
/* Connection-loss-storm fast-recover (Trigger A). See sta.c. */
|
||||
struct work_struct connection_loss_storm_recover_work;
|
||||
|
||||
/* member for low power */
|
||||
struct bes2600_pwr_t bes_power;
|
||||
|
||||
@@ -599,11 +596,6 @@ struct bes2600_vif {
|
||||
unsigned long rx_timestamp;
|
||||
u32 cipherType;
|
||||
|
||||
/* Decrypt-storm fast-recover (Trigger B). See txrx.c. */
|
||||
unsigned long decrypt_storm_window_start;
|
||||
unsigned int decrypt_storm_count;
|
||||
unsigned int decrypt_storm_recoveries;
|
||||
struct work_struct decrypt_storm_recover_work;
|
||||
|
||||
/* AP powersave */
|
||||
u32 link_id_map;
|
||||
@@ -630,10 +622,6 @@ struct bes2600_vif {
|
||||
/* CQM Implementation */
|
||||
struct delayed_work bss_loss_work;
|
||||
struct delayed_work connection_loss_work;
|
||||
/* Connection-loss-storm fast-recover (Trigger A). See sta.c. */
|
||||
unsigned long connection_loss_storm_window_start;
|
||||
unsigned int connection_loss_storm_count;
|
||||
unsigned int connection_loss_storm_recoveries;
|
||||
struct work_struct tx_failure_work;
|
||||
int delayed_link_loss;
|
||||
spinlock_t bss_loss_lock;
|
||||
@@ -868,13 +856,4 @@ int bes2600_btusb_setup_pipes(struct sbus_priv *sbus_priv);
|
||||
void bes2600_btusb_uninit(struct usb_interface *interface);
|
||||
#endif
|
||||
|
||||
/* Decrypt-storm fast-recover helpers — see txrx.c. */
|
||||
void bes2600_decrypt_storm_init(struct bes2600_vif *priv);
|
||||
void bes2600_decrypt_storm_account(struct bes2600_vif *priv);
|
||||
|
||||
/* Connection-loss-storm fast-recover helpers — see sta.c. */
|
||||
void bes2600_connection_loss_storm_init(struct bes2600_vif *priv);
|
||||
bool bes2600_connection_loss_storm_account(struct bes2600_vif *priv);
|
||||
void bes2600_connection_loss_storm_recover(struct work_struct *work);
|
||||
|
||||
#endif /* BES2600_H */
|
||||
|
||||
+9
-79
@@ -16,7 +16,6 @@
|
||||
#include <linux/mmc/host.h>
|
||||
#include <linux/mmc/sdio_func.h>
|
||||
#include <linux/mmc/card.h>
|
||||
#include <linux/mmc/core.h>
|
||||
#include <linux/mmc/sdio.h>
|
||||
#include <linux/spinlock.h>
|
||||
#include <net/mac80211.h>
|
||||
@@ -29,7 +28,6 @@
|
||||
#include <linux/of_gpio.h>
|
||||
|
||||
#include "bes2600.h"
|
||||
#include "bh.h"
|
||||
#include "sbus.h"
|
||||
#include "bes2600_plat.h"
|
||||
#include "bes2600_factory.h"
|
||||
@@ -813,23 +811,10 @@ static int bes2600_sdio_extract_packets(struct sbus_priv *self, u32 ctrl_reg, u8
|
||||
skb_put(skb, packet_len);
|
||||
memcpy(skb->data, &data[pos], packet_len);
|
||||
bes_devel("%s, %d,%d\n", __func__, packet_len, pos);
|
||||
spin_lock(&self->rx_queue_lock);
|
||||
skb_queue_tail(&self->rx_queue, skb);
|
||||
self->rx_data_cnt++;
|
||||
/*
|
||||
* Patch C: deliver SKB directly into the WSM/mac80211 stack
|
||||
* instead of skb_queue_tail-ing onto self->rx_queue for later
|
||||
* pickup by the bh thread. Removes two spinlock acquires
|
||||
* (rx_queue->lock at queue-tail + at dequeue) per RX frame
|
||||
* and one bh wait-queue wake-up per IRQ batch.
|
||||
*
|
||||
* bes2600_bh_handle_rx_skb owns the SKB on every path.
|
||||
* Contract: process context, sleepable, caller holds no
|
||||
* bes2600 spinlock. See bh.c for the contract block.
|
||||
*
|
||||
* Pre-condition satisfied here: bes2600_sdio_unlock(self)
|
||||
* was called at the bottom of the SDIO read sequence in
|
||||
* sdio_rx_work, so we hold no bes2600 mutex either.
|
||||
*/
|
||||
bes2600_bh_handle_rx_skb(self->core, skb);
|
||||
spin_unlock(&self->rx_queue_lock);
|
||||
packet_len = (packet_len + 3) & (~0x3);
|
||||
pos += packet_len;
|
||||
#ifdef BES_SDIO_OPTIMIZED_LEN
|
||||
@@ -912,17 +897,12 @@ static void sdio_rx_work(struct work_struct *work)
|
||||
|
||||
ctrl_reg = 0;
|
||||
|
||||
/*
|
||||
* Patch C: with direct delivery in extract_packets, the bh
|
||||
* thread no longer drives RX consumption — there is no
|
||||
* rx_queue to drain. Calling self->irq_handler() here would
|
||||
* wake the bh thread for nothing on every IRQ batch. TX
|
||||
* wakes still flow through bes2600_bh_wakeup() from TX
|
||||
* submitters and from bes2600_bh_handle_rx_skb when a
|
||||
* confirm releases a TX buffer; early-boot IRQs (before
|
||||
* fw_started) still go through self->irq_handler from the
|
||||
* GPIO IRQ handler's fallback branch.
|
||||
*/
|
||||
if (likely(self->irq_handler)) {
|
||||
self->irq_handler(self->irq_priv);
|
||||
} else {
|
||||
bes_err("%s,%d\n", __func__, __LINE__);
|
||||
goto failed;
|
||||
}
|
||||
|
||||
} while (again);
|
||||
|
||||
@@ -1808,55 +1788,6 @@ static void bes2600_sdio_halt_device(struct sbus_priv *self)
|
||||
sdio_work_debug(self);
|
||||
}
|
||||
|
||||
/*
|
||||
* Trigger an SDIO bus reset via mmc_hw_reset().
|
||||
*
|
||||
* With multiple SDIO functions probed (PineTab2 binds func 1 for WLAN and
|
||||
* func 2 for the BT-companion path) mmc_sdio_hw_reset() takes the
|
||||
* remove-and-rescan path: it marks the card removed and schedules
|
||||
* mmc_rescan, which tears down the bound function drivers and re-detects
|
||||
* the card on the next sweep, in turn reinvoking bes2600_sdio_probe().
|
||||
*
|
||||
* With a single function probed it instead invokes mmc_power_cycle()
|
||||
* directly, which on PineTab2 toggles the wifi-reset GPIO via sdio_pwrseq.
|
||||
*
|
||||
* In both cases the chip ends up in a freshly reset state, which is the
|
||||
* goal of the recovery path.
|
||||
*
|
||||
* mmc_hw_reset() must be called without holding the SDIO host claim --
|
||||
* the multi-func remove-and-rescan path acquires the host claim via the
|
||||
* mmc workqueue.
|
||||
*/
|
||||
static int bes2600_sdio_bus_reset(struct sbus_priv *self)
|
||||
{
|
||||
struct mmc_host *host;
|
||||
int ret;
|
||||
|
||||
if (!self || !self->func || !self->func->card)
|
||||
return -EINVAL;
|
||||
|
||||
host = self->func->card->host;
|
||||
ret = mmc_hw_reset(self->func->card);
|
||||
|
||||
/*
|
||||
* On multi-function SDIO cards (BES2600 has WLAN func 1 + BT
|
||||
* companion func 2), mmc_sdio_hw_reset() removes the card and
|
||||
* returns 1 to signal "remove happened, caller must trigger
|
||||
* rescan". The kernel does NOT auto-rescan in this case;
|
||||
* single-function cards take the rescan path inline and return 0.
|
||||
* Treat any non-negative return as success and force a rescan if
|
||||
* mmc_hw_reset signalled the multi-function path - otherwise the
|
||||
* card stays removed indefinitely after a wedge recovery,
|
||||
* leaving wifi (and the BT companion) silent until reboot.
|
||||
*/
|
||||
if (ret > 0) {
|
||||
bes_info("multi-func mmc_hw_reset removed card; scheduling rescan\n");
|
||||
mmc_detect_change(host, 0);
|
||||
ret = 0;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static bool bes2600_sdio_wakeup_source(struct sbus_priv *self)
|
||||
{
|
||||
struct bes2600_platform_data_sdio *pdata = bes2600_get_platform_data();
|
||||
@@ -1895,7 +1826,6 @@ static struct sbus_ops bes2600_sdio_sbus_ops = {
|
||||
.gpio_sleep = bes2600_gpio_allow_mcu_sleep,
|
||||
.halt_device = bes2600_sdio_halt_device,
|
||||
.wakeup_source = bes2600_sdio_wakeup_source,
|
||||
.bus_reset = bes2600_sdio_bus_reset,
|
||||
};
|
||||
|
||||
static void bes2600_sdio_en_lp_cb(struct bes2600_common *hw_priv)
|
||||
|
||||
+2
-69
@@ -442,60 +442,6 @@ int bes2600_chrdev_do_system_close(const struct sbus_ops *sbus_ops, struct sbus_
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Hard-reset the bus and wait for the bus core to remove the chip.
|
||||
*
|
||||
* Used by the firmware-wedge recovery path on platforms where the normal
|
||||
* power_switch(0) sequence has no effective chip-reset signal. The bus
|
||||
* implementation triggers an asynchronous re-detect; this helper waits for
|
||||
* the resulting remove() callback to clear bes2600_cdev.sbus_priv so that a
|
||||
* subsequent bes2600_switch_wifi(true) sees a clean state and can wait on
|
||||
* the fresh probe.
|
||||
*/
|
||||
int bes2600_chrdev_do_bus_reset(const struct sbus_ops *sbus_ops, struct sbus_priv *priv)
|
||||
{
|
||||
int ret;
|
||||
long status;
|
||||
|
||||
if (!sbus_ops || !priv)
|
||||
return -EINVAL;
|
||||
|
||||
if (!sbus_ops->bus_reset)
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
bes_info("trigger bus reset to recover wedged firmware.\n");
|
||||
|
||||
ret = sbus_ops->bus_reset(priv);
|
||||
if (ret) {
|
||||
bes_err("bus_reset failed: %d\n", ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* The bus reset is asynchronous: the bus core schedules a rescan
|
||||
* which removes the bound function drivers and then re-detects the
|
||||
* chip. Wait for the remove callback to clear sbus_priv. Do not
|
||||
* dereference 'priv' after this point -- it may already be freed.
|
||||
*/
|
||||
status = wait_event_timeout(bes2600_cdev.probe_done_wq,
|
||||
!bes2600_cdev.sbus_priv, HZ * 3);
|
||||
WARN_ON(status <= 0);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Trigger bes2600_chrdev_do_bus_reset() against the file-global
|
||||
* bes2600_cdev. Used by host-side recovery paths outside this
|
||||
* compilation unit (e.g. sta.c connection-loss-storm fast-recover) so
|
||||
* those callers do not need to reach the static bes2600_cdev directly.
|
||||
*/
|
||||
int bes2600_chrdev_trigger_bus_reset(void)
|
||||
{
|
||||
return bes2600_chrdev_do_bus_reset(bes2600_cdev.sbus_ops,
|
||||
bes2600_cdev.sbus_priv);
|
||||
}
|
||||
|
||||
bool bes2600_chrdev_is_wifi_opened(void)
|
||||
{
|
||||
bool wifi_opened = false;
|
||||
@@ -594,21 +540,8 @@ static void bes2600_chrdev_wifi_force_close_work(struct work_struct *work)
|
||||
/* unregister wifi */
|
||||
bes2600_switch_wifi(0);
|
||||
|
||||
/*
|
||||
* Hard exception with a bus_reset implementation: tear the
|
||||
* bus down via mmc_hw_reset() (or equivalent) so the next
|
||||
* bringup probes a freshly reset chip. On PineTab2 this is
|
||||
* the only effective recovery path -- the existing
|
||||
* power_switch(0)/(1) sequence has no chip-reset signal of
|
||||
* its own (sdio_pwrseq owns wifi_reset).
|
||||
*
|
||||
* Soft close, or hard close on a board without bus_reset:
|
||||
* fall back to the legacy power_switch(0) sequence.
|
||||
*/
|
||||
if (bes2600_cdev.halt_dev && bes2600_cdev.sbus_ops->bus_reset) {
|
||||
bes2600_chrdev_do_bus_reset(bes2600_cdev.sbus_ops,
|
||||
bes2600_cdev.sbus_priv);
|
||||
} else if (bes2600_chrdev_check_system_close()) {
|
||||
/* power down device if wifi is only opened */
|
||||
if (bes2600_chrdev_check_system_close()) {
|
||||
bes2600_chrdev_do_system_close(bes2600_cdev.sbus_ops,
|
||||
bes2600_cdev.sbus_priv);
|
||||
}
|
||||
|
||||
@@ -60,8 +60,6 @@ struct sbus_priv *bes2600_chrdev_get_sbus_priv_data(void);
|
||||
/* used to control device power down */
|
||||
int bes2600_chrdev_check_system_close(void);
|
||||
int bes2600_chrdev_do_system_close(const struct sbus_ops *sbus_ops, struct sbus_priv *priv);
|
||||
int bes2600_chrdev_do_bus_reset(const struct sbus_ops *sbus_ops, struct sbus_priv *priv);
|
||||
int bes2600_chrdev_trigger_bus_reset(void);
|
||||
void bes2600_chrdev_wakeup_bt(void);
|
||||
void bes2600_chrdev_wifi_force_close(struct bes2600_common *hw_priv, bool halt_dev);
|
||||
void bes2600_chrdev_usb_remove(struct bes2600_common *hw_priv);
|
||||
|
||||
-109
@@ -958,115 +958,6 @@ static void bes2600_bh_parse_wakeup_event(struct bes2600_common *hw_priv, struct
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Direct-deliver an RX SKB into the WSM/mac80211 stack.
|
||||
*
|
||||
* Patch C (sdio_rx_work direct delivery): this function does the
|
||||
* per-SKB bookkeeping (sequence-number check, exception handling,
|
||||
* tx-confirm accounting, mac80211 hand-off via wsm_handle_rx) that
|
||||
* previously ran inside bes2600_bh_rx_helper after pipe_read dequeued
|
||||
* an SKB from sbus_priv->rx_queue. It is now called inline from
|
||||
* bes2600_sdio_extract_packets, eliminating the queue + bh-wakeup
|
||||
* relay (one wait-queue wake-up + two rx_queue->lock acquires per
|
||||
* RX frame).
|
||||
*
|
||||
* Contract:
|
||||
* - process context, sleepable. wsm_handle_rx (wsm.c:2211, exported
|
||||
* at wsm.c:2463) acquires wsm_cmd.lock, may call into mac80211
|
||||
* and may sleep on wait_event_timeout (wsm.c:2036, 2091).
|
||||
* - caller MUST hold no bes2600 spinlock. Reference precedent:
|
||||
* bes2600_bh_rx_helper (this file) called from the bh thread.
|
||||
* The SDIO mutex is released at bes2600_sdio.c before
|
||||
* extract_packets is called, so this is satisfied.
|
||||
* - SKB ownership: function frees on every path (success and error).
|
||||
* - Returns 0 on success, negative on error. When the SKB carries
|
||||
* a confirm that releases a TX buffer, the function asynchronously
|
||||
* wakes the bh thread to drain TX (matches the in-bh tx=1
|
||||
* signaling that bh_rx_helper used).
|
||||
*/
|
||||
int bes2600_bh_handle_rx_skb(struct bes2600_common *priv, struct sk_buff *skb)
|
||||
{
|
||||
struct wsm_hdr *wsm;
|
||||
size_t wsm_len;
|
||||
u16 wsm_id;
|
||||
u8 wsm_seq;
|
||||
int tx = 0;
|
||||
u32 confirm_label = 0x0;
|
||||
|
||||
if (!skb)
|
||||
return 0;
|
||||
|
||||
wsm = (struct wsm_hdr *)skb->data;
|
||||
wsm_len = __le16_to_cpu(wsm->len);
|
||||
if (WARN_ON(wsm_len > skb->len)) {
|
||||
bes_err("wsm_len err %d %d\n", (int)wsm_len, (int)skb->len);
|
||||
dev_kfree_skb(skb);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (priv->wsm_enable_wsm_dumps)
|
||||
print_hex_dump(KERN_DEBUG, "<-- ", DUMP_PREFIX_NONE, 16, 1,
|
||||
skb->data, wsm_len, false);
|
||||
|
||||
wsm_id = __le16_to_cpu(wsm->id) & 0xFFF;
|
||||
wsm_seq = (__le16_to_cpu(wsm->id) >> 13) & 7;
|
||||
bes_devel("bes2600_bh_handle_rx_skb wsm_id:0x%04x seq:%d\n",
|
||||
wsm_id, wsm_seq);
|
||||
|
||||
skb_trim(skb, wsm_len);
|
||||
|
||||
if (wsm_id == 0x0800) {
|
||||
wsm_handle_exception(priv,
|
||||
&skb->data[sizeof(*wsm)],
|
||||
wsm_len - sizeof(*wsm));
|
||||
bes_err("wsm exception\n");
|
||||
dev_kfree_skb(skb);
|
||||
return -1;
|
||||
} else if ((wsm_seq != priv->wsm_rx_seq[WSM_TXRX_SEQ_IDX(wsm_id)])) {
|
||||
bes_err("seq error! %u. %u. 0x%x.", wsm_seq,
|
||||
priv->wsm_rx_seq[WSM_TXRX_SEQ_IDX(wsm_id)], wsm_id);
|
||||
dev_kfree_skb(skb);
|
||||
return -1;
|
||||
}
|
||||
|
||||
bes2600_bh_parse_wakeup_event(priv, skb);
|
||||
|
||||
priv->wsm_rx_seq[WSM_TXRX_SEQ_IDX(wsm_id)] = (wsm_seq + 1) & 7;
|
||||
|
||||
if (IS_DRIVER_TO_MCU_CMD(wsm_id))
|
||||
confirm_label = __le32_to_cpu(((struct wsm_mcu_hdr *)wsm)->handle_label);
|
||||
|
||||
if (WSM_CONFIRM_CONDITION(wsm_id, confirm_label)) {
|
||||
int rc = wsm_release_tx_buffer(priv, 1);
|
||||
bes2600_bh_dec_pending_count(priv, WSM_TXRX_SEQ_IDX(wsm->id));
|
||||
|
||||
if (rc < 0) {
|
||||
bes_err("wsm_release_tx_buffer failed: %d\n", rc);
|
||||
dev_kfree_skb(skb);
|
||||
return rc;
|
||||
} else if (rc > 0) {
|
||||
tx = 1;
|
||||
}
|
||||
}
|
||||
|
||||
/* wsm_handle_rx takes care of SKB lifetime: zeroes *skb_p if consumed. */
|
||||
if (wsm_handle_rx(priv, wsm_id, wsm, &skb)) {
|
||||
bes_err("wsm_handle_rx failed (id=0x%04x)\n", wsm_id);
|
||||
if (skb)
|
||||
dev_kfree_skb(skb);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (skb)
|
||||
dev_kfree_skb(skb);
|
||||
|
||||
if (tx)
|
||||
bes2600_bh_wakeup(priv);
|
||||
|
||||
return 0;
|
||||
}
|
||||
EXPORT_SYMBOL(bes2600_bh_handle_rx_skb);
|
||||
|
||||
static int bes2600_bh_rx_helper(struct bes2600_common *priv, int *tx)
|
||||
{
|
||||
struct sk_buff *skb = NULL;
|
||||
|
||||
@@ -36,13 +36,6 @@ void bes2600_enable_powersave(struct bes2600_vif *priv,
|
||||
int wsm_release_tx_buffer(struct bes2600_common *hw_priv, int count);
|
||||
int wsm_release_vif_tx_buffer(struct bes2600_common *hw_priv, int if_id,
|
||||
int count);
|
||||
/*
|
||||
* Direct-deliver an RX SKB into the WSM/mac80211 stack.
|
||||
* Process context, sleepable, caller holds no bes2600 spinlock.
|
||||
* Function frees skb on every path. See bh.c for full contract.
|
||||
*/
|
||||
int bes2600_bh_handle_rx_skb(struct bes2600_common *hw_priv,
|
||||
struct sk_buff *skb);
|
||||
int bes2600_bh_sw_process(struct bes2600_common *hw_priv,
|
||||
struct wsm_tx_confirm *tx_confirm);
|
||||
|
||||
|
||||
@@ -542,10 +542,6 @@ static int bes2600_status_show_priv(struct seq_file *seq, void *v)
|
||||
priv->listening ? " (listening)" : "");
|
||||
seq_printf(seq, "Assoc: %s\n",
|
||||
bes2600_debug_join_status[priv->join_status]);
|
||||
seq_printf(seq, "DecryptStormRecoveries: %u\n",
|
||||
priv->decrypt_storm_recoveries);
|
||||
seq_printf(seq, "ConnectionLossStormRecoveries: %u\n",
|
||||
priv->connection_loss_storm_recoveries);
|
||||
if (priv->rx_filter.promiscuous)
|
||||
seq_puts(seq, "Filter: promisc\n");
|
||||
else if (priv->rx_filter.fcs)
|
||||
|
||||
@@ -484,8 +484,6 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len)
|
||||
spin_lock_init(&hw_priv->rtsvalue_lock);
|
||||
INIT_WORK(&hw_priv->dynamic_opt_txrx_work, bes2600_dynamic_opt_txrx_work);
|
||||
INIT_WORK(&hw_priv->tx_policy_upload_work, tx_policy_upload_work);
|
||||
INIT_WORK(&hw_priv->connection_loss_storm_recover_work,
|
||||
bes2600_connection_loss_storm_recover);
|
||||
spin_lock_init(&hw_priv->event_queue_lock);
|
||||
INIT_LIST_HEAD(&hw_priv->event_queue);
|
||||
INIT_WORK(&hw_priv->event_handler, bes2600_event_handler);
|
||||
|
||||
@@ -75,14 +75,6 @@ struct sbus_ops {
|
||||
void (*halt_device)(struct sbus_priv *self);
|
||||
bool (*wakeup_source)(struct sbus_priv *self);
|
||||
int (*reboot)(struct sbus_priv *self);
|
||||
/*
|
||||
* Force the host bus to re-detect and re-probe the chip. Called
|
||||
* from the firmware-wedge recovery path when power_switch() has no
|
||||
* effective chip-reset signal of its own (e.g. PineTab2, where the
|
||||
* wifi-reset GPIO is owned by sdio_pwrseq, not the bes2600 node).
|
||||
* Returns 0 on success or a negative errno.
|
||||
*/
|
||||
int (*bus_reset)(struct sbus_priv *self);
|
||||
};
|
||||
|
||||
void bes2600_irq_handler(struct bes2600_common *priv);
|
||||
|
||||
+2
-82
@@ -266,7 +266,6 @@ void bes2600_stop(struct ieee80211_hw *dev, bool suspend)
|
||||
cancel_work_sync(&hw_priv->coex_work);
|
||||
coex_stop(hw_priv);
|
||||
#endif
|
||||
cancel_work_sync(&hw_priv->connection_loss_storm_recover_work);
|
||||
|
||||
bes2600_wifi_stop(hw_priv);
|
||||
|
||||
@@ -449,7 +448,6 @@ void bes2600_remove_interface(struct ieee80211_hw *dev,
|
||||
cancel_delayed_work_sync(&priv->join_timeout);
|
||||
cancel_delayed_work_sync(&priv->set_cts_work);
|
||||
cancel_delayed_work_sync(&priv->pending_offchanneltx_work);
|
||||
cancel_work_sync(&priv->decrypt_storm_recover_work);
|
||||
|
||||
del_timer_sync(&priv->mcast_timeout);
|
||||
/* TODO:COMBO: May be reset of these variables "delayed_link_loss and
|
||||
@@ -1660,70 +1658,6 @@ report:
|
||||
spin_unlock(&priv->bss_loss_lock);
|
||||
}
|
||||
|
||||
/*
|
||||
* Connection-loss-storm fast-recover (Trigger A).
|
||||
*
|
||||
* bes2600_connection_loss_work below is the driver's own decision-point
|
||||
* to give up on a BSS (after bss-loss detection accumulates beyond
|
||||
* tolerance) and tell mac80211 via ieee80211_connection_loss(). On the
|
||||
* deployed pinetab2 stack a single ieee80211_connection_loss() event
|
||||
* sometimes triggers a userspace reauth blackhole (assoc-comeback
|
||||
* timeouts followed by AP unprotected-deauth-reason-6) that ends only
|
||||
* via cross-channel/cross-SSID fallback and can take 80+ s. Receipts at
|
||||
* https://git.reauktion.de/marfrit/besser, notes/phase4-2026-05-07.md.
|
||||
*
|
||||
* When N connection-loss decisions land within WINDOW on the same vif,
|
||||
* skip the ieee80211_connection_loss() path and trigger a chip-level
|
||||
* bus_reset (the c5.2-introduced bes2600_chrdev_do_bus_reset). The chip
|
||||
* is removed and re-probed; userspace re-associates from a fresh state,
|
||||
* dodging the assoc-comeback loop.
|
||||
*
|
||||
* Threshold (3 / 60 s) is chosen well above the steady-state per-vif
|
||||
* connection-loss rate observed in the patch-A Phase-7 rep
|
||||
* (0.86/h under sustained load), so a true storm is required.
|
||||
*
|
||||
* The recover work_struct lives on bes2600_common (hw_priv) so that
|
||||
* scheduling it does not race with vif teardown after bus_reset frees
|
||||
* the per-vif state.
|
||||
*/
|
||||
#define BES2600_CONNECTION_LOSS_STORM_THRESHOLD 3
|
||||
#define BES2600_CONNECTION_LOSS_STORM_WINDOW_MS 60000
|
||||
|
||||
void bes2600_connection_loss_storm_recover(struct work_struct *work)
|
||||
{
|
||||
bes_warn("[bes2600] connection-loss-storm fast-recover: bus_reset\n");
|
||||
bes2600_chrdev_trigger_bus_reset();
|
||||
/*
|
||||
* After bes2600_chrdev_do_bus_reset() returns, the SDIO core has
|
||||
* scheduled a remove + rescan; per-vif state may already be gone.
|
||||
* Do not dereference any per-vif pointer here.
|
||||
*/
|
||||
}
|
||||
|
||||
void bes2600_connection_loss_storm_init(struct bes2600_vif *priv)
|
||||
{
|
||||
priv->connection_loss_storm_window_start = 0;
|
||||
priv->connection_loss_storm_count = 0;
|
||||
priv->connection_loss_storm_recoveries = 0;
|
||||
}
|
||||
|
||||
bool bes2600_connection_loss_storm_account(struct bes2600_vif *priv)
|
||||
{
|
||||
unsigned long now = jiffies;
|
||||
unsigned long window =
|
||||
msecs_to_jiffies(BES2600_CONNECTION_LOSS_STORM_WINDOW_MS);
|
||||
|
||||
if (priv->connection_loss_storm_window_start == 0 ||
|
||||
time_after(now, priv->connection_loss_storm_window_start + window)) {
|
||||
priv->connection_loss_storm_window_start = now;
|
||||
priv->connection_loss_storm_count = 1;
|
||||
return false;
|
||||
}
|
||||
|
||||
return ++priv->connection_loss_storm_count >=
|
||||
BES2600_CONNECTION_LOSS_STORM_THRESHOLD;
|
||||
}
|
||||
|
||||
void bes2600_connection_loss_work(struct work_struct *work)
|
||||
{
|
||||
struct bes2600_vif *priv =
|
||||
@@ -1733,21 +1667,9 @@ void bes2600_connection_loss_work(struct work_struct *work)
|
||||
|
||||
bes_devel("[CQM] Reporting connection loss.\n");
|
||||
bes2600_pwr_clear_busy_event(priv->hw_priv, BES_PWR_LOCK_ON_BSS_LOST);
|
||||
|
||||
if (bes2600_connection_loss_storm_account(priv)) {
|
||||
bes_warn("[bes2600] connection-loss storm: %u in %u s, scheduling bus reset\n",
|
||||
priv->connection_loss_storm_count,
|
||||
BES2600_CONNECTION_LOSS_STORM_WINDOW_MS / 1000);
|
||||
priv->connection_loss_storm_count = 0;
|
||||
priv->connection_loss_storm_recoveries++;
|
||||
schedule_work(&hw_priv->connection_loss_storm_recover_work);
|
||||
/* bus_reset will tear the chip down; skip the mac80211 path. */
|
||||
return;
|
||||
}
|
||||
|
||||
if (bes2600_suspend_status_get(hw_priv))
|
||||
if(bes2600_suspend_status_get(hw_priv)) {
|
||||
bes2600_pending_unjoin_set(hw_priv, priv->if_id);
|
||||
else
|
||||
} else
|
||||
ieee80211_connection_loss(priv->vif);
|
||||
#ifdef WIFI_BT_COEXIST_EPTA_ENABLE
|
||||
// set disconnected in BSS_CHANGED_ASSOC
|
||||
@@ -2697,8 +2619,6 @@ int bes2600_vif_setup(struct bes2600_vif *priv)
|
||||
|
||||
/* Setup per vif workitems and locks */
|
||||
spin_lock_init(&priv->vif_lock);
|
||||
bes2600_decrypt_storm_init(priv);
|
||||
bes2600_connection_loss_storm_init(priv);
|
||||
INIT_WORK(&priv->join_work, bes2600_join_work);
|
||||
INIT_DELAYED_WORK(&priv->join_timeout, bes2600_join_timeout);
|
||||
INIT_WORK(&priv->unjoin_work, bes2600_unjoin_work);
|
||||
|
||||
@@ -25,78 +25,6 @@
|
||||
|
||||
#define BES2600_INVALID_RATE_ID (0xFF)
|
||||
|
||||
/*
|
||||
* Decrypt-storm fast-recover (Trigger B).
|
||||
*
|
||||
* When the BES2600 firmware reports WSM_STATUS_DECRYPTFAILURE for a
|
||||
* burst of received frames (typically because the host's PTK or GTK
|
||||
* has fallen out of sync with the AP), the AP eventually concludes that
|
||||
* the STA is not authenticated and emits an unprotected deauth-reason-6
|
||||
* ("Class 2 frame received from non-authenticated station"). On the
|
||||
* deployed pinetab2 + bes2600 stack this AP-initiated deauth has been
|
||||
* observed to leave the link blackholed for up to 109 s before
|
||||
* userspace finds a different SSID/channel to recover on. (Receipts at
|
||||
* https://git.reauktion.de/marfrit/besser, notes/phase5-2026-05-06.md.)
|
||||
*
|
||||
* Recovery here pre-empts the AP: when we see THRESHOLD decrypt
|
||||
* failures within WINDOW, we ask mac80211 for a clean reassoc via
|
||||
* ieee80211_connection_loss(), which causes immediate disassociation
|
||||
* and lets userspace auto-reconnect with fresh keys.
|
||||
*
|
||||
* mac80211 contract: ieee80211_connection_loss() may be called
|
||||
* regardless of IEEE80211_HW_CONNECTION_MONITOR; it causes immediate
|
||||
* disassociation without driver-side recovery attempts. See
|
||||
* include/net/mac80211.h for the canonical doc-comment.
|
||||
*
|
||||
* The threshold is set well above the steady-state per-vif
|
||||
* decrypt-fail rate observed in measurement (~1/min even under
|
||||
* sustained 1 MB/s load), so a true storm is required to trip it.
|
||||
*/
|
||||
#define BES2600_DECRYPT_STORM_THRESHOLD 5
|
||||
#define BES2600_DECRYPT_STORM_WINDOW_MS 5000
|
||||
|
||||
static void bes2600_decrypt_storm_recover_work(struct work_struct *work)
|
||||
{
|
||||
struct bes2600_vif *priv = container_of(work, struct bes2600_vif,
|
||||
decrypt_storm_recover_work);
|
||||
|
||||
if (!priv->vif)
|
||||
return;
|
||||
|
||||
bes_warn("[bes2600] decrypt-storm fast-recover: forcing reassoc\n");
|
||||
ieee80211_connection_loss(priv->vif);
|
||||
priv->decrypt_storm_recoveries++;
|
||||
}
|
||||
|
||||
void bes2600_decrypt_storm_init(struct bes2600_vif *priv)
|
||||
{
|
||||
INIT_WORK(&priv->decrypt_storm_recover_work,
|
||||
bes2600_decrypt_storm_recover_work);
|
||||
priv->decrypt_storm_window_start = 0;
|
||||
priv->decrypt_storm_count = 0;
|
||||
priv->decrypt_storm_recoveries = 0;
|
||||
}
|
||||
|
||||
void bes2600_decrypt_storm_account(struct bes2600_vif *priv)
|
||||
{
|
||||
unsigned long now = jiffies;
|
||||
unsigned long window = msecs_to_jiffies(BES2600_DECRYPT_STORM_WINDOW_MS);
|
||||
|
||||
if (priv->decrypt_storm_window_start == 0 ||
|
||||
time_after(now, priv->decrypt_storm_window_start + window)) {
|
||||
priv->decrypt_storm_window_start = now;
|
||||
priv->decrypt_storm_count = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
if (++priv->decrypt_storm_count >= BES2600_DECRYPT_STORM_THRESHOLD) {
|
||||
priv->decrypt_storm_count = 0;
|
||||
/* Skew the window so we don't re-fire on the same storm. */
|
||||
priv->decrypt_storm_window_start = now + window;
|
||||
schedule_work(&priv->decrypt_storm_recover_work);
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef CONFIG_BES2600_TESTMODE
|
||||
#include "bes_nl80211_testmode_msg.h"
|
||||
#endif /* CONFIG_BES2600_TESTMODE */
|
||||
@@ -1744,8 +1672,6 @@ void bes2600_rx_cb(struct bes2600_vif *priv,
|
||||
goto drop;
|
||||
} else {
|
||||
bes_warn("[RX] Receive failure: %d.\n", arg->status);
|
||||
if (arg->status == WSM_STATUS_DECRYPTFAILURE)
|
||||
bes2600_decrypt_storm_account(priv);
|
||||
goto drop;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user