wireless-drivers fixes for 5.4

First set of fixes for 5.4 sent during the merge window. Most are
 regressions fixes but the mt7615 problem has been since it was merged.
 
 iwlwifi
 
 * fix a build regression related CONFIG_THERMAL
 
 * avoid using GEO_TX_POWER_LIMIT command on certain firmware versions
 
 rtw88
 
 * fixes for skb leaks
 
 zd1211rw
 
 * fix a compiler warning on 32 bit
 
 mt76
 
 * fix the firmware paths for mt7615 to match with linux-firmware
 
 wil6210
 
 * fix use of skb after free
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJdjLN3AAoJEG4XJFUm622bsBcH/1A/srmEN3bME86p9j0DS1Wb
 A/8KPP88q9gczIDg+uZQCw1rTqHUrqkgbPxVCa64tKdPjqioRc9nW4CVhKh2OLTy
 88Bwh/mJhxfh/+TTfYf397OsHr9NEVaFnEqjYeUxtyhRoZriUmAtKSd4/689czDP
 AOdbkXShe8pUS+UvpizfpOHP28j4TbFOzcWn8qcGm1gqfuCHan+giaSw073vz+r4
 fagOz470huyqCwx8LB21IzTCunox20W4IfN/G2AMoKx7tE9XbYr6kRR8vawffwm2
 FVyhlnibkRQnRv77thg+zJZQ6UpJybsfM8Izpn1kTDFiRChNqvMtOKboz+IQOHg=
 =4i7U
 -----END PGP SIGNATURE-----

Merge tag 'wireless-drivers-for-davem-2019-09-26' of https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers

Kalle Valo says:

====================
wireless-drivers fixes for 5.4

First set of fixes for 5.4 sent during the merge window. Most are
regressions fixes but the mt7615 problem has been since it was merged.

iwlwifi

* fix a build regression related CONFIG_THERMAL

* avoid using GEO_TX_POWER_LIMIT command on certain firmware versions

rtw88

* fixes for skb leaks

zd1211rw

* fix a compiler warning on 32 bit

mt76

* fix the firmware paths for mt7615 to match with linux-firmware

wil6210

* fix use of skb after free
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2019-09-26 18:00:26 +02:00
commit 5a2a828d81
9 changed files with 63 additions and 30 deletions

View File

@ -1012,11 +1012,11 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
skb_orphan(skb);
if (security && (wil->txrx_ops.rx_crypto_check(wil, skb) != 0)) {
wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len);
dev_kfree_skb(skb);
ndev->stats.rx_dropped++;
stats->rx_replay++;
stats->rx_dropped++;
wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len);
return;
}

View File

@ -889,11 +889,13 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
* firmware versions. Unfortunately, we don't have a TLV API
* flag to rely on, so rely on the major version which is in
* the first byte of ucode_ver. This was implemented
* initially on version 38 and then backported to 36, 29 and
* 17.
* initially on version 38 and then backported to29 and 17.
* The intention was to have it in 36 as well, but not all
* 8000 family got this feature enabled. The 8000 family is
* the only one using version 36, so skip this version
* entirely.
*/
return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 36 ||
IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
}

View File

@ -555,16 +555,19 @@ static int compare_temps(const void *a, const void *b)
return ((s16)le16_to_cpu(*(__le16 *)a) -
(s16)le16_to_cpu(*(__le16 *)b));
}
#endif
int iwl_mvm_send_temp_report_ths_cmd(struct iwl_mvm *mvm)
{
struct temp_report_ths_cmd cmd = {0};
int ret, i, j, idx = 0;
int ret;
#ifdef CONFIG_THERMAL
int i, j, idx = 0;
lockdep_assert_held(&mvm->mutex);
if (!mvm->tz_device.tzone)
return -EINVAL;
goto send;
/* The driver holds array of temperature trips that are unsorted
* and uncompressed, the FW should get it compressed and sorted
@ -597,6 +600,7 @@ int iwl_mvm_send_temp_report_ths_cmd(struct iwl_mvm *mvm)
}
send:
#endif
ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(PHY_OPS_GROUP,
TEMP_REPORTING_THRESHOLDS_CMD),
0, sizeof(cmd), &cmd);
@ -607,6 +611,7 @@ send:
return ret;
}
#ifdef CONFIG_THERMAL
static int iwl_mvm_tzone_get_temp(struct thermal_zone_device *device,
int *temperature)
{

View File

@ -333,7 +333,6 @@ static int mt7615_driver_own(struct mt7615_dev *dev)
static int mt7615_load_patch(struct mt7615_dev *dev)
{
const char *firmware = MT7615_ROM_PATCH;
const struct mt7615_patch_hdr *hdr;
const struct firmware *fw = NULL;
int len, ret, sem;
@ -349,7 +348,7 @@ static int mt7615_load_patch(struct mt7615_dev *dev)
return -EAGAIN;
}
ret = request_firmware(&fw, firmware, dev->mt76.dev);
ret = request_firmware(&fw, MT7615_ROM_PATCH, dev->mt76.dev);
if (ret)
goto out;
@ -447,13 +446,11 @@ mt7615_mcu_send_ram_firmware(struct mt7615_dev *dev,
static int mt7615_load_ram(struct mt7615_dev *dev)
{
const struct firmware *fw;
const struct mt7615_fw_trailer *hdr;
const char *n9_firmware = MT7615_FIRMWARE_N9;
const char *cr4_firmware = MT7615_FIRMWARE_CR4;
const struct firmware *fw;
int ret;
ret = request_firmware(&fw, n9_firmware, dev->mt76.dev);
ret = request_firmware(&fw, MT7615_FIRMWARE_N9, dev->mt76.dev);
if (ret)
return ret;
@ -482,7 +479,7 @@ static int mt7615_load_ram(struct mt7615_dev *dev)
release_firmware(fw);
ret = request_firmware(&fw, cr4_firmware, dev->mt76.dev);
ret = request_firmware(&fw, MT7615_FIRMWARE_CR4, dev->mt76.dev);
if (ret)
return ret;

View File

@ -26,9 +26,9 @@
#define MT7615_RX_RING_SIZE 1024
#define MT7615_RX_MCU_RING_SIZE 512
#define MT7615_FIRMWARE_CR4 "mt7615_cr4.bin"
#define MT7615_FIRMWARE_N9 "mt7615_n9.bin"
#define MT7615_ROM_PATCH "mt7615_rom_patch.bin"
#define MT7615_FIRMWARE_CR4 "mediatek/mt7615_cr4.bin"
#define MT7615_FIRMWARE_N9 "mediatek/mt7615_n9.bin"
#define MT7615_ROM_PATCH "mediatek/mt7615_rom_patch.bin"
#define MT7615_EEPROM_SIZE 1024
#define MT7615_TOKEN_SIZE 4096

View File

@ -707,9 +707,6 @@ int rtw_download_firmware(struct rtw_dev *rtwdev, struct rtw_fw_state *fw)
rtwdev->h2c.last_box_num = 0;
rtwdev->h2c.seq = 0;
rtw_fw_send_general_info(rtwdev);
rtw_fw_send_phydm_info(rtwdev);
rtw_flag_set(rtwdev, RTW_FLAG_FW_RUNNING);
return 0;

View File

@ -704,6 +704,10 @@ static int rtw_power_on(struct rtw_dev *rtwdev)
goto err_off;
}
/* send H2C after HCI has started */
rtw_fw_send_general_info(rtwdev);
rtw_fw_send_phydm_info(rtwdev);
wifi_only = !rtwdev->efuse.btcoex;
rtw_coex_power_on_setting(rtwdev);
rtw_coex_init_hw_config(rtwdev, wifi_only);

View File

@ -90,16 +90,13 @@ static inline void *rtw_pci_get_tx_desc(struct rtw_pci_tx_ring *tx_ring, u8 idx)
return tx_ring->r.head + offset;
}
static void rtw_pci_free_tx_ring(struct rtw_dev *rtwdev,
struct rtw_pci_tx_ring *tx_ring)
static void rtw_pci_free_tx_ring_skbs(struct rtw_dev *rtwdev,
struct rtw_pci_tx_ring *tx_ring)
{
struct pci_dev *pdev = to_pci_dev(rtwdev->dev);
struct rtw_pci_tx_data *tx_data;
struct sk_buff *skb, *tmp;
dma_addr_t dma;
u8 *head = tx_ring->r.head;
u32 len = tx_ring->r.len;
int ring_sz = len * tx_ring->r.desc_size;
/* free every skb remained in tx list */
skb_queue_walk_safe(&tx_ring->queue, skb, tmp) {
@ -110,21 +107,30 @@ static void rtw_pci_free_tx_ring(struct rtw_dev *rtwdev,
pci_unmap_single(pdev, dma, skb->len, PCI_DMA_TODEVICE);
dev_kfree_skb_any(skb);
}
}
static void rtw_pci_free_tx_ring(struct rtw_dev *rtwdev,
struct rtw_pci_tx_ring *tx_ring)
{
struct pci_dev *pdev = to_pci_dev(rtwdev->dev);
u8 *head = tx_ring->r.head;
u32 len = tx_ring->r.len;
int ring_sz = len * tx_ring->r.desc_size;
rtw_pci_free_tx_ring_skbs(rtwdev, tx_ring);
/* free the ring itself */
pci_free_consistent(pdev, ring_sz, head, tx_ring->r.dma);
tx_ring->r.head = NULL;
}
static void rtw_pci_free_rx_ring(struct rtw_dev *rtwdev,
struct rtw_pci_rx_ring *rx_ring)
static void rtw_pci_free_rx_ring_skbs(struct rtw_dev *rtwdev,
struct rtw_pci_rx_ring *rx_ring)
{
struct pci_dev *pdev = to_pci_dev(rtwdev->dev);
struct sk_buff *skb;
dma_addr_t dma;
u8 *head = rx_ring->r.head;
int buf_sz = RTK_PCI_RX_BUF_SIZE;
int ring_sz = rx_ring->r.desc_size * rx_ring->r.len;
dma_addr_t dma;
int i;
for (i = 0; i < rx_ring->r.len; i++) {
@ -137,6 +143,16 @@ static void rtw_pci_free_rx_ring(struct rtw_dev *rtwdev,
dev_kfree_skb(skb);
rx_ring->buf[i] = NULL;
}
}
static void rtw_pci_free_rx_ring(struct rtw_dev *rtwdev,
struct rtw_pci_rx_ring *rx_ring)
{
struct pci_dev *pdev = to_pci_dev(rtwdev->dev);
u8 *head = rx_ring->r.head;
int ring_sz = rx_ring->r.desc_size * rx_ring->r.len;
rtw_pci_free_rx_ring_skbs(rtwdev, rx_ring);
pci_free_consistent(pdev, ring_sz, head, rx_ring->r.dma);
}
@ -484,6 +500,17 @@ static void rtw_pci_dma_reset(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci)
rtwpci->rx_tag = 0;
}
static void rtw_pci_dma_release(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci)
{
struct rtw_pci_tx_ring *tx_ring;
u8 queue;
for (queue = 0; queue < RTK_MAX_TX_QUEUE_NUM; queue++) {
tx_ring = &rtwpci->tx_rings[queue];
rtw_pci_free_tx_ring_skbs(rtwdev, tx_ring);
}
}
static int rtw_pci_start(struct rtw_dev *rtwdev)
{
struct rtw_pci *rtwpci = (struct rtw_pci *)rtwdev->priv;
@ -505,6 +532,7 @@ static void rtw_pci_stop(struct rtw_dev *rtwdev)
spin_lock_irqsave(&rtwpci->irq_lock, flags);
rtw_pci_disable_interrupt(rtwdev, rtwpci);
rtw_pci_dma_release(rtwdev, rtwpci);
spin_unlock_irqrestore(&rtwpci->irq_lock, flags);
}

View File

@ -1633,7 +1633,7 @@ static bool check_read_regs(struct zd_usb *usb, struct usb_req_read_regs *req,
*/
if (rr->length < struct_size(regs, regs, count)) {
dev_dbg_f(zd_usb_dev(usb),
"error: actual length %d less than expected %ld\n",
"error: actual length %d less than expected %zu\n",
rr->length, struct_size(regs, regs, count));
return false;
}