diff options
| -rw-r--r-- | kernel.spec | 18 | ||||
| -rw-r--r-- | wcn36xx-Fix-firmware-crash-due-to-corrupted-buffer-address.patch | 164 | ||||
| -rw-r--r-- | wcn36xx-reduce-verbosity-of-drivers-messages.patch | 95 |
3 files changed, 271 insertions, 6 deletions
diff --git a/kernel.spec b/kernel.spec index 81e15c6b2..7f4221ee6 100644 --- a/kernel.spec +++ b/kernel.spec @@ -580,19 +580,22 @@ Patch302: arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch # http://patchwork.ozlabs.org/patch/587554/ Patch303: ARM-tegra-usb-no-reset.patch -Patch305: arm64-Revert-allwinner-a64-pine64-Use-dcdc1-regulato.patch +Patch304: arm64-Revert-allwinner-a64-pine64-Use-dcdc1-regulato.patch # https://patchwork.kernel.org/patch/9820417/ -Patch306: qcom-msm89xx-fixes.patch +Patch305: qcom-msm89xx-fixes.patch # https://patchwork.kernel.org/patch/10173115/ -Patch307: arm-dts-imx6qdl-udoo-Disable-usbh1-to-avoid-kernel-hang.patch +Patch306: arm-dts-imx6qdl-udoo-Disable-usbh1-to-avoid-kernel-hang.patch # Fix USB on the RPi https://patchwork.kernel.org/patch/9879371/ -Patch308: bcm283x-dma-mapping-skip-USB-devices-when-configuring-DMA-during-probe.patch +Patch307: bcm283x-dma-mapping-skip-USB-devices-when-configuring-DMA-during-probe.patch -# https://www.spinics.net/lists/stable/msg214527.html -Patch311: arm-clk-bcm2835-hdmi-fixes.patch +# http://patches.linaro.org/patch/131764/ +Patch308: wcn36xx-Fix-firmware-crash-due-to-corrupted-buffer-address.patch + +# https://patchwork.kernel.org/patch/10245303/ +Patch309: wcn36xx-reduce-verbosity-of-drivers-messages.patch # https://www.spinics.net/lists/arm-kernel/msg632925.html Patch313: arm-crypto-sunxi-ss-Add-MODULE_ALIAS-to-sun4i-ss.patch @@ -1924,6 +1927,9 @@ fi # # %changelog +* Thu Mar 22 2018 Peter Robinson <pbrobinson@fedoraproject.org> +- Wifi fixes for QCom DragonBoard 410c + * Wed Mar 21 2018 Jeremy Cline <jeremy@jcline.org> - 4.16.0-0.rc6.git2.1 - Linux v4.16-rc6-75-g3215b9d57a2c diff --git a/wcn36xx-Fix-firmware-crash-due-to-corrupted-buffer-address.patch b/wcn36xx-Fix-firmware-crash-due-to-corrupted-buffer-address.patch new file mode 100644 index 000000000..dd8db063c --- /dev/null +++ b/wcn36xx-Fix-firmware-crash-due-to-corrupted-buffer-address.patch @@ -0,0 +1,164 @@ +From patchwork Thu Mar 15 11:31:33 2018 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: wcn36xx: Fix firmware crash due to corrupted buffer address +X-Patchwork-Submitter: Ramon Fried <rfried@codeaurora.org> +X-Patchwork-Id: 131764 +Message-Id: <20180315113133.28791-1-rfried@codeaurora.org> +To: k.eugene.e@gmail.com, kvalo@codeaurora.org, + wcn36xx@lists.infradead.org, linux-wireless@vger.kernel.org +Cc: Loic Poulain <loic.poulain@linaro.org>, Ramon Fried <rfried@codeaurora.org> +Date: Thu, 15 Mar 2018 13:31:33 +0200 +From: Ramon Fried <rfried@codeaurora.org> +List-Id: <linux-wireless.vger.kernel.org> + +From: Loic Poulain <loic.poulain@linaro.org>
+
+wcn36xx_start_tx function retrieves the buffer descriptor from the
+channel control queue to start filling tx buffer information. However,
+nothing prevents this same buffer to be concurrently accessed in a
+concurent tx call, leading to potential buffer coruption and firmware
+crash (observed during iperf test). The channel control queue should
+only be accessed and updated with the channel lock.
+
+Fix this issue by using a local buffer descriptor which will be copied
+in the thread-safe wcn36xx_dxe_tx_frame.
+
+Note that buffer descriptor size is few bytes so the introduced copy
+overhead is insignificant. Moreover, this allows to keep the locked
+section minimal.
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Ramon Fried <rfried@codeaurora.org>
+---
+ drivers/net/wireless/ath/wcn36xx/dxe.c | 13 ++++---------
+ drivers/net/wireless/ath/wcn36xx/dxe.h | 3 ++-
+ drivers/net/wireless/ath/wcn36xx/txrx.c | 32 ++++++++++----------------------
+ 3 files changed, 16 insertions(+), 32 deletions(-)
+
+--
+The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
+a Linux Foundation Collaborative Project + +diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
+index 7d5ecaf02288..2c3b899a88fa 100644
+--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
++++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
+@@ -27,15 +27,6 @@
+ #include "wcn36xx.h"
+ #include "txrx.h"
+
+-void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low)
+-{
+- struct wcn36xx_dxe_ch *ch = is_low ?
+- &wcn->dxe_tx_l_ch :
+- &wcn->dxe_tx_h_ch;
+-
+- return ch->head_blk_ctl->bd_cpu_addr;
+-}
+-
+ static void wcn36xx_ccu_write_register(struct wcn36xx *wcn, int addr, int data)
+ {
+ wcn36xx_dbg(WCN36XX_DBG_DXE,
+@@ -648,6 +639,7 @@ void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn)
+
+ int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+ struct wcn36xx_vif *vif_priv,
++ struct wcn36xx_tx_bd *bd,
+ struct sk_buff *skb,
+ bool is_low)
+ {
+@@ -681,6 +673,9 @@ int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+ ctl->skb = NULL;
+ desc = ctl->desc;
+
++ /* write buffer descriptor */
++ memcpy(ctl->bd_cpu_addr, bd, sizeof(*bd));
++
+ /* Set source address of the BD we send */
+ desc->src_addr_l = ctl->bd_phy_addr;
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.h b/drivers/net/wireless/ath/wcn36xx/dxe.h
+index 2bc376c5391b..ce580960d109 100644
+--- a/drivers/net/wireless/ath/wcn36xx/dxe.h
++++ b/drivers/net/wireless/ath/wcn36xx/dxe.h
+@@ -452,6 +452,7 @@ struct wcn36xx_dxe_mem_pool {
+ dma_addr_t phy_addr;
+ };
+
++struct wcn36xx_tx_bd;
+ struct wcn36xx_vif;
+ int wcn36xx_dxe_allocate_mem_pools(struct wcn36xx *wcn);
+ void wcn36xx_dxe_free_mem_pools(struct wcn36xx *wcn);
+@@ -463,8 +464,8 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn);
+ int wcn36xx_dxe_init_channels(struct wcn36xx *wcn);
+ int wcn36xx_dxe_tx_frame(struct wcn36xx *wcn,
+ struct wcn36xx_vif *vif_priv,
++ struct wcn36xx_tx_bd *bd,
+ struct sk_buff *skb,
+ bool is_low);
+ void wcn36xx_dxe_tx_ack_ind(struct wcn36xx *wcn, u32 status);
+-void *wcn36xx_dxe_get_next_bd(struct wcn36xx *wcn, bool is_low);
+ #endif /* _DXE_H_ */
+diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
+index 22304edc5948..b1768ed6b0be 100644
+--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
++++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
+@@ -272,21 +272,9 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
+ bool is_low = ieee80211_is_data(hdr->frame_control);
+ bool bcast = is_broadcast_ether_addr(hdr->addr1) ||
+ is_multicast_ether_addr(hdr->addr1);
+- struct wcn36xx_tx_bd *bd = wcn36xx_dxe_get_next_bd(wcn, is_low);
+-
+- if (!bd) {
+- /*
+- * TX DXE are used in pairs. One for the BD and one for the
+- * actual frame. The BD DXE's has a preallocated buffer while
+- * the skb ones does not. If this isn't true something is really
+- * wierd. TODO: Recover from this situation
+- */
+-
+- wcn36xx_err("bd address may not be NULL for BD DXE\n");
+- return -EINVAL;
+- }
++ struct wcn36xx_tx_bd bd;
+
+- memset(bd, 0, sizeof(*bd));
++ memset(&bd, 0, sizeof(bd));
+
+ wcn36xx_dbg(WCN36XX_DBG_TX,
+ "tx skb %p len %d fc %04x sn %d %s %s\n",
+@@ -296,10 +284,10 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
+
+ wcn36xx_dbg_dump(WCN36XX_DBG_TX_DUMP, "", skb->data, skb->len);
+
+- bd->dpu_rf = WCN36XX_BMU_WQ_TX;
++ bd.dpu_rf = WCN36XX_BMU_WQ_TX;
+
+- bd->tx_comp = !!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS);
+- if (bd->tx_comp) {
++ bd.tx_comp = !!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS);
++ if (bd.tx_comp) {
+ wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
+ spin_lock_irqsave(&wcn->dxe_lock, flags);
+ if (wcn->tx_ack_skb) {
+@@ -321,13 +309,13 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
+
+ /* Data frames served first*/
+ if (is_low)
+- wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, skb, bcast);
++ wcn36xx_set_tx_data(&bd, wcn, &vif_priv, sta_priv, skb, bcast);
+ else
+ /* MGMT and CTRL frames are handeld here*/
+- wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, skb, bcast);
++ wcn36xx_set_tx_mgmt(&bd, wcn, &vif_priv, skb, bcast);
+
+- buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
+- bd->tx_bd_sign = 0xbdbdbdbd;
++ buff_to_be((u32 *)&bd, sizeof(bd)/sizeof(u32));
++ bd.tx_bd_sign = 0xbdbdbdbd;
+
+- return wcn36xx_dxe_tx_frame(wcn, vif_priv, skb, is_low);
++ return wcn36xx_dxe_tx_frame(wcn, vif_priv, &bd, skb, is_low);
+ }
diff --git a/wcn36xx-reduce-verbosity-of-drivers-messages.patch b/wcn36xx-reduce-verbosity-of-drivers-messages.patch new file mode 100644 index 000000000..7f9e39b40 --- /dev/null +++ b/wcn36xx-reduce-verbosity-of-drivers-messages.patch @@ -0,0 +1,95 @@ +From patchwork Tue Feb 27 14:05:35 2018 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [v3] wcn36xx: reduce verbosity of drivers messages +From: Ramon Fried <rfried@codeaurora.org> +X-Patchwork-Id: 10245303 +Message-Id: <20180227140535.4794-1-rfried@codeaurora.org> +To: k.eugene.e@gmail.com, kvalo@codeaurora.org, + wcn36xx@lists.infradead.org, linux-wireless@vger.kernel.org +Cc: Ramon Fried <rfried@codeaurora.org> +Date: Tue, 27 Feb 2018 16:05:35 +0200 + +Whenever the WLAN interface is started the FW +version and caps are printed. +The caps now will be displayed only in debug mode. +Firmware version will be displayed only once on first +startup of the interface. + +Change-Id: I4db6ea7f384fe15eebe4c3ddb1d1ccab00094332 +Signed-off-by: Ramon Fried <rfried@codeaurora.org> +--- +v2: print the firwmare version as info but only + onetime. +v3: change the static variable to a struct variable. + + drivers/net/wireless/ath/wcn36xx/main.c | 3 ++- + drivers/net/wireless/ath/wcn36xx/smd.c | 18 ++++++++++-------- + drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 2 ++ + 3 files changed, 14 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index ab5be6d2c691..bfe9062bfa52 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -261,7 +261,7 @@ static void wcn36xx_feat_caps_info(struct wcn36xx *wcn) + + for (i = 0; i < MAX_FEATURE_SUPPORTED; i++) { + if (get_feat_caps(wcn->fw_feat_caps, i)) +- wcn36xx_info("FW Cap %s\n", wcn36xx_get_cap_name(i)); ++ wcn36xx_dbg(WCN36XX_DBG_MAC, "FW Cap %s\n", wcn36xx_get_cap_name(i)); + } + } + +@@ -1283,6 +1283,7 @@ static int wcn36xx_probe(struct platform_device *pdev) + wcn = hw->priv; + wcn->hw = hw; + wcn->dev = &pdev->dev; ++ wcn->first_boot = true; + mutex_init(&wcn->conf_mutex); + mutex_init(&wcn->hal_mutex); + mutex_init(&wcn->scan_lock); +diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c +index 2a4871ca9c72..1a5b4d57c0ac 100644 +--- a/drivers/net/wireless/ath/wcn36xx/smd.c ++++ b/drivers/net/wireless/ath/wcn36xx/smd.c +@@ -409,15 +409,17 @@ static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len) + wcn->fw_minor = rsp->start_rsp_params.version.minor; + wcn->fw_major = rsp->start_rsp_params.version.major; + +- wcn36xx_info("firmware WLAN version '%s' and CRM version '%s'\n", +- wcn->wlan_version, wcn->crm_version); +- +- wcn36xx_info("firmware API %u.%u.%u.%u, %u stations, %u bssids\n", +- wcn->fw_major, wcn->fw_minor, +- wcn->fw_version, wcn->fw_revision, +- rsp->start_rsp_params.stations, +- rsp->start_rsp_params.bssids); ++ if (wcn->first_boot) { ++ wcn->first_boot = false; ++ wcn36xx_info("firmware WLAN version '%s' and CRM version '%s'\n", ++ wcn->wlan_version, wcn->crm_version); + ++ wcn36xx_info("firmware API %u.%u.%u.%u, %u stations, %u bssids\n", ++ wcn->fw_major, wcn->fw_minor, ++ wcn->fw_version, wcn->fw_revision, ++ rsp->start_rsp_params.stations, ++ rsp->start_rsp_params.bssids); ++ } + return 0; + } + +diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h +index 81017e6703b4..5854adf43f3a 100644 +--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h ++++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h +@@ -192,6 +192,8 @@ struct wcn36xx { + u8 crm_version[WCN36XX_HAL_VERSION_LENGTH + 1]; + u8 wlan_version[WCN36XX_HAL_VERSION_LENGTH + 1]; + ++ bool first_boot; ++ + /* IRQs */ + int tx_irq; + int rx_irq; |