[][MAC80211][wed][fix some possible NULL pointer dereferences]
[Description]
Fix some possible NULL pointer dereferences
sync upstream patches
[Release-log]
N/A
Change-Id: I17dcda8c3304f7e989c332c815982ad4bc004fb4
Reviewed-on: https://gerrit.mediatek.inc/c/openwrt/feeds/mtk_openwrt_feeds/+/6929459
diff --git a/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9997-add-wed-rx-support-for-mt7896.patch b/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9997-add-wed-rx-support-for-mt7896.patch
index 053a4da..322c5f5 100644
--- a/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9997-add-wed-rx-support-for-mt7896.patch
+++ b/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9997-add-wed-rx-support-for-mt7896.patch
@@ -262,7 +262,7 @@
static u32
mtk_wed_read_reset(struct mtk_wed_device *dev)
{
-@@ -68,6 +126,52 @@ mtk_wed_reset(struct mtk_wed_device *dev, u32 mask)
+@@ -68,6 +126,53 @@ mtk_wed_reset(struct mtk_wed_device *dev, u32 mask)
WARN_ON_ONCE(1);
}
@@ -280,8 +280,9 @@
+
+ mtk_wed_reset(dev, MTK_WED_RESET_WED);
+
-+ mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_CHANGE_STATE,
-+ &state, sizeof(state), false);
++ if (mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, MTK_WED_WO_CMD_CHANGE_STATE,
++ &state, sizeof(state), false))
++ return;
+
+ do {
+ value = wed_r32(dev, MTK_WED_SCR0 + 4 * WED_DUMMY_CR_WO_STATUS);
@@ -315,7 +316,7 @@
static struct mtk_wed_hw *
mtk_wed_assign(struct mtk_wed_device *dev)
{
-@@ -178,7 +282,7 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
+@@ -178,7 +283,7 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
{
struct mtk_wdma_desc *desc = dev->buf_ring.desc;
void **page_list = dev->buf_ring.pages;
@@ -324,7 +325,7 @@
int i;
if (!page_list)
-@@ -187,7 +291,14 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
+@@ -187,7 +292,14 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
if (!desc)
goto free_pagelist;
@@ -340,7 +341,7 @@
void *page = page_list[page_idx++];
if (!page)
-@@ -198,13 +309,49 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
+@@ -198,13 +310,49 @@ mtk_wed_free_buffer(struct mtk_wed_device *dev)
__free_page(page);
}
@@ -391,7 +392,7 @@
static void
mtk_wed_free_ring(struct mtk_wed_device *dev, struct mtk_wed_ring *ring, int scale)
{
-@@ -226,13 +373,22 @@ mtk_wed_free_tx_rings(struct mtk_wed_device *dev)
+@@ -226,13 +374,22 @@ mtk_wed_free_tx_rings(struct mtk_wed_device *dev)
mtk_wed_free_ring(dev, &dev->tx_wdma[i], dev->ver);
}
@@ -415,7 +416,7 @@
/* wed control cr set */
wed_set(dev, MTK_WED_CTRL,
MTK_WED_CTRL_WDMA_INT_AGENT_EN |
-@@ -251,7 +407,7 @@ mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
+@@ -251,7 +408,7 @@ mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV);
} else {
@@ -424,7 +425,7 @@
wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
MTK_WED_WPDMA_INT_CTRL_TX0_DONE_CLR |
-@@ -262,22 +418,30 @@ mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
+@@ -262,22 +419,30 @@ mtk_wed_set_int(struct mtk_wed_device *dev, u32 irq_mask)
FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX1_DONE_TRIG,
dev->wlan.tx_tbit[1]));
@@ -459,7 +460,7 @@
}
wdma_w32(dev, MTK_WDMA_INT_MASK, wdma_mask);
-@@ -312,6 +476,40 @@ mtk_wed_set_512_support(struct mtk_wed_device *dev, bool en)
+@@ -312,6 +477,40 @@ mtk_wed_set_512_support(struct mtk_wed_device *dev, bool en)
}
}
@@ -500,7 +501,7 @@
static void
mtk_wed_dma_enable(struct mtk_wed_device *dev)
{
-@@ -336,9 +534,15 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
+@@ -336,9 +535,15 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
wdma_set(dev, MTK_WDMA_GLO_CFG,
MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
} else {
@@ -516,7 +517,7 @@
wed_set(dev, MTK_WED_WPDMA_GLO_CFG,
MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_PKT_PROC |
MTK_WED_WPDMA_GLO_CFG_RX_DRV_R0_CRX_SYNC);
-@@ -346,6 +550,15 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
+@@ -346,6 +551,15 @@ mtk_wed_dma_enable(struct mtk_wed_device *dev)
wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP |
MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV);
@@ -532,7 +533,7 @@
}
}
-@@ -363,19 +576,23 @@ mtk_wed_dma_disable(struct mtk_wed_device *dev)
+@@ -363,19 +577,23 @@ mtk_wed_dma_disable(struct mtk_wed_device *dev)
MTK_WED_GLO_CFG_TX_DMA_EN |
MTK_WED_GLO_CFG_RX_DMA_EN);
@@ -560,7 +561,7 @@
}
}
-@@ -383,10 +600,12 @@ static void
+@@ -383,10 +601,12 @@ static void
mtk_wed_stop(struct mtk_wed_device *dev)
{
mtk_wed_dma_disable(dev);
@@ -576,7 +577,7 @@
mtk_wed_set_ext_int(dev, false);
wed_clr(dev, MTK_WED_CTRL,
-@@ -395,6 +614,11 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+@@ -395,6 +615,11 @@ mtk_wed_stop(struct mtk_wed_device *dev)
MTK_WED_CTRL_WED_TX_BM_EN |
MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
@@ -588,7 +589,16 @@
wed_w32(dev, MTK_WED_WPDMA_INT_TRIGGER, 0);
wed_w32(dev, MTK_WED_WDMA_INT_TRIGGER, 0);
wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
-@@ -417,10 +641,21 @@ mtk_wed_detach(struct mtk_wed_device *dev)
+@@ -403,7 +628,7 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ }
+
+ static void
+-mtk_wed_detach(struct mtk_wed_device *dev)
++__mtk_wed_detach(struct mtk_wed_device *dev)
+ {
+ struct device_node *wlan_node;
+ struct mtk_wed_hw *hw = dev->hw;
+@@ -417,10 +642,23 @@ mtk_wed_detach(struct mtk_wed_device *dev)
mtk_wed_reset(dev, MTK_WED_RESET_WED);
@@ -599,19 +609,35 @@
mtk_wed_free_buffer(dev);
mtk_wed_free_tx_rings(dev);
+ if (dev->ver > MTK_WED_V1) {
-+ mtk_wed_wo_reset(dev);
++ if (hw->wed_wo)
++ mtk_wed_wo_reset(dev);
+ mtk_wed_free_rx_rings(dev);
-+ mtk_wed_wo_exit(hw);
++ if (hw->wed_wo)
++ mtk_wed_wo_exit(hw);
+ }
-+
-+ mtk_wdma_rx_reset(dev);
- if (dev->wlan.bus_type == MTK_BUS_TYPE_PCIE) {
++ mtk_wdma_rx_reset(dev);
++
+ if (dev->wlan.bus_type == MTK_WED_BUS_PCIE) {
wlan_node = dev->wlan.pci_dev->dev.of_node;
if (of_dma_is_coherent(wlan_node))
regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
-@@ -443,7 +678,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
+@@ -438,12 +676,21 @@ mtk_wed_detach(struct mtk_wed_device *dev)
+ mutex_unlock(&hw_lock);
+ }
+
++
++static void
++mtk_wed_detach(struct mtk_wed_device *dev)
++{
++ mutex_lock(&hw_lock);
++ __mtk_wed_detach(dev);
++ mutex_unlock(&hw_lock);
++}
++
+ static void
+ mtk_wed_bus_init(struct mtk_wed_device *dev)
{
#define PCIE_BASE_ADDR0 0x11280000
@@ -620,7 +646,7 @@
struct device_node *node;
void __iomem * base_addr;
u32 value = 0;
-@@ -477,7 +712,6 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
+@@ -477,7 +724,6 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
value = wed_r32(dev, MTK_WED_PCIE_CFG_INTM);
value = wed_r32(dev, MTK_WED_PCIE_CFG_BASE);
@@ -628,7 +654,7 @@
wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER, BIT(24));
wed_r32(dev, MTK_WED_PCIE_INT_TRIGGER);
-@@ -485,7 +719,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
+@@ -485,7 +731,7 @@ mtk_wed_bus_init(struct mtk_wed_device *dev)
value = wed_r32(dev, MTK_WED_PCIE_INT_CTRL);
wed_set(dev, MTK_WED_PCIE_INT_CTRL,
MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA);
@@ -637,7 +663,7 @@
wed_set(dev, MTK_WED_WPDMA_INT_CTRL,
MTK_WED_WPDMA_INT_CTRL_SIG_SRC |
FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_SRC_SEL, 0));
-@@ -501,6 +735,9 @@ mtk_wed_set_wpdma(struct mtk_wed_device *dev)
+@@ -501,6 +747,9 @@ mtk_wed_set_wpdma(struct mtk_wed_device *dev)
wed_w32(dev, MTK_WED_WPDMA_CFG_INT_MASK, dev->wlan.wpdma_mask);
wed_w32(dev, MTK_WED_WPDMA_CFG_TX, dev->wlan.wpdma_tx);
wed_w32(dev, MTK_WED_WPDMA_CFG_TX_FREE, dev->wlan.wpdma_txfree);
@@ -647,12 +673,12 @@
} else {
wed_w32(dev, MTK_WED_WPDMA_CFG_BASE, dev->wlan.wpdma_phys);
}
-@@ -549,24 +786,92 @@ mtk_wed_hw_init_early(struct mtk_wed_device *dev)
+@@ -549,24 +798,92 @@ mtk_wed_hw_init_early(struct mtk_wed_device *dev)
FIELD_PREP(MTK_WED_WDMA_OFST1_RX_CTRL,
MTK_WDMA_RING_RX(0)));
}
+}
-
++
+static void
+mtk_wed_rx_bm_hw_init(struct mtk_wed_device *dev)
+{
@@ -660,7 +686,7 @@
+ FIELD_PREP(MTK_WED_RX_BM_RX_DMAD_SDL0, dev->wlan.rx_size));
+
+ wed_w32(dev, MTK_WED_RX_BM_BASE, dev->rx_buf_ring.desc_phys);
-+
+
+ wed_w32(dev, MTK_WED_RX_BM_INIT_PTR, MTK_WED_RX_BM_INIT_SW_TAIL |
+ FIELD_PREP(MTK_WED_RX_BM_SW_TAIL, dev->wlan.rx_npkt));
+
@@ -748,13 +774,13 @@
rev_size = size;
thr = 0;
}
-@@ -609,13 +914,46 @@ mtk_wed_hw_init(struct mtk_wed_device *dev)
+@@ -609,13 +926,46 @@ mtk_wed_hw_init(struct mtk_wed_device *dev)
}
static void
-mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size, int scale)
+mtk_wed_rx_hw_init(struct mtk_wed_device *dev)
- {
++{
+ wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
+ MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
+ MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
@@ -781,7 +807,7 @@
+
+static void
+mtk_wed_ring_reset(struct mtk_wdma_desc *desc, int size, int scale, bool tx)
-+{
+ {
+ __le32 ctrl;
int i;
@@ -797,7 +823,7 @@
desc->buf1 = 0;
desc->info = 0;
desc += scale;
-@@ -674,7 +1012,7 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
+@@ -674,7 +1024,7 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
if (!desc)
continue;
@@ -806,7 +832,7 @@
}
if (mtk_wed_poll_busy(dev))
-@@ -692,6 +1030,8 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
+@@ -692,6 +1042,8 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_RX);
wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
@@ -815,7 +841,7 @@
if (busy) {
mtk_wed_reset(dev, MTK_WED_RESET_WDMA_INT_AGENT);
mtk_wed_reset(dev, MTK_WED_RESET_WDMA_RX_DRV);
-@@ -729,9 +1069,24 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
+@@ -729,9 +1081,24 @@ mtk_wed_reset_dma(struct mtk_wed_device *dev)
}
@@ -841,7 +867,7 @@
{
ring->desc = dma_alloc_coherent(dev->hw->dev,
size * sizeof(*ring->desc) * scale,
-@@ -740,17 +1095,18 @@ mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
+@@ -740,17 +1107,18 @@ mtk_wed_ring_alloc(struct mtk_wed_device *dev, struct mtk_wed_ring *ring,
return -ENOMEM;
ring->size = size;
@@ -863,7 +889,7 @@
return -ENOMEM;
wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
-@@ -767,22 +1123,143 @@ mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
+@@ -767,22 +1135,146 @@ mtk_wed_wdma_ring_setup(struct mtk_wed_device *dev, int idx, int size)
return 0;
}
@@ -970,6 +996,9 @@
+ if (dev->ver == MTK_WED_V1)
+ return 0;
+
++ if (WARN_ON(!wo))
++ return -ENODEV;
++
+ return mtk_wed_mcu_send_msg(wo, MODULE_ID_WO, cmd_id, data, len, true);
+}
+
@@ -1013,7 +1042,7 @@
mtk_wed_set_ext_int(dev, true);
if (dev->ver == MTK_WED_V1) {
-@@ -797,8 +1274,20 @@ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
+@@ -797,8 +1289,20 @@ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
val |= BIT(0);
regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
} else {
@@ -1035,7 +1064,7 @@
mtk_wed_dma_enable(dev);
dev->running = true;
-@@ -809,6 +1298,7 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+@@ -809,6 +1313,7 @@ mtk_wed_attach(struct mtk_wed_device *dev)
__releases(RCU)
{
struct mtk_wed_hw *hw;
@@ -1043,7 +1072,7 @@
u16 ver;
int ret = 0;
-@@ -829,6 +1319,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+@@ -829,6 +1334,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
goto out;
}
@@ -1056,7 +1085,7 @@
dev->hw = hw;
dev->dev = hw->dev;
dev->irq = hw->irq;
-@@ -847,9 +1343,17 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+@@ -847,9 +1358,17 @@ mtk_wed_attach(struct mtk_wed_device *dev)
dev->rev_id = ((dev->ver << 28) | ver << 16);
ret = mtk_wed_buffer_alloc(dev);
@@ -1077,7 +1106,7 @@
}
mtk_wed_hw_init_early(dev);
-@@ -857,7 +1361,12 @@ mtk_wed_attach(struct mtk_wed_device *dev)
+@@ -857,7 +1376,14 @@ mtk_wed_attach(struct mtk_wed_device *dev)
if (dev->ver == MTK_WED_V1)
regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
BIT(hw->index), 0);
@@ -1085,12 +1114,14 @@
+ ret = mtk_wed_wo_init(hw);
+error:
-+ if (ret)
-+ mtk_wed_detach(dev);
++ if (ret) {
++ dev_err(dev->hw->dev, "failed to attach wed device\n");
++ __mtk_wed_detach(dev);
++ }
out:
mutex_unlock(&hw_lock);
-@@ -883,10 +1392,10 @@ mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
+@@ -883,10 +1409,10 @@ mtk_wed_tx_ring_setup(struct mtk_wed_device *dev, int idx, void __iomem *regs)
BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
@@ -1103,7 +1134,7 @@
return -ENOMEM;
ring->reg_base = MTK_WED_RING_TX(idx);
-@@ -933,6 +1442,35 @@ mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
+@@ -933,6 +1459,35 @@ mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
return 0;
}
@@ -1139,7 +1170,7 @@
static u32
mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
{
-@@ -1020,6 +1558,8 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1020,6 +1575,8 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
.attach = mtk_wed_attach,
.tx_ring_setup = mtk_wed_tx_ring_setup,
.txfree_ring_setup = mtk_wed_txfree_ring_setup,
@@ -1148,7 +1179,7 @@
.start = mtk_wed_start,
.stop = mtk_wed_stop,
.reset_dma = mtk_wed_reset_dma,
-@@ -1028,6 +1568,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1028,6 +1585,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
.irq_get = mtk_wed_irq_get,
.irq_set_mask = mtk_wed_irq_set_mask,
.detach = mtk_wed_detach,
@@ -1156,7 +1187,7 @@
};
struct device_node *eth_np = eth->dev->of_node;
struct platform_device *pdev;
-@@ -1067,6 +1608,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1067,6 +1625,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
hw->wdma_phy = wdma_phy;
hw->index = index;
hw->irq = irq;
@@ -1164,7 +1195,7 @@
if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
-@@ -1083,6 +1625,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
+@@ -1083,6 +1642,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth,
regmap_write(hw->mirror, 0, 0);
regmap_write(hw->mirror, 4, 0);
}
@@ -1277,10 +1308,10 @@
#endif
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_ccif.c b/drivers/net/ethernet/mediatek/mtk_wed_ccif.c
new file mode 100644
-index 0000000..951278b
+index 0000000..f46ce95
--- /dev/null
+++ b/drivers/net/ethernet/mediatek/mtk_wed_ccif.c
-@@ -0,0 +1,133 @@
+@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/soc/mediatek/mtk_wed.h>
@@ -1340,13 +1371,13 @@
+ if (!np)
+ return -ENODEV;
+
-+ regs = syscon_regmap_lookup_by_phandle(np, NULL);
-+ if (!regs)
-+ return -ENODEV;
++ wo->ccif.regs = syscon_regmap_lookup_by_phandle(np, NULL);
++ if (IS_ERR(wo->ccif.regs)) {
++ ret = PTR_ERR(wo->ccif.regs);
++ goto error_put;
++ }
+
+ wo->drv_ops = &wo_drv_ops;
-+
-+ wo->ccif.regs = regs;
+ wo->ccif.irq = irq_of_parse_and_map(np, 0);
+
+ spin_lock_init(&wo->ccif.irq_lock);
@@ -1396,6 +1427,8 @@
+free_irq:
+ free_irq(wo->ccif.irq, wo);
+
++error_put:
++ of_node_put(np);
+ return ret;
+}
+