Emmanuel Grumbach (1): wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
Johannes Berg (1): iwlwifi: mvm: move iwl_mvm_stop_device() out of line
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 11 +---------- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 10 deletions(-)
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/12678 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/M...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/12678 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/M...
From: Johannes Berg johannes.berg@intel.com
mainline inclusion from mainline-v5.11-rc1 commit cf5b462768474c783cf40f6408a038540917088a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU87 CVE: CVE-2024-47673
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
This function has grown quite a bit over time, move it out of line before we grow it even further.
Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Luca Coelho luciano.coelho@intel.com Link: https://lore.kernel.org/r/iwlwifi.20201209231352.1a0211e66906.I572eb69dc3738... Signed-off-by: Luca Coelho luciano.coelho@intel.com Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com --- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 11 +---------- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h index 8b779c3..35be82e 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h @@ -1948,16 +1948,7 @@ static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm) ~BIT(IWL_MVM_DQA_CMD_QUEUE)); }
-static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm) -{ - lockdep_assert_held(&mvm->mutex); - iwl_fw_cancel_timestamp(&mvm->fwrt); - clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status); - iwl_fw_dbg_stop_sync(&mvm->fwrt); - iwl_trans_stop_device(mvm->trans); - iwl_free_fw_paging(&mvm->fwrt); - iwl_fw_dump_conf_clear(&mvm->fwrt); -} +void iwl_mvm_stop_device(struct iwl_mvm *mvm);
/* Re-configure the SCD for a queue that has already been configured */ int iwl_mvm_reconfig_scd(struct iwl_mvm *mvm, int queue, int fifo, int sta_id, diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c index 3548eb5..93d9c70 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c @@ -902,6 +902,20 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg, return NULL; }
+void iwl_mvm_stop_device(struct iwl_mvm *mvm) +{ + lockdep_assert_held(&mvm->mutex); + + iwl_fw_cancel_timestamp(&mvm->fwrt); + + clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status); + + iwl_fw_dbg_stop_sync(&mvm->fwrt); + iwl_trans_stop_device(mvm->trans); + iwl_free_fw_paging(&mvm->fwrt); + iwl_fw_dump_conf_clear(&mvm->fwrt); +} + static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode) { struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
From: Emmanuel Grumbach emmanuel.grumbach@intel.com
mainline inclusion from mainline-v6.11-rc6 commit 0668ebc8c2282ca1e7eb96092a347baefffb5fe7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU87 CVE: CVE-2024-47673
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Not doing so will make us send a host command to the transport while the firmware is not alive, which will trigger a WARNING.
bad state = 0 WARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] Call Trace: <TASK> iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm] iwl_mvm_config_scan+0x198/0x260 [iwlmvm] iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm] iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm] process_one_work+0x29e/0x640 worker_thread+0x2df/0x690 ? rescuer_thread+0x540/0x540 kthread+0x192/0x1e0 ? set_kthread_struct+0x90/0x90 ret_from_fork+0x22/0x30
Signed-off-by: Emmanuel Grumbach emmanuel.grumbach@intel.com Signed-off-by: Miri Korenblit miriam.rachel.korenblit@intel.com Link: https://patch.msgid.link/20240825191257.5abe71ca1b6b.I97a968cb8be1f24f94652d... Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com --- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c index 93d9c70..1568898 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c @@ -910,6 +910,8 @@ void iwl_mvm_stop_device(struct iwl_mvm *mvm)
clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
+ iwl_mvm_pause_tcm(mvm, false); + iwl_fw_dbg_stop_sync(&mvm->fwrt); iwl_trans_stop_device(mvm->trans); iwl_free_fw_paging(&mvm->fwrt);
-
patchwork bot -
Zhang Changzhong