summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-05-07ath10k: Use struct_size() helperGustavo A. R. Silva1-3/+1
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*rx) + (sizeof(struct htt_rx_indication_mpdu_range) * num_mpdu_ranges) to : struct_size(rx, mpdu_ranges, num_mpdu_ranges) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: Fix encoding for protected management framesRakesh Pillai1-1/+3
Currently the protected management frames are not appended with the MIC_LEN which results in the protected management frames being encoded incorrectly. Add the extra space at the end of the protected management frames to fix this encoding error for the protected management frames. Tested HW: WCN3990 Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Fixes: 1807da49733e ("ath10k: wmi: add management tx by reference support over wmi") Signed-off-by: Rakesh Pillai <pillair@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: rx_duration update for fw_stats debugfs entryBalaji Pothunoori3-7/+35
Currently instant rx_duration always fetching as zero in fw_stats debugfs entry if extended peer stats event supports. This patch updates instant rx_duration in fw_stats entry based on extended peer stats and maintaining backward compatibility for 10.2/10.x. Tested HW: QCA9984. Tested FW: 10.4-3.6.0.1-00004. Signed-off-by: Balaji Pothunoori <bpothuno@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: Fix the tx stats bytes & packets parsingBrandon Huang1-3/+3
In tx_stats debugfs, txrate->flags may contain multiple bits. For example, RATE_INFO_FLAGS_SHORT_GI could be set, and tx stats bytes and packets will be not updated correctly. Fix this issue by using bit operation to check txrate->flags. Tested HW: QCA9984 Tested Firmware: 10.4-3.9.0.1-00007 Signed-off-by: Brandon Huang <yanghuan@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: Modify CE4 src buffer entries to 2048 for WCN3990Govind Singh1-1/+1
CE4 is host to target HTT tx pipe, tx completion are not served on time when CPU is loaded and this cause ce src ring full condition due to less no of src buffer entries. To mitigate the issue increase CE4 src buffer entries to 2048. Testing: Tested on QCS404 platform(WCN3990 HW) Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1 Signed-off-by: Govind Singh <govinds@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: Move board id and fw version logging to info levelGovind Singh1-7/+8
Board id and fw version is not printed by default in qmi cap response message. Move board id and fw version logging to info level for default logging. [ 34.005399] ath10k_snoc a000000.wifi: qmi chip_id 0x30b chip_family 0x4001 board_id 0xff soc_id 0x40070000 [ 34.005432] ath10k_snoc a000000.wifi: qmi fw_version 0x3106836b fw_build_timestamp 2019-02-13 10:24 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HL.3.1-00875-QCAHLSWMTPL-1 Signed-off-by: Govind Singh <govinds@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: Added support to reset HTT stats in debugfsMaharaja Kennadyrajan4-4/+48
Reset HTT stats helps to get the aggregated HTT stats via tracing and also we can clear the accumulated HTT stats with this debugfs file. Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-07ath10k: Extended the HTT stats support to retrieve Mu-MIMO related statsMaharaja Kennadyrajan3-7/+8
Extended the bit mask value of the HTT stats to get the Mu-MIMO related stats via tracing. Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: remove HALP for Talyn devicesMaya Erez1-0/+6
In Talyn the HW is responsible for power management enter / exit flow, hence the deep sleep exit latency is significantly shorter than in Sparrow. In such a case HALP feature, that is meant to prevent long PCIe blocking accesses, is no longer needed and can be removed for Talyn. Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: check rx_buff_mgmt before accessing itDedy Lansky1-0/+3
Make sure rx_buff_mgmt is initialized before accessing it. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: fix missed MISC mbox interruptMaya Erez1-1/+1
When MISC interrupt is triggered due to HALP bit, in parallel to mbox events handling by the MISC threaded IRQ, new mbox interrupt can be missed in the following scenario: 1. MISC ICR is read in the IRQ handler 2. Threaded IRQ is completed and all MISC interrupts are unmasked 3. mbox interrupt is set by FW 4. HALP is masked The mbox interrupt in step 3 can be missed due to constant high level of ICM. Masking all MISC IRQs instead of masking only HALP bit in step 4 will guarantee that ICM will drop to 0 and interrupt will be triggered once MISC interrupts will be unmasked. Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: fix overwriting max_assoc_sta module paramAhmad Masri8-46/+49
Save the parameter of max_assoc_sta per device. On fw_ready event calculate the max_assoc_sta and save it per device, do not overwrite the max_assoc_sta module param. Signed-off-by: Ahmad Masri <amasri@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: enhancements for descriptor and status ring debugfsDedy Lansky2-12/+45
Add printing of hwhead as part of desc ring and status ring debugfs. Validate wil->rx_buff_mgmt and ring->ctx arrays before accessing them. Dump Tx descriptor content even when it indicates invalid buff_id. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: add support for multiple sections in brd fileMaya Erez4-45/+126
Current board file loading procedure assumes that the board file includes only one section. New board files can include multiple sections. Add the ability to read multiple addresses and max size from FW file and load multiple sections from the board file into those addresses. Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: add printout of platform capabilitiesDedy Lansky1-0/+2
Add logging of the platform capabilities after retrieving it from the platform driver. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: fix _desc access in __wil_tx_vring_tsoAlexei Avshalom Lazar1-0/+3
_desc is defined in __wil_tx_vring_tso() and may not be set in case len is 0, verify _desc is set. Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org> Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-05-03wil6210: fix spurious interrupts in 3-msiMaya Erez1-25/+40
Interrupt is set in ICM (ICR & ~IMV) rising trigger. As the driver masks the IRQ after clearing it, there can be a race where an additional spurious interrupt is triggered when the driver unmask the IRQ. This can happen in case HW triggers an interrupt after the clear and before the mask. To prevent the second spurious interrupt the driver needs to mask the IRQ before reading and clearing it. Signed-off-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29wireless: carl9170: fix clang build warningArnd Bergmann2-2/+2
clang fails to eliminate some dead code with always-taken branches when CONFIG_PROFILE_ANNOTATED_BRANCHES is set, leading to a false-positive warning: drivers/net/wireless/ath/carl9170/mac.c:522:3: error: variable 'power' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] BUG_ON(1); ^~~~~~~~~ Change both instances of BUG_ON(1) in carl9170 to the simpler BUG() to avoid the warning. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Christian Lamparter <chunkeey@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29wil6210: fix potential out-of-bounds readGustavo A. R. Silva1-0/+1
Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: enum gro_result { GRO_MERGED, GRO_MERGED_FREE, GRO_HELD, GRO_NORMAL, GRO_DROP, GRO_CONSUMED, }; typedef enum gro_result gro_result_t; In case *rc* evaluates to 5, we end up having an out-of-bounds read at drivers/net/wireless/ath/wil6210/txrx.c:821: wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", len, gro_res_str[rc]); Fix this by adding element "GRO_CONSUMED" to array gro_res_str. Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: Maya Erez <merez@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath: DFS JP domain W56 fixed pulse type 3 RADAR detectionAnilkumar Kolli1-1/+1
Increase pulse width range from 1-2usec to 0-4usec. During data traffic HW occasionally fails detecting radar pulses, so that SW cannot get enough radar reports to achieve the success rate. Tested ath10k hw and fw: * QCA9888(10.4-3.5.1-00052) * QCA4019(10.4-3.2.1.1-00017) * QCA9984(10.4-3.6-00104) * QCA988X(10.2.4-1.0-00041) Tested ath9k hw: AR9300 Tested-by: Tamizh chelvam <tamizhr@codeaurora.org> Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org> Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath9k: drop redundant code in ar9003_hw_set_channelTomislav Požega1-21/+3
AR9330, AR9485, AR9531, AR9550, AR9561 and AR9565 all use same channel set register configuration which allows for small code size reduction. Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath: drop duplicated defineTomislav Požega1-1/+0
Remove duplicate NO_CTL that is just 2 lines below. Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath9k: Remove some set but not used variablesYueHaibing1-11/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_count_frames': drivers/net/wireless/ath/ath9k/xmit.c:413:25: warning: variable 'fi' set but not used [-Wunused-but-set-variable] drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_complete_aggr': drivers/net/wireless/ath/ath9k/xmit.c:449:24: warning: variable 'hdr' set but not used [-Wunused-but-set-variable] drivers/net/wireless/ath/ath9k/xmit.c: In function 'ath_tx_start': drivers/net/wireless/ath/ath9k/xmit.c:2274:18: warning: variable 'avp' set but not used [-Wunused-but-set-variable] drivers/net/wireless/ath/ath9k/xmit.c:2269:24: warning: variable 'hdr' set but not used [-Wunused-but-set-variable] These variables are not used any more and can be removed. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath9k: Differentiate between max combined and per chain powerSven Eckelmann5-6/+8
The ath9k driver uses as maximum allowed txpower the constant MAX_RATE_POWER. It is used to set a maximum txpower limit for the PHY (which is combined txpower) and also the maximum txpower for per chain rates. Its value 63 is derived from the maximum number the registers can store for the per chain txpower. The max txpower a user can set because of this is 31 dBm (floor(63 / 2)). This also means that a device with multiple tx chains is even limited further: * 1 chain: 31 dBm per chain * 2 chains: 28 dBm per chain * 3 chains: 26 dBm per chain This combined txpower limit of 31 dBm becomes even more problematic when some extra antenna gain is set in the EEPROM. A high power device is then no longer able to reach its potential limits. Instead the code dealing with the combined txpower must use a higher limit than 63 and only the code dealing with the per chain txpower have to use the limit of 63. Since the antenna gain can be quite large and 8 bit variables are often used in ath9k for txpower, a large, divisible by two number like 254 is a good choice for this new limit. Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath9k: Check for errors when reading SREV registerTim Schumacher1-9/+23
Right now, if an error is encountered during the SREV register read (i.e. an EIO in ath9k_regread()), that error code gets passed all the way to __ath9k_hw_init(), where it is visible during the "Chip rev not supported" message. ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits ath: phy2: Mac Chip Rev 0x0f.3 is not supported by this driver ath: phy2: Unable to initialize hardware; initialization status: -95 ath: phy2: Unable to initialize hardware; initialization status: -95 ath9k_htc: Failed to initialize the device Check for -EIO explicitly in ath9k_hw_read_revisions() and return a boolean based on the success of the operation. Check for that in __ath9k_hw_init() and abort with a more debugging-friendly message if reading the revisions wasn't successful. ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits ath: phy2: Failed to read SREV register ath: phy2: Could not read hardware revision ath: phy2: Unable to initialize hardware; initialization status: -95 ath: phy2: Unable to initialize hardware; initialization status: -95 ath9k_htc: Failed to initialize the device This helps when debugging by directly showing the first point of failure and it could prevent possible errors if a 0x0f.3 revision is ever supported. Signed-off-by: Tim Schumacher <timschumi@gmx.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath9k: Don't trust TX status TID number when reporting airtimeToke Høiland-Jørgensen1-3/+4
As already noted a comment in ath_tx_complete_aggr(), the hardware will occasionally send a TX status with the wrong tid number. If we trust the value, airtime usage will be reported to the wrong AC, which can cause the deficit on that AC to become very low, blocking subsequent attempts to transmit. To fix this, account airtime usage to the TID number from the original skb, instead of the one in the hardware TX status report. Reported-by: Miguel Catalan Cid <miguel.catalan@i2cat.net> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath6kl: remove redundant check of status != 0Colin Ian King1-3/+0
The check on status not being zero is redundant as previous code paths that set status to an error value break out of the while loop and hence status is never non-zero at the check. Remove this redundant code. Addresses-Coverity: ("Logically dead code") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Mukesh Ojha <mojha@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath6kl: add some bounds checkingDan Carpenter1-1/+9
The "ev->traffic_class" and "reply->ac" variables come from the network and they're used as an offset into the wmi->stream_exist_for_ac[] array. Those variables are u8 so they can be 0-255 but the stream_exist_for_ac[] array only has WMM_NUM_AC (4) elements. We need to add a couple bounds checks to prevent array overflows. I also modified one existing check from "if (traffic_class > 3) {" to "if (traffic_class >= WMM_NUM_AC) {" just to make them all consistent. Fixes: bdcd81707973 (" Add ath6kl cleaned up driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath6kl: wmi: use struct_size() helperGustavo A. R. Silva1-2/+1
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace code of the following form: sizeof(*ev) + ev->num_neighbors * sizeof(struct wmi_neighbor_info) with: struct_size(ev, neighbor, ev->num_neighbors) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath6kl: debug: Use struct_size() helperGustavo A. R. Silva1-2/+1
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*tbl) + num_entries * sizeof(struct wmi_bss_roam_info) to : struct_size(tbl, info, num_entries) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath10k: fix incorrect multicast/broadcast rate settingPradeep kumar Chitrapu1-3/+7
Invalid rate code is sent to firmware when multicast rate value of 0 is sent to driver indicating disabled case, causing broken mesh path. so fix that. Tested on QCA9984 with firmware 10.4-3.6.1-00827 Sven tested on IPQ4019 with 10.4-3.5.3-00057 and QCA9888 with 10.4-3.5.3-00053 (ath10k-firmware) and 10.4-3.6-00140 (linux-firmware 2018-12-16-211de167). Fixes: cd93b83ad92 ("ath10k: support for multicast rate control") Co-developed-by: Zhi Chen <zhichen@codeaurora.org> Signed-off-by: Zhi Chen <zhichen@codeaurora.org> Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org> Tested-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath10k: enable QCA6174 hw3.2 SDIO hardwareWen Gong3-1/+29
After implementing PN replay check we can enable SDIO support on QCA6174. Tested with client mode on all security modes, and fragmentation as well. AP mode does not work yet. Also tone down the warning about SDIO being not ready yet. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. AP mode is not working yet. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath10k: add fragmentation handler for high latency devicesWen Gong2-0/+243
On high latency devices (SDIO, USB) ath10k did not handle fragmented frames and all fragmented frames on receive path were lost in ath10k. Even a simple ping test failed with fragmentation. The fragmented packets are decapsulated based on the security mode, then the PN is checked and the fragmented frame is passed to mac80211. mac80211 in ieee80211_rx_h_defragment() will then combine the fragment frames and forward to upper layers. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath10k: add PN replay protection for high latency devicesWen Gong1-2/+95
On high latency devices (SDIO, USB) ath10k did not do PN replay check, a data frame with an invalid PN number was not discard as it should have been. So this patch implements PN replay in ath10k. PN replay check for fragmented frames is implemented in followup patch. With low latency devices (PCI, AHB) hardware can store the data frames's content to host memory directly and the firmware can fully reorder data frames, and do PN replay check at the same time. But for high latency devices all data frames will be received and stored in firmware's memory and it is hard to do full reorder because of the memory size limitations in the firmware. This is why the PN replay protections needs to be implemented in host driver. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath10k: add handler for HTT_T2H_MSG_TYPE_SEC_IND eventWen Gong1-0/+46
Add the handler for HTT_T2H_MSG_TYPE_SEC_IND event from firmware, which stores PN for replay check implemented in the following patch. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-29ath10k: add struct for high latency PN replay protectionWen Gong2-4/+47
Add the struct for PN replay protection and fragment packet handler. Also fix the bitmask of HTT_RX_DESC_HL_INFO_MCAST_BCAST to match what's currently used by SDIO firmware. The defines are not used yet so it's safe to modify them. Remove the conflicting HTT_RX_DESC_HL_INFO_FRAGMENT as it's not either used in ath10k. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: sdio: add missing error checkErik Stromdahl1-0/+5
Although not likely, the bundle allocation might fail. Add proper error check and warning print. Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: add initialization of HTC headerAlagu Sankar1-0/+1
HTC header carries junk values that may be interpreted by the firmware differently. Enable credit update only if flow control is enabled for the corresponding endpoint. Signed-off-by: Alagu Sankar <alagusankar@silex-india.com> Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: fix use-after-free on SDIO data framesKalle Valo1-0/+7
With SDIO there's a use after free after a data frame is transfered, call stack below. This happens because ath10k_htt_tx_hl() directly transmits the skb provided by mac80211 using ath10k_htc_send(), all other HTT functions use separate skb created with ath10k_htc_alloc_skb() to transmit the HTC packet. After the packet is transmitted mac80211 frees the skb in ieee80211_tx_status() but HTT layer expects that it still owns the skb, and frees it in ath10k_htt_htc_tx_complete(). To fix this take a reference of skb before sending it to HTC layer to make sure we still own the skb. Tested on QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. ath10k_htt_tx_hl() is only used by SDIO and USB so other busses (PCI, AHB and SNOC) should be unaffected. call stack of use-after-free: dump_backtrace+0x0/0x2d8 show_stack+0x20/0x2c __dump_stack+0x20/0x28 dump_stack+0xc8/0xec print_address_description+0x74/0x240 kasan_report+0x258/0x274 __asan_report_load4_noabort+0x20/0x28 skb_pull+0xbc/0x114 ath10k_htc_notify_tx_completion+0x190/0x2a4 [ath10k_core] ath10k_sdio_write_async_work+0x1e4/0x2c4 [ath10k_sdio] process_one_work+0x3d8/0x8b0 worker_thread+0x518/0x7e0 kthread+0x260/0x278 ret_from_fork+0x10/0x18 Allocated by one task: kasan_kmalloc+0xa0/0x13c kasan_slab_alloc+0x14/0x1c kmem_cache_alloc+0x144/0x208 __alloc_skb+0xec/0x394 alloc_skb_with_frags+0x8c/0x374 sock_alloc_send_pskb+0x520/0x5d4 sock_alloc_send_skb+0x40/0x50 __ip_append_data+0xf5c/0x1858 ip_make_skb+0x194/0x1d4 udp_sendmsg+0xf24/0x1ab8 inet_sendmsg+0x1b0/0x2e0 sock_sendmsg+0x88/0xa0 __sys_sendto+0x220/0x3a8 __arm64_sys_sendto+0x78/0x80 el0_svc_common+0x120/0x1e0 el0_svc_compat_handler+0x64/0x80 el0_svc_compat+0x8/0x18 Freed by another task: __kasan_slab_free+0x120/0x1d4 kasan_slab_free+0x10/0x1c kmem_cache_free+0x74/0x504 kfree_skbmem+0x88/0xc8 __kfree_skb+0x24/0x2c consume_skb+0x114/0x18c __ieee80211_tx_status+0xb7c/0xf60 [mac80211] ieee80211_tx_status+0x224/0x270 [mac80211] ath10k_txrx_tx_unref+0x564/0x950 [ath10k_core] ath10k_htt_t2h_msg_handler+0x178c/0x2a38 [ath10k_core] ath10k_htt_htc_t2h_msg_handler+0x20/0x30 [ath10k_core] ath10k_sdio_irq_handler+0xcc0/0x1654 [ath10k_sdio] process_sdio_pending_irqs+0xec/0x358 sdio_run_irqs+0x68/0xe4 sdio_irq_work+0x1c/0x28 process_one_work+0x3d8/0x8b0 worker_thread+0x518/0x7e0 kthread+0x260/0x278 ret_from_fork+0x10/0x18 Reported-by: Wen Gong <wgong@codeaurora.org> Tested-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: htt: support MSDU ids with SDIOAlagu Sankar3-1/+15
Transmit completion for SDIO is similar to PCIe, modify the high latency path to allow SDIO modules to use the msdu id. kvalo: the original patch from Alagu enabled this only for SDIO but I'm not sure should we also enable this with USB. I'll use bus params to enable this for so that it's easy to enable also for USB later. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Co-developed-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Alagu Sankar <alagusankar@silex-india.com> Signed-off-by: Wen Gong <wgong@codeaurora.org>. Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: initialise struct ath10k_bus params to zeroKalle Valo5-5/+5
This way we don't need to set every variable and give them to default, which is zero. This is also safer in case we forgot to initalise a new field in some of the bus modules. Compile tested only. Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: htt: don't use txdone_fifo with SDIOAlagu Sankar1-1/+3
HTT High Latency (ATH10K_DEV_TYPE_HL) does not use txdone_fifo at all, we don't even initialise it by skipping ath10k_htt_tx_alloc_buf() in ath10k_htt_tx_start(). Because of this using QCA6174 SDIO ath10k_htt_rx_tx_compl_ind() will crash when it accesses unitialised txdone_fifo. So skip txdone_fifo when using High Latency mode. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Co-developed-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Alagu Sankar <alagusankar@silex-india.com> Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: don't disable interrupts in ath10k_sdio_remove()Wen Gong1-2/+0
Disabling interrupts this early meant WMI communication was not working anymore when the SDIO device was removed. But we call ath10k_core_unregister() that will eventually call ath10k_sdio_hif_stop(), which disables the interrupts. So there's actually no need to disable interrupts here. Also remove cancel_work_sync() as it's also called in ath10k_sdio_hif_stop(). Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-23ath10k: sdio: workaround firmware UART pin configuration bugWen Gong2-1/+14
On QCA6174 SDIO devices the SDIO interrupt will fail if UART is disabled from ath10k. SDIO firmware enables UART printouts by default. If ath10k will try to enable UART again the firmware will configure it's GPIO line incorrectly and SDIO interrupts won't work anymore. The workaround is to set UART pin again (19 for QCA6174 SDIO) if uart_print is 0. Tested with QCA6174 SDIO with firmware WLAN.RMH.4.4.1-00007-QCARMSWP-1. Signed-off-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2019-04-19Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.gitKalle Valo13-117/+330
ath.git patches for 5.2. No major changes.
2019-04-19Merge branch 'net-add-reset-controller-driven-PHY-reset'David S. Miller5-9/+48
David Bauer says: ==================== net: add reset-controller driven PHY reset This patchset adds support for a PHY reset driven by a reset-controller. Currently, only GPIO driven resets are supported by the PHY subsystem. It also renames the reset-gpio from 'reset' to 'reset_gpio' to better differentiate between resets wired to a GPIO and resets wired to a reset-controller driven pin. Some systems have the PHY reset-line wired to a pin controlled by a reset-controller (eg. some Atheros AR9132 based boards). In case the bootloader asserts reset before loading the kernel, we currently do not have a clean way of deasserting reset to probe the PHY. v3: - add missing newline in mdio_bus.c v2: - fixed missed rename of "reset" in at803x.c - move initial reset to mdio_device_reset ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-19net: mdio: rename mdio_device reset to reset_gpioDavid Bauer4-8/+8
This renames the GPIO reset of mdio devices from 'reset' to 'reset_gpio' to better differentiate between GPIO and reset-controller driven reset line. Signed-off-by: David Bauer <mail@david-bauer.net> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-19net: phy: add support for reset-controllerDavid Bauer3-4/+37
This commit adds support for PHY reset pins handled by a reset controller. Signed-off-by: David Bauer <mail@david-bauer.net> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-19dt-bindings: net: add PHY reset controller bindingDavid Bauer1-0/+6
Add the documentation for PHY reset lines controlled by a reset controller. Signed-off-by: David Bauer <mail@david-bauer.net> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-19Merge branch 'net-some-build-fixes-and-other-improvements'David S. Miller5-18/+15
Jakub Kicinski says: ==================== net: some build fixes and other improvements A few unrelated improvements here, mostly trying to make random configs build and W=1 produce a little less warnings under net/ and drivers net/. First two patches fix set but not used warnings with W=1. Next patch fixes 64bit division in sch_taprio.c. Last two patches are getting rid of some (almost) unused asserts in skbuff.h. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>