Further testing proved that multi-channel AP+STA
on QCA6174 with RM.2.0-00088 should have powersave
force-disabled to avoid beacon misses/skipping on
either side which in turn could disrupt
communication.
Since AP never has arvif->ps don't even bother
checking it. Other combinations may be broken as
well so disallow powersave with multivif outright
unless firmware advertises otherwise.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
mac80211 already does provide complete IEs for
Probe Requests for hw scan and ath10k firmware was
appending duplicate Supported Rates IEs
unnecessarily.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
In commit 418ca5992e ("ath10k: Make target cpu address to
CE address conversion chip specific") mask 0x7fff is added
by mistake instead of 0x7ff. Fix this regression.
Fixes: 418ca5992e ("ath10k: Make target cpu address to CE address conversion chip specific")
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
commit a521ee983d ("ath10k: Add new reg_address/mask to hw register
table") broke QCA61x4 support by providing wrong
fw_indicator_address, which should have been 0x0003a028 instead of 0x00009028.
User experience was a failing boot up sequence (crashing device during
initialization):
[ 181.663874] ath10k_pci 0000:02:00.0: enabling device (0000 -> 0002)
[ 181.664787] ath10k_pci 0000:02:00.0: pci irq msi-x interrupts 8 irq_mode 0 reset_mode 0
[ 181.688886] ath10k_pci 0000:02:00.0: device has crashed during init
[ 181.688897] ath10k_pci 0000:02:00.0: failed to wait for target after cold reset: -70
[ 181.688902] ath10k_pci 0000:02:00.0: failed to reset chip: -70
[ 181.689774] ath10k_pci: probe of 0000:02:00.0 failed with error -70
Fix it by updating the address with correct value.
Fixes: a521ee983d ("ath10k: Add new reg_address/mask to hw register table")
Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
iwl_trans_pcie_alloc needs to return a non-zero value
if it fails. Otherwise the iwl_drv_start will think that
the allocation succeeded.
Remove the duplication of err and ret variable and use ret
which is the name we usually use in other places of the
driver.
Fixes: c278754a21e6 ("iwlwifi: mvm: support family 8000 B2/C steps")
CC: <stable@vger.kernel.org> [4.1]
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
While cleanig the access to those hw-dependent registers,
instead of using the product family type, wrong condition was added
mistakenly and enabled 8000 family devices a forbidden access
to HW registers, fix it.
Fixes: 95411d0455 ("iwlwifi: pcie: Control access to the NIC's PM registers via iwl_cfg")
Signed-off-by: Dreyfuss, Haim <haim.dreyfuss@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Pre qca99X0 chipsets follows the model where dynamically allocate
memory for frag desc on getting new skb for TX. But, this is not
going to be the case in qca99X0. It expects frag desc memory to be
allocated at boot time and let the driver to reuse allocated memory
after every TX completion. So there won't be any dynamic frag memory
memory allocation in qca99X0 during data transmission.
qca99X0 hardware doesn't need fragment desc address to be programmed
in msdu descriptor for every data transaction. It needs to know only
starting address of fragment descriptor at the time of the boot.
During data transmission, qca99X0 hardware can retrieve corresponding
frag addr by adding programmed frag desc base addr + msdu id.
Allocate continuous fragment descriptor memory (same size as number of
descriptor) at the time of target initialization and configure allocated
dma address to the target via HTT_H2T_MSG_TYPE_FRAG_DESC_BANK_CFG.
How this is allocated continuous memory is going to be used is not
covered in this patch. It just allocates memory and hand over to firmware.
If we don't do it at init time, qca99X0 will stall when firmware tries
to do TX.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
10.4 fw supports upto 4 spatial stream. Limit max spatial
stream to 4 for 10.4 firmware and to 3 for non 10.4 firmware.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
10.4 fw supports upto 16 interface in ap mode and 1 interface
in station mode, overall total interfaces supported are 16
interfaces. Populate this limit in wiphy->iface_combinations.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
New htt event table is added for 10.4 firmware. Following new htt
events are available only 10.4. adding this to generic htt event
table,
HTT_T2H_MSG_TYPE_EN_STATS,
HTT_T2H_MSG_TYPE_TX_FETCH_IND,
HTT_T2H_MSG_TYPE_TX_FETCH_CONF,
HTT_T2H_MSG_TYPE_TX_LOW_LATENCY_IND
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Existing non 10.4 firmware scan related events and commands are
matching with 10.4 firmware (except chan info event). Link general
start scan,stop scan, scan channel list configuration functions
to 10.4 wmi function table and add a new handler to parse 10.4
specific chan info event.
10.4 firmware has extra scan completion reason
WMI_SCAN_REASON_INTERNAL_FAILURE and new scan event
WMI_SCAN_EVENT_FOREIGN_CHANNEL_EXIT compared to previous firmware
versions. These things are added in respective enum.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Most of existing vdev and peer related functions (vdev create,
vdev delete, vdev start, peer create, peer delete, peer flush, etc)
are reusable for 10.4 firmware. Link those general vdev and peer
functions to 10.4 wmi function table.
Existing general pktlog enable/disable, dbglog configuration functions
are reusable for 10.4 and add them also in wmi function table.
Also handle few wmi events (sevice rdy, echo, dbg msg, tbtt offset
update, dbg print) in ath10k_wmi_10_4_op_rx(). wow event is not
applicable in 10.4 firmware, have it under not implemented print.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
10.4 firmware swba event payload has space to accommodate upto
512 client traffic indication info & one p2p noa descriptor.
It's is not matching with exiting swba event format defined for
non 10.4 firmware. Non 10.4 firmware swba event format is designed
to support only upto only 128 client and four p2p notice of absence
descriptor.
following changes are done in this patch to enable ath10k to handle
10.4 firmware swba event,
- link generic ath10k_wmi_event_host_swba() to handle 10.4 swba
event in 10.4 wmi rx handler.
- add 10.4 specific swba event structure wmi_10_4_host_swba_event.
- new function ath10k_wmi_10_4_op_pull_swba_ev() to parse
10.4 swba event.
- increase tim_bitmap[] size in ath10k_vif to 64 to hold 512 station
power save state.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Due to 512 client support in 10.4 firmware, size of tim ie is going
to be slightly higher than non 10.4 firmware. So, size of tim_bitmap
what is carried in swba event from 10.4 firmware is bit higher.
The only bottle neck to reuse existing swba handler
ath10k_wmi_event_host_swba() for 10.4 is that code designed to deal
with fixed size tim bitmap(ie, tim_info[].tim_bitmap in wmi_swba_ev_arg).
This patch removes such size limitation and makes it more suitable
to handle swba event which has different size tim bitmap.
All existing swba event parsing functions are changed to adapt this
change. Actual support to handle 10.4 swba event is added in next patch.
Only preparation is made in this patch.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Pull module updates from Rusty Russell:
"Main excitement here is Peter Zijlstra's lockless rbtree optimization
to speed module address lookup. He found some abusers of the module
lock doing that too.
A little bit of parameter work here too; including Dan Streetman's
breaking up the big param mutex so writing a parameter can load
another module (yeah, really). Unfortunately that broke the usual
suspects, !CONFIG_MODULES and !CONFIG_SYSFS, so those fixes were
appended too"
* tag 'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (26 commits)
modules: only use mod->param_lock if CONFIG_MODULES
param: fix module param locks when !CONFIG_SYSFS.
rcu: merge fix for Convert ACCESS_ONCE() to READ_ONCE() and WRITE_ONCE()
module: add per-module param_lock
module: make perm const
params: suppress unused variable error, warn once just in case code changes.
modules: clarify CONFIG_MODULE_COMPRESS help, suggest 'N'.
kernel/module.c: avoid ifdefs for sig_enforce declaration
kernel/workqueue.c: remove ifdefs over wq_power_efficient
kernel/params.c: export param_ops_bool_enable_only
kernel/params.c: generalize bool_enable_only
kernel/module.c: use generic module param operaters for sig_enforce
kernel/params: constify struct kernel_param_ops uses
sysfs: tightened sysfs permission checks
module: Rework module_addr_{min,max}
module: Use __module_address() for module_address_lookup()
module: Make the mod_tree stuff conditional on PERF_EVENTS || TRACING
module: Optimize __module_address() using a latched RB-tree
rbtree: Implement generic latch_tree
seqlock: Introduce raw_read_seqcount_latch()
...
privacy settings might change while AP is running.
Inside wil_cfg80211_change_beacon(), detect change
in privacy settings and handle it by stopping and
re-starting the AP.
Firmware cannot handle on-the-fly privacy settings
change and so AP restart is required.
Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com>
Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
In the PRI detector, after the current radar pulse
has been checked agains existing PRI sequences, it
is considered as part of a new potential sequence.
Previously, the condition to accept a new sequence
was to have at least the same number of pulses as
the longest matching sequence. This was wrong,
since it led to duplicates of PRI sequences.
This patch changes the acceptance criteria for new
potential sequences from 'at least' to 'more than'
the longest existing.
Detection performance remains unaffected, while
the number of PRI sequences accounted at runtime
(and with it CPU load) is reduced by up to 50%.
Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Reuse existing function ath10k_wmi_op_pull_rdy_ev()
to parse WMI_10_4_READY_EVENTID and handle the same
event in ath10k_wmi_10_4_op_rx().
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
10.4 firmware supports upto 512 clients when qcache feature is enabled.
Make adjustment on default max peer count, active peers, number of tid in
such case to meet qcache requirement. 10.4 fw has extra unit info flag
NUM_UNITS_IS_NUM_ACTIVE_PEERS which is also handled in this patch.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
10.4 firmware wmi mgmt rx event format differs from non 10.4
firmware and changing existing wmi mgmt rx event parsing function
ath10k_wmi_op_pull_mgmt_rx_ev() for 10.4 would add more complex.
This patch adds new function to receive any wmi rx event from
10.4 firmware and also introduce new function to parse wmi mgmt
rx event.
In addition, fw main branch service rdy event parsing function
is linked in wmi ops table.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Define 10.4 wmi init command structure and introduce new function
ath10k_wmi_10_4_op_gen_init() to fill default values for each field
which goes as part of wmi init cmd to 10.4 firmware.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Include 10.4 firmware wmi pdev cmd id and prepare wmi vdev map
table wmi_10_4_pdev_param_map and update non 10.4 firmware
pdev cmd map table with newly added vdev cmd id specifically for
10.4 firmware as unsupported.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Include 10.4 firmware wmi vdev cmd id and make up wmi vdev map
table wmi_10_4_vdev_param_map and also update non 10.4 firmware
vdev cmd map table with newly added vdev cmd id specifically for
10.4 firmware as unsupported.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
In fact, explicit assigned to ZERO for unsupported wmi commands
are not really needed. Global static variable will have ZERO by
default. However, just for better readability setting all wmi cmds
in non 10.4 firmware wmi mapping table as unsupported for wmi cmd
which are exclusively available only in 10.4 firmware.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
10.4 firmware wmi cmd and event id values are not exactly aligned
with previous firmware versions (main, 10.x, 10.2, etc). Add new
enum to define wmi cmd & event definitions for 10.4 firmware and
prepare wmi_10_4_cmd_map based on 10.4 firmware wmi cmd definitions.
wmi_cmd_map is extended to accommodate new wmi commands which are
exclusively available in 10.4 firmware.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Include new enum to define wmi service bitmap definitions for
10.4 firmware and a function wmi_10_4_svc_map() to remap 10.4
firmware wmi service bitmap definitions to ath10k generic wmi
services.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
qca99X0 chip uses firmware version 10.4. Define a new macro
ATH10K_FW_WMI_OP_VERSION_10_4 for 10.4 firmware and include
in switch cases where ATH10K_FW_WMI_OP_VERSION_* is used
to avoid compilation error.
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
BMI parameter value to execute downloaded otp binary
is different for QCA99X0. Have a member in hw_params
to hold hw specific BMI param.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Code swap is a mechanism to use host memory to store
some fw binary code segment. Ath10k host driver allocates
and loads the code swap binary into the host memory and
configures the target with the host allocated memory
information at the address taken from code swap binary.
This patch adds code swap support for firmware binary.
Code swap binary for firmware bin is available in
ATH10K_FW_IE_FW_CODE_SWAP_IMAGE.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
There is more than 1 sec delay in getting response from target
through BMI in QCA99X0. Increase the BMI communication timeout
to 2*HZ to fix BMI failures.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
QCA99X0 uses two new copy engine src desc flags for interrupt
indication. Bit_2 is to mark if host interrupt is disabled after
processing the current desc and bit_3 is to mark if target interrupt
is diabled after the processing of current descriptor.
CE_DESC_FLAGS_META_DATA_MASK and CE_DESC_FLAGS_META_DATA_LSB are based
on the target type.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
QCA99X0 supports only cold reset. Also, made
ath10k_pci_irq_msi_fw_mask() and ath10k_pci_irq_msi_fw_unmask()
non-99X0 specific till we get proper register configuration
to mask/unmask irq/MSI.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Make the helper converting target virtual address space to CE address
space a target type specific to support QCA99X0. Also make this as
function instead of macro.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
QCA99X0 supports upto 12 Copy engines. Host and target
CE configuration table is updated to support new copy engine
pipes. This also fixes the assumption of diagnostic CE by making
CE_7 as the one instead of CE_COUNT - 1.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This is to prepare the driver for QCA99X0 chip support.
This commit adds hw_params, hw register table and hw_values
table for QCA99X0 chip. Please note this is only a partial patch adding
support for QCA99X0, so the device id is not yet added to pci device
table.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Add more register address and mask which can be different
for newer chip to hw_reg table.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This is to prepare ath10k to support newer chip set.
Values like CE_COUNT, MSI_ASSIGN_CE_MAX and
RTC_STATE_V_ON can be different for different
chips.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Sometimes when setting an igtk key the station maybe NULL.
In the of case igtk the function will skip to the end, and
try to print sta->addr, if sta is Null - we will access a
Null pointer.
Avoid accessing a Null pointer when setting a igtk key &
the sta == NULL, and print a default MAC address instead.
Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
When BT is active, we want to avoid the shared antenna for
management frame to make sure we don't disturb BT. There
was a bug in that code because it chose the antenna
BIT(ANT_A) where ANT_A is already a bitmap (0x1). This
means that the antenna chosen in the end was ANT_B.
While this is not optimal on devices with 2 antennas (it'd
disturb BT), it is critical on single antenna devices like
3160 which couldn't connect at all when BT was active.
This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=97181
CC: <stable@vger.kernel.org> [3.17+]
Fixes: 34c8b24ff2 ("iwlwifi: mvm: BT Coex - avoid the shared antenna for management frames")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This allows to ensure that we don't have races between them.
A user reported that stop_device was called twice upon
rfkill interrupt after suspend. When the interrupts are
enabled, and right after when we directly check the rfkill
state.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
The new locking in PCIe transport requires to start_hw
before start_fw. This uncovered a bug in dvm which failed
to do so.
Fix that.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This firmware is not supported anymore - stop loading this firmware.
Remove code handling older versions.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
There's no need to forward RX MPDUs to notification wait tests, nor
do we need to check them for firmware dump triggers, nor could they
be asynchronous. It's thus more efficient to handle them separately,
before going into the regular RX handlers.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
In scenarios where we haven't converged yet to a specific modulation
and rate it could be better to report to userspace the last tx rate
based on the STA capabilities and RSSI. This is important as sometimes
userspace displays the last tx rate as the link speed.
This avoids being presented with low legacy rates when rs just begins
its search or after an idle period in which it resets itself.
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Kalle Valo says:
====================
Major changes:
mwifiex:
* enhancements for AP mode: support verbose information in station
dump command and also information about AP link.
* enable power save by default
brcmfmac:
* fix module reload issue for PCIe
* improving msgbuf protocol for PCIe devices
* rework .get_station() cfg80211 callback operation
* determine interface combinations upon device feature support
ath9k:
* ath9k_htc: add support of channel switch
wil6210:
* add modparam for bcast ring size
* support hidden SSID
* add per-MCS Rx stats
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Add a "param_lock" mutex to each module, and update params.c to use
the correct built-in or module mutex while locking kernel params.
Remove the kparam_block_sysfs_r/w() macros, replace them with direct
calls to kernel_param_[un]lock(module).
The kernel param code currently uses a single mutex to protect
modification of any and all kernel params. While this generally works,
there is one specific problem with it; a module callback function
cannot safely load another module, i.e. with request_module() or even
with indirect calls such as crypto_has_alg(). If the module to be
loaded has any of its params configured (e.g. with a /etc/modprobe.d/*
config file), then the attempt will result in a deadlock between the
first module param callback waiting for modprobe, and modprobe trying to
lock the single kernel param mutex to set the new module's param.
This fixes that by using per-module mutexes, so that each individual module
is protected against concurrent changes in its own kernel params, but is
not blocked by changes to other module params. All built-in modules
continue to use the built-in mutex, since they will always be loaded at
runtime and references (e.g. request_module(), crypto_has_alg()) to them
will never cause load-time param changing.
This also simplifies the interface used by modules to block sysfs access
to their params; while there are currently functions to block and unblock
sysfs param access which are split up by read and write and expect a single
kernel param to be passed, their actual operation is identical and applies
to all params, not just the one passed to them; they simply lock and unlock
the global param mutex. They are replaced with direct calls to
kernel_param_[un]lock(THIS_MODULE), which locks THIS_MODULE's param_lock, or
if the module is built-in, it locks the built-in mutex.
Suggested-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Dan Streetman <ddstreet@ieee.org>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
wait_event_timeout(), introduced in 'commit 5e3dd157d7 ("ath10k: mac80211
driver for Qualcomm Atheros 802.11ac CQA98xx devices")' never returns < 0
so the only failure condition to be checked is == 0 (timeout). Further the
return type is long not int - an appropriately named variable is added
and the assignments fixed up.
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
wait_event_timeout(), introduced in 'commit 5e3dd157d7 ("ath10k: mac80211
driver for Qualcomm Atheros 802.11ac CQA98xx devices")' never returns < 0
so the only failure condition to be checked is ==0 (timeout). Further the
return type is long not int - an appropriately named variable is added
and the assignments fixed up.
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
It was possible to force an out of bounds MMIO
read/write via debugfs. E.g. on QCA988X this could
be triggered with:
echo 0x2080e0 | tee /sys/kernel/debug/ieee80211/*/ath10k/reg_addr
cat /sys/kernel/debug/ieee80211/*/ath10k/reg_value
BUG: unable to handle kernel paging request at ffffc90001e080e0
IP: [<ffffffff8135c860>] ioread32+0x40/0x50
...
Call Trace:
[<ffffffffa00d0c7f>] ? ath10k_pci_read32+0x4f/0x70 [ath10k_pci]
[<ffffffffa0080f50>] ath10k_reg_value_read+0x90/0xf0 [ath10k_core]
[<ffffffff8115c2c1>] ? handle_mm_fault+0xa91/0x1050
[<ffffffff81189758>] __vfs_read+0x28/0xe0
[<ffffffff812e4694>] ? security_file_permission+0x84/0xa0
[<ffffffff81189ce3>] ? rw_verify_area+0x53/0x100
[<ffffffff81189e1a>] vfs_read+0x8a/0x140
[<ffffffff8118acb9>] SyS_read+0x49/0xb0
[<ffffffff8104e39c>] ? trace_do_page_fault+0x3c/0xc0
[<ffffffff8196596e>] system_call_fastpath+0x12/0x71
Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
