[PATCH 0/5] ath9k bug fixes

[PATCH 0/5] ath9k bug fixes

[miaoqing]

From: Miaoqing Pan <miaoqing@codeaurora.org>

ath9k bug fixes

Miaoqing Pan (5):
  ath9k: avoid ANI restart if no trigger
  ath9k: clean up ANI per-channel pointer checking
  ath9k: do not reset while BB panic(0x4000409) on ar9561
  ath9k: fix inconsistent use of tab and space in indentation
  ath9k: fix data bus error on ar9300 and ar9580

 drivers/net/wireless/ath/ath9k/ani.c           | 36 +++++++-------------------
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c |  6 ++---
 drivers/net/wireless/ath/ath9k/ar9003_phy.c    |  5 ++--
 drivers/net/wireless/ath/ath9k/hw.c            | 10 +++++++
 drivers/net/wireless/ath/ath9k/reg.h           |  4 ++-
 5 files changed, 28 insertions(+), 33 deletions(-)

-- 
1.9.1

[PATCH 1/5] ath9k: avoid ANI restart if no trigger

[miaoqing]

From: Miaoqing Pan <miaoqing@codeaurora.org>

ath9k_ani_restart() is always be invoked even if the trigger
condition is false.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
---
 drivers/net/wireless/ath/ath9k/ani.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 25e45e4..0f74d59 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -444,14 +444,16 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
 		    ofdmPhyErrRate < ah->config.ofdm_trig_low) {
 			ath9k_hw_ani_lower_immunity(ah);
 			aniState->ofdmsTurn = !aniState->ofdmsTurn;
+			ath9k_ani_restart(ah);
 		} else if (ofdmPhyErrRate > ah->config.ofdm_trig_high) {
 			ath9k_hw_ani_ofdm_err_trigger(ah);
 			aniState->ofdmsTurn = false;
+			ath9k_ani_restart(ah);
 		} else if (cckPhyErrRate > ah->config.cck_trig_high) {
 			ath9k_hw_ani_cck_err_trigger(ah);
 			aniState->ofdmsTurn = true;
+			ath9k_ani_restart(ah);
 		}
-		ath9k_ani_restart(ah);
 	}
 }
 EXPORT_SYMBOL(ath9k_hw_ani_monitor);
-- 
1.9.1

[PATCH 2/5] ath9k: clean up ANI per-channel pointer checking

[miaoqing]

From: Miaoqing Pan <miaoqing@codeaurora.org>

commit c24bd3620c50 ("ath9k: Do not maintain ANI state per-channel")
removed per-channel handling, the code to check 'curchan' also
should be removed as never used.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
---
 drivers/net/wireless/ath/ath9k/ani.c | 32 ++++++--------------------------
 1 file changed, 6 insertions(+), 26 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 0f74d59..bd1b573 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -126,12 +126,8 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah,
 
 static void ath9k_ani_restart(struct ath_hw *ah)
 {
-	struct ar5416AniState *aniState;
-
-	if (!ah->curchan)
-		return;
+	struct ar5416AniState *aniState = &ah->ani;
 
-	aniState = &ah->ani;
 	aniState->listenTime = 0;
 
 	ENABLE_REGWRITE_BUFFER(ah);
@@ -221,12 +217,7 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
 
 static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 {
-	struct ar5416AniState *aniState;
-
-	if (!ah->curchan)
-		return;
-
-	aniState = &ah->ani;
+	struct ar5416AniState *aniState = &ah->ani;
 
 	if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
 		ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1, false);
@@ -281,12 +272,7 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
 
 static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
 {
-	struct ar5416AniState *aniState;
-
-	if (!ah->curchan)
-		return;
-
-	aniState = &ah->ani;
+	struct ar5416AniState *aniState = &ah->ani;
 
 	if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
 		ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1,
@@ -299,9 +285,7 @@ static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
  */
 static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
 {
-	struct ar5416AniState *aniState;
-
-	aniState = &ah->ani;
+	struct ar5416AniState *aniState = &ah->ani;
 
 	/* lower OFDM noise immunity */
 	if (aniState->ofdmNoiseImmunityLevel > 0 &&
@@ -329,7 +313,7 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
 	struct ath_common *common = ath9k_hw_common(ah);
 	int ofdm_nil, cck_nil;
 
-	if (!ah->curchan)
+	if (!chan)
 		return;
 
 	BUG_ON(aniState == NULL);
@@ -416,14 +400,10 @@ static bool ath9k_hw_ani_read_counters(struct ath_hw *ah)
 
 void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-	struct ar5416AniState *aniState;
+	struct ar5416AniState *aniState = &ah->ani;
 	struct ath_common *common = ath9k_hw_common(ah);
 	u32 ofdmPhyErrRate, cckPhyErrRate;
 
-	if (!ah->curchan)
-		return;
-
-	aniState = &ah->ani;
 	if (!ath9k_hw_ani_read_counters(ah))
 		return;
 
-- 
1.9.1

[PATCH 3/5] ath9k: do not reset while BB panic(0x4000409) on ar9561

[miaoqing]

From: Miaoqing Pan <miaoqing@codeaurora.org>

BB panic(0x4000409) observed while AP enabling/disabling
bursting.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
---
 drivers/net/wireless/ath/ath9k/ar9003_phy.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 201425e..abd9646 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -2071,7 +2071,8 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
  *             to be disabled.
  *
  * 0x04000409: Packet stuck on receive.
- *             Full chip reset is required for all chips except AR9340.
+ *             Full chip reset is required for all chips except
+ *	       AR9340, AR9531 and AR9561.
  */
 
 /*
@@ -2100,7 +2101,7 @@ bool ar9003_hw_bb_watchdog_check(struct ath_hw *ah)
 	case 0x04000b09:
 		return true;
 	case 0x04000409:
-		if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
+		if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah))
 			return false;
 		else
 			return true;
-- 
1.9.1

[PATCH 4/5] ath9k: fix inconsistent use of tab and space in indentation

[miaoqing]

From: Miaoqing Pan <miaoqing@codeaurora.org>

Minor changes for indenting.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
---
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 8b4561e..54ed2f7 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -5485,11 +5485,11 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah,
 			  AR9300_PAPRD_SCALE_1);
 	else {
 		if (chan->channel >= 5700)
-		return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
-			  AR9300_PAPRD_SCALE_1);
+			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt20),
+				  AR9300_PAPRD_SCALE_1);
 		else if (chan->channel >= 5400)
 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
-				   AR9300_PAPRD_SCALE_2);
+				  AR9300_PAPRD_SCALE_2);
 		else
 			return MS(le32_to_cpu(eep->modalHeader5G.papdRateMaskHt40),
 				  AR9300_PAPRD_SCALE_1);
-- 
1.9.1

[PATCH 5/5] ath9k: fix data bus error on ar9300 and ar9580

[miaoqing]

From: Miaoqing Pan <miaoqing@codeaurora.org>

One crash issue be found on ar9300: RTC_RC reg read leads crash, leading
the data bus error, due to RTC_RC reg write not happen properly.

Warm Reset trigger in continuous beacon stuck for one of the customer for
other chip, noticed the MAC was stuck in RTC reset. After analysis noticed
DMA did not complete when RTC was put in reset.

So, before resetting the MAC need to make sure there are no pending DMA
transactions because this reset does not reset all parts of the chip.

The 12th and 11th bit of MAC _DMA_CFG register used to do that.
	12 cfg_halt_ack 0x0
		0 DMA has not yet halted
		1 DMA has halted
	11 cfg_halt_req 0x0
		0 DMA logic operates normally
		1 Request DMA logic to stop so software can reset the MAC

The Bit [12] of this register indicates when the halt has taken effect or
not. the DMA halt IS NOT recoverable; once software sets bit [11] to
request a DMA halt, software must wait for bit [12] to be set and reset
the MAC.

So, the same thing we implemented for ar9580 chip.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
---
 drivers/net/wireless/ath/ath9k/hw.c  | 10 ++++++++++
 drivers/net/wireless/ath/ath9k/reg.h |  4 +++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 257f46e..e7a3101 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1368,6 +1368,16 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 	if (ath9k_hw_mci_is_enabled(ah))
 		ar9003_mci_check_gpm_offset(ah);
 
+	/* DMA HALT added to resolve ar9300 and ar9580 bus error during
+	 * RTC_RC reg read
+	 */
+	if (AR_SREV_9300(ah) || AR_SREV_9580(ah)) {
+		REG_SET_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
+		ath9k_hw_wait(ah, AR_CFG, AR_CFG_HALT_ACK, AR_CFG_HALT_ACK,
+			      20 * AH_WAIT_TIMEOUT);
+		REG_CLR_BIT(ah, AR_CFG, AR_CFG_HALT_REQ);
+	}
+
 	REG_WRITE(ah, AR_RTC_RC, rst_flags);
 
 	REGWRITE_BUFFER_FLUSH(ah);
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index caba54d..c8d35fe 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -34,8 +34,10 @@
 #define AR_CFG_SWRG          0x00000010
 #define AR_CFG_AP_ADHOC_INDICATION 0x00000020
 #define AR_CFG_PHOK          0x00000100
-#define AR_CFG_CLK_GATE_DIS  0x00000400
 #define AR_CFG_EEBS          0x00000200
+#define AR_CFG_CLK_GATE_DIS  0x00000400
+#define AR_CFG_HALT_REQ	     0x00000800
+#define AR_CFG_HALT_ACK	     0x00001000
 #define AR_CFG_PCI_MASTER_REQ_Q_THRESH         0x00060000
 #define AR_CFG_PCI_MASTER_REQ_Q_THRESH_S       17
 
-- 
1.9.1

Re: [PATCH 1/5] ath9k: avoid ANI restart if no trigger

[Kalle Valo]

<miaoqing@codeaurora.org> writes:

> From: Miaoqing Pan <miaoqing@codeaurora.org>
>
> ath9k_ani_restart() is always be invoked even if the trigger
> condition is false.
>
> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>

Why? The commit log should always answer that.

-- 
Kalle Valo

Re: [PATCH 1/5] ath9k: avoid ANI restart if no trigger

[Pan, Miaoqing]

The commit 54da20d83f0e7fe87b75aec44bc2b1448d119320 ("ath9k_hw: improve ANI processing and rx desensitizing parameters") first introduced this issue, ath9k_ani_restart() is always be invoked is wrong.

Thanks,
Miaoqing

________________________________________
From: Valo, Kalle
Sent: Friday, January 15, 2016 4:00 PM
To: miaoqing@codeaurora.org
Cc: linville@tuxdriver.com; linux-wireless@vger.kernel.org; ath9k-devel
Subject: Re: [PATCH 1/5] ath9k: avoid ANI restart if no trigger

<miaoqing@codeaurora.org> writes:

> From: Miaoqing Pan <miaoqing@codeaurora.org>
>
> ath9k_ani_restart() is always be invoked even if the trigger
> condition is false.
>
> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>

Why? The commit log should always answer that.

--
Kalle Valo

Re: [PATCH 1/5] ath9k: avoid ANI restart if no trigger

[Kalle Valo]

"Pan, Miaoqing" <miaoqing@qti.qualcomm.com> writes:

> The commit 54da20d83f0e7fe87b75aec44bc2b1448d119320 ("ath9k_hw:
> improve ANI processing and rx desensitizing parameters") first
> introduced this issue, ath9k_ani_restart() is always be invoked is
> wrong.

Then you should add this to the commit log:

Fixes: 54da20d83f0e ("ath9k_hw: improve ANI processing and rx desensitizing parameters")

Also you need to explain more, especially why you think it's wrong. How
did you notice this? What kind of user visible issue this fixes?

-- 
Kalle Valo

Re: [PATCH 1/5] ath9k: avoid ANI restart if no trigger

[Felix Fietkau]

On 2016-01-15 02:23, miaoqing@codeaurora.org wrote:
> From: Miaoqing Pan <miaoqing@codeaurora.org>
> 
> ath9k_ani_restart() is always be invoked even if the trigger
> condition is false.
> 
> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
> ---
>  drivers/net/wireless/ath/ath9k/ani.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
> index 25e45e4..0f74d59 100644
> --- a/drivers/net/wireless/ath/ath9k/ani.c
> +++ b/drivers/net/wireless/ath/ath9k/ani.c
> @@ -444,14 +444,16 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
>  		    ofdmPhyErrRate < ah->config.ofdm_trig_low) {
>  			ath9k_hw_ani_lower_immunity(ah);
>  			aniState->ofdmsTurn = !aniState->ofdmsTurn;
> +			ath9k_ani_restart(ah);
>  		} else if (ofdmPhyErrRate > ah->config.ofdm_trig_high) {
>  			ath9k_hw_ani_ofdm_err_trigger(ah);
>  			aniState->ofdmsTurn = false;
> +			ath9k_ani_restart(ah);
>  		} else if (cckPhyErrRate > ah->config.cck_trig_high) {
>  			ath9k_hw_ani_cck_err_trigger(ah);
>  			aniState->ofdmsTurn = true;
> +			ath9k_ani_restart(ah);
>  		}
How about adding an 'else return' here instead of duplicating the
ath9k_ani_restart lines?

- Felix

[PATCH 0/5] ath9k: bug fixes

[Qiujun Huang]

This series fixes some bugs in ath9k reported and tested by syzbot.
https://lore.kernel.org/linux-usb/000000000000666c9c05a1c05d12@google.com
https://lore.kernel.org/linux-usb/0000000000003d7c1505a2168418@google.com
https://lore.kernel.org/linux-usb/0000000000006ac55b05a1c05d72@google.com
https://lore.kernel.org/linux-usb/0000000000000002fc05a1d61a68@google.com
https://lore.kernel.org/linux-usb/000000000000590f6b05a1c05d15@google.com

Qiujun Huang (5):
  ath9k: Fix use-after-free Read in htc_connect_service
  ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx
  ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
  ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb
  ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb

 drivers/net/wireless/ath/ath9k/hif_usb.c      | 58 ++++++++++++++-----
 drivers/net/wireless/ath/ath9k/hif_usb.h      |  6 ++
 drivers/net/wireless/ath/ath9k/htc_drv_init.c | 10 +++-
 drivers/net/wireless/ath/ath9k/htc_hst.c      |  6 +-
 drivers/net/wireless/ath/ath9k/wmi.c          |  6 +-
 drivers/net/wireless/ath/ath9k/wmi.h          |  3 +-
 6 files changed, 67 insertions(+), 22 deletions(-)

-- 
2.17.1