Files
linux/drivers/net/wireless/ath/ath9k/rng.c

122 lines
3.1 KiB
C
Raw Normal View History

/*
* Copyright (c) 2015 Qualcomm Atheros, Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include <linux/hw_random.h>
#include <linux/kthread.h>
#include "ath9k.h"
#include "hw.h"
#include "ar9003_phy.h"
static int ath9k_rng_data_read(struct ath_softc *sc, u32 *buf, u32 buf_size)
{
int i, j;
u32 v1, v2, rng_last = sc->rng_last;
struct ath_hw *ah = sc->sc_ah;
ath9k_ps_wakeup(sc);
REG_RMW_FIELD(ah, AR_PHY_TEST, AR_PHY_TEST_BBB_OBS_SEL, 1);
REG_CLR_BIT(ah, AR_PHY_TEST, AR_PHY_TEST_RX_OBS_SEL_BIT5);
REG_RMW_FIELD(ah, AR_PHY_TEST_CTL_STATUS, AR_PHY_TEST_CTL_RX_OBS_SEL, 0);
for (i = 0, j = 0; i < buf_size; i++) {
v1 = REG_READ(ah, AR_PHY_TST_ADC) & 0xffff;
v2 = REG_READ(ah, AR_PHY_TST_ADC) & 0xffff;
/* wait for data ready */
if (v1 && v2 && rng_last != v1 && v1 != v2 && v1 != 0xffff &&
v2 != 0xffff)
buf[j++] = (v1 << 16) | v2;
rng_last = v2;
}
ath9k_ps_restore(sc);
sc->rng_last = rng_last;
return j << 2;
}
static u32 ath9k_rng_delay_get(u32 fail_stats)
{
u32 delay;
if (fail_stats < 100)
delay = 10;
else if (fail_stats < 105)
delay = 1000;
else
delay = 10000;
return delay;
}
static int ath9k_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
{
struct ath_softc *sc = container_of(rng, struct ath_softc, rng_ops);
u32 fail_stats = 0, word;
int bytes_read = 0;
for (;;) {
if (max & ~3UL)
bytes_read = ath9k_rng_data_read(sc, buf, max >> 2);
if ((max & 3UL) && ath9k_rng_data_read(sc, &word, 1)) {
memcpy(buf + bytes_read, &word, max & 3UL);
bytes_read += max & 3UL;
memzero_explicit(&word, sizeof(word));
}
if (!wait || !max || likely(bytes_read) || fail_stats > 110)
break;
msleep_interruptible(ath9k_rng_delay_get(++fail_stats));
}
if (wait && !bytes_read && max)
bytes_read = -EIO;
return bytes_read;
}
void ath9k_rng_start(struct ath_softc *sc)
{
static atomic_t serial = ATOMIC_INIT(0);
struct ath_hw *ah = sc->sc_ah;
if (sc->rng_ops.read)
return;
if (!AR_SREV_9300_20_OR_LATER(ah))
return;
snprintf(sc->rng_name, sizeof(sc->rng_name), "ath9k_%u",
(atomic_inc_return(&serial) - 1) & U16_MAX);
sc->rng_ops.name = sc->rng_name;
sc->rng_ops.read = ath9k_rng_read;
sc->rng_ops.quality = 320;
if (devm_hwrng_register(sc->dev, &sc->rng_ops))
sc->rng_ops.read = NULL;
}
void ath9k_rng_stop(struct ath_softc *sc)
{
if (sc->rng_ops.read) {
devm_hwrng_unregister(sc->dev, &sc->rng_ops);
sc->rng_ops.read = NULL;
ath9k: fix an invalid pointer dereference in ath9k_rng_stop() The bug was triggered when do suspend/resuming continuously on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel 4.12.0-041200rc4-generic. But can't reproduce on DELL E5440 + AR9300 PCIE chips. The warning is caused by accessing invalid pointer sc->rng_task. sc->rng_task is not be cleared after kthread_stop(sc->rng_task) be called in ath9k_rng_stop(). Because the kthread is stopped before ath9k_rng_kthread() be scheduled. So set sc->rng_task to null after kthread_stop(sc->rng_task) to resolve this issue. WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100 CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031 Hardware name: Dell Inc. Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013 task: ffff950170fdda00 task.stack: ffffa22c01538000 RIP: 0010:kthread_stop+0xf1/0x100 RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246 RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000 RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680 RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680 R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018 FS: 00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0 Call Trace: ath9k_rng_stop+0x1a/0x20 [ath9k] ath9k_stop+0x3b/0x1d0 [ath9k] drv_stop+0x33/0xf0 [mac80211] ieee80211_stop_device+0x43/0x50 [mac80211] ieee80211_do_stop+0x4f2/0x810 [mac80211] Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043 Reported-by: Giulio Genovese <giulio.genovese@gmail.com> Tested-by: Giulio Genovese <giulio.genovese@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
2017-06-27 17:31:53 +03:00
}
}