linux/drivers/net/wireless/ath/ath10k/ahb.c

888 lines
21 KiB
C
Raw Normal View History

// SPDX-License-Identifier: ISC
/*
* Copyright (c) 2016-2017 Qualcomm Atheros, Inc. All rights reserved.
* Copyright (c) 2015 The Linux Foundation. All rights reserved.
*/
#include <linux/module.h>
#include <linux/of.h>
#include <linux/of_device.h>
#include <linux/clk.h>
#include <linux/reset.h>
#include "core.h"
#include "debug.h"
#include "pci.h"
#include "ahb.h"
static const struct of_device_id ath10k_ahb_of_match[] = {
{ .compatible = "qcom,ipq4019-wifi",
.data = (void *)ATH10K_HW_QCA4019
},
{ }
};
MODULE_DEVICE_TABLE(of, ath10k_ahb_of_match);
#define QCA4019_SRAM_ADDR 0x000C0000
#define QCA4019_SRAM_LEN 0x00040000 /* 256 kb */
static inline struct ath10k_ahb *ath10k_ahb_priv(struct ath10k *ar)
{
return &((struct ath10k_pci *)ar->drv_priv)->ahb[0];
}
static void ath10k_ahb_write32(struct ath10k *ar, u32 offset, u32 value)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
iowrite32(value, ar_ahb->mem + offset);
}
static u32 ath10k_ahb_read32(struct ath10k *ar, u32 offset)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
return ioread32(ar_ahb->mem + offset);
}
static u32 ath10k_ahb_gcc_read32(struct ath10k *ar, u32 offset)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
return ioread32(ar_ahb->gcc_mem + offset);
}
static void ath10k_ahb_tcsr_write32(struct ath10k *ar, u32 offset, u32 value)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
iowrite32(value, ar_ahb->tcsr_mem + offset);
}
static u32 ath10k_ahb_tcsr_read32(struct ath10k *ar, u32 offset)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
return ioread32(ar_ahb->tcsr_mem + offset);
}
static u32 ath10k_ahb_soc_read32(struct ath10k *ar, u32 addr)
{
return ath10k_ahb_read32(ar, RTC_SOC_BASE_ADDRESS + addr);
}
static int ath10k_ahb_get_num_banks(struct ath10k *ar)
{
if (ar->hw_rev == ATH10K_HW_QCA4019)
return 1;
ath10k_warn(ar, "unknown number of banks, assuming 1\n");
return 1;
}
static int ath10k_ahb_clock_init(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
struct device *dev;
dev = &ar_ahb->pdev->dev;
ar_ahb->cmd_clk = devm_clk_get(dev, "wifi_wcss_cmd");
if (IS_ERR_OR_NULL(ar_ahb->cmd_clk)) {
ath10k_err(ar, "failed to get cmd clk: %ld\n",
PTR_ERR(ar_ahb->cmd_clk));
return ar_ahb->cmd_clk ? PTR_ERR(ar_ahb->cmd_clk) : -ENODEV;
}
ar_ahb->ref_clk = devm_clk_get(dev, "wifi_wcss_ref");
if (IS_ERR_OR_NULL(ar_ahb->ref_clk)) {
ath10k_err(ar, "failed to get ref clk: %ld\n",
PTR_ERR(ar_ahb->ref_clk));
return ar_ahb->ref_clk ? PTR_ERR(ar_ahb->ref_clk) : -ENODEV;
}
ar_ahb->rtc_clk = devm_clk_get(dev, "wifi_wcss_rtc");
if (IS_ERR_OR_NULL(ar_ahb->rtc_clk)) {
ath10k_err(ar, "failed to get rtc clk: %ld\n",
PTR_ERR(ar_ahb->rtc_clk));
return ar_ahb->rtc_clk ? PTR_ERR(ar_ahb->rtc_clk) : -ENODEV;
}
return 0;
}
static void ath10k_ahb_clock_deinit(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
ar_ahb->cmd_clk = NULL;
ar_ahb->ref_clk = NULL;
ar_ahb->rtc_clk = NULL;
}
static int ath10k_ahb_clock_enable(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
int ret;
if (IS_ERR_OR_NULL(ar_ahb->cmd_clk) ||
IS_ERR_OR_NULL(ar_ahb->ref_clk) ||
IS_ERR_OR_NULL(ar_ahb->rtc_clk)) {
ath10k_err(ar, "clock(s) is/are not initialized\n");
ret = -EIO;
goto out;
}
ret = clk_prepare_enable(ar_ahb->cmd_clk);
if (ret) {
ath10k_err(ar, "failed to enable cmd clk: %d\n", ret);
goto out;
}
ret = clk_prepare_enable(ar_ahb->ref_clk);
if (ret) {
ath10k_err(ar, "failed to enable ref clk: %d\n", ret);
goto err_cmd_clk_disable;
}
ret = clk_prepare_enable(ar_ahb->rtc_clk);
if (ret) {
ath10k_err(ar, "failed to enable rtc clk: %d\n", ret);
goto err_ref_clk_disable;
}
return 0;
err_ref_clk_disable:
clk_disable_unprepare(ar_ahb->ref_clk);
err_cmd_clk_disable:
clk_disable_unprepare(ar_ahb->cmd_clk);
out:
return ret;
}
static void ath10k_ahb_clock_disable(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
clk_disable_unprepare(ar_ahb->cmd_clk);
clk_disable_unprepare(ar_ahb->ref_clk);
clk_disable_unprepare(ar_ahb->rtc_clk);
}
static int ath10k_ahb_rst_ctrl_init(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
struct device *dev;
dev = &ar_ahb->pdev->dev;
ar_ahb->core_cold_rst = devm_reset_control_get_exclusive(dev,
"wifi_core_cold");
if (IS_ERR(ar_ahb->core_cold_rst)) {
ath10k_err(ar, "failed to get core cold rst ctrl: %ld\n",
PTR_ERR(ar_ahb->core_cold_rst));
return PTR_ERR(ar_ahb->core_cold_rst);
}
ar_ahb->radio_cold_rst = devm_reset_control_get_exclusive(dev,
"wifi_radio_cold");
if (IS_ERR(ar_ahb->radio_cold_rst)) {
ath10k_err(ar, "failed to get radio cold rst ctrl: %ld\n",
PTR_ERR(ar_ahb->radio_cold_rst));
return PTR_ERR(ar_ahb->radio_cold_rst);
}
ar_ahb->radio_warm_rst = devm_reset_control_get_exclusive(dev,
"wifi_radio_warm");
if (IS_ERR(ar_ahb->radio_warm_rst)) {
ath10k_err(ar, "failed to get radio warm rst ctrl: %ld\n",
PTR_ERR(ar_ahb->radio_warm_rst));
return PTR_ERR(ar_ahb->radio_warm_rst);
}
ar_ahb->radio_srif_rst = devm_reset_control_get_exclusive(dev,
"wifi_radio_srif");
if (IS_ERR(ar_ahb->radio_srif_rst)) {
ath10k_err(ar, "failed to get radio srif rst ctrl: %ld\n",
PTR_ERR(ar_ahb->radio_srif_rst));
return PTR_ERR(ar_ahb->radio_srif_rst);
}
ar_ahb->cpu_init_rst = devm_reset_control_get_exclusive(dev,
"wifi_cpu_init");
if (IS_ERR(ar_ahb->cpu_init_rst)) {
ath10k_err(ar, "failed to get cpu init rst ctrl: %ld\n",
PTR_ERR(ar_ahb->cpu_init_rst));
return PTR_ERR(ar_ahb->cpu_init_rst);
}
return 0;
}
static void ath10k_ahb_rst_ctrl_deinit(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
ar_ahb->core_cold_rst = NULL;
ar_ahb->radio_cold_rst = NULL;
ar_ahb->radio_warm_rst = NULL;
ar_ahb->radio_srif_rst = NULL;
ar_ahb->cpu_init_rst = NULL;
}
static int ath10k_ahb_release_reset(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
int ret;
if (IS_ERR_OR_NULL(ar_ahb->radio_cold_rst) ||
IS_ERR_OR_NULL(ar_ahb->radio_warm_rst) ||
IS_ERR_OR_NULL(ar_ahb->radio_srif_rst) ||
IS_ERR_OR_NULL(ar_ahb->cpu_init_rst)) {
ath10k_err(ar, "rst ctrl(s) is/are not initialized\n");
return -EINVAL;
}
ret = reset_control_deassert(ar_ahb->radio_cold_rst);
if (ret) {
ath10k_err(ar, "failed to deassert radio cold rst: %d\n", ret);
return ret;
}
ret = reset_control_deassert(ar_ahb->radio_warm_rst);
if (ret) {
ath10k_err(ar, "failed to deassert radio warm rst: %d\n", ret);
return ret;
}
ret = reset_control_deassert(ar_ahb->radio_srif_rst);
if (ret) {
ath10k_err(ar, "failed to deassert radio srif rst: %d\n", ret);
return ret;
}
ret = reset_control_deassert(ar_ahb->cpu_init_rst);
if (ret) {
ath10k_err(ar, "failed to deassert cpu init rst: %d\n", ret);
return ret;
}
return 0;
}
static void ath10k_ahb_halt_axi_bus(struct ath10k *ar, u32 haltreq_reg,
u32 haltack_reg)
{
unsigned long timeout;
u32 val;
/* Issue halt axi bus request */
val = ath10k_ahb_tcsr_read32(ar, haltreq_reg);
val |= AHB_AXI_BUS_HALT_REQ;
ath10k_ahb_tcsr_write32(ar, haltreq_reg, val);
/* Wait for axi bus halted ack */
timeout = jiffies + msecs_to_jiffies(ATH10K_AHB_AXI_BUS_HALT_TIMEOUT);
do {
val = ath10k_ahb_tcsr_read32(ar, haltack_reg);
if (val & AHB_AXI_BUS_HALT_ACK)
break;
mdelay(1);
} while (time_before(jiffies, timeout));
if (!(val & AHB_AXI_BUS_HALT_ACK)) {
ath10k_err(ar, "failed to halt axi bus: %d\n", val);
return;
}
ath10k_dbg(ar, ATH10K_DBG_AHB, "axi bus halted\n");
}
static void ath10k_ahb_halt_chip(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
u32 core_id, glb_cfg_reg, haltreq_reg, haltack_reg;
u32 val;
int ret;
if (IS_ERR_OR_NULL(ar_ahb->core_cold_rst) ||
IS_ERR_OR_NULL(ar_ahb->radio_cold_rst) ||
IS_ERR_OR_NULL(ar_ahb->radio_warm_rst) ||
IS_ERR_OR_NULL(ar_ahb->radio_srif_rst) ||
IS_ERR_OR_NULL(ar_ahb->cpu_init_rst)) {
ath10k_err(ar, "rst ctrl(s) is/are not initialized\n");
return;
}
core_id = ath10k_ahb_read32(ar, ATH10K_AHB_WLAN_CORE_ID_REG);
switch (core_id) {
case 0:
glb_cfg_reg = ATH10K_AHB_TCSR_WIFI0_GLB_CFG;
haltreq_reg = ATH10K_AHB_TCSR_WCSS0_HALTREQ;
haltack_reg = ATH10K_AHB_TCSR_WCSS0_HALTACK;
break;
case 1:
glb_cfg_reg = ATH10K_AHB_TCSR_WIFI1_GLB_CFG;
haltreq_reg = ATH10K_AHB_TCSR_WCSS1_HALTREQ;
haltack_reg = ATH10K_AHB_TCSR_WCSS1_HALTACK;
break;
default:
ath10k_err(ar, "invalid core id %d found, skipping reset sequence\n",
core_id);
return;
}
ath10k_ahb_halt_axi_bus(ar, haltreq_reg, haltack_reg);
val = ath10k_ahb_tcsr_read32(ar, glb_cfg_reg);
val |= TCSR_WIFIX_GLB_CFG_DISABLE_CORE_CLK;
ath10k_ahb_tcsr_write32(ar, glb_cfg_reg, val);
ret = reset_control_assert(ar_ahb->core_cold_rst);
if (ret)
ath10k_err(ar, "failed to assert core cold rst: %d\n", ret);
msleep(1);
ret = reset_control_assert(ar_ahb->radio_cold_rst);
if (ret)
ath10k_err(ar, "failed to assert radio cold rst: %d\n", ret);
msleep(1);
ret = reset_control_assert(ar_ahb->radio_warm_rst);
if (ret)
ath10k_err(ar, "failed to assert radio warm rst: %d\n", ret);
msleep(1);
ret = reset_control_assert(ar_ahb->radio_srif_rst);
if (ret)
ath10k_err(ar, "failed to assert radio srif rst: %d\n", ret);
msleep(1);
ret = reset_control_assert(ar_ahb->cpu_init_rst);
if (ret)
ath10k_err(ar, "failed to assert cpu init rst: %d\n", ret);
msleep(10);
/* Clear halt req and core clock disable req before
* deasserting wifi core reset.
*/
val = ath10k_ahb_tcsr_read32(ar, haltreq_reg);
val &= ~AHB_AXI_BUS_HALT_REQ;
ath10k_ahb_tcsr_write32(ar, haltreq_reg, val);
val = ath10k_ahb_tcsr_read32(ar, glb_cfg_reg);
val &= ~TCSR_WIFIX_GLB_CFG_DISABLE_CORE_CLK;
ath10k_ahb_tcsr_write32(ar, glb_cfg_reg, val);
ret = reset_control_deassert(ar_ahb->core_cold_rst);
if (ret)
ath10k_err(ar, "failed to deassert core cold rst: %d\n", ret);
ath10k_dbg(ar, ATH10K_DBG_AHB, "core %d reset done\n", core_id);
}
static irqreturn_t ath10k_ahb_interrupt_handler(int irq, void *arg)
{
struct ath10k *ar = arg;
if (!ath10k_pci_irq_pending(ar))
return IRQ_NONE;
ath10k_pci_disable_and_clear_legacy_irq(ar);
ath10k_pci_irq_msi_fw_mask(ar);
napi_schedule(&ar->napi);
return IRQ_HANDLED;
}
static int ath10k_ahb_request_irq_legacy(struct ath10k *ar)
{
struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
int ret;
ret = request_irq(ar_ahb->irq,
ath10k_ahb_interrupt_handler,
IRQF_SHARED, "ath10k_ahb", ar);
if (ret) {
ath10k_warn(ar, "failed to request legacy irq %d: %d\n",
ar_ahb->irq, ret);
return ret;
}
ar_pci->oper_irq_mode = ATH10K_PCI_IRQ_LEGACY;
return 0;
}
static void ath10k_ahb_release_irq_legacy(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
free_irq(ar_ahb->irq, ar);
}
static void ath10k_ahb_irq_disable(struct ath10k *ar)
{
ath10k_ce_disable_interrupts(ar);
ath10k_pci_disable_and_clear_legacy_irq(ar);
}
static int ath10k_ahb_resource_init(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
struct platform_device *pdev;
struct resource *res;
int ret;
pdev = ar_ahb->pdev;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
ath10k_err(ar, "failed to get memory resource\n");
ret = -ENXIO;
goto out;
}
ar_ahb->mem = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(ar_ahb->mem)) {
ath10k_err(ar, "mem ioremap error\n");
ret = PTR_ERR(ar_ahb->mem);
goto out;
}
ar_ahb->mem_len = resource_size(res);
ar_ahb->gcc_mem = ioremap(ATH10K_GCC_REG_BASE,
ATH10K_GCC_REG_SIZE);
if (!ar_ahb->gcc_mem) {
ath10k_err(ar, "gcc mem ioremap error\n");
ret = -ENOMEM;
goto err_mem_unmap;
}
ar_ahb->tcsr_mem = ioremap(ATH10K_TCSR_REG_BASE,
ATH10K_TCSR_REG_SIZE);
if (!ar_ahb->tcsr_mem) {
ath10k_err(ar, "tcsr mem ioremap error\n");
ret = -ENOMEM;
goto err_gcc_mem_unmap;
}
ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
if (ret) {
ath10k_err(ar, "failed to set 32-bit dma mask: %d\n", ret);
goto err_tcsr_mem_unmap;
}
ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
if (ret) {
ath10k_err(ar, "failed to set 32-bit consistent dma: %d\n",
ret);
goto err_tcsr_mem_unmap;
}
ret = ath10k_ahb_clock_init(ar);
if (ret)
goto err_tcsr_mem_unmap;
ret = ath10k_ahb_rst_ctrl_init(ar);
if (ret)
goto err_clock_deinit;
ar_ahb->irq = platform_get_irq_byname(pdev, "legacy");
if (ar_ahb->irq < 0) {
ath10k_err(ar, "failed to get irq number: %d\n", ar_ahb->irq);
ret = ar_ahb->irq;
goto err_clock_deinit;
}
ath10k_dbg(ar, ATH10K_DBG_BOOT, "irq: %d\n", ar_ahb->irq);
ath10k_dbg(ar, ATH10K_DBG_BOOT, "mem: 0x%pK mem_len: %lu gcc mem: 0x%pK tcsr_mem: 0x%pK\n",
ar_ahb->mem, ar_ahb->mem_len,
ar_ahb->gcc_mem, ar_ahb->tcsr_mem);
return 0;
err_clock_deinit:
ath10k_ahb_clock_deinit(ar);
err_tcsr_mem_unmap:
iounmap(ar_ahb->tcsr_mem);
err_gcc_mem_unmap:
ar_ahb->tcsr_mem = NULL;
iounmap(ar_ahb->gcc_mem);
err_mem_unmap:
ar_ahb->gcc_mem = NULL;
devm_iounmap(&pdev->dev, ar_ahb->mem);
out:
ar_ahb->mem = NULL;
return ret;
}
static void ath10k_ahb_resource_deinit(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
struct device *dev;
dev = &ar_ahb->pdev->dev;
if (ar_ahb->mem)
devm_iounmap(dev, ar_ahb->mem);
if (ar_ahb->gcc_mem)
iounmap(ar_ahb->gcc_mem);
if (ar_ahb->tcsr_mem)
iounmap(ar_ahb->tcsr_mem);
ar_ahb->mem = NULL;
ar_ahb->gcc_mem = NULL;
ar_ahb->tcsr_mem = NULL;
ath10k_ahb_clock_deinit(ar);
ath10k_ahb_rst_ctrl_deinit(ar);
}
static int ath10k_ahb_prepare_device(struct ath10k *ar)
{
u32 val;
int ret;
ret = ath10k_ahb_clock_enable(ar);
if (ret) {
ath10k_err(ar, "failed to enable clocks\n");
return ret;
}
/* Clock for the target is supplied from outside of target (ie,
* external clock module controlled by the host). Target needs
* to know what frequency target cpu is configured which is needed
* for target internal use. Read target cpu frequency info from
* gcc register and write into target's scratch register where
* target expects this information.
*/
val = ath10k_ahb_gcc_read32(ar, ATH10K_AHB_GCC_FEPLL_PLL_DIV);
ath10k_ahb_write32(ar, ATH10K_AHB_WIFI_SCRATCH_5_REG, val);
ret = ath10k_ahb_release_reset(ar);
if (ret)
goto err_clk_disable;
ath10k_ahb_irq_disable(ar);
ath10k_ahb_write32(ar, FW_INDICATOR_ADDRESS, FW_IND_HOST_READY);
ret = ath10k_pci_wait_for_target_init(ar);
if (ret)
goto err_halt_chip;
return 0;
err_halt_chip:
ath10k_ahb_halt_chip(ar);
err_clk_disable:
ath10k_ahb_clock_disable(ar);
return ret;
}
static int ath10k_ahb_chip_reset(struct ath10k *ar)
{
int ret;
ath10k_ahb_halt_chip(ar);
ath10k_ahb_clock_disable(ar);
ret = ath10k_ahb_prepare_device(ar);
if (ret)
return ret;
return 0;
}
static int ath10k_ahb_wake_target_cpu(struct ath10k *ar)
{
u32 addr, val;
addr = SOC_CORE_BASE_ADDRESS | CORE_CTRL_ADDRESS;
val = ath10k_ahb_read32(ar, addr);
val |= ATH10K_AHB_CORE_CTRL_CPU_INTR_MASK;
ath10k_ahb_write32(ar, addr, val);
return 0;
}
static int ath10k_ahb_hif_start(struct ath10k *ar)
{
ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif start\n");
napi_enable(&ar->napi);
ath10k_ce_enable_interrupts(ar);
ath10k_pci_enable_legacy_irq(ar);
ath10k_pci_rx_post(ar);
return 0;
}
static void ath10k_ahb_hif_stop(struct ath10k *ar)
{
struct ath10k_ahb *ar_ahb = ath10k_ahb_priv(ar);
ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif stop\n");
ath10k_ahb_irq_disable(ar);
synchronize_irq(ar_ahb->irq);
napi_synchronize(&ar->napi);
napi_disable(&ar->napi);
ath10k: fix kernel panic by moving pci flush after napi_disable When continuously running wifi up/down sequence, the napi poll can be scheduled after the CE buffers being freed by ath10k_pci_flush Steps: In a certain condition, during wifi down below scenario might occur. ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize). In the above scenario, CE buffer entries will be freed up and become NULL in ath10k_pci_flush. And the napi_poll has been invoked after the flush process and it will try to get the skb from the CE buffer entry and perform some action on that. Since the CE buffer already cleaned by pci flush this action will create NULL pointer dereference and trigger below kernel panic. Unable to handle kernel NULL pointer dereference at virtual address 0000005c PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci] ath10k_pci_htt_rx_cb [ath10k_pci] ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci] ath10k_ce_per_engine_service [ath10k_pci] ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci] ath10k_ce_per_engine_service_any [ath10k_pci] ath10k_pci_napi_poll+0x48/0xec [ath10k_pci] ath10k_pci_napi_poll [ath10k_pci] net_rx_action+0xac/0x160 net_rx_action __do_softirq+0xdc/0x208 __do_softirq irq_exit+0x84/0xe0 irq_exit __handle_domain_irq+0x80/0xa0 __handle_domain_irq gic_handle_irq+0x38/0x5c gic_handle_irq __irq_usr+0x44/0x60 Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010 Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2018-08-06 09:39:01 +00:00
ath10k_pci_flush(ar);
}
static int ath10k_ahb_hif_power_up(struct ath10k *ar,
enum ath10k_firmware_mode fw_mode)
{
int ret;
ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif power up\n");
ret = ath10k_ahb_chip_reset(ar);
if (ret) {
ath10k_err(ar, "failed to reset chip: %d\n", ret);
goto out;
}
ret = ath10k_pci_init_pipes(ar);
if (ret) {
ath10k_err(ar, "failed to initialize CE: %d\n", ret);
goto out;
}
ret = ath10k_pci_init_config(ar);
if (ret) {
ath10k_err(ar, "failed to setup init config: %d\n", ret);
goto err_ce_deinit;
}
ret = ath10k_ahb_wake_target_cpu(ar);
if (ret) {
ath10k_err(ar, "could not wake up target CPU: %d\n", ret);
goto err_ce_deinit;
}
return 0;
err_ce_deinit:
ath10k_pci_ce_deinit(ar);
out:
return ret;
}
static u32 ath10k_ahb_qca4019_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
{
u32 val = 0, region = addr & 0xfffff;
val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS);
if (region >= QCA4019_SRAM_ADDR && region <=
(QCA4019_SRAM_ADDR + QCA4019_SRAM_LEN)) {
/* SRAM contents for QCA4019 can be directly accessed and
* no conversions are required
*/
val |= region;
} else {
val |= 0x100000 | region;
}
return val;
}
static const struct ath10k_hif_ops ath10k_ahb_hif_ops = {
.tx_sg = ath10k_pci_hif_tx_sg,
.diag_read = ath10k_pci_hif_diag_read,
.diag_write = ath10k_pci_diag_write_mem,
.exchange_bmi_msg = ath10k_pci_hif_exchange_bmi_msg,
.start = ath10k_ahb_hif_start,
.stop = ath10k_ahb_hif_stop,
.map_service_to_pipe = ath10k_pci_hif_map_service_to_pipe,
.get_default_pipe = ath10k_pci_hif_get_default_pipe,
.send_complete_check = ath10k_pci_hif_send_complete_check,
.get_free_queue_number = ath10k_pci_hif_get_free_queue_number,
.power_up = ath10k_ahb_hif_power_up,
.power_down = ath10k_pci_hif_power_down,
.read32 = ath10k_ahb_read32,
.write32 = ath10k_ahb_write32,
};
static const struct ath10k_bus_ops ath10k_ahb_bus_ops = {
.read32 = ath10k_ahb_read32,
.write32 = ath10k_ahb_write32,
.get_num_banks = ath10k_ahb_get_num_banks,
};
static int ath10k_ahb_probe(struct platform_device *pdev)
{
struct ath10k *ar;
struct ath10k_ahb *ar_ahb;
struct ath10k_pci *ar_pci;
const struct of_device_id *of_id;
enum ath10k_hw_rev hw_rev;
size_t size;
int ret;
struct ath10k_bus_params bus_params = {};
of_id = of_match_device(ath10k_ahb_of_match, &pdev->dev);
if (!of_id) {
dev_err(&pdev->dev, "failed to find matching device tree id\n");
return -EINVAL;
}
hw_rev = (enum ath10k_hw_rev)of_id->data;
size = sizeof(*ar_pci) + sizeof(*ar_ahb);
ar = ath10k_core_create(size, &pdev->dev, ATH10K_BUS_AHB,
hw_rev, &ath10k_ahb_hif_ops);
if (!ar) {
dev_err(&pdev->dev, "failed to allocate core\n");
return -ENOMEM;
}
ath10k_dbg(ar, ATH10K_DBG_BOOT, "ahb probe\n");
ar_pci = ath10k_pci_priv(ar);
ar_ahb = ath10k_ahb_priv(ar);
ar_ahb->pdev = pdev;
platform_set_drvdata(pdev, ar);
ret = ath10k_ahb_resource_init(ar);
if (ret)
goto err_core_destroy;
ar->dev_id = 0;
ar_pci->mem = ar_ahb->mem;
ar_pci->mem_len = ar_ahb->mem_len;
ar_pci->ar = ar;
ar_pci->ce.bus_ops = &ath10k_ahb_bus_ops;
ar_pci->targ_cpu_to_ce_addr = ath10k_ahb_qca4019_targ_cpu_to_ce_addr;
ar->ce_priv = &ar_pci->ce;
ret = ath10k_pci_setup_resource(ar);
if (ret) {
ath10k_err(ar, "failed to setup resource: %d\n", ret);
goto err_resource_deinit;
}
ath10k_pci_init_napi(ar);
ret = ath10k_ahb_request_irq_legacy(ar);
if (ret)
goto err_free_pipes;
ret = ath10k_ahb_prepare_device(ar);
if (ret)
goto err_free_irq;
ath10k_pci_ce_deinit(ar);
bus_params.dev_type = ATH10K_DEV_TYPE_LL;
bus_params.chip_id = ath10k_ahb_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
if (bus_params.chip_id == 0xffffffff) {
ath10k_err(ar, "failed to get chip id\n");
ret = -ENODEV;
goto err_halt_device;
}
ret = ath10k_core_register(ar, &bus_params);
if (ret) {
ath10k_err(ar, "failed to register driver core: %d\n", ret);
goto err_halt_device;
}
return 0;
err_halt_device:
ath10k_ahb_halt_chip(ar);
ath10k_ahb_clock_disable(ar);
err_free_irq:
ath10k_ahb_release_irq_legacy(ar);
err_free_pipes:
ath10k: Fix NULL pointer dereference in AHB device probe This fixes a NULL pointer dereference in the probe path for AHB devices. There attr parameter in the ath10k_ce_alloc_pipe() function is not initialized, but accessed. This function is called by ath10k_pci_setup_resource() which is called by ath10k_ahb_probe(). The struct ath10k_pci is also used for AHB devices and not only for PCI devices. The initialization of the new members of struct ath10k_pci is moved to ath10k_pci_setup_resource() which is used by the PCI and the AHB code. This also fixes a use after free bug in ath10k_pci_remove() when ar_pci is accessed after ath10k_core_destroy() was called, which calls ieee80211_free_hw() and frees this memory. This fixes the following bug seen with backports-5.8-rc2 on OpenWrt on a IPQ4019 device: [ 11.117462] 8<--- cut here --- [ 11.117494] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 11.119510] pgd = f377fd58 [ 11.127657] [00000000] *pgd=8e9a0835, *pte=00000000, *ppte=00000000 [ 11.130206] Internal error: Oops: 17 [#1] SMP ARM [ 11.136339] Modules linked in: ath10k_pci(+) ath10k_core ath xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD pppox ppp_generic nf_nat nf_flow_table_hw nf_flow_table nf_conntrack_rtcache nf_conntrack mac80211 ipt_REJECT cfg80211 xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG slhc nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables crc_ccitt compat nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom gpio_button_hotplug [ 11.174355] CPU: 2 PID: 257 Comm: kmodloader Not tainted 5.4.51 #0 [ 11.196585] Hardware name: Generic DT based system [ 11.202746] PC is at ath10k_ce_alloc_pipe+0x58/0x180 [ath10k_core] [ 11.207459] LR is at ath10k_pci_alloc_pipes+0x94/0xc8 [ath10k_pci] [ 11.213600] pc : [<bf2c96cc>] lr : [<bf2fbf98>] psr: 80000013 [ 11.219760] sp : cea0dc90 ip : cf4001f0 fp : 00000001 [ 11.225923] r10: 00000000 r9 : 00000018 r8 : ce4963b4 [ 11.231133] r7 : 00000000 r6 : ce491ea0 r5 : 00000000 r4 : ce4963b4 [ 11.236342] r3 : 0004a000 r2 : 0004a000 r1 : bf2d0d70 r0 : 00000006 [ 11.242942] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 11.249452] Control: 10c5387d Table: 8e9c006a DAC: 00000051 [ 11.256656] Process kmodloader (pid: 257, stack limit = 0xaba286ca) [ 11.262386] Stack: (0xcea0dc90 to 0xcea0e000) [ 11.268462] dc80: 00000000 ce49629c ce491ea0 ce4963bc [ 11.272984] dca0: ce495ea0 bf2fbf98 00000002 ce4963a8 ce495ea0 00000000 ce491ea0 cf95d800 [ 11.281142] dcc0: cf95d810 cf95d810 00000001 bf2fc854 00000000 cf95d800 bf300748 ce495ea0 [ 11.289304] dce0: ce491ea0 d1300000 cf95d800 bf2fde8c 00000000 00000001 ce49cea0 00000000 [ 11.297462] dd00: 00000000 00000000 bf3010a0 cf95d810 bf3010a0 c0b61580 00000000 00000000 [ 11.305624] dd20: bf3010a0 0000000b c0b04e48 c06110c8 c0b61588 cf95d810 c0b61580 c060f740 [ 11.313781] dd40: cf95d810 00000000 bf3010a0 00000000 00000000 ce49d2a4 bf301100 c060fc90 [ 11.321943] dd60: 00000000 bf3010a0 cf95d810 c060fcf0 cf95d810 bf3010a0 c060fc98 c060dca4 [ 11.330101] dd80: cf809d58 cf952cb4 bf3010a0 ce967900 c0b1f2c8 c060ec28 bf3007b8 bf301038 [ 11.338263] dda0: bf3010a0 bf3010a0 c0b2d4d4 ffffe000 bf304000 c0610278 c0b04e48 c0b2d4d4 [ 11.346422] ddc0: ffffe000 bf2fe2b4 c0b04e48 bf30403c c0b04e48 c0302764 8040003f 00000001 [ 11.354582] dde0: 38e38e39 ce513580 c0b2cb50 cf801e00 cffbc6ac ce513600 cf801e00 cffbc6ac [ 11.362740] de00: 8040003e ce49d280 00000001 c0428d54 00000001 cf801e00 cffbc6ac ce513580 [ 11.370900] de20: ce49d280 0e391998 bf301100 ce49d340 d12d2000 ce49d280 00000001 c0398c2c [ 11.379061] de40: 00000001 cea0df34 cea0df34 00000001 d12d2000 c039ae48 bf30110c 00007fff [ 11.387221] de60: bf301100 c0398044 cf804028 bf301148 c0397674 bf30126c c08ee5c0 c08ee70c [ 11.395380] de80: bf30110c c0b04e48 c08ee518 00000000 c08ee570 c0b04e48 ce513600 fffff000 [ 11.403540] dea0: 00000001 ce513580 0000000d 0000000d 00000000 00000000 00000000 00000000 [ 11.411698] dec0: 00000000 00000000 6e72656b 00006c65 00000000 00000000 00000000 00000000 [ 11.419858] dee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 11.428018] df00: 00000000 0e391998 00000000 0000c610 d12de610 00000000 0062c620 ffffe000 [ 11.436180] df20: 000129d1 00000051 00000000 c039b228 00000000 d12d7afd d12d8e80 d12d2000 [ 11.444337] df40: 0000c610 d12de0e8 d12ddfa8 d12dab74 00009000 00009570 00003a2c 00009cae [ 11.452498] df60: 00000000 00000000 00000000 00003a1c 0000001e 0000001f 00000018 00000000 [ 11.460656] df80: 00000010 00000000 00000000 00000000 00000003 00000080 c0301204 cea0c000 [ 11.468817] dfa0: 00000080 c0301000 00000000 00000000 00620010 0000c610 000129d1 00000014 [ 11.476975] dfc0: 00000000 00000000 00000003 00000080 0000c610 00000000 b6fc1d20 00000000 [ 11.485137] dfe0: bef0ad14 bef0acf8 00011e14 b6f74c94 60000010 00620010 00000000 00000000 [ 11.493390] [<bf2c96cc>] (ath10k_ce_alloc_pipe [ath10k_core]) from [<bf2fbf98>] (ath10k_pci_alloc_pipes+0x94/0xc8 [ath10k_pci]) [ 11.501498] [<bf2fbf98>] (ath10k_pci_alloc_pipes [ath10k_pci]) from [<bf2fc854>] (ath10k_pci_setup_resource+0xb8/0xf0 [ath10k_pci]) [ 11.512773] [<bf2fc854>] (ath10k_pci_setup_resource [ath10k_pci]) from [<bf2fde8c>] (ath10k_ahb_probe+0x32c/0x670 [ath10k_pci]) [ 11.524566] [<bf2fde8c>] (ath10k_ahb_probe [ath10k_pci]) from [<c06110c8>] (platform_drv_probe+0x34/0x70) [ 11.536016] [<c06110c8>] (platform_drv_probe) from [<c060f740>] (really_probe+0x1f0/0x358) [ 11.545729] [<c060f740>] (really_probe) from [<c060fc90>] (device_driver_attach+0x58/0x60) [ 11.553886] [<c060fc90>] (device_driver_attach) from [<c060fcf0>] (__driver_attach+0x58/0xcc) [ 11.562134] [<c060fcf0>] (__driver_attach) from [<c060dca4>] (bus_for_each_dev+0x68/0x8c) [ 11.570731] [<c060dca4>] (bus_for_each_dev) from [<c060ec28>] (bus_add_driver+0x1c8/0x1d8) [ 11.578886] [<c060ec28>] (bus_add_driver) from [<c0610278>] (driver_register+0x74/0x108) [ 11.587060] [<c0610278>] (driver_register) from [<bf2fe2b4>] (ath10k_ahb_init+0x18/0x38 [ath10k_pci]) [ 11.595320] [<bf2fe2b4>] (ath10k_ahb_init [ath10k_pci]) from [<bf30403c>] (init_module+0x3c/0x1000 [ath10k_pci]) [ 11.604432] [<bf30403c>] (init_module [ath10k_pci]) from [<c0302764>] (do_one_initcall+0x84/0x1d8) [ 11.614657] [<c0302764>] (do_one_initcall) from [<c0398c2c>] (do_init_module+0x5c/0x228) [ 11.623421] [<c0398c2c>] (do_init_module) from [<c039ae48>] (load_module+0x1fc8/0x224c) [ 11.631663] [<c039ae48>] (load_module) from [<c039b228>] (sys_init_module+0x15c/0x17c) [ 11.639390] [<c039b228>] (sys_init_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54) [ 11.647370] Exception stack(0xcea0dfa8 to 0xcea0dff0) [ 11.655615] dfa0: 00000000 00000000 00620010 0000c610 000129d1 00000014 [ 11.660569] dfc0: 00000000 00000000 00000003 00000080 0000c610 00000000 b6fc1d20 00000000 [ 11.668725] dfe0: bef0ad14 bef0acf8 00011e14 b6f74c94 [ 11.676886] Code: e1c321d4 e0433002 e0232397 e5843014 (e5953000) [ 11.681958] ---[ end trace 8f35917de2e76854 ]--- Fixes: 521fc37be3d8 ("ath10k: Avoid override CE5 configuration for QCA99X0 chipsets") Reported-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> [ipq40xx/ map-ac2200] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200714205802.17688-1-hauke@hauke-m.de
2020-07-14 20:58:02 +00:00
ath10k_pci_release_resource(ar);
err_resource_deinit:
ath10k_ahb_resource_deinit(ar);
err_core_destroy:
ath10k_core_destroy(ar);
platform_set_drvdata(pdev, NULL);
return ret;
}
static int ath10k_ahb_remove(struct platform_device *pdev)
{
struct ath10k *ar = platform_get_drvdata(pdev);
struct ath10k_ahb *ar_ahb;
if (!ar)
return -EINVAL;
ar_ahb = ath10k_ahb_priv(ar);
if (!ar_ahb)
return -EINVAL;
ath10k_dbg(ar, ATH10K_DBG_AHB, "ahb remove\n");
ath10k_core_unregister(ar);
ath10k_ahb_irq_disable(ar);
ath10k_ahb_release_irq_legacy(ar);
ath10k_pci_release_resource(ar);
ath10k_ahb_halt_chip(ar);
ath10k_ahb_clock_disable(ar);
ath10k_ahb_resource_deinit(ar);
ath10k_core_destroy(ar);
platform_set_drvdata(pdev, NULL);
return 0;
}
static struct platform_driver ath10k_ahb_driver = {
.driver = {
.name = "ath10k_ahb",
.of_match_table = ath10k_ahb_of_match,
},
.probe = ath10k_ahb_probe,
.remove = ath10k_ahb_remove,
};
int ath10k_ahb_init(void)
{
int ret;
ret = platform_driver_register(&ath10k_ahb_driver);
if (ret)
printk(KERN_ERR "failed to register ath10k ahb driver: %d\n",
ret);
return ret;
}
void ath10k_ahb_exit(void)
{
platform_driver_unregister(&ath10k_ahb_driver);
}