![Bob Copeland](/assets/img/avatar_default.png)
ath5k assumes ah_current_channel is always a valid pointer in several places, but a newly created interface may not have a channel. To avoid null pointer dereferences, set it up to point to the first available channel until later reconfigured. This fixes the following oops: $ rmmod ath5k $ insmod ath5k $ iw phy0 set distance 11000 BUG: unable to handle kernel NULL pointer dereference at 00000006 IP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] *pde = 00000000 Oops: 0000 [#1] last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90 scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci 8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc Pid: 1597, comm: iw Not tainted (2.6.32.14 #8) EIP: 0060:[<d0a1ff24>] EFLAGS: 00010296 CPU: 0 EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080 ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000) Stack: d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0 <0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7 <0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000 Call Trace: [<d0a27f0c>] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k] [<d09bfdc7>] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211] [<d08e0d28>] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211] [<c10f5db9>] ? nla_parse+0x59/0xc0 [<c11ca8d9>] ? genl_rcv_msg+0x169/0x1a0 [<c11ca770>] ? genl_rcv_msg+0x0/0x1a0 [<c11c7e68>] ? netlink_rcv_skb+0x38/0x90 [<c11c9649>] ? genl_rcv+0x19/0x30 [<c11c7c03>] ? netlink_unicast+0x1b3/0x220 [<c11c893e>] ? netlink_sendmsg+0x26e/0x290 [<c11a409e>] ? sock_sendmsg+0xbe/0xf0 [<c1032780>] ? autoremove_wake_function+0x0/0x50 [<c104d846>] ? __alloc_pages_nodemask+0x106/0x530 [<c1074933>] ? do_lookup+0x53/0x1b0 [<c10766f9>] ? __link_path_walk+0x9b9/0x9e0 [<c11acab0>] ? verify_iovec+0x50/0x90 [<c11a42b1>] ? sys_sendmsg+0x1e1/0x270 [<c1048e50>] ? find_get_page+0x10/0x50 [<c104a96f>] ? filemap_fault+0x5f/0x370 [<c1059159>] ? __do_fault+0x319/0x370 [<c11a55b4>] ? sys_socketcall+0x244/0x290 [<c101962c>] ? do_page_fault+0x1ec/0x270 [<c1019440>] ? do_page_fault+0x0/0x270 [<c1002ae5>] ? syscall_call+0x7/0xb Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24 0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7 43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2 EIP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP 0068:cfa09bf4 CR2: 0000000000000006 ---[ end trace 54f73d6b10ceb87b ]--- Cc: stable@kernel.org Reported-by: Steve Brown <sbrown@cortland.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
366 lines
9.9 KiB
C
366 lines
9.9 KiB
C
/*
|
|
* Copyright (c) 2004-2008 Reyk Floeter <reyk@openbsd.org>
|
|
* Copyright (c) 2006-2008 Nick Kossifidis <mickflemm@gmail.com>
|
|
*
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
*
|
|
*/
|
|
|
|
/*************************************\
|
|
* Attach/Detach Functions and helpers *
|
|
\*************************************/
|
|
|
|
#include <linux/pci.h>
|
|
#include <linux/slab.h>
|
|
#include "ath5k.h"
|
|
#include "reg.h"
|
|
#include "debug.h"
|
|
#include "base.h"
|
|
|
|
/**
|
|
* ath5k_hw_post - Power On Self Test helper function
|
|
*
|
|
* @ah: The &struct ath5k_hw
|
|
*/
|
|
static int ath5k_hw_post(struct ath5k_hw *ah)
|
|
{
|
|
|
|
static const u32 static_pattern[4] = {
|
|
0x55555555, 0xaaaaaaaa,
|
|
0x66666666, 0x99999999
|
|
};
|
|
static const u16 regs[2] = { AR5K_STA_ID0, AR5K_PHY(8) };
|
|
int i, c;
|
|
u16 cur_reg;
|
|
u32 var_pattern;
|
|
u32 init_val;
|
|
u32 cur_val;
|
|
|
|
for (c = 0; c < 2; c++) {
|
|
|
|
cur_reg = regs[c];
|
|
|
|
/* Save previous value */
|
|
init_val = ath5k_hw_reg_read(ah, cur_reg);
|
|
|
|
for (i = 0; i < 256; i++) {
|
|
var_pattern = i << 16 | i;
|
|
ath5k_hw_reg_write(ah, var_pattern, cur_reg);
|
|
cur_val = ath5k_hw_reg_read(ah, cur_reg);
|
|
|
|
if (cur_val != var_pattern) {
|
|
ATH5K_ERR(ah->ah_sc, "POST Failed !!!\n");
|
|
return -EAGAIN;
|
|
}
|
|
|
|
/* Found on ndiswrapper dumps */
|
|
var_pattern = 0x0039080f;
|
|
ath5k_hw_reg_write(ah, var_pattern, cur_reg);
|
|
}
|
|
|
|
for (i = 0; i < 4; i++) {
|
|
var_pattern = static_pattern[i];
|
|
ath5k_hw_reg_write(ah, var_pattern, cur_reg);
|
|
cur_val = ath5k_hw_reg_read(ah, cur_reg);
|
|
|
|
if (cur_val != var_pattern) {
|
|
ATH5K_ERR(ah->ah_sc, "POST Failed !!!\n");
|
|
return -EAGAIN;
|
|
}
|
|
|
|
/* Found on ndiswrapper dumps */
|
|
var_pattern = 0x003b080f;
|
|
ath5k_hw_reg_write(ah, var_pattern, cur_reg);
|
|
}
|
|
|
|
/* Restore previous value */
|
|
ath5k_hw_reg_write(ah, init_val, cur_reg);
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
/**
|
|
* ath5k_hw_attach - Check if hw is supported and init the needed structs
|
|
*
|
|
* @sc: The &struct ath5k_softc we got from the driver's attach function
|
|
*
|
|
* Check if the device is supported, perform a POST and initialize the needed
|
|
* structs. Returns -ENOMEM if we don't have memory for the needed structs,
|
|
* -ENODEV if the device is not supported or prints an error msg if something
|
|
* else went wrong.
|
|
*/
|
|
int ath5k_hw_attach(struct ath5k_softc *sc)
|
|
{
|
|
struct ath5k_hw *ah = sc->ah;
|
|
struct ath_common *common = ath5k_hw_common(ah);
|
|
struct pci_dev *pdev = sc->pdev;
|
|
struct ath5k_eeprom_info *ee;
|
|
int ret;
|
|
u32 srev;
|
|
|
|
/*
|
|
* HW information
|
|
*/
|
|
ah->ah_radar.r_enabled = AR5K_TUNE_RADAR_ALERT;
|
|
ah->ah_turbo = false;
|
|
ah->ah_txpower.txp_tpc = AR5K_TUNE_TPC_TXPOWER;
|
|
ah->ah_imr = 0;
|
|
ah->ah_atim_window = 0;
|
|
ah->ah_aifs = AR5K_TUNE_AIFS;
|
|
ah->ah_cw_min = AR5K_TUNE_CWMIN;
|
|
ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
|
|
ah->ah_software_retry = false;
|
|
ah->ah_ant_mode = AR5K_ANTMODE_DEFAULT;
|
|
ah->ah_noise_floor = -95; /* until first NF calibration is run */
|
|
sc->ani_state.ani_mode = ATH5K_ANI_MODE_AUTO;
|
|
ah->ah_current_channel = &sc->channels[0];
|
|
|
|
/*
|
|
* Find the mac version
|
|
*/
|
|
srev = ath5k_hw_reg_read(ah, AR5K_SREV);
|
|
if (srev < AR5K_SREV_AR5311)
|
|
ah->ah_version = AR5K_AR5210;
|
|
else if (srev < AR5K_SREV_AR5212)
|
|
ah->ah_version = AR5K_AR5211;
|
|
else
|
|
ah->ah_version = AR5K_AR5212;
|
|
|
|
/*Fill the ath5k_hw struct with the needed functions*/
|
|
ret = ath5k_hw_init_desc_functions(ah);
|
|
if (ret)
|
|
goto err_free;
|
|
|
|
/* Bring device out of sleep and reset it's units */
|
|
ret = ath5k_hw_nic_wakeup(ah, 0, true);
|
|
if (ret)
|
|
goto err_free;
|
|
|
|
/* Get MAC, PHY and RADIO revisions */
|
|
ah->ah_mac_srev = srev;
|
|
ah->ah_mac_version = AR5K_REG_MS(srev, AR5K_SREV_VER);
|
|
ah->ah_phy_revision = ath5k_hw_reg_read(ah, AR5K_PHY_CHIP_ID) &
|
|
0xffffffff;
|
|
ah->ah_radio_5ghz_revision = ath5k_hw_radio_revision(ah,
|
|
CHANNEL_5GHZ);
|
|
ah->ah_phy = AR5K_PHY(0);
|
|
|
|
/* Try to identify radio chip based on it's srev */
|
|
switch (ah->ah_radio_5ghz_revision & 0xf0) {
|
|
case AR5K_SREV_RAD_5111:
|
|
ah->ah_radio = AR5K_RF5111;
|
|
ah->ah_single_chip = false;
|
|
ah->ah_radio_2ghz_revision = ath5k_hw_radio_revision(ah,
|
|
CHANNEL_2GHZ);
|
|
break;
|
|
case AR5K_SREV_RAD_5112:
|
|
case AR5K_SREV_RAD_2112:
|
|
ah->ah_radio = AR5K_RF5112;
|
|
ah->ah_single_chip = false;
|
|
ah->ah_radio_2ghz_revision = ath5k_hw_radio_revision(ah,
|
|
CHANNEL_2GHZ);
|
|
break;
|
|
case AR5K_SREV_RAD_2413:
|
|
ah->ah_radio = AR5K_RF2413;
|
|
ah->ah_single_chip = true;
|
|
break;
|
|
case AR5K_SREV_RAD_5413:
|
|
ah->ah_radio = AR5K_RF5413;
|
|
ah->ah_single_chip = true;
|
|
break;
|
|
case AR5K_SREV_RAD_2316:
|
|
ah->ah_radio = AR5K_RF2316;
|
|
ah->ah_single_chip = true;
|
|
break;
|
|
case AR5K_SREV_RAD_2317:
|
|
ah->ah_radio = AR5K_RF2317;
|
|
ah->ah_single_chip = true;
|
|
break;
|
|
case AR5K_SREV_RAD_5424:
|
|
if (ah->ah_mac_version == AR5K_SREV_AR2425 ||
|
|
ah->ah_mac_version == AR5K_SREV_AR2417){
|
|
ah->ah_radio = AR5K_RF2425;
|
|
ah->ah_single_chip = true;
|
|
} else {
|
|
ah->ah_radio = AR5K_RF5413;
|
|
ah->ah_single_chip = true;
|
|
}
|
|
break;
|
|
default:
|
|
/* Identify radio based on mac/phy srev */
|
|
if (ah->ah_version == AR5K_AR5210) {
|
|
ah->ah_radio = AR5K_RF5110;
|
|
ah->ah_single_chip = false;
|
|
} else if (ah->ah_version == AR5K_AR5211) {
|
|
ah->ah_radio = AR5K_RF5111;
|
|
ah->ah_single_chip = false;
|
|
ah->ah_radio_2ghz_revision = ath5k_hw_radio_revision(ah,
|
|
CHANNEL_2GHZ);
|
|
} else if (ah->ah_mac_version == (AR5K_SREV_AR2425 >> 4) ||
|
|
ah->ah_mac_version == (AR5K_SREV_AR2417 >> 4) ||
|
|
ah->ah_phy_revision == AR5K_SREV_PHY_2425) {
|
|
ah->ah_radio = AR5K_RF2425;
|
|
ah->ah_single_chip = true;
|
|
ah->ah_radio_5ghz_revision = AR5K_SREV_RAD_2425;
|
|
} else if (srev == AR5K_SREV_AR5213A &&
|
|
ah->ah_phy_revision == AR5K_SREV_PHY_5212B) {
|
|
ah->ah_radio = AR5K_RF5112;
|
|
ah->ah_single_chip = false;
|
|
ah->ah_radio_5ghz_revision = AR5K_SREV_RAD_5112B;
|
|
} else if (ah->ah_mac_version == (AR5K_SREV_AR2415 >> 4)) {
|
|
ah->ah_radio = AR5K_RF2316;
|
|
ah->ah_single_chip = true;
|
|
ah->ah_radio_5ghz_revision = AR5K_SREV_RAD_2316;
|
|
} else if (ah->ah_mac_version == (AR5K_SREV_AR5414 >> 4) ||
|
|
ah->ah_phy_revision == AR5K_SREV_PHY_5413) {
|
|
ah->ah_radio = AR5K_RF5413;
|
|
ah->ah_single_chip = true;
|
|
ah->ah_radio_5ghz_revision = AR5K_SREV_RAD_5413;
|
|
} else if (ah->ah_mac_version == (AR5K_SREV_AR2414 >> 4) ||
|
|
ah->ah_phy_revision == AR5K_SREV_PHY_2413) {
|
|
ah->ah_radio = AR5K_RF2413;
|
|
ah->ah_single_chip = true;
|
|
ah->ah_radio_5ghz_revision = AR5K_SREV_RAD_2413;
|
|
} else {
|
|
ATH5K_ERR(sc, "Couldn't identify radio revision.\n");
|
|
ret = -ENODEV;
|
|
goto err_free;
|
|
}
|
|
}
|
|
|
|
|
|
/* Return on unsuported chips (unsupported eeprom etc) */
|
|
if ((srev >= AR5K_SREV_AR5416) &&
|
|
(srev < AR5K_SREV_AR2425)) {
|
|
ATH5K_ERR(sc, "Device not yet supported.\n");
|
|
ret = -ENODEV;
|
|
goto err_free;
|
|
}
|
|
|
|
/*
|
|
* POST
|
|
*/
|
|
ret = ath5k_hw_post(ah);
|
|
if (ret)
|
|
goto err_free;
|
|
|
|
/* Enable pci core retry fix on Hainan (5213A) and later chips */
|
|
if (srev >= AR5K_SREV_AR5213A)
|
|
AR5K_REG_ENABLE_BITS(ah, AR5K_PCICFG, AR5K_PCICFG_RETRY_FIX);
|
|
|
|
/*
|
|
* Get card capabilities, calibration values etc
|
|
* TODO: EEPROM work
|
|
*/
|
|
ret = ath5k_eeprom_init(ah);
|
|
if (ret) {
|
|
ATH5K_ERR(sc, "unable to init EEPROM\n");
|
|
goto err_free;
|
|
}
|
|
|
|
ee = &ah->ah_capabilities.cap_eeprom;
|
|
|
|
/*
|
|
* Write PCI-E power save settings
|
|
*/
|
|
if ((ah->ah_version == AR5K_AR5212) && (pdev->is_pcie)) {
|
|
ath5k_hw_reg_write(ah, 0x9248fc00, AR5K_PCIE_SERDES);
|
|
ath5k_hw_reg_write(ah, 0x24924924, AR5K_PCIE_SERDES);
|
|
|
|
/* Shut off RX when elecidle is asserted */
|
|
ath5k_hw_reg_write(ah, 0x28000039, AR5K_PCIE_SERDES);
|
|
ath5k_hw_reg_write(ah, 0x53160824, AR5K_PCIE_SERDES);
|
|
|
|
/* If serdes programing is enabled, increase PCI-E
|
|
* tx power for systems with long trace from host
|
|
* to minicard connector. */
|
|
if (ee->ee_serdes)
|
|
ath5k_hw_reg_write(ah, 0xe5980579, AR5K_PCIE_SERDES);
|
|
else
|
|
ath5k_hw_reg_write(ah, 0xf6800579, AR5K_PCIE_SERDES);
|
|
|
|
/* Shut off PLL and CLKREQ active in L1 */
|
|
ath5k_hw_reg_write(ah, 0x001defff, AR5K_PCIE_SERDES);
|
|
|
|
/* Preserve other settings */
|
|
ath5k_hw_reg_write(ah, 0x1aaabe40, AR5K_PCIE_SERDES);
|
|
ath5k_hw_reg_write(ah, 0xbe105554, AR5K_PCIE_SERDES);
|
|
ath5k_hw_reg_write(ah, 0x000e3007, AR5K_PCIE_SERDES);
|
|
|
|
/* Reset SERDES to load new settings */
|
|
ath5k_hw_reg_write(ah, 0x00000000, AR5K_PCIE_SERDES_RESET);
|
|
mdelay(1);
|
|
}
|
|
|
|
/* Get misc capabilities */
|
|
ret = ath5k_hw_set_capabilities(ah);
|
|
if (ret) {
|
|
ATH5K_ERR(sc, "unable to get device capabilities: 0x%04x\n",
|
|
sc->pdev->device);
|
|
goto err_free;
|
|
}
|
|
|
|
/* Crypto settings */
|
|
ah->ah_aes_support = srev >= AR5K_SREV_AR5212_V4 &&
|
|
(ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
|
|
!AR5K_EEPROM_AES_DIS(ee->ee_misc5));
|
|
|
|
if (srev >= AR5K_SREV_AR2414) {
|
|
ah->ah_combined_mic = true;
|
|
AR5K_REG_ENABLE_BITS(ah, AR5K_MISC_MODE,
|
|
AR5K_MISC_MODE_COMBINED_MIC);
|
|
}
|
|
|
|
/* MAC address is cleared until add_interface */
|
|
ath5k_hw_set_lladdr(ah, (u8[ETH_ALEN]){});
|
|
|
|
/* Set BSSID to bcast address: ff:ff:ff:ff:ff:ff for now */
|
|
memcpy(common->curbssid, ath_bcast_mac, ETH_ALEN);
|
|
ath5k_hw_set_associd(ah);
|
|
ath5k_hw_set_opmode(ah, sc->opmode);
|
|
|
|
ath5k_hw_rfgain_opt_init(ah);
|
|
|
|
ath5k_hw_init_nfcal_hist(ah);
|
|
|
|
/* turn on HW LEDs */
|
|
ath5k_hw_set_ledstate(ah, AR5K_LED_INIT);
|
|
|
|
return 0;
|
|
err_free:
|
|
kfree(ah);
|
|
return ret;
|
|
}
|
|
|
|
/**
|
|
* ath5k_hw_detach - Free the ath5k_hw struct
|
|
*
|
|
* @ah: The &struct ath5k_hw
|
|
*/
|
|
void ath5k_hw_detach(struct ath5k_hw *ah)
|
|
{
|
|
ATH5K_TRACE(ah->ah_sc);
|
|
|
|
__set_bit(ATH_STAT_INVALID, ah->ah_sc->status);
|
|
|
|
if (ah->ah_rf_banks != NULL)
|
|
kfree(ah->ah_rf_banks);
|
|
|
|
ath5k_eeprom_detach(ah);
|
|
|
|
/* assume interrupts are down */
|
|
}
|