From: "Nerijus Bendžiūnas" <nerijus.bendziunas@gmail.com>
To: "Toke Høiland-Jørgensen" <toke@toke.dk>
Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
"John W . Linville" <linville@tuxdriver.com>,
Simon Wunderlich <sw@simonwunderlich.de>,
Oleksij Rempel <linux@rempel-privat.de>,
Kalle Valo <kvalo@kernel.org>,
Jeff Johnson <jeff.johnson@oss.qualcomm.com>,
stable@vger.kernel.org
Subject: [PATCH ath-next v4 1/8] wifi: ath9k: return an error from a failed multi-register read
Date: Wed, 16 Sep 2026 20:34:22 +0300 [thread overview]
Message-ID: <20260916173429.403889-2-nerijus.bendziunas@gmail.com> (raw)
In-Reply-To: <20260916173429.403889-1-nerijus.bendziunas@gmail.com>
ath9k_multi_regread() logs a failed or timed-out WMI read and still
copies its result buffer to the caller, so the caller gets
uninitialised stack data for every register it asked for. The MIB
counters in ath9k_hw_update_mibstats() then take arbitrary jumps, and
an EEPROM read at probe fails on the checksum rather than on the read.
Give the multi_read op a return value, return the WMI error from
ath9k_multi_regread(), and check it: skip the counter update and fail
the EEPROM fill when the read did not happen.
Fixes: 09a525d33870 ("ath9k_htc: Add multiple register read API")
Assisted-by: LLM
Signed-off-by: Nerijus Bendžiūnas <nerijus.bendziunas@gmail.com>
---
drivers/net/wireless/ath/ath.h | 2 +-
drivers/net/wireless/ath/ath9k/ani.c | 4 +++-
drivers/net/wireless/ath/ath9k/eeprom.c | 10 +++++++---
drivers/net/wireless/ath/ath9k/eeprom.h | 2 +-
drivers/net/wireless/ath/ath9k/eeprom_4k.c | 4 +---
drivers/net/wireless/ath/ath9k/eeprom_9287.c | 7 +++----
drivers/net/wireless/ath/ath9k/eeprom_def.c | 5 ++---
drivers/net/wireless/ath/ath9k/htc_drv_init.c | 7 +++++--
drivers/net/wireless/ath/ath9k/init.c | 6 ++++--
9 files changed, 27 insertions(+), 20 deletions(-)
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 34654f710d8a..d1af0b81768a 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -126,7 +126,7 @@ enum ath_cipher {
*/
struct ath_ops {
unsigned int (*read)(void *, u32 reg_offset);
- void (*multi_read)(void *, u32 *addr, u32 *val, u16 count);
+ int (*multi_read)(void *hw_priv, u32 *addr, u32 *val, u16 count);
void (*write)(void *, u32 val, u32 reg_offset);
void (*enable_write_buffer)(void *);
void (*write_flush) (void *);
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 41d192709e8e..6d9f0ee26237 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -111,7 +111,9 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah,
AR_FCS_FAIL, AR_BEACON_CNT};
u32 data[5];
- REG_READ_MULTI(ah, &addr[0], &data[0], 5);
+ if (REG_READ_MULTI(ah, &addr[0], &data[0], 5))
+ return;
+
/* AR_RTS_OK */
stats->rts_good += data[0];
/* AR_RTS_FAIL */
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index df58dc02e104..6bf86d017c13 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -76,7 +76,7 @@ bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList, u16 listSize,
return false;
}
-void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
+bool ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
int eep_start_loc, int size)
{
int i = 0, j, addr;
@@ -88,7 +88,8 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
((addr + eep_start_loc) << AR5416_EEPROM_S);
i++;
if (i == 8) {
- REG_READ_MULTI(ah, addrdata, data, i);
+ if (REG_READ_MULTI(ah, addrdata, data, i))
+ return false;
for (j = 0; j < i; j++) {
*eep_data = data[j];
@@ -99,13 +100,16 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
}
if (i != 0) {
- REG_READ_MULTI(ah, addrdata, data, i);
+ if (REG_READ_MULTI(ah, addrdata, data, i))
+ return false;
for (j = 0; j < i; j++) {
*eep_data = data[j];
eep_data++;
}
}
+
+ return true;
}
static bool ath9k_hw_nvram_read_array(u16 *blob, size_t blob_size,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index f1cde43fcb55..dc5ad4a3e752 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -680,7 +680,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data);
int ath9k_hw_nvram_swap_data(struct ath_hw *ah, bool *swap_needed, int size);
bool ath9k_hw_nvram_validate_checksum(struct ath_hw *ah, int size);
bool ath9k_hw_nvram_check_version(struct ath_hw *ah, int version, int minrev);
-void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
+bool ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
int eep_start_loc, int size);
void ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
u8 *pVpdList, u16 numIntercepts,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 3e16cfe059f3..d5a8275ceb03 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -53,9 +53,7 @@ static bool __ath9k_hw_usb_4k_fill_eeprom(struct ath_hw *ah)
{
u16 *eep_data = (u16 *)&ah->eeprom.map4k;
- ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, 64, SIZE_EEPROM_4K);
-
- return true;
+ return ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, 64, SIZE_EEPROM_4K);
}
static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index c139ac49ccf6..73213416fc8c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -55,10 +55,9 @@ static bool __ath9k_hw_usb_ar9287_fill_eeprom(struct ath_hw *ah)
{
u16 *eep_data = (u16 *)&ah->eeprom.map9287;
- ath9k_hw_usb_gen_fill_eeprom(ah, eep_data,
- AR9287_HTC_EEP_START_LOC,
- SIZE_EEPROM_AR9287);
- return true;
+ return ath9k_hw_usb_gen_fill_eeprom(ah, eep_data,
+ AR9287_HTC_EEP_START_LOC,
+ SIZE_EEPROM_AR9287);
}
static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 5ba467cb7425..085e544f7c4b 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -112,9 +112,8 @@ static bool __ath9k_hw_usb_def_fill_eeprom(struct ath_hw *ah)
{
u16 *eep_data = (u16 *)&ah->eeprom.def;
- ath9k_hw_usb_gen_fill_eeprom(ah, eep_data,
- 0x100, SIZE_EEPROM_DEF);
- return true;
+ return ath9k_hw_usb_gen_fill_eeprom(ah, eep_data,
+ 0x100, SIZE_EEPROM_DEF);
}
static bool ath9k_hw_def_fill_eeprom(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 6de78ae85726..3798d3375158 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -252,8 +252,8 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
return be32_to_cpu(val);
}
-static void ath9k_multi_regread(void *hw_priv, u32 *addr,
- u32 *val, u16 count)
+static int ath9k_multi_regread(void *hw_priv, u32 *addr,
+ u32 *val, u16 count)
{
struct ath_hw *ah = hw_priv;
struct ath_common *common = ath9k_hw_common(ah);
@@ -273,11 +273,14 @@ static void ath9k_multi_regread(void *hw_priv, u32 *addr,
if (unlikely(ret)) {
ath_dbg(common, WMI,
"Multiple REGISTER READ FAILED (count: %d)\n", count);
+ return ret;
}
for (i = 0; i < count; i++) {
val[i] = be32_to_cpu(tmpval[i]);
}
+
+ return 0;
}
static void ath9k_regwrite_multi(struct ath_common *common)
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 2f0c4ef86b7e..e425d355bf94 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -201,13 +201,15 @@ static unsigned int ath9k_ioread32(void *hw_priv, u32 reg_offset)
return val;
}
-static void ath9k_multi_ioread32(void *hw_priv, u32 *addr,
- u32 *val, u16 count)
+static int ath9k_multi_ioread32(void *hw_priv, u32 *addr,
+ u32 *val, u16 count)
{
int i;
for (i = 0; i < count; i++)
val[i] = ath9k_ioread32(hw_priv, addr[i]);
+
+ return 0;
}
--
2.55.0
next prev parent reply other threads:[~2026-09-16 17:34 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-16 17:34 [PATCH ath-next v4 0/8] wifi: ath9k: fix register access and spectral scan filter handling on ath9k_htc Nerijus Bendžiūnas
2026-09-16 17:34 ` Nerijus Bendžiūnas [this message]
2026-09-16 17:34 ` [PATCH ath-next v4 2/8] wifi: ath9k_htc: fix the byte count of a full RMW buffer flush Nerijus Bendžiūnas
2026-09-16 17:34 ` [PATCH ath-next v4 3/8] wifi: ath9k_htc: refuse a command that fills whole USB packets Nerijus Bendžiūnas
2026-09-16 17:34 ` [PATCH ath-next v4 4/8] wifi: ath9k: stop a failed register read from opening the RX filter Nerijus Bendžiūnas
2026-09-16 17:34 ` [PATCH ath-next v4 5/8] wifi: ath9k: clear the PHY error filter when a spectral scan is disabled Nerijus Bendžiūnas
2026-09-16 17:34 ` [PATCH ath-next v4 6/8] wifi: ath9k: count spectral samples in the driver's own RX stats Nerijus Bendžiūnas
2026-09-16 17:34 ` [PATCH ath-next v4 7/8] wifi: ath9k_htc: pass CRC-tagged spectral samples to the FFT parser Nerijus Bendžiūnas
2026-09-16 17:34 ` [PATCH ath-next v4 8/8] wifi: ath9k_htc: derive the PHY error filter bits from software state Nerijus Bendžiūnas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260916173429.403889-2-nerijus.bendziunas@gmail.com \
--to=nerijus.bendziunas@gmail.com \
--cc=jeff.johnson@oss.qualcomm.com \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linux@rempel-privat.de \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
--cc=sw@simonwunderlich.de \
--cc=toke@toke.dk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®