- Remove no-op code for queue lock/unlock, which is no longer needed
- Set a missing DMA flag
- Wait for full completion of error recovery before restarting tx
- Schedule IRQ tasklet to ensure that IRQ mask gets written
Signed-off-by: Felix Fietkau <[email protected]>
There are firmware or hardware issues, which are currently causing tx hangs
when attempting to use these interfaces
Signed-off-by: Felix Fietkau <[email protected]>
The device tree partition offset needs to be added to the function argument,
instead of overwriting it.
Fixes an issue where wrong EEPROM data was sent to the firmware as
pre-calibration data on MT7915.
Fixes: 495184ac91bb ("mt76: mt7915: add support for applying pre-calibration data")
Signed-off-by: Felix Fietkau <[email protected]>
Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
header, and if so dropping the complete A-MSDU frame. This mitigates
known attacks, although new (unknown) aggregation-based attacks may
remain possible.
This defense works because in A-MSDU aggregation injection attacks, a
normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
header. In other words, the destination MAC address of the first A-MSDU
subframe contains the start of an RFC1042 header during an aggregation
attack. We can detect this and thereby prevent this specific attack.
For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
Through Frame Aggregation and Fragmentation".
Signed-off-by: Felix Fietkau <[email protected]>
Instead of attaching the last reported rate to tx packets, use
ieee80211_tx_status_ext to immediately pass the rate to mac80211 after
receiving it from the firmware.
Preparation for implementing full tx status reporting
Signed-off-by: Felix Fietkau <[email protected]>
Use ieee80211_tx_status_ext instead of ieee80211_free_skb and
ieee80211_tx_status. This makes it compatible with 802.3 encap offload
and improves performance by removing a redundant sta lookup
Signed-off-by: Felix Fietkau <[email protected]>
The hardware can only handle 64 subframes in rx direction and 128 for tx.
Improves throughput with APs that can handle more than that
Signed-off-by: Felix Fietkau <[email protected]>
For MT7663, the availability of the patch files is used to detect, which
corresponding firmware is going to be used (AP firmware or STA offload
firmware). If the ROM patch was already applied, it could attempt to
load the wrong firmware (without considering the alternative).
Signed-off-by: Felix Fietkau <[email protected]>
MT7663 uses different bits for communicating reset commands/status between MCU
and host. Also add an extra initial reset command.
Signed-off-by: Felix Fietkau <[email protected]>
After DMA reset, tx status information for queued frames will never arrive.
Flush the queue to free skbs immediately instead of waiting for a timeout
Signed-off-by: Felix Fietkau <[email protected]>
Ensures that header translation is disabled for interfaces that do not support
it.
Fixes: bb1262e7199b ("mt76: mt7615: add support for rx decapsulation offload")
Signed-off-by: Felix Fietkau <[email protected]>
When receiving an A-MSDU containing only a single subframe, status->last_amsdu
is set, but no previous head is present in the rx A-MSDU queue.
In this case, the A-MSDU subframe will be held until the next one is received,
potentially causing significant extra latency.
Rework the code to make it easier to read and less convoluted, and release the
newly created head if status->last_amsdu is set.
Signed-off-by: Felix Fietkau <[email protected]>
After chip reset, the DMA scheduler needs to be initialized as well.
Since the code is PCI/SoC specific, move it to pci_mac.c, so that it
can depend on a function in dma.c
Signed-off-by: Felix Fietkau <[email protected]>
When disassociating and clearing the BSSID of a repeater entry used by a client
mode interface, the corresponding MAC address entry can get lost too, causing
the client interface to not be able to associate anymore.
Fix this by also refreshing the MAC address when setting the BSSID
Signed-off-by: Felix Fietkau <[email protected]>
With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap
could potentially inherit a non-zero value from stack garbage.
If this happens, it will cause DMA mappings for MCU command frames to not be
unmapped after completion
Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
Cc: [email protected]
Signed-off-by: Felix Fietkau <[email protected]>
Deleting a key with the previous key index deletes the current key
Rework the code to better keep track of multiple keys and check for the
key index before deleting the current key
Signed-off-by: Felix Fietkau <[email protected]>
When running out of room in the tx queue after calling drv->tx_prepare_skb,
the buffer list will already have been modified on MT7615 and newer drivers.
This can leak a DMA mapping and will show up as swiotlb allocation failures
on x86.
Fix this by moving the queue length check further up. This is less accurate,
since it can overestimate the needed room in the queue on MT7615 and newer,
but the difference is small enough to not matter in practice.
Signed-off-by: Felix Fietkau <[email protected]>
For AP and Client mode, the hardware can pass received packets as 802.3 frames
that can be passed to the network stack as-is.
Signed-off-by: Felix Fietkau <[email protected]>
The first pointer in the txp needs to be unmapped as well, otherwise it will
leak DMA mapping entries
Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
Signed-off-by: Felix Fietkau <[email protected]>
The first pointer in the txp needs to be unmapped as well, otherwise it will
leak DMA mapping entries
Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
Signed-off-by: Felix Fietkau <[email protected]>
There were multiple issues in the current key set/remove code:
- deleting a key with the previous key index deletes the current key
- BIP key would only be uploaded correctly initially and corrupted on rekey
Rework the code to better keep track of multiple keys and check for the
key index before deleting the current key
Signed-off-by: Felix Fietkau <[email protected]>
With a maximum length of 7991, the radio sometimes locks up under load when
transmitting A-MSDU frames to lots of stations. Using the lower limit makes
it work reliably again
Signed-off-by: Felix Fietkau <[email protected]>
Instead of holding it for the duration of an entire station schedule run,
which can block out competing tasks for a significant amount of time,
only hold it for scheduling one batch of packets for one station.
Improves responsiveness under load
Signed-off-by: Felix Fietkau <[email protected]>
For performance reasons, mt7915 supports using 2 PCIE gen1 links on
platforms that don't support gen2.
Add support for using this to move traffic for a second DBDC band onto
a dedicated link
Signed-off-by: Felix Fietkau <[email protected]>
Since vif indexes are per-phy, we need to factor in the phy index to avoid
collisions on the WTBL index
Signed-off-by: Felix Fietkau <[email protected]>
Only clear dev->phy2 after the phy is gone, the driver may still need to access
it until shutdown is complete
Signed-off-by: Felix Fietkau <[email protected]>
When the EEPROM band fields contain default values, assign 2.4 GHz to the
first band and 5 GHz to the second.
Signed-off-by: Felix Fietkau <[email protected]>
It causes high CPU load on the WA core, which can lead to extra latency when
using many stations. Dropping packets for long queues is managed by mac80211
fq_codel instead
Signed-off-by: Felix Fietkau <[email protected]>
Add support for passing flags for selecting the MCU target and query type
instead of trying to detect it based on the command id
Signed-off-by: Felix Fietkau <[email protected]>
This is causing some extreme latency spikes when sending traffic to
multiple stations at the same time. Disable this until the firmware issue
is sorted out
Signed-off-by: Felix Fietkau <[email protected]>
Instead of stopping and waking only a single queue, handle all phy tx queues
mapped ot the same hardware queue.
Also allow the driver to block tx queues
Signed-off-by: Felix Fietkau <[email protected]>
It was accidentally dropped while adding multiple wiphy support
Fixes fast-rx support and avoids handling reordering in both mac80211
and the driver
Cc: [email protected]
Fixes: c89d36254155 ("mt76: add function for allocating an extra wiphy")
Signed-off-by: Felix Fietkau <[email protected]>
When per-packet rate reporting is enabled, the hardware can get stuck under
some conditions. It self-recovers quickly, but in practice this leads to
reduced performance.
In order to avoid running into this issue, disable per-packet rate reporting
by default and query the rx rate from firmware instead, unless monitor mode
is enabled.
Signed-off-by: Felix Fietkau <[email protected]>
Can be used by the caller to get the response data directly instead of using the
hack of storing the result in internal data structures from .mcu_parse_response
Signed-off-by: Felix Fietkau <[email protected]>
The firmware/hardware supports only 16 entries. Trying to use more can lead
to timeouts on some firmware versions
Signed-off-by: Felix Fietkau <[email protected]>
In the MT7915 info, the fields for the WLAN index / queue overlap with the
token id, and the MT_TX_FREE_PAIR bit indicates, which one is present.
If MT_TX_FREE_PAIR is set, skip processing the token index, since the data
will not be valid.
This fixes accidentally freeing tokens which are still in use by the
hardware with a wrong station pointer.
Signed-off-by: Felix Fietkau <[email protected]>
When looking for a MAC address slot, start by using main BSSID slots 1-3,
afterwards use 16 repeater mode BSSID slots, then start using the slots
usually used for AP mode.
This search order should prevent unnecessary conflicts with AP mode interfaces
on the same PHY
Signed-off-by: Felix Fietkau <[email protected]>
Felix Fietkau