When operating two VAP on a MT7610 with encryption (PSK2, SAE, OWE),
only the first one to be created will transmit properly encrypteded
frames.
All subsequently created VAPs will sent out frames with the payload left
unencrypted, breaking multicast traffic (ICMP6 NDP) and potentially
disclosing information to a third party.
Disable GTK offloading and encrypt these frames in software to
circumvent this issue. THis only seems to be necessary on MT7610 chips,
as MT7612 is not affected from our testing.
Signed-off-by: David Bauer <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
(cherry picked from commit e6c0948ada)
If the minimum power is raised too much, it can make it impossible for weaker
clients to connect, and there are some scenarios where the false detects will
not go down no matter how much the sensitivity is adjusted.
Fixes connectivity issues in some rare cases
Signed-off-by: Felix Fietkau <[email protected]>
If a MCU timeout occurs before a hw restart completes, another hw restart
is scheduled, and the station state gets corrupted.
To speed up dealing with that, do not issue any MCU commands after the first
timeout, and defer handling timeouts until the reset has completed.
Also ignore errors in MCU commands during start/config to avoid making user
space fail on this condition. If it happens, another restart is scheduled
quickly, and that usually recovers the hardware properly.
Signed-off-by: Felix Fietkau <[email protected]>
The mt76_led_cleanup() function is called unconditionally, which
leads to a link error when CONFIG_LEDS is a loadable module or
disabled but mt76 is built-in:
drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_unregister_device':
mac80211.c:(.text+0x2ac): undefined reference to `led_classdev_unregister'
Use the same trick that is guarding the registration, using an
IS_ENABLED() check for the CONFIG_MT76_LEDS symbol that indicates
whether LEDs can be used or not.
Fixes: 36f7e2b2bb1d ("mt76: do not use devm API for led classdev")
Signed-off-by: Arnd Bergmann <[email protected]>
Acked-by: Felix Fietkau <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Do not set the tx/rx start bits in MT_MAC_SYS_CTRL from within initvals.
The driver sets these later when the hardware is ready
Signed-off-by: Felix Fietkau <[email protected]>
The ring is used for looping back tx powersave filtered frames, so it could
use some more room, in case more than one aggregate was queued
Signed-off-by: Felix Fietkau <[email protected]>
Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)
Signed-off-by: Felix Fietkau <[email protected]>
Avoids a theoretical corner case where the hardware could try to process
a stale descriptor after a watchdog reset
Signed-off-by: Felix Fietkau <[email protected]>
If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.
Cc: [email protected]
Signed-off-by: Felix Fietkau <[email protected]>
For transferring data over USB the optimal size is endpoint maxpacket.
For my hardware maxpaket for control endpoint is 64 bytes and changing
to this value from 128 bytes further shorten TBTT work time from
3ms to 1ms.
Signed-off-by: Stanislaw Gruszka <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Use larger batches for usb copy to speed this operation up. Otherwise it
would be too slow for copying new beacons or broadcast frames over usb.
Assure, that always a multiple of 4 Bytes is copied, as outlined in
850e8f6fbd "mt76: round up length on mt76_wr_copy" from Felix Fietkau.
Signed-off-by: Markus Theil <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Fix the following compilation warning in mt76_eeprom_override routine
when CONFIG_OF is not set and label 'out' is not actually used
drivers/net/wireless/mediatek/mt76/eeprom.c: In function ‘mt76_eeprom_override’:
drivers/net/wireless/mediatek/mt76/eeprom.c:100:1: warning: label ‘out’ defined but not used [-Wunused-label]
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
(cherry picked from commit 1c8e76f4de)
Current implementation always use default eeprom mac address to
configure device registers even if it is updated using
mt76_eeprom_override. Fix it initializing macaddr filed of mt76_dev data
structure with eeprom mac address and running mt76_eeprom_override
before mt76x02_mac_setaddr
Fixes: d1bc9bf2072c ("mt76: mt76x0: eeprom: add support for MAC address from OF")
Tested-by: Kevin Schmidt <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
[backported from upstream commit 693d060536abca7b16d2fb8e66aa56be2a2443a2]
Signed-off-by: David Bauer <[email protected]>
(cherry picked from commit 38f4c57989)
Before extracting the tid out of the packet, check if it was qos-data.
Only accept tid values 0-7
Also, avoid accepting the hardware queue as skb queue mapping, it could
lead to an overrun. Instead, derive the hardware queue from the tid number,
in order to avoid issues with packets being filtered multiple times.
This also fixes a mismatch between hardware and software queue indexes.
Signed-off-by: Felix Fietkau <[email protected]>
MCU_EXT_CMD_EFUSE_BUFFER_MODE needs more time on initialization, and
with only 10 seconds it sometimes runs into timeouts.
Signed-off-by: Felix Fietkau <[email protected]>
During the cleanup of the aggregation session, a rx handler (or release timer)
on another CPU might still hold a pointer to the reorder buffer and could
attempt to release some packets.
Clearing pointers during cleanup avoids a theoretical use-after-free bug here.
Signed-off-by: Felix Fietkau <[email protected]>
mt76x0e users reported some devices (e.g TP-Link Archer VR200v) have
been flashed with big endian radio partition. Add the possibility to
specify eeprom endianness using big-endian dts property and in case
covert eeprom data in little endian
Tested-by: Kevin Schmidt <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Make sure the MAC address is checked before function returns.
If CONFIG_OF is set and the device node is null, the function will
return directly, and an invalid MAC address will not be checked.
Signed-off-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
The sband->bitrates[] array has "sband->n_bitrates" elements so this
check needs to be >= instead of > or we could read beyond the end of the
array.
These values come from when we call mt76_register_device():
ret = mt76_register_device(&dev->mt76, true, mt7603_rates,
ARRAY_SIZE(mt7603_rates));
Here sband->bitrates[] is mt7603_rates[] and ->n_bitrates is the
ARRAY_SIZE()
Fixes: 5ce09c1a7907 ("mt76: track rx airtime for airtime fairness and survey")
Signed-off-by: Dan Carpenter <[email protected]>
Reset MT_MIB_STAT_CCA after channel switch since it is used to track busy
time starting from 'commit dcff8d4dc301 ("mt76: mt7603: switch to a
different counter for survey busy time")'
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
To avoid having the hardware potentially write to memory behind stale
descriptors, set the dma-done flag on all of them before cleaning up
allocated rx buffers
Signed-off-by: Felix Fietkau <[email protected]>
The MT7615 firmware needs to know the association id at creation time,
which is unavailable during the transition from notexist to none in
.sta_state.
This can cause a number of issues, probably also breaking powersave
support.
Signed-off-by: Felix Fietkau <[email protected]>
Parse configured {tx,rx} mask from eeprom data instead of just setting it
to four tx-rx streams
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_get_antenna in mac80211.c in order to be reused by all
drivers. Initialize .get_antenna function pointer for mt76x0, mt7603,
mt7615 and mt76x2u drivers
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Fix possible out-of-bound access of status rates array in
mt7615_fill_txs/mt7603_fill_txs routines
Fixes: c5211e997eca ("mt76: mt7603: rework and fix tx status reporting")
Fixes: 4af81f02b49c ("mt76: mt7615: sync with mt7603 rate control changes")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Set switch_reason to CH_SWITCH_SCAN_BYPASS_DPD during frequency scanning
in order to disable radar pattern detector
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move interface modes declaration in common code since now mt76
chipsets support all modes (NL80211_IFTYPE_STATION, NL80211_IFTYPE_AP,
NL80211_IFTYPE_MESH_POINT and NL80211_IFTYPE_ADHOC)
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Enable IFTYPE_ADHOC support on 7615 devices. The feature has been tested
using a mt76x2 device as wireless peer.
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move SUPPORTS_REORDERING_BUFFER hw property configuration from chip
specific code to mt76_register_device since it is supported by all mt76
drivers
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Convert mt76_is_mmio and mt76_is_usb to rely on mt76_dev instead of
mt76x02_dev since this is a property not strictly related to hw chipset
and it will be more reusable
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Fixes gcc '-Wunused-but-set-variable' warning:
drivers/net/wireless/mediatek/mt76/dma.c: In function mt76_dma_rx_fill:
drivers/net/wireless/mediatek/mt76/dma.c:377:6: warning: variable idx set but not used [-Wunused-but-set-variable]
It is not used since commit 17f1de56df05 ("mt76:
add common code shared between multiple chipsets")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: zhengbin <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
rate controller and throughput are very sensitive to tx status timing.
In order to improve performances when the system is heavily loaded,
substitute stat_work delayed_work with a regular work_struct and create
a mt76u dedicated workqueue for tx status reporting
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
usb drivers are supposed to communicate using usb_interface instead
mt76x{0,2}u is now registering through usb_device. Fix it by passing
usb_intf device to mt76_alloc_device routine.
Fixes: 112f980ac8926 ("mt76usb: use usb_dev private data")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Tested-By: Zero_Chaos <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
mt76 dma layer is supposed to unmap skb data buffers while keep txwi
mapped on hw dma ring. At the moment mt76 wrongly unmap txwi or does
not unmap data fragments in even positions for non-linear skbs. This
issue may result in hw hangs with A-MSDU if the system relies on IOMMU
or SWIOTLB. Fix this behaviour properly unmapping data fragments on
non-linear skbs.
Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets")
Signed-off-by: Lorenzo Bianconi <[email protected]>
On same device (e.g. U7612E-H1) PCIE_ASPM causes continuous mcu hangs and
instability. Since mt76x2 series does not manage PCIE PS states, first we
try to disable ASPM using pci_disable_link_state. If it fails, we will
disable PCIE PS configuring PCI registers.
This patch has been successfully tested on U7612E-H1 mini-pice card
Tested-by: Oleksandr Natalenko <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Update ewma packet length in mt76x02u_tx_prepare_skb as it is
done for pci counterpart in order to properly estimate tx time on
current channel
Signed-off-by: Lorenzo Bianconi <[email protected]>
Since mt76x0 does not save the phy calibration data it is not necessary
to wait 350ms in mt76x0_phy_calibrate
Tested-by: Sid Hayn <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
