If the minimum power is raised too much, it can make it impossible for weaker
clients to connect, and there are some scenarios where the false detects will
not go down no matter how much the sensitivity is adjusted.
Fixes connectivity issues in some rare cases
Signed-off-by: Felix Fietkau <[email protected]>
If the hardware receives an oversized packet with too many rx fragments,
skb_shinfo(skb)->frags can overflow and corrupt memory of adjacent pages.
This becomes especially visible if it corrupts the freelist pointer of
a slab page.
Cc: [email protected]
Signed-off-by: Felix Fietkau <[email protected]>
When injecting beacon frames via monitor interface, they must not be sent to
the beacon hardware queue, because they don't follow normal hardware beacon tx
rules.
Fix sending them by adding a flag to mt7615_mac_write_txwi that selects the
beacon queue for tx, and use it only from mt7615_mcu_set_bcn.
Signed-off-by: Felix Fietkau <[email protected]>
If a MCU timeout occurs before a hw restart completes, another hw restart
is scheduled, and the station state gets corrupted.
To speed up dealing with that, do not issue any MCU commands after the first
timeout, and defer handling timeouts until the reset has completed.
Also ignore errors in MCU commands during start/config to avoid making user
space fail on this condition. If it happens, another restart is scheduled
quickly, and that usually recovers the hardware properly.
Signed-off-by: Felix Fietkau <[email protected]>
Overwriting the RMAC_CHFREQ register is not reliable enough, as the firmware
could potentially write it again.
Since there is no PHY index indication in the rx info, we need to use another
way:
If both PHYs are using different channels, find the PHY where chfreq matches
the register value.
The only corner case remaining is when both PHYs are using the same channel.
In that case, the per-packet noise value on the primary PHY will have
information belonging to the chains of the secondary PHY from the previous
received packet of that PHY. The secondary PHY will set noise to 0 for extra
chains.
Signed-off-by: Felix Fietkau <[email protected]>
Unify code converting between the different txpower values. Always add/remove
the combined txpower delta before dividing half-dB values.
Also fix the combined txpower delta values. The correct half-dB delta for
3 chains is 9, not 8.
Signed-off-by: Felix Fietkau <[email protected]>
Do not set the tx/rx start bits in MT_MAC_SYS_CTRL from within initvals.
The driver sets these later when the hardware is ready
Signed-off-by: Felix Fietkau <[email protected]>
The second PHY receives no packets unless there is an active vif present.
Set the WANT_MONITOR_VIF flag to deal with that
Signed-off-by: Felix Fietkau <[email protected]>
Send an undersized corrupt packet to the DMA queue, which causes the
firmware to issue a full chip reset
Signed-off-by: Felix Fietkau <[email protected]>
When the firmware detects a problem, it needs the host to stop/reset DMA and
resume it again when the hardware state has been reset.
Signed-off-by: Felix Fietkau <[email protected]>
Setting the tx power by manipulating EEPROM may in some cases not be enough,
since it only covers the base target power and not per-rate offsets.
In other cases, it could limit tx power of rates too much, possibly reducing
throughput or range.
Use firmware support for applying per-rate limit and power offsets for
different values of Nss.
Signed-off-by: Felix Fietkau <[email protected]>
MT7622 does not have the CR4 microcontroller sitting in the data path.
Because of that, it uses the chip's native tx descriptor format instead of
something parsed and converted by the firmware.
Co-developed-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
MT7622 does not have a CR4 microcontroller, so it only uses its own N9
firmware.
Co-developed-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
When sending EEPROM data to the MCU, MT7622 uses a longer buffer
Co-developed-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
MT7622 queue mapping is different from MT7615 and requires an extra dma
scheduler init and a few register tweaks
Co-developed-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
MT7622 uses more interrupt bits for queue tx completion events.
Enabling those extra bits is harmless on MT7615
Co-developed-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
The beginning of the struct is guaranteed to be 4-byte aligned, and this
attribute allows the compiler to generate more efficient code
Signed-off-by: Felix Fietkau <[email protected]>
The ring is used for looping back tx powersave filtered frames, so it could
use some more room, in case more than one aggregate was queued
Signed-off-by: Felix Fietkau <[email protected]>
Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)
Signed-off-by: Felix Fietkau <[email protected]>
Avoids a theoretical corner case where the hardware could try to process
a stale descriptor after a watchdog reset
Signed-off-by: Felix Fietkau <[email protected]>
The hardware does not support using the same MAC address for interfaces,
even if they are on different bands.
In the future this will be made configurable via device tree
Signed-off-by: Felix Fietkau <[email protected]>
Before extracting the tid out of the packet, check if it was qos-data.
Only accept tid values 0-7
Also, avoid accepting the hardware queue as skb queue mapping, it could
lead to an overrun. Instead, derive the hardware queue from the tid number,
in order to avoid issues with packets being filtered multiple times.
This also fixes a mismatch between hardware and software queue indexes.
Signed-off-by: Felix Fietkau <[email protected]>
MCU_EXT_CMD_EFUSE_BUFFER_MODE needs more time on initialization, and
with only 10 seconds it sometimes runs into timeouts.
Signed-off-by: Felix Fietkau <[email protected]>
During the cleanup of the aggregation session, a rx handler (or release timer)
on another CPU might still hold a pointer to the reorder buffer and could
attempt to release some packets.
Clearing pointers during cleanup avoids a theoretical use-after-free bug here.
Signed-off-by: Felix Fietkau <[email protected]>
To avoid having the hardware potentially write to memory behind stale
descriptors, set the dma-done flag on all of them before cleaning up
allocated rx buffers
Signed-off-by: Felix Fietkau <[email protected]>
The MT7615 firmware needs to know the association id at creation time,
which is unavailable during the transition from notexist to none in
.sta_state.
This can cause a number of issues, probably also breaking powersave
support.
Signed-off-by: Felix Fietkau <[email protected]>
Loading the mcu firmware and waiting for it to boot takes a long time,
which adds a significant amount to the system boot time.
Fix this by running the mcu init from a workqueue and waiting for it to
complete before starting the phy or issuing mcu commands via debugfs
Signed-off-by: Felix Fietkau <[email protected]>
This is only used for testing for now. In the future it will be possible to
enable the second PHY through an proper API via device tree
Signed-off-by: Felix Fietkau <[email protected]>
Beacons and management frames need to explicitly select the alternate tx
queues in order to be sent out on the right phy
Signed-off-by: Felix Fietkau <[email protected]>
Program the RMAC CHFREQ registers to properly indicate the band that the
frames are received on.
Add some sanity checks to the programmed values, because the firmware
programs these registers differently
Signed-off-by: Felix Fietkau <[email protected]>
Move chainmask to struct mt7615_phy and instead of needlessly making the
format similar to values for older chips, make it refer to the actual chain
bits used for the rx/tx path.
This is important for multiple wiphy support, where for a secondary phy,
antenna_mask will start at 0, and chainmask will start at the chain offset
(bit 2)
Signed-off-by: Felix Fietkau <[email protected]>
There are two DFS detectors on the chip. When using 160 MHz channel bandwidth
(not supported in dual-wiphy mode), both are used. Otherwise, one detector is
used per wiphy.
Rework the code to start/stop them separately per phy and to indicate the
radar event on the right phy based on the detector index
Signed-off-by: Felix Fietkau <[email protected]>
Add support for an extra wiphy in mt76_set_channel and mt76_get_survey
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
On the first wiphy, hw->priv will point to struct mt76_dev, which contains a
struct mt76_phy at the start. For the secondary wiphy, hw->priv will point
to a mt76_phy encapsulated in a driver specific struct
To simplify access to struct mt76_phy members from drivers, the driver specific
device struct is changed to add a union of struct mt76_dev and struct mt76_phy
as the first element
Signed-off-by: Felix Fietkau <[email protected]>
status->ampdu_ref can be 0 if the first frame is an A-MPDU. Avoid calling
mt76_airtime_flush_ampdu again without reinitializing the status wcid by
checking dev->rx_ampdu_len first.
Signed-off-by: Felix Fietkau <[email protected]>
A rcu read locked section is not allowed to sleep, and the rcu lock here
isn't actually necessary, because we're holding dev->mutex.
Fixes an issue when the tid work item is still running while freeing
a station or stopping the aggregation session
Signed-off-by: Felix Fietkau <[email protected]>
if napi_complete() returns false, it means that polling is still pending.
Interrupts should not fire until the polling is no longer scheduled
Signed-off-by: Felix Fietkau <[email protected]>
Cancel the workqueue after the tid has been cleaned up, in order to
avoid a possible rescheduling from within the work function.
Signed-off-by: Felix Fietkau <[email protected]>
status.info could point to skb->cb, leading to a use-after-free after the tx
status has been reported to mac80211
Signed-off-by: Felix Fietkau <[email protected]>
With the devm API, the unregister happens after the device cleanup is done,
after which the struct mt76_dev which contains the led_cdev has already been
freed. This leads to a use-after-free bug that can crash the system.
Signed-off-by: Felix Fietkau <[email protected]>
Like on mt7603, MIB status register 16 tracks CCA time, but does not
include tx time. Switch to status register 9 to includ NAV and tx
time as well.
Signed-off-by: Felix Fietkau <[email protected]>
Felix Fietkau