When an AER error occurs and the bus is hung, the register reads return
0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in
an invalid memory access when accessing q->desc[] or q->entry[].
Unable to handle kernel paging request at virtual address
ffffffc01099eac0
pc : mt76_dma_add_buf+0x124/0x188 [mt76]
lr : mt76_dma_rx_fill+0x11c/0x1d8 [mt76]
sp : ffffffc016d9bbf0
x29: ffffffc016d9bc10 x28: 0000000000000000
x27: 0000000000000000 x26: ffffffb7855e50b8
x25: ffffffb80d04f000 x24: 0000000000000000
x23: 0000000000000ec0 x22: ffffffb796803648
x21: ffffffb796801f80 x20: ffffffb7968035f8
x19: 0000000000000ec0 x18: 0000000000000000
x17: 000000004ec00000 x16: 000000000ec00000
x15: ffffffc01099eac0 x14: 000000004ec00000
x13: 00000000ffc5a000 x12: ffffffc016d9bc32
x11: 00000000ffffffff x10: 0000000000000002
x9 : 0000000000000000 x8 : 000000000000b4ac
x7 : 0000000000000a20 x6 : ffffffb6c1806400
x5 : 0000000000000000 x4 : ffffffb80d04f000
x3 : 0000000000000000 x2 : 0000000000000001
x1 : 000000000ec04000 x0 : ffffffb7968035f8
Call trace:
mt76_dma_add_buf+0x124/0x188 [mt76 (HASH:1029 4)]
mt76_dma_rx_reset+0xe8/0xfc [mt76 (HASH:1029 4)]
mt7921_wpdma_reset+0x188/0x1b0 [mt7921e (HASH:ee48 5)]
mt7921e_mac_reset+0x128/0x418 [mt7921e (HASH:ee48 5)]
mt7921_mac_reset_work+0xac/0x1a8 [mt7921_common (HASH:f721 6)]
process_one_work+0x188/0x514
worker_thread+0x12c/0x300
kthread+0x140/0x1fc
ret_from_fork+0x10/0x30
Fix the invalid memory access by validating the DMA index read from the
hardware before it is used as a queue index. An out-of-range value, such
as the 0xFFFFFFFF returned while the bus is hung, is now clamped so it can
no longer corrupt q->head or q->tail. In addition, check the bus_hung flag
in mt7921_mac_reset_work() before attempting the reset sequence, reject MCU
messages while the bus is hung, and install no-op bus operations when an
unrecoverable AER error is detected, preventing further invalid hardware
accesses.
Due to hardware limitations - such as the lack of a connected hardware
reset pin or the absence of host re-probe functionality - affected Wi-Fi
devices may not fully recover to a normal operational state after
certain errors, even with AER enabled.
Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets")
Co-developed-by: Sean Wang <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Co-developed-by: Jeff Hsu <[email protected]>
Signed-off-by: Jeff Hsu <[email protected]>
Signed-off-by: Eason Lai <[email protected]>
Co-developed-by: Michael Lo <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
When wait_resp is not set but the ACK option is enabled in the MCU TXD,
the ACK event is enqueued to the MCU event queue without being dequeued
by the original MCU command request.
Any orphaned ACK events will only be removed from the queue when another
MCU command requests a response. Due to sequence index mismatches, these
events are discarded one by one until a matching sequence index is found.
However, if several MCU commands that do not require a response continue
to fill up the event queue, there is a risk that when an MCU command with
wait_resp enabled is issued, it may dequeue the wrong event skb,
especially if the queue contains events with all possible sequence
indices.
Signed-off-by: StanleyYP Wang <[email protected]>
Signed-off-by: Shayne Chen <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
MediaTek has asked to switch from the ISC license to BSD-3-Clause-Clear,
in order to improve clarity and the legal integrity of the code.
The BSD-3-Clause license includes the "no endorsement" clause, which is
important for protecting the reputation of the original authors and
contributors by preventing unauthorized use of their names for endorsement
purposes.
This clause is absent in the BSD-2-Clause license, which is more permissive
but lacks this specific protection.
This change also cleans up the license of some Kconfig/Makefile files,
which were accidentally marked as GPL.
The GPL 2.0 remains in use on mt76x0, as well as two source files in mt7615
for which the license situation still needs to be clarified.
Signed-off-by: Felix Fietkau <[email protected]>
If mcu_skb_prepare_msg is not implemented, incrementing skb refcount does not
work for mcu message retry. In some cases (e.g. on SDIO), shared skbs can trigger
a BUG_ON, crashing the system.
Fix this by only incrementing refcount if retry is actually supported.
Fixes: 3688c18b65ae ("wifi: mt76: mt7915: retry mcu messages")
Reported-by: Nícolas F. R. A. Prado <[email protected]> #KernelCI
Tested-by: Alper Nebi Yasak <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
In some cases MCU messages can get lost. Instead of failing completely,
attempt to recover by re-sending them.
Signed-off-by: Felix Fietkau <[email protected]>
Introduce len to __mt76_mcu_msg_alloc signature in order to add the
capability to specify two different value for allocation and copy length.
Signed-off-by: Lorenzo Bianconi <[email protected]>
Introduce __mt76_mcu_msg_alloc utility routine in order to specify gfp
flags for mcu message allocation.
Acked-by: Sean Wang <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Each firmware piece with mt7915 and mt7921 do not have the MCU header to
reroute the packet to the internal RAM. So we do not need to consider the
MCU header size in __mt76_mcu_send_firmware.
Move the MCU header overhead calculation to mt76_mcu_send_firmware (for
older chipsets)
Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Fixes: 1c099ab44727 ("mt76: mt7921: add MCU support")
Signed-off-by: Sean Wang <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Introduce __mt76_mcu_send_firmware routine to specify mcu message max
length. This is a preliminary patch to support mt7921s driver.
Co-developed-by: Sean Wang <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
since mcu_reset it used only by mt7921, move the reset callback to
mt7921_mcu_parse_response routine and get rid of the function pointer.
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Introduce mcu_reset function pointer in mt76_mcu_ops structure in order
to run hw related reset function for the mcu running on the chipset.
This is a preliminary patch to introduce chip reset for mt7921 devices.
Co-developed-by: Sean Wang <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mcu queue to a dedicated array q_mcu in mt76_dev structure.
This is a preliminary patch to move data queues in mt76_phy and properly
support dbdc
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
This is a preliminary patch to move data queues in mt76_phy and properly
support dbdc
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_mcu_send_firmware routine in common code since it is actually
shared between mt7615, mt7663, mt7603 and mt7915 devices
Signed-off-by: Lorenzo Bianconi <[email protected]>
Can be used by the caller to get the response data directly instead of using the
hack of storing the result in internal data structures from .mcu_parse_response
Signed-off-by: Felix Fietkau <[email protected]>
Introduce headroom and tailroom to mt76_mcu_ops data structure in order
to unify the routine used for mcu message allocation. This is a
preliminary patch to add mt7663u support
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Always initialize to 0 mcu messages since if they are not propely
configured they could hang the firmware.
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Introduce mt76_mcu data structure to contain common fields between
mt76u_mcu and mt76e_mcu.
Initialize mcu common fields in mt76_alloc_device().
Rely on mt76_mcu in mt76_mcu_rx_event and in mt76_mcu_get_response
in order to reuse them in usb code
Signed-off-by: Lorenzo Bianconi <[email protected]>
When the firmware detects a problem, it needs the host to stop/reset DMA and
resume it again when the hardware state has been reset.
Signed-off-by: Felix Fietkau <[email protected]>
No functional change intended.
Add SPDX identifiers to all remaining files in /mt76.
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_mcu_rx_event i mt76-core module and remove duplicated code.
mt76_mcu_rx_event will be reused adding support for mt7603 driver
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_mcu_get_response in mt76-core module and remove duplicated
code. mt76_mcu_get_response will be reused adding support for mt7603
driver
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_mcu_msg_alloc in mt76-core module and remove duplicated code.
mt76_mcu_msg_alloc will be reused adding support for mt7603 driver
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
It is the precision not field width in the format
which limits length of printed string.
Fixes: 28f93be713 ("remove get_string helper")
Signed-off-by: Jakub Kicinski <[email protected]>
There is no need to copy strings, printk will not read past field
width and strings in firmware are padded with '_' so we will not
save any space by not using field widths.
Signed-off-by: Jakub Kicinski <[email protected]>
