The ring is used for looping back tx powersave filtered frames, so it could
use some more room, in case more than one aggregate was queued
Signed-off-by: Felix Fietkau <[email protected]>
Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)
Signed-off-by: Felix Fietkau <[email protected]>
Avoids a theoretical corner case where the hardware could try to process
a stale descriptor after a watchdog reset
Signed-off-by: Felix Fietkau <[email protected]>
The hardware does not support using the same MAC address for interfaces,
even if they are on different bands.
In the future this will be made configurable via device tree
Signed-off-by: Felix Fietkau <[email protected]>
Before extracting the tid out of the packet, check if it was qos-data.
Only accept tid values 0-7
Also, avoid accepting the hardware queue as skb queue mapping, it could
lead to an overrun. Instead, derive the hardware queue from the tid number,
in order to avoid issues with packets being filtered multiple times.
This also fixes a mismatch between hardware and software queue indexes.
Signed-off-by: Felix Fietkau <[email protected]>
MCU_EXT_CMD_EFUSE_BUFFER_MODE needs more time on initialization, and
with only 10 seconds it sometimes runs into timeouts.
Signed-off-by: Felix Fietkau <[email protected]>
During the cleanup of the aggregation session, a rx handler (or release timer)
on another CPU might still hold a pointer to the reorder buffer and could
attempt to release some packets.
Clearing pointers during cleanup avoids a theoretical use-after-free bug here.
Signed-off-by: Felix Fietkau <[email protected]>
To avoid having the hardware potentially write to memory behind stale
descriptors, set the dma-done flag on all of them before cleaning up
allocated rx buffers
Signed-off-by: Felix Fietkau <[email protected]>
The MT7615 firmware needs to know the association id at creation time,
which is unavailable during the transition from notexist to none in
.sta_state.
This can cause a number of issues, probably also breaking powersave
support.
Signed-off-by: Felix Fietkau <[email protected]>
Loading the mcu firmware and waiting for it to boot takes a long time,
which adds a significant amount to the system boot time.
Fix this by running the mcu init from a workqueue and waiting for it to
complete before starting the phy or issuing mcu commands via debugfs
Signed-off-by: Felix Fietkau <[email protected]>
This is only used for testing for now. In the future it will be possible to
enable the second PHY through an proper API via device tree
Signed-off-by: Felix Fietkau <[email protected]>
Beacons and management frames need to explicitly select the alternate tx
queues in order to be sent out on the right phy
Signed-off-by: Felix Fietkau <[email protected]>
Program the RMAC CHFREQ registers to properly indicate the band that the
frames are received on.
Add some sanity checks to the programmed values, because the firmware
programs these registers differently
Signed-off-by: Felix Fietkau <[email protected]>
Move chainmask to struct mt7615_phy and instead of needlessly making the
format similar to values for older chips, make it refer to the actual chain
bits used for the rx/tx path.
This is important for multiple wiphy support, where for a secondary phy,
antenna_mask will start at 0, and chainmask will start at the chain offset
(bit 2)
Signed-off-by: Felix Fietkau <[email protected]>
There are two DFS detectors on the chip. When using 160 MHz channel bandwidth
(not supported in dual-wiphy mode), both are used. Otherwise, one detector is
used per wiphy.
Rework the code to start/stop them separately per phy and to indicate the
radar event on the right phy based on the detector index
Signed-off-by: Felix Fietkau <[email protected]>
Add support for an extra wiphy in mt76_set_channel and mt76_get_survey
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
Signed-off-by: Felix Fietkau <[email protected]>
This is preparation for supporting multiple wiphys per device to support the
concurrent dual-band feature of MT7615D
On the first wiphy, hw->priv will point to struct mt76_dev, which contains a
struct mt76_phy at the start. For the secondary wiphy, hw->priv will point
to a mt76_phy encapsulated in a driver specific struct
To simplify access to struct mt76_phy members from drivers, the driver specific
device struct is changed to add a union of struct mt76_dev and struct mt76_phy
as the first element
Signed-off-by: Felix Fietkau <[email protected]>
status->ampdu_ref can be 0 if the first frame is an A-MPDU. Avoid calling
mt76_airtime_flush_ampdu again without reinitializing the status wcid by
checking dev->rx_ampdu_len first.
Signed-off-by: Felix Fietkau <[email protected]>
A rcu read locked section is not allowed to sleep, and the rcu lock here
isn't actually necessary, because we're holding dev->mutex.
Fixes an issue when the tid work item is still running while freeing
a station or stopping the aggregation session
Signed-off-by: Felix Fietkau <[email protected]>
if napi_complete() returns false, it means that polling is still pending.
Interrupts should not fire until the polling is no longer scheduled
Signed-off-by: Felix Fietkau <[email protected]>
Cancel the workqueue after the tid has been cleaned up, in order to
avoid a possible rescheduling from within the work function.
Signed-off-by: Felix Fietkau <[email protected]>
status.info could point to skb->cb, leading to a use-after-free after the tx
status has been reported to mac80211
Signed-off-by: Felix Fietkau <[email protected]>
With the devm API, the unregister happens after the device cleanup is done,
after which the struct mt76_dev which contains the led_cdev has already been
freed. This leads to a use-after-free bug that can crash the system.
Signed-off-by: Felix Fietkau <[email protected]>
Like on mt7603, MIB status register 16 tracks CCA time, but does not
include tx time. Switch to status register 9 to includ NAV and tx
time as well.
Signed-off-by: Felix Fietkau <[email protected]>
Host time is used to calculate the channel active time on mt7603 and mt7615.
Use the same on mt76x02 and move the lock to core code to get rid of some
duplicated code.
Signed-off-by: Felix Fietkau <[email protected]>
MT_MIB_STAT_PSCCA only counts rx CCA busy time, which does not include
tx time. MT_MIB_STAT_CCA counts full busy time, including Rx, Tx and NAV
Signed-off-by: Felix Fietkau <[email protected]>
Report total rx airtime for valid stations as BSS rx time in survey
mt7615 is left out for now, it will be supported later by reading
hardware counters instead of calculating airtime in software
Signed-off-by: Felix Fietkau <[email protected]>
Move mt76_channel_state() from mt76.h to mac80211.c
Preparation for updating channel state from more places in the drivers/core
Signed-off-by: Felix Fietkau <[email protected]>
tx queues are already disabled by mac80211 during scanning or other
off-channel activity. There is no need to repeat the check in mt76,
since scheduled queues are selected by mac80211 as well.
Signed-off-by: Balakrishna Bandi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
There is no need to send a BAR frame after stopping aggregation, and doing
so could lead to sending class 3 frames after deauthentication from an AP
Signed-off-by: Balakrishna Bandi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
MT7615 chips usually come pre-calibrated, even when used on embedded boards.
In that case, the on-flash EEPROM data needs to be merged with some data
from OTP ROM.
Run this merge if the external EEPROM data is valid and OTP has valid fields.
Signed-off-by: Felix Fietkau <[email protected]>
Bufferable management frames need to be put in the data queue, otherwise
they will not be buffered when the receiver is asleep.
Signed-off-by: Felix Fietkau <[email protected]>
The hardware expects MT_TX_RATE_NSS to be filled with the number of
space/time streams. For non-STBC rates, this is equal to nss.
For 1-stream STBC, this needs to be set to 2.
This is relevant for VHT rates only, on HT, the value is derived from MCS
internally.
Signed-off-by: Felix Fietkau <[email protected]>
- Store the previous and current rate set in the driver + the TSF value
at the time of the switch.
- Use the tx status TSF value to determine which rate set needs to be used
as reference.
- Report only short or long GI rates for a single status event, not a mix.
- The hardware reports the last used rate index. Use it along with the
retry count to figure out what rate was used for the first attempt.
- Use the same retry count value for all rate slots to make this calculation
work.
- Derive the probe rate from the current rateset instead of the skb cb
- Do not wait for a status report for the probe frame before removing the
probe rate from the rate table. Do it immediately after it was referenced
in a tx status report.
- Use the first half of the first rate retry budget for the probe rate
in order to avoid using too many retries on that rate
- Switch from lower rates to higher rates more conservatively
- enable hardware rate up/down selection
Signed-off-by: Felix Fietkau <[email protected]>
These values must be initialized to zero, otherwise the hardware could
reuse previous values, especially the rate index
Signed-off-by: Felix Fietkau <[email protected]>
Since we don't clean that tx queue from the tx tasklet, we need to do it
after the firmware upload is done. This patch also adds a cleanup step during
the upload, to help reclaim memory faster.
Fixes unprocessed queued frames eating up memory long after the firmware
upload has already completed
Signed-off-by: Felix Fietkau <[email protected]>
When beacon length is not a multiple of 4, the beacon could be sent with
the last 1-3 bytes corrupted. The skb data is guaranteed to have enough
room for reading beyond the end, because it is always followed by
skb_shared_info, so rounding up is safe.
All other callers of mt76_wr_copy have multiple-of-4 length already.
Cc: [email protected]
Signed-off-by: Felix Fietkau <[email protected]>
When loading EEPROM data from flash, the RF frontend settings need to be
initialized from flash data. Without this, the chip loads the wrong values
from its internal eFuse ROM.
Signed-off-by: Felix Fietkau <[email protected]>
Now that tx status reporting can figure out the first attempted rate, we can
make switching from lower rates to higher rates more conservative.
This reduces retries under bad link conditions and ensures that fallback
rates get more test coverage
Signed-off-by: Felix Fietkau <[email protected]>
Felix Fietkau