Commit Graph
244 Commits
Author SHA1 Message Date
Sean WangandFelix Fietkau ebd522981b wifi: mt76: mt7925: report link information in rx status
report link information in rx status

Co-developed-by: Ming Yen Hsieh <[email protected]>
Signed-off-by: Ming Yen Hsieh <[email protected]>
Co-developed-by: Deren Wu <[email protected]>
Signed-off-by: Deren Wu <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/c7cdc17d94375a76802a5c4a825ea3e51cdb53af.1720248331.git.sean.wang@kernel.org
Signed-off-by: Felix Fietkau <[email protected]>
2024-07-16 14:30:13 +02:00
Bjørn MorkandFelix Fietkau 3b47d9df42 wifi: mt76: mt7915: fix oops on non-dbdc mt7986
mt7915_band_config() sets band_idx = 1 on the main phy for mt7986
with MT7975_ONE_ADIE or MT7976_ONE_ADIE.

Commit 0335c034e726 ("wifi: mt76: fix race condition related to
checking tx queue fill status") introduced a dereference of the
phys array indirectly indexed by band_idx via wcid->phy_idx in
mt76_wcid_cleanup(). This caused the following Oops on affected
mt7986 devices:

 Unable to handle kernel read from unreadable memory at virtual address 0000000000000024
 Mem abort info:
   ESR = 0x0000000096000005
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x05: level 1 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000005
   CM = 0, WnR = 0
 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000
 [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
 Internal error: Oops: 0000000096000005 [#1] SMP
 Modules linked in: ... mt7915e mt76_connac_lib mt76 mac80211 cfg80211 ...
 CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0
 Hardware name: ZyXEL EX5700 (Telenor) (DT)
 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : mt76_wcid_cleanup+0x84/0x22c [mt76]
 lr : mt76_wcid_cleanup+0x64/0x22c [mt76]
 sp : ffffffc00a803700
 x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00
 x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001
 x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8
 x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000
 x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0
 x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000
 x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28
 x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000
 x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001
 x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024
 Call trace:
  mt76_wcid_cleanup+0x84/0x22c [mt76]
  __mt76_sta_remove+0x70/0xbc [mt76]
  mt76_sta_state+0x8c/0x1a4 [mt76]
  mt7915_eeprom_get_power_delta+0x11e4/0x23a0 [mt7915e]
  drv_sta_state+0x144/0x274 [mac80211]
  sta_info_move_state+0x1cc/0x2a4 [mac80211]
  sta_set_sinfo+0xaf8/0xc24 [mac80211]
  sta_info_destroy_addr_bss+0x4c/0x6c [mac80211]

  ieee80211_color_change_finish+0x1c08/0x1e70 [mac80211]
  cfg80211_check_station_change+0x1360/0x4710 [cfg80211]
  genl_family_rcv_msg_doit+0xb4/0x110
  genl_rcv_msg+0xd0/0x1bc
  netlink_rcv_skb+0x58/0x120
  genl_rcv+0x34/0x50
  netlink_unicast+0x1f0/0x2ec
  netlink_sendmsg+0x198/0x3d0
  ____sys_sendmsg+0x1b0/0x210
  ___sys_sendmsg+0x80/0xf0
  __sys_sendmsg+0x44/0xa0
  __arm64_sys_sendmsg+0x20/0x30
  invoke_syscall.constprop.0+0x4c/0xe0
  do_el0_svc+0x40/0xd0
  el0_svc+0x14/0x4c
  el0t_64_sync_handler+0x100/0x110
  el0t_64_sync+0x15c/0x160
 Code: d2800002 910092c0 52800023 f9800011 (885f7c01)
 ---[ end trace 7e42dd9a39ed2281 ]---

Fix by using mt76_dev_phy() which will map band_idx to the correct phy
for all hardware combinations.

Fixes: 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status")
Link: https://github.com/openwrt/openwrt/issues/14548
Signed-off-by: Bjørn Mork <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2024-07-13 15:29:45 +02:00
Felix Fietkau 564cd93961 mt76: sync with upstream changes
Signed-off-by: Felix Fietkau <[email protected]>
2024-07-12 17:15:04 +02:00
Felix Fietkau c40e648b89 wifi: mt76: enable spectrum management
It is supported by all drivers

Signed-off-by: Felix Fietkau <[email protected]>
2024-04-19 13:35:28 +02:00
Felix Fietkau 605624a4e1 mt76: fix path to page_pool helper include
Signed-off-by: Felix Fietkau <[email protected]>
2024-03-24 15:51:52 +01:00
Lorenzo BianconiandFelix Fietkau 9827df56b2 wifi: mt76: move wed common utilities in wed.c
Introduce wed.c in order to collect mt76 wed common codebase used by
mt7915 and mt7996 drivers.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2024-02-03 15:04:42 +01:00
Allen YeandFelix Fietkau c7b243b127 wifi: mt76: use chainmask for power delta calculation
The power gain value is related to total TX path, so change the
calculation to use per-phy chainmask.

Signed-off-by: Allen Ye <[email protected]>
Signed-off-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-11-17 14:13:03 +01:00
Lorenzo BianconiandFelix Fietkau 48b0cedbf8 wifi: mt76: introduce wed pointer in mt76_queue
Introduce mtk_wed_device pointer in mt76_queue structure in order to
configure WED chip.
Get rid of dev parameter in Q_READ and Q_WRITE macros.
Introduce wed parameter to the following routine signatures:
- mt76_init_queue
- mt76_init_tx_queue

This is a preliminary patch to introduce WED support for mt7996 since
mt7996 runs two separate WED chips.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-11-17 14:12:32 +01:00
Lorenzo BianconiandFelix Fietkau 4b47145ecf wifi: mt76: move mt76_net_setup_tc in common code
This is a preliminary patch to introduce WED support for mt7996

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-11-17 14:12:32 +01:00
Ryder LeeandFelix Fietkau f4df423d3d wifi: mt76: add ability to explicitly forbid LED registration with DT
Add ability to explicitly forbid LED registration using DT led\status = "disabled".

Tested-by: Alexey D. Filimonov <[email protected]>
Signed-off-by: Alexey D. Filimonov <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-11-17 14:11:33 +01:00
Sean WangandFelix Fietkau 66d5694e18 wifi: mt76: mt7921: fix the wrong rate pickup for the chanctx driver
The variable band should be determined by the ieee80211_chanctx_conf when
the driver is a kind of chanctx one e.g mt7921 and mt7922 driver so we
added the extension to mt76_connac2_mac_tx_rate_val by distinguishing if
it can support chanctx to fix the incorrect rate pickup.

Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support")
Signed-off-by: Sean Wang <[email protected]>
Reviewed-by: David Ruth <[email protected]>
Tested-by: David Ruth <[email protected]>
Signed-off-by: Deren Wu <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-09-18 12:15:31 +02:00
Shayne ChenandFelix Fietkau b3f739a64e wifi: mt76: mt7996: add eht rx rate support
Add support to report eht rx rate.
Note that extended fields for eht in mt76_rx_status will make the struct
size exceed the cb size, so make nss and band share the same u8.

Signed-off-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-09-11 13:10:51 +02:00
Felix Fietkau f1e1e67d97 wifi: mt76: fix race condition related to checking tx queue fill status
When drv_tx calls race against local tx scheduling, the queue fill status checks
can potentially race, leading to dma queue entries being overwritten.
Fix this by deferring packets from drv_tx calls to the tx worker, in order to
ensure that all regular queue tx comes from the same context.

Signed-off-by: Felix Fietkau <[email protected]>
2023-09-11 13:10:34 +02:00
Felix Fietkau bbbac7deee wifi: mt76: rename mt76_packet_id_init/flush to mt76_wcid_init/cleanup
Also un-inline the functions. Will be used for further wcid init/cleanup

Signed-off-by: Felix Fietkau <[email protected]>
2023-09-11 13:10:34 +02:00
Felix Fietkau b14c2351dd wifi: mt76: mt7603: disable A-MSDU tx support on MT7628
It was reported that this can cause the PSE hang issues, even with a low
number of fragments.

Link: https://github.com/openwrt/mt76/issues/793#issuecomment-1676529138
Signed-off-by: Felix Fietkau <[email protected]>
2023-08-14 21:33:36 +02:00
Lorenzo BianconiandFelix Fietkau 30706095c5 wifi: mt76: mt7915: move sta_poll_list and sta_poll_lock in mt76_dev
sta_poll_list and sta_poll_lock are used by most of the drivers, so move
them in mt76_dev structure.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-06-22 19:24:03 +02:00
Ryder LeeandFelix Fietkau edd8a830f6 wifi: mt76: add tx_nss histogram to ethtool stats
mt76_connac2_mac_fill_txs() counts tx_nss but ethtool doesn't show
stats. Add missing histogram accordingly.

Signed-off-by: Ben Greear <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-06-22 17:52:14 +02:00
Ryder LeeandFelix Fietkau 458ad0af21 wifi: mt76: enable UNII-4 channel 177 support
Enable support for the 5GHz channel 177 with center frequency 5885MHz and
operating class 125 based on IEEE Std 802.11ax-2021 Table E-4.

Signed-off-by: Himanshu Goyal <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-06-22 17:50:24 +02:00
Lorenzo BianconiandFelix Fietkau 28ea992ce8 wifi: mt76: get rid of unused sta_ps callbacks
sta_ps callback is just an empty stub for most of the drivers,
so get rid of them.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-04-18 11:37:59 +02:00
Lorenzo BianconiandFelix Fietkau 920bc6e1fc wifi: mt76: do not run mt76_unregister_device() on unregistered hw
Trying to probe a mt7921e pci card without firmware results in a
successful probe where ieee80211_register_hw hasn't been called. When
removing the driver, ieee802111_unregister_hw is called unconditionally
leading to a kernel NULL pointer dereference.
Fix the issue running mt76_unregister_device routine just for registered
hw.

Link: https://bugs.debian.org/1029116
Link: https://bugs.kali.org/view.php?id=8140
Reported-by: Stuart Hayhurst <[email protected]>
Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work")
Tested-by: Helmut Grohne <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
2023-03-01 17:39:20 +01:00
Ryder LeeandFelix Fietkau 17ec2146b8 wifi: mt76: dynamic channel bandwidth changes in AP mode
Allow AP to change channel width for 40Mhz intolerant STA on the
2.4 GHz band.

Signed-off-by: Himanshu Goyal <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-02-28 11:19:52 +01:00
Shayne ChenandFelix Fietkau 5e85136c9b wifi: mt76: add EHT rate stats for ethtool
Add support to get EHT rate stats from ethtool.
This is the preliminary patch to add EHT support for mt7996.

Signed-off-by: Shayne Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-02-02 11:05:09 +01:00
Felix Fietkau e8c10835cf wifi: mt76: fix compile error without CONFIG_PAGE_POOL_STATS
Signed-off-by: Felix Fietkau <[email protected]>
2023-01-27 11:31:03 +01:00
Lorenzo BianconiandFelix Fietkau 04da4eaa82 wifi: mt76: enable page_pool stats
Enable page_pool ethtool statistics for mt7915 and mt7921 chipsets.

Tested-by: Felix Fietkau <[email protected]>
Tested-by: Deren Wu <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-01-25 20:12:27 +01:00
Lorenzo BianconiandFelix Fietkau 9686cd7cc6 wifi: mt76: switch to page_pool allocator
In order to reduce possible memory allocation failures due to memory
fragmentation caused by page_frag_cache allocator, switch to page_pool
allocator for dma and usb mt76 drivers.
Remove per rx-queue page_frag_cache

Co-developed-by: Felix Fietkau <[email protected]>
Tested-by: Deren Wu <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2023-01-25 20:11:29 +01:00
Lorenzo BianconiandFelix Fietkau 81edc468fc wifi: mt76: mt7915: enable per-phy led support
Introduce the capability to support per-phy led blinking. This is needed
for devices supporting dbdc.

Tested-by: Frank Wunderlich <[email protected]>
Co-developed-by: Ryder Lee <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-12-10 13:11:05 +01:00
Lorenzo BianconiandFelix Fietkau 14fbb6d6e8 wifi: mt76: move leds struct in mt76_phy
Move leds struct in mt76_phy in order to have leds associated to phy
(e.g. in dbdc mode) instead of per device.

Tested-by: Frank Wunderlich <[email protected]>
Co-developed-by: Ryder Lee <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-12-10 13:11:05 +01:00
Lorenzo BianconiandFelix Fietkau 551201379e wifi: mt76: move leds field in leds struct
This is a preliminary patch to support per-phy leds.

Tested-by: Frank Wunderlich <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-12-10 13:11:05 +01:00
Felix Fietkau ec46d7486a sync with upstream
Signed-off-by: Felix Fietkau <[email protected]>
2022-12-10 13:11:04 +01:00
Lorenzo BianconiandFelix Fietkau f38faf2943 wifi: mt76: mt7915: enable WED RX support
Enable RX Wireless Ethernet Dispatch available on MT7986 Soc in oreder
to offlad traffic received by WLAN NIC and forwarded to LAN/WAN one.

Tested-by: Daniel Golle <[email protected]>
Co-developed-by: Sujuan Chen <[email protected]>
Signed-off-by: Sujuan Chen <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-11-23 13:16:11 +01:00
Sujuan ChenandFelix Fietkau 417cca39ba wifi: mt76: introduce rxwi and rx token utility routines
This is a preliminary patch to introduce WED RX support for mt7915.

Tested-by: Daniel Golle <[email protected]>
Co-developed-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Sujuan Chen <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-11-23 13:11:29 +01:00
Ryder LeeandFelix Fietkau 94b335fa88 wifi: mt76: mt7915: add ack signal support
This reports signal strength of ACK packets from the peer as measured
at each interface.

Tested-by: Shurong Wen <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-11-11 11:31:52 +01:00
Ben GreearandFelix Fietkau 72b87836d3 Revert "mt76: use IEEE80211_OFFLOAD_ENCAP_ENABLED instead of MT_DRV_AMSDU_OFFLOAD"
This reverts commit f17f4864504d754bcbf31e4c89412cdf9946c409.

The reverted commit significantly decreases performance when running
a test where two MT7915 radios have 16 station vdevs each, configured
for AC mode, and transmitting UDP traffic to AP.

Reported-by: Carson Vandegriffe <[email protected]>
Signed-off-by: Ben Greear <[email protected]>
2022-10-01 17:14:48 +02:00
Felix Fietkau d70546462b mt76: fix 5 GHz connection regression on mt76x0/mt76x2
Some users have reported being unable to connect to MT76x0 APs running mt76
after a commit enabling the VHT extneded NSS BW feature.
Fix this regression by ensuring that this feature only gets enabled on drivers
that support it

Fixes: d9fcfc1424aa ("mt76: enable the VHT extended NSS BW feature")
Signed-off-by: Felix Fietkau <[email protected]>
2022-09-06 22:39:56 +02:00
Liang HeandFelix Fietkau 120f73ad99 mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init()
We should use of_node_put() for the reference 'np' returned by
of_get_child_by_name() which will increase the refcount.

Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets")
Signed-off-by: Liang He <[email protected]>
2022-07-11 13:38:17 +02:00
Lorenzo BianconiandFelix Fietkau 30887591e3 mt76: add phy_idx to mt76_wcid
Introduce phy_idx to mt76_wcid structure instead of ext_phy.
This is a preliminary patch to add newer chipset support.

Co-developed-by: Bo Jiao <[email protected]>
Signed-off-by: Bo Jiao <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
2022-07-11 13:38:17 +02:00
Lorenzo BianconiandFelix Fietkau eb19ac83c0 mt76: introduce phys array in mt76_dev structure
Introduce phys array in mt76_dev structure to reference mt76_phy
supported by the chipset. This is a preliminary patch to introduce
newer chipset support.

Signed-off-by: Lorenzo Bianconi <[email protected]>
2022-07-11 13:38:17 +02:00
Lorenzo BianconiandFelix Fietkau 8ccbb38ca6 mt76: add phy_idx in mt76_rx_status
Introduce phy_idx mt76_rx_status instead of ext_idx. This is a
preliminary patch to add newer chipset support

Co-developed-by: Bo Jiao <[email protected]>
Signed-off-by: Bo Jiao <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
2022-07-11 13:38:17 +02:00
Felix Fietkau f2edd340dd mt76: allow receiving frames with invalid CCMP PN via monitor interfaces
This can be useful for debugging

Signed-off-by: Felix Fietkau <[email protected]>
2022-06-23 14:21:20 +02:00
MeiChia ChiuandFelix Fietkau 3ef66fc7c7 mt76: do not check the ccmp pn for ONLY_MONITOR frame
if the received frame enables RX_FLAG_ONLY_MONITOR,
driver doesn't need to check the ccmp pn of this frame.

Reviewed-by: Ryder Lee <[email protected]>
Signed-off-by: MeiChia Chiu <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-22 13:19:55 +02:00
Deren WuandFelix Fietkau d6ae3505ac mt76: enable the VHT extended NSS BW feature
According IEEE Std 802.11-2020, its definition is:
Indicates whether the STA is capable of interpreting the Extended NSS BW
Support subfield of the VHT Capabilities Information field.

Some APs, such as Xiaomi AX6000, would check this one for BW settings.
mt76 driver can get max BW capability only if the this field is confgured
properly.

Reviewed-by: Ryder Lee <[email protected]>
Signed-off-by: Ming Yen Hsieh <[email protected]>
Signed-off-by: Deren Wu <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-17 12:14:22 +02:00
Deren WuandFelix Fietkau 380eac6f31 mt76: add 6 GHz band support in mt76_sar_freq_ranges
Add new frequencies support in mt76_sar_freq_ranges[]
* 5945 - 6165
* 6165 - 6405
* 6405 - 6525
* 6525 - 6705
* 6705 - 6865
* 6865 - 7125

Reviewed-by: Sean Wang <[email protected]>
Signed-off-by: Deren Wu <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-02 21:39:30 +02:00
Felix Fietkau a666d5637b mt76: fix tx status related use-after-free race on station removal
There is a small race window where ongoing tx activity can lead to a skb
getting added to the status tracking idr after that idr has already been
cleaned up, which will keep the wcid linked in the status poll list.
Fix this by only adding status skbs if the wcid pointer is still assigned
in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove

Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr")
Tested-by: Ben Greear <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-04-23 07:12:47 +02:00
Deren WuandFelix Fietkau 75e046e3c9 mt76: fix antenna config missing in 6G cap
To make sure we have the proper antenna config in 6g cap,
move IEEE80211_VHT_CAP_[T/R]X_ANTENNA_PATTERN to stream init.

Fixes: edf9dab8ba27 ("mt76: add 6GHz support")
Signed-off-by: Deren Wu <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-04-20 13:23:48 +02:00
Felix Fietkau 87a962e060 mt76: mt7915: add Wireless Ethernet Dispatch support
This is used to support hardware flow offloading from Ethernet to WLAN

Signed-off-by: Felix Fietkau <[email protected]>
2022-04-07 11:56:24 +02:00
Felix Fietkau b8c842daa0 mt76: make number of tokens configurable dynamically
Preparation for adding Wireless Ethernet Dispatch support

Signed-off-by: Felix Fietkau <[email protected]>
2022-03-29 13:13:27 +02:00
Felix Fietkau e0bc736d56 mt76: add support for overriding the device used for DMA mapping
WED support requires using non-coherent DMA, whereas the PCI device might
be configured for coherent DMA.
The WED driver will take care of changing the PCI HIF coherent IO setting
on attach.

Signed-off-by: Felix Fietkau <[email protected]>
2022-03-29 13:13:27 +02:00
Felix Fietkau 5b7dd093c8 mt76: fix use-after-free by removing a non-RCU wcid pointer
Fixes an issue caught by KASAN about use-after-free in mt76_txq_schedule
by protecting mtxq->wcid with rcu_lock between mt76_txq_schedule and
sta_info_[alloc, free].

[18853.876689] ==================================================================
[18853.876751] BUG: KASAN: use-after-free in mt76_txq_schedule+0x204/0xaf8 [mt76]
[18853.876773] Read of size 8 at addr ffffffaf989a2138 by task mt76-tx phy0/883
[18853.876786]
[18853.876810] CPU: 5 PID: 883 Comm: mt76-tx phy0 Not tainted 5.10.100-fix-510-56778d365941-kasan #5 0b01fbbcf41a530f52043508fec2e31a4215

[18853.876840] Call trace:
[18853.876861]  dump_backtrace+0x0/0x3ec
[18853.876878]  show_stack+0x20/0x2c
[18853.876899]  dump_stack+0x11c/0x1ac
[18853.876918]  print_address_description+0x74/0x514
[18853.876934]  kasan_report+0x134/0x174
[18853.876948]  __asan_report_load8_noabort+0x44/0x50
[18853.876976]  mt76_txq_schedule+0x204/0xaf8 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]
[18853.877002]  mt76_txq_schedule_all+0x2c/0x48 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]
[18853.877030]  mt7921_tx_worker+0xa0/0x1cc [mt7921_common f0875ebac9d7b4754e1010549e7db50fbd90a047]
[18853.877054]  __mt76_worker_fn+0x190/0x22c [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]
[18853.877071]  kthread+0x2f8/0x3b8
[18853.877087]  ret_from_fork+0x10/0x30
[18853.877098]
[18853.877112] Allocated by task 941:
[18853.877131]  kasan_save_stack+0x38/0x68
[18853.877147]  __kasan_kmalloc+0xd4/0xfc
[18853.877163]  kasan_kmalloc+0x10/0x1c
[18853.877177]  __kmalloc+0x264/0x3c4
[18853.877294]  sta_info_alloc+0x460/0xf88 [mac80211]
[18853.877410]  ieee80211_prep_connection+0x204/0x1ee0 [mac80211]
[18853.877523]  ieee80211_mgd_auth+0x6c4/0xa4c [mac80211]
[18853.877635]  ieee80211_auth+0x20/0x2c [mac80211]
[18853.877733]  rdev_auth+0x7c/0x438 [cfg80211]
[18853.877826]  cfg80211_mlme_auth+0x26c/0x390 [cfg80211]
[18853.877919]  nl80211_authenticate+0x6d4/0x904 [cfg80211]
[18853.877938]  genl_rcv_msg+0x748/0x93c
[18853.877954]  netlink_rcv_skb+0x160/0x2a8
[18853.877969]  genl_rcv+0x3c/0x54
[18853.877985]  netlink_unicast_kernel+0x104/0x1ec
[18853.877999]  netlink_unicast+0x178/0x268
[18853.878015]  netlink_sendmsg+0x3cc/0x5f0
[18853.878030]  sock_sendmsg+0xb4/0xd8
[18853.878043]  ____sys_sendmsg+0x2f8/0x53c
[18853.878058]  ___sys_sendmsg+0xe8/0x150
[18853.878071]  __sys_sendmsg+0xc4/0x1f4
[18853.878087]  __arm64_compat_sys_sendmsg+0x88/0x9c
[18853.878101]  el0_svc_common+0x1b4/0x390
[18853.878115]  do_el0_svc_compat+0x8c/0xdc
[18853.878131]  el0_svc_compat+0x10/0x1c
[18853.878146]  el0_sync_compat_handler+0xa8/0xcc
[18853.878161]  el0_sync_compat+0x188/0x1c0
[18853.878171]
[18853.878183] Freed by task 10927:
[18853.878200]  kasan_save_stack+0x38/0x68
[18853.878215]  kasan_set_track+0x28/0x3c
[18853.878228]  kasan_set_free_info+0x24/0x48
[18853.878244]  __kasan_slab_free+0x11c/0x154
[18853.878259]  kasan_slab_free+0x14/0x24
[18853.878273]  slab_free_freelist_hook+0xac/0x1b0
[18853.878287]  kfree+0x104/0x390
[18853.878402]  sta_info_free+0x198/0x210 [mac80211]
[18853.878515]  __sta_info_destroy_part2+0x230/0x2d4 [mac80211]
[18853.878628]  __sta_info_flush+0x300/0x37c [mac80211]
[18853.878740]  ieee80211_set_disassoc+0x2cc/0xa7c [mac80211]
[18853.878851]  ieee80211_mgd_deauth+0x4a4/0x10a0 [mac80211]
[18853.878962]  ieee80211_deauth+0x20/0x2c [mac80211]
[18853.879057]  rdev_deauth+0x7c/0x438 [cfg80211]
[18853.879150]  cfg80211_mlme_deauth+0x274/0x414 [cfg80211]
[18853.879243]  cfg80211_mlme_down+0xe4/0x118 [cfg80211]
[18853.879335]  cfg80211_disconnect+0x218/0x2d8 [cfg80211]
[18853.879427]  __cfg80211_leave+0x17c/0x240 [cfg80211]
[18853.879519]  cfg80211_leave+0x3c/0x58 [cfg80211]
[18853.879611]  wiphy_suspend+0xdc/0x200 [cfg80211]
[18853.879628]  dpm_run_callback+0x58/0x408
[18853.879642]  __device_suspend+0x4cc/0x864
[18853.879658]  async_suspend+0x34/0xf4
[18853.879673]  async_run_entry_fn+0xe0/0x37c
[18853.879689]  process_one_work+0x508/0xb98
[18853.879702]  worker_thread+0x7f4/0xcd4
[18853.879717]  kthread+0x2f8/0x3b8
[18853.879731]  ret_from_fork+0x10/0x30
[18853.879741]
[18853.879757] The buggy address belongs to the object at ffffffaf989a2000
[18853.879757]  which belongs to the cache kmalloc-8k of size 8192
[18853.879774] The buggy address is located 312 bytes inside of
[18853.879774]  8192-byte region [ffffffaf989a2000, ffffffaf989a4000)
[18853.879787] The buggy address belongs to the page:
[18853.879807] page:000000004bda2a59 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d89a0
[18853.879823] head:000000004bda2a59 order:3 compound_mapcount:0 compound_pincount:0
[18853.879839] flags: 0x8000000000010200(slab|head)
[18853.879857] raw: 8000000000010200 ffffffffbc89e208 ffffffffb7fb5208 ffffffaec000cc80
[18853.879873] raw: 0000000000000000 0000000000010001 00000001ffffffff 0000000000000000
[18853.879885] page dumped because: kasan: bad access detected
[18853.879896]
[18853.879907] Memory state around the buggy address:
[18853.879922]  ffffffaf989a2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[18853.879935]  ffffffaf989a2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[18853.879948] >ffffffaf989a2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[18853.879961]                                         ^
[18853.879973]  ffffffaf989a2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[18853.879986]  ffffffaf989a2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[18853.879998] ==================================================================

Cc: [email protected]
Reported-by: Sean Wang <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-03-25 22:08:28 +01:00
Deren WuandFelix Fietkau 0664d39039 mt76: fix invalid rssi report
Drop invalid rssi value to calculate a reasonable report

Fixes: 4550fb9e9810 ("mt76: improve signal strength reporting")
Signed-off-by: Deren Wu <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-03-14 15:53:26 +01:00
Felix Fietkau 64c74dc93f mt76: fix dfs state issue with 160 MHz channels
When operating on a mix of DFS and non-DFS channels, the driver only checks
the CAC status of the control channel. This causes beacons/tx to fail if the
control channel is on a non-DFS channel.
Fix this by calling cfg80211_reg_can_beacon to determine the DFS status of
all affected channels

Signed-off-by: Felix Fietkau <[email protected]>
2022-02-24 14:34:35 +01:00