MAC address, hardware type, calibration values and etc are stored in efuse,
so we read them at probe stage and use them as capabilities to register
hardware.
There are two physical efuse -- one is the main efuse for digital hardware
part, and the other is for analog part. Because they are very similar, we
only describe the main efuse below.
The main efuse is split into two regions -- one is for logic map, and the
other is for physical map. For both regions, we use the same method to read
data, but need additional parser to get logic map. To allow reading
operation, we need to convert power state to active, and turn to idle state
after reading.
For WiFi 7 chips, we introduce efuse blocks to define feature group easier,
and these blocks are discontinue. For example, RF block is from 0x1_0000 ~
0x1_0240, and the next block PCIE_SDIO is starting from 0x2_0000.
Comparing to old one used by WiFi 6 chips, there is only single one logic
map, it would be a little hard to add an new field to a group if we don't
reserve a room in advance.
The relationship between efuse, region and block is shown as below:
(logical map)
+------------+ +---------------+ +-----------------+
| main efuse | | region 1 | | block 0x1_0000~ |
| (digital) | |(to logcal map)| +-----------------+
| | | | => +-----------------+
| | => | | | block 0x2_0000~ |
| | | | +-----------------+
| | |---------------| :
| | | region 2 |
+------------+ +---------------+
+------------+ +-----------------+
| 2nd efuse | ======================> | block 0x7_0000~ |
| (analog) | +-----------------+
+------------+
The parser converting from raw data to logic map is to decode block page,
block page offset, and word_en bits. Each word_en bit indicates two
following bytes as data of logic map, so total four word_en bits can
represent eight bytes. Thus, block page offset is 8-byte alignment.
The layout of a tuple is shown as below
+--------+--------+--------+--------+--------+--------+
| fixed 3 byte header | | | |
| | | | |
| [19:17] block_page | | | ... |
| [16:4] block_page_offset| | | |
| [3:0] word_en | ^ | ^ | |
+----|---+--------+--------+---|----+----|---+--------+
| | |
+-------------------------+---------+
a word_en bit indicates two bytes as data
For example,
block_page = 0x3
block_page_offset = 0x80 (must 8-byte alignment)
word_en = 0x6 (b'0110; 0 means data is presented)
following 4 bytes = 34 56 78 90
Then,
0x3_0080 = 34 56
0x3_0086 = 78 90
A special block page is RTW89_EFUSE_BLOCK_ADIE (7) that uses different
but similar format, because its real efuse size is smaller than main efuse.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231117024029.113845-4-pkshih@realtek.com
8922A is a 802.11be chip that can support 2/5/6 GHz bands 160MHz bandwidth.
Introduce the basic info such as firmware file name, some hardware address
and size, supported spatial stream, TX descriptor and so on, and then
we can add more attributes by later patches.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231117024029.113845-2-pkshih@realtek.com
According to BIOS configuration of Realtek ACPI DSM function 4,
RTW89_ACPI_DSM_FUNC_6G_BP, we handle the regd policy of 6 GHz.
Policy defines two modes as below.
1. `BLOCK` mode:
The countries in configured list are blocked.
2. `ALLOW` mode:
_Only_ the countries in configured list are allowed.
(i.e. others are all blocked.)
Then, when receiving regulatory notification at runtime, if 6 GHz
is blocked on the country, 6 GHz channels will be disabled.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231114091359.50664-3-pkshih@realtek.com
Realtek ACPI DSM func 4, RTW89_ACPI_DSM_FUNC_6G_BP,
accepts a configuration via ACPI buffer as below.
| index | description |
-------------------------
| [0-2] | signature |
| [3] | reserved |
| [4] | policy mode |
| [5] | country count |
| [6-] | country list |
Through this function, BIOS can indicate to allow/block
6 GHz on some specific countries. Still, driver should
follow regd first before taking this configuration into
account.
Besides, add a bit in debug mask for ACPI.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231114091359.50664-2-pkshih@realtek.com
Since 'drv_priv' is an in-place member allocated at the end of
'struct ieee80211_sta', it can't be NULL and so relevant checks
in 'rtl_action_proc()' and 'rtl_tx_agg_start()' may be dropped.
Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231113144734.197359-2-dmantipov@yandex.ru
To reduce interrupts, configure the mitigation setting of 8922AE when
bringing interface up, and then check situations to decide turning on or
off the function. With this, interrupt count decreases to 20,141 from
202,141 in period of 20 seconds.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231110012319.12727-8-pkshih@realtek.com
To reduce interrupt count, configure mitigation register with thresholds
of time and packet count. We missed that 8852CE uses different register
address, so correct it. Then, interrupt counts down to 30,763 from 229,825
during stress test in 20 seconds.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231110012319.12727-7-pkshih@realtek.com
When a hardware reset is triggered, all registers are reset, so all
queues are forced to stop in hardware interface. However, mac80211
will not automatically stop the queue. If we don't manually stop the
beacon queue, the queue will be deadlocked and unable to start again.
This patch fixes the issue where Apple devices cannot connect to the
AP after calling ieee80211_restart_hw().
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
rt2800 has a lot of registers to control the RTS enable/disable
status for different rates. And the driver control them via
rt2800_set_rts_threshold(). When RTS was disabled in user
interface, this function won't be called at all. This means that
the RTS is still 'on' for CCK and OFDM rates. So we'd better to
disable them by default because it should be like this. The RTS
for HT20 and HT40 is already default off so we don't need to
touch them. If we toggle the RTS status, these register bits
will be enable/disable again by rt2800_set_rts_threshold().
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB03155DDB953155B7A2DE849ABCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
When I tried to fix the watchdog of rt2800, I found that sometimes
the watchdog can not reset the hung device. This is because the
queue is not completely stuck, it just becomes very slow. The MTK
vendor driver for the new chip MT7603/MT7612 has a DMA busy watchdog
to detect device hangs by checking DMA busy status. This watchdog
implementation is something similar to it. To reduce unnecessary
reset, we can check the INT_SOURCE_CSR register together as I found
that when the radio hung, the RX/TX coherent interrupt will always
stuck at triggered state.
The 'watchdog' module parameter has been extended to control all
watchdogs(0=disabled, 1=hang watchdog, 2=DMA watchdog, 3=both). This
new watchdog function is a slight schedule and it won't affect the
transmission speed. So we can turn on it by default. Due to the
INT_SOURCE_CSR register is invalid on rt2800 USB NICs, the DMA busy
watchdog will be automatically disabled for them.
Tested on MT7620 and RT5350.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB0315D7462CE08A119A99DE34BCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
To notify firmware TDMA timeslot assignment, append TDMA parameters when
sending policy H2C firmware command. However, compiler warns we do memcpy()
data to val[] field of TLV struct. To avoid this, assign the struct value
with simple '=' instead. Compile tested only.
rtw89/coex.c: In function '_append_tdma':
drivers/net/wireless/realtek/rtw89/coex.c:1585:17:
warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=]
1585 | memcpy(&v3->tdma, &dm->tdma, sizeof(v3->tdma));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/net/wireless/realtek/rtw89/coex.h:8,
from drivers/net/wireless/realtek/rtw89/coex.c:5:
drivers/net/wireless/realtek/rtw89/core.h:2703:37:
note: at offset [5714, 71249] into destination object 'ver' of size 8
2703 | const struct rtw89_btc_ver *ver;
| ^~~
drivers/net/wireless/realtek/rtw89/coex.c:1579:17:
warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=]
1579 | memcpy(v, &dm->tdma, sizeof(*v));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/realtek/rtw89/core.h:2703:37:
note: at offset [5710, 71245] into destination object 'ver' of size 8
2703 | const struct rtw89_btc_ver *ver;
| ^~~
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310301908.Wrj0diqe-lkp@intel.com/
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231102003716.25815-1-pkshih@realtek.com
Call this function when doing MAC initialization at probe stage. It does
partial initial registers only, because we only need basic ability to
download firmware. The function to clear index is the sub-function,
so set its pointer as well.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231101072149.21997-4-pkshih@realtek.com
Use gen_def pointer to call three WiFi 6 specific functions, and add _ax
suffix to them. Then, we will implement functions for WiFi 7 chips later.
The mac_{pre,post}_init are used to initialize PCI during doing MAC
initialization, and clear PCI ring index to make index consistent between
driver, firmware and hardware.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231101072149.21997-3-pkshih@realtek.com
Wireless RNDIS USB is a new-style CFG80211 driver for 802.11b and
802.11g USB hardware from around 2004 to 2006. This makes it more modern
than any of the others, but Kalle already classified it as "legacy"
in commit 298e50ad8e ("wifi: move raycs, wl3501 and rndis_wlan to
legacy directory").
Jussi Kivilinna worked on this driver between 2008 and 2012, and it has
only seen cosmetic updates after that.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Planet WL3501 is another PCMCIA driver for pre-802.11b interfaces
(2Mbit/s) with incomplete CFG80211 support.
This was marked as orphaned in 2017 but has been unmaintained
for a long time before that.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Aviator/Raytheon is an early PCMCIA driver, apparently predating 802.11b
and only supporting wireless extensions.
The driver has been orphaned since 2010 and only seen cosmetic updates
long before than. Jean Tourrilhes pointed out in a 2005 changelog that
he tested a change on actual hardware, which was apparently already
noteworthy back then.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Orinoco is a PIO-only ISA/PCMCIA 802.11b device with extra bus interface
connections for PCI/Cardbus/mini-PCI and a few pre-2002 Apple PowerMac
variants. It supports both wireless extensions and CFG80211, but I could
not tell if it requires using both.
This device used to be one of the most common ones 20 years ago, but
has been orphaned for most of the time since then, and the conversion
to cfg80211 has stalled in 2010.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
This is a wireless extensions style driver for 802.11b USB dongles,
with partial support for cfg80211 interfaces.
As these are all external dongles, there are probably few users that
have not yet replaced them with cheap 802.11n devices that work better.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
HostAP is an ISA/PCMCIA style 802.11b driver supporting only
wireless extensions, and some custom ioctls (already removed).
Some devices include a legacy PCI bridge but no DMA.
The driver was marked obsolete in 2016 and is highly unlikely
to still have any users.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Cisco Aironet is an 802.11b PCMCIA and mini-PCI with limited support
for Cardbus DMA and for CFG80211.
Both PCMCIA and WEXT are deprecated, and there is little chance
that anyone is still using this driver, so remove it.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Atmel at76c502/at76c504/at76c506 is a PIO-only (PCMCIA, mini-PCI
and Cardbus) 802.11b driver with incomplete CFG80211 support.
Both PCMCIA and WEXT are deprecated, and there is little chance
that anyone is still using this driver, so remove it.
The related at76c50x USB driver uses MAC80211 and remains.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
With all the other PCMCIA WLAN adapters gone from the kernel, this is now
the last remaining device with this interface, but as far as I can tell,
all the actual libertas users were actually using either SDIO or USB.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
For WiFi 7 chips, some fields and predefined length are changed, so
add them accordingly.
The mac_id field is used to identify peer that send a packet, and we can
use it to know RSSI and traffic from the peer. For WiFi 7 chips,
RXWD.mac_id of PPDU status packet is not set by hardware. Instead, we
should fill it by rxinfo_user[].mac_id of PPDU status content.
Also, filter out invalid reports to prevent warning messages keep showing.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231027015059.10032-4-pkshih@realtek.com
strncpy() is deprecated for use on NUL-terminated destination strings
[1] and as such we should prefer more robust and less ambiguous string
interfaces.
`extra` is clearly supposed to be NUL-terminated which is evident by the
manual NUL-byte assignment as well as its immediate usage with strlen().
Moreover, let's NUL-pad since there is deliberate effort (48 instances)
made elsewhere to zero-out buffers in these getters and setters:
6050 | memset(local->config.nodeName, 0, sizeof(local->config.nodeName));
6130 | memset(local->config.rates, 0, 8);
6139 | memset(local->config.rates, 0, 8);
6414 | memset(key.key, 0, MAX_KEY_SIZE);
6497 | memset(extra, 0, 16);
(to be clear, strncpy also NUL-padded -- we are matching that behavior)
Considering the above, a suitable replacement is `strscpy_pad` due to
the fact that it guarantees both NUL-termination and NUL-padding on the
destination buffer.
We can also replace the hard-coded size of "16" to IW_ESSID_MAX_SIZE
because this function is a wext handler.
In wext-core.c we have:
static const struct iw_ioctl_description standard_ioctl[] = {
...
[IW_IOCTL_IDX(SIOCGIWNICKN)] = {
.header_type = IW_HEADER_TYPE_POINT,
.token_size = 1,
.max_tokens = IW_ESSID_MAX_SIZE,
},
So the buffer size is (strangely) IW_ESSID_MAX_SIZE
Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Justin Stitt <justinstitt@google.com>
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231026-strncpy-drivers-net-wireless-cisco-airo-c-v2-1-413427249e47@google.com
