- 22 Sep, 2022 1 commit
-
-
Duoming Zhou authored
There are sleep in atomic context bugs when uploading device dump data in mwifiex. The root cause is that dev_coredumpv could not be used in atomic contexts, because it calls dev_set_name which include operations that may sleep. The call tree shows execution paths that could lead to bugs: (Interrupt context) fw_dump_timer_fn mwifiex_upload_device_dump dev_coredumpv(..., GFP_KERNEL) dev_coredumpm() kzalloc(sizeof(*devcd), gfp); //may sleep dev_set_name kobject_set_name_vargs kvasprintf_const(GFP_KERNEL, ...); //may sleep kstrdup(s, GFP_KERNEL); //may sleep The corresponding fail log is shown below: [ 135.275938] usb 1-1: == mwifiex dump information to /sys/class/devcoredump start [ 135.281029] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:265 ... [ 135.293613] Call Trace: [ 135.293613] <IRQ> [ 135.293613] dump_stack_lvl+0x57/0x7d [ 135.293613] __might_resched.cold+0x138/0x173 [ 135.293613] ? dev_coredumpm+0xca/0x2e0 [ 135.293613] kmem_cache_alloc_trace+0x189/0x1f0 [ 135.293613] ? devcd_match_failing+0x30/0x30 [ 135.293613] dev_coredumpm+0xca/0x2e0 [ 135.293613] ? devcd_freev+0x10/0x10 [ 135.293613] dev_coredumpv+0x1c/0x20 [ 135.293613] ? devcd_match_failing+0x30/0x30 [ 135.293613] mwifiex_upload_device_dump+0x65/0xb0 [ 135.293613] ? mwifiex_dnld_fw+0x1b0/0x1b0 [ 135.293613] call_timer_fn+0x122/0x3d0 [ 135.293613] ? msleep_interruptible+0xb0/0xb0 [ 135.293613] ? lock_downgrade+0x3c0/0x3c0 [ 135.293613] ? __next_timer_interrupt+0x13c/0x160 [ 135.293613] ? lockdep_hardirqs_on_prepare+0xe/0x220 [ 135.293613] ? mwifiex_dnld_fw+0x1b0/0x1b0 [ 135.293613] __run_timers.part.0+0x3f8/0x540 [ 135.293613] ? call_timer_fn+0x3d0/0x3d0 [ 135.293613] ? arch_restore_msi_irqs+0x10/0x10 [ 135.293613] ? lapic_next_event+0x31/0x40 [ 135.293613] run_timer_softirq+0x4f/0xb0 [ 135.293613] __do_softirq+0x1c2/0x651 ... [ 135.293613] RIP: 0010:default_idle+0xb/0x10 [ 135.293613] RSP: 0018:ffff888006317e68 EFLAGS: 00000246 [ 135.293613] RAX: ffffffff82ad8d10 RBX: ffff888006301cc0 RCX: ffffffff82ac90e1 [ 135.293613] RDX: ffffed100d9ff1b4 RSI: ffffffff831ad140 RDI: ffffffff82ad8f20 [ 135.293613] RBP: 0000000000000003 R08: 0000000000000000 R09: ffff88806cff8d9b [ 135.293613] R10: ffffed100d9ff1b3 R11: 0000000000000001 R12: ffffffff84593410 [ 135.293613] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff11000c62fd2 ... [ 135.389205] usb 1-1: == mwifiex dump information to /sys/class/devcoredump end This patch uses delayed work to replace timer and moves the operations that may sleep into a delayed work in order to mitigate bugs, it was tested on Marvell 88W8801 chip whose port is usb and the firmware is usb8801_uapsta.bin. The following is the result after using delayed work to replace timer. [ 134.936453] usb 1-1: == mwifiex dump information to /sys/class/devcoredump start [ 135.043344] usb 1-1: == mwifiex dump information to /sys/class/devcoredump end As we can see, there is no bug now. Fixes: f5ecd02a ("mwifiex: device dump support for usb interface") Signed-off-by:Duoming Zhou <duoming@zju.edu.cn> Reviewed-by:
Brian Norris <briannorris@chromium.org> Acked-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/5cfa5c473ff6d069cb67760ffa04a2f84ef450a8.1661252818.git.duoming@zju.edu.cn
-
- 19 Sep, 2022 38 commits
-
-
Dan Carpenter authored
If request_partial_firmware_into_buf() fails then "firmware" is not initialized and the release_firmware(firmware) will crash. Fixes: deebea35 ("wifi: rtw89: early recognize FW feature to decide if chanctx") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Acked-by:
Ping-Ke Shih <pkshih@realtek.com> Signed-off-by:
-
Hans de Goede authored
Even though ieee80211_hw.queues is set to 2, the ralink rt2x00 driver is seeing tx skbs submitted to it with the queue-id set to 2 / set to IEEE80211_AC_BE on a rt2500 card when associating with an access-point. This causes rt2x00queue_get_tx_queue() to return NULL and the following error to be logged: "ieee80211 phy0: rt2x00mac_tx: Error - Attempt to send packet over invalid queue 2", after which association with the AP fails. This patch works around this by mapping QID_AC_BE and QID_AC_BK to QID_AC_VI when there are only 2 tx_queues. Signed-off-by:
Hans de Goede <hdegoede@redhat.com> Acked-by:
Stanislaw Gruszka <stf_xl@wp.pl> Signed-off-by:
-
Po-Hao Huang authored
Update tx descriptor settings so broadcast packets on other ports can be issued properly when DTIM count is 0. Before this, all broadcast packets are sent via port 0 and won't be transmitted correctly. Signed-off-by:
Po-Hao Huang <phhuang@realtek.com> Signed-off-by:
-
Po-Hao Huang authored
In monitor mode we should be able to received all packets even if it's not destined to us. But after scan, the configuration was wrongly set, so we fix it. Signed-off-by:
-
Po-Hao Huang authored
This avoid potential memory leak under power saving mode. Signed-off-by:
-
Ping-Ke Shih authored
Reset these registers to prevent firmware get false alarm after wifi CPU is running. Signed-off-by:
-
Ping-Ke Shih authored
Modify PCI LTR control flow and LTR idle latency to improve power save efficiency. Signed-off-by:
-
Ping-Ke Shih authored
NAV upper register is to limit the maximum NAV value to prevent unexpected NAV, but the old setting is too small to reflect NAV from AP transmiting big MPDU at once. Signed-off-by:
-
Ping-Ke Shih authored
8852C needs this to change CMAC dma to full mode to keep receiving packets after RX full event being resolved. Signed-off-by:
-
Zong-Zhe Yang authored
SER (system error recovery) can deal with different crash types by different levels of processes. Previous FW crash simulation triggers a CPU exception which is one kind of SER L2 type. It can verify SER L2 flow which includes HW/FW restart. Now, we want to increase crash simulation types. A debug function is added to trigger control error in purpose for SER L1 simulation/verification. And, debugfs fw_crash is extended to accept different parameters. echo 1 > fw_crash: simulate CPU exception as before (keep 1 for compatibility with previous) It will be catched and handled by SER L2. (this requires HW/FW restart) echo 2 > fw_crash: simulate control error It will be catched and handled by SER L1. (driver and FW cooperate to recover this) Besides, in order to apply to the above two cases, rename RTW89_FLAG_RESTART_TRIGGER to RTW89_FLAG_CRASH_SIMULATING and adjust where SER flow clears this bit for both L1 and L2. Signed-off-by:
Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by:
-
Zong-Zhe Yang authored
With FW >= v0.27.40.0, 8852C FW has feature to handle crash simulation. Besides, use RTW89_WCPU_BASE_MASK to replace use of RTW89_WCPU_BASE_ADDR and work for both 8852A and 8852C. Signed-off-by:
-
Zong-Zhe Yang authored
Introudce a H2C feature to drop packets according to given parameters. And, we implement instances to drop packets from BE, BK, VI, VO queues by vif or sta. Then, we refine our callback of ieee80211_ops::flush to deal with the case of drop=true via this feature. Signed-off-by:
-
Ping-Ke Shih authored
Seaprate calling of rtw89_h2c_tx() out of if-expression, and bypass the return value to upper caller. Signed-off-by:
-
Chin-Yen Lee authored
Different chips use different register and mask for tx dma channels, so concentrate them. Signed-off-by:
Chin-Yen Lee <timlee@realtek.com> Signed-off-by:
-
Chin-Yen Lee authored
Some PCI and MAC registers are changed for different chips and correct them accordingly. And HCI MAD functions belongs to MAC core, so move it to mac.h/.c. Signed-off-by:
-
Zong-Zhe Yang authored
For 8852C, rtw89_pci_lv1rst_stop_dma() and rtw89_pci_lv1rst_start_dma() are offloaded to FW L1 reset flow. So, driver no longer needs to do them. Signed-off-by:
-
Kuan-Chung Chen authored
Add ops set_tid_config to support TID specific configuration. We currently only support ampdu setting. The command example is: iw wlan0 set tidconf tids 0x3 ampdu off iw wlan0 set tidconf peer xx:xx:xx:xx:xx:xx tids 0x2 ampdu on Signed-off-by:
Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by:
-
Kuan-Chung Chen authored
Support setting HE GI and LTF values to the kernel via nl80211. We currently only support some GI and LTF values settings. The command example is: iw wlan0 set bitrates he-gi-2.4 0.8 he-ltf-2.4 2 Signed-off-by:
-
Ping-Ke Shih authored
The variable cnt_connecting is to indicate if we are connecting to an AP. This is an important clue for coexistence to assign more time slot to WiFi side in this situation to ensure WiFi can establish connection. Without this patch, compiler warns: drivers/net/wireless/realtek/rtw89/coex.c:3244:25: warning: variable 'cnt_connecting' set but not used [-Wunused-but-set-variable] Reported-by:kernel test robot <lkp@intel.com> Signed-off-by:
-
Ching-Te Ku authored
To reduce register IO, combine set_gnt_wl/set_gnt_bt to set the same register one time. Because RTL8852C use different register to control antenna path, so make correction of path control related debug logs. Signed-off-by:
Ching-Te Ku <ku920601@realtek.com> Signed-off-by:
-
Ching-Te Ku authored
RTL8852C don't need to send the data trace_step which used to tell firmware how many TDMA steps should record. Remove the member. Signed-off-by:
-
Ching-Te Ku authored
Show TDMA information containing TDMA policy and time slot of Wi-Fi/BT in debug message to check things are in expected. The v1 format contains additional header, and remaining part is the same as original. So 8852CE selects v1 version, and then everything like original. Signed-off-by:
-
Ching-Te Ku authored
Parsing firmware error message from original version and v1 reports to show up exception counter of commands from firmware in debug message. Then, we can make sure exchange commands are correct totally. In the later version Wi-Fi firmware(v1), the report format was changed. With this update, we can yield correct report from proper struct. Signed-off-by:
-
Ching-Te Ku authored
Because RTL8852A/RTL8852C use different firmware buffer size to send C2H packet, it's necessary to use different size to parse C2H report. Signed-off-by:
-
Ching-Te Ku authored
The later version Wi-Fi firmware will report null data TX times, so the structure is different from before. Signed-off-by:
-
Ping-Ke Shih authored
With void pointer, we don't need to cast to 'u8 *' by one by. Signed-off-by:
-
Hector Martin authored
Add the new module-instance/antenna-sku properties required to select WiFi firmwares properly to all board device trees. Signed-off-by:
Hector Martin <marcan@marcan.st> Reviewed-by:
Mark Kettenis <kettenis@openbsd.org> Acked-by:
Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Signed-off-by:
-
Hector Martin authored
This chip is present on Apple M1 (t8103) platforms: * atlantisb (apple,j274): Mac mini (M1, 2020) * honshu (apple,j293): MacBook Pro (13-inch, M1, 2020) * shikoku (apple,j313): MacBook Air (M1, 2020) * capri (apple,j456): iMac (24-inch, 4x USB-C, M1, 2020) * santorini (apple,j457): iMac (24-inch, 2x USB-C, M1, 2020) Reviewed-by:
Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
Alvin Šipraga <alsi@bang-olufsen.dk> Signed-off-by:
-
Hector Martin authored
These newer PCIe core revisions include new sets of registers that must be used instead of the legacy ones. Introduce a brcmf_pcie_reginfo to hold the specific register offsets and values to use for a given platform, and change all the register accesses to indirect through it. Reviewed-by:
-
Hector Martin authored
Newer chips used on Apple platforms have a max_rxbufpost greater than 512, which causes warnings when brcmf_msgbuf_rxbuf_data_fill tries to put more entries in the ring than will fit. Increase the ring sizes to 1024. Reviewed-by:
-
Hector Martin authored
On Device Tree platforms, it is customary to be able to set the MAC address via the Device Tree, as it is often stored in system firmware. This is particularly relevant for Apple ARM64 platforms, where this information comes from system configuration and passed through by the bootloader into the DT. Implement support for this by fetching the platform MAC address and adding or replacing the macaddr= property in nvram. This becomes the dongle's default MAC address. On platforms with an SROM MAC address, this overrides it. On platforms without one, such as Apple ARM64 devices, this is required for the firmware to boot (it will fail if it does not have a valid MAC at all). Reviewed-by:
-
Hector Martin authored
On Apple platforms, firmware selection uses the following elements: Property Example Source ============== ======= ======================== * Chip name 4378 Device ID * Chip revision B1 OTP * Platform shikoku DT (ARM64) or ACPI (x86) * Module type RASP OTP * Module vendor m OTP * Module version 6.11 OTP * Antenna SKU X3 DT (ARM64) or ACPI (x86) In macOS, these firmwares are stored using filenames in this format under /usr/share/firmware/wifi: C-4378__s-B1/P-shikoku-X3_M-RASP_V-m__m-6.11.txt To prepare firmwares for Linux, we rename these to a scheme following the existing brcmfmac convention: brcmfmac<chip><lower(rev)>-pcie.apple,<platform>-<mod_type>-\ <mod_vendor>-<mod_version>-<antenna_sku>.txt The NVRAM uses all the components, while the firmware and CLM blob only use the chip/revision/platform/antenna_sku: brcmfmac<chip><lower(rev)>-pcie.apple,<platform>-<antenna_sku>.bin e.g. brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP-m-6.11-X3.txt brcm/brcmfmac4378b1-pcie.apple,shikoku-X3.bin In addition, since there are over 1000 files in total, many of which are symlinks or outright duplicates, we deduplicate and prune the firmware tree to reduce firmware filenames to fewer dimensions. For example, the shikoku platform (MacBook Air M1 2020) simplifies to just 4 files: brcm/brcmfmac4378b1-pcie.apple,shikoku.clm_blob brcm/brcmfmac4378b1-pcie.apple,shikoku.bin brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP-m.txt brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP-u.txt This reduces the total file count to around 170, of which 75 are symlinks and 95 are regular files: 7 firmware blobs, 27 CLM blobs, and 61 NVRAM config files. We also slightly process NVRAM files to correct some formatting issues. To handle this, the driver must try the following path formats when looking for firmware files: brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP-m-6.11-X3.txt brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP-m-6.11.txt brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP-m.txt brcm/brcmfmac4378b1-pcie.apple,shikoku-RASP.txt brcm/brcmfmac4378b1-pcie.apple,shikoku-X3.txt * brcm/brcmfmac4378b1-pcie.apple,shikoku.txt * Not relevant for NVRAM, only for firmware/CLM. The chip revision nominally comes from OTP on Apple platforms, but it can be mapped to the PCI revision number, so we ignore the OTP revision and continue to use the existing PCI revision mechanism to identify chip revisions, as the driver already does for other chips. Unfortunately, the mapping is not consistent between different chip types, so this has to be determined experimentally. Reviewed-by: -
Hector Martin authored
On Apple ARM64 platforms, firmware selection requires two properties that come from system firmware: the module-instance (aka "island", a codename representing a given hardware platform) and the antenna-sku. We map Apple's module codenames to board_types in the form "apple,<module-instance>". The mapped board_type is added to the DTS file in that form, while the antenna-sku is forwarded by our bootloader from the Apple Device Tree into the FDT. Grab them from the DT so firmware selection can use them. Reviewed-by:
-
Hector Martin authored
On Apple platforms, the One Time Programmable ROM in the Broadcom chips contains information about the specific board design (module, vendor, version) that is required to select the correct NVRAM file. Parse this OTP ROM and extract the required strings. Note that the user OTP offset/size is per-chip. This patch does not add any chips yet. Reviewed-by:
Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by:
-
Hector Martin authored
Apple platforms have firmware and config files identified with multiple dimensions. We want to be able to find the most specific firmware available for any given platform, progressively trying more general firmwares. To do this, first add support for passing in multiple board_types, which will be tried in sequence. Since this will cause more log spam due to missing firmwares, also switch the secondary firmware fecthes to use the _nowarn variant, which will not log if the firmware is not found. Signed-off-by:
-
Hector Martin authored
Now that the firmware fetcher can handle per-board CLM files, load the CLM blob alongside the other firmware files and change the bus API to just return the existing blob, instead of fetching the filename. This enables per-board CLM blobs, which are required on Apple platforms. Acked-by:
-
Hector Martin authored
Teach brcm_alt_fw_paths to correctly split off variable length extensions, and enable alt firmware lookups for the CLM blob firmware requests. Apple platforms have per-board CLM blob files. Acked-by:
-
Hector Martin authored
This binding is currently used for SDIO devices, but these chips are also used as PCIe devices on DT platforms and may be represented in the DT. Re-use the existing binding and add chip compatibles used by Apple T2 and M1 platforms (the T2 ones are not known to be used in DT platforms, but we might as well document them). Then, add properties required for firmware selection and calibration on M1 machines. Reviewed-by:
Rob Herring <robh@kernel.org> Reviewed-by:
-
- 12 Sep, 2022 1 commit
-
-
Bitterblue Smith authored
It looks like a leftover from copying rtl8xxxu_update_rate_mask, which is used with the gen1 chips. It wasn't causing any problems for my RTL8188FU test device, but it's clearly a mistake, so remove it. Fixes: f653e690 ("rtl8xxxu: Implement basic 8723b specific update_rate_mask() function") Signed-off-by:
Bitterblue Smith <rtl8821cerfe2@gmail.com> Signed-off-by:
-
