[PATCH 1/5] mt76: set dma-done flag for flushed descriptors

[PATCH 1/5] mt76: set dma-done flag for flushed descriptors

[Felix Fietkau]

Avoids a theoretical corner case where the hardware could try to process
a stale descriptor after a watchdog reset

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 9e03a7871ff4..e69329feed78 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -246,7 +246,9 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
 	if (!q->queued)
 		return NULL;
 
-	if (!flush && !(q->desc[idx].ctrl & cpu_to_le32(MT_DMA_CTL_DMA_DONE)))
+	if (flush)
+		q->desc[idx].ctrl |= cpu_to_le32(MT_DMA_CTL_DMA_DONE);
+	else if (!(q->desc[idx].ctrl & cpu_to_le32(MT_DMA_CTL_DMA_DONE)))
 		return NULL;
 
 	q->tail = (q->tail + 1) % q->ndesc;
-- 
2.24.0

[PATCH 2/5] mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw

[Felix Fietkau]

Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index e69329feed78..bcb11bb9aeeb 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -271,10 +271,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
 	struct mt76_queue_buf buf;
 	dma_addr_t addr;
 
+	if (q->queued + 1 >= q->ndesc - 1)
+		goto error;
+
 	addr = dma_map_single(dev->dev, skb->data, skb->len,
 			      DMA_TO_DEVICE);
 	if (unlikely(dma_mapping_error(dev->dev, addr)))
-		return -ENOMEM;
+		goto error;
 
 	buf.addr = addr;
 	buf.len = skb->len;
@@ -285,6 +288,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
 	spin_unlock_bh(&q->lock);
 
 	return 0;
+
+error:
+	dev_kfree_skb(skb);
+	return -ENOMEM;
 }
 
 static int
-- 
2.24.0

[PATCH 3/5] mt76: dma: do not write cpu_idx on rx queue reset until after refill

[Felix Fietkau]

The hardware should only start processing the ring after at least one
buffer has been added

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index bcb11bb9aeeb..e5dd7080e88e 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -132,6 +132,11 @@ mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
 	writel(q->ndesc, &q->regs->ring_size);
 	q->head = readl(&q->regs->dma_idx);
 	q->tail = q->head;
+}
+
+static void
+mt76_dma_kick_queue(struct mt76_dev *dev, struct mt76_queue *q)
+{
 	writel(q->head, &q->regs->cpu_idx);
 }
 
@@ -193,8 +198,10 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, enum mt76_txq_id qid, bool flush)
 		dev->q_tx[__MT_TXQ_MAX + i].swq_queued -= n_swq_queued[4 + i];
 	}
 
-	if (flush)
+	if (flush) {
 		mt76_dma_sync_idx(dev, q);
+		mt76_dma_kick_queue(dev, q);
+	}
 
 	wake = wake && q->stopped &&
 	       qid < IEEE80211_NUM_ACS && q->queued < q->ndesc - 8;
@@ -257,12 +264,6 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
 	return mt76_dma_get_buf(dev, q, idx, len, info, more);
 }
 
-static void
-mt76_dma_kick_queue(struct mt76_dev *dev, struct mt76_queue *q)
-{
-	writel(q->head, &q->regs->cpu_idx);
-}
-
 static int
 mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
 			  struct sk_buff *skb, u32 tx_info)
-- 
2.24.0

[PATCH 4/5] mt76: mt7603: increase dma mcu rx ring size

[Felix Fietkau]

The ring is used for looping back tx powersave filtered frames, so it could
use some more room, in case more than one aggregate was queued

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt7603/dma.c    | 2 +-
 drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
index 57428467fe96..a08b85281170 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
@@ -221,7 +221,7 @@ int mt7603_dma_init(struct mt7603_dev *dev)
 		return ret;
 
 	ret = mt7603_init_rx_queue(dev, &dev->mt76.q_rx[MT_RXQ_MCU], 1,
-				   MT_MCU_RING_SIZE, MT_RX_BUF_SIZE);
+				   MT7603_MCU_RX_RING_SIZE, MT_RX_BUF_SIZE);
 	if (ret)
 		return ret;
 
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
index 12fd2db2df10..ef374641fe80 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
@@ -15,6 +15,7 @@
 
 #define MT7603_RATE_RETRY	2
 
+#define MT7603_MCU_RX_RING_SIZE	64
 #define MT7603_RX_RING_SIZE     128
 
 #define MT7603_FIRMWARE_E1	"mt7603_e1.bin"
-- 
2.24.0

[PATCH 5/5] mt76: enable Airtime Queue Limit support

[Felix Fietkau]

It is supported by all drivers

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mac80211.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 9947e627318b..2a85e0cb5793 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -283,6 +283,7 @@ mt76_phy_init(struct mt76_dev *dev, struct ieee80211_hw *hw)
 
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AIRTIME_FAIRNESS);
+	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_AQL);
 
 	wiphy->available_antennas_tx = dev->phy.antenna_mask;
 	wiphy->available_antennas_rx = dev->phy.antenna_mask;
-- 
2.24.0

Re: [PATCH 5/5] mt76: enable Airtime Queue Limit support

[Toke Høiland-Jørgensen]

Felix Fietkau <nbd@nbd.name> writes:

> It is supported by all drivers
>
> Signed-off-by: Felix Fietkau <nbd@nbd.name>

Nice!

Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>

Re: [PATCH 5/5] mt76: enable Airtime Queue Limit support

[Sebastian Gottschall]

nope (iperf3 with 32 parallel streams after 5 seconds of running)

STA 30:24:32💿f9:c4 AC 2 txq pending airtime underflow: 4294967208, 88
Modules linked in: fast_classifier mt7615e mt76 mac80211 compat
CPU: 3 PID: 1890 Comm: hostapd Not tainted 4.14.171 #187
Stack : 00000000 00000001 00000040 8007e454 80490000 8048bc8c 80610000 
805aee78
         8058850c 8770b864 870f289c 805f07a7 80582204 00000001 8770b808 
805f60a8
         00000000 00000000 80650000 00000000 81147bb8 0000011e 00000007 
00000000
         00000000 80660000 80660000 68203a6d 80000000 80610000 00000000 
873079ec
         873a4654 00000775 00000000 00000001 00000000 80230b88 0000000c 
8065000c
         ...
Call Trace:
[<800153a0>] show_stack+0x58/0x100
[<80438c54>] dump_stack+0xa4/0xe0
[<80035050>] __warn+0xe4/0x144
[<80034c8c>] warn_slowpath_fmt+0x30/0x3c
[<873079ec>] _616+0x110/0x214 [mac80211]
[<87301ce0>] _535+0x15c/0x4f8 [mac80211]
[<804224f0>] br_handle_frame_finish+0x4e0/0x524
[<873d5160>] _49+0x50/0xa4 [mt76]
[<87606e30>] _61+0x1e8/0x224 [mt7615e]

Am 01.02.2020 um 13:58 schrieb Toke Høiland-Jørgensen:
> Felix Fietkau <nbd@nbd.name> writes:
>
>> It is supported by all drivers
>>
>> Signed-off-by: Felix Fietkau <nbd@nbd.name>
> Nice!
>
> Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
>
>

Re: [PATCH 5/5] mt76: enable Airtime Queue Limit support

[Toke Høiland-Jørgensen]

Sebastian Gottschall <s.gottschall@dd-wrt.com> writes:

> nope (iperf3 with 32 parallel streams after 5 seconds of running)
>
> STA 30:24:32💿f9:c4 AC 2 txq pending airtime underflow: 4294967208, 88
> Modules linked in: fast_classifier mt7615e mt76 mac80211 compat
> CPU: 3 PID: 1890 Comm: hostapd Not tainted 4.14.171 #187
> Stack : 00000000 00000001 00000040 8007e454 80490000 8048bc8c 80610000 
> 805aee78
>          8058850c 8770b864 870f289c 805f07a7 80582204 00000001 8770b808 
> 805f60a8
>          00000000 00000000 80650000 00000000 81147bb8 0000011e 00000007 
> 00000000
>          00000000 80660000 80660000 68203a6d 80000000 80610000 00000000 
> 873079ec
>          873a4654 00000775 00000000 00000001 00000000 80230b88 0000000c 
> 8065000c
>          ...
> Call Trace:
> [<800153a0>] show_stack+0x58/0x100
> [<80438c54>] dump_stack+0xa4/0xe0
> [<80035050>] __warn+0xe4/0x144
> [<80034c8c>] warn_slowpath_fmt+0x30/0x3c
> [<873079ec>] _616+0x110/0x214 [mac80211]
> [<87301ce0>] _535+0x15c/0x4f8 [mac80211]
> [<804224f0>] br_handle_frame_finish+0x4e0/0x524
> [<873d5160>] _49+0x50/0xa4 [mt76]
> [<87606e30>] _61+0x1e8/0x224 [mt7615e]

Huh, why is there a bridge function name in there in the middle of the
callstack?

-Toke

Re: [PATCH 5/5] mt76: enable Airtime Queue Limit support

[Sebastian Gottschall]

the interface is bridged to a bridge named br0 and owns the local lan ip.
its a typical setup. lan switch is bridged together with ap interface
iperf was not running on the device itself needs to be mentioned. i was 
running iperf -s on a device which was  connected by ethernet to this 
device.
my client was a simple lenovo p52 laptop with a iwlwifi 9560 card wich 
was using iperf -c x.x.x.x -P 32 -i 1

Am 19.02.2020 um 23:23 schrieb Toke Høiland-Jørgensen:
> Sebastian Gottschall <s.gottschall@dd-wrt.com> writes:
>
>> nope (iperf3 with 32 parallel streams after 5 seconds of running)
>>
>> STA 30:24:32💿f9:c4 AC 2 txq pending airtime underflow: 4294967208, 88
>> Modules linked in: fast_classifier mt7615e mt76 mac80211 compat
>> CPU: 3 PID: 1890 Comm: hostapd Not tainted 4.14.171 #187
>> Stack : 00000000 00000001 00000040 8007e454 80490000 8048bc8c 80610000
>> 805aee78
>>           8058850c 8770b864 870f289c 805f07a7 80582204 00000001 8770b808
>> 805f60a8
>>           00000000 00000000 80650000 00000000 81147bb8 0000011e 00000007
>> 00000000
>>           00000000 80660000 80660000 68203a6d 80000000 80610000 00000000
>> 873079ec
>>           873a4654 00000775 00000000 00000001 00000000 80230b88 0000000c
>> 8065000c
>>           ...
>> Call Trace:
>> [<800153a0>] show_stack+0x58/0x100
>> [<80438c54>] dump_stack+0xa4/0xe0
>> [<80035050>] __warn+0xe4/0x144
>> [<80034c8c>] warn_slowpath_fmt+0x30/0x3c
>> [<873079ec>] _616+0x110/0x214 [mac80211]
>> [<87301ce0>] _535+0x15c/0x4f8 [mac80211]
>> [<804224f0>] br_handle_frame_finish+0x4e0/0x524
>> [<873d5160>] _49+0x50/0xa4 [mt76]
>> [<87606e30>] _61+0x1e8/0x224 [mt7615e]
> Huh, why is there a bridge function name in there in the middle of the
> callstack?
>
> -Toke
>
>