summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-06-09wifi: ath10k: Update Qualcomm copyrightsJeff Johnson23-23/+14
Update Qualcomm copyrights per current legal guidance. Assisted-by: Claude:claude-sonnet-4-6 Link: https://patch.msgid.link/20260608-ath12k-copyright-v2-3-37504d70b03c@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-09wifi: ath11k: Update Qualcomm copyrightsJeff Johnson48-48/+38
Update Qualcomm copyrights per current legal guidance. Assisted-by: Claude:claude-sonnet-4-6 Link: https://patch.msgid.link/20260608-ath12k-copyright-v2-2-37504d70b03c@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-09wifi: ath12k: Update Qualcomm copyrightsJeff Johnson17-17/+16
Update Qualcomm copyrights per current legal guidance. Assisted-by: Claude:claude-sonnet-4-6 Link: https://patch.msgid.link/20260608-ath12k-copyright-v2-1-37504d70b03c@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-09net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submissionJeremy Kerr1-1/+1
In the ndo_open path, a deferred queue open will report a failure, and so the netdev will not be ndo_stop()ed, leaving us with the rx_retry work potentially pending. Don't report a deferred queue as an error, as we are still operational. This means we use the ndo_stop() path for future cleanup, which handles rx_retry_work cancellation. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260608-dev-mctp-usb-rx-requeue-v2-2-29a3aa507609@codeconstruct.com.au Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09net: mctp: usb: fix race between urb completion and rx_retry cancellationJeremy Kerr1-9/+17
It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued: T1: ndo_stop T2: rx_retry_work ------------ ---------------- LD: ->stopped => false ST: ->stopped <= true usb_kill_urb() mctp_usb_rx_queue() usb_submit_urb() cancel_delayed_work_sync() That urb completion can then re-schedule rx_retry_work. Strenghen the sequencing between the stop (preventing another requeue) and the cancel by updating both atomically under a new rx lock. After setting ->rx_stopped, and cancelling pending work, we know that the requeue cannot occur, so all that's left is killing any pending urb. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260608-dev-mctp-usb-rx-requeue-v2-1-29a3aa507609@codeconstruct.com.au Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09hv_netvsc: use kmap_local_page in netvsc_copy_to_send_bufAnton Leontev1-4/+15
netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments reference page cache or user pages, which on 32-bit x86 with CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page phys_to_virt() returns an address outside the direct map and the subsequent memcpy() faults on the transmit softirq path, which is fatal. Map the pages with kmap_local_page() instead, handling two properties of the page buffer entries: - pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity, not a native PFN. Reconstruct the physical address first and derive the native page from it, so the mapping stays correct where PAGE_SIZE > HV_HYP_PAGE_SIZE (e.g. arm64 with 64K pages). - Since commit 41a6328b2c55 ("hv_netvsc: Preserve contiguous PFN grouping in the page buffer array"), an entry describes a full physically contiguous fragment and pb[i].len can exceed PAGE_SIZE, while kmap_local_page() maps a single page. Copy page by page, splitting at native page boundaries. The copy path only handles packets smaller than the send section size (6144 bytes by default); larger packets take the cp_partial path where only the RNDIS header is copied. So entries here are bounded by the section size and a copy is split at most once on 4K-page systems. On !CONFIG_HIGHMEM configs kmap_local_page() folds to page_address() and no mapping work is added. Fixes: c25aaf814a63 ("hyperv: Enable sendbuf mechanism on the send path") Cc: stable@vger.kernel.org Signed-off-by: Anton Leontev <leontyevantony@gmail.com> Link: https://patch.msgid.link/20260604165938.32033-1-leontyevantony@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09netconsole: close netdevice unregister window during target resumeBreno Leitao1-0/+19
process_resume_target() removes the target from target_list before calling resume_target() so that netpoll_setup() can run with interrupts enabled, then re-adds it once setup completes. netpoll_setup() acquires a net_device reference (netdev_hold()) and releases the RTNL before returning. While the target is off target_list and the RTNL is not held, netconsole_netdev_event() cannot find it. If the egress device is unregistered in that window, the NETDEV_UNREGISTER notifier walks target_list, misses the resuming target, and never tears it down. The target is then re-added in STATE_ENABLED still holding a reference to the now-unregistered device, leaking it and hanging unregister_netdevice() in netdev_wait_allrefs(). Re-check under RTNL before re-publishing the target: if the device left NETREG_REGISTERED while we were off the list, run do_netpoll_cleanup() and mark the target disabled. Taking the RTNL across the check and the list_add() serialises against the NETDEV_UNREGISTER notifier, which also runs under RTNL, so the device is either still registered (and the notifier will find the re-added target later) or already unregistering (and we drop the reference here). netdev_wait_allrefs() runs from netdev_run_todo() outside the RTNL, so dropping the reference here cannot deadlock against the pending unregister. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-5-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09netconsole: clean up deactivated targets dropped before the cleanup workerBreno Leitao1-1/+13
drop_netconsole_target() downgrades a STATE_DEACTIVATED target to STATE_DISABLED and then only calls netpoll_cleanup() when the target is STATE_ENABLED. A target becomes STATE_DEACTIVATED when its underlying interface is unregistered: netconsole_netdev_event() moves it to target_cleanup_list, and netconsole_process_cleanups_core() is expected to run do_netpoll_cleanup() on it. Now that drop_netconsole_target() takes target_cleanup_list_lock around the unlink, a configfs removal racing with NETDEV_UNREGISTER can pull the target off target_cleanup_list before the cleanup worker processes it. The notifier drops the lock before calling netconsole_process_cleanups_core(), so the worker then iterates a list that no longer contains the target and never runs do_netpoll_cleanup() on it. Because drop_netconsole_target() has already rewritten the state to STATE_DISABLED, its own STATE_ENABLED check is false and netpoll_cleanup() is skipped too. The net_device reference taken by netpoll_setup() is then leaked and unregister_netdevice() hangs forever in netdev_wait_allrefs(). Capture whether the target still owns a netpoll before the state is downgraded and clean it up for both STATE_ENABLED and STATE_DEACTIVATED targets. netpoll_cleanup() is idempotent -- it skips when np->dev is already NULL -- so it is safe even when the cleanup worker won the race and already tore the netpoll down. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-4-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09netconsole: take target_cleanup_list_lock in drop_netconsole_target()Breno Leitao1-0/+2
drop_netconsole_target() unlinks the target while only holding target_list_lock. However, when the underlying interface has been unregistered, netconsole_netdev_event() moves the target from target_list to target_cleanup_list, and netconsole_process_cleanups_core() walks that list under target_cleanup_list_lock only. If a user removes the configfs target at the same time the cleanup worker is iterating target_cleanup_list, list_del() can corrupt the list because the two paths take disjoint locks while operating on the same list node. Acquire target_cleanup_list_lock around the list_del() so the unlink is serialised against netconsole_process_cleanups_core() regardless of which list the target currently belongs to. The state transition that downgrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is performed under the same combined locking, preserving the existing ordering with resume_target(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-3-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09netconsole: do not dequeue pooled skbs that cannot satisfy lenBreno Leitao1-2/+20
find_skb() falls back to np->skb_pool when the GFP_ATOMIC alloc_skb() fails. The pool is refilled by refill_skbs(), which always allocates buffers of MAX_SKB_SIZE (ethhdr + iphdr + udphdr + MAX_UDP_CHUNK == 1502 bytes). netconsole, however, computes the requested length dynamically as total_len + np->dev->needed_tailroom If the egress device declares a non-zero needed_tailroom (e.g. some tunnel or hardware accelerator devices), the required length can exceed MAX_SKB_SIZE. The pooled skb is then handed back to the caller, which immediately performs skb_put(skb, len), trips the tail > end check, and triggers skb_over_panic(). Leave the normal alloc_skb(len, GFP_ATOMIC) path untouched -- the slab allocator can still satisfy oversized requests when memory is available, so senders to devices with non-zero needed_tailroom keep working in the common case. Only the pool fallback is gated: when alloc_skb() failed and len exceeds the pool buffer size, skip the skb_dequeue() instead of burning a pre-allocated skb on a request that would later trip skb_over_panic(). Reserving pool entries for requests they can actually satisfy also keeps the panic path, which depends on the pool being primed, intact. When that drop happens, emit a rate-limited net_warn() so the user notices that netconsole is unable to push messages on the egress device. The warn is skipped under in_nmi() for the same reason schedule_work() is: printk machinery taken by net_warn_ratelimited() is not NMI-safe and would risk recursing into the same nbcon console we are servicing. MAX_SKB_SIZE / MAX_UDP_CHUNK were private to net/core/netpoll.c. Move them to include/linux/netpoll.h so netconsole can reference the same definition that refill_skbs() uses, keeping the two in sync by construction. The header now pulls in <linux/ip.h> and <linux/udp.h> explicitly so MAX_SKB_SIZE remains self-contained for any future user. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-2-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09netconsole: do not schedule skb pool refill from NMIBreno Leitao1-4/+19
When alloc_skb() fails in find_skb(), the fallback path dequeues an skb from np->skb_pool and unconditionally calls schedule_work() to top the pool back up. schedule_work() ends up taking the workqueue pool locks, which are not NMI-safe. netconsole_write() is registered as the nbcon write_atomic callback and is explicitly marked CON_NBCON_ATOMIC_UNSAFE, meaning it is invoked from emergency/panic contexts including NMIs. If the NMI interrupts a thread already holding the workqueue pool lock, calling schedule_work() self-deadlocks and the panic message that was being printed is lost. Introduce netcons_skb_pop() to fold the pool dequeue and the refill request into a single helper. The helper skips schedule_work() when called from NMI context; the pool is best-effort, so the refill is simply deferred to the next non-NMI find_skb() call that exhausts alloc_skb() and hits the fallback again. This keeps the fast path untouched and the locking rules around the fallback pool documented in one place. Note this only removes the schedule_work() hazard from the NMI path. The allocation itself is still not fully NMI-safe: the alloc_skb(GFP_ATOMIC) attempted first may take slab locks, and the skb_dequeue() fallback takes np->skb_pool.lock, so either can deadlock if the NMI interrupts a holder of those locks. Closing those windows requires an NMI-safe (lockless) skb pool and is left to a follow-up; this patch addresses the schedule_work() deadlock, which is both the most likely and the easiest to trigger. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-1-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09wifi: mt76: Drop unneeded mt76_register_debugfs_fops() return checksIngyu Jang5-10/+1
mt76_register_debugfs_fops() returns the dentry from debugfs_create_dir(), which yields an error pointer on failure (notably ERR_PTR(-ENODEV) when CONFIG_DEBUG_FS=n), never NULL. Per commit ff9fb72bc077 ("debugfs: return error values, not NULL"), callers do not need to check the return value. Drop the dead !dir checks in mt7615/mt7915/mt7921/mt7925/mt7996 _init_debugfs(). Converting them to IS_ERR() instead would have exposed a probe abort on CONFIG_DEBUG_FS=n, since each *_init_debugfs() caller propagates the helper's return value. This patch supersedes an earlier proposal that converted the checks to IS_ERR(). Link: https://lore.kernel.org/all/20260514193243.2518979-1-ingyujang25@korea.ac.kr Signed-off-by: Ingyu Jang <ingyujang25@korea.ac.kr> Link: https://patch.msgid.link/20260519085214.164846-1-ingyujang25@korea.ac.kr Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: assert sniffer on chanctx changeDevin Wittmayer1-2/+4
mt7921_change_chanctx() configures the channel for monitor vifs but does not re-assert sniffer mode. mt7925_change_chanctx() does. Match mt7925 by adding the missing mt7921_mcu_set_sniffer(true) call, completing the architectural pattern from commit 914189af23b8 ("wifi: mt76: mt7921: fix channel switch fail in monitor mode"). The user-visible regression this asymmetry produced on v6.17 and v6.18 was addressed by commit cdb2941a516c ("Revert "wifi: mt76: mt792x: improve monitor interface handling"") in v6.19 and backported to the 6.17.y and 6.18.y stable trees. This patch is defense in depth in case the NO_VIRTUAL_MONITOR change is reintroduced in a future series. Tested-by: Nick Morrow <morrownr@gmail.com> Tested-on: RasPi4B, RasPiOS 64 bit, Alfa AWUS036AXML mt7921u Tested-on: RasPi4B, RasPiOS 64 bit, Netgear A9000 mt7925u Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260515183921.23484-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09octeontx2-af: fix memory leak in rvu_setup_hw_resources()Dawei Feng1-1/+1
If rvu_npc_exact_init() fails in rvu_setup_hw_resources(), the function returns directly instead of jumping to the error handling path. This causes a resource leak for the previously initialized CGX, NPC, fwdata, and MSI-X states. Fix this by replacing the direct return with goto cgx_err to ensure proper cleanup. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have access to Marvell OcteonTX2 RVU AF hardware to test with, no runtime testing was able to be performed. Fixes: 3571fe07a090 ("octeontx2-af: Drop rules for NPC MCAM") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://patch.msgid.link/20260604143756.1524482-1-dawei.feng@seu.edu.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09wifi: mt76: mt7996: fix potential tx_retries underflowRyder Lee1-3/+3
When FIELD_GET returns 0 for the retry count, subtracting 1 causes an unsigned integer underflow, resulting in tx_retries becoming a very large value (0xFFFFFFFF for u32). Fix by checking if count is non-zero before subtracting 1. Fixes: 2461599f835e ("wifi: mt76: mt7996: get tx_retries and tx_failed from txfree") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/20260605113306.3485554-4-ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: fix potential tx_retries underflowRyder Lee1-2/+3
When FIELD_GET returns 0 for the retry count, subtracting 1 causes an unsigned integer underflow, resulting in tx_retries becoming a very large value (0xFFFFFFFF for u32). Fix by checking if count is non-zero before subtracting 1. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/20260605113306.3485554-3-ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: fix potential tx_retries underflowRyder Lee1-2/+3
When FIELD_GET returns 0 for the retry count, subtracting 1 causes an unsigned integer underflow, resulting in tx_retries becoming a very large value (0xFFFFFFFF for u32). Fix by checking if count is non-zero before subtracting 1. Fixes: 9aecfa754c7f ("wifi: mt76: mt7921e: report tx retries/failed counts in tx free event") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/20260605113306.3485554-2-ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7915: fix potential tx_retries underflowRyder Lee1-5/+5
When FIELD_GET returns 0 for the retry count, subtracting 1 causes an unsigned integer underflow, resulting in tx_retries becoming a very large value (0xFFFFFFFF for u32). Fix by checking if count is non-zero before subtracting 1. Fixes: 943e4fb96e6f ("wifi: mt76: mt7915: report tx retries/failed counts for non-WED path") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/20260605113306.3485554-1-ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: disable auto regd changes after user setJB Tsai2-1/+7
Add regd_user flag to block automatic regulatory domain updates if set by user. Co-developed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: JB Tsai <jb.tsai@mediatek.com> Link: https://patch.msgid.link/20260303053637.465465-5-jb.tsai@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: add auto regdomain switch supportJB Tsai6-11/+92
Implement 802.11d-based automatic regulatory domain switching to dynamically determine the regulatory domain at runtime. The scan-done event structure by reusing reserved padding and appending new fields; the layout and values remains backward-compatible with existing users. Co-developed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: JB Tsai <jb.tsai@mediatek.com> Link: https://patch.msgid.link/20260303053637.465465-4-jb.tsai@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: refactor regulatory notifier flowJB Tsai4-16/+36
Rename mt7921_regd_update() to mt7921_mcu_regd_update() to centralize regd updates with error handling. Co-developed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: JB Tsai <jb.tsai@mediatek.com> Link: https://patch.msgid.link/20260303053637.465465-3-jb.tsai@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: refactor CLC support check flowJB Tsai3-6/+16
Move the disable_clc module parameter to regd.c and introduce mt7921_regd_clc_supported() to centralize CLC support checks. Co-developed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: JB Tsai <jb.tsai@mediatek.com> Link: https://patch.msgid.link/20260303053637.465465-2-jb.tsai@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921: refactor regulatory domain handling to regd.[ch]JB Tsai7-99/+122
Move regd logic to regd.c and regd.h files Co-developed-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Signed-off-by: JB Tsai <jb.tsai@mediatek.com> Link: https://patch.msgid.link/20260303053637.465465-1-jb.tsai@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: disable UNI_BSS_INFO_PROTECT_INFO for mt7996Ryder Lee1-0/+4
The current MT7996 firmware causes TX failure and need further investigation, so it is temporarily disabled. MT7992 and MT7990 are working normally. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/6427326eb4e8f375c63379f7a0df7e2ae9d120a4.1774458901.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3SZenm Chen1-0/+1
Add the ID 056e:400a to the table to support an additional MT7612U adapter: ELECOM WDC-867SU3S. Compile tested only. Cc: stable@vger.kernel.org # 5.10.x Signed-off-by: Zenm Chen <zenmchen@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260407154430.9184-1-zenmchen@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: fix argument to ieee80211_is_first_frag()Bjoern A. Zeeb1-1/+1
ieee80211_is_first_frag() operates on the seq_ctrl not the frame_control header field. Pass the correct one in; otherwise the results may vary. Sponsored by: The FreeBSD Foundation Fixes: 30ce7f4456ae4 ("mt76: validate rx CCMP PN") Link: https://cgit.freebsd.org/src/commit/sys/contrib/dev/mediatek/mt76/mac80211.c?id=c67fd35e58c6ee1e19877a7fe5998885683abedc Signed-off-by: Bjoern A. Zeeb <bz@FreeBSD.org> Link: https://patch.msgid.link/83s4psnr-popo-8789-757o-npr2n9n7rs2o@SerrOFQ.bet Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921u: escalate broken USB transport to device resetSean Wang4-1/+35
Check the USB control path before running the normal WFSYS reset flow. If USB access is no longer reliable, stop the WFSYS-only reset path, mark the device as bus_hung, and queue a USB device reset instead. Reuse the existing bus_hung state to represent transport-level failure, keeping the semantics consistent with the SDIO path. Also initialize bus_hung explicitly during probe for consistency. Reported-by: Bryam Vargas <bryamestebanvargas@gmail.com> Closes: https://lore.kernel.org/r/CANAPQziOh3sB7B8G+U3AZsFfeFN1uAg4munhwA_feZi56D7W+Q@mail.gmail.com Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260401190632.147042-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt792x: add common USB transport reset helpersSean Wang4-0/+59
Add per-device USB reset work and a control-path access check helper for mt7921u and mt7925u. This prepares common infrastructure for transport-level recovery while keeping the reset state per-device for correct lifetime handling. No functional change intended. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260401190632.147042-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt792x: report txpower for the requested vif linkSean Wang4-2/+45
mt792x currently reports txpower from the generic PHY cached state, which may not match the requested vif/link context. Resolve the requested link channel and derive txpower from that channel instead, with fallback to the current PHY chandef if no valid chanctx is available. Reported-by: Devin Wittmayer <lucid_duck@justthetip.ca> Closes: https://lore.kernel.org/linux-wireless/20260130215839.53270-1-lucid_duck@justthetip.ca/ Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca> Tested-by: Satadru Pramanik <satadru@gmail.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260401182322.64355-3-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: connac: factor out rate power limit calculationSean Wang2-8/+23
Factor out the per-channel rate power limit calculation into a shared helper. This avoids duplicating the same regulatory, SAR and rate-limit logic in multiple paths. Reported-by: Devin Wittmayer <lucid_duck@justthetip.ca> Closes: https://lore.kernel.org/linux-wireless/20260130215839.53270-1-lucid_duck@justthetip.ca/ Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca> Tested-by: Satadru Pramanik <satadru@gmail.com> Co-developed-by: Devin Wittmayer <lucid_duck@justthetip.ca> Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260401182322.64355-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: connac: use a helper to cache txpower_curSean Wang3-4/+18
The cached txpower value is derived from the bounded channel power after applying the chainmask path delta. Use a helper for that conversion so callers do not open-code it. -- v2: - Rebased onto the latest mt76 tree - Added Reported-by, Tested-by, Co-developed-by and Signed-off-by tags Reported-by: Devin Wittmayer <lucid_duck@justthetip.ca> Closes: https://lore.kernel.org/linux-wireless/20260130215839.53270-1-lucid_duck@justthetip.ca/ Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca> Tested-by: Satadru Pramanik <satadru@gmail.com> Co-developed-by: Devin Wittmayer <lucid_duck@justthetip.ca> Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Reported-by: Lucid Duck <lucid_duck@justthetip.ca> Tested-by: Lucid Duck <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260401182322.64355-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: limit work in set_bitrate_maskDylan Eskew1-3/+6
Calls to mt7996_set_bitrate_mask() would propagate work for all stations on the ieee80211_hw regardless of the vif specified in the call. To prevent unnecessary work in FW, limit setting the sta_rate to only the specified vif in mt7996_sta_rate_ctrl_update(). Fixes: afff4325548f0 ("wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback") Signed-off-by: Dylan Eskew <dylan.eskew@candelatech.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260408145057.2356878-2-dylan.eskew@candelatech.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: reduce phy work in set_coverageDylan Eskew1-10/+0
In mt7996_set_coverage_class(), each phy is iterated over in calling mt7996_mac_set_coverage_class(). Thus, the phy2 and phy3 configuration logic in mt7996_mac_set_coverage_class() can be dropped. Signed-off-by: Dylan Eskew <dylan.eskew@candelatech.com> Link: https://patch.msgid.link/20260415155354.1135548-2-dylan.eskew@candelatech.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7921u: add MT7902 USB supportSean Wang2-0/+3
Add the 0e8d:7902 USB ID and select the MT7902 WM firmware. Use the same USB queue mapping as mt7921/mt7925 so MT7902U can bind and probe through mt7921u driver. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425160930.739237-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: transform aspm_conf for pci_disable_link_stateJiajia Liu1-1/+7
commit b478e162f227 ("PCI/ASPM: Consolidate link state defines") changed PCIE_LINK_STATE_L0S (1) to (BIT(0) | BIT(1)). PCI_EXP_LNKCTL_ASPM_L0S (1) and PCI_EXP_LNKCTL_ASPM_L1 (2) are no longer matched with PCIE_LINK_STATE_L0S (3) and PCIE_LINK_STATE_L1 (4). On the platform enabling ASPM L0s and L1, mt76_pci_disable_aspm is not able to disable L1. Fix this by transforming aspm_conf to pcie link state. Signed-off-by: Jiajia Liu <liujiajia@kylinos.cn> Link: https://patch.msgid.link/20260602054349.42429-1-liujia6264@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: add wcid publish check in mt76_sta_addJiajia Liu1-3/+12
Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconnect from AP 90:fb:5d:94:8b:e3 for new auth to 90:fb:5d:94:8b:e2 wlan0: authenticate with 90:fb:5d:94:8b:e2 (local address=84:9e:56:9c:7e:6b) wlan0: send auth to 90:fb:5d:94:8b:e2 (try 1/3) slab kmalloc-8k start ffff8c80958a6000 pointer offset 4160 size 8192 list_add corruption. prev->next should be next (ffff8c808a7488f8), but was ffff8c80958a7040. (prev=ffff8c80958a7040). mt76_wcid_add_poll+0x95/0xd0 [mt76] mt7925_mac_add_txs.part.0+0xa5/0xe0 [mt7925_common] mt7925_rx_check+0xa7/0xc0 [mt7925_common] mt76_dma_rx_poll+0x50d/0x790 [mt76] mt792x_poll_rx+0x52/0xe0 [mt792x_lib] Signed-off-by: Jiajia Liu <liujiajia@kylinos.cn> Link: https://patch.msgid.link/20260528033814.46418-1-liujiajia@kylinos.cn Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: remove redundant pdev->bus check in probeLorenzo Bianconi1-1/+1
Drop the unnecessary pdev->bus NULL check in mt7996_pci_probe() since the pointer is already dereferenced earlier in mt76_pci_disable_aspm(), making the check dead code. Silences the related Smatch warning. Fixes: 377aa17d2aed ("wifi: mt76: mt7996: Add NPU offload support to MT7996 driver") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260522-mt7996-pdev-bus-fix-v1-1-c91716484365@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: fix reading zeroed info->control.flags after ↵Lorenzo Bianconi3-13/+9
mt76_tx_status_skb_add() mt76_tx_status_skb_add() zeroes the mt76_tx_cb struct stored at info->status.status_driver_data via memset(). Since info->control and info->status are members of the same union in ieee80211_tx_info, this overwrites info->control.flags. In mt7996_tx_prepare_skb(), mt76_tx_status_skb_add() is called before mt7996_mac_write_txwi(), which re-reads info->control.flags to extract IEEE80211_TX_CTRL_MLO_LINK. Because the field has been zeroed, the link_id always resolves to 0 for frames using global_wcid, leading to incorrect TXWI configuration. Fix this by passing link_id as an explicit parameter to mt7996_mac_write_txwi(). In mt7996_tx_prepare_skb(), the link_id is already extracted from info->control.flags before the destructive mt76_tx_status_skb_add() call. For the beacon and inband discovery callers in mcu.c, use link_conf->link_id directly. Fixes: f0b0b239b8f36 ("wifi: mt76: mt7996: rework mt7996_mac_write_txwi() for MLO support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260531-mt76_tx_status_skb_add-overwrite-fix-v2-1-b73c4b4a9798@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: Fix possible NULL pointer dereference in ↵Lorenzo Bianconi1-3/+4
mt7996_mac_write_txwi_80211() For injected frames (e.g. via radiotap), mac80211 can pass info->control.vif = NULL, as explicitly noted in struct ieee80211_tx_info. Check vif pointer before executing ieee80211_vif_is_mld() in mt7996_mac_write_txwi_80211 routine in order to avoid a possible NULL pointer dereference. Fixes: f0b0b239b8f36 ("wifi: mt76: mt7996: rework mt7996_mac_write_txwi() for MLO support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260531-mt7996_mac_write_txwi_80211-null-ptr-deref-v1-1-6dd38e1d3422@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()Lorenzo Bianconi2-3/+7
If link_conf or link_sta lookup fails in mt7996_tx_prepare_skb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of error. Fixes: 7ef0c7ad735b0 ("wifi: mt76: mt7996: Implement MLD address translation for EAPOL") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260531-mt7996_tx_prepare_skb-token-leack-v1-1-2b9c9f59ceb1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7915: validate skb length in txpower SKU queryAviel Zohar1-0/+8
In mt7915_mcu_get_txpower_sku(), the response skb from mt76_mcu_send_and_get_msg() is used in memcpy without validating its length: For TX_POWER_INFO_RATE: memcpy(res, skb->data + 4, sizeof(res)); where sizeof(res) is MT7915_SKU_RATE_NUM * 2 = 322 bytes. For TX_POWER_INFO_PATH: memcpy(txpower, skb->data + 4, len); In both cases, if the firmware returns a response shorter than the expected size, the memcpy reads beyond the skb data buffer. The data surfaces to userspace via debugfs (txpower_sku and txpower_path). Add length checks for both code paths before the memcpy. Signed-off-by: Aviel Zohar <avielzohar123@gmail.com> Link: https://patch.msgid.link/20260413033136.5417-3-avielzohar123@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: validate skb length in testmode queryAviel Zohar1-0/+5
In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length: memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN); where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump(). Add a length check before the memcpy to ensure the skb contains sufficient data. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Aviel Zohar <avielzohar123@gmail.com> Link: https://patch.msgid.link/20260413033136.5417-2-avielzohar123@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TXSean Wang1-1/+2
mt792x_tx() rewrites addr1/addr2/addr3 by treating skb->data as an 802.11 header for MLD traffic. That is only valid for native 802.11 frames. Direct 802.3 TX can also reach this path with IEEE80211_TX_CTL_HW_80211_ENCAP set, where skb->data is not an 802.11 header. Skip the MLD header rewrite for HW-encap packets to avoid corrupting 802.3 frame contents. Fixes: ebb1406813c6 ("wifi: mt76: mt7925: add link handling to txwi") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425144648.734030-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: program BA state on active linksSean Wang3-22/+59
With MLO, traffic for one TID can be sent on any active link. Programming BA state only on the default link leaves the other active links out of sync. Program BA state on all active links instead. Fixes: 766ea2cf5a39 ("Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"") Tested-by: Yao Ting Hsieh <yao-ting.hsieh@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425154721.738101-3-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: pass WCID explicitly to mt7925_mcu_sta_ba()Sean Wang1-2/+3
mt7925_mcu_sta_ba() currently hides the BA target behind an implicit WCID lookup. Pass the WCID explicitly so the caller controls which BA context is being programmed. No functional change intended. Tested-by: Yao Ting Hsieh <yao-ting.hsieh@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425154721.738101-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: keep TX BA state in the primary WCIDSean Wang1-8/+7
For MLO, the same TID can run over different links. Keeping TX BA state in a link WCID makes the state depend on which link starts aggregation first. Store it in the primary WCID instead, so the BA state stays stable across links. Fixes: 44eb173bdd4f ("wifi: mt76: mt7925: add link handling in mt7925_txwi_free") Tested-by: Yao Ting Hsieh <yao-ting.hsieh@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425154721.738101-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: add MT7927 USB supportSean Wang2-0/+16
Add the MT7927 USB device ID and normalize the raw 0x6639 CHIPID to MT7927 so the shared mt7925u code can use the proper chip-specific paths. Restore the required band setup after USB MAC reset before restarting the device. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425195011.790265-22-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: add MT7927 PCIe supportSean Wang1-1/+15
Add the missing MT7927 device support in the mt7925 PCI path. This ensures MT7927 is identified correctly and uses the proper initialization flow. Co-developed-by: Javier Tia <floss@jetm.me> Signed-off-by: Javier Tia <floss@jetm.me> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425195011.790265-21-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt792x: enable CNM ops for MT7927Sean Wang1-0/+11
Enable CNM support for MT7927 so mac80211 keeps remain-on-channel callbacks available. MT7927 needs them at runtime even when the capability is not advertised through the normal firmware feature path. Co-developed-by: Javier Tia <floss@jetm.me> Signed-off-by: Javier Tia <floss@jetm.me> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425195011.790265-20-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: add MBMC event handlingSean Wang3-1/+34
Handle MBMC unsolicited events from firmware to report the current MBMC state. This helps validate MT7927 band setup. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260425195011.790265-19-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit (git 2.54.0.dirty) at 2026-09-27 14:07:42 +0000