summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/mediatek
AgeCommit message (Collapse)Author
2026-03-24wifi: mt76: add missing lock protection in mt76_sta_state for sta_event callbackZiyi Guo
mt76_sta_state() calls the sta_event callback without holding dev->mutex. However, mt7915_mac_sta_event() (MT7915 implementation of this callback) calls mt7915_mac_twt_teardown_flow() which has lockdep_assert_held(&dev->mt76.mutex) indicating that callers must hold this lock. The locking pattern in mt76_sta_state() is inconsistent: - mt76_sta_add() acquires dev->mutex before calling dev->drv->sta_add - mt76_sta_remove() acquires dev->mutex before calling __mt76_sta_remove - But sta_event callback is called without acquiring the lock Add mutex_lock()/mutex_unlock() around the mt7915_mac_twt_teardown_flow invocation to fix the missing lock protection and maintain consistency with the existing locking pattern. Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Link: https://patch.msgid.link/20260131035210.2198259-1-n7l8m4@u.northwestern.edu Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: fix 6GHz regulatory update on connectionMichael Lo
Call mt7921_regd_update() instead of mt7921_mcu_set_clc() when setting the 6GHz power type after connection, so that regulatory limits and SAR power are also applied. Fixes: 51ba0e3a15eb ("wifi: mt76: mt7921: add 6GHz power type support for clc") Signed-off-by: Michael Lo <michael.lo@mediatek.com> Link: https://patch.msgid.link/20260211095025.2415624-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Disable Rx hdr_trans in monitor modeRyder Lee
Ensure raw frames are captured without header modification. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/04008426d6cd5de3995beefb98f9d13f35526c25.1770969275.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Add eMLSR supportMeiChia Chiu
Implement set_eml_op_mode mac80211 callback in order to introduce eMLSR support. Tested-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260203-mt7996-emlsr-v1-1-38ffb3d5110c@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()Duoming Zhou
When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work. Fixes: 878161d5d4a4 ("wifi: mt76: mt7996: enable coredump support") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://patch.msgid.link/20260131024731.18741-1-duoming@zju.edu.cn Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()Duoming Zhou
When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7915_pci_remove() | mt7915_sys_recovery_set() mt7915_unregister_device() | mt7915_reset() mt7915_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7915_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7915_unregister_device() to synchronize with any pending or executing dump work. Fixes: 4dbcb9125cc3 ("wifi: mt76: mt7915: enable coredump support") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://patch.msgid.link/20260130145759.84272-1-duoming@zju.edu.cn Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: don't return TXQ when exceeding max non-AQL packetsDavid Bauer
mt76_txq_send_burst does check if the number of non-AQL frames exceeds the maximum. In this case the queue is returned to ieee80211_return_txq when iterating over the scheduled TXQs in mt76_txq_schedule_list. This has the effect of inserting said TXQ at the head of the list. This means the loop will get the same TXQ again, which will terminate the scheduling round. TXQs following in the list thus never get scheduled for transmission. This can manifest in high latency low throughput or broken connections for said STAs. Check if the non-AQL packet count exceeds the limit and not return the TXQ in this case. Schedule all TXQs for the STA in case the non-AQL limit can be satisfied again. Signed-off-by: David Bauer <mail@david-bauer.net> Link: https://patch.msgid.link/20260129232321.276575-1-mail@david-bauer.net Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch ↵StanleyYP Wang
reason Previously, we used the IEEE80211_CONF_IDLE flag to avoid setting the parking channel with the CH_SWITCH_NORMAL reason, which could trigger TX emission before bootup CAC. However, we found that this flag can be set after triggering scanning on a connected station interface, and the reason CH_SWITCH_SCAN_BYPASS_DPD will be used when switching back to the operating channel, which makes the firmware failed to resume paused AC queues. Seems that we should avoid relying on this flag after switching to single multi-radio architecture. Instead, use the existence of chanctx as the condition. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: avoid to set ACK for MCU command if wait_resp is not setStanleyYP Wang
When wait_resp is not set but the ACK option is enabled in the MCU TXD, the ACK event is enqueued to the MCU event queue without being dequeued by the original MCU command request. Any orphaned ACK events will only be removed from the queue when another MCU command requests a response. Due to sequence index mismatches, these events are discarded one by one until a matching sequence index is found. However, if several MCU commands that do not require a response continue to fill up the event queue, there is a risk that when an MCU command with wait_resp enabled is issued, it may dequeue the wrong event skb, especially if the queue contains events with all possible sequence indices. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix struct mt7996_mcu_uni_eventStanleyYP Wang
The cid field is defined as a two-byte value in the firmware. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXPShayne Chen
The struct mt76_connac_fw_txp is used for HIF TXP. Change to use the struct mt76_connac_hw_txp to fix the wrong DMAD length for MAC TXP. Fixes: cb6ebbdffef2 ("wifi: mt76: mt7996: support writing MAC TXD for AddBA Request") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902 SDIO device supportSean Wang
Register the MT7902 SDIO device ID in the mt7921 driver and add its corresponding firmware and ROM patch names. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-11-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902 PCIe device supportSean Wang
Register the MT7902 PCI device ID in the mt7921 driver and add its corresponding firmware and ROM patch names. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-10-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt792x: add MT7902 WFDMA prefetch configurationSean Wang
Configure the RX/TX ring prefetch setting for MT7902 PCIe device. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-9-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902 MCU supportSean Wang
Add MCU support for the MT7902 chipset. runtime pm is not yet supported by the driver, but normal mac80211 operation is unaffected. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-8-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt792x: ensure MCU ready before ROM patch downloadSean Wang
Restart the MCU and poll FW state to ensure correct MCU status before downloading the ROM patch. This is a prerequisite for enabling MT7902 PCIe and has been validated on MT7921 and MT7925 since they share the common code path. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-7-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt792x: add PSE handling barrier for the large MCU cmdSean Wang
Add a dummy register read in mt76_connac_mcu_rate_txpower_band() to act as a PSE barrier. This would release PSE pages and prevents buffer underflow issues when handling MCU commands with larger payloads without the response in mt76_connac_mcu_set_rate_txpower(). This is a prerequisite patch before enabling MT7902 PCIe and SDIO support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-6-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: connac: mark MT7902 as hw txp devicesSean Wang
Add MT7902 to is_mt76_fw_txp() so it follows the legacy TX descriptor path like the other connac2 chips that return false. This is a prerequisite patch before enabling MT7902 pcie support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-5-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902e DMA layout supportSean Wang
Add MT7902 PCIe specific DMA layout overrides for MCU TXQ index, RX ring size, and MCU_WA usage. Common layout remains the default for other chips. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-4-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: handle MT7902 irq_map quirk with mutable copySean Wang
MT7902 PCIe requires a different wm2_complete_mask value, so introduce a mutable per-device copy of the default irq_map and override the field only for this chip. Other devices continue using the shared const template. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-3-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: use mt76_for_each_q_rx() in reset pathSean Wang
Replace explicit napi_disable() calls for RX queues with mt76_for_each_q_rx() in mt7921e_mac_reset(). This removes hardcoded queue indices and disables all configured RX queues during reset. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: connac: use is_connac2() to replace is_mt7921() checksSean Wang
Unify all per-chip conditionals under the new is_connac2() helper. This avoids confusion caused by the previous is_mt7921() check, which implicitly covered multiple connac2 chipsets and no longer reflected its actual scope. This is a clean-up only change with no functional impact. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: apply calibration-free data from OTPStanleyYP Wang
Before sending the current EEPROM data to the firmware, read the calibration-free data (FT data) from the efuse and merge it with the existing EEPROM data. Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20260212090310.3335392-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: add variant for MT7992 chipsetsShayne Chen
Introduce VAR_TYPE_24 for the MT7992 chipsets, a dual-band variant supporting 3T3R/2SS on the 2 GHz band and 5T5R/4SS on the 5GHz band. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260212090310.3335392-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: add external EEPROM support for mt799x chipsetsStanleyYP Wang
For the MT7992 and MT7990 chipsets, efuse mode is not supported because there is insufficient space in the efuse to store the calibration data. Therefore, an additional on-chip EEPROM is added to address this limitation. Co-developed-by: Elwin Huang <s09289728096@gmail.com> Signed-off-by: Elwin Huang <s09289728096@gmail.com> Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20260212090310.3335392-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: fix backoff fields and max_power calculationAllen Ye
The maximum power value may exist in either the data or backoff field. Previously, backoff power limits were not considered in txpower reporting. This patch ensures mt76 also considers backoff values in the SKU table. Also, each RU entry (RU26, RU52, RU106, BW20, ...) in the DTS corresponds to 10 stream combinations (1T1ss, 2T1ss, 3T1ss, 4T1ss, 2T2ss, 3T2ss, 4T2ss, 3T3ss, 4T3ss, 4T4ss). For beamforming tables: - In connac2, beamforming entries for BW20~BW160, and OFDM do not include 1T1ss. - In connac3, beamforming entries for BW20~BW160, and RU include 1T1ss, but OFDM beamforming does not include 1T1ss. Non-beamforming and RU entries for both connac2 and connac3 include 1T1ss. Fixes: b05ab4be9fd7 ("wifi: mt76: mt7915: add bf backoff limit table support") Signed-off-by: Allen Ye <allen.ye@mediatek.com> Co-developed-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/8fa8ec500b3d4de7b1966c6887f1dfbe5c46a54c.1771205424.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7921: Replace deprecated PCI functionMadhur Kumar
pcim_iomap_table() and pcim_iomap_regions() have been deprecated. Replace them with pcim_iomap_region(). Signed-off-by: Madhur Kumar <madhurkumar004@gmail.com> Link: https://patch.msgid.link/20251208172331.89705-1-madhurkumar004@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: increase txq memory limit to 32 MiBChad Monroe
Prior to this change, both 2G and 6G radios would fall back to the mac80211 default of 4MB which is not enough for high data rates. Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/acfe2e25768b414518be2db22b1d3ba6f5db6fa1.1765203249.git.chad@monroe.io Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: reset device after MCU message timeoutChad Monroe
Trigger a full reset after MCU message timeout. Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/6e05ed063f3763ad3457633c56b60a728a49a6f0.1765203753.git.chad@monroe.io Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: fix deadlock in remain-on-channelChad Monroe
mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel() while already holding dev->mutex. Since mt76_set_channel() also acquires dev->mutex, this results in a deadlock. Use __mt76_set_channel() instead of mt76_set_channel(). Add cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel() to prevent a secondary deadlock with the mac_work workqueue. Fixes: a8f424c1287c ("wifi: mt76: add multi-radio remain_on_channel functions") Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/ace737e7b621af7c2adb33b0188011a5c1de2166.1765204256.git.chad@monroe.io Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_syncSean Wang
roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() -> mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership. Fixes: 352d966126e6 ("wifi: mt76: mt7921: fix a potential association failure upon resuming") Co-developed-by: Quan Zhou <quan.zhou@mediatek.com> Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260126180013.8167-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_workQuan Zhou
The mt7921_set_roc API may be executed concurrently with mt7921_roc_work, specifically between the following code paths: - The check and clear of MT76_STATE_ROC in mt7921_roc_work: if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) return; - The execution of ieee80211_iterate_active_interfaces. This race condition can interrupt the ROC abort flow, resulting in the ROC process failing to abort as expected. To address this defect, the modification of MT76_STATE_ROC is now protected by mt792x_mutex_acquire(phy->dev). This ensures that changes to the ROC state are properly synchronized, preventing race conditions and ensuring the ROC abort flow is not interrupted. Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Reviewed-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/2568ece8b557e5dda79391414c834ef3233049b6.1769133724.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: fix tx power setting failure after chip resetLeon Yen
After the chip reset, the procedure to set the tx power will not be successful because the previous region setting is still remains. Clear the region setting during MAC initialization and allow it to be reset to finalize the TX power setting. Fixes: 3bc62aa4484d ("wifi: mt76: mt7925: add auto regdomain switch support") Signed-off-by: Leon Yen <leon.yen@mediatek.com> Link: https://patch.msgid.link/20260120163152.3694116-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()Zilin Guan
mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked. Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path. Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: d1369e515efe ("wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine") Fixes: 6683d988089c ("mt76: connac: move mt76_connac_mcu_add_key in connac module") Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support") Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://patch.msgid.link/20260116144919.1482558-1-zilin@seu.edu.cn Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_syncSean Wang
roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() -> mt7925_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership. Fixes: 45064d19fd3a ("wifi: mt76: mt7925: fix a potential association failure upon resuming") Co-developed-by: Quan Zhou <quan.zhou@mediatek.com> Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20251216013849.17976-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: Skip scan process during suspend.Michael Lo
We are experiencing command timeouts because an upper layer triggers an unexpected scan while the system/device is in suspend. The upper layer should not initiate scans until the NIC has fully resumed. We want to prevent scans during suspend and avoid timeouts without harming power management or user experience. Signed-off-by: Michael Lo <michael.lo@mediatek.com> Link: https://patch.msgid.link/20260112114007.2115873-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: drop puncturing handling from BSS change pathSean Wang
IEEE80211_CHANCTX_CHANGE_PUNCTURING is a channel context change flag and should not be checked in the BSS change handler, where the changed mask represents enum ieee80211_bss_change. Remove the puncturing handling from the BSS path and rely on mt7925_change_chanctx() to update puncturing configuration. Fixes: cadebdad959b ("wifi: mt76: mt7925: add EHT preamble puncturing") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20251216022017.23870-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: Enable NPU support for MT7996 devicesLorenzo Bianconi
Enable NPU offloading for MT7990 chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-17-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Store DMA mapped buffer addresses in mt7996_npu_hw_init()Lorenzo Bianconi
In order to not always reallocate them during NPU reset, store the DMA mapped buffer addresses allocated by mt7996_npu_hw_init routine in mt7996 structure. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-16-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Do not schedule RRO and TxFree queues during reset for NPULorenzo Bianconi
This is a preliminary patch to properly manage reset procedure when NPU offloading is enabled. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-15-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: Do not reset idx for NPU tx queues during resetLorenzo Bianconi
Do not run reset_q callaback with reset_idx set to true for NPU Tx queues. This is a preliminary patch to properly manage reset procedure when NPU offloading is enabled. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-14-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Move RRO dma start in a dedicated routineLorenzo Bianconi
This is a preliminary patch to properly enable NPU offloading for MT7996 chipset since NPU initialization must be completed before kicking rx queues. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-13-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Add __mt7996_npu_hw_init routineLorenzo Bianconi
Introduce __mt7996_npu_hw_init utility routine in order to run it holding mt76 mutex and move NPU hw re-initialization before restarting the NAPIs during device reset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-12-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Integrate MT7990 dma configuration for NPULorenzo Bianconi
Add NPU integration in MT7996 dma codebase for MT7990 chipset. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-11-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Integrate MT7990 init configuration for NPULorenzo Bianconi
Add NPU integration in MT7996 init codebase for MT7990 chipset. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-10-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Integrate NPU in RRO session managementLorenzo Bianconi
Add NPU integration in RRO 3.0 session management. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-9-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Add NPU support for MT7990 chipsetLorenzo Bianconi
Introduce support for MT7990 chipset in MT7996 npu configuration codebase. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-8-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Rename mt7996_npu_rxd_init() in mt7992_npu_rxd_init()Lorenzo Bianconi
This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-7-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Add mt7992_npu_txrx_offload_init routineLorenzo Bianconi
Introduce mt7992_npu_txrx_offload_init utility routine. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-6-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Fix wdma_idx for MT7996 device if NPU is enabledLorenzo Bianconi
This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang <kang.yang@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-5-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit v1.2.3 (git 2.0.4) at 2026-04-21 00:07:00 +0000