* [PATCH] thermal/drivers/airoha: Fix FIELD_PREP using wrong mask for sensor interval
From: Wayen.Yan @ 2026-06-14 0:14 UTC (permalink / raw)
To: linux-pm
Cc: Rafael J. Wysocki, Daniel Lezcano, Zhang Rui, Lukasz Luba,
Christian Marangi, Lorenzo Bianconi, linux-kernel, linux-mediatek
In airoha_thermal_setup_monitor(), the TEMPMONCTL2 register is
programmed with:
writel(FIELD_PREP(EN7581_FILT_INTERVAL, 1) |
FIELD_PREP(EN7581_FILT_INTERVAL, 379), ...)
Both FIELD_PREP calls target FILT_INTERVAL (GENMASK(25,16)), so the
second one overwrites the first. The sensor interval field
SEN_INTERVAL (GENMASK(9,0)) is never written and remains zero.
The comment above states: "filt interval is 1 * 52.715us, sen interval
is 379 * 52.715us", confirming the second value should go into
SEN_INTERVAL. This matches the Mediatek auxadc_thermal.c reference
implementation which correctly writes FILTER_INTERVAL and
SENSOR_INTERVAL to their respective non-overlapping bit fields.
Actual effect: FILT=379 (should be 1), SEN=0 (should be 379).
The filter interval runs 379x too long and the sensor sampling
interval is uninitialized, causing incorrect thermal monitoring timing.
Fix by replacing the second FIELD_PREP's mask from FILT_INTERVAL to
SEN_INTERVAL.
Fixes: 42de37f40e1b ("thermal/drivers: Add support for Airoha EN7581 thermal sensor")
Signed-off-by: Wayen <win847@gmail.com>
---
drivers/thermal/airoha_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/airoha_thermal.c b/drivers/thermal/airoha_thermal.c
index b9fd6bfc88..e8a33234e0 100644
--- a/drivers/thermal/airoha_thermal.c
+++ b/drivers/thermal/airoha_thermal.c
@@ -403,7 +403,7 @@ static void airoha_thermal_setup_monitor(struct airoha_thermal_priv *priv)
* sen interval is 379 * 52.715us = 19.97ms
*/
writel(FIELD_PREP(EN7581_FILT_INTERVAL, 1) |
- FIELD_PREP(EN7581_FILT_INTERVAL, 379),
+ FIELD_PREP(EN7581_SEN_INTERVAL, 379),
priv->base + EN7581_TEMPMONCTL2);
/* AHB poll is set to 146 * 68.64 = 10.02us */
--
2.51.0
^ permalink raw reply related
* [PATCH] thermal/drivers/airoha: Fix low trip clamp using wrong variable
From: Wayen.Yan @ 2026-06-14 0:14 UTC (permalink / raw)
To: linux-pm
Cc: Rafael J. Wysocki, Daniel Lezcano, Zhang Rui, Lukasz Luba,
Christian Marangi, Lorenzo Bianconi, linux-kernel, linux-mediatek
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1399 bytes --]
In airoha_thermal_set_trips(), the low trip validation incorrectly
clamps 'high' instead of 'low':
low = clamp_t(int, high, RAW_TO_TEMP(priv, 0), ...);
This causes TEMPOFFSETL to receive the clamped high-temperature value
instead of the requested low-temperature value, making the low-temperature
alert threshold identical to the high-temperature threshold. As a result,
low-temperature interrupts can never fire independently.
Fix by replacing 'high' with 'low' in the clamp expression, matching
the symmetric pattern used for the high trip on line 264.
Fixes: 42de37f40e1b ("thermal/drivers: Add support for Airoha EN7581 thermal sensor")
Signed-off-by: Wayen <win847@gmail.com>
---
drivers/thermal/airoha_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/airoha_thermal.c b/drivers/thermal/airoha_thermal.c
index b9fd6bfc88..439aa011b7 100644
--- a/drivers/thermal/airoha_thermal.c
+++ b/drivers/thermal/airoha_thermal.c
@@ -273,7 +273,7 @@ static int airoha_thermal_set_trips(struct thermal_zone_device *tz, int low,
if (low != -INT_MAX) {
/* Validate low and clamp it to a supported value */
- low = clamp_t(int, high, RAW_TO_TEMP(priv, 0),
+ low = clamp_t(int, low, RAW_TO_TEMP(priv, 0),
RAW_TO_TEMP(priv, FIELD_MAX(EN7581_DOUT_TADC_MASK)));
/* We offset the low temp of 1°C to trigger correct event */
--
2.51.0
^ permalink raw reply related
* [PATCH] net: airoha: Fix MODULE_LICENSE to match SPDX GPL-2.0-only identifier
From: Wayen.Yan @ 2026-06-13 23:52 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek
Both airoha_eth.c and airoha_npu.c declare SPDX-License-Identifier:
GPL-2.0-only but use MODULE_LICENSE("GPL"), which the kernel module
loader interprets as GPL-2.0+ (any GPL version). This mismatch causes
license compliance tools (FOSSology, ScanCode, etc.) to misidentify
the effective license as more permissive than intended.
Replace MODULE_LICENSE("GPL") with MODULE_LICENSE("GPL v2") to
align with the GPL-2.0-only SPDX identifier. Per include/linux/module.h,
"GPL v2" maps to GPL-2.0-only, matching the source files' declared
license.
Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC")
Signed-off-by: Wayen <win847@gmail.com>
---
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
drivers/net/ethernet/airoha/airoha_npu.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index 31cdb11cd7..960727957e 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -3333,6 +3333,6 @@ static struct platform_driver airoha_driver = {
};
module_platform_driver(airoha_driver);
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
MODULE_DESCRIPTION("Ethernet driver for Airoha SoC");
diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
index 17dbdc8325..870d61fdd9 100644
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -826,6 +826,6 @@ MODULE_FIRMWARE(NPU_EN7581_7996_FIRMWARE_DATA);
MODULE_FIRMWARE(NPU_EN7581_7996_FIRMWARE_RV32);
MODULE_FIRMWARE(NPU_AN7583_FIRMWARE_DATA);
MODULE_FIRMWARE(NPU_AN7583_FIRMWARE_RV32);
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
MODULE_DESCRIPTION("Airoha Network Processor Unit driver");
--
2.51.0
^ permalink raw reply related
* [PATCH] net: airoha: Remove dead MT7996 NPU firmware declarations
From: Wayen.Yan @ 2026-06-13 23:40 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek
Remove the NPU_EN7581_7996_FIRMWARE_DATA/RV32 #define macros and
their corresponding MODULE_FIRMWARE() declarations. Neither the
en7581_npu_soc_data nor the an7583_npu_soc_data references these
firmware names, and no firmware loading path in the driver ever
requests them. The only references are the #define lines themselves
and the MODULE_FIRMWARE() declarations below.
Keeping dead MODULE_FIRMWARE entries causes modprobe/udev to attempt
pre-loading non-existent firmware files, generating kernel log noise
and misleading distributors about which firmware files to package.
Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support")
Signed-off-by: Wayen <win847@gmail.com>
---
drivers/net/ethernet/airoha/airoha_npu.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
index 17dbdc8325..93095f3894 100644
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -16,8 +16,6 @@
#define NPU_EN7581_FIRMWARE_DATA "airoha/en7581_npu_data.bin"
#define NPU_EN7581_FIRMWARE_RV32 "airoha/en7581_npu_rv32.bin"
-#define NPU_EN7581_7996_FIRMWARE_DATA "airoha/en7581_MT7996_npu_data.bin"
-#define NPU_EN7581_7996_FIRMWARE_RV32 "airoha/en7581_MT7996_npu_rv32.bin"
#define NPU_AN7583_FIRMWARE_DATA "airoha/an7583_npu_data.bin"
#define NPU_AN7583_FIRMWARE_RV32 "airoha/an7583_npu_rv32.bin"
#define NPU_EN7581_FIRMWARE_RV32_MAX_SIZE 0x200000
@@ -822,8 +820,6 @@ module_platform_driver(airoha_npu_driver);
MODULE_FIRMWARE(NPU_EN7581_FIRMWARE_DATA);
MODULE_FIRMWARE(NPU_EN7581_FIRMWARE_RV32);
-MODULE_FIRMWARE(NPU_EN7581_7996_FIRMWARE_DATA);
-MODULE_FIRMWARE(NPU_EN7581_7996_FIRMWARE_RV32);
MODULE_FIRMWARE(NPU_AN7583_FIRMWARE_DATA);
MODULE_FIRMWARE(NPU_AN7583_FIRMWARE_RV32);
MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related
* [PATCH] net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
From: Wayen.Yan @ 2026-06-13 23:30 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek
In airoha_dev_select_queue(), the expression:
queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES;
implicitly converts to unsigned arithmetic: when skb->priority is 0
(the default for unclassified traffic), (0u - 1u) wraps to UINT_MAX,
and UINT_MAX % 8 = 7, routing default best-effort packets to the
highest-priority QoS queue. This causes QoS inversion where the
majority of traffic on a PON gateway starves actual high-priority
flows (VoIP, gaming, etc.).
Fix by guarding the subtraction: when priority is 0, map to queue 0
(lowest priority), otherwise apply the original (priority - 1) % 8
mapping.
Fixes: 2b288b81560b ("net: airoha: Introduce ndo_select_queue callback")
Signed-off-by: Wayen <win847@gmail.com>
---
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index 31cdb11cd7..d476ef83c3 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -1933,7 +1933,7 @@ static u16 airoha_dev_select_queue(struct net_device *dev, struct sk_buff *skb,
*/
channel = netdev_uses_dsa(dev) ? skb_get_queue_mapping(skb) : port->id;
channel = channel % AIROHA_NUM_QOS_CHANNELS;
- queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES; /* QoS queue */
+ queue = skb->priority ? (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES : 0;
queue = channel * AIROHA_NUM_QOS_QUEUES + queue;
return queue < dev->num_tx_queues ? queue : 0;
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2] net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries
From: patchwork-bot+netdevbpf @ 2026-06-13 23:00 UTC (permalink / raw)
To: Wayen.Yan
Cc: netdev, lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek
In-Reply-To: <6a2be54b.ef98c1b2.3c3224.2ed8@mx.google.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 12 Jun 2026 07:09:56 +0800 you wrote:
> In airoha_ppe_debugfs_foe_show(), the second switch statement falls
> through from PPE_PKT_TYPE_IPV4_HNAPT/DSLITE to PPE_PKT_TYPE_IPV4_ROUTE,
> accessing hwe->ipv4.new_tuple for all three types. However, IPv4 ROUTE
> (3-tuple) entries do not contain a valid new_tuple — this field is only
> meaningful for NATted flows (HNAPT/DSLITE). For ROUTE entries, the
> memory at the new_tuple offset holds routing information, not NAT data,
> so displaying "new=" produces garbage output.
>
> [...]
Here is the summary with links:
- [v2] net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries
https://git.kernel.org/netdev/net/c/1c3a77471afb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH] net: airoha: Fix register index for Tx-fwd counter configuration
From: patchwork-bot+netdevbpf @ 2026-06-13 23:00 UTC (permalink / raw)
To: Wayen.Yan; +Cc: netdev, lorenzo, linux-arm-kernel, linux-mediatek
In-Reply-To: <6a2b40e7.4dd82583.3a5c46.e566@mx.google.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 12 Jun 2026 07:09:13 +0800 you wrote:
> In airoha_qdma_init_qos_stats(), the Tx-fwd counter configuration
> register uses the same index (i << 1) as the Tx-cpu counter, which
> overwrites the Tx-cpu configuration. The Tx-fwd counter value register
> correctly uses (i << 1) + 1, so the configuration register should use
> the same index.
>
> Fix the REG_CNTR_CFG index from (i << 1) to ((i << 1) + 1) so that
> the Tx-fwd counter is properly configured instead of clobbering the
> Tx-cpu counter config.
>
> [...]
Here is the summary with links:
- net: airoha: Fix register index for Tx-fwd counter configuration
https://git.kernel.org/netdev/net/c/1402ecccf563
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH 2/2] wifi: mt76: mt7927: use real monitor vifs for dual-band monitors
From: Sean Wang @ 2026-06-13 22:51 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613225144.2414283-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
MT7927 needs monitor interfaces to be passed to the driver as real vifs
so each monitor interface can be configured with its own band context.
This is required to support concurrent 2 GHz and 5 GHz monitor operation
on the same hw.
Keep the existing virtual monitor behavior for older chips.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index b50825eccdaf..16afc90b7422 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -724,7 +724,10 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)
ieee80211_hw_set(hw, HAS_RATE_CONTROL);
ieee80211_hw_set(hw, SUPPORTS_TX_ENCAP_OFFLOAD);
ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);
- ieee80211_hw_set(hw, WANT_MONITOR_VIF);
+ if (is_mt7927(&dev->mt76))
+ ieee80211_hw_set(hw, NO_VIRTUAL_MONITOR);
+ else
+ ieee80211_hw_set(hw, WANT_MONITOR_VIF);
ieee80211_hw_set(hw, SUPPORTS_PS);
ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
--
2.43.0
^ permalink raw reply related
* [PATCH 1/2] wifi: mt76: mt7927: set band index for sniffer mode
From: Sean Wang @ 2026-06-13 22:51 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
From: Sean Wang <sean.wang@mediatek.com>
Use the active channel context to select the SNIFFER command band index on
MT7927, and fall back to the PHY chandef when no channel context is
available.
Also pass the same band index to the sniffer channel configuration. This
keeps monitor setup on the correct band, especially when multiple PHY band
contexts are present.
Fixes: 35a5dcc71735 ("wifi: mt76: mt7925: add MT7927 PCIe support")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index e94fa544ff20..17bc7204f02a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2174,6 +2174,8 @@ int mt7925_get_txpwr_info(struct mt792x_dev *dev, u8 band_idx, struct mt7925_txp
int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
bool enable)
{
+ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ struct ieee80211_chanctx_conf *ctx = mvif->bss_conf.mt76.ctx;
struct {
struct {
u8 band_idx;
@@ -2196,6 +2198,15 @@ int mt7925_mcu_set_sniffer(struct mt792x_dev *dev, struct ieee80211_vif *vif,
},
};
+ if (is_mt7927(&dev->mt76)) {
+ struct ieee80211_channel *chan;
+
+ chan = ctx ? ctx->def.chan : mvif->phy->mt76->chandef.chan;
+
+ if (chan)
+ req.hdr.band_idx = mt7927_band_idx(chan->band);
+ }
+
return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(SNIFFER), &req, sizeof(req),
true);
}
@@ -2255,6 +2266,9 @@ int mt7925_mcu_config_sniffer(struct mt792x_vif *vif,
},
};
+ if (is_mt7927(mphy->dev))
+ req.hdr.band_idx = mt7927_band_idx(chandef->chan->band);
+
if (chandef->chan->band < ARRAY_SIZE(ch_band))
req.tlv.ch_band = ch_band[chandef->chan->band];
if (chandef->width < ARRAY_SIZE(ch_width))
--
2.43.0
^ permalink raw reply related
* [PATCH 5/5] wifi: mt76: mt7927u: enable USB RX aggregation
From: Sean Wang @ 2026-06-13 22:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224655.2405686-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Enable USB RX aggregation on MT7927u with vendor driver parameters for
alignment, padding and buffer size. According to the vendor driver, the
hardware should run RX aggregation with USB SG disabled.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 6 +++++-
drivers/net/wireless/mediatek/mt76/usb.c | 11 +++++++++++
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
index a0bfe6f09ae4..42d13bc6ebbc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -5,7 +5,6 @@
#include <linux/module.h>
#include <linux/sizes.h>
#include <linux/usb.h>
-
#include "mt7925.h"
#include "mcu.h"
#include "mac.h"
@@ -235,6 +234,11 @@ static int mt7925u_probe(struct usb_interface *usb_intf,
mdev->rev = (0x7927 << 16) | (mdev->rev & 0xff);
}
+ if (is_mt7927(mdev))
+ mt76u_enable_rx_aggr(mdev, MT7927_USB_RX_AGGR_ALIGN,
+ MT7927_USB_RX_AGGR_PADDING,
+ MT7927_USB_RX_AGGR_BUF_SIZE);
+
if (mt76_get_field(dev, MT_CONN_ON_MISC, MT_TOP_MISC2_FW_N9_RDY)) {
ret = mt792xu_wfsys_reset(dev);
if (ret)
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index 10ad2b024985..f0df510904c5 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -1300,6 +1300,17 @@ static const struct mt76_queue_ops usb_queue_ops = {
.kick = mt76u_tx_kick,
};
+void mt76u_enable_rx_aggr(struct mt76_dev *dev, int align, int padding,
+ int buf_size)
+{
+ dev->usb.sg_en = false;
+ dev->usb.rx_aggr.enable = true;
+ dev->usb.rx_aggr.align = align;
+ dev->usb.rx_aggr.padding = padding;
+ dev->usb.rx_aggr.buf_size = buf_size;
+}
+EXPORT_SYMBOL_GPL(mt76u_enable_rx_aggr);
+
int __mt76u_init(struct mt76_dev *dev, struct usb_interface *intf,
struct mt76_bus_ops *ops)
{
--
2.43.0
^ permalink raw reply related
* [PATCH 4/5] wifi: mt76: usb: add debugfs aggregation stats
From: Sean Wang @ 2026-06-13 22:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224655.2405686-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Add USB debugfs counters for RX/TX URBs, packets, bytes and recent RX
aggregation frame counts.
These stats make it easier to verify whether USB RX aggregation are working
as expected, and to debug throughput issues without adding
temporary driver logs.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/debugfs.c | 35 ++++++++++++++++++
drivers/net/wireless/mediatek/mt76/mt76.h | 12 ++++++
drivers/net/wireless/mediatek/mt76/usb.c | 39 ++++++++++++++++++++
3 files changed, 86 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/debugfs.c b/drivers/net/wireless/mediatek/mt76/debugfs.c
index a5ac6ca86735..b3f1bc3cd69b 100644
--- a/drivers/net/wireless/mediatek/mt76/debugfs.c
+++ b/drivers/net/wireless/mediatek/mt76/debugfs.c
@@ -88,6 +88,38 @@ static int mt76_rx_queues_read(struct seq_file *s, void *data)
return 0;
}
+static int mt76_usb_stats_read(struct seq_file *s, void *data)
+{
+ struct mt76_dev *dev = dev_get_drvdata(s->private);
+ struct mt76_usb *usb = &dev->usb;
+ u64 seq;
+ int i, n;
+
+ seq_printf(s, "rx_aggr\t%d\n", usb->rx_aggr.enable);
+ seq_printf(s, "sg_en\t%d\n", usb->sg_en);
+ seq_printf(s, "tx_urbs\t%lld\n", atomic64_read(&usb->stats.tx_urbs));
+ seq_printf(s, "tx_packets\t%lld\n",
+ atomic64_read(&usb->stats.tx_packets));
+ seq_printf(s, "tx_bytes\t%lld\n", atomic64_read(&usb->stats.tx_bytes));
+ seq_printf(s, "rx_urbs\t%lld\n", atomic64_read(&usb->stats.rx_urbs));
+ seq_printf(s, "rx_packets\t%lld\n",
+ atomic64_read(&usb->stats.rx_packets));
+ seq_printf(s, "rx_bytes\t%lld\n", atomic64_read(&usb->stats.rx_bytes));
+
+ seq = atomic64_read(&usb->stats.rx_aggr_seq);
+ seq_puts(s, "rx_aggr_nframes");
+ n = min_t(u64, seq, MT_USB_AGGR_STATS_LEN);
+ for (i = 0; i < n; i++) {
+ u64 idx = seq - n + i;
+ u64 slot = idx % MT_USB_AGGR_STATS_LEN;
+
+ seq_printf(s, " %u", READ_ONCE(usb->stats.rx_aggr_nframes[slot]));
+ }
+ seq_puts(s, "\n");
+
+ return 0;
+}
+
void mt76_seq_puts_array(struct seq_file *file, const char *str,
s8 *val, int len)
{
@@ -120,6 +152,9 @@ mt76_register_debugfs_fops(struct mt76_phy *phy,
debugfs_create_blob("otp", 0400, dir, &dev->otp);
debugfs_create_devm_seqfile(dev->dev, "rx-queues", dir,
mt76_rx_queues_read);
+ if (mt76_is_usb(dev))
+ debugfs_create_devm_seqfile(dev->dev, "usb-stats", dir,
+ mt76_usb_stats_read);
return dir;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 125c97dc1f28..c11a463ae092 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -664,6 +664,7 @@ struct mt76u_rx_entry {
#define MT_RX_SG_MAX_SIZE 4
#define MT_NUM_TX_ENTRIES 256
#define MT_NUM_RX_ENTRIES 128
+#define MT_USB_AGGR_STATS_LEN 128
#define MCU_RESP_URB_SIZE 1024
struct mt76_usb {
struct mutex usb_ctrl_mtx;
@@ -687,6 +688,17 @@ struct mt76_usb {
int buf_size;
} rx_aggr;
+ struct {
+ atomic64_t tx_urbs;
+ atomic64_t tx_packets;
+ atomic64_t tx_bytes;
+ atomic64_t rx_urbs;
+ atomic64_t rx_packets;
+ atomic64_t rx_bytes;
+ atomic64_t rx_aggr_seq;
+ u8 rx_aggr_nframes[MT_USB_AGGR_STATS_LEN];
+ } stats;
+
struct mt76u_mcu {
u8 *data;
/* multiple reads */
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index cbdd663fbb25..10ad2b024985 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -15,6 +15,36 @@ static bool disable_usb_sg;
module_param_named(disable_usb_sg, disable_usb_sg, bool, 0644);
MODULE_PARM_DESC(disable_usb_sg, "Disable usb scatter-gather support");
+static void mt76u_tx_stats_add(struct mt76_dev *dev, struct urb *urb,
+ unsigned int packets)
+{
+ atomic64_inc(&dev->usb.stats.tx_urbs);
+ atomic64_add(packets, &dev->usb.stats.tx_packets);
+ atomic64_add(urb->transfer_buffer_length, &dev->usb.stats.tx_bytes);
+}
+
+static void mt76u_rx_urb_stats_add(struct mt76_dev *dev, struct urb *urb)
+{
+ atomic64_inc(&dev->usb.stats.rx_urbs);
+ atomic64_add(urb->actual_length, &dev->usb.stats.rx_bytes);
+}
+
+static void mt76u_rx_packet_stats_add(struct mt76_dev *dev,
+ unsigned int packets)
+{
+ atomic64_add(packets, &dev->usb.stats.rx_packets);
+}
+
+static void mt76u_rx_aggr_stats_add(struct mt76_dev *dev, unsigned int packets)
+{
+ u64 idx, slot;
+
+ idx = atomic64_inc_return(&dev->usb.stats.rx_aggr_seq) - 1;
+ slot = idx % MT_USB_AGGR_STATS_LEN;
+ WRITE_ONCE(dev->usb.stats.rx_aggr_nframes[slot],
+ min_t(unsigned int, packets, U8_MAX));
+}
+
int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type,
u16 val, u16 offset, void *buf, size_t len)
{
@@ -634,6 +664,10 @@ static int mt76u_process_rx_agg_entry(struct mt76_dev *dev, struct urb *urb)
mt76_put_page_pool_buf(urb->transfer_buffer, false);
urb->transfer_buffer = NULL;
+ if (nframes)
+ mt76u_rx_packet_stats_add(dev, nframes);
+ mt76u_rx_aggr_stats_add(dev, nframes);
+
return max(nframes, 1);
}
@@ -681,6 +715,7 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
skb_mark_for_recycle(skb);
dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
+ mt76u_rx_packet_stats_add(dev, 1);
return nsgs;
}
@@ -714,6 +749,9 @@ static void mt76u_complete_rx(struct urb *urb)
break;
}
+ if (!urb->status)
+ mt76u_rx_urb_stats_add(dev, urb);
+
spin_lock_irqsave(&q->lock, flags);
idx = e - q->entry;
pending = q->ndesc - q->queued;
@@ -1083,6 +1121,7 @@ static void mt76u_tx_kick(struct mt76_dev *dev, struct mt76_queue *q)
err);
break;
}
+ mt76u_tx_stats_add(dev, urb, 1);
q->first = (q->first + 1) % q->ndesc;
}
}
--
2.43.0
^ permalink raw reply related
* [PATCH 3/5] wifi: mt76: usb: add optional RX aggregation support
From: Sean Wang @ 2026-06-13 22:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224655.2405686-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Add common USB RX aggregation support and let drivers opt in by programming
the UDMA RX aggregation limit and timeout.
RX aggregation allows the device to pack multiple RX packets into one USB
transfer, reducing URB completion rate, USB interrupt/IO overhead, and host
RX scheduling pressure. This is especially useful at high throughput, where
per-packet USB RX handling can become a CPU bottleneck.
Keep it disabled by default so existing USB drivers keep the current RX
behavior unless they explicitly enable aggregation.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt76.h | 21 ++-
.../net/wireless/mediatek/mt76/mt7925/usb.c | 12 ++
.../net/wireless/mediatek/mt76/mt792x_usb.c | 23 +++-
drivers/net/wireless/mediatek/mt76/usb.c | 124 +++++++++++++++++-
4 files changed, 169 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 81740aa7df71..125c97dc1f28 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -680,6 +680,13 @@ struct mt76_usb {
void (*ctrl_timeout)(struct mt76_dev *dev, int err);
bool sg_en;
+ struct {
+ bool enable;
+ int align;
+ int padding;
+ int buf_size;
+ } rx_aggr;
+
struct mt76u_mcu {
u8 *data;
/* multiple reads */
@@ -1857,6 +1864,17 @@ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
return usb_bulk_msg(udev, pipe, data, len, actual_len, timeout);
}
+static inline int
+mt76u_rx_aggr_buf_size(int max_mpdu, int aggr_limit, int aggr_pkt_limit,
+ int padding)
+{
+ int aggr_size;
+
+ aggr_size = min(aggr_limit, aggr_pkt_limit * (max_mpdu + padding));
+
+ return PAGE_ALIGN(max_mpdu + aggr_size);
+}
+
void mt76_ethtool_page_pool_stats(struct mt76_dev *dev, u64 *data, int *index);
void mt76_ethtool_worker(struct mt76_ethtool_worker_info *wi,
struct mt76_sta_stats *stats, bool eht);
@@ -1882,7 +1900,8 @@ void mt76u_stop_tx(struct mt76_dev *dev);
void mt76u_stop_rx(struct mt76_dev *dev);
int mt76u_resume_rx(struct mt76_dev *dev);
void mt76u_queues_deinit(struct mt76_dev *dev);
-
+void mt76u_enable_rx_aggr(struct mt76_dev *dev, int align, int padding,
+ int buf_size);
int mt76s_init(struct mt76_dev *dev, struct sdio_func *func,
const struct mt76_bus_ops *bus_ops);
int mt76s_alloc_rx_queue(struct mt76_dev *dev, enum mt76_rxq_id qid);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
index 49ad4fe9eb1b..a0bfe6f09ae4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -3,12 +3,24 @@
#include <linux/kernel.h>
#include <linux/module.h>
+#include <linux/sizes.h>
#include <linux/usb.h>
#include "mt7925.h"
#include "mcu.h"
#include "mac.h"
+#define MT7927_USB_RX_AGGR_ALIGN 16
+#define MT7927_USB_RX_AGGR_PADDING 12
+#define MT7927_USB_RX_AGGR_LIMIT SZ_32K
+#define MT7927_USB_RX_AGGR_PKT_LIMIT 30
+#define MT7927_USB_RX_MAX_MPDU (13 * SZ_1K)
+#define MT7927_USB_RX_AGGR_BUF_SIZE \
+ mt76u_rx_aggr_buf_size(MT7927_USB_RX_MAX_MPDU, \
+ MT7927_USB_RX_AGGR_LIMIT, \
+ MT7927_USB_RX_AGGR_PKT_LIMIT, \
+ MT7927_USB_RX_AGGR_PADDING)
+
static const struct usb_device_id mt7925u_device_table[] = {
{ USB_DEVICE_AND_INTERFACE_INFO(0x0e8d, 0x6639, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)MT7925_FIRMWARE_WM },
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
index 6280bc4bf78d..769e828e9449 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
@@ -13,6 +13,9 @@
#define MT792X_USB_TX_TIMEOUT_LIMIT 50000
#define MT792X_USB_UDMA_IDLE_TIMEOUT 1000
+#define MT792X_USB_RX_AGG_LIMIT 32
+#define MT792X_USB_RX_AGG_TIMEOUT 100
+#define MT792X_USB_RX_AGG_PKT_LIMIT 30
static int mt792xu_read32(struct mt76_dev *dev, u32 addr, void *buf)
{
@@ -403,9 +406,23 @@ int mt792xu_dma_init(struct mt792x_dev *dev, bool resume)
FIELD_PREP(MT_WL_TX_TMOUT_LMT,
MT792X_USB_TX_TIMEOUT_LIMIT));
mt76_set(dev, MT_UDMA_WLCFG_0, MT_WL_TX_TMOUT_FUNC_EN);
- mt76_clear(dev, MT_UDMA_WLCFG_0,
- MT_WL_RX_AGG_TO | MT_WL_RX_AGG_LMT);
- mt76_clear(dev, MT_UDMA_WLCFG_1, MT_WL_RX_AGG_PKT_LMT);
+
+ if (dev->mt76.usb.rx_aggr.enable) {
+ mt76_set(dev, MT_UDMA_WLCFG_0, MT_WL_RX_AGG_EN);
+ mt76_rmw(dev, MT_UDMA_WLCFG_0,
+ MT_WL_RX_AGG_TO | MT_WL_RX_AGG_LMT,
+ FIELD_PREP(MT_WL_RX_AGG_TO,
+ MT792X_USB_RX_AGG_TIMEOUT) |
+ FIELD_PREP(MT_WL_RX_AGG_LMT,
+ MT792X_USB_RX_AGG_LIMIT));
+ mt76_rmw(dev, MT_UDMA_WLCFG_1, MT_WL_RX_AGG_PKT_LMT,
+ FIELD_PREP(MT_WL_RX_AGG_PKT_LMT,
+ MT792X_USB_RX_AGG_PKT_LIMIT));
+ } else {
+ mt76_clear(dev, MT_UDMA_WLCFG_0, MT_WL_RX_AGG_EN |
+ MT_WL_RX_AGG_TO | MT_WL_RX_AGG_LMT);
+ mt76_clear(dev, MT_UDMA_WLCFG_1, MT_WL_RX_AGG_PKT_LMT);
+ }
if (resume)
return 0;
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index cab36630c978..cbdd663fbb25 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -371,6 +371,14 @@ mt76u_refill_rx(struct mt76_dev *dev, struct mt76_queue *q,
return mt76u_fill_rx_sg(dev, q, urb, nsgs);
urb->transfer_buffer_length = q->buf_size;
+ if (qid == MT_RXQ_MAIN && dev->usb.rx_aggr.enable) {
+ if (!urb->transfer_buffer)
+ urb->transfer_buffer =
+ mt76_get_page_pool_buf(q, &offset, q->buf_size);
+
+ return urb->transfer_buffer ? 0 : -ENOMEM;
+ }
+
urb->transfer_buffer = mt76_get_page_pool_buf(q, &offset, q->buf_size);
return urb->transfer_buffer ? 0 : -ENOMEM;
@@ -538,18 +546,113 @@ mt76u_build_rx_skb(struct mt76_dev *dev, void *data,
return skb;
}
+static struct sk_buff *
+mt76u_build_rx_skb_aggr(struct mt76_dev *dev, void *data, int data_len,
+ int buf_len)
+{
+ int head_room, drv_flags = dev->drv->drv_flags;
+ int len = min_t(int, data_len, MT_SKB_HEAD_LEN);
+ struct sk_buff *skb;
+
+ if (data_len <= 0)
+ return NULL;
+
+ head_room = drv_flags & MT_DRV_RX_DMA_HDR ? 0 : MT_DMA_HDR_LEN;
+ skb = alloc_skb(len, GFP_ATOMIC);
+ if (!skb)
+ return NULL;
+
+ data += head_room;
+ skb_put_data(skb, data, len);
+ if (data_len > len) {
+ struct page *page;
+
+ data += len;
+ page = virt_to_head_page(data);
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ page, data - page_address(page),
+ data_len - len, buf_len);
+ get_page(page);
+ }
+
+ return skb;
+}
+
+static int mt76u_process_rx_agg_entry(struct mt76_dev *dev, struct urb *urb)
+{
+ int offset = 0, head_room, drv_flags = dev->drv->drv_flags;
+ int align = dev->usb.rx_aggr.align ?: 4;
+ int padding = dev->usb.rx_aggr.padding ?: 4;
+ u8 *data = urb->transfer_buffer;
+ int min_len;
+ int nframes = 0;
+
+ if (!test_bit(MT76_STATE_INITIALIZED, &dev->phy.state) ||
+ test_bit(MT76_REMOVED, &dev->phy.state))
+ return 0;
+
+ head_room = drv_flags & MT_DRV_RX_DMA_HDR ? 0 : MT_DMA_HDR_LEN;
+ min_len = head_room + MT_RX_RXWI_LEN;
+
+ while (urb->actual_length - offset >= min_len) {
+ struct sk_buff *skb;
+ int len, frame_len, agg_len;
+
+ len = mt76u_get_rx_entry_len(dev, data + offset,
+ urb->actual_length - offset);
+ if (len < 0) {
+ dev_warn_ratelimited(dev->dev,
+ "invalid USB RX aggregate at offset %d\n",
+ offset);
+ break;
+ }
+
+ frame_len = head_room + len;
+ if (frame_len > urb->actual_length - offset) {
+ dev_warn_ratelimited(dev->dev,
+ "truncated USB RX aggregate at offset %d\n",
+ offset);
+ break;
+ }
+
+ agg_len = ALIGN(frame_len, align) + padding;
+ if (dev->drv->rx_check &&
+ !dev->drv->rx_check(dev, data + offset + head_room, len))
+ goto next;
+
+ skb = mt76u_build_rx_skb_aggr(dev, data + offset, len,
+ agg_len);
+ if (skb) {
+ dev->drv->rx_skb(dev, MT_RXQ_MAIN, skb, NULL);
+ nframes++;
+ }
+
+next:
+ offset += agg_len;
+ }
+
+ mt76_put_page_pool_buf(urb->transfer_buffer, false);
+ urb->transfer_buffer = NULL;
+
+ return max(nframes, 1);
+}
+
static int
mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
- int buf_size)
+ enum mt76_rxq_id qid, int buf_size)
{
u8 *data = urb->num_sgs ? sg_virt(&urb->sg[0]) : urb->transfer_buffer;
int data_len = urb->num_sgs ? urb->sg[0].length : urb->actual_length;
int len, nsgs = 1, head_room, drv_flags = dev->drv->drv_flags;
struct sk_buff *skb;
- if (!test_bit(MT76_STATE_INITIALIZED, &dev->phy.state))
+ if (!test_bit(MT76_STATE_INITIALIZED, &dev->phy.state) ||
+ test_bit(MT76_REMOVED, &dev->phy.state))
return 0;
+ if (qid == MT_RXQ_MAIN && dev->usb.rx_aggr.enable && !urb->num_sgs)
+ return mt76u_process_rx_agg_entry(dev, urb);
+
len = mt76u_get_rx_entry_len(dev, data, urb->actual_length);
if (len < 0)
return 0;
@@ -594,6 +697,9 @@ static void mt76u_complete_rx(struct urb *urb)
trace_rx_urb(dev, urb);
+ if (test_bit(MT76_REMOVED, &dev->phy.state))
+ return;
+
switch (urb->status) {
case -ECONNRESET:
case -ESHUTDOWN:
@@ -658,12 +764,14 @@ mt76u_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
if (!urb)
break;
- count = mt76u_process_rx_entry(dev, urb, q->buf_size);
+ count = mt76u_process_rx_entry(dev, urb, qid, q->buf_size);
if (count > 0) {
err = mt76u_refill_rx(dev, q, urb, count);
if (err < 0)
break;
}
+ if (test_bit(MT76_REMOVED, &dev->phy.state))
+ break;
mt76u_submit_rx_buf(dev, qid, urb);
}
}
@@ -729,10 +837,6 @@ mt76u_alloc_rx_queue(struct mt76_dev *dev, enum mt76_rxq_id qid)
struct mt76_queue *q = &dev->q_rx[qid];
int i, err;
- err = mt76_create_page_pool(dev, q);
- if (err)
- return err;
-
spin_lock_init(&q->lock);
q->entry = devm_kcalloc(dev->dev,
MT_NUM_RX_ENTRIES, sizeof(*q->entry),
@@ -742,6 +846,12 @@ mt76u_alloc_rx_queue(struct mt76_dev *dev, enum mt76_rxq_id qid)
q->ndesc = MT_NUM_RX_ENTRIES;
q->buf_size = PAGE_SIZE;
+ if (qid == MT_RXQ_MAIN && dev->usb.rx_aggr.enable)
+ q->buf_size = dev->usb.rx_aggr.buf_size ?: PAGE_SIZE;
+
+ err = mt76_create_page_pool(dev, q);
+ if (err)
+ return err;
for (i = 0; i < q->ndesc; i++) {
err = mt76u_rx_urb_alloc(dev, q, &q->entry[i]);
--
2.43.0
^ permalink raw reply related
* [PATCH 1/5] wifi: mt76: usb: size RX page-pool pages from queue buffer
From: Sean Wang @ 2026-06-13 22:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224655.2405686-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Use the RX queue buffer size to select the page-pool allocation order.
This lets USB devices use larger RX buffers without silently allocating
undersized order-0 pages.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 13c4e8abe281..6ff1eada6d09 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -628,6 +628,9 @@ int mt76_create_page_pool(struct mt76_dev *dev, struct mt76_queue *q)
if (!is_qrx && !mt76_queue_is_wed_tx_free(q))
return 0;
+ if (q->buf_size > PAGE_SIZE)
+ pp_params.order = get_order(q->buf_size);
+
switch (idx) {
case MT_RXQ_MAIN:
case MT_RXQ_BAND1:
--
2.43.0
^ permalink raw reply related
* [PATCH 2/5] wifi: mt76: usb: support out-of-order RX URB completion
From: Sean Wang @ 2026-06-13 22:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224655.2405686-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Keep per-URB RX queue context and complete entries by their real queue
position instead of assuming the completed URB is always at q->head.
USB RX URBs can complete out of order, and advancing q->head too early
can corrupt RX queue accounting and process buffers in the wrong order.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt76.h | 5 ++
drivers/net/wireless/mediatek/mt76/usb.c | 77 ++++++++++++++++-------
2 files changed, 61 insertions(+), 21 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 122e77a5f2f4..81740aa7df71 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -655,6 +655,11 @@ struct mt76_mcu {
wait_queue_head_t wait;
};
+struct mt76u_rx_entry {
+ struct mt76_queue_entry *e;
+ struct mt76_queue *q;
+};
+
#define MT_TX_SG_MAX_SIZE 8
#define MT_RX_SG_MAX_SIZE 4
#define MT_NUM_TX_ENTRIES 256
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index ce68e1d0c786..cab36630c978 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -397,11 +397,25 @@ mt76u_urb_alloc(struct mt76_dev *dev, struct mt76_queue_entry *e,
return 0;
}
+static void mt76u_urb_free(struct urb *urb)
+{
+ int i;
+
+ for (i = 0; i < urb->num_sgs; i++)
+ mt76_put_page_pool_buf(sg_virt(&urb->sg[i]), false);
+
+ if (urb->transfer_buffer)
+ mt76_put_page_pool_buf(urb->transfer_buffer, false);
+
+ usb_free_urb(urb);
+}
+
static int
mt76u_rx_urb_alloc(struct mt76_dev *dev, struct mt76_queue *q,
struct mt76_queue_entry *e)
{
enum mt76_rxq_id qid = q - &dev->q_rx[MT_RXQ_MAIN];
+ struct mt76u_rx_entry *rxe;
int err, sg_size;
sg_size = qid == MT_RXQ_MAIN ? MT_RX_SG_MAX_SIZE : 0;
@@ -409,20 +423,25 @@ mt76u_rx_urb_alloc(struct mt76_dev *dev, struct mt76_queue *q,
if (err)
return err;
- return mt76u_refill_rx(dev, q, e->urb, sg_size);
-}
-
-static void mt76u_urb_free(struct urb *urb)
-{
- int i;
+ rxe = kzalloc_obj(*rxe, GFP_KERNEL);
+ if (!rxe) {
+ usb_free_urb(e->urb);
+ e->urb = NULL;
+ return -ENOMEM;
+ }
- for (i = 0; i < urb->num_sgs; i++)
- mt76_put_page_pool_buf(sg_virt(&urb->sg[i]), false);
+ rxe->e = e;
+ rxe->q = q;
+ e->urb->context = rxe;
- if (urb->transfer_buffer)
- mt76_put_page_pool_buf(urb->transfer_buffer, false);
+ err = mt76u_refill_rx(dev, q, e->urb, sg_size);
+ if (err) {
+ kfree(rxe);
+ mt76u_urb_free(e->urb);
+ e->urb = NULL;
+ }
- usb_free_urb(urb);
+ return err;
}
static void
@@ -566,8 +585,12 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb,
static void mt76u_complete_rx(struct urb *urb)
{
struct mt76_dev *dev = dev_get_drvdata(&urb->dev->dev);
- struct mt76_queue *q = urb->context;
+ struct mt76u_rx_entry *rxe = urb->context;
+ struct mt76_queue_entry *e = rxe->e;
+ unsigned int idx, pending, pos;
+ struct mt76_queue *q = rxe->q;
unsigned long flags;
+ bool wake = false;
trace_rx_urb(dev, urb);
@@ -586,18 +609,28 @@ static void mt76u_complete_rx(struct urb *urb)
}
spin_lock_irqsave(&q->lock, flags);
- if (WARN_ONCE(q->entry[q->head].urb != urb, "rx urb mismatch"))
+ idx = e - q->entry;
+ pending = q->ndesc - q->queued;
+ pos = (idx + q->ndesc - q->head) % q->ndesc;
+ if (WARN_ONCE(idx >= q->ndesc || pos >= pending, "rx urb mismatch"))
goto out;
- q->head = (q->head + 1) % q->ndesc;
- q->queued++;
-
- if (q == &dev->q_rx[MT_RXQ_MAIN])
- napi_schedule(&dev->napi[MT_RXQ_MAIN]);
- else
- mt76_worker_schedule(&dev->usb.rx_worker);
+ e->done = true;
+ while (q->entry[q->head].done) {
+ q->entry[q->head].done = false;
+ q->head = (q->head + 1) % q->ndesc;
+ q->queued++;
+ wake = true;
+ }
out:
spin_unlock_irqrestore(&q->lock, flags);
+
+ if (wake) {
+ if (q == &dev->q_rx[MT_RXQ_MAIN])
+ napi_schedule(&dev->napi[MT_RXQ_MAIN]);
+ else
+ mt76_worker_schedule(&dev->usb.rx_worker);
+ }
}
static int
@@ -607,7 +640,7 @@ mt76u_submit_rx_buf(struct mt76_dev *dev, enum mt76_rxq_id qid,
int ep = qid == MT_RXQ_MAIN ? MT_EP_IN_PKT_RX : MT_EP_IN_CMD_RESP;
mt76u_fill_bulk_urb(dev, USB_DIR_IN, ep, urb,
- mt76u_complete_rx, &dev->q_rx[qid]);
+ mt76u_complete_rx, urb->context);
trace_submit_urb(dev, urb);
return usb_submit_urb(urb, GFP_ATOMIC);
@@ -678,6 +711,7 @@ mt76u_submit_rx_buffers(struct mt76_dev *dev, enum mt76_rxq_id qid)
spin_lock_irqsave(&q->lock, flags);
for (i = 0; i < q->ndesc; i++) {
+ q->entry[i].done = false;
err = mt76u_submit_rx_buf(dev, qid, q->entry[i].urb);
if (err < 0)
break;
@@ -733,6 +767,7 @@ mt76u_free_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)
if (!q->entry[i].urb)
continue;
+ kfree(q->entry[i].urb->context);
mt76u_urb_free(q->entry[i].urb);
q->entry[i].urb = NULL;
}
--
2.43.0
^ permalink raw reply related
* [PATCH 0/5] wifi: mt76: add USB RX aggregation support
From: Sean Wang @ 2026-06-13 22:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
This series adds optional USB RX aggregation support to mt76 and enables
it on mt7927u.
RX aggregation allows multiple RX frames to be received from one USB URB,
reducing USB completion overhead and improving RX efficiency for
high-throughput RX traffic and monitor capture.
The common USB support remains opt-in, so existing USB drivers keep the
current behavior unless they explicitly enable RX aggregation. The same
settings work for both mt7927u and mt7925u, but this series enables the
feature only on mt7927u for now.
This series does the following:
- size RX page-pool pages from the queue buffer size
- support out-of-order RX URB completion
- add optional USB RX aggregation parsing
- add debugfs stats to verify aggregation behavior
- enable USB RX aggregation on mt7927u
The series is based on wireless-next commit:
21352612198c ("b43: add RF power offset for N-PHY r8 + radio 2057 r8")
It also cherry-picks the following patch from patchwork as a dependency:
wifi: mt76: mt76u: use a threaded NAPI for the RX path
Link: https://lore.kernel.org/all/20260609105301.196302-1-phial@phiality.com/
Sean Wang (5):
wifi: mt76: usb: size RX page-pool pages from queue buffer
wifi: mt76: usb: support out-of-order RX URB completion
wifi: mt76: usb: add optional RX aggregation support
wifi: mt76: usb: add debugfs aggregation stats
wifi: mt76: mt7927u: enable USB RX aggregation
drivers/net/wireless/mediatek/mt76/debugfs.c | 35 +++
drivers/net/wireless/mediatek/mt76/mac80211.c | 3 +
drivers/net/wireless/mediatek/mt76/mt76.h | 38 ++-
.../net/wireless/mediatek/mt76/mt7925/usb.c | 18 +-
.../net/wireless/mediatek/mt76/mt792x_usb.c | 23 +-
drivers/net/wireless/mediatek/mt76/usb.c | 251 ++++++++++++++++--
6 files changed, 335 insertions(+), 33 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH 6/6] wifi: mt76: mt792x: quiesce USB paths on disconnect
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224131.2396026-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
USB disconnect can leave reset/init work, TX worker, and MCU waiters active
while the device is being removed. Stop those paths before unregistering
the device to avoid teardown waiting on firmware or queue activity after
disconnect.
Run WFSYS reset after USB queue deinit so removal does not issue the reset
while USB traffic may still be queued.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
.../net/wireless/mediatek/mt76/mt792x_usb.c | 20 ++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
index c4da1b900d47..e5d2d2f6a388 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
@@ -230,9 +230,9 @@ EXPORT_SYMBOL_GPL(mt792xu_mcu_power_on);
static void mt792xu_cleanup(struct mt792x_dev *dev)
{
clear_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
- mt792xu_wfsys_reset(dev);
skb_queue_purge(&dev->mt76.mcu.res_q);
mt76u_queues_deinit(&dev->mt76);
+ mt792xu_wfsys_reset(dev);
}
static u32 mt792xu_uhw_rr(struct mt76_dev *dev, u32 addr)
@@ -494,13 +494,27 @@ void mt792xu_disconnect(struct usb_interface *usb_intf)
{
struct mt792x_dev *dev = usb_get_intfdata(usb_intf);
- mt792xu_reset_work_cleanup(dev);
+ if (!dev)
+ return;
+
+ set_bit(MT76_RESET, &dev->mphy.state);
+ set_bit(MT76_MCU_RESET, &dev->mphy.state);
+ clear_bit(MT76_STATE_RUNNING, &dev->mphy.state);
+ wake_up(&dev->mt76.mcu.wait);
+ skb_queue_purge(&dev->mt76.mcu.res_q);
+
+ cancel_work_sync(&dev->reset_work);
cancel_work_sync(&dev->init_work);
- if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
+ mt76_worker_disable(&dev->mt76.tx_worker);
+ mt792xu_reset_work_cleanup(dev);
+ if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state)) {
+ set_bit(MT76_REMOVED, &dev->mphy.state);
return;
+ }
mt76_unregister_device(&dev->mt76);
mt792xu_cleanup(dev);
+ set_bit(MT76_REMOVED, &dev->mphy.state);
usb_set_intfdata(usb_intf, NULL);
--
2.43.0
^ permalink raw reply related
* [PATCH 5/6] wifi: mt76: mt792x: enable USB UDMA TX timeout
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224131.2396026-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Configure the USB UDMA TX timeout limit and enable timeout detection
during DMA initialization, matching the vendor driver setup. Use a
longer timeout to avoid false alarms.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
index 43191a8a9ea4..c4da1b900d47 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
@@ -11,6 +11,7 @@
#include "mt792x.h"
#include "mt76_connac2_mac.h"
+#define MT792X_USB_TX_TIMEOUT_LIMIT 50000
#define MT792X_USB_UDMA_IDLE_TIMEOUT 1000
static int mt792xu_read32(struct mt76_dev *dev, u32 addr, void *buf)
@@ -396,6 +397,10 @@ int mt792xu_dma_init(struct mt792x_dev *dev, bool resume)
mt76_set(dev, MT_UDMA_WLCFG_0,
MT_WL_RX_EN | MT_WL_TX_EN |
MT_WL_RX_MPSZ_PAD0 | MT_TICK_1US_EN);
+ mt76_rmw(dev, MT_UDMA_WLCFG_1, MT_WL_TX_TMOUT_LMT,
+ FIELD_PREP(MT_WL_TX_TMOUT_LMT,
+ MT792X_USB_TX_TIMEOUT_LIMIT));
+ mt76_set(dev, MT_UDMA_WLCFG_0, MT_WL_TX_TMOUT_FUNC_EN);
mt76_clear(dev, MT_UDMA_WLCFG_0,
MT_WL_RX_AGG_TO | MT_WL_RX_AGG_LMT);
mt76_clear(dev, MT_UDMA_WLCFG_1, MT_WL_RX_AGG_PKT_LMT);
--
2.43.0
^ permalink raw reply related
* [PATCH 4/6] wifi: mt76: mt792x: drain USB UDMA before WFSYS reset
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224131.2396026-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Stop USB UDMA RX/TX and wait for idle before WFSYS reset.
Warn if the engine remains busy.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
.../net/wireless/mediatek/mt76/mt792x_usb.c | 20 +++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
index d86b0918c2f8..43191a8a9ea4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
@@ -11,6 +11,8 @@
#include "mt792x.h"
#include "mt76_connac2_mac.h"
+#define MT792X_USB_UDMA_IDLE_TIMEOUT 1000
+
static int mt792xu_read32(struct mt76_dev *dev, u32 addr, void *buf)
{
return __mt76u_vendor_request(dev, MT_VEND_READ_EXT,
@@ -339,6 +341,23 @@ static void mt792xu_epctl_rst_opt(struct mt792x_dev *dev, bool reset)
mt792xu_uhw_wr(&dev->mt76, MT_SSUSB_EPCTL_CSR_EP_RST_OPT, val);
}
+static void mt792xu_wait_udma_idle(struct mt792x_dev *dev)
+{
+ u32 mask = MT_WL_RX_BUSY | MT_WL_TX_BUSY;
+ u32 val;
+
+ mt76_set(dev, MT_UDMA_WLCFG_0, MT_WL_RX_FLUSH);
+
+ if (mt76_poll_msec(dev, MT_UDMA_WLCFG_0, mask, 0,
+ MT792X_USB_UDMA_IDLE_TIMEOUT))
+ return;
+
+ val = mt76_rr(dev, MT_UDMA_WLCFG_0);
+
+ dev_warn(dev->mt76.dev,
+ "UDMA busy before WFSYS reset: WLCFG0=0x%08x\n", val);
+}
+
struct mt792xu_wfsys_desc {
u32 rst_reg;
u32 done_reg;
@@ -405,6 +424,7 @@ int mt792xu_wfsys_reset(struct mt792x_dev *dev)
if (atomic_read(&dev->mt76.bus_hung))
return -EIO;
+ mt792xu_wait_udma_idle(dev);
mt792xu_epctl_rst_opt(dev, false);
val = mt792xu_uhw_rr(&dev->mt76, desc->rst_reg);
--
2.43.0
^ permalink raw reply related
* [PATCH 3/6] wifi: mt76: mt792x: stop USB register access after bus hang
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224131.2396026-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Mark the mt792x USB bus hung on the first control timeout and switch
register access to no-op bus ops. Each failed vendor request may spend
up to MT_VEND_REQ_MAX_RETRY * MT_VEND_REQ_TOUT_MS, about 3 seconds, and
teardown/reset paths can keep issuing such requests after the device has
stopped responding.
Also skip the USB WFSYS reset path after bus_hung is set, since it uses
UHW vendor requests as well.
mt7925u 1-2:1.3: vendor request req:63 off:0018 failed:-110
mt7925u 1-2:1.3: vendor request req:63 off:0018 failed:-110
mt7925u 1-2:1.3: vendor request req:63 off:0018 failed:-110
mt7925u 1-2:1.3: vendor request req:63 off:0018 failed:-110
mt7925u 1-2:1.3: vendor request req:63 off:0018 failed:-110
Avoid repeating those register reads after the bus is known to be hung by
switching register access to no-op handlers.
Fixes: 0d2afe09fad5 ("mt76: mt7921: add mt7921u driver")
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt76.h | 1 +
.../net/wireless/mediatek/mt76/mt792x_usb.c | 79 ++++++++++++++++---
drivers/net/wireless/mediatek/mt76/usb.c | 11 +++
3 files changed, 82 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 07955555f84d..122e77a5f2f4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -672,6 +672,7 @@ struct mt76_usb {
u8 out_ep[__MT_EP_OUT_MAX];
u8 in_ep[__MT_EP_IN_MAX];
+ void (*ctrl_timeout)(struct mt76_dev *dev, int err);
bool sg_en;
struct mt76u_mcu {
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
index 910132e94956..d86b0918c2f8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
@@ -31,10 +31,75 @@ static void mt792xu_reset_work(struct work_struct *work)
atomic_set(&dev->usb_reset_pending, 0);
}
+static void mt792xu_queue_usb_reset(struct mt792x_dev *dev, int err)
+{
+ if (!atomic_xchg(&dev->usb_reset_pending, 1)) {
+ dev_warn(dev->mt76.dev,
+ "USB transport access failed (%d), queueing device reset\n",
+ err);
+
+ schedule_work(&dev->usb_reset_work);
+ }
+}
+
+static u32 mt792xu_bus_hung_rr(struct mt76_dev *mdev, u32 offset)
+{
+ return 0;
+}
+
+static void mt792xu_bus_hung_wr(struct mt76_dev *mdev, u32 offset, u32 val)
+{
+}
+
+static u32 mt792xu_bus_hung_rmw(struct mt76_dev *mdev, u32 offset,
+ u32 mask, u32 val)
+{
+ return 0;
+}
+
+static void mt792xu_bus_hung_write_copy(struct mt76_dev *mdev, u32 offset,
+ const void *data, int len)
+{
+}
+
+static void mt792xu_bus_hung_read_copy(struct mt76_dev *mdev, u32 offset,
+ void *data, int len)
+{
+ memset(data, 0, len);
+}
+
+static const struct mt76_bus_ops mt792xu_bus_hung_ops = {
+ .rr = mt792xu_bus_hung_rr,
+ .wr = mt792xu_bus_hung_wr,
+ .rmw = mt792xu_bus_hung_rmw,
+ .write_copy = mt792xu_bus_hung_write_copy,
+ .read_copy = mt792xu_bus_hung_read_copy,
+ .type = MT76_BUS_USB,
+};
+
+static void mt792xu_set_bus_hung(struct mt792x_dev *dev)
+{
+ atomic_set(&dev->mt76.bus_hung, true);
+
+ if (READ_ONCE(dev->mt76.bus) == &mt792xu_bus_hung_ops)
+ return;
+
+ WRITE_ONCE(dev->mt76.bus, &mt792xu_bus_hung_ops);
+}
+
+static void mt792xu_ctrl_timeout(struct mt76_dev *mdev, int err)
+{
+ struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
+
+ mt792xu_set_bus_hung(dev);
+ mt792xu_queue_usb_reset(dev, err);
+}
+
void mt792xu_reset_work_init(struct mt792x_dev *dev)
{
INIT_WORK(&dev->usb_reset_work, mt792xu_reset_work);
atomic_set(&dev->usb_reset_pending, 0);
+ dev->mt76.usb.ctrl_timeout = mt792xu_ctrl_timeout;
}
EXPORT_SYMBOL_GPL(mt792xu_reset_work_init);
@@ -68,15 +133,8 @@ int mt792xu_reset_on_bus_error(struct mt792x_dev *dev)
err = mt792xu_check_bus(dev);
if (err) {
- atomic_set(&dev->mt76.bus_hung, true);
-
- if (!atomic_xchg(&dev->usb_reset_pending, 1)) {
- dev_warn(dev->mt76.dev,
- "USB transport access failed (%d), queueing device reset\n",
- err);
-
- schedule_work(&dev->usb_reset_work);
- }
+ mt792xu_set_bus_hung(dev);
+ mt792xu_queue_usb_reset(dev, err);
return err;
}
@@ -344,6 +402,9 @@ int mt792xu_wfsys_reset(struct mt792x_dev *dev)
u32 val;
int i;
+ if (atomic_read(&dev->mt76.bus_hung))
+ return -EIO;
+
mt792xu_epctl_rst_opt(dev, false);
val = mt792xu_uhw_rr(&dev->mt76, desc->rst_reg);
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index 77a8e35b1f86..ce68e1d0c786 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -30,6 +30,8 @@ int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type,
for (i = 0; i < MT_VEND_REQ_MAX_RETRY; i++) {
if (test_bit(MT76_REMOVED, &dev->phy.state))
return -EIO;
+ if (dev->usb.ctrl_timeout && atomic_read(&dev->bus_hung))
+ return -EIO;
ret = usb_control_msg(udev, pipe, req, req_type, val,
offset, buf, len, MT_VEND_REQ_TOUT_MS);
@@ -42,6 +44,15 @@ int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type,
dev_err(dev->dev, "vendor request req:%02x off:%04x failed:%d\n",
req, offset, ret);
+
+ if (dev->usb.ctrl_timeout) {
+ atomic_set(&dev->bus_hung, true);
+ dev_err(dev->dev, "vendor request req:%02x off:%04x timed out, marking bus hung\n",
+ req, offset);
+ dev->usb.ctrl_timeout(dev, ret);
+ return ret;
+ }
+
return ret;
}
EXPORT_SYMBOL_GPL(__mt76u_vendor_request);
--
2.43.0
^ permalink raw reply related
* [PATCH 2/6] wifi: mt76: mt7925: skip reset work on hung bus
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224131.2396026-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Skip mt7925 reset handling once the bus is marked hung.
A hung bus cannot be recovered by issuing another device reset. Continuing
the reset path may only send more failing MCU or register accesses and
delay teardown. Return early from reset work and the USB reset path so the
failed device can be torn down quickly.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 ++++++
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 7 +++++++
2 files changed, 13 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
index 0641a7131d7c..d7e4ebe92342 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -1310,6 +1310,9 @@ void mt7925_mac_reset_work(struct work_struct *work)
struct mt76_connac_pm *pm = &dev->pm;
int i, ret;
+ if (atomic_read(&dev->mt76.bus_hung))
+ return;
+
dev_dbg(dev->mt76.dev, "chip reset\n");
dev->hw_full_reset = true;
ieee80211_stop_queues(hw);
@@ -1327,6 +1330,9 @@ void mt7925_mac_reset_work(struct work_struct *work)
break;
}
+ if (atomic_read(&dev->mt76.bus_hung))
+ return;
+
if (i == 10)
dev_err(dev->mt76.dev, "chip reset failed\n");
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
index e9f58492bf7d..49ad4fe9eb1b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/usb.c
@@ -81,6 +81,13 @@ static int mt7925u_mac_reset(struct mt792x_dev *dev)
{
int err;
+ if (atomic_read(&dev->mt76.bus_hung))
+ return 0;
+
+ mt792xu_reset_on_bus_error(dev);
+ if (atomic_read(&dev->mt76.bus_hung))
+ return 0;
+
mt76_txq_schedule_all(&dev->mphy);
mt76_worker_disable(&dev->mt76.tx_worker);
--
2.43.0
^ permalink raw reply related
* [PATCH 1/6] wifi: mt76: mt7925: stop init retries on hung bus
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
In-Reply-To: <20260613224131.2396026-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Stop retrying hardware init once the bus is marked hung.
The control path is no longer usable at that point, so more retries only
issue failing device accesses, including MCU commands or register
operations, and delay teardown. Exit early and let the failed device be
torn down quickly.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/init.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/init.c b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
index e85b0d104fbe..e9ca5aa1e407 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
@@ -137,10 +137,18 @@ static int mt7925_init_hardware(struct mt792x_dev *dev)
set_bit(MT76_STATE_INITIALIZED, &dev->mphy.state);
for (i = 0; i < MT792x_MCU_INIT_RETRY_COUNT; i++) {
+ if (atomic_read(&dev->mt76.bus_hung)) {
+ ret = -EIO;
+ break;
+ }
+
ret = __mt7925_init_hardware(dev);
if (!ret)
break;
+ if (atomic_read(&dev->mt76.bus_hung))
+ break;
+
mt792x_init_reset(dev);
}
--
2.43.0
^ permalink raw reply related
* [PATCH 0/6] wifi: mt76: mt792x: harden USB reset and disconnect paths
From: Sean Wang @ 2026-06-13 22:41 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi; +Cc: linux-wireless, linux-mediatek, Sean Wang
This series hardens mt792x USB reset and disconnect handling.
When the USB control path starts timing out, later register accesses can
keep entering the same dead transport. Each timed-out vendor request may
block for seconds, so reset or disconnect can be delayed by repeated
accesses that can no longer make progress.
Avoid this by failing fast once the USB bus is known to be hung, stopping
reset/init retry paths that cannot recover the device, draining UDMA before
WFSYS reset, and quiescing USB activity before unregistering the device.
This series does the following:
- stop mt7925 init retries once the USB bus is hung
- skip mt7925 reset work once the USB bus is hung
- switch later USB register accesses to no-op bus ops after bus hang
- drain USB UDMA before WFSYS reset
- enable the USB UDMA TX timeout limit
- stop pending USB work and TX paths before unregistering the device
The series is based on wireless-next commit:
21352612198c ("b43: add RF power offset for N-PHY r8 + radio 2057 r8")
It also cherry-picks the following patch from patchwork as a dependency:
wifi: mt76: mt76u: use a threaded NAPI for the RX path
Link: https://lore.kernel.org/all/20260609105301.196302-1-phial@phiality.com/
Sean Wang (6):
wifi: mt76: mt7925: stop init retries on hung bus
wifi: mt76: mt7925: skip reset work on hung bus
wifi: mt76: mt792x: stop USB register access after bus hang
wifi: mt76: mt792x: drain USB UDMA before WFSYS reset
wifi: mt76: mt792x: enable USB UDMA TX timeout
wifi: mt76: mt792x: quiesce USB paths on disconnect
drivers/net/wireless/mediatek/mt76/mt76.h | 1 +
.../net/wireless/mediatek/mt76/mt7925/init.c | 8 ++
.../net/wireless/mediatek/mt76/mt7925/mac.c | 6 +
.../net/wireless/mediatek/mt76/mt7925/usb.c | 7 +
.../net/wireless/mediatek/mt76/mt792x_usb.c | 124 ++++++++++++++++--
drivers/net/wireless/mediatek/mt76/usb.c | 11 ++
6 files changed, 145 insertions(+), 12 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH] [media] mt2063: correct CONFIG_MEDIA_TUNER_MT2063 macro name in comment
From: Ethan Nelson-Moore @ 2026-06-13 22:23 UTC (permalink / raw)
To: GitAuthor: Ethan Nelson-Moore, linux-media, linux-arm-kernel,
linux-mediatek
Cc: Mauro Carvalho Chehab, Matthias Brugger,
AngeloGioacchino Del Regno
A comment in drivers/media/tuners/mt2063.h incorrectly refers to
CONFIG_DVB_MT2063 instead of CONFIG_MEDIA_TUNER_MT2063. Correct it.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
---
drivers/media/tuners/mt2063.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/tuners/mt2063.h b/drivers/media/tuners/mt2063.h
index 30d03cd76061..6c4b6c68ec25 100644
--- a/drivers/media/tuners/mt2063.h
+++ b/drivers/media/tuners/mt2063.h
@@ -24,6 +24,6 @@ static inline struct dvb_frontend *mt2063_attach(struct dvb_frontend *fe,
return NULL;
}
-#endif /* CONFIG_DVB_MT2063 */
+#endif /* IS_REACHABLE(CONFIG_MEDIA_TUNER_MT2063) */
#endif /* __MT2063_H__ */
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net-next] net: airoha: better handle MIBs for GDM ports with multiple devs attached
From: patchwork-bot+netdevbpf @ 2026-06-13 22:10 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, linux-arm-kernel,
linux-mediatek, netdev, ansuelsmth
In-Reply-To: <20260611-airoha-eth-multi-serdes-stats-v1-1-42442ae42064@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 11 Jun 2026 12:43:00 +0200 you wrote:
> In the context of a GDM port that can have multiple net_devices attached
> (GDM3 and GDM4), the HW counters (MIBs) are global for the GDM port.
> This cause duplicated stats reported to the kernel for the related
> net_device.
> The SoC supports a split MIB feature where each counter is tracked based
> on the relevant HW channel (NBQ) to account for this scenario and
> provide a way to select the related counter on accessing the MIB
> registers.
> Enable this feature for GDM3 and GDM4 and configure the relevant HW
> channel before updating the HW stats to report correct HW counter to the
> kernel for the related interface.
> Move the stats struct from port to dev since HW counter are now specific
> to the network device instead of the GDM port. Refactor
> airoha_update_hw_stats() to take airoha_eth and airoha_gdm_port
> parameters since the function operates on the entire port.
>
> [...]
Here is the summary with links:
- [net-next] net: airoha: better handle MIBs for GDM ports with multiple devs attached
https://git.kernel.org/netdev/net-next/c/8f4695fb67b2
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2] net: airoha: Fix error handling in airoha_ppe_flush_sram_entries()
From: patchwork-bot+netdevbpf @ 2026-06-13 17:40 UTC (permalink / raw)
To: Wayen.Yan; +Cc: netdev, lorenzo, linux-arm-kernel, linux-mediatek
In-Reply-To: <6a2bd37a.4034e349.1b41bb.1caf@mx.google.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 12 Jun 2026 17:37:00 +0800 you wrote:
> In airoha_ppe_flush_sram_entries(), the outer "err" variable was never
> updated when the inner loop variable shadowed it, causing the function
> to always return 0 even when airoha_ppe_foe_commit_sram_entry() fails.
>
> Drop the outer "err" variable and return directly on error, propagating
> the error code from airoha_ppe_foe_commit_sram_entry() correctly.
>
> [...]
Here is the summary with links:
- [v2] net: airoha: Fix error handling in airoha_ppe_flush_sram_entries()
https://git.kernel.org/netdev/net/c/d7d81b003013
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox