* [PATCH RFC 2/2] wifi: mt76: mt7996: Add beacon_reconf IE parsing support
From: Lorenzo Bianconi @ 2026-02-11 23:38 UTC (permalink / raw)
To: Johannes Berg, Felix Fietkau, Ryder Lee, Shayne Chen, Sean Wang,
Matthias Brugger, AngeloGioacchino Del Regno
Cc: Aditya Kumar Singh, Ping-Ke Shih, Jeff Johnson, linux-wireless,
linux-arm-kernel, linux-mediatek, Lorenzo Bianconi
In-Reply-To: <20260212-mt7996-link-reconf-v1-0-2b110340d6c4@kernel.org>
From: Shayne Chen <shayne.chen@mediatek.com>
Implement the capability to offload the countdown for MLO link
reconfiguration IE sent by the AP MLD if the specified link is going
to be removed.
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 5 +
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 3 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 185 +++++++++++++++++++++
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 69 +++++++-
4 files changed, 260 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
index f44977f9093da76a9f5e2b4d7ce147de28c5b18e..669f20d57d591a092afbb33bc58f4b63e82ae9b6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -1067,6 +1067,7 @@ enum {
MCU_UNI_EVENT_WED_RRO = 0x57,
MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
+ MCU_UNI_EVENT_MLD = 0x81,
MCU_UNI_EVENT_SDO = 0x83,
};
@@ -1309,6 +1310,8 @@ enum {
MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
MCU_UNI_CMD_RADIO_STATUS = 0x80,
+ MCU_UNI_CMD_MLD = 0x82,
+ MCU_UNI_CMD_PEER_MLD = 0x83,
MCU_UNI_CMD_SDO = 0x88,
};
@@ -1384,6 +1387,8 @@ enum {
UNI_BSS_INFO_MLD = 26,
UNI_BSS_INFO_PM_DISABLE = 27,
UNI_BSS_INFO_EHT = 30,
+ UNI_BSS_INFO_MLD_LINK_OP = 36,
+ UNI_BSS_INFO_BCN_ML_RECONF = 38,
};
enum {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index 2937e89ad0c9c489274cfa4f6aeb694fb4456bd1..bf084cd434304e1afd3c3f8bbe726740f4d19f52 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -507,7 +507,8 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
wiphy->reg_notifier = mt7996_regd_notifier;
wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |
- WIPHY_FLAG_SUPPORTS_MLO;
+ WIPHY_FLAG_SUPPORTS_MLO |
+ WIPHY_FLAG_MLO_RECONF_ADV_OFFLOAD;
wiphy->mbssid_max_interfaces = 16;
wiphy->iftype_ext_capab = iftypes_ext_capa;
wiphy->num_iftype_ext_capab = ARRAY_SIZE(iftypes_ext_capa);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 8e1c8e1d6a99f093a2b7d7dc3a0c56f3a4bc220b..310a580028a8e3532923fa82d65739b008dc58af 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -816,6 +816,50 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
}
}
+static void
+mt7996_mcu_mld_reconf_finish(void *priv, u8 *mac, struct ieee80211_vif *vif)
+{
+ struct mt7996_mld_event_data *data = priv;
+ struct mt7996_mcu_mld_ap_reconf_event *reconf = (void *)data->data;
+
+ if (!ether_addr_equal(vif->addr, data->mld_addr))
+ return;
+
+ ieee80211_mlo_reconf_complete_notify(vif,
+ le16_to_cpu(reconf->link_bitmap));
+}
+
+static void
+mt7996_mcu_mld_event(struct mt7996_dev *dev, struct sk_buff *skb)
+{
+ struct mt7996_mcu_mld_event *e = (void *)skb->data;
+ struct mt7996_mld_event_data data = {};
+ struct tlv *tlv;
+ int len;
+
+ memcpy(data.mld_addr, e->mld_addr, ETH_ALEN);
+ skb_pull(skb, sizeof(*e));
+ tlv = (struct tlv *)skb->data;
+ len = skb->len;
+
+ while (len > 0 && le16_to_cpu(tlv->len) <= len) {
+ data.data = (u8 *)tlv;
+
+ switch (le16_to_cpu(tlv->tag)) {
+ case UNI_EVENT_MLD_RECONF_AP_REM_TIMER:
+ ieee80211_iterate_active_interfaces_atomic(
+ dev->mt76.hw, IEEE80211_IFACE_ITER_RESUME_ALL,
+ mt7996_mcu_mld_reconf_finish, &data);
+ break;
+ default:
+ break;
+ }
+
+ len -= le16_to_cpu(tlv->len);
+ tlv = (struct tlv *)((u8 *)tlv + le16_to_cpu(tlv->len));
+ }
+}
+
static void
mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
{
@@ -837,6 +881,9 @@ mt7996_mcu_uni_rx_unsolicited_event(struct mt7996_dev *dev, struct sk_buff *skb)
case MCU_UNI_EVENT_WED_RRO:
mt7996_mcu_wed_rro_event(dev, skb);
break;
+ case MCU_UNI_EVENT_MLD:
+ mt7996_mcu_mld_event(dev, skb);
+ break;
default:
break;
}
@@ -2863,6 +2910,142 @@ mt7996_mcu_beacon_cntdwn(struct sk_buff *rskb, struct sk_buff *skb,
}
}
+static int
+mt7996_mcu_mld_reconf(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ u16 removed_links, u16 *removal_count)
+{
+ struct mld_req_hdr hdr = { .mld_idx = 0xff };
+ unsigned long rem = removed_links;
+ struct mld_reconf_timer *rt;
+ struct sk_buff *skb;
+ struct tlv *tlv;
+ u8 link_id;
+
+ skb = mt76_mcu_msg_alloc(&dev->mt76, NULL, sizeof(hdr) + sizeof(*rt));
+ if (!skb)
+ return -ENOMEM;
+
+ memcpy(hdr.mld_addr, vif->addr, ETH_ALEN);
+ skb_put_data(skb, &hdr, sizeof(hdr));
+
+ tlv = mt7996_mcu_add_uni_tlv(skb, UNI_CMD_MLD_RECONF_AP_REM_TIMER,
+ sizeof(*rt));
+ rt = (struct mld_reconf_timer *)tlv;
+ rt->link_bitmap = cpu_to_le16(removed_links);
+
+ for_each_set_bit(link_id, &rem, IEEE80211_MLD_MAX_NUM_LINKS) {
+ struct ieee80211_bss_conf *link_conf;
+ struct mt7996_vif_link *link;
+ u8 band_idx;
+ u16 to_sec;
+
+ link_conf = link_conf_dereference_protected(vif, link_id);
+ if (!link_conf)
+ continue;
+
+ link = mt7996_vif_link(dev, vif, link_id);
+ if (!link)
+ continue;
+
+ to_sec = link_conf->beacon_int * removal_count[link_id] / 1000;
+ band_idx = link->phy->mt76->band_idx;
+ rt->to_sec[band_idx] = cpu_to_le16(to_sec);
+ rt->bss_idx[band_idx] = link->mt76.idx;
+ }
+
+ return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_WM_UNI_CMD(MLD), true);
+}
+
+static void
+mt7996_mcu_beacon_ml_reconf(struct mt7996_dev *dev,
+ struct ieee80211_bss_conf *link_conf,
+ struct sk_buff *rskb, struct sk_buff *skb,
+ struct ieee80211_mutable_offsets *offs)
+{
+ u16 tail_offset = offs->tim_offset + offs->tim_length;
+ u16 removal_count[IEEE80211_MLD_MAX_NUM_LINKS] = {};
+ u16 removal_offs[IEEE80211_MLD_MAX_NUM_LINKS] = {};
+ u8 link_id, *beacon_tail = skb->data + tail_offset;
+ struct bss_bcn_ml_reconf_offset *reconf_offs;
+ struct bss_bcn_ml_reconf_tlv *reconf;
+ const struct element *elem, *sub;
+ unsigned long removed_links = 0;
+ bool has_reconf = false;
+ struct tlv *tlv;
+
+ /* TODO: currently manually parse reconf info directly from the IE, it
+ * is expected to be passed from upper layer in the future.
+ */
+ for_each_element_extid(elem, WLAN_EID_EXT_EHT_MULTI_LINK, beacon_tail,
+ skb->len - tail_offset) {
+ if (ieee80211_mle_type_ok(elem->data + 1,
+ IEEE80211_ML_CONTROL_TYPE_RECONF,
+ elem->datalen - 1)) {
+ has_reconf = true;
+ break;
+ }
+ }
+
+ if (!has_reconf)
+ return;
+
+ for_each_mle_subelement(sub, elem->data + 1, elem->datalen - 1) {
+ struct ieee80211_mle_per_sta_profile *prof = (void *)sub->data;
+ u8 *pos = prof->variable;
+ u16 control;
+
+ if (sub->id != IEEE80211_MLE_SUBELEM_PER_STA_PROFILE)
+ continue;
+
+ if (!ieee80211_mle_reconf_sta_prof_size_ok(sub->data,
+ sub->datalen))
+ return;
+
+ control = le16_to_cpu(prof->control);
+ link_id = control & IEEE80211_MLE_STA_RECONF_CONTROL_LINK_ID;
+ removed_links |= BIT(link_id);
+
+ if (control &
+ IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT)
+ pos += 6;
+
+ if (control &
+ IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT) {
+ removal_offs[link_id] = pos - skb->data;
+ removal_count[link_id] = le16_to_cpu(*(__le16 *)pos);
+ }
+ }
+
+ if (!removed_links)
+ return;
+
+ /* the first link to be removed */
+ if (link_conf->link_id == __ffs(removed_links))
+ mt7996_mcu_mld_reconf(dev, link_conf->vif, removed_links,
+ removal_count);
+
+ tlv = mt7996_mcu_add_uni_tlv(rskb, UNI_BSS_INFO_BCN_ML_RECONF,
+ sizeof(*reconf) +
+ sizeof(*reconf_offs) * hweight16(removed_links));
+ reconf = (struct bss_bcn_ml_reconf_tlv *)tlv;
+ reconf->reconf_count = hweight16(removed_links);
+
+ reconf_offs = (struct bss_bcn_ml_reconf_offset *)reconf->offset;
+ for_each_set_bit(link_id, &removed_links,
+ IEEE80211_MLD_MAX_NUM_LINKS) {
+ struct mt7996_vif_link *link;
+
+ link = mt7996_vif_link(dev, link_conf->vif, link_id);
+ if (!link)
+ continue;
+
+ reconf_offs->ap_removal_timer_offs =
+ cpu_to_le16(removal_offs[link_id]);
+ reconf_offs->bss_idx = link->mt76.idx;
+ reconf_offs++;
+ }
+}
+
static void
mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
struct bss_bcn_content_tlv *bcn,
@@ -3006,6 +3189,8 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
if (link_conf->bssid_indicator)
mt7996_mcu_beacon_mbss(rskb, skb, bcn, &offs);
mt7996_mcu_beacon_cntdwn(rskb, skb, &offs, link_conf->csa_active);
+ if (ieee80211_vif_is_mld(link_conf->vif))
+ mt7996_mcu_beacon_ml_reconf(dev, link_conf, rskb, skb, &offs);
out:
dev_kfree_skb(skb);
return mt76_mcu_skb_send_msg(&dev->mt76, rskb,
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
index d9fb49f7b01b6cca2fd7a0e760c1d2b1b74eab5b..bb98194b98879ed7039791b3990019cbd43f120b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -487,6 +487,20 @@ struct bss_prot_tlv {
__le32 prot_mode;
} __packed;
+struct bss_bcn_ml_reconf_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 reconf_count;
+ u8 rsv[3];
+ u8 offset[];
+} __packed;
+
+struct bss_bcn_ml_reconf_offset {
+ __le16 ap_removal_timer_offs;
+ u8 bss_idx;
+ u8 rsv;
+} __packed;
+
struct sta_rec_ht_uni {
__le16 tag;
__le16 len;
@@ -660,6 +674,57 @@ struct mld_setup_link {
u8 __rsv;
} __packed;
+struct mld_req_hdr {
+ u8 ver;
+ u8 mld_addr[ETH_ALEN];
+ u8 mld_idx;
+ u8 flag;
+ u8 rsv[3];
+ u8 buf[];
+} __packed;
+
+struct mld_reconf_timer {
+ __le16 tag;
+ __le16 len;
+ __le16 link_bitmap;
+ __le16 to_sec[__MT_MAX_BAND]; /* timeout of reconf (second) */
+ u8 bss_idx[__MT_MAX_BAND];
+ u8 rsv;
+} __packed;
+
+enum {
+ UNI_CMD_MLD_RECONF_AP_REM_TIMER = 0x03,
+ UNI_CMD_MLD_RECONF_STOP_LINK = 0x04,
+};
+
+struct mt7996_mcu_mld_event {
+ struct mt7996_mcu_rxd rxd;
+ /* fixed field */
+ u8 ver;
+ u8 mld_addr[ETH_ALEN];
+ u8 mld_idx;
+ u8 rsv[4];
+ /* tlv */
+ u8 buf[];
+} __packed;
+
+struct mt7996_mld_event_data {
+ u8 mld_addr[ETH_ALEN];
+ u8 *data;
+};
+
+struct mt7996_mcu_mld_ap_reconf_event {
+ __le16 tag;
+ __le16 len;
+ __le16 link_bitmap;
+ u8 bss_idx[3];
+ u8 rsv[3];
+} __packed;
+
+enum {
+ UNI_EVENT_MLD_RECONF_AP_REM_TIMER = 0x04,
+};
+
struct hdr_trans_en {
__le16 tag;
__le16 len;
@@ -847,7 +912,9 @@ enum {
sizeof(struct bss_bcn_content_tlv) + \
4 + MT_TXD_SIZE + \
sizeof(struct bss_bcn_cntdwn_tlv) + \
- sizeof(struct bss_bcn_mbss_tlv))
+ sizeof(struct bss_bcn_mbss_tlv) + \
+ sizeof(struct bss_bcn_ml_reconf_tlv) + \
+ 3 * sizeof(struct bss_bcn_ml_reconf_offset))
#define MT7996_MAX_BSS_OFFLOAD_SIZE 2048
#define MT7996_MAX_BEACON_SIZE (MT7996_MAX_BSS_OFFLOAD_SIZE - \
MT7996_BEACON_UPDATE_SIZE)
--
2.53.0
^ permalink raw reply related
* [PATCH v5 1/2] wifi: mt76: fix backoff fields and max_power calculation
From: Ryder Lee @ 2026-02-12 0:36 UTC (permalink / raw)
To: Felix Fietkau, Rob Herring
Cc: devicetree, linux-mediatek, linux-wireless, Allen Ye, Ryder Lee
From: Allen Ye <allen.ye@mediatek.com>
The maximum power value may exist in either the data or backoff field.
Previously, backoff power limits were not considered in txpower reporting.
This patch ensures mt76 also considers backoff values in the SKU table.
Also, each RU entry (RU26, RU52, RU106, BW20, ...) in the DTS corresponds
to 10 stream combinations (1T1ss, 2T1ss, 3T1ss, 4T1ss, 2T2ss, 3T2ss,
4T2ss, 3T3ss, 4T3ss, 4T4ss).
For beamforming tables:
- In connac2, beamforming entries for BW20~BW160, and OFDM do not include
1T1ss.
- In connac3, beamforming entries for BW20~BW160, and RU include 1T1ss,
but OFDM beamforming does not include 1T1ss.
Non-beamforming and RU entries for both connac2 and connac3 include 1T1ss.
Fixes: b05ab4be9fd7 ("wifi: mt76: mt7915: add bf backoff limit table support")
Signed-off-by: Allen Ye <allen.ye@mediatek.com>
Co-developed-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
---
v1:
- Add "wifi:" prefix to the subject.
v2:
- Fix checkpatch errors.
- Remove unnecessary style changes.
- Add explanation for connac2 index adjustment.
v3:
- Fix "case"s for MT76_SKU_BACKOFF_BF_OFFSET and MT76_SKU_BACKOFF.
- add more explanation for connac2/connac3 tables.
---
drivers/net/wireless/mediatek/mt76/eeprom.c | 154 ++++++++++++++------
drivers/net/wireless/mediatek/mt76/mt76.h | 1 -
2 files changed, 109 insertions(+), 46 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
index 573400d57..afdb73661 100644
--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
@@ -9,6 +9,13 @@
#include <linux/nvmem-consumer.h>
#include <linux/etherdevice.h>
#include "mt76.h"
+#include "mt76_connac.h"
+
+enum mt76_sku_type {
+ MT76_SKU_RATE,
+ MT76_SKU_BACKOFF,
+ MT76_SKU_BACKOFF_BF_OFFSET,
+};
static int mt76_get_of_eeprom_data(struct mt76_dev *dev, void *eep, int len)
{
@@ -292,7 +299,6 @@ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan)
}
EXPORT_SYMBOL_GPL(mt76_find_channel_node);
-
static s8
mt76_get_txs_delta(struct device_node *np, u8 nss)
{
@@ -306,9 +312,24 @@ mt76_get_txs_delta(struct device_node *np, u8 nss)
return be32_to_cpu(val[nss - 1]);
}
+static inline u8 mt76_backoff_n_chains(struct mt76_dev *dev, u8 idx)
+{
+ /* 0:1T1ss, 1:2T1ss, ..., 14:5T5ss */
+ static const u8 connac3_table[] = {
+ 1, 2, 3, 4, 5, 2, 3, 4, 5, 3, 4, 5, 4, 5, 5};
+ static const u8 connac2_table[] = {
+ 1, 2, 3, 4, 2, 3, 4, 3, 4, 4, 0, 0, 0, 0, 0};
+
+ if (idx >= ARRAY_SIZE(connac3_table))
+ return 0;
+
+ return is_mt799x(dev) ? connac3_table[idx] : connac2_table[idx];
+}
+
static void
-mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const s8 *data,
- s8 target_power, s8 nss_delta, s8 *max_power)
+mt76_apply_array_limit(struct mt76_dev *dev, s8 *pwr, size_t pwr_len,
+ const s8 *data, s8 target_power, s8 nss_delta,
+ s8 *max_power, int n_chains, enum mt76_sku_type type)
{
int i;
@@ -316,18 +337,51 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const s8 *data,
return;
for (i = 0; i < pwr_len; i++) {
- pwr[i] = min_t(s8, target_power, data[i] + nss_delta);
+ u8 backoff_chain_idx = i;
+ int backoff_n_chains;
+ s8 backoff_delta;
+ s8 delta;
+
+ switch (type) {
+ case MT76_SKU_RATE:
+ delta = 0;
+ backoff_delta = 0;
+ backoff_n_chains = 0;
+ break;
+ case MT76_SKU_BACKOFF_BF_OFFSET:
+ backoff_chain_idx += 1;
+ fallthrough;
+ case MT76_SKU_BACKOFF:
+ delta = mt76_tx_power_path_delta(n_chains);
+ backoff_n_chains = mt76_backoff_n_chains(dev, backoff_chain_idx);
+ backoff_delta = mt76_tx_power_path_delta(backoff_n_chains);
+ break;
+ default:
+ return;
+ }
+
+ pwr[i] = min_t(s8, target_power + delta - backoff_delta, data[i] + nss_delta);
+
+ /* used for padding, doesn't need to be considered */
+ if (data[i] >= S8_MAX - 1)
+ continue;
+
+ /* only consider backoff value for the configured chain number */
+ if (type != MT76_SKU_RATE && n_chains != backoff_n_chains)
+ continue;
+
*max_power = max(*max_power, pwr[i]);
}
}
static void
-mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
- const s8 *data, size_t len, s8 target_power,
- s8 nss_delta)
+mt76_apply_multi_array_limit(struct mt76_dev *dev, s8 *pwr, size_t pwr_len,
+ s8 pwr_num, const s8 *data, size_t len,
+ s8 target_power, s8 nss_delta, s8 *max_power,
+ int n_chains, enum mt76_sku_type type)
{
+ static const int connac2_backoff_ru_idx = 2;
int i, cur;
- s8 max_power = -128;
if (!data)
return;
@@ -337,8 +391,26 @@ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
if (len < pwr_len + 1)
break;
- mt76_apply_array_limit(pwr + pwr_len * i, pwr_len, data + 1,
- target_power, nss_delta, &max_power);
+ /* Each RU entry (RU26, RU52, RU106, BW20, ...) in the DTS
+ * corresponds to 10 stream combinations (1T1ss, 2T1ss, 3T1ss,
+ * 4T1ss, 2T2ss, 3T2ss, 4T2ss, 3T3ss, 4T3ss, 4T4ss).
+ *
+ * For beamforming tables:
+ * - In connac2, beamforming entries for BW20~BW160 and OFDM
+ * do not include 1T1ss.
+ * - In connac3, beamforming entries for BW20~BW160 and RU
+ * include 1T1ss, but OFDM beamforming does not include 1T1ss.
+ *
+ * Non-beamforming and RU entries for both connac2 and connac3
+ * include 1T1ss.
+ */
+ if (!is_mt799x(dev) && type == MT76_SKU_BACKOFF &&
+ i > connac2_backoff_ru_idx)
+ type = MT76_SKU_BACKOFF_BF_OFFSET;
+
+ mt76_apply_array_limit(dev, pwr + pwr_len * i, pwr_len, data + 1,
+ target_power, nss_delta, max_power,
+ n_chains, type);
if (--cur > 0)
continue;
@@ -360,18 +432,11 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
struct device_node *np;
const s8 *val;
char name[16];
- u32 mcs_rates = dev->drv->mcs_rates;
- u32 ru_rates = ARRAY_SIZE(dest->ru[0]);
char band;
size_t len;
- s8 max_power = 0;
- s8 max_power_backoff = -127;
+ s8 max_power = -127;
s8 txs_delta;
int n_chains = hweight16(phy->chainmask);
- s8 target_power_combine = target_power + mt76_tx_power_path_delta(n_chains);
-
- if (!mcs_rates)
- mcs_rates = 10;
memset(dest, target_power, sizeof(*dest) - sizeof(dest->path));
memset(&dest->path, 0, sizeof(dest->path));
@@ -409,46 +474,45 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
txs_delta = mt76_get_txs_delta(np, hweight16(phy->chainmask));
val = mt76_get_of_array_s8(np, "rates-cck", &len, ARRAY_SIZE(dest->cck));
- mt76_apply_array_limit(dest->cck, ARRAY_SIZE(dest->cck), val,
- target_power, txs_delta, &max_power);
+ mt76_apply_array_limit(dev, dest->cck, ARRAY_SIZE(dest->cck), val,
+ target_power, txs_delta, &max_power, n_chains, MT76_SKU_RATE);
- val = mt76_get_of_array_s8(np, "rates-ofdm",
- &len, ARRAY_SIZE(dest->ofdm));
- mt76_apply_array_limit(dest->ofdm, ARRAY_SIZE(dest->ofdm), val,
- target_power, txs_delta, &max_power);
+ val = mt76_get_of_array_s8(np, "rates-ofdm", &len, ARRAY_SIZE(dest->ofdm));
+ mt76_apply_array_limit(dev, dest->ofdm, ARRAY_SIZE(dest->ofdm), val,
+ target_power, txs_delta, &max_power, n_chains, MT76_SKU_RATE);
- val = mt76_get_of_array_s8(np, "rates-mcs", &len, mcs_rates + 1);
- mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
- ARRAY_SIZE(dest->mcs), val, len,
- target_power, txs_delta);
+ val = mt76_get_of_array_s8(np, "rates-mcs", &len, ARRAY_SIZE(dest->mcs[0]) + 1);
+ mt76_apply_multi_array_limit(dev, dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
+ ARRAY_SIZE(dest->mcs), val, len, target_power,
+ txs_delta, &max_power, n_chains, MT76_SKU_RATE);
- val = mt76_get_of_array_s8(np, "rates-ru", &len, ru_rates + 1);
- mt76_apply_multi_array_limit(dest->ru[0], ARRAY_SIZE(dest->ru[0]),
- ARRAY_SIZE(dest->ru), val, len,
- target_power, txs_delta);
+ val = mt76_get_of_array_s8(np, "rates-ru", &len, ARRAY_SIZE(dest->ru[0]) + 1);
+ mt76_apply_multi_array_limit(dev, dest->ru[0], ARRAY_SIZE(dest->ru[0]),
+ ARRAY_SIZE(dest->ru), val, len, target_power,
+ txs_delta, &max_power, n_chains, MT76_SKU_RATE);
- max_power_backoff = max_power;
val = mt76_get_of_array_s8(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
- mt76_apply_array_limit(dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
- target_power_combine, txs_delta, &max_power_backoff);
+ mt76_apply_array_limit(dev, dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
+ target_power, txs_delta, &max_power, n_chains, MT76_SKU_BACKOFF);
val = mt76_get_of_array_s8(np, "paths-ofdm", &len, ARRAY_SIZE(dest->path.ofdm));
- mt76_apply_array_limit(dest->path.ofdm, ARRAY_SIZE(dest->path.ofdm), val,
- target_power_combine, txs_delta, &max_power_backoff);
+ mt76_apply_array_limit(dev, dest->path.ofdm, ARRAY_SIZE(dest->path.ofdm), val,
+ target_power, txs_delta, &max_power, n_chains, MT76_SKU_BACKOFF);
val = mt76_get_of_array_s8(np, "paths-ofdm-bf", &len, ARRAY_SIZE(dest->path.ofdm_bf));
- mt76_apply_array_limit(dest->path.ofdm_bf, ARRAY_SIZE(dest->path.ofdm_bf), val,
- target_power_combine, txs_delta, &max_power_backoff);
+ mt76_apply_array_limit(dev, dest->path.ofdm_bf, ARRAY_SIZE(dest->path.ofdm_bf), val,
+ target_power, txs_delta, &max_power, n_chains,
+ MT76_SKU_BACKOFF_BF_OFFSET);
val = mt76_get_of_array_s8(np, "paths-ru", &len, ARRAY_SIZE(dest->path.ru[0]) + 1);
- mt76_apply_multi_array_limit(dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
- ARRAY_SIZE(dest->path.ru), val, len,
- target_power_combine, txs_delta);
+ mt76_apply_multi_array_limit(dev, dest->path.ru[0], ARRAY_SIZE(dest->path.ru[0]),
+ ARRAY_SIZE(dest->path.ru), val, len, target_power,
+ txs_delta, &max_power, n_chains, MT76_SKU_BACKOFF);
val = mt76_get_of_array_s8(np, "paths-ru-bf", &len, ARRAY_SIZE(dest->path.ru_bf[0]) + 1);
- mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
- ARRAY_SIZE(dest->path.ru_bf), val, len,
- target_power_combine, txs_delta);
+ mt76_apply_multi_array_limit(dev, dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
+ ARRAY_SIZE(dest->path.ru_bf), val, len, target_power,
+ txs_delta, &max_power, n_chains, MT76_SKU_BACKOFF);
return max_power;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index d05e83ea1..32876eab2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -540,7 +540,6 @@ struct mt76_driver_ops {
u32 survey_flags;
u16 txwi_size;
u16 token_size;
- u8 mcs_rates;
unsigned int link_data_size;
--
2.45.2
^ permalink raw reply related
* [PATCH v5 2/2] dt-bindings: net: wireless: mt76: clarify backoff limit usage
From: Ryder Lee @ 2026-02-12 0:36 UTC (permalink / raw)
To: Felix Fietkau, Rob Herring
Cc: devicetree, linux-mediatek, linux-wireless, Ryder Lee, Allen Ye
In-Reply-To: <8fa8ec500b3d4de7b1966c6887f1dfbe5c46a54c.1770856296.git.ryder.lee@mediatek.com>
Clarify the usage of path backoff limit properties in mt76 binding.
Add explicit documentation for old generation (mt7915, mt7916, mt7981,
mt7986) and new generation (mt7990, mt7992, mt7996) devices, including
the difference in beamforming and non-beamforming entries.
Rephrase the paths-ru/paths-ru-bf description to make them more precise.
Co-developed-by: Allen Ye <allen.ye@mediatek.com>
Signed-off-by: Allen Ye <allen.ye@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
---
v4:
- revise commit message
- use PCI id as the compatible string to replace "connac2/3"
v5: fix missing starting space in comment(comments)
---
.../bindings/net/wireless/mediatek,mt76.yaml | 21 +++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml b/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml
index ae6b97cdc..20b868f7d 100644
--- a/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml
+++ b/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml
@@ -27,6 +27,11 @@ properties:
- mediatek,mt7622-wmac
- mediatek,mt7981-wmac
- mediatek,mt7986-wmac
+ - pci14c3,7915 # mt7915
+ - pci14c3,7906 # mt7916
+ - pci14c3,7990 # mt7996
+ - pci14c3,7992 # mt7992
+ - pci14c3,7993 # mt7990
reg:
minItems: 1
@@ -252,6 +257,14 @@ properties:
followed by 10 power limit values. The order of the
channel resource unit settings is RU26, RU52, RU106,
RU242/SU20, RU484/SU40, RU996/SU80 and RU2x996/SU160.
+ - For mt7981/mt7986/mt7915/mt7916
+ - Beamforming entries for BW20~BW160 and OFDM do not
+ include 1T1ss.
+ - When 1T1ss is not used, it should be filled with 0.
+ - For mt7996/mt7992/mt7990
+ - Beamforming entries for BW20~BW160 and RU include
+ 1T1ss, but OFDM does not include 1T1ss.
+ - 1T1ss is taken into account, so no need to fill with 0.
minItems: 1
maxItems: 7
items:
@@ -270,6 +283,14 @@ properties:
followed by 10 power limit values. The order of the
channel resource unit settings is RU26, RU52, RU106,
RU242/SU20, RU484/SU40, RU996/SU80 and RU2x996/SU160.
+ - For mt7981/mt7986/mt7915/mt7916
+ - Beamforming entries for BW20~BW160 and OFDM do not
+ include 1T1ss.
+ - When 1T1ss is not used, it should be filled with 0.
+ - For mt7996/mt7992/mt7990
+ - Beamforming entries for BW20~BW160 and RU include
+ 1T1ss, but OFDM does not include 1T1ss.
+ - 1T1ss is taken into account, so no need to fill with 0.
minItems: 1
maxItems: 7
items:
--
2.45.2
^ permalink raw reply related
* Re: [RFC PATCH 2/2] wifi: ath10k: only wait for response to SET_KEY
From: James Prestwood @ 2026-02-12 2:11 UTC (permalink / raw)
To: Richard Acayan, Jeff Johnson, Michal Kazior, Kalle Valo,
linux-wireless, ath10k
In-Reply-To: <20260210021249.12132-3-mailingradian@gmail.com>
On 2/9/26 6:12 PM, Richard Acayan wrote:
> When sending DELETE_KEY, the driver times out waiting for a response
> that doesn't come. Only wait for a response when sending SET_KEY.
We've run into the exact same thing on the QCA6174 and have been
carrying an identical patch to this for at least a year.
https://lore.kernel.org/linux-wireless/b2838a23-ea30-4dee-b513-f5471d486af2@gmail.com/
>
> Sample dmesg:
>
> [ 117.285854] wlan0: deauthenticating from XX:XX:XX:XX:XX:XX by local choice (Reason: 3=DEAUTH_LEAVING)
> [ 120.302934] ath10k_snoc 18800000.wifi: failed to install key for vdev 0 peer XX:XX:XX:XX:XX:XX: -110
> [ 120.302996] wlan0: failed to remove key (0, XX:XX:XX:XX:XX:XX) from hardware (-110)
>
> Signed-off-by: Richard Acayan <mailingradian@gmail.com>
> ---
> drivers/net/wireless/ath/ath10k/mac.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
> index da6f7957a0ae..73aa93043f8a 100644
> --- a/drivers/net/wireless/ath/ath10k/mac.c
> +++ b/drivers/net/wireless/ath/ath10k/mac.c
> @@ -324,9 +324,11 @@ static int ath10k_install_key(struct ath10k_vif *arvif,
> if (ret)
> return ret;
>
> - time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
> - if (time_left == 0)
> - return -ETIMEDOUT;
> + if (cmd != DISABLE_KEY) {
> + time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
> + if (time_left == 0)
> + return -ETIMEDOUT;
> + }
>
> return 0;
> }
^ permalink raw reply
* Re: [PATCH v2] wifi: mt76: mt7921: fix txpower reporting
From: Lucid Duck @ 2026-02-12 2:46 UTC (permalink / raw)
To: morrownr; +Cc: nbd, lorenzo, linux-wireless, Lucid Duck
In-Reply-To: <CAFktD2dZwX9-Cq8Pv7NEHE5agDLqVau+4fHjre7Zh+2M_1u3Uw@mail.gmail.com>
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1973 bytes --]
On Mon, 9 Feb 2026, Nick wrote:
> I just tested this patch with a fresh download of kernel 6.18.8. All I
> see is 3 dBm when running "iw dev". My USB WiFi adapter also uses the
> mt7921u driver.
Hi Nick,
Thanks for testing.
First thing to check: were you associated to an AP when you ran the
command?
This v2 updates txpower_cur from mt7921_bss_info_changed() on
BSS_CHANGED_TXPOWER, which only fires when there is an active BSS
context. If the interface is not connected, that callback may never
run and txpower_cur can remain at its default (which often shows up
as 3 dBm via iw).
Could you share the output of these while testing?
iw dev wlan0 link
iw dev wlan0 info
iw reg get
If you can reproduce the 3 dBm while clearly associated (the
iw ... link output shows a connected state), then we are looking at
a different path not triggering the update on your setup, and I can
adjust where the driver sets txpower_cur (likely earlier around
channel context setup rather than only in BSS change handling).
> Also, something just doesn't seem right with 33, 27 and 15 dBm. You
> are in CA, right?
I am in Canada (not California). Those numbers are not a measurement
of actual RF output, they are derived from the regulatory information
(the chan->max_reg_power fallback path) when bss_conf.txpower is not
populated. They will vary based on regulatory domain and the
channel/band selected. For reference:
Canada (ISED) US (FCC)
2.4 GHz 30 dBm 30 dBm
5 GHz DFS 24 dBm 24 dBm
6 GHz LPI 12 dBm 30 dBm
The 6 GHz band is where the difference is most visible — ISED limits
low-power indoor to 12 dBm while FCC allows 30 dBm. The values you
see will depend on what iw reg get reports for your system.
Thanks again, your results are helpful for tightening up the next
revision.
Lucid Duck
^ permalink raw reply
* [PATCH wireless-next v3] wifi: mac80211: Fix AAD/Nonce computation for management frames with MLO
From: Sai Pratyusha Magam @ 2026-02-12 4:26 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, sai.magam, quic_drohan
Per IEEE Std 802.11be-2024, 12.5.2.3.3, if the MPDU is an
individually addressed Data frame between an AP MLD and a
non-AP MLD associated with the AP MLD, then A1/A2/A3
will be MLD MAC addresses. Otherwise, Al/A2/A3 will be
over-the-air link MAC addresses.
Currently, during AAD and Nonce computation for software based
encryption/decryption cases, mac80211 directly uses the addresses it
receives in the skb frame header. However, after the first
authentication, management frame addresses for non-AP MLD stations
are translated to MLD addresses from over the air link addresses in
software. This means that the skb header could contain translated MLD
addresses, which when used as is, can lead to incorrect AAD/Nonce
computation.
In the following manner, ensure that the right set of addresses are used:
In the receive path, stash the pre-translated link addresses in
ieee80211_rx_data and use them for the AAD/Nonce computations
when required.
In the transmit path, offload the encryption for a CCMP/GCMP key
to the hwsim driver that can then ensure that encryption and hence
the AAD/Nonce computations are performed on the frame containing the
right set of addresses, i.e, MLD addresses if unicast data frame and
link addresses otherwise.
To do so, register the set key handler in hwsim driver so mac80211 is
aware that it is the driver that would take care of encrypting the
frame. Offload encryption for a CCMP/GCMP key, while keeping the
encryption for WEP/TKIP and MMIE generation for a AES_CMAC or a
AES_GMAC key still at the SW crypto in mac layer
Co-developed-by: Rohan Dutta <quic_drohan@quicinc.com>
Signed-off-by: Rohan Dutta <quic_drohan@quicinc.com>
Signed-off-by: Sai Pratyusha Magam <sai.magam@oss.qualcomm.com>
---
v2 -> v3:
Added support for data tx encryption offload and removed the
logic around additional key flag(IEEE80211_KEY_FLAG_MGMT_TX_ENC_OFFLOAD)
v1 -> v2:
Removed the additional address translation to link addresses approach
in the encrypt/decrypt path for management frames and instead the rx
path uses the stashed pre-translated link addresses for decryption and
in the tx path, encryption for mgmt frames is offloaded to hwsim driver
drivers/net/wireless/virtual/mac80211_hwsim.c | 40 ++++++++++++-
include/net/mac80211.h | 7 +++
net/mac80211/ieee80211_i.h | 2 +
net/mac80211/rx.c | 3 +
net/mac80211/tx.c | 32 +++++++++++
net/mac80211/wpa.c | 57 +++++++++++++++----
6 files changed, 128 insertions(+), 13 deletions(-)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 4d9f5f87e814..293603faf748 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -1955,6 +1955,25 @@ mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,
return NULL;
}
+static int mac80211_hwsim_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct ieee80211_key_conf *key)
+{
+ switch (key->cipher) {
+ case WLAN_CIPHER_SUITE_CCMP:
+ case WLAN_CIPHER_SUITE_CCMP_256:
+ case WLAN_CIPHER_SUITE_GCMP:
+ case WLAN_CIPHER_SUITE_GCMP_256:
+ break;
+ default:
+ return 1;
+ }
+
+ key->flags |= IEEE80211_KEY_FLAG_RESERVE_TAILROOM;
+ return 0;
+}
+
static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
struct ieee80211_tx_control *control,
struct sk_buff *skb)
@@ -1965,7 +1984,7 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *chanctx_conf;
struct ieee80211_channel *channel;
struct ieee80211_vif *vif = txi->control.vif;
- bool ack;
+ bool ack, unicast_data;
enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
u32 _portid, i;
@@ -1975,6 +1994,16 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
return;
}
+ unicast_data = is_unicast_ether_addr(hdr->addr1) &&
+ ieee80211_is_data(hdr->frame_control);
+
+ if (unicast_data && ieee80211_encrypt_tx_skb(skb) < 0) {
+ ieee80211_free_txskb(hw, skb);
+ return;
+ }
+ /* re-assign hdr since skb data may have shifted after encryption */
+ hdr = (void *)skb->data;
+
if (vif && vif->type == NL80211_IFTYPE_NAN && !data->tmp_chan) {
/* For NAN Device simulation purposes, assume that NAN is always
* on channel 6 or channel 149, unless a ROC is in progress (for
@@ -2060,6 +2089,13 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
}
}
+ if (!unicast_data && ieee80211_encrypt_tx_skb(skb) < 0) {
+ ieee80211_free_txskb(hw, skb);
+ return;
+ }
+ /* re-assign hdr since skb data may have shifted after encryption */
+ hdr = (void *)skb->data;
+
if (WARN(!channel, "TX w/o channel - queue = %d\n", txi->hw_queue)) {
ieee80211_free_txskb(hw, skb);
return;
@@ -4189,6 +4225,7 @@ static int mac80211_hwsim_change_nan_config(struct ieee80211_hw *hw,
.start_nan = mac80211_hwsim_start_nan, \
.stop_nan = mac80211_hwsim_stop_nan, \
.nan_change_conf = mac80211_hwsim_change_nan_config, \
+ .set_key = mac80211_hwsim_set_key, \
HWSIM_DEBUGFS_OPS
#define HWSIM_NON_MLO_OPS \
@@ -5621,6 +5658,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
WIPHY_FLAG_AP_UAPSD |
WIPHY_FLAG_SUPPORTS_5_10_MHZ |
WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+ hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
NL80211_FEATURE_STATIC_SMPS |
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 7f9d96939a4e..bfd7d2a781ec 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -7962,4 +7962,11 @@ int ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
* Return: %true iff the vif is a NAN interface and NAN is started
*/
bool ieee80211_vif_nan_started(struct ieee80211_vif *vif);
+
+/**
+ * ieee80211_encrypt_tx_skb - Encrypt the transmit skb
+ * @skb: the skb
+ * Return: 0 if success and non-zero on error
+ */
+int ieee80211_encrypt_tx_skb(struct sk_buff *skb);
#endif /* MAC80211_H */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e60b814dd89e..a4babf7624e5 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -256,6 +256,8 @@ struct ieee80211_rx_data {
u8 pn[IEEE80211_CCMP_PN_LEN];
} ccm_gcm;
};
+
+ u8 link_addrs[3 * ETH_ALEN];
};
struct ieee80211_csa_settings {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 11d6c56c9d7e..e8eb38cbafc6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5127,6 +5127,9 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
hdr = (struct ieee80211_hdr *)rx->skb->data;
}
+ /* Store a copy of the pre-translated link addresses */
+ memcpy(rx->link_addrs, &hdr->addrs, 3 * ETH_ALEN);
+
if (unlikely(rx->sta && rx->sta->sta.mlo) &&
is_unicast_ether_addr(hdr->addr1) &&
!ieee80211_is_probe_resp(hdr->frame_control) &&
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 007f5a368d41..3562d9a6b70a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -5316,6 +5316,38 @@ static int ieee80211_beacon_protect(struct sk_buff *skb,
return 0;
}
+int ieee80211_encrypt_tx_skb(struct sk_buff *skb)
+{
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ struct ieee80211_sub_if_data *sdata;
+ struct sk_buff *check_skb;
+ struct ieee80211_tx_data tx;
+ ieee80211_tx_result res;
+
+ if (!info->control.hw_key)
+ return 0;
+
+ memset(&tx, 0, sizeof(tx));
+ tx.key = container_of(info->control.hw_key, struct ieee80211_key, conf);
+ /* NULL it out now so we do full SW crypto */
+ info->control.hw_key = NULL;
+ __skb_queue_head_init(&tx.skbs);
+ __skb_queue_tail(&tx.skbs, skb);
+
+ sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+ tx.sdata = sdata;
+ tx.local = sdata->local;
+ res = ieee80211_tx_h_encrypt(&tx);
+ check_skb = __skb_dequeue(&tx.skbs);
+ /* we may crash after this, but it'd be a bug in crypto */
+ WARN_ON(check_skb != skb);
+ if (WARN_ON_ONCE(res != TX_CONTINUE))
+ return -EINVAL;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(ieee80211_encrypt_tx_skb);
+
static void
ieee80211_beacon_get_finish(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index fdf98c21d32c..2a66765b5c88 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -315,7 +315,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
* Calculate AAD for CCMP/GCMP, returning qos_tid since we
* need that in CCMP also for b_0.
*/
-static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad, bool spp_amsdu)
+static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad, bool spp_amsdu,
+ bool aad_nonce_computed)
{
struct ieee80211_hdr *hdr = (void *)skb->data;
__le16 mask_fc;
@@ -358,7 +359,8 @@ static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad, bool spp_amsdu)
* FC | A1 | A2 | A3 | SC | [A4] | [QC] */
put_unaligned_be16(len_a, &aad[0]);
put_unaligned(mask_fc, (__le16 *)&aad[2]);
- memcpy(&aad[4], &hdr->addrs, 3 * ETH_ALEN);
+ if (!aad_nonce_computed)
+ memcpy(&aad[4], &hdr->addrs, 3 * ETH_ALEN);
/* Mask Seq#, leave Frag# */
aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
@@ -377,10 +379,10 @@ static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad, bool spp_amsdu)
}
static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
- bool spp_amsdu)
+ bool spp_amsdu, bool aad_nonce_computed)
{
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- u8 qos_tid = ccmp_gcmp_aad(skb, aad, spp_amsdu);
+ u8 qos_tid = ccmp_gcmp_aad(skb, aad, spp_amsdu, aad_nonce_computed);
/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
* mode authentication are not allowed to collide, yet both are derived
@@ -395,7 +397,8 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
* Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
*/
b_0[1] = qos_tid | (ieee80211_is_mgmt(hdr->frame_control) << 4);
- memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
+ if (!aad_nonce_computed)
+ memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
}
@@ -488,7 +491,8 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
pos += IEEE80211_CCMP_HDR_LEN;
ccmp_special_blocks(skb, pn, b_0, aad,
- key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
+ key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU,
+ false);
return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
skb_put(skb, mic_len));
}
@@ -566,9 +570,23 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
if (!(status->flag & RX_FLAG_DECRYPTED)) {
u8 aad[2 * AES_BLOCK_SIZE];
u8 b_0[AES_BLOCK_SIZE];
+ bool aad_nonce_computed = false;
+ bool unicast_data = is_unicast_ether_addr(hdr->addr1) &&
+ ieee80211_is_data(hdr->frame_control);
+
+ if (!unicast_data) {
+ /* AAD computation */
+ memcpy(&aad[4], rx->link_addrs, 3 * ETH_ALEN);
+ /* Nonce computation */
+ ether_addr_copy(&b_0[2],
+ &rx->link_addrs[ETH_ALEN]);
+ aad_nonce_computed = true;
+ }
+
/* hardware didn't decrypt/verify MIC */
ccmp_special_blocks(skb, pn, b_0, aad,
- key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
+ key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU,
+ aad_nonce_computed);
if (ieee80211_aes_ccm_decrypt(
key->u.ccmp.tfm, b_0, aad,
@@ -593,14 +611,15 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
}
static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad,
- bool spp_amsdu)
+ bool spp_amsdu, bool aad_nonce_computed)
{
struct ieee80211_hdr *hdr = (void *)skb->data;
- memcpy(j_0, hdr->addr2, ETH_ALEN);
+ if (!aad_nonce_computed)
+ memcpy(j_0, hdr->addr2, ETH_ALEN);
memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
- ccmp_gcmp_aad(skb, aad, spp_amsdu);
+ ccmp_gcmp_aad(skb, aad, spp_amsdu, aad_nonce_computed);
}
static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
@@ -690,7 +709,8 @@ static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
pos += IEEE80211_GCMP_HDR_LEN;
gcmp_special_blocks(skb, pn, j_0, aad,
- key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
+ key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU,
+ false);
return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
skb_put(skb, IEEE80211_GCMP_MIC_LEN));
}
@@ -763,9 +783,22 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
if (!(status->flag & RX_FLAG_DECRYPTED)) {
u8 aad[2 * AES_BLOCK_SIZE];
u8 j_0[AES_BLOCK_SIZE];
+ bool aad_nonce_computed = false;
+ bool unicast_data = is_unicast_ether_addr(hdr->addr1) &&
+ ieee80211_is_data(hdr->frame_control);
+
+ if (!unicast_data) {
+ /* AAD computation */
+ memcpy(&aad[4], rx->link_addrs, 3 * ETH_ALEN);
+ /* Nonce computation */
+ ether_addr_copy(&j_0[0],
+ &rx->link_addrs[ETH_ALEN]);
+ aad_nonce_computed = true;
+ }
/* hardware didn't decrypt/verify MIC */
gcmp_special_blocks(skb, pn, j_0, aad,
- key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
+ key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU,
+ aad_nonce_computed);
if (ieee80211_aes_gcm_decrypt(
key->u.gcmp.tfm, j_0, aad,
base-commit: 333225e1e9ead7b06e5363389403bdac72ba3046
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v2] wifi: brcmfmac: Fix potential kernel oops when probe fails
From: Arend van Spriel @ 2026-02-12 6:38 UTC (permalink / raw)
To: Marek Szyprowski, linux-wireless, brcm80211,
brcm80211-dev-list.pdl
In-Reply-To: <20260203102133.1478331-1-m.szyprowski@samsung.com>
Op 3 februari 2026 11:21:51 schreef Marek Szyprowski
<m.szyprowski@samsung.com>:
> When probe of the sdio brcmfmac device fails for some reasons (i.e.
> missing firmware), the sdiodev->bus is set to error instead of NULL, thus
> the cleanup later in brcmf_sdio_remove() tries to free resources via
> invalid bus pointer. This happens because sdiodev->bus is set 2 times:
> first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix
> this by chaning the brcmf_sdio_probe() function to return the error code
> and set sdio->bus only there.
>
> Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable support")
Acked-by: Arend van Spriel<arend.vanspriel@broadcom.com>
> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
> Changelog:
> v2:
> - changed return type of brcmf_sdio_probe() function
>
> v1:
> https://lore.kernel.org/all/20251231143544.4158840-1-m.szyprowski@samsung.com
> ---
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 +++----
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 2 +-
> 3 files changed, 8 insertions(+), 8 deletions(-)
^ permalink raw reply
* Re: [PATCH v5 2/2] dt-bindings: net: wireless: mt76: clarify backoff limit usage
From: Krzysztof Kozlowski @ 2026-02-12 7:50 UTC (permalink / raw)
To: Ryder Lee
Cc: Felix Fietkau, Rob Herring, devicetree, linux-mediatek,
linux-wireless, Allen Ye
In-Reply-To: <e39bff1d56a3f8b5146b881eef3442a4af97078b.1770856296.git.ryder.lee@mediatek.com>
On Wed, Feb 11, 2026 at 04:36:06PM -0800, Ryder Lee wrote:
> Clarify the usage of path backoff limit properties in mt76 binding.
> Add explicit documentation for old generation (mt7915, mt7916, mt7981,
> mt7986) and new generation (mt7990, mt7992, mt7996) devices, including
> the difference in beamforming and non-beamforming entries.
>
> Rephrase the paths-ru/paths-ru-bf description to make them more precise.
>
> Co-developed-by: Allen Ye <allen.ye@mediatek.com>
> Signed-off-by: Allen Ye <allen.ye@mediatek.com>
> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
> ---
> v4:
> - revise commit message
> - use PCI id as the compatible string to replace "connac2/3"
>
> v5: fix missing starting space in comment(comments)
> ---
> .../bindings/net/wireless/mediatek,mt76.yaml | 21 +++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml b/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml
> index ae6b97cdc..20b868f7d 100644
> --- a/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml
> +++ b/Documentation/devicetree/bindings/net/wireless/mediatek,mt76.yaml
> @@ -27,6 +27,11 @@ properties:
> - mediatek,mt7622-wmac
> - mediatek,mt7981-wmac
> - mediatek,mt7986-wmac
> + - pci14c3,7915 # mt7915
> + - pci14c3,7906 # mt7916
> + - pci14c3,7990 # mt7996
> + - pci14c3,7992 # mt7992
> + - pci14c3,7993 # mt7990
These are two separate commits with their own separate rationale.
>
> reg:
> minItems: 1
> @@ -252,6 +257,14 @@ properties:
> followed by 10 power limit values. The order of the
> channel resource unit settings is RU26, RU52, RU106,
> RU242/SU20, RU484/SU40, RU996/SU80 and RU2x996/SU160.
> + - For mt7981/mt7986/mt7915/mt7916
> + - Beamforming entries for BW20~BW160 and OFDM do not
> + include 1T1ss.
> + - When 1T1ss is not used, it should be filled with 0.
Shouldn't be skipped in such case? Why filling with 0 matters?
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH wireless-next v2 1/3] wifi: cfg80211: Add support for S1G Response Indication Configuration
From: Ria Thomas @ 2026-02-12 8:43 UTC (permalink / raw)
To: Johannes Berg
Cc: linux-wireless, lachlan.hodges, arien.judge, pradeep.reddy, simon
In-Reply-To: <ec999f04a965006dea6bd8e7380996b6fca980b4.camel@sipsolutions.net>
Hi Johannes,
Thanks for the feedback.
> And for the certification test, presumably the choice for testbed STA
> (for certain frames at least, I guess not intended to break the rules
> for cases where there's no/less choice) is not meant to be left to the
> implementation, but rather meant to be set, presumably to check that the
> receiver reacts correctly.
Yes, for certification testing this configuration is intended to verify
that the receiver of the PPDU correctly interprets and acts upon the
Response Indication value set by the transmitter.
> Now that I've described it this way, I think the biggest question I have
> is actually how, if at all, we need this in a non-testing scenario?
This configuration is not expected to be used in any non-testing cases.
> But we still need to decide where it should live, although in
> that case I'd be more willing to accept an interface setting despite
> the lifetime issues.)
>
We think it makes the most sense to treat Response Indication as an
interface-level setting as it avoids introducing peer-specific state
that is neither negotiated nor maintained by the protocol.
That said as the response indication is only a test configuration there
is expected to be some changes to the upcoming patches. I would preferably
submit the response indication configuration as a single patch and NDP
ADDBA/DELBA negotiations as a different patch. This would open up two different
new mail chains for two patches which is different from the current one.
Looking forward to hear your thoughts on this.
Ria
^ permalink raw reply
* [PATCH mt76 3/3] wifi: mt76: mt7996: apply calibration-free data from OTP
From: Shayne Chen @ 2026-02-12 9:03 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, StanleyYP Wang, Shayne Chen
In-Reply-To: <20260212090310.3335392-1-shayne.chen@mediatek.com>
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Before sending the current EEPROM data to the firmware, read the
calibration-free data (FT data) from the efuse and merge it with
the existing EEPROM data.
Co-developed-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
---
.../net/wireless/mediatek/mt76/mt7996/mcu.c | 171 ++++++++++++++++--
.../wireless/mediatek/mt76/mt7996/mt7996.h | 5 +
2 files changed, 157 insertions(+), 19 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 98db3bcf76f0..4cac1f7dd597 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3948,7 +3948,152 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
&req, sizeof(req), true);
}
-static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
+static int
+mt7996_mcu_get_cal_free_data(struct mt7996_dev *dev)
+{
+#define MT_EE_7977BN_OFFSET (0x1200 - 0x500)
+ struct cal_free_data {
+ u16 adie_offs;
+ u16 eep_offs;
+ };
+ static const struct cal_free_data cal_7975[] = {
+ { 0x5cd, 0x451 }, { 0x5cf, 0x453 }, { 0x5d1, 0x455 },
+ { 0x5d3, 0x457 }, { 0x6c0, 0x44c }, { 0x6c1, 0x44d },
+ { 0x6c2, 0x44e }, { 0x6c3, 0x44f }, { 0x7a1, 0xba1 },
+ { 0x7a6, 0xba6 }, { 0x7a8, 0xba8 }, { 0x7aa, 0xbaa },
+ };
+ static const struct cal_free_data cal_7976[] = {
+ { 0x4c, 0x44c }, { 0x4d, 0x44d }, { 0x4e, 0x44e },
+ { 0x4f, 0x44f }, { 0x50, 0x450 }, { 0x51, 0x451 },
+ { 0x53, 0x453 }, { 0x55, 0x455 }, { 0x57, 0x457 },
+ { 0x59, 0x459 }, { 0x70, 0x470 }, { 0x71, 0x471 },
+ { 0x790, 0xb90 }, { 0x791, 0xb91 }, { 0x794, 0xb94 },
+ { 0x795, 0xb95 }, { 0x7a6, 0xba6 }, { 0x7a8, 0xba8 },
+ { 0x7aa, 0xbaa },
+ };
+ static const struct cal_free_data cal_7977[] = {
+ { 0x4c, 0x124c }, { 0x4d, 0x124d }, { 0x4e, 0x124e },
+ { 0x4f, 0x124f }, { 0x50, 0x1250 }, { 0x51, 0x1251 },
+ { 0x53, 0x1253 }, { 0x55, 0x1255 }, { 0x57, 0x1257 },
+ { 0x59, 0x1259 }, { 0x69, 0x1269 }, { 0x6a, 0x126a },
+ { 0x7a, 0x127a }, { 0x7b, 0x127b }, { 0x7c, 0x127c },
+ { 0x7d, 0x127d }, { 0x7e, 0x127e },
+ };
+ static const struct cal_free_data cal_7978[] = {
+ { 0x91, 0xb91 }, { 0x95, 0xb95 }, { 0x100, 0x480 },
+ { 0x102, 0x482 }, { 0x104, 0x484 }, { 0x106, 0x486 },
+ { 0x107, 0x487 }, { 0x108, 0x488 }, { 0x109, 0x489 },
+ { 0x10a, 0x48a }, { 0x10b, 0x48b }, { 0x10c, 0x48c },
+ { 0x10e, 0x48e }, { 0x110, 0x490 },
+ };
+ static const struct cal_free_data cal_7979[] = {
+ { 0x4c, 0x124c }, { 0x4d, 0x124d }, { 0x4e, 0x124e },
+ { 0x4f, 0x124f }, { 0x50, 0x1250 }, { 0x51, 0x1251 },
+ { 0x53, 0x1253 }, { 0x55, 0x1255 }, { 0x57, 0x1257 },
+ { 0x59, 0x1259 }, { 0x69, 0x1269 }, { 0x6a, 0x126a },
+ { 0x7a, 0x127a }, { 0x7b, 0x127b }, { 0x7c, 0x127c },
+ { 0x7e, 0x127e }, { 0x80, 0x1280 },
+ };
+ const struct cal_free_data *cal_arr[__MT_MAX_BAND];
+ u16 cal_arr_len[__MT_MAX_BAND] = {};
+ u8 *eeprom = (u8 *)dev->mt76.eeprom.data;
+ int band, i, ret;
+
+#define CAL_ARR(_band, _adie) do { \
+ cal_arr[_band] = cal_##_adie; \
+ cal_arr_len[_band] = ARRAY_SIZE(cal_##_adie); \
+ } while (0)
+
+ switch (mt76_chip(&dev->mt76)) {
+ case MT7996_DEVICE_ID:
+ /* adie 0 */
+ if (dev->var.fem == MT7996_FEM_INT &&
+ dev->var.type != MT7996_VAR_TYPE_233)
+ CAL_ARR(0, 7975);
+ else
+ CAL_ARR(0, 7976);
+
+ /* adie 1 */
+ if (dev->var.type == MT7996_VAR_TYPE_444)
+ CAL_ARR(1, 7977);
+
+ /* adie 2 */
+ CAL_ARR(2, 7977);
+ break;
+ case MT7992_DEVICE_ID:
+ /* adie 0 */
+ if (dev->var.type == MT7992_VAR_TYPE_44 &&
+ dev->var.fem != MT7996_FEM_EXT)
+ CAL_ARR(0, 7975);
+ else if (dev->var.type == MT7992_VAR_TYPE_24)
+ CAL_ARR(0, 7978);
+ else
+ CAL_ARR(0, 7976);
+
+ /* adie 1 */
+ if (dev->var.type == MT7992_VAR_TYPE_44 &&
+ dev->var.fem != MT7996_FEM_INT)
+ CAL_ARR(1, 7977);
+ else if (dev->var.type != MT7992_VAR_TYPE_23)
+ CAL_ARR(1, 7979);
+ break;
+ case MT7990_DEVICE_ID:
+ /* adie 0 */
+ CAL_ARR(0, 7976);
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ for (band = 0; band < __MT_MAX_BAND; band++) {
+ const struct cal_free_data *cal;
+ u16 prev_block_idx = -1;
+ u16 adie_base;
+
+ if (!cal_arr_len[band])
+ continue;
+
+ if (band == MT_BAND0)
+ adie_base = MT7996_EFUSE_BASE_OFFS_ADIE0;
+ else if (band == MT_BAND1 && is_mt7992(&dev->mt76))
+ adie_base = MT7992_EFUSE_BASE_OFFS_ADIE1;
+ else if (band == MT_BAND1)
+ adie_base = MT7996_EFUSE_BASE_OFFS_ADIE1;
+ else
+ adie_base = MT7996_EFUSE_BASE_OFFS_ADIE2;
+
+ cal = cal_arr[band];
+ for (i = 0; i < cal_arr_len[band]; i++) {
+ u16 adie_offset = cal[i].adie_offs + adie_base;
+ u16 eep_offset = cal[i].eep_offs;
+ u16 block_idx = adie_offset / MT7996_EEPROM_BLOCK_SIZE;
+ u16 offset = adie_offset % MT7996_EEPROM_BLOCK_SIZE;
+ u8 buf[MT7996_EEPROM_BLOCK_SIZE];
+
+ if (is_mt7996(&dev->mt76) && band == MT_BAND1 &&
+ dev->var.type == MT7996_VAR_TYPE_444)
+ eep_offset -= MT_EE_7977BN_OFFSET;
+
+ if (prev_block_idx != block_idx) {
+ ret = mt7996_mcu_get_eeprom(dev, adie_offset, buf,
+ MT7996_EEPROM_BLOCK_SIZE,
+ EEPROM_MODE_EFUSE);
+ if (ret) {
+ if (ret != -EINVAL)
+ return ret;
+ prev_block_idx = -1;
+ continue;
+ }
+ }
+ eeprom[eep_offset] = buf[offset];
+ prev_block_idx = block_idx;
+ }
+ }
+
+ return 0;
+}
+
+int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
{
#define MAX_PAGE_IDX_MASK GENMASK(7, 5)
#define PAGE_IDX_MASK GENMASK(4, 2)
@@ -3960,11 +4105,15 @@ static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
u16 eeprom_size = MT7996_EEPROM_SIZE;
u8 total = DIV_ROUND_UP(eeprom_size, PER_PAGE_SIZE);
u8 *eep = (u8 *)dev->mt76.eeprom.data;
- int eep_len, i;
+ int ret, eep_len, i;
+
+ ret = mt7996_mcu_get_cal_free_data(dev);
+ if (ret)
+ return ret;
for (i = 0; i < total; i++, eep += eep_len) {
struct sk_buff *skb;
- int ret, msg_len;
+ int msg_len;
if (i == total - 1 && !!(eeprom_size % PER_PAGE_SIZE))
eep_len = eeprom_size % PER_PAGE_SIZE;
@@ -3993,22 +4142,6 @@ static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
return 0;
}
-int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
-{
- struct mt7996_mcu_eeprom_update req = {
- .tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
- .len = cpu_to_le16(sizeof(req) - 4),
- .buffer_mode = EE_MODE_EFUSE,
- .format = EE_FORMAT_WHOLE
- };
-
- if (dev->eeprom_mode != EEPROM_MODE_EFUSE)
- return mt7996_mcu_set_eeprom_flash(dev);
-
- return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
- &req, sizeof(req), true);
-}
-
int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
enum mt7996_eeprom_mode mode)
{
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index d36fb5396141..5f574ebe81cc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -184,6 +184,11 @@ enum mt7996_eeprom_mode {
EEPROM_MODE_EXT,
};
+#define MT7996_EFUSE_BASE_OFFS_ADIE0 0x400
+#define MT7996_EFUSE_BASE_OFFS_ADIE1 0x1e00
+#define MT7996_EFUSE_BASE_OFFS_ADIE2 0x1200
+#define MT7992_EFUSE_BASE_OFFS_ADIE1 0x1200
+
enum mt7996_txq_id {
MT7996_TXQ_FWDL = 16,
MT7996_TXQ_MCU_WM,
--
2.51.0
^ permalink raw reply related
* [PATCH mt76 2/3] wifi: mt76: mt7996: add variant for MT7992 chipsets
From: Shayne Chen @ 2026-02-12 9:03 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, Shayne Chen
In-Reply-To: <20260212090310.3335392-1-shayne.chen@mediatek.com>
Introduce VAR_TYPE_24 for the MT7992 chipsets, a dual-band variant
supporting 3T3R/2SS on the 2 GHz band and 5T5R/4SS on the 5GHz band.
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 5 ++++-
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 7 +++++++
4 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
index 00c72be8498f..ac05f7d75d63 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
@@ -33,6 +33,8 @@ static char *mt7996_eeprom_name(struct mt7996_dev *dev)
if (dev->var.fem == MT7996_FEM_INT)
return MT7992_EEPROM_DEFAULT_23_INT;
return MT7992_EEPROM_DEFAULT_23;
+ case MT7992_VAR_TYPE_24:
+ return MT7992_EEPROM_DEFAULT_24;
case MT7992_VAR_TYPE_44:
default:
if (dev->var.fem == MT7996_FEM_INT)
@@ -392,7 +394,8 @@ bool mt7996_eeprom_has_background_radar(struct mt7996_dev *dev)
return false;
break;
case MT7992_DEVICE_ID:
- if (dev->var.type == MT7992_VAR_TYPE_23)
+ if (dev->var.type == MT7992_VAR_TYPE_23 ||
+ dev->var.type == MT7992_VAR_TYPE_24)
return false;
break;
case MT7990_DEVICE_ID: {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index 1fab04909831..3b4f808b968c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -1173,7 +1173,7 @@ static int mt7996_variant_type_init(struct mt7996_dev *dev)
else if (u32_get_bits(val, MT_PAD_GPIO_ADIE_COMB_7992))
var_type = MT7992_VAR_TYPE_44;
else
- return -EINVAL;
+ var_type = MT7992_VAR_TYPE_24;
break;
case MT7990_DEVICE_ID:
var_type = MT7990_VAR_TYPE_23;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 46099486ec09..98db3bcf76f0 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -18,6 +18,9 @@
case MT7992_VAR_TYPE_23: \
_fw = MT7992_##name##_23; \
break; \
+ case MT7992_VAR_TYPE_24: \
+ _fw = MT7992_##name##_24; \
+ break; \
default: \
_fw = MT7992_##name; \
} \
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index ea1f656a9334..d36fb5396141 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -64,6 +64,11 @@
#define MT7992_FIRMWARE_DSP_23 "mediatek/mt7996/mt7992_dsp_23.bin"
#define MT7992_ROM_PATCH_23 "mediatek/mt7996/mt7992_rom_patch_23.bin"
+#define MT7992_FIRMWARE_WA_24 "mediatek/mt7996/mt7992_wa_24.bin"
+#define MT7992_FIRMWARE_WM_24 "mediatek/mt7996/mt7992_wm_24.bin"
+#define MT7992_FIRMWARE_DSP_24 "mediatek/mt7996/mt7992_dsp_24.bin"
+#define MT7992_ROM_PATCH_24 "mediatek/mt7996/mt7992_rom_patch_24.bin"
+
#define MT7990_FIRMWARE_WA ""
#define MT7990_FIRMWARE_WM "mediatek/mt7996/mt7990_wm.bin"
#define MT7990_FIRMWARE_DSP ""
@@ -79,6 +84,7 @@
#define MT7992_EEPROM_DEFAULT_MIX "mediatek/mt7996/mt7992_eeprom_2i5e.bin"
#define MT7992_EEPROM_DEFAULT_23 "mediatek/mt7996/mt7992_eeprom_23.bin"
#define MT7992_EEPROM_DEFAULT_23_INT "mediatek/mt7996/mt7992_eeprom_23_2i5i.bin"
+#define MT7992_EEPROM_DEFAULT_24 "mediatek/mt7996/mt7992_eeprom_24_2i5i.bin"
#define MT7990_EEPROM_DEFAULT "mediatek/mt7996/mt7990_eeprom.bin"
#define MT7990_EEPROM_DEFAULT_INT "mediatek/mt7996/mt7990_eeprom_2i5i.bin"
@@ -158,6 +164,7 @@ enum mt7996_var_type {
enum mt7992_var_type {
MT7992_VAR_TYPE_44,
MT7992_VAR_TYPE_23,
+ MT7992_VAR_TYPE_24,
};
enum mt7990_var_type {
--
2.51.0
^ permalink raw reply related
* [PATCH mt76 1/3] wifi: mt76: add external EEPROM support for mt799x chipsets
From: Shayne Chen @ 2026-02-12 9:03 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, StanleyYP Wang, Elwin Huang,
Shayne Chen
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
For the MT7992 and MT7990 chipsets, efuse mode is not supported because
there is insufficient space in the efuse to store the calibration data.
Therefore, an additional on-chip EEPROM is added to address this
limitation.
Co-developed-by: Elwin Huang <s09289728096@gmail.com>
Signed-off-by: Elwin Huang <s09289728096@gmail.com>
Co-developed-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
---
.../wireless/mediatek/mt76/mt76_connac_mcu.h | 1 +
.../wireless/mediatek/mt76/mt7996/eeprom.c | 59 +++++++------
.../net/wireless/mediatek/mt76/mt7996/init.c | 3 +-
.../net/wireless/mediatek/mt76/mt7996/mcu.c | 83 ++++++++++++-------
.../net/wireless/mediatek/mt76/mt7996/mcu.h | 43 +++++++++-
.../wireless/mediatek/mt76/mt7996/mt7996.h | 20 ++++-
6 files changed, 148 insertions(+), 61 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
index f44977f9093d..e91966cd5efe 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -1308,6 +1308,7 @@ enum {
MCU_UNI_CMD_PER_STA_INFO = 0x6d,
MCU_UNI_CMD_ALL_STA_INFO = 0x6e,
MCU_UNI_CMD_ASSERT_DUMP = 0x6f,
+ MCU_UNI_CMD_EXT_EEPROM_CTRL = 0x74,
MCU_UNI_CMD_RADIO_STATUS = 0x80,
MCU_UNI_CMD_SDO = 0x88,
};
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
index 8f60772913b4..00c72be8498f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
@@ -153,7 +153,7 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
dev_warn(dev->mt76.dev, "eeprom load fail, use default bin\n");
memcpy(eeprom, fw->data, MT7996_EEPROM_SIZE);
- dev->flash_mode = true;
+ dev->eeprom_mode = EEPROM_MODE_DEFAULT_BIN;
out:
release_firmware(fw);
@@ -163,26 +163,31 @@ mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)
static int mt7996_eeprom_load(struct mt7996_dev *dev)
{
+ u32 eeprom_blk_size, block_num;
bool use_default = false;
- int ret;
+ int ret, i;
ret = mt76_eeprom_init(&dev->mt76, MT7996_EEPROM_SIZE);
if (ret < 0)
return ret;
if (ret && !mt7996_check_eeprom(dev)) {
- dev->flash_mode = true;
+ dev->eeprom_mode = EEPROM_MODE_FLASH;
goto out;
}
- if (!dev->flash_mode) {
- u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
- u32 block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
+ memset(dev->mt76.eeprom.data, 0, MT7996_EEPROM_SIZE);
+ if (mt7996_has_ext_eeprom(dev)) {
+ /* external eeprom mode */
+ dev->eeprom_mode = EEPROM_MODE_EXT;
+ eeprom_blk_size = MT7996_EXT_EEPROM_BLOCK_SIZE;
+ } else {
u8 free_block_num;
- int i;
- memset(dev->mt76.eeprom.data, 0, MT7996_EEPROM_SIZE);
- ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num);
+ /* efuse mode */
+ dev->eeprom_mode = EEPROM_MODE_EFUSE;
+ eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
+ ret = mt7996_mcu_get_efuse_free_block(dev, &free_block_num);
if (ret < 0)
return ret;
@@ -191,27 +196,29 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev)
use_default = true;
goto out;
}
+ }
+
+ /* check if eeprom data from fw is valid */
+ if (mt7996_mcu_get_eeprom(dev, 0, NULL, eeprom_blk_size,
+ dev->eeprom_mode) ||
+ mt7996_check_eeprom(dev)) {
+ use_default = true;
+ goto out;
+ }
+
+ /* read eeprom data from fw */
+ block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);
+ for (i = 1; i < block_num; i++) {
+ u32 len = eeprom_blk_size;
- /* check if eeprom data from fw is valid */
- if (mt7996_mcu_get_eeprom(dev, 0, NULL, 0) ||
- mt7996_check_eeprom(dev)) {
+ if (i == block_num - 1)
+ len = MT7996_EEPROM_SIZE % eeprom_blk_size;
+ ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size,
+ NULL, len, dev->eeprom_mode);
+ if (ret && ret != -EINVAL) {
use_default = true;
goto out;
}
-
- /* read eeprom data from fw */
- for (i = 1; i < block_num; i++) {
- u32 len = eeprom_blk_size;
-
- if (i == block_num - 1)
- len = MT7996_EEPROM_SIZE % eeprom_blk_size;
- ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size,
- NULL, len);
- if (ret && ret != -EINVAL) {
- use_default = true;
- goto out;
- }
- }
}
out:
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index 2937e89ad0c9..1fab04909831 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -1207,7 +1207,8 @@ static int mt7996_variant_fem_init(struct mt7996_dev *dev)
if (ret)
return ret;
- ret = mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf, sizeof(buf));
+ ret = mt7996_mcu_get_eeprom(dev, MT7976C_EFUSE_OFFSET, buf, sizeof(buf),
+ EEPROM_MODE_EFUSE);
if (ret && ret != -EINVAL)
return ret;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 9ccf9f97c984..46099486ec09 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3950,7 +3950,7 @@ static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
#define MAX_PAGE_IDX_MASK GENMASK(7, 5)
#define PAGE_IDX_MASK GENMASK(4, 2)
#define PER_PAGE_SIZE 0x400
- struct mt7996_mcu_eeprom req = {
+ struct mt7996_mcu_eeprom_update req = {
.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
.buffer_mode = EE_MODE_BUFFER
};
@@ -3992,57 +3992,80 @@ static int mt7996_mcu_set_eeprom_flash(struct mt7996_dev *dev)
int mt7996_mcu_set_eeprom(struct mt7996_dev *dev)
{
- struct mt7996_mcu_eeprom req = {
+ struct mt7996_mcu_eeprom_update req = {
.tag = cpu_to_le16(UNI_EFUSE_BUFFER_MODE),
.len = cpu_to_le16(sizeof(req) - 4),
.buffer_mode = EE_MODE_EFUSE,
.format = EE_FORMAT_WHOLE
};
- if (dev->flash_mode)
+ if (dev->eeprom_mode != EEPROM_MODE_EFUSE)
return mt7996_mcu_set_eeprom_flash(dev);
return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(EFUSE_CTRL),
&req, sizeof(req), true);
}
-int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len)
+int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
+ enum mt7996_eeprom_mode mode)
{
- struct {
- u8 _rsv[4];
-
- __le16 tag;
- __le16 len;
- __le32 addr;
- __le32 valid;
- u8 data[16];
- } __packed req = {
- .tag = cpu_to_le16(UNI_EFUSE_ACCESS),
- .len = cpu_to_le16(sizeof(req) - 4),
- .addr = cpu_to_le32(round_down(offset,
- MT7996_EEPROM_BLOCK_SIZE)),
+ struct mt7996_mcu_eeprom_access req = {
+ .info.len = cpu_to_le16(sizeof(req) - 4),
};
+ struct mt7996_mcu_eeprom_access_event *event;
struct sk_buff *skb;
- bool valid;
- int ret;
+ int ret, cmd;
+ u32 addr;
+
+ switch (mode) {
+ case EEPROM_MODE_EFUSE:
+ addr = round_down(offset, MT7996_EEPROM_BLOCK_SIZE);
+ cmd = MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL);
+ req.info.tag = cpu_to_le16(UNI_EFUSE_ACCESS);
+ break;
+ case EEPROM_MODE_EXT:
+ addr = round_down(offset, MT7996_EXT_EEPROM_BLOCK_SIZE);
+ cmd = MCU_WM_UNI_CMD_QUERY(EXT_EEPROM_CTRL);
+ req.info.tag = cpu_to_le16(UNI_EXT_EEPROM_ACCESS);
+ req.eeprom.ext_eeprom.data_len = cpu_to_le32(buf_len);
+ break;
+ default:
+ return -EINVAL;
+ }
- ret = mt76_mcu_send_and_get_msg(&dev->mt76,
- MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL),
- &req, sizeof(req), true, &skb);
+ req.info.addr = cpu_to_le32(addr);
+ ret = mt76_mcu_send_and_get_msg(&dev->mt76, cmd, &req, sizeof(req),
+ true, &skb);
if (ret)
return ret;
- valid = le32_to_cpu(*(__le32 *)(skb->data + 16));
- if (valid) {
- u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
+ event = (struct mt7996_mcu_eeprom_access_event *)skb->data;
+ if (event->valid) {
+ u32 ret_len = le32_to_cpu(event->eeprom.ext_eeprom.data_len);
+
+ addr = le32_to_cpu(event->addr);
if (!buf)
buf = (u8 *)dev->mt76.eeprom.data + addr;
- if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
- buf_len = MT7996_EEPROM_BLOCK_SIZE;
- skb_pull(skb, 48);
- memcpy(buf, skb->data, buf_len);
+ switch (mode) {
+ case EEPROM_MODE_EFUSE:
+ if (!buf_len || buf_len > MT7996_EEPROM_BLOCK_SIZE)
+ buf_len = MT7996_EEPROM_BLOCK_SIZE;
+
+ memcpy(buf, event->eeprom.efuse, buf_len);
+ break;
+ case EEPROM_MODE_EXT:
+ if (!buf_len || buf_len > MT7996_EXT_EEPROM_BLOCK_SIZE)
+ buf_len = MT7996_EXT_EEPROM_BLOCK_SIZE;
+
+ memcpy(buf, event->eeprom.ext_eeprom.data,
+ ret_len < buf_len ? ret_len : buf_len);
+ break;
+ default:
+ ret = -EINVAL;
+ break;
+ }
} else {
ret = -EINVAL;
}
@@ -4052,7 +4075,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_l
return ret;
}
-int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num)
+int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num)
{
struct {
u8 _rsv[4];
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
index d70540982983..39df13679779 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -145,7 +145,7 @@ struct mt7996_mcu_background_chain_ctrl {
u8 rsv[2];
} __packed;
-struct mt7996_mcu_eeprom {
+struct mt7996_mcu_eeprom_update {
u8 _rsv[4];
__le16 tag;
@@ -155,6 +155,43 @@ struct mt7996_mcu_eeprom {
__le16 buf_len;
} __packed;
+union eeprom_data {
+ struct {
+ __le32 data_len;
+ DECLARE_FLEX_ARRAY(u8, data);
+ } ext_eeprom;
+ DECLARE_FLEX_ARRAY(u8, efuse);
+} __packed;
+
+struct mt7996_mcu_eeprom_info {
+ u8 _rsv[4];
+
+ __le16 tag;
+ __le16 len;
+ __le32 addr;
+ __le32 valid;
+} __packed;
+
+struct mt7996_mcu_eeprom_access {
+ struct mt7996_mcu_eeprom_info info;
+ union eeprom_data eeprom;
+} __packed;
+
+struct mt7996_mcu_eeprom_access_event {
+ u8 _rsv[4];
+
+ __le16 tag;
+ __le16 len;
+ __le32 version;
+ __le32 addr;
+ __le32 valid;
+ __le32 size;
+ __le32 magic_no;
+ __le32 type;
+ __le32 rsv[4];
+ union eeprom_data eeprom;
+} __packed;
+
struct mt7996_mcu_phy_rx_info {
u8 category;
u8 rate;
@@ -875,6 +912,10 @@ enum {
UNI_EFUSE_BUFFER_RD,
};
+enum {
+ UNI_EXT_EEPROM_ACCESS = 1,
+};
+
enum {
UNI_VOW_DRR_CTRL,
UNI_VOW_RX_AT_AIRTIME_EN = 0x0b,
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 3ff730e36fa6..ea1f656a9334 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -85,6 +85,7 @@
#define MT7996_EEPROM_SIZE 7680
#define MT7996_EEPROM_BLOCK_SIZE 16
+#define MT7996_EXT_EEPROM_BLOCK_SIZE 1024
#define MT7996_TOKEN_SIZE 16384
#define MT7996_HW_TOKEN_SIZE 8192
@@ -169,6 +170,13 @@ enum mt7996_fem_type {
MT7996_FEM_MIX,
};
+enum mt7996_eeprom_mode {
+ EEPROM_MODE_DEFAULT_BIN,
+ EEPROM_MODE_EFUSE,
+ EEPROM_MODE_FLASH,
+ EEPROM_MODE_EXT,
+};
+
enum mt7996_txq_id {
MT7996_TXQ_FWDL = 16,
MT7996_TXQ_MCU_WM,
@@ -441,7 +449,7 @@ struct mt7996_dev {
u32 hw_pattern;
- bool flash_mode:1;
+ u8 eeprom_mode;
bool has_eht:1;
struct {
@@ -717,8 +725,9 @@ int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct mt7996_sta *msta,
void *data, u8 link_id, u32 field);
int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
-int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
-int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);
+int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len,
+ enum mt7996_eeprom_mode mode);
+int mt7996_mcu_get_efuse_free_block(struct mt7996_dev *dev, u8 *block_num);
int mt7996_mcu_get_chip_config(struct mt7996_dev *dev, u32 *cap);
int mt7996_mcu_set_ser(struct mt7996_dev *dev, u8 action, u8 set, u8 band);
int mt7996_mcu_set_txbf(struct mt7996_dev *dev, u8 action);
@@ -816,6 +825,11 @@ static inline bool mt7996_has_wa(struct mt7996_dev *dev)
return !is_mt7990(&dev->mt76);
}
+static inline bool mt7996_has_ext_eeprom(struct mt7996_dev *dev)
+{
+ return !is_mt7996(&dev->mt76);
+}
+
void mt7996_mac_init(struct mt7996_dev *dev);
u32 mt7996_mac_wtbl_lmac_addr(struct mt7996_dev *dev, u16 wcid, u8 dw);
bool mt7996_mac_wtbl_update(struct mt7996_dev *dev, int idx, u32 mask);
--
2.51.0
^ permalink raw reply related
* Re: [PATCH wireless-next v3] wifi: mac80211: Fix AAD/Nonce computation for management frames with MLO
From: Chien Wong @ 2026-02-12 9:58 UTC (permalink / raw)
To: Sai Pratyusha Magam, johannes; +Cc: linux-wireless, sai.magam, quic_drohan
In-Reply-To: <20260212042601.2250514-1-sai.magam@oss.qualcomm.com>
Hey,
While adding MLO decryption feature to Wireshark, I noticed this issue that
mac80211_hwsim handles MLO management frames encryption incorrectly.
It seems that wlantest can also verify the correctness of the encryption?
However, I couldn't get it to work—wlantest keeps reporting 'No PTK known
to decrypt the frame', but at least I verified using Wireshark that the
encryption of unicast data frames and management frames in MLO is correct
with the patch.
BTW, the changes to Wireshark are already in the upstream repository. If you
want to use it for verification, you need to compile it yourself because
the currently released version does not yet include these changes.
Tested on base commit 05f7e89ab9731565d8a62e3b5d1ec206485eeb0(v6.19)
Tested case eht_mld_sae_two_link from hostapd
Tested-by: Chien Wong <m@xv97.com>
^ permalink raw reply
* Re: [PATCH] wifi: iwlwifi: ptp: Fix potential race condition in PTP removal
From: Junjie Cao @ 2026-02-12 10:24 UTC (permalink / raw)
To: miriam.rachel.korenblit, johannes.berg, linux-wireless,
richardcochran
Cc: horms, netdev, linux-kernel, yedidya.ben.shimol, avraham.stern,
daniel.gabay, krishnanand.prabhu, luciano.coelho,
gregory.greenman, stable
In-Reply-To: <DM3PPF63A6024A9E1EF4081E342AF4BED81A365A@DM3PPF63A6024A9.namprd11.prod.outlook.com>
Hi Miri,
You're right -- cancel_delayed_work_sync() handles re-arming by design,
and the work is scheduled with a 1-hour delay (IWL_PTP_WRAP_TIME =
3600 * HZ), so it cannot realistically fire again during the
microsecond-scale teardown window.
The real issue is simply that the delayed work can execute between
ptp_clock_unregister() and cancel_delayed_work_sync(), observing
partially cleared PTP state.
I'll send a v2 with a corrected commit message, and also split the
patch into two (one per sub-driver) as Simon suggested.
Thanks for the review!
Junjie
^ permalink raw reply
* Re: [PATCH wireless-next v8 2/3] wifi: cfg80211: add initial UHR support
From: Harshitha Prem @ 2026-02-12 11:08 UTC (permalink / raw)
To: Johannes Berg, linux-wireless
Cc: Karthikeyan Kathirvel, vasanthakumar.thiagarajan
In-Reply-To: <f96125eeda23451c19067359eb9d10b4047bcdd3.camel@sipsolutions.net>
On 2/11/2026 7:49 PM, Johannes Berg wrote:
> WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.
>
> On Fri, 2026-01-30 at 16:21 +0100, Johannes Berg wrote:
>>
>> @@ -6462,6 +6486,17 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
>> cap->datalen - 1))
>> return -EINVAL;
>> }
>> +
>> + cap = cfg80211_find_ext_elem(WLAN_EID_EXT_UHR_OPER, ies, ies_len);
>> + if (cap) {
>> + if (!cap->datalen)
>> + return -EINVAL;
>> + params->uhr_oper = (void *)(cap->data + 1);
>> + if (!ieee80211_uhr_oper_size_ok((const u8 *)params->uhr_oper,
>> + cap->datalen - 1, true))
>> + return -EINVAL;
>> + }
>> +
>
> OK, I just basically copied this from EHT, but it's useless. Due to the
> reduced information in the beacon, we don't really have anything here
> (such as NPCA timings.)
>
> Should we add a separate netlink attribute for the UHR operation, which
> hostapd would fill with the _full_ data like it appears in association
> response etc.?
>
> That way, hostapd doesn't need to build a separate data/attribute
> structure but can just use hostapd_eid_uhr_operation(..., false) for it.
>
> An alternative would be to add more attributes for everything, but it's
> probably more complicated on both sides?
>
> johannes
>
Hi Johannes,
Thank you for the suggestions.
We feel that using separate nested attributes for each feature is the better approach, as this allows us to reuse the attributes for the Enhanced BSS Parameter Critical Update procedure, where similar information is carried in the UHR parameters update element.
While this approach is slightly more verbose, we believe it offers better extensibility for the future.
Please let us know your thoughts.
Regards,
Harshitha
^ permalink raw reply
* [PATCH ath-next v2 0/4] wifi: ath12k: harden stats/rate handling for WCN785x stability
From: m.limarencko @ 2026-02-12 12:17 UTC (permalink / raw)
To: jjohnson; +Cc: linux-wireless, ath12k, linux-kernel, Mikhail Limarenko
From: Mikhail Limarenko <m.limarencko@yandex.ru>
Hi Jeff, all,
On QCNFA765/WCN785x (PCI, kernel 6.18.5) we observed three recurring
issues:
- chan info events with frequency not present in local survey range,
producing invalid idx warnings;
- frequent VDEV_STAT polling can block for 3 seconds on fw_stats_done
timeouts and cause visible hitches;
- occasional invalid MCS metadata (for example HE MCS=12) propagates
into mac80211 status handling and correlates with ieee80211_rx_list
warnings.
This series addresses those cases by:
1. returning an explicit error from freq_to_idx() when no channel
matches, and rejecting negative indexes in callers;
2. reducing the wait on VDEV_STAT fw_stats completion and skipping
unnecessary waits for stats types that do not require it;
3. sanitizing invalid MCS metadata in both dp_rx and dp_mon paths by
falling back to legacy metadata with ratelimited diagnostics.
Tested on:
- hardware: QCNFA765 (WCN785x)
- kernel: 6.18.5+deb13-amd64
- AP mode: 5 GHz (802.11ac)
Observed after applying this series:
- station dump polling no longer shows multi-second stalls in test runs;
- no fresh ieee80211_rx_list WARN was observed in the same windows.
v2:
- patch 1/4 commit message no longer claims OOB in chan-info paths
- patch 1/4 keeps matched-frequency index progression unchanged
- patch 1/4 returns -ENOENT on no-match and callers reject negative idx
Thanks,
Mikhail Limarenko
Mikhail Limarenko (4):
wifi: ath12k: return error when survey frequency is not found
wifi: ath12k: avoid long fw_stats waits on vdev stats hot path
wifi: ath12k: sanitize invalid MCS metadata in rx path
wifi: ath12k: sanitize invalid MCS metadata in monitor rx path
drivers/net/wireless/ath/ath12k/dp_mon.c | 38 ++++++++++++++---------
drivers/net/wireless/ath/ath12k/dp_rx.c | 39 ++++++++++++++----------
drivers/net/wireless/ath/ath12k/mac.c | 22 +++++++++++--
drivers/net/wireless/ath/ath12k/wmi.c | 9 +++------
4 files changed, 70 insertions(+), 38 deletions(-)
--
2.47.3
^ permalink raw reply
* [PATCH ath-next v2 2/4] wifi: ath12k: avoid long fw_stats waits on vdev stats hot path
From: m.limarencko @ 2026-02-12 12:17 UTC (permalink / raw)
To: jjohnson; +Cc: linux-wireless, ath12k, linux-kernel, Mikhail Limarenko
In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru>
From: Mikhail Limarenko <m.limarencko@yandex.ru>
Station info requests can trigger frequent VDEV stat pulls from
user space (iw/NM polling).
On affected firmware, waiting 3 seconds for fw_stats_done causes
repeated stalls and visible hitches.
Use a short timeout for VDEV_STAT requests and skip unnecessary
waits for stats types that do not need completion
synchronization.
Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64
Signed-off-by: Mikhail Limarenko <m.limarencko@yandex.ru>
---
drivers/net/wireless/ath/ath12k/mac.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 095b49a..1b550e9 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -4829,6 +4829,7 @@ int ath12k_mac_get_fw_stats(struct ath12k *ar,
{
struct ath12k_base *ab = ar->ab;
struct ath12k_hw *ah = ath12k_ar_to_ah(ar);
+ unsigned long done_timeout = 3 * HZ;
unsigned long time_left;
int ret;
@@ -4859,15 +4860,32 @@ int ath12k_mac_get_fw_stats(struct ath12k *ar,
return -ETIMEDOUT;
}
+ /* VDEV stats are queried frequently from station info paths (e.g. iw/NM).
+ * On buggy firmware this path can timeout repeatedly and block callers for
+ * multiple seconds; keep the hot path responsive while preserving behavior
+ * for other stats types.
+ */
+ if (param->stats_id & WMI_REQUEST_VDEV_STAT)
+ done_timeout = msecs_to_jiffies(200);
+
+ /* Non-vdev/bcn stats are handled in a single event. */
+ if (!(param->stats_id & (WMI_REQUEST_VDEV_STAT | WMI_REQUEST_BCN_STAT)))
+ return 0;
+
/* Firmware sends WMI_UPDATE_STATS_EVENTID back-to-back
* when stats data buffer limit is reached. fw_stats_complete
* is completed once host receives first event from firmware, but
* still there could be more events following. Below is to wait
* until firmware completes sending all the events.
*/
- time_left = wait_for_completion_timeout(&ar->fw_stats_done, 3 * HZ);
+ time_left = wait_for_completion_timeout(&ar->fw_stats_done, done_timeout);
if (!time_left) {
- ath12k_warn(ab, "time out while waiting for fw stats done\n");
+ if (param->stats_id & WMI_REQUEST_VDEV_STAT)
+ ath12k_dbg(ab, ATH12K_DBG_WMI,
+ "time out while waiting for fw stats done (stats_id 0x%x)\n",
+ param->stats_id);
+ else
+ ath12k_warn(ab, "time out while waiting for fw stats done\n");
return -ETIMEDOUT;
}
--
2.47.3
^ permalink raw reply related
* [PATCH ath-next v2 1/4] wifi: ath12k: return error when survey frequency is not found
From: m.limarencko @ 2026-02-12 12:17 UTC (permalink / raw)
To: jjohnson; +Cc: linux-wireless, ath12k, linux-kernel, Mikhail Limarenko
In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru>
From: Mikhail Limarenko <m.limarencko@yandex.ru>
freq_to_idx() currently returns a trailing synthetic index when the
requested channel frequency is not found.
chan-info handlers already bound-check survey index, but an explicit
error on no-match keeps semantics clear and avoids propagating a fake
index value.
Keep matched-frequency index progression unchanged, return -ENOENT on
no match, and make callers reject negative indexes.
Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64
Signed-off-by: Mikhail Limarenko <m.limarencko@yandex.ru>
---
v2:
- drop out-of-bounds claim from commit message
- keep original index progression for matched frequencies
- return explicit -ENOENT on no-match and reject negative idx in callers
drivers/net/wireless/ath/ath12k/wmi.c | 9 +++------
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index e647b84..a2f8a7c 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -6528,12 +6528,11 @@ static int freq_to_idx(struct ath12k *ar, int freq)
continue;
if (sband->channels[ch].center_freq == freq)
- goto exit;
+ return idx;
}
}
-exit:
- return idx;
+ return -ENOENT;
}
static int ath12k_pull_chan_info_ev(struct ath12k_base *ab, struct sk_buff *skb,
@@ -7475,7 +7474,7 @@ static void ath12k_chan_info_event(struct ath12k_base *ab, struct sk_buff *skb)
}
idx = freq_to_idx(ar, le32_to_cpu(ch_info_ev.freq));
- if (idx >= ARRAY_SIZE(ar->survey)) {
+ if (idx < 0 || idx >= ARRAY_SIZE(ar->survey)) {
ath12k_warn(ab, "chan info: invalid frequency %d (idx %d out of bounds)\n",
ch_info_ev.freq, idx);
goto exit;
@@ -7550,7 +7549,7 @@ ath12k_pdev_bss_chan_info_event(struct ath12k_base *ab, struct sk_buff *skb)
spin_lock_bh(&ar->data_lock);
idx = freq_to_idx(ar, le32_to_cpu(bss_ch_info_ev.freq));
- if (idx >= ARRAY_SIZE(ar->survey)) {
+ if (idx < 0 || idx >= ARRAY_SIZE(ar->survey)) {
ath12k_warn(ab, "bss chan info: invalid frequency %d (idx %d out of bounds)\n",
bss_ch_info_ev.freq, idx);
goto exit;
--
2.47.3
^ permalink raw reply related
* [PATCH ath-next v2 4/4] wifi: ath12k: sanitize invalid MCS metadata in monitor rx path
From: m.limarencko @ 2026-02-12 12:17 UTC (permalink / raw)
To: jjohnson; +Cc: linux-wireless, ath12k, linux-kernel, Mikhail Limarenko
In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru>
From: Mikhail Limarenko <m.limarencko@yandex.ru>
Apply the same invalid-MCS hardening in monitor path status
conversion to keep metadata handling consistent in both data and
monitor pipelines.
Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64
Signed-off-by: Mikhail Limarenko <m.limarencko@yandex.ru>
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 38 ++++++++++++++----------
1 file changed, 23 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index 009c495..6e894ef 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -1922,9 +1922,11 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
case RX_MSDU_START_PKT_TYPE_11N:
rx_status->encoding = RX_ENC_HT;
if (rate_mcs > ATH12K_HT_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in HT mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid HT mcs %u in monitor path, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
rx_status->rate_idx = rate_mcs + (8 * (nss - 1));
@@ -1933,35 +1935,41 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
break;
case RX_MSDU_START_PKT_TYPE_11AC:
rx_status->encoding = RX_ENC_VHT;
- rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_VHT_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in VHT mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid VHT mcs %u in monitor path, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
+ rx_status->rate_idx = rate_mcs;
if (sgi)
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
break;
case RX_MSDU_START_PKT_TYPE_11AX:
- rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_HE_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in HE mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid HE mcs %u in monitor path, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
+ rx_status->rate_idx = rate_mcs;
rx_status->encoding = RX_ENC_HE;
rx_status->he_gi = ath12k_he_gi_to_nl80211_he_gi(sgi);
break;
case RX_MSDU_START_PKT_TYPE_11BE:
- rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_EHT_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in EHT mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid EHT mcs %u in monitor path, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
+ rx_status->rate_idx = rate_mcs;
rx_status->encoding = RX_ENC_EHT;
rx_status->he_gi = ath12k_he_gi_to_nl80211_he_gi(sgi);
break;
--
2.47.3
^ permalink raw reply related
* [PATCH ath-next v2 3/4] wifi: ath12k: sanitize invalid MCS metadata in rx path
From: m.limarencko @ 2026-02-12 12:17 UTC (permalink / raw)
To: jjohnson; +Cc: linux-wireless, ath12k, linux-kernel, Mikhail Limarenko
In-Reply-To: <20260212121746.329619-1-m.limarencko@yandex.ru>
From: Mikhail Limarenko <m.limarencko@yandex.ru>
Malformed or unsupported rate metadata from firmware can carry
invalid MCS values into mac80211 status handling.
This was observed with HE MCS=12 and coincided with
ieee80211_rx_list warnings.
When MCS is out of range, fall back to legacy metadata and use
ratelimited diagnostics.
Tested-on: QCNFA765 (WCN785x), kernel 6.18.5+deb13-amd64
Signed-off-by: Mikhail Limarenko <m.limarencko@yandex.ru>
---
drivers/net/wireless/ath/ath12k/dp_rx.c | 39 +++++++++++++++----------
1 file changed, 23 insertions(+), 16 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index 99d29ed..f0c56a9 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -2534,9 +2534,11 @@ static void ath12k_dp_rx_h_rate(struct ath12k *ar, struct ath12k_dp_rx_info *rx_
case RX_MSDU_START_PKT_TYPE_11N:
rx_status->encoding = RX_ENC_HT;
if (rate_mcs > ATH12K_HT_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in HT mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid HT mcs %u, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
rx_status->rate_idx = rate_mcs + (8 * (nss - 1));
@@ -2546,42 +2548,47 @@ static void ath12k_dp_rx_h_rate(struct ath12k *ar, struct ath12k_dp_rx_info *rx_
break;
case RX_MSDU_START_PKT_TYPE_11AC:
rx_status->encoding = RX_ENC_VHT;
- rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_VHT_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in VHT mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid VHT mcs %u, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
+ rx_status->rate_idx = rate_mcs;
rx_status->nss = nss;
if (sgi)
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
rx_status->bw = ath12k_mac_bw_to_mac80211_bw(bw);
break;
case RX_MSDU_START_PKT_TYPE_11AX:
- rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_HE_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in HE mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid HE mcs %u, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
rx_status->encoding = RX_ENC_HE;
+ rx_status->rate_idx = rate_mcs;
rx_status->nss = nss;
rx_status->he_gi = ath12k_he_gi_to_nl80211_he_gi(sgi);
rx_status->bw = ath12k_mac_bw_to_mac80211_bw(bw);
break;
case RX_MSDU_START_PKT_TYPE_11BE:
- rx_status->rate_idx = rate_mcs;
-
if (rate_mcs > ATH12K_EHT_MCS_MAX) {
- ath12k_warn(ar->ab,
- "Received with invalid mcs in EHT mode %d\n",
- rate_mcs);
+ dev_warn_ratelimited(ar->ab->dev,
+ "ath12k: invalid EHT mcs %u, forcing legacy rate metadata\n",
+ rate_mcs);
+ rx_status->encoding = RX_ENC_LEGACY;
+ rx_status->rate_idx = 0;
break;
}
rx_status->encoding = RX_ENC_EHT;
+ rx_status->rate_idx = rate_mcs;
rx_status->nss = nss;
rx_status->eht.gi = ath12k_mac_eht_gi_to_nl80211_eht_gi(sgi);
rx_status->bw = ath12k_mac_bw_to_mac80211_bw(bw);
--
2.47.3
^ permalink raw reply related
* [PATCH v2 1/2] wifi: iwlwifi: mvm: fix race condition in PTP removal
From: Junjie Cao @ 2026-02-12 12:50 UTC (permalink / raw)
To: miriam.rachel.korenblit, johannes.berg, linux-wireless,
richardcochran
Cc: horms, netdev, linux-kernel, yedidya.ben.shimol, avraham.stern,
daniel.gabay, krishnanand.prabhu, luciano.coelho,
gregory.greenman, stable, Junjie Cao, Vadim Fedorenko
In-Reply-To: <DM3PPF63A6024A9E1EF4081E342AF4BED81A365A@DM3PPF63A6024A9.namprd11.prod.outlook.com>
iwl_mvm_ptp_remove() calls cancel_delayed_work_sync() only after
ptp_clock_unregister() and clearing ptp_data state (ptp_clock,
ptp_clock_info, last_gp2).
This creates a race where the delayed work iwl_mvm_ptp_work() can
execute between ptp_clock_unregister() and cancel_delayed_work_sync(),
observing partially cleared PTP state.
Move cancel_delayed_work_sync() before ptp_clock_unregister() to
ensure the delayed work is fully stopped before any PTP cleanup
begins.
Fixes: 1595ecce1cf3 ("wifi: iwlwifi: mvm: add support for PTP HW clock (PHC)")
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index ad156b82eaa9..efb291ceb0e5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
@@ -323,11 +323,11 @@ void iwl_mvm_ptp_remove(struct iwl_mvm *mvm)
mvm->ptp_data.ptp_clock_info.name,
ptp_clock_index(mvm->ptp_data.ptp_clock));
+ cancel_delayed_work_sync(&mvm->ptp_data.dwork);
ptp_clock_unregister(mvm->ptp_data.ptp_clock);
mvm->ptp_data.ptp_clock = NULL;
memset(&mvm->ptp_data.ptp_clock_info, 0,
sizeof(mvm->ptp_data.ptp_clock_info));
mvm->ptp_data.last_gp2 = 0;
- cancel_delayed_work_sync(&mvm->ptp_data.dwork);
}
}
--
2.48.1
^ permalink raw reply related
* [PATCH v2 2/2] wifi: iwlwifi: mld: fix race condition in PTP removal
From: Junjie Cao @ 2026-02-12 12:50 UTC (permalink / raw)
To: miriam.rachel.korenblit, johannes.berg, linux-wireless,
richardcochran
Cc: horms, netdev, linux-kernel, yedidya.ben.shimol, avraham.stern,
daniel.gabay, krishnanand.prabhu, luciano.coelho,
gregory.greenman, stable, Junjie Cao, Vadim Fedorenko
In-Reply-To: <20260212125035.1345718-1-junjie.cao@intel.com>
iwl_mld_ptp_remove() calls cancel_delayed_work_sync() only after
ptp_clock_unregister() and clearing ptp_data state (ptp_clock,
last_gp2, wrap_counter).
This creates a race where the delayed work iwl_mld_ptp_work() can
execute between ptp_clock_unregister() and cancel_delayed_work_sync(),
observing partially cleared PTP state.
Move cancel_delayed_work_sync() before ptp_clock_unregister() to
ensure the delayed work is fully stopped before any PTP cleanup
begins.
Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
index 231920425c06..b40182320801 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ptp.c
@@ -319,10 +319,10 @@ void iwl_mld_ptp_remove(struct iwl_mld *mld)
mld->ptp_data.ptp_clock_info.name,
ptp_clock_index(mld->ptp_data.ptp_clock));
+ cancel_delayed_work_sync(&mld->ptp_data.dwork);
ptp_clock_unregister(mld->ptp_data.ptp_clock);
mld->ptp_data.ptp_clock = NULL;
mld->ptp_data.last_gp2 = 0;
mld->ptp_data.wrap_counter = 0;
- cancel_delayed_work_sync(&mld->ptp_data.dwork);
}
}
--
2.48.1
^ permalink raw reply related
* [PATCH] wifi: ath11k: Silence remoteproc probe deferral prints
From: Bjorn Andersson @ 2026-02-12 14:52 UTC (permalink / raw)
To: Jeff Johnson
Cc: linux-arm-msm, linux-wireless, ath11k, linux-kernel,
Bjorn Andersson
Upon failing to resolve the remoteproc phandle one ath11k_dbg() and one
ath11k_err() is used to tell the user about the (presumably) temporary
failure.
Reduce the log spam by removing the duplicate print and switching to
dev_err_probe(), in line with how ath12k handles this error.
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath11k/ahb.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
index 8dfe9b40c12626649639fc1dd9da0e5e0c2dcaf1..08d3a0c8f105b26b1548c5d6006f6ea162fe58ff 100644
--- a/drivers/net/wireless/ath/ath11k/ahb.c
+++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -807,10 +807,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab)
}
prproc = rproc_get_by_phandle(rproc_phandle);
- if (!prproc) {
- ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n");
- return -EPROBE_DEFER;
- }
+ if (!prproc)
+ return dev_err_probe(&ab->pdev->dev, -EPROBE_DEFER, "failed to get rproc\n");
ab_ahb->tgt_rproc = prproc;
return 0;
@@ -1190,10 +1188,8 @@ static int ath11k_ahb_probe(struct platform_device *pdev)
ath11k_ahb_init_qmi_ce_config(ab);
ret = ath11k_core_get_rproc(ab);
- if (ret) {
- ath11k_err(ab, "failed to get rproc: %d\n", ret);
+ if (ret)
goto err_ce_free;
- }
ret = ath11k_core_init(ab);
if (ret) {
---
base-commit: fd9678829d6dd0c10fde080b536abf4b1121c346
change-id: 20260212-ath11k-silence-probe-deferr-28c2532bcc1d
Best regards,
--
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
^ permalink raw reply related
* Re: [PATCH] wifi: ath11k: Silence remoteproc probe deferral prints
From: Konrad Dybcio @ 2026-02-12 15:01 UTC (permalink / raw)
To: Bjorn Andersson, Jeff Johnson
Cc: linux-arm-msm, linux-wireless, ath11k, linux-kernel
In-Reply-To: <20260212-ath11k-silence-probe-deferr-v1-1-b8a49bb3c332@oss.qualcomm.com>
On 2/12/26 3:52 PM, Bjorn Andersson wrote:
> Upon failing to resolve the remoteproc phandle one ath11k_dbg() and one
> ath11k_err() is used to tell the user about the (presumably) temporary
> failure.
>
> Reduce the log spam by removing the duplicate print and switching to
> dev_err_probe(), in line with how ath12k handles this error.
>
> Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
> ---
> drivers/net/wireless/ath/ath11k/ahb.c | 10 +++-------
> 1 file changed, 3 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
> index 8dfe9b40c12626649639fc1dd9da0e5e0c2dcaf1..08d3a0c8f105b26b1548c5d6006f6ea162fe58ff 100644
> --- a/drivers/net/wireless/ath/ath11k/ahb.c
> +++ b/drivers/net/wireless/ath/ath11k/ahb.c
> @@ -807,10 +807,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab)
> }
>
> prproc = rproc_get_by_phandle(rproc_phandle);
> - if (!prproc) {
> - ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n");
> - return -EPROBE_DEFER;
> - }
> + if (!prproc)
> + return dev_err_probe(&ab->pdev->dev, -EPROBE_DEFER, "failed to get rproc\n");
I'd like to think this doesn't really change the behavior, but I'd rather
see this that in-house print functions..
> ab_ahb->tgt_rproc = prproc;
>
> return 0;
> @@ -1190,10 +1188,8 @@ static int ath11k_ahb_probe(struct platform_device *pdev)
> ath11k_ahb_init_qmi_ce_config(ab);
>
> ret = ath11k_core_get_rproc(ab);
> - if (ret) {
> - ath11k_err(ab, "failed to get rproc: %d\n", ret);
> + if (ret)
> goto err_ce_free;
> - }
If the rproc handle is unavailable at this point, we undo quite a bit of work
in .probe.. would it make sense to move this check way above?
Konrad
^ permalink raw reply
* Re: [PATCH] wifi: ath11k: Silence remoteproc probe deferral prints
From: Bjorn Andersson @ 2026-02-12 15:16 UTC (permalink / raw)
To: Konrad Dybcio
Cc: Bjorn Andersson, Jeff Johnson, linux-arm-msm, linux-wireless,
ath11k, linux-kernel
In-Reply-To: <f028462c-ae31-4fa5-b414-e03d3a73fdf4@oss.qualcomm.com>
On Thu, Feb 12, 2026 at 04:01:21PM +0100, Konrad Dybcio wrote:
> On 2/12/26 3:52 PM, Bjorn Andersson wrote:
> > Upon failing to resolve the remoteproc phandle one ath11k_dbg() and one
> > ath11k_err() is used to tell the user about the (presumably) temporary
> > failure.
> >
> > Reduce the log spam by removing the duplicate print and switching to
> > dev_err_probe(), in line with how ath12k handles this error.
> >
> > Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
> > ---
> > drivers/net/wireless/ath/ath11k/ahb.c | 10 +++-------
> > 1 file changed, 3 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
> > index 8dfe9b40c12626649639fc1dd9da0e5e0c2dcaf1..08d3a0c8f105b26b1548c5d6006f6ea162fe58ff 100644
> > --- a/drivers/net/wireless/ath/ath11k/ahb.c
> > +++ b/drivers/net/wireless/ath/ath11k/ahb.c
> > @@ -807,10 +807,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab)
> > }
> >
> > prproc = rproc_get_by_phandle(rproc_phandle);
> > - if (!prproc) {
> > - ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n");
> > - return -EPROBE_DEFER;
> > - }
> > + if (!prproc)
> > + return dev_err_probe(&ab->pdev->dev, -EPROBE_DEFER, "failed to get rproc\n");
>
> I'd like to think this doesn't really change the behavior, but I'd rather
> see this that in-house print functions..
>
I'm having problems parsing your sentence. Are you saying you rather see
us keep using the ath11k_* functions?
>
> > ab_ahb->tgt_rproc = prproc;
> >
> > return 0;
> > @@ -1190,10 +1188,8 @@ static int ath11k_ahb_probe(struct platform_device *pdev)
> > ath11k_ahb_init_qmi_ce_config(ab);
> >
> > ret = ath11k_core_get_rproc(ab);
> > - if (ret) {
> > - ath11k_err(ab, "failed to get rproc: %d\n", ret);
> > + if (ret)
> > goto err_ce_free;
> > - }
>
> If the rproc handle is unavailable at this point, we undo quite a bit of work
> in .probe.. would it make sense to move this check way above?
>
Given that devlink doesn't covers this, but presumably cover several of
the above resources, I think that would make sense. It would be a
separate patch regardless...
Regards,
Bjorn
> Konrad
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox