* [PATCH v2 6/9] wifi: mt76: add init_wiphy callback
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
In-Reply-To: <20260625001834.475094-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Add an optional callback for drivers to finalize wiphy state after mt76
has initialized the supported bands and before registration.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 7 +++++++
drivers/net/wireless/mediatek/mt76/mt76.h | 3 +++
2 files changed, 10 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 13c4e8abe281..c4cbf7195b80 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -681,6 +681,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
dev = hw->priv;
dev->hw = hw;
dev->dev = pdev;
+ dev->init_wiphy = NULL;
dev->drv = drv_ops;
dev->dma_dev = pdev;
@@ -779,6 +780,12 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
mt76_check_sband(&dev->phy, &phy->sband_5g, NL80211_BAND_5GHZ);
mt76_check_sband(&dev->phy, &phy->sband_6g, NL80211_BAND_6GHZ);
+ if (dev->init_wiphy) {
+ ret = dev->init_wiphy(dev);
+ if (ret)
+ return ret;
+ }
+
if (IS_ENABLED(CONFIG_MT76_LEDS)) {
ret = mt76_led_init(phy);
if (ret)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 07955555f84d..0d185675689a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -940,6 +940,9 @@ struct mt76_dev {
const struct mt76_bus_ops *bus;
const struct mt76_driver_ops *drv;
const struct mt76_mcu_ops *mcu_ops;
+
+ /* Optional callback to finalize wiphy state before registration. */
+ int (*init_wiphy)(struct mt76_dev *dev);
struct device *dev;
struct device *dma_dev;
--
2.43.0
^ permalink raw reply related
* [PATCH v2 5/9] wifi: mt76: mt7925: add NAN MCU handling
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
In-Reply-To: <20260625001834.475094-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Route NAN MCU responses and unsolicited events through the mt7925 MCU
path, and handle NAN-specific BSS and station TLVs.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
.../net/wireless/mediatek/mt76/mt7925/mcu.c | 99 ++++++++++++++++---
1 file changed, 84 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index cff91b4eeac6..f58f24583453 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -7,10 +7,17 @@
#include "regd.h"
#include "mcu.h"
#include "mac.h"
+#include "nan.h"
#define MT_STA_BFER BIT(0)
#define MT_STA_BFEE BIT(1)
+static bool mt7925_vif_is_nan(struct ieee80211_vif *vif)
+{
+ return vif->type == NL80211_IFTYPE_NAN ||
+ vif->type == NL80211_IFTYPE_NAN_DATA;
+}
+
int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
struct sk_buff *skb, int seq)
{
@@ -37,7 +44,8 @@ int mt7925_mcu_parse_response(struct mt76_dev *mdev, int cmd,
cmd == MCU_UNI_CMD(BSS_INFO_UPDATE) ||
cmd == MCU_UNI_CMD(STA_REC_UPDATE) ||
cmd == MCU_UNI_CMD(OFFLOAD) ||
- cmd == MCU_UNI_CMD(SUSPEND)) {
+ cmd == MCU_UNI_CMD(SUSPEND) ||
+ cmd == MCU_UNI_CMD(NAN)) {
struct mt7925_mcu_uni_event *event;
skb_pull(skb, sizeof(*rxd));
@@ -631,6 +639,9 @@ mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
dev->fw_assert = true;
mt76_connac_mcu_coredump_event(&dev->mt76, skb, &dev->coredump);
return;
+ case MCU_UNI_EVENT_NAN:
+ mt7925_nan_mcu_event(dev, skb);
+ break;
default:
break;
}
@@ -1835,9 +1846,20 @@ mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
phy = (struct sta_rec_phy *)tlv;
- phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
- chandef->chan->band,
- link_sta);
+
+ if (mt7925_vif_is_nan(vif)) {
+ enum nl80211_band band = chandef->chan ? chandef->chan->band
+ : NL80211_BAND_2GHZ;
+ phy->phy_type = PHY_TYPE_BIT_OFDM | PHY_TYPE_BIT_ERP;
+ phy->phy_type |= mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
+ band,
+ link_sta);
+ } else {
+ phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif,
+ chandef->chan->band,
+ link_sta);
+ }
+
phy->basic_rate = cpu_to_le16((u16)link_conf->basic_rates);
if (link_sta->ht_cap.ht_supported) {
af = link_sta->ht_cap.ampdu_factor;
@@ -1910,11 +1932,15 @@ mt7925_mcu_sta_rate_ctrl_tlv(struct sk_buff *skb,
mconf = mt792x_vif_to_link(mvif, link_sta->link_id);
chandef = mconf->mt76.ctx ? &mconf->mt76.ctx->def :
&link_conf->chanreq.oper;
- band = chandef->chan->band;
tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA, sizeof(*ra_info));
ra_info = (struct sta_rec_ra_info *)tlv;
+ if (mt7925_vif_is_nan(vif))
+ band = chandef->chan ? chandef->chan->band : NL80211_BAND_2GHZ;
+ else
+ band = chandef->chan->band;
+
supp_rates = link_sta->supp_rates[band];
if (band == NL80211_BAND_2GHZ)
supp_rates = FIELD_PREP(RA_LEGACY_OFDM, supp_rates >> 4) |
@@ -2561,6 +2587,29 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
return mode;
}
+static void
+mt7925_mcu_bss_basic_tlv_nan(struct mt76_phy *phy,
+ struct ieee80211_vif *vif,
+ struct ieee80211_link_sta *link_sta,
+ struct mt76_connac_bss_basic_tlv *basic_req)
+{
+ u8 mode_2g, mode_5g;
+
+ mode_2g = mt7925_get_phy_mode_ext(phy, vif, NL80211_BAND_2GHZ,
+ link_sta);
+ mode_5g = mt7925_get_phy_mode_ext(phy, vif, NL80211_BAND_5GHZ,
+ link_sta);
+ basic_req->phymode_ext = mode_2g | mode_5g;
+
+ basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
+
+ mode_2g = mt76_connac_get_phy_mode(phy, vif, NL80211_BAND_2GHZ,
+ link_sta);
+ mode_5g = mt76_connac_get_phy_mode(phy, vif, NL80211_BAND_5GHZ,
+ link_sta);
+ basic_req->phymode = (mode_2g | mode_5g) & ~PHY_MODE_B;
+}
+
static void
mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
struct ieee80211_bss_conf *link_conf,
@@ -2575,7 +2624,7 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
&link_conf->chanreq.oper;
- enum nl80211_band band = chandef->chan->band;
+ enum nl80211_band band = NL80211_BAND_2GHZ;
struct mt76_connac_bss_basic_tlv *basic_req;
struct tlv *tlv;
int conn_type;
@@ -2588,16 +2637,25 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
mconf->mt76.omac_idx;
basic_req->hw_bss_idx = idx;
- basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
- link_sta);
+ if (mt7925_vif_is_nan(vif)) {
+ mt7925_mcu_bss_basic_tlv_nan(phy, vif, link_sta, basic_req);
+ } else {
+ band = chandef->chan->band;
+ basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band,
+ link_sta);
- if (band == NL80211_BAND_2GHZ)
- basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
- else
- basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
+ if (band == NL80211_BAND_2GHZ)
+ basic_req->nonht_basic_phy =
+ cpu_to_le16(PHY_TYPE_ERP_INDEX);
+ else
+ basic_req->nonht_basic_phy =
+ cpu_to_le16(PHY_TYPE_OFDM_INDEX);
+
+ memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
+ basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band,
+ link_sta);
+ }
- memcpy(basic_req->bssid, link_conf->bssid, ETH_ALEN);
- basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, link_sta);
basic_req->bcn_interval = cpu_to_le16(link_conf->beacon_int);
basic_req->dtim_period = link_conf->dtim_period;
basic_req->bmc_tx_wlan_idx = cpu_to_le16(bmc_tx_wlan_idx);
@@ -2630,6 +2688,11 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
basic_req->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
basic_req->active = true;
break;
+ case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_NAN_DATA:
+ basic_req->conn_type = cpu_to_le32(CONNECTION_NAN);
+ basic_req->active = enable;
+ break;
default:
WARN_ON(1);
break;
@@ -2688,10 +2751,11 @@ mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
struct ieee80211_chanctx_conf *ctx,
struct ieee80211_bss_conf *link_conf)
{
+ struct ieee80211_vif *vif = link_conf->vif;
struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
&link_conf->chanreq.oper;
struct mt792x_bss_conf *mconf = mt792x_link_conf_to_mconf(link_conf);
- enum nl80211_band band = chandef->chan->band;
+ enum nl80211_band band = NL80211_BAND_2GHZ;
struct mt76_vif_link *mvif = &mconf->mt76;
struct bss_rate_tlv *bmc;
struct tlv *tlv;
@@ -2702,6 +2766,11 @@ mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
bmc = (struct bss_rate_tlv *)tlv;
+ if (mt7925_vif_is_nan(vif))
+ band = chandef->chan ? chandef->chan->band : NL80211_BAND_2GHZ;
+ else
+ band = chandef->chan->band;
+
if (band == NL80211_BAND_2GHZ)
bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
else
--
2.43.0
^ permalink raw reply related
* [PATCH v2 4/9] wifi: mt76: mt7925: add NAN MCU helpers
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
In-Reply-To: <20260625001834.475094-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Add the mt7925 NAN MCU ABI and helpers for enable, disable, configuration
updates, availability updates and peer schedule commands.
Upper-layer integration is added by later patches.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
.../wireless/mediatek/mt76/mt7925/Makefile | 2 +-
.../net/wireless/mediatek/mt76/mt7925/nan.c | 920 ++++++++++++++++++
.../net/wireless/mediatek/mt76/mt7925/nan.h | 438 +++++++++
.../net/wireless/mediatek/mt76/mt7925/regd.c | 30 +
.../net/wireless/mediatek/mt76/mt7925/regd.h | 3 +
drivers/net/wireless/mediatek/mt76/mt792x.h | 38 +
6 files changed, 1430 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/wireless/mediatek/mt76/mt7925/nan.c
create mode 100644 drivers/net/wireless/mediatek/mt76/mt7925/nan.h
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/Makefile b/drivers/net/wireless/mediatek/mt76/mt7925/Makefile
index 8f1078ce3231..f9dcc0bba393 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/Makefile
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/Makefile
@@ -4,7 +4,7 @@ obj-$(CONFIG_MT7925_COMMON) += mt7925-common.o
obj-$(CONFIG_MT7925E) += mt7925e.o
obj-$(CONFIG_MT7925U) += mt7925u.o
-mt7925-common-y := mac.o mcu.o regd.o main.o init.o debugfs.o
+mt7925-common-y := mac.o mcu.o regd.o main.o init.o debugfs.o nan.o
mt7925-common-$(CONFIG_NL80211_TESTMODE) += testmode.o
mt7925e-y := pci.o pci_mac.o pci_mcu.o
mt7925u-y := usb.o
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/nan.c b/drivers/net/wireless/mediatek/mt76/mt7925/nan.c
new file mode 100644
index 000000000000..dc7aa2cd9449
--- /dev/null
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/nan.c
@@ -0,0 +1,920 @@
+// SPDX-License-Identifier: BSD-3-Clause-Clear
+/* Copyright (C) 2025-2026 MediaTek Inc. */
+
+#include <asm/byteorder.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/stddef.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/ieee80211.h>
+#include <net/cfg80211.h>
+#include <net/mac80211.h>
+
+#include "mt7925.h"
+#include "mcu.h"
+#include "nan.h"
+#include "regd.h"
+
+static void mt7925_nan_set_5g_channel(struct mt792x_dev *dev,
+ struct mt7925_nan_enable_req_tlv *req,
+ struct cfg80211_nan_conf *conf)
+{
+ struct ieee80211_channel *chan;
+ u32 ch5g = 0;
+
+ chan = conf->band_cfgs[NL80211_BAND_5GHZ].chan;
+
+ if (!chan)
+ return;
+
+ if (!mt7925_regd_is_valid_channel(dev, NL80211_BAND_5GHZ, chan))
+ return;
+
+ req->config_5g_channel = 1;
+
+ if (chan->hw_value == NAN_5G_LOW_DISC_CHANNEL)
+ ch5g |= BIT(0);
+ else if (chan->hw_value == NAN_5G_HIGH_DISC_CHANNEL)
+ ch5g |= BIT(1);
+
+ req->channel_5g_val = cpu_to_le32(ch5g);
+}
+
+static void mt7925_nan_set_cluster_id(struct mt7925_nan_enable_req_tlv *req,
+ const u8 *cluster_id)
+{
+ if (!cluster_id)
+ return;
+
+ req->cluster_high = cpu_to_le16(cluster_id[4] | cluster_id[5] << 8);
+ req->cluster_low = cpu_to_le16((u16)cluster_id[3]);
+}
+
+static void mt7925_nan_set_dw_interval(struct mt7925_nan_enable_req_tlv *req,
+ struct cfg80211_nan_conf *conf)
+{
+ if (conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval > 0) {
+ req->config_dw.config_2dot4g_dw_band = 1;
+ req->config_dw.dw_2dot4g_interval_val =
+ cpu_to_le32(conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval);
+ }
+
+ if (conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval > 0) {
+ req->config_dw.config_5g_dw_band = 1;
+ req->config_dw.dw_5g_interval_val =
+ cpu_to_le32(conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval);
+ }
+}
+
+static void mt7925_nan_set_disc_beacon(struct mt7925_nan_enable_req_tlv *req,
+ struct cfg80211_nan_conf *conf)
+{
+ if (conf->discovery_beacon_interval > 0) {
+ req->config_2dot4g_beacons = true;
+ req->beacon_2dot4g_val = conf->discovery_beacon_interval;
+ }
+}
+
+static void mt7925_nan_set_rssi_thresholds(struct mt7925_nan_enable_req_tlv *req,
+ struct cfg80211_nan_conf *conf)
+{
+ if (conf->band_cfgs[NL80211_BAND_2GHZ].chan) {
+ req->config_2dot4g_rssi_close = 1;
+ req->rssi_close_2dot4g_val =
+ abs(conf->band_cfgs[NL80211_BAND_2GHZ].rssi_close);
+ req->config_2dot4g_rssi_middle = 1;
+ req->rssi_middle_2dot4g_val =
+ abs(conf->band_cfgs[NL80211_BAND_2GHZ].rssi_middle);
+ }
+
+ if (conf->band_cfgs[NL80211_BAND_5GHZ].chan) {
+ req->config_5g_rssi_close = 1;
+ req->rssi_close_5g_val =
+ abs(conf->band_cfgs[NL80211_BAND_5GHZ].rssi_close);
+ req->config_5g_rssi_middle = 1;
+ req->rssi_middle_5g_val =
+ abs(conf->band_cfgs[NL80211_BAND_5GHZ].rssi_middle);
+ }
+}
+
+static void mt7925_nan_set_scan_params(struct mt7925_nan_enable_req_tlv *req,
+ struct cfg80211_nan_conf *conf)
+{
+ req->scan_params_val.scan_period[0] =
+ cpu_to_le16(conf->scan_period < 255 ? conf->scan_period : 255);
+ req->scan_params_val.dwell_time[0] =
+ conf->scan_dwell_time < 255 ? conf->scan_dwell_time : 255;
+}
+
+static u16
+mt7925_nan_avail_attr_ctrl(const struct ieee80211_nan_sched_cfg *sched)
+{
+ if (sched->avail_blob_len < NAN_AVAIL_ATTR_CTRL_OFFSET + 2)
+ return 0;
+
+ return sched->avail_blob[NAN_AVAIL_ATTR_CTRL_OFFSET] |
+ sched->avail_blob[NAN_AVAIL_ATTR_CTRL_OFFSET + 1] << 8;
+}
+
+static void
+mt7925_nan_update_conf(struct mt792x_vif *mvif,
+ const struct cfg80211_nan_conf *conf)
+{
+ mvif->nan.conf.master_pref = conf->master_pref;
+ mvif->nan.conf.bands = conf->bands;
+ mvif->nan.conf.discovery_beacon_interval =
+ conf->discovery_beacon_interval;
+ mvif->nan.conf.enable_dw_notification =
+ conf->enable_dw_notification;
+
+ memcpy(mvif->nan.conf.cluster_id, conf->cluster_id, ETH_ALEN);
+}
+
+int mt7925_nan_enable(struct ieee80211_vif *vif,
+ struct mt792x_dev *dev,
+ struct cfg80211_nan_conf *conf)
+{
+ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ struct mt76_dev *mdev = &dev->mt76;
+ struct {
+ u8 rsv[4];
+ struct mt7925_nan_enable_req_tlv nan_req_tlv;
+ } nan_cmd = {
+ .rsv = { 0 },
+ .nan_req_tlv = {
+ .tag = cpu_to_le16(NAN_UNI_CMD_ENABLE_REQUEST),
+ .len = cpu_to_le16(sizeof(struct mt7925_nan_enable_req_tlv)),
+ .config_random_factor_force = 0,
+ .random_factor_force_val = 0,
+ .config_hop_count_force = 0,
+ .hop_count_force_val = 0,
+ },
+ };
+ struct mt7925_nan_enable_req_tlv *p_nan_req_tlv = &nan_cmd.nan_req_tlv;
+
+ if (!vif || !dev || !conf)
+ return -EINVAL;
+
+ p_nan_req_tlv->master_pref = conf->master_pref;
+
+ mt7925_nan_set_5g_channel(dev, p_nan_req_tlv, conf);
+ mt7925_nan_set_cluster_id(p_nan_req_tlv, conf->cluster_id);
+ mt7925_nan_set_dw_interval(p_nan_req_tlv, conf);
+ mt7925_nan_set_disc_beacon(p_nan_req_tlv, conf);
+ mt7925_nan_set_rssi_thresholds(p_nan_req_tlv, conf);
+ mt7925_nan_set_scan_params(p_nan_req_tlv, conf);
+
+ mt7925_nan_update_conf(mvif, conf);
+
+ return mt76_mcu_send_msg(mdev, MCU_UNI_CMD(NAN), &nan_cmd, sizeof(nan_cmd), true);
+}
+
+int mt7925_nan_disable(struct ieee80211_vif *vif, struct mt792x_dev *dev)
+{
+ struct mt76_dev *mdev = &dev->mt76;
+ struct {
+ u8 rsv[4];
+ struct tlv nan_dis_tlv;
+ } nan_cmd = {
+ .rsv = { 0 },
+ .nan_dis_tlv = {
+ .tag = cpu_to_le16(NAN_UNI_CMD_DISABLE_REQUEST),
+ .len = cpu_to_le16(sizeof(struct tlv)),
+ },
+ };
+
+ if (!dev)
+ return -EINVAL;
+
+ return mt76_mcu_send_msg(mdev, MCU_UNI_CMD(NAN), &nan_cmd, sizeof(nan_cmd), true);
+}
+
+static int
+mt7925_nan_mp_tlv(struct sk_buff *skb, u8 master_pref)
+{
+ struct mt7925_nan_master_preference_tlv *mp_tlv = NULL;
+ struct tlv *tlv = NULL;
+
+ if (!skb)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_MASTER_PREFERENCE,
+ sizeof(struct mt7925_nan_master_preference_tlv));
+ if (!tlv)
+ return -ENOMEM;
+
+ mp_tlv = (struct mt7925_nan_master_preference_tlv *)tlv;
+
+ if (master_pref > NAN_MAX_MASTER_PREFERENCE)
+ return 0;
+
+ mp_tlv->master_preference = master_pref;
+
+ return 0;
+}
+
+static int
+mt7925_nan_dw_tlv(struct sk_buff *skb, struct cfg80211_nan_conf *conf)
+{
+ struct mt7925_nan_dw_interval_tlv *dw_tlv = NULL;
+ struct tlv *tlv = NULL;
+ u16 interval;
+
+ if (!skb || !conf)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_DW_INTERVAL,
+ sizeof(struct mt7925_nan_dw_interval_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ dw_tlv = (struct mt7925_nan_dw_interval_tlv *)tlv;
+
+ /* Set DW interval for 2.4GHz and 5GHz bands if available */
+ if (conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval > 0) {
+ dw_tlv->dw_interval = conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval;
+ } else if (conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval > 0) {
+ dw_tlv->dw_interval = conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval;
+ } else {
+ /* Fallback to a default value or log a warning */
+ dw_tlv->dw_interval = NAN_DEFAULT_DW_INTERVAL;
+ }
+
+ /* Validate and set NAN Discovery Beacon Interval */
+ interval = conf->discovery_beacon_interval > 0 ?
+ conf->discovery_beacon_interval :
+ NAN_DEFAULT_DISC_BCN_INTERVAL;
+
+ dw_tlv->disc_bcn_interval = cpu_to_le16(interval);
+
+ return 0;
+}
+
+static int
+mt7925_nan_cluster_id_tlv(struct sk_buff *skb, const u8 *cluster_id)
+{
+ struct mt7925_nan_cluster_id_tlv *cluster_tlv = NULL;
+ struct tlv *tlv = NULL;
+
+ if (!skb || !cluster_id)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_CLUSTER_ID,
+ sizeof(struct mt7925_nan_cluster_id_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ cluster_tlv = (struct mt7925_nan_cluster_id_tlv *)tlv;
+
+ memcpy(cluster_tlv->cluster_id, cluster_id, ETH_ALEN);
+
+ return 0;
+}
+
+static int
+mt7925_nan_sync_rssi_tlv(struct sk_buff *skb, struct cfg80211_nan_conf *conf)
+{
+ struct mt7925_nan_sync_rssi_tlv *rssi_tlv = NULL;
+ struct tlv *tlv = NULL;
+
+ if (!skb || !conf)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_SET_SYNC_RSSI,
+ sizeof(struct mt7925_nan_sync_rssi_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ rssi_tlv = (struct mt7925_nan_sync_rssi_tlv *)tlv;
+
+ if (conf->band_cfgs[NL80211_BAND_2GHZ].chan) {
+ rssi_tlv->rssi_close_2g =
+ conf->band_cfgs[NL80211_BAND_2GHZ].rssi_close;
+ rssi_tlv->rssi_middle_2g =
+ conf->band_cfgs[NL80211_BAND_2GHZ].rssi_middle;
+ }
+
+ if (conf->band_cfgs[NL80211_BAND_5GHZ].chan) {
+ rssi_tlv->rssi_close_5g =
+ conf->band_cfgs[NL80211_BAND_5GHZ].rssi_close;
+ rssi_tlv->rssi_middle_5g =
+ conf->band_cfgs[NL80211_BAND_5GHZ].rssi_middle;
+ }
+
+ return 0;
+}
+
+int mt7925_nan_change_configure(struct ieee80211_vif *vif,
+ struct mt792x_dev *dev,
+ struct cfg80211_nan_conf *conf)
+{
+ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ struct mt7925_nan_common_hdr *hdr = NULL;
+ struct mt76_dev *mdev = &dev->mt76;
+ struct sk_buff *skb = NULL;
+
+ if (!vif || !dev || !conf)
+ return -EINVAL;
+
+ skb = mt76_mcu_msg_alloc(mdev, NULL, MT7925_NAN_CONF_MAX_SIZE);
+ if (!skb)
+ return -ENOMEM;
+
+ hdr = (struct mt7925_nan_common_hdr *)skb_put(skb, sizeof(*hdr));
+ memset(hdr, 0, sizeof(*hdr));
+
+ if (mt7925_nan_mp_tlv(skb, conf->master_pref) ||
+ mt7925_nan_dw_tlv(skb, conf) ||
+ mt7925_nan_cluster_id_tlv(skb, conf->cluster_id) ||
+ mt7925_nan_sync_rssi_tlv(skb, conf)) {
+ dev_kfree_skb(skb);
+ return -ENOMEM;
+ }
+
+ mt7925_nan_update_conf(mvif, conf);
+
+ return mt76_mcu_skb_send_msg(mdev, skb,
+ MCU_UNI_CMD(NAN), true);
+}
+
+static void
+mt7925_nan_handle_dw_ind(struct mt792x_dev *dev, struct tlv *tlv)
+{
+ struct ieee80211_channel *chan;
+ struct nan_rpt_dw_evt *evt;
+ struct wireless_dev *wdev;
+ u16 len, channel, dw_num;
+ struct mt792x_vif *mvif;
+ enum nl80211_band band;
+ int freq;
+
+ if (!dev || !tlv)
+ return;
+
+ len = le16_to_cpu(tlv->len);
+ if (len < sizeof(*tlv) + sizeof(*evt)) {
+ dev_warn(dev->mt76.dev,
+ "nan: short dw event tlv len=%u\n", len);
+ return;
+ }
+
+ if (!dev->nan_vif || !ieee80211_vif_nan_started(dev->nan_vif))
+ return;
+
+ wdev = ieee80211_vif_to_wdev(dev->nan_vif);
+ if (!wdev)
+ return;
+
+ mvif = (struct mt792x_vif *)dev->nan_vif->drv_priv;
+ if (!mvif->nan.conf.enable_dw_notification)
+ return;
+
+ evt = (struct nan_rpt_dw_evt *)tlv->data;
+ channel = le16_to_cpu(evt->channel);
+ dw_num = le16_to_cpu(evt->dw_num);
+
+ band = channel > 13 ? NL80211_BAND_5GHZ : NL80211_BAND_2GHZ;
+ freq = ieee80211_channel_to_frequency(channel, band);
+ chan = ieee80211_get_channel(dev->mt76.hw->wiphy, freq);
+ if (!chan) {
+ dev_dbg(dev->mt76.dev,
+ "nan: no channel for dw end event ch=%u dw=%u\n",
+ channel, dw_num);
+ return;
+ }
+
+ cfg80211_next_nan_dw_notif(wdev, chan, GFP_KERNEL);
+}
+
+static void
+mt7925_nan_mcu_handle_de_event(struct mt792x_dev *dev, struct tlv *tlv)
+{
+ u8 cluster_id[ETH_ALEN] __aligned(2) = {0x50, 0x6f, 0x9a, 0x01, 0x00, 0x00};
+ struct mt7925_nan_de_event *de_evt = NULL;
+ u16 len;
+
+ if (!dev || !tlv) {
+ if (dev)
+ dev_warn(dev->mt76.dev, "nan: failed to parse TLV\n");
+ return;
+ }
+
+ len = le16_to_cpu(tlv->len);
+ if (len < sizeof(*tlv) + sizeof(*de_evt)) {
+ dev_warn(dev->mt76.dev,
+ "nan: short de_event tlv len=%u\n", len);
+ return;
+ }
+
+ de_evt = (struct mt7925_nan_de_event *)tlv->data;
+ if (!de_evt) {
+ dev_warn(dev->mt76.dev, "nan: missing DE event payload\n");
+ return;
+ }
+
+ if (de_evt->event_type == NAN_EVENT_ID_DISC_MAC_ADDR)
+ return;
+
+ memcpy(cluster_id, de_evt->cluster_id, ETH_ALEN);
+
+ dev_dbg(dev->mt76.dev, "nan: evt=%u cluster=%pM\n",
+ de_evt->event_type, de_evt->cluster_id);
+
+ if (de_evt->event_type != NAN_EVENT_ID_JOINED_CLUSTER)
+ return;
+
+ if (!ieee80211_vif_nan_started(dev->nan_vif)) {
+ dev_warn(dev->mt76.dev, "nan: joined-cluster event but NAN not started\n");
+ return;
+ }
+
+ dev_dbg(dev->mt76.dev, "nan: anchor_master_rank=%*phN\n",
+ NAN_ANCHOR_MASTER_RANK_NUM, de_evt->anchor_master_rank);
+
+ dev_dbg(dev->mt76.dev, "nan: own_nmi=%pM master_nmi=%pM\n",
+ de_evt->own_nmi, de_evt->master_nmi);
+
+ ieee80211_nan_cluster_joined(dev->nan_vif, cluster_id, true, GFP_KERNEL);
+}
+
+void mt7925_nan_mcu_event(struct mt792x_dev *dev, struct sk_buff *skb)
+{
+ struct tlv *tlv;
+ u32 tlv_len;
+
+ if (!dev || !skb)
+ return;
+
+ if (skb->len < sizeof(struct mt7925_mcu_rxd) + 4)
+ return;
+
+ skb_pull(skb, sizeof(struct mt7925_mcu_rxd) + 4);
+ tlv = (struct tlv *)skb->data;
+ tlv_len = skb->len;
+
+ while (tlv_len >= sizeof(*tlv)) {
+ u16 len = le16_to_cpu(tlv->len);
+
+ if (len < sizeof(*tlv) || len > tlv_len)
+ break;
+
+ switch (le16_to_cpu(tlv->tag)) {
+ case NAN_UNI_EVENT_ID_DE_EVENT_IND:
+ mt7925_nan_mcu_handle_de_event(dev, tlv);
+ break;
+ case NAN_UNI_EVENT_REPORT_DW_END:
+ mt7925_nan_handle_dw_ind(dev, tlv);
+ break;
+ default:
+ break;
+ }
+
+ tlv_len -= len;
+ tlv = (struct tlv *)((u8 *)tlv + len);
+ }
+}
+
+static int mt7925_nan_avail_ctrl_tlv(struct sk_buff *skb,
+ struct ieee80211_vif *vif)
+{
+ struct mt7925_nan_avail_ctrl_tlv *avail_ctrl_tlv;
+ struct ieee80211_nan_sched_cfg *sched;
+ struct tlv *tlv;
+ u8 seq_id = 0;
+ u16 ctrl = 0;
+
+ if (!skb || !vif)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_UPDATE_AVAILABILITY_CTRL,
+ sizeof(struct mt7925_nan_avail_ctrl_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ sched = &vif->cfg.nan_sched;
+
+ ctrl = mt7925_nan_avail_attr_ctrl(sched);
+ if (sched->avail_blob_len >= NAN_AVAIL_ATTR_CTRL_OFFSET + 2)
+ seq_id = sched->avail_blob[NAN_AVAIL_SEQ_ID_OFFSET];
+
+ avail_ctrl_tlv = (struct mt7925_nan_avail_ctrl_tlv *)tlv;
+ avail_ctrl_tlv->avail_ctrl = ctrl & NAN_AVAIL_CTRL_CHECK_FOR_CHANGED;
+ avail_ctrl_tlv->seq_id = seq_id;
+
+ return 0;
+}
+
+static u32 mt7925_nan_slot_to_bitmap(struct ieee80211_vif *vif,
+ struct mt7925_nan_ch_timeline *ch_list)
+{
+ struct ieee80211_nan_channel **slots = vif->cfg.nan_sched.schedule;
+ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ u32 num_channels = 0;
+ u32 i, j;
+
+ for (i = 0; i < ARRAY_SIZE(mvif->nan.local_sched); i++) {
+ struct cfg80211_chan_def *slot_chan = &mvif->nan.local_sched[i];
+ struct ieee80211_nan_channel *slot = slots[i];
+ bool is_found = false;
+
+ if (slot && !IS_ERR(slot) && slot->chanctx_conf) {
+ *slot_chan = slot->chanctx_conf->def;
+ } else {
+ memset(slot_chan, 0, sizeof(*slot_chan));
+ continue;
+ }
+
+ for (j = 0; j < num_channels; j++) {
+ if (ch_list[j].ch_info.primary_ch ==
+ slot_chan->chan->hw_value) {
+ ch_list[j].avail_map[0] |= BIT(i);
+ ch_list[j].num++;
+ is_found = true;
+ break;
+ }
+ }
+
+ if (!is_found && num_channels < NAN_TIMELINE_MGMT_CHNL_LIST_NUM) {
+ ch_list[num_channels].ch_info.primary_ch =
+ slot_chan->chan->hw_value;
+ ch_list[num_channels].ch_info.op_class =
+ slot->channel_entry[0];
+ ch_list[num_channels].avail_map[0] = BIT(i);
+ ch_list[num_channels].num++;
+ ch_list[num_channels].is_valid++;
+ num_channels++;
+ }
+ }
+
+ return num_channels;
+}
+
+static int mt7925_nan_avail_tlv(struct sk_buff *skb,
+ struct ieee80211_vif *vif)
+{
+ struct mt7925_nan_avail_entry_tlv *avail_tlv;
+ struct ieee80211_nan_sched_cfg *sched;
+ struct tlv *tlv;
+ u16 ctrl = 0;
+
+ if (!skb || !vif)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_UPDATE_AVAILABILITY,
+ sizeof(struct mt7925_nan_avail_entry_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ sched = &vif->cfg.nan_sched;
+
+ ctrl = mt7925_nan_avail_attr_ctrl(sched);
+
+ avail_tlv = (struct mt7925_nan_avail_entry_tlv *)tlv;
+ avail_tlv->map_id = ctrl & NAN_AVAIL_CTRL_MAPID;
+ avail_tlv->is_cond_avail = false;
+ avail_tlv->timeline_idx = 0;
+
+ mt7925_nan_slot_to_bitmap(vif, avail_tlv->ch_list);
+
+ avail_tlv->is_multi_map = false;
+
+ return 0;
+}
+
+void mt7925_nan_local_sched_changed(struct mt792x_dev *dev,
+ struct ieee80211_vif *vif)
+{
+ struct mt7925_nan_common_hdr *hdr;
+ struct mt76_dev *mdev;
+ struct sk_buff *skb;
+
+ if (!dev || !vif)
+ return;
+
+ mdev = &dev->mt76;
+
+ skb = mt76_mcu_msg_alloc(mdev, NULL, MT7925_NAN_AVAIL_MAX_SIZE);
+ if (!skb)
+ return;
+
+ hdr = (struct mt7925_nan_common_hdr *)skb_put(skb, sizeof(*hdr));
+ memset(hdr, 0, sizeof(*hdr));
+
+ if (mt7925_nan_avail_ctrl_tlv(skb, vif) ||
+ mt7925_nan_avail_tlv(skb, vif)) {
+ dev_kfree_skb(skb);
+ return;
+ }
+
+ mt76_mcu_skb_send_msg(mdev, skb,
+ MCU_UNI_CMD(NAN), true);
+}
+
+static int mt7925_nan_peer_rec_tlv(struct sk_buff *skb,
+ struct ieee80211_sta *sta,
+ struct mt792x_sta *msta,
+ u8 is_activate)
+{
+ struct mt7925_nan_sched_manage_peer_rec_tlv *peer_rec_tlv;
+ struct tlv *tlv;
+
+ if (!skb || !sta || !msta)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_MANAGE_PEER_SCH_RECORD,
+ sizeof(struct mt7925_nan_sched_manage_peer_rec_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ peer_rec_tlv = (struct mt7925_nan_sched_manage_peer_rec_tlv *)tlv;
+ peer_rec_tlv->sch_idx = msta->nan_sched.sch_idx;
+ peer_rec_tlv->is_activate = is_activate;
+ memcpy(peer_rec_tlv->nmi_addr, sta->addr, ETH_ALEN);
+
+ return 0;
+}
+
+static int mt7925_nan_peer_cap_tlv(struct sk_buff *skb,
+ struct ieee80211_sta *sta,
+ struct mt792x_sta *msta)
+{
+ struct mt7925_nan_sched_update_peer_cap_tlv *peer_cap_tlv;
+ struct ieee80211_nan_peer_sched *sched;
+ enum nl80211_band band;
+ struct tlv *tlv;
+ u16 primary_ch;
+ u32 i;
+
+ if (!skb || !sta || !msta)
+ return -EINVAL;
+
+ sched = sta->nan_sched;
+ if (!sched)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_UPDATE_PEER_CAPABILITY,
+ sizeof(struct mt7925_nan_sched_update_peer_cap_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ peer_cap_tlv = (struct mt7925_nan_sched_update_peer_cap_tlv *)tlv;
+ peer_cap_tlv->sch_idx = msta->nan_sched.sch_idx;
+ peer_cap_tlv->supported_bands = BIT(NAN_SUPPORTED_BAND_ID_2P4G);
+ peer_cap_tlv->max_chnl_switch_time = sched->max_chan_switch;
+
+ for (i = 0; i < sched->n_channels; i++) {
+ if (!sched->channels[i].chanctx_conf)
+ continue;
+
+ band = sched->channels[i].chanctx_conf->def.chan->band;
+ primary_ch =
+ sched->channels[i].chanctx_conf->def.chan->hw_value;
+
+ if (band == NL80211_BAND_2GHZ)
+ peer_cap_tlv->peer_supported_bands |=
+ BIT(NAN_SUPPORTED_BN_2G);
+ else if (primary_ch >= UNII1_LOWER_BOUND &&
+ primary_ch <= UNII1_UPPER_BOUND)
+ peer_cap_tlv->peer_supported_bands |=
+ BIT(NAN_SUPPORTED_BN_5G_LOW);
+ else if (primary_ch >= UNII3_LOWER_BOUND &&
+ primary_ch <= UNII3_UPPER_BOUND)
+ peer_cap_tlv->peer_supported_bands |=
+ BIT(NAN_SUPPORTED_BN_5G_HIGH);
+ }
+
+ return 0;
+}
+
+static void
+mt7925_nan_fill_crb_committed(struct mt7925_nan_sched_update_crb_tlv *crb_tlv,
+ struct ieee80211_nan_peer_sched *sched)
+{
+ u32 m, slot;
+
+ if (!sched)
+ return;
+
+ for (m = 0; m < CFG80211_NAN_MAX_PEER_MAPS &&
+ m < NAN_TIMELINE_MGMT_SIZE; m++) {
+ struct mt7925_nan_sched_timeline *tl =
+ &crb_tlv->comm_faw_timeline[m];
+ struct ieee80211_nan_peer_map *map = &sched->maps[m];
+
+ if (map->map_id == CFG80211_NAN_INVALID_MAP_ID)
+ continue;
+
+ tl->map_id = map->map_id;
+
+ /*
+ * Convert peer schedule slots to FW avail_map bitmap.
+ * Each bit in avail_map[0] represents one time slot where
+ * the peer has committed availability.
+ */
+ for (slot = 0; slot < CFG80211_NAN_SCHED_NUM_TIME_SLOTS;
+ slot++) {
+ struct ieee80211_nan_channel *ch = map->slots[slot];
+
+ if (!ch || !ch->chanctx_conf)
+ continue;
+
+ tl->avail_map[0] |= cpu_to_le32(BIT(slot));
+ }
+ }
+}
+
+static int mt7925_nan_update_crb_tlv(struct sk_buff *skb,
+ struct ieee80211_sta *sta,
+ struct mt792x_sta *msta)
+{
+ struct mt7925_nan_sched_update_crb_tlv *crb_tlv;
+ struct tlv *tlv;
+
+ if (!skb || !sta || !msta)
+ return -EINVAL;
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_UPDATE_CRB,
+ sizeof(struct mt7925_nan_sched_update_crb_tlv));
+
+ if (!tlv)
+ return -ENOMEM;
+
+ crb_tlv = (struct mt7925_nan_sched_update_crb_tlv *)tlv;
+ crb_tlv->sch_idx = msta->nan_sched.sch_idx;
+ crb_tlv->is_use_data_path = true;
+ crb_tlv->is_use_ranging = false;
+ crb_tlv->comm_ndc_ctrl.is_valid = false;
+
+ mt7925_nan_fill_crb_committed(crb_tlv, sta->nan_sched);
+
+ return 0;
+}
+
+int mt792x_nan_set_peer_schedule(struct mt792x_dev *dev,
+ struct ieee80211_sta *sta)
+{
+ struct mt7925_nan_common_hdr *hdr;
+ struct mt792x_sta *msta;
+ struct mt792x_nan *nan;
+ struct mt76_dev *mdev;
+ struct sk_buff *skb;
+
+ if (!dev || !sta)
+ return -EINVAL;
+
+ mdev = &dev->mt76;
+
+ skb = mt76_mcu_msg_alloc(mdev, NULL, MT7925_NAN_PEER_MAX_SIZE);
+ if (!skb)
+ return -ENOMEM;
+
+ hdr = (struct mt7925_nan_common_hdr *)skb_put(skb, sizeof(*hdr));
+ memset(hdr, 0, sizeof(*hdr));
+
+ msta = (struct mt792x_sta *)sta->drv_priv;
+ nan = &msta->vif->nan;
+
+ /* Allocate connection index on first call for this peer */
+ if (!msta->nan_sched.idx_assigned) {
+ int idx = find_first_zero_bit(&nan->conn_bitmap,
+ NAN_MAX_CONN_CFG);
+ if (idx >= NAN_MAX_CONN_CFG) {
+ dev_kfree_skb(skb);
+ return -ENOSPC;
+ }
+
+ set_bit(idx, &nan->conn_bitmap);
+ msta->nan_sched.sch_idx = idx;
+ msta->nan_sched.idx_assigned = true;
+
+ if (mt7925_nan_peer_rec_tlv(skb, sta, msta, true) ||
+ mt7925_nan_peer_cap_tlv(skb, sta, msta)) {
+ dev_kfree_skb(skb);
+ return -ENOMEM;
+ }
+ }
+
+ if (mt7925_nan_update_crb_tlv(skb, sta, msta)) {
+ dev_kfree_skb(skb);
+ return -ENOMEM;
+ }
+
+ return mt76_mcu_skb_send_msg(mdev, skb,
+ MCU_UNI_CMD(NAN), true);
+}
+
+int mt792x_nan_set_peer_rec(struct mt76_dev *mdev,
+ struct ieee80211_sta *sta)
+{
+ struct mt7925_nan_common_hdr *hdr;
+ struct mt792x_sta *msta;
+ struct mt792x_nan *nan;
+ struct sk_buff *skb;
+
+ if (!mdev || !sta)
+ return -EINVAL;
+
+ skb = mt76_mcu_msg_alloc(mdev, NULL,
+ sizeof(struct mt7925_nan_common_hdr) +
+ sizeof(struct mt7925_nan_sched_manage_peer_rec_tlv));
+ if (!skb)
+ return -ENOMEM;
+
+ hdr = (struct mt7925_nan_common_hdr *)skb_put(skb, sizeof(*hdr));
+ memset(hdr, 0, sizeof(*hdr));
+
+ msta = (struct mt792x_sta *)sta->drv_priv;
+ nan = &msta->vif->nan;
+
+ if (!msta->nan_sched.idx_assigned) {
+ dev_kfree_skb(skb);
+ return 0;
+ }
+
+ if (mt7925_nan_peer_rec_tlv(skb, sta, msta, false)) {
+ dev_kfree_skb(skb);
+ return -ENOMEM;
+ }
+
+ clear_bit(msta->nan_sched.sch_idx, &nan->conn_bitmap);
+ msta->nan_sched.idx_assigned = false;
+
+ return mt76_mcu_skb_send_msg(mdev, skb,
+ MCU_UNI_CMD(NAN), true);
+}
+
+int mt792x_nan_map_sta_rec(struct mt76_dev *mdev,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta)
+{
+ struct mt7925_nan_sched_map_sta_rec_tlv *map_tlv;
+ struct mt7925_nan_common_hdr *hdr;
+ struct ieee80211_sta *nmi_sta;
+ struct mt792x_sta *nmi_msta;
+ struct mt792x_sta *msta;
+ u8 nmi_addr[ETH_ALEN];
+ struct sk_buff *skb;
+ int ndp_ctx_id = 0;
+ struct tlv *tlv;
+
+ if (!mdev || !vif || !sta)
+ return -EINVAL;
+
+ msta = (struct mt792x_sta *)sta->drv_priv;
+
+ rcu_read_lock();
+ nmi_sta = rcu_dereference(sta->nmi);
+ if (!nmi_sta) {
+ rcu_read_unlock();
+ dev_err(mdev->dev, "NAN: NMI sta not found for NDI sta %pM\n",
+ sta->addr);
+ return -EINVAL;
+ }
+
+ memcpy(nmi_addr, nmi_sta->addr, ETH_ALEN);
+ nmi_msta = (struct mt792x_sta *)nmi_sta->drv_priv;
+
+ ndp_ctx_id = find_first_zero_bit(&nmi_msta->nan_sched.ndp_ctx_bitmap,
+ NAN_MAX_NDP_CXT);
+ if (ndp_ctx_id < NAN_MAX_NDP_CXT)
+ set_bit(ndp_ctx_id, &nmi_msta->nan_sched.ndp_ctx_bitmap);
+ else
+ ndp_ctx_id = 0;
+ rcu_read_unlock();
+
+ msta->nan_sched.ndp_ctx_id = ndp_ctx_id;
+
+ skb = mt76_mcu_msg_alloc(mdev, NULL,
+ sizeof(struct mt7925_nan_common_hdr) +
+ sizeof(struct mt7925_nan_sched_map_sta_rec_tlv));
+ if (!skb)
+ return -ENOMEM;
+
+ hdr = (struct mt7925_nan_common_hdr *)skb_put(skb, sizeof(*hdr));
+ memset(hdr, 0, sizeof(*hdr));
+
+ tlv = mt76_connac_mcu_add_tlv(skb, NAN_UNI_CMD_MAP_STA_RECORD,
+ sizeof(struct mt7925_nan_sched_map_sta_rec_tlv));
+ if (!tlv) {
+ dev_kfree_skb(skb);
+ return -ENOMEM;
+ }
+
+ map_tlv = (struct mt7925_nan_sched_map_sta_rec_tlv *)tlv;
+ memcpy(map_tlv->nmi_addr, nmi_addr, ETH_ALEN);
+ map_tlv->sta_rec_idx = msta->deflink.wcid.idx;
+ map_tlv->ndp_ctx_id = ndp_ctx_id;
+ map_tlv->role_idx = 0;
+ memcpy(map_tlv->ndi_addr, vif->addr, ETH_ALEN);
+
+ return mt76_mcu_skb_send_msg(mdev, skb,
+ MCU_UNI_CMD(NAN), true);
+}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/nan.h b/drivers/net/wireless/mediatek/mt76/mt7925/nan.h
new file mode 100644
index 000000000000..1895d0be8ee4
--- /dev/null
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/nan.h
@@ -0,0 +1,438 @@
+/* SPDX-License-Identifier: BSD-3-Clause-Clear */
+/* Copyright (C) 2025-2026 MediaTek Inc. */
+
+#ifndef __MT7925_NAN_H
+#define __MT7925_NAN_H
+
+#include <linux/if_ether.h>
+#include <linux/types.h>
+
+#include "../mt76_connac_mcu.h"
+
+#define NAN_MAX_SOCIAL_CHANNELS 3
+#define NAN_ANCHOR_MASTER_RANK_NUM 8
+#define NAN_5G_LOW_DISC_CHANNEL 44
+#define NAN_5G_HIGH_DISC_CHANNEL 149
+#define NAN_MAX_MASTER_PREFERENCE 255
+#define NAN_DEFAULT_DW_INTERVAL 1
+#define NAN_DEFAULT_DISC_BCN_INTERVAL 100
+#define NAN_TOTAL_DW 16
+#define NAN_SUPPORTED_2G_FAW_CH_NUM 4
+#define NAN_SUPPORTED_5G_FAW_CH_NUM 4
+#define NAN_TIMELINE_MGMT_SIZE 2
+#define NAN_TIMELINE_MGMT_CHNL_LIST_NUM \
+ ((NAN_SUPPORTED_2G_FAW_CH_NUM + \
+ NAN_SUPPORTED_5G_FAW_CH_NUM) / NAN_TIMELINE_MGMT_SIZE)
+#define NAN_NUM_AVAIL_DB 2
+#define NAN_NDC_ATTRIBUTE_ID_LENGTH 6
+#define NAN_MAX_CONN_CFG 8
+#define NAN_MAX_NDP_CXT 4
+
+#define MT7925_NAN_CONF_MAX_SIZE \
+ (sizeof(struct mt7925_nan_common_hdr) + \
+ sizeof(struct mt7925_nan_master_preference_tlv) + \
+ sizeof(struct mt7925_nan_dw_interval_tlv) + \
+ sizeof(struct mt7925_nan_cluster_id_tlv) + \
+ sizeof(struct mt7925_nan_sync_rssi_tlv))
+
+#define MT7925_NAN_AVAIL_MAX_SIZE \
+ (sizeof(struct mt7925_nan_common_hdr) + \
+ sizeof(struct mt7925_nan_avail_ctrl_tlv) + \
+ sizeof(struct mt7925_nan_avail_entry_tlv))
+
+#define MT7925_NAN_PEER_MAX_SIZE \
+ (sizeof(struct mt7925_nan_common_hdr) + \
+ sizeof(struct mt7925_nan_sched_manage_peer_rec_tlv) + \
+ sizeof(struct mt7925_nan_sched_update_peer_cap_tlv) + \
+ sizeof(struct mt7925_nan_sched_update_crb_tlv))
+
+/* NAN Availability Attribute */
+#define NAN_AVAIL_ATTR_ID_OFFSET 0
+#define NAN_AVAIL_ATTR_LEN_OFFSET 1
+#define NAN_AVAIL_SEQ_ID_OFFSET 3
+#define NAN_AVAIL_ATTR_CTRL_OFFSET 4
+
+/* NAN Availability Attribute - Attribute Control Field */
+#define NAN_AVAIL_CTRL_MAPID GENMASK(3, 0)
+#define NAN_AVAIL_CTRL_COMMIT_CHANGED BIT(4)
+#define NAN_AVAIL_CTRL_POTN_CHANGED BIT(5)
+#define NAN_AVAIL_CTRL_PUBLIC_AVAIL_CHANGED BIT(6)
+#define NAN_AVAIL_CTRL_NDC_CHANGED BIT(7)
+#define NAN_AVAIL_CTRL_CHECK_FOR_CHANGED GENMASK(7, 4)
+
+#define UNII1_LOWER_BOUND 36
+#define UNII1_UPPER_BOUND 50
+#define UNII3_LOWER_BOUND 149
+#define UNII3_UPPER_BOUND 165
+
+enum nan_uni_cmd_tag {
+ NAN_UNI_CMD_SET_MASTER_PREFERENCE = 0,
+ NAN_UNI_CMD_ENABLE_REQUEST = 7,
+ NAN_UNI_CMD_DISABLE_REQUEST = 8,
+ NAN_UNI_CMD_UPDATE_AVAILABILITY = 9,
+ NAN_UNI_CMD_UPDATE_CRB = 10,
+ NAN_UNI_CMD_MANAGE_PEER_SCH_RECORD = 12,
+ NAN_UNI_CMD_MAP_STA_RECORD = 13,
+ NAN_UNI_CMD_UPDATE_AVAILABILITY_CTRL = 20,
+ NAN_UNI_CMD_UPDATE_PEER_CAPABILITY = 21,
+ NAN_UNI_CMD_CHANGE_NMI_ADDRESS = 24,
+ NAN_UNI_CMD_SET_DW_INTERVAL = 26,
+ NAN_UNI_CMD_SET_SYNC_RSSI = 39,
+ NAN_UNI_CMD_SET_CLUSTER_ID = 40,
+ NAN_UNI_CMD_KEY_MANAGEMENT = 53,
+};
+
+enum nan_uni_event_tag {
+ NAN_UNI_EVENT_ID_DE_EVENT_IND = 19,
+ NAN_UNI_EVENT_REPORT_DW_END = 60,
+};
+
+enum nan_disc_event_type {
+ NAN_EVENT_ID_DISC_MAC_ADDR = 0,
+ NAN_EVENT_ID_JOINED_CLUSTER = 2,
+};
+
+/* NAN 4.0 Table 79. Device Capability attribute format, Supported Bands */
+enum nan_supported_bands {
+ NAN_SUPPORTED_BAND_ID_2P4G = 2,
+ NAN_SUPPORTED_BAND_ID_5G = 4,
+ NAN_PROPRIETARY_BAND_ID_6G = 6,
+ NAN_SUPPORTED_BAND_ID_6G = 7,
+};
+
+enum nan_peer_supported_bands {
+ NAN_SUPPORTED_BN_2G = 0,
+ NAN_SUPPORTED_BN_5G_LOW,
+ NAN_SUPPORTED_BN_5G_HIGH,
+ NAN_SUPPORTED_BN_6G,
+ NAN_SUPPORTED_BN_NUM
+};
+
+union nan_band_ch_ctrl {
+ struct {
+ __le32 type : 1;
+ __le32 reserved : 31;
+ };
+
+ struct {
+ __le32 band_type : 1;
+ __le32 band_rsvd : 23;
+ __le32 band_id_mask : 8;
+ };
+
+ struct {
+ __le32 ch_type : 1;
+ __le32 ch_rsvd : 7;
+ __le32 op_class : 8;
+ __le32 primary_ch : 8;
+ __le32 aux_center_ch : 8;
+ };
+
+ __le32 raw_data;
+};
+
+struct mt7925_nan_social_ch_scan_params {
+ u8 dwell_time[NAN_MAX_SOCIAL_CHANNELS];
+ __le16 scan_period[NAN_MAX_SOCIAL_CHANNELS];
+} __packed;
+
+/* Firmware-reported NAN device information */
+struct nan_dev_info_evt {
+ u8 is_enabled;
+ u8 my_addr[ETH_ALEN];
+ u8 en_fw_election;
+ __le32 nan_dev_role;
+ __le32 nan_dev_state;
+ u8 mst_preference;
+ u8 random_factor;
+ u8 cnt_hop;
+ u8 cluster_id[ETH_ALEN];
+ u8 anchor_mst_addr[ETH_ALEN];
+ u8 am_preference;
+ u8 am_random_factor;
+ u8 parent_mac[ETH_ALEN];
+ u8 parent_am_preference;
+ u8 parent_am_factor;
+ __le32 ambtt;
+ __le32 tsf[2];
+ u8 pn_igtk[6];
+ u8 pn_bigtk[6];
+};
+
+/* Firmware NAN discovery window event */
+struct nan_rpt_dw_evt {
+ struct nan_dev_info_evt device_info;
+ __le32 expected_tsf_h;
+ __le32 expected_tsf_l;
+ __le32 actual_tsf_h;
+ __le32 actual_tsf_l;
+ __le16 channel;
+ __le16 dw_num;
+};
+
+struct mt7925_nan_conf_dw {
+ u8 config_2dot4g_dw_band;
+ __le32 dw_2dot4g_interval_val;
+
+ u8 config_5g_dw_band;
+ __le32 dw_5g_interval_val;
+} __packed;
+
+struct mt7925_nan_enable_req_tlv {
+ __le16 tag;
+ __le16 len;
+
+ u8 master_pref;
+ __le16 cluster_low;
+ __le16 cluster_high;
+
+ u8 config_support_5g;
+ u8 support_5g_val;
+
+ u8 config_sid_beacon;
+ u8 sid_beacon_val;
+
+ u8 config_2dot4g_rssi_close;
+ u8 rssi_close_2dot4g_val;
+ u8 config_2dot4g_rssi_middle;
+ u8 rssi_middle_2dot4g_val;
+
+ u8 config_2dot4g_rssi_proximity;
+ u8 rssi_proximity_2dot4g_val;
+ u8 config_hop_count_limit;
+ u8 hop_count_limit_val;
+
+ u8 config_2dot4g_support;
+ u8 support_2dot4g_val;
+
+ u8 config_2dot4g_beacons;
+ u8 beacon_2dot4g_val;
+
+ u8 config_2dot4g_sdf;
+ u8 sdf_2dot4g_val;
+
+ u8 config_5g_beacons;
+ u8 beacon_5g_val;
+
+ u8 config_5g_sdf;
+ u8 sdf_5g_val;
+
+ u8 config_5g_rssi_close;
+ u8 rssi_close_5g_val;
+
+ u8 config_5g_rssi_middle;
+ u8 rssi_middle_5g_val;
+
+ u8 config_5g_rssi_close_proximity;
+ u8 rssi_close_proximity_5g_val;
+
+ u8 config_rssi_window_size;
+ u8 rssi_window_size_val;
+
+ u8 config_oui;
+ __le32 oui_val;
+
+ u8 config_intf_addr;
+ u8 intf_addr_val[ETH_ALEN];
+
+ u8 config_cluster_attribute_val;
+
+ u8 config_scan_params;
+ struct mt7925_nan_social_ch_scan_params scan_params_val;
+
+ u8 config_random_factor_force;
+ u8 random_factor_force_val;
+
+ u8 config_hop_count_force;
+ u8 hop_count_force_val;
+
+ u8 config_24g_channel;
+ __le32 channel_24g_val;
+
+ u8 config_5g_channel;
+ __le32 channel_5g_val;
+
+ struct mt7925_nan_conf_dw config_dw;
+
+ u8 config_disc_mac_addr_randomization;
+ __le32 disc_mac_addr_rand_interval_sec;
+
+ u8 discovery_indication_cfg;
+
+ u8 config_subscribe_sid_beacon;
+ __le32 subscribe_sid_beacon_val;
+
+ u8 enable_log_slot_statistics;
+} __packed __aligned(4);
+
+struct mt7925_nan_common_hdr {
+ u8 reserved[4];
+};
+
+struct mt7925_nan_master_preference_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 master_preference;
+ u8 reserved[3];
+} __packed __aligned(4);
+
+struct mt7925_nan_dw_interval_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 dw_interval;
+ u8 vendor_ioctl;
+ __le16 disc_bcn_interval;
+} __packed __aligned(4);
+
+struct mt7925_nan_cluster_id_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 cluster_id[ETH_ALEN];
+ u8 reserved[2];
+} __packed __aligned(4);
+
+struct mt7925_nan_sync_rssi_tlv {
+ __le16 tag;
+ __le16 len;
+ s8 rssi_close_2g;
+ s8 rssi_middle_2g;
+ s8 rssi_close_5g;
+ s8 rssi_middle_5g;
+} __packed __aligned(4);
+
+struct mt7925_nan_de_event {
+ u8 event_type;
+ u8 cluster_id[ETH_ALEN];
+ u8 anchor_master_rank[NAN_ANCHOR_MASTER_RANK_NUM];
+ u8 own_nmi[ETH_ALEN];
+ u8 master_nmi[ETH_ALEN];
+};
+
+struct mt7925_nan_nmi_addr_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 nmi_addr[ETH_ALEN];
+} __packed __aligned(4);
+
+struct mt7925_nan_avail_ctrl_tlv {
+ __le16 tag;
+ __le16 len;
+ __le16 avail_ctrl;
+ u8 seq_id;
+ u8 reserved[1];
+} __packed __aligned(4);
+
+struct mt7925_nan_ch_timeline {
+ u8 is_valid;
+ u8 reserved[3];
+
+ union nan_band_ch_ctrl ch_info;
+
+ __le32 num;
+ __le32 avail_map[NAN_TOTAL_DW];
+};
+
+struct mt7925_nan_avail_entry_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 map_id;
+ u8 is_cond_avail;
+ u8 timeline_idx;
+ u8 is_multi_map;
+
+ struct mt7925_nan_ch_timeline ch_list[NAN_TIMELINE_MGMT_CHNL_LIST_NUM];
+} __packed __aligned(4);
+
+struct mt7925_nan_sched_manage_peer_rec_tlv {
+ __le16 tag;
+ __le16 len;
+ __le32 sch_idx;
+ u8 is_activate;
+ u8 nmi_addr[ETH_ALEN];
+ u8 reserved[1];
+} __packed __aligned(4);
+
+struct mt7925_nan_sched_update_peer_cap_tlv {
+ __le16 tag;
+ __le16 len;
+ __le32 sch_idx;
+ u8 supported_bands;
+ __le16 max_chnl_switch_time;
+ u8 peer_supported_bands;
+} __packed __aligned(4);
+
+struct mt7925_nan_sched_timeline {
+ u8 map_id;
+ u8 local_map_id;
+ u8 reserved[2];
+ union {
+ __le32 avail_map[NAN_TOTAL_DW];
+ u8 avail_block[NAN_TOTAL_DW * 4];
+ };
+};
+
+struct mt7925_nan_sched_faw_ndc_timeline {
+ __le32 avail_map[NAN_TOTAL_DW];
+};
+
+struct mt7925_nan_sched_ndc_ctrl {
+ u8 is_valid;
+ u8 ndc_id[NAN_NDC_ATTRIBUTE_ID_LENGTH];
+ u8 ndc_idx;
+ struct mt7925_nan_sched_timeline timeline[NAN_NUM_AVAIL_DB];
+};
+
+struct mt7925_nan_sched_update_crb_tlv {
+ __le16 tag;
+ __le16 len;
+ __le32 sch_idx;
+ u8 is_use_data_path : 1;
+ u8 avail_6g_format : 2;
+ u8 rsvd : 5;
+ u8 is_use_ranging;
+ u8 reserved[2];
+ struct mt7925_nan_sched_timeline comm_ranging_timeline[NAN_TIMELINE_MGMT_SIZE];
+ struct mt7925_nan_sched_timeline comm_faw_timeline[NAN_TIMELINE_MGMT_SIZE];
+ struct mt7925_nan_sched_ndc_ctrl comm_ndc_ctrl;
+ struct mt7925_nan_sched_faw_ndc_timeline faw_ndc_timeline[NAN_TIMELINE_MGMT_SIZE];
+} __packed __aligned(4);
+
+struct mt7925_nan_sched_map_sta_rec_tlv {
+ __le16 tag;
+ __le16 len;
+ u8 nmi_addr[ETH_ALEN];
+ u8 sta_rec_idx;
+ u8 ndp_ctx_id;
+
+ __le32 role_idx;
+ u8 ndi_addr[ETH_ALEN];
+ u8 reserved[2];
+} __packed __aligned(4);
+
+int mt7925_nan_enable(struct ieee80211_vif *vif,
+ struct mt792x_dev *dev,
+ struct cfg80211_nan_conf *conf);
+
+int mt7925_nan_disable(struct ieee80211_vif *vif,
+ struct mt792x_dev *dev);
+
+int mt7925_nan_change_configure(struct ieee80211_vif *vif,
+ struct mt792x_dev *dev,
+ struct cfg80211_nan_conf *conf);
+
+void mt7925_nan_mcu_event(struct mt792x_dev *dev, struct sk_buff *skb);
+
+void mt7925_nan_local_sched_changed(struct mt792x_dev *dev,
+ struct ieee80211_vif *vif);
+
+int mt792x_nan_set_peer_schedule(struct mt792x_dev *dev,
+ struct ieee80211_sta *sta);
+
+int mt792x_nan_set_peer_rec(struct mt76_dev *mdev,
+ struct ieee80211_sta *sta);
+
+int mt792x_nan_map_sta_rec(struct mt76_dev *mdev,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta);
+
+#endif
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/regd.c b/drivers/net/wireless/mediatek/mt76/mt7925/regd.c
index 16f56ee879d4..0235437d11d5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/regd.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/regd.c
@@ -217,6 +217,36 @@ mt7925_regd_is_valid_alpha2(const char *alpha2)
return false;
}
+bool
+mt7925_regd_is_valid_channel(struct mt792x_dev *dev,
+ enum nl80211_band band,
+ struct ieee80211_channel *chan)
+{
+ struct ieee80211_hw *hw = mt76_hw(dev);
+ struct wiphy *wiphy = hw->wiphy;
+ struct ieee80211_supported_band *sband;
+ struct ieee80211_channel *ch;
+ int i;
+
+ if (!chan)
+ return false;
+
+ sband = wiphy->bands[band];
+ if (!sband)
+ return false;
+
+ for (i = 0; i < sband->n_channels; i++) {
+ ch = &sband->channels[i];
+
+ if (ch->hw_value == chan->hw_value &&
+ ((ch->flags & IEEE80211_CHAN_DISABLED) == 0))
+ return true;
+ }
+
+ return false;
+}
+EXPORT_SYMBOL_GPL(mt7925_regd_is_valid_channel);
+
int mt7925_regd_change(struct mt792x_phy *phy, char *alpha2)
{
struct wiphy *wiphy = phy->mt76->hw->wiphy;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/regd.h b/drivers/net/wireless/mediatek/mt76/mt7925/regd.h
index 0767f078862e..0b0754cf8ae7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/regd.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/regd.h
@@ -13,6 +13,9 @@ void mt7925_regd_be_ctrl(struct mt792x_dev *dev, u8 *alpha2);
void mt7925_regd_notifier(struct wiphy *wiphy, struct regulatory_request *req);
bool mt7925_regd_clc_supported(struct mt792x_dev *dev);
int mt7925_regd_change(struct mt792x_phy *phy, char *alpha2);
+bool mt7925_regd_is_valid_channel(struct mt792x_dev *dev,
+ enum nl80211_band band,
+ struct ieee80211_channel *chan);
int mt7925_regd_init(struct mt792x_phy *phy);
#endif
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x.h b/drivers/net/wireless/mediatek/mt76/mt792x.h
index 70073b43af54..89c3f84a776a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x.h
+++ b/drivers/net/wireless/mediatek/mt76/mt792x.h
@@ -115,6 +115,18 @@ struct mt792x_link_sta {
struct ieee80211_link_sta *pri_link;
};
+struct mt792x_sta_nan_sched {
+ u16 committed_dw;
+ u32 sch_idx;
+ bool idx_assigned;
+ unsigned long ndp_ctx_bitmap;
+ u8 ndp_ctx_id; /* assigned NDP context ID (for NDI sta) */
+ struct {
+ u8 map_id;
+ struct cfg80211_chan_def chans[CFG80211_NAN_SCHED_NUM_TIME_SLOTS];
+ } maps[CFG80211_NAN_MAX_PEER_MAPS];
+};
+
struct mt792x_sta {
struct mt792x_link_sta deflink; /* must be first */
struct mt792x_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
@@ -123,6 +135,9 @@ struct mt792x_sta {
u16 valid_links;
u8 deflink_id;
+
+ /* NAN peer schedule */
+ struct mt792x_sta_nan_sched nan_sched;
};
DECLARE_EWMA(rssi, 10, 8);
@@ -139,6 +154,25 @@ struct mt792x_bss_conf {
unsigned int link_id;
};
+struct mt792x_nan_conf {
+ u8 master_pref;
+ u8 bands;
+ u8 cluster_id[ETH_ALEN];
+ u32 discovery_beacon_interval;
+ bool enable_dw_notification;
+};
+
+struct mt792x_nan {
+ struct mt792x_nan_conf conf;
+
+ /* Scheduler */
+ struct cfg80211_chan_def local_sched[CFG80211_NAN_SCHED_NUM_TIME_SLOTS];
+ u32 seq_id;
+
+ /* Connection index bitmap, up to NAN_MAX_CONN_CFG peers */
+ unsigned long conn_bitmap;
+};
+
struct mt792x_vif {
struct mt792x_bss_conf bss_conf; /* must be first */
struct mt792x_bss_conf __rcu *link_conf[IEEE80211_MLD_MAX_NUM_LINKS];
@@ -153,6 +187,8 @@ struct mt792x_vif {
struct work_struct csa_work;
struct timer_list csa_timer;
+
+ struct mt792x_nan nan;
};
struct mt792x_phy {
@@ -283,6 +319,8 @@ struct mt792x_dev {
u32 backup_l2;
struct ieee80211_chanctx_conf *new_ctx;
+
+ struct ieee80211_vif *nan_vif;
};
static inline struct mt792x_bss_conf *
--
2.43.0
^ permalink raw reply related
* [PATCH v2 3/9] wifi: mt76: connac: add NAN connection type
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
In-Reply-To: <20260625001834.475094-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Introduce a dedicated NAN connection type for connac firmware and use it
for NAN interface device, BSS and station records.
Add the common NAN MCU command and event IDs used by mt7925.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 14 ++++++++++++++
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 4 ++++
2 files changed, 18 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
index 6596c9e198f4..67eba4dd9615 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
@@ -422,6 +422,10 @@ void mt76_connac_mcu_sta_basic_tlv(struct mt76_dev *dev, struct sk_buff *skb,
basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
basic->aid = cpu_to_le16(link_sta->sta->aid);
break;
+ case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_NAN_DATA:
+ basic->conn_type = cpu_to_le32(CONNECTION_NAN);
+ break;
default:
WARN_ON(1);
break;
@@ -1217,6 +1221,11 @@ int mt76_connac_mcu_uni_add_dev(struct mt76_phy *phy,
case NL80211_IFTYPE_ADHOC:
basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
break;
+ case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_NAN_DATA:
+ basic_req.basic.conn_type = cpu_to_le32(CONNECTION_NAN);
+ basic_req.basic.conn_state = !enable;
+ break;
default:
WARN_ON(1);
break;
@@ -1625,6 +1634,11 @@ int mt76_connac_mcu_uni_add_bss(struct mt76_phy *phy,
case NL80211_IFTYPE_ADHOC:
basic_req.basic.conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
break;
+ case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_NAN_DATA:
+ basic_req.basic.conn_type = cpu_to_le32(CONNECTION_NAN);
+ basic_req.basic.active = enable;
+ break;
default:
WARN_ON(1);
break;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
index 78f633ad81a0..a9a4a87ae0a7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -876,6 +876,7 @@ enum {
#define NETWORK_P2P BIT(17)
#define NETWORK_IBSS BIT(18)
#define NETWORK_WDS BIT(21)
+#define NETWORK_NAN BIT(22)
#define SCAN_FUNC_RANDOM_MAC BIT(0)
#define SCAN_FUNC_RNR_SCAN BIT(3)
@@ -888,6 +889,7 @@ enum {
#define CONNECTION_IBSS_ADHOC (STA_TYPE_ADHOC | NETWORK_IBSS)
#define CONNECTION_WDS (STA_TYPE_WDS | NETWORK_WDS)
#define CONNECTION_INFRA_BC (STA_TYPE_BC | NETWORK_INFRA)
+#define CONNECTION_NAN (NETWORK_NAN)
#define CONN_STATE_DISCONNECT 0
#define CONN_STATE_CONNECT 1
@@ -1074,6 +1076,7 @@ enum {
MCU_UNI_EVENT_THERMAL = 0x35,
MCU_UNI_EVENT_RSSI_MONITOR = 0x41,
MCU_UNI_EVENT_NIC_CAPAB = 0x43,
+ MCU_UNI_EVENT_NAN = 0x56,
MCU_UNI_EVENT_WED_RRO = 0x57,
MCU_UNI_EVENT_PER_STA_INFO = 0x6d,
MCU_UNI_EVENT_ALL_STA_INFO = 0x6e,
@@ -1313,6 +1316,7 @@ enum {
MCU_UNI_CMD_FIXED_RATE_TABLE = 0x40,
MCU_UNI_CMD_RSSI_MONITOR = 0x41,
MCU_UNI_CMD_TESTMODE_CTRL = 0x46,
+ MCU_UNI_CMD_NAN = 0x56,
MCU_UNI_CMD_RRO = 0x57,
MCU_UNI_CMD_OFFCH_SCAN_CTRL = 0x58,
MCU_UNI_CMD_PER_STA_INFO = 0x6d,
--
2.43.0
^ permalink raw reply related
* [PATCH v2 2/9] wifi: mt76: mt7925: guard BSS capability lookups
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
In-Reply-To: <20260625001834.475094-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
mt7925 BSS setup may dereference missing channel data or query HE 6 GHz
capabilities for an iftype without HE support.
Guard both lookups before adding NAN paths that can use partially
configured BSS state.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
.../net/wireless/mediatek/mt76/mt7925/mcu.c | 26 ++++++++++++++-----
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index e94fa544ff20..cff91b4eeac6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -2364,11 +2364,18 @@ void mt7925_mcu_bss_rlm_tlv(struct sk_buff *skb, struct mt76_phy *phy,
{
struct cfg80211_chan_def *chandef = ctx ? &ctx->def :
&link_conf->chanreq.oper;
- int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2;
- enum nl80211_band band = chandef->chan->band;
struct bss_rlm_tlv *req;
+ enum nl80211_band band;
+ int freq1, freq2;
struct tlv *tlv;
+ if (WARN_ON_ONCE(!chandef || !chandef->chan))
+ return;
+
+ freq1 = chandef->center_freq1;
+ freq2 = chandef->center_freq2;
+ band = chandef->chan->band;
+
tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_RLM, sizeof(*req));
req = (struct bss_rlm_tlv *)tlv;
req->control_channel = chandef->chan->hw_value;
@@ -2506,8 +2513,8 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
enum nl80211_band band,
struct ieee80211_link_sta *link_sta)
{
- struct ieee80211_he_6ghz_capa *he_6ghz_capa;
- const struct ieee80211_sta_eht_cap *eht_cap;
+ struct ieee80211_he_6ghz_capa *he_6ghz_capa = NULL;
+ const struct ieee80211_sta_eht_cap *eht_cap = NULL;
__le16 capa = 0;
u8 mode = 0;
@@ -2515,11 +2522,18 @@ mt7925_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif,
he_6ghz_capa = &link_sta->he_6ghz_capa;
eht_cap = &link_sta->eht_cap;
} else {
+ const struct ieee80211_sta_he_cap *he_cap;
struct ieee80211_supported_band *sband;
sband = phy->hw->wiphy->bands[band];
- capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
- he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
+
+ he_cap = (band == NL80211_BAND_6GHZ) ?
+ ieee80211_get_he_iftype_cap(sband, vif->type) : NULL;
+
+ if (he_cap) {
+ capa = ieee80211_get_he_6ghz_capa(sband, vif->type);
+ he_6ghz_capa = (struct ieee80211_he_6ghz_capa *)&capa;
+ }
eht_cap = ieee80211_get_eht_iftype_cap(sband, vif->type);
}
--
2.43.0
^ permalink raw reply related
* [PATCH v2 1/9] wifi: mt76: mt792x: advertise mgmt frame registration
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
In-Reply-To: <20260625001834.475094-1-sean.wang@kernel.org>
From: Sean Wang <sean.wang@mediatek.com>
Advertise multicast management frame registration support so userspace
can subscribe to multicast management and action frames.
This capability is required for NAN discovery and related operations.
Co-developed-by: Stella Liu <yu-ching.liu@mediatek.com>
Signed-off-by: Stella Liu <yu-ching.liu@mediatek.com>
Co-developed-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Jeremy Yu <chengwei.yu@mediatek.com>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index b50825eccdaf..a0db815c27bc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -719,6 +719,7 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)
wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_BEACON_RATE_HE);
wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT);
wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
+ wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS);
ieee80211_hw_set(hw, SINGLE_SCAN_ON_ALL_BANDS);
ieee80211_hw_set(hw, HAS_RATE_CONTROL);
--
2.43.0
^ permalink raw reply related
* [PATCH v2 0/9] wifi: mt76: add mt7925 NAN support
From: Sean Wang @ 2026-06-25 0:18 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: chengwei.yu, yu-ching.liu, jenhao.yang, posh.sun, linux-wireless,
linux-mediatek, Sean Wang
Add NAN support for mt7925. The series first advertises userspace
management-frame registration and hardens BSS capability lookups used by
partially configured BSS state.
The rest of the series adds the connac NAN connection type, mt7925 NAN
MCU helpers and event handling, a generic init_wiphy callback, mac80211
NAN operations, firmware-gated interface combinations and NAN data
advertisement.
Changes since v1
- Rebased and reworked the 7-patch v1 series into 9 focused patches.
- v1 patch 2 and 3 are folded into one BSS capability guard patch.
- v1 patch 7 is split into a framework-only interface combination
patch and a final NAN/NAN_DATA advertisement patch.
- v1 patch 5 is split into NAN MCU helpers and mt7925 MCU response,
event and NAN-specific BSS/STA TLV handling.
- v1 patch 6 is split so NAN PHY capability setup uses a generic
init_wiphy callback before mac80211 NAN ops are wired.
- Order init_wiphy before the mt7925 NAN ops patch so each patch
builds independently.
- Define MT792x_FW_CAP_NAN in the patch that first uses it.
- Move common NAN MCU command/event IDs to the connac patch and handle
NAN_DATA as a NAN connection type.
- Add NAN_DATA interface support, 2.4/5 GHz NAN bands and secure NAN
advertisement.
- Add NMI address programming, DW notifications, local availability
updates, peer schedule updates and NDI STA mapping.
- Add cleanup and rollback for NAN peer indexes, NDP contexts and MCU
failures.
- Drop temporary NAN channel debug logging and fix checkpatch issues.
Sean Wang (9):
wifi: mt76: mt792x: advertise mgmt frame registration
wifi: mt76: mt7925: guard BSS capability lookups
wifi: mt76: connac: add NAN connection type
wifi: mt76: mt7925: add NAN MCU helpers
wifi: mt76: mt7925: add NAN MCU handling
wifi: mt76: add init_wiphy callback
wifi: mt76: mt7925: wire up NAN operations
wifi: mt76: mt792x: build iface combinations dynamically
wifi: mt76: mt792x: advertise NAN data support
drivers/net/wireless/mediatek/mt76/mac80211.c | 7 +
drivers/net/wireless/mediatek/mt76/mt76.h | 3 +
.../wireless/mediatek/mt76/mt76_connac_mcu.c | 14 +
.../wireless/mediatek/mt76/mt76_connac_mcu.h | 4 +
.../wireless/mediatek/mt76/mt7925/Makefile | 2 +-
.../net/wireless/mediatek/mt76/mt7925/init.c | 29 +
.../net/wireless/mediatek/mt76/mt7925/main.c | 201 ++-
.../net/wireless/mediatek/mt76/mt7925/mcu.c | 125 +-
.../net/wireless/mediatek/mt76/mt7925/nan.c | 1091 +++++++++++++++++
.../net/wireless/mediatek/mt76/mt7925/nan.h | 440 +++++++
.../net/wireless/mediatek/mt76/mt7925/regd.c | 30 +
.../net/wireless/mediatek/mt76/mt7925/regd.h | 3 +
drivers/net/wireless/mediatek/mt76/mt792x.h | 43 +
.../net/wireless/mediatek/mt76/mt792x_core.c | 125 +-
14 files changed, 2077 insertions(+), 40 deletions(-)
create mode 100644 drivers/net/wireless/mediatek/mt76/mt7925/nan.c
create mode 100644 drivers/net/wireless/mediatek/mt76/mt7925/nan.h
--
2.43.0
^ permalink raw reply
* [PATCH] wifi: cfg80211: replace BOOL_TO_STR macro with str_true_false()
From: Serhat Kumral @ 2026-06-24 20:49 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg, linux-kernel, Serhat Kumral
Remove the local BOOL_TO_STR macro and replace all its usages with
the kernel's str_true_false() helper from <linux/string_choices.h>.
No functional change intended.
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
net/wireless/trace.h | 44 ++++++++++++++++++++++----------------------
1 file changed, 22 insertions(+), 22 deletions(-)
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 94944f2a39a4..befab459852a 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -14,6 +14,7 @@
#include <linux/rtnetlink.h>
#include <linux/etherdevice.h>
+#include <linux/string_choices.h>
#include <net/cfg80211.h>
#include "core.h"
@@ -228,7 +229,6 @@
__entry->plink_state = sinfo->plink_state; \
} while (0)
-#define BOOL_TO_STR(bo) (bo) ? "true" : "false"
#define QOS_MAP_ENTRY __field(u8, num_des) \
__array(u8, dscp_exception, \
@@ -578,7 +578,7 @@ DECLARE_EVENT_CLASS(key_handle,
TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT ", link_id: %d, "
"key_index: %u, pairwise: %s, mac addr: %pM",
WIPHY_PR_ARG, WDEV_PR_ARG, __entry->link_id,
- __entry->key_index, BOOL_TO_STR(__entry->pairwise),
+ __entry->key_index, str_true_false(__entry->pairwise),
__entry->mac_addr)
);
@@ -621,7 +621,7 @@ TRACE_EVENT(rdev_add_key,
"mac addr: %pM",
WIPHY_PR_ARG, WDEV_PR_ARG, __entry->link_id,
__entry->key_index, __entry->mode,
- BOOL_TO_STR(__entry->pairwise), __entry->mac_addr)
+ str_true_false(__entry->pairwise), __entry->mac_addr)
);
TRACE_EVENT(rdev_set_default_key,
@@ -647,8 +647,8 @@ TRACE_EVENT(rdev_set_default_key,
TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", link_id: %d, "
"key index: %u, unicast: %s, multicast: %s",
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->link_id,
- __entry->key_index, BOOL_TO_STR(__entry->unicast),
- BOOL_TO_STR(__entry->multicast))
+ __entry->key_index, str_true_false(__entry->unicast),
+ str_true_false(__entry->multicast))
);
TRACE_EVENT(rdev_set_default_mgmt_key,
@@ -733,7 +733,7 @@ TRACE_EVENT(rdev_start_ap,
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->ssid, CHAN_DEF_PR_ARG,
__entry->beacon_interval, __entry->dtim_period,
__entry->hidden_ssid, __entry->wpa_ver,
- BOOL_TO_STR(__entry->privacy), __entry->auth_type,
+ str_true_false(__entry->privacy), __entry->auth_type,
__entry->inactivity_timeout, __entry->link_id)
);
@@ -1469,7 +1469,7 @@ TRACE_EVENT(rdev_assoc,
TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", bssid: %pM"
", previous bssid: %pM, use mfp: %s, flags: 0x%x",
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->bssid,
- __entry->prev_bssid, BOOL_TO_STR(__entry->use_mfp),
+ __entry->prev_bssid, str_true_false(__entry->use_mfp),
__entry->flags)
);
@@ -1518,7 +1518,7 @@ TRACE_EVENT(rdev_disassoc,
", reason: %u, local state change: %s",
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->bssid,
__entry->reason_code,
- BOOL_TO_STR(__entry->local_state_change))
+ str_true_false(__entry->local_state_change))
);
TRACE_EVENT(rdev_mgmt_tx_cancel_wait,
@@ -1591,7 +1591,7 @@ TRACE_EVENT(rdev_connect,
", ssid: %s, auth type: %d, privacy: %s, wpa versions: %u, "
"flags: 0x%x, previous bssid: %pM",
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->bssid, __entry->ssid,
- __entry->auth_type, BOOL_TO_STR(__entry->privacy),
+ __entry->auth_type, str_true_false(__entry->privacy),
__entry->wpa_versions, __entry->flags, __entry->prev_bssid)
);
@@ -2033,7 +2033,7 @@ TRACE_EVENT(rdev_tdls_mgmt,
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->peer,
__entry->link_id, __entry->action_code, __entry->dialog_token,
__entry->status_code, __entry->peer_capability,
- BOOL_TO_STR(__entry->initiator),
+ str_true_false(__entry->initiator),
((u8 *)__get_dynamic_array(buf))[0])
);
@@ -2246,9 +2246,9 @@ TRACE_EVENT(rdev_mgmt_tx,
TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT ", " CHAN_PR_FMT ", offchan: %s,"
" wait: %u, no cck: %s, dont wait for ack: %s",
WIPHY_PR_ARG, WDEV_PR_ARG, CHAN_PR_ARG,
- BOOL_TO_STR(__entry->offchan), __entry->wait,
- BOOL_TO_STR(__entry->no_cck),
- BOOL_TO_STR(__entry->dont_wait_for_ack))
+ str_true_false(__entry->offchan), __entry->wait,
+ str_true_false(__entry->no_cck),
+ str_true_false(__entry->dont_wait_for_ack))
);
TRACE_EVENT(rdev_tx_control_port,
@@ -2276,7 +2276,7 @@ TRACE_EVENT(rdev_tx_control_port,
" proto: 0x%x, unencrypted: %s, link: %d",
WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->dest,
be16_to_cpu(__entry->proto),
- BOOL_TO_STR(__entry->unencrypted),
+ str_true_false(__entry->unencrypted),
__entry->link_id)
);
@@ -2894,7 +2894,7 @@ TRACE_EVENT(rdev_set_multicast_to_unicast,
),
TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", unicast: %s",
WIPHY_PR_ARG, NETDEV_PR_ARG,
- BOOL_TO_STR(__entry->enabled))
+ str_true_false(__entry->enabled))
);
DEFINE_EVENT(wiphy_wdev_evt, rdev_get_txq_stats,
@@ -3225,7 +3225,7 @@ TRACE_EVENT(cfg80211_return_bool,
TP_fast_assign(
__entry->ret = ret;
),
- TP_printk("returned %s", BOOL_TO_STR(__entry->ret))
+ TP_printk("returned %s", str_true_false(__entry->ret))
);
DECLARE_EVENT_CLASS(cfg80211_netdev_mac_evt,
@@ -3500,7 +3500,7 @@ TRACE_EVENT(cfg80211_mgmt_tx_status,
__entry->ack = ack;
),
TP_printk(WDEV_PR_FMT", cookie: %llu, ack: %s",
- WDEV_PR_ARG, __entry->cookie, BOOL_TO_STR(__entry->ack))
+ WDEV_PR_ARG, __entry->cookie, str_true_false(__entry->ack))
);
TRACE_EVENT(cfg80211_control_port_tx_status,
@@ -3517,7 +3517,7 @@ TRACE_EVENT(cfg80211_control_port_tx_status,
__entry->ack = ack;
),
TP_printk(WDEV_PR_FMT", cookie: %llu, ack: %s",
- WDEV_PR_ARG, __entry->cookie, BOOL_TO_STR(__entry->ack))
+ WDEV_PR_ARG, __entry->cookie, str_true_false(__entry->ack))
);
TRACE_EVENT(cfg80211_rx_control_port,
@@ -3542,7 +3542,7 @@ TRACE_EVENT(cfg80211_rx_control_port,
),
TP_printk(NETDEV_PR_FMT ", len=%d, %pM, proto: 0x%x, unencrypted: %s, link: %d",
NETDEV_PR_ARG, __entry->len, __entry->from,
- __entry->proto, BOOL_TO_STR(__entry->unencrypted),
+ __entry->proto, str_true_false(__entry->unencrypted),
__entry->link_id)
);
@@ -3726,7 +3726,7 @@ TRACE_EVENT(cfg80211_probe_status,
),
TP_printk(NETDEV_PR_FMT " addr:%pM, cookie: %llu, acked: %s",
NETDEV_PR_ARG, __entry->addr, __entry->cookie,
- BOOL_TO_STR(__entry->acked))
+ str_true_false(__entry->acked))
);
TRACE_EVENT(cfg80211_cqm_pktloss_notify,
@@ -3769,7 +3769,7 @@ TRACE_EVENT(cfg80211_pmksa_candidate_notify,
),
TP_printk(NETDEV_PR_FMT ", index:%d, bssid: %pM, pre auth: %s",
NETDEV_PR_ARG, __entry->index, __entry->bssid,
- BOOL_TO_STR(__entry->preauth))
+ str_true_false(__entry->preauth))
);
TRACE_EVENT(cfg80211_report_obss_beacon,
@@ -3848,7 +3848,7 @@ TRACE_EVENT(cfg80211_scan_done,
}
),
TP_printk("aborted: %s, scan start (TSF): %llu, tsf_bssid: %pM",
- BOOL_TO_STR(__entry->aborted),
+ str_true_false(__entry->aborted),
(unsigned long long)__entry->scan_start_tsf,
__entry->tsf_bssid)
);
--
2.54.0
^ permalink raw reply related
* [PATCH v1 2/2] wifi: mt76: mt7996: enable firmware txpower limit controls
From: Yanghan Ye @ 2026-06-24 14:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Deren Wu
Cc: linux-mediatek, linux-wireless, Yanghan Ye
In-Reply-To: <20260624144516.1841063-1-yyh94306@gmail.com>
mt7996 firmware does not apply uploaded SKU and backoff power tables unless
the corresponding UNI_CMD(TXPOWER) controls are enabled. Enable the SKU and
backoff controls in the normal run path and upload the mt7996 backoff table
using the firmware table layout used by the MediaTek SDK.
Keep the mt7996 backoff layout private instead of resizing the shared mt76
power-limit structure used by older connac chipsets. Continue to respect
chan->max_reg_power when initializing channel power.
Signed-off-by: Yanghan Ye <yyh94306@gmail.com>
---
eeprom.c | 9 ++
mt7996/init.c | 16 ++-
mt7996/main.c | 10 ++
mt7996/mcu.c | 365 +++++++++++++++++++++++++++++++++++++++++++++---
mt7996/mcu.h | 25 ++++
mt7996/mt7996.h | 6 +
6 files changed, 411 insertions(+), 20 deletions(-)
diff --git a/eeprom.c b/eeprom.c
index 28dbda6f..440a89dc 100644
--- a/eeprom.c
+++ b/eeprom.c
@@ -511,6 +511,15 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
ARRAY_SIZE(dest->ru), val, len, target_power,
txs_delta, &max_power, n_chains, MT76_SKU_RATE);
+ val = mt76_get_of_array_s8(np, "rates-eht", &len,
+ ARRAY_SIZE(dest->eht[0]) + 1);
+ mt76_apply_multi_array_limit(dev, dest->eht[0], ARRAY_SIZE(dest->eht[0]),
+ ARRAY_SIZE(dest->eht), val, len, target_power,
+ txs_delta, &max_power, n_chains, MT76_SKU_RATE);
+
+ if (is_mt799x(dev))
+ return max_power == -127 ? target_power : max_power;
+
val = mt76_get_of_array_s8(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
mt76_apply_array_limit(dev, dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
target_power, txs_delta, &max_power, n_chains, MT76_SKU_BACKOFF);
diff --git a/mt7996/init.c b/mt7996/init.c
index 2bf3ddd8..21c359f5 100644
--- a/mt7996/init.c
+++ b/mt7996/init.c
@@ -362,15 +362,23 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
int i, n_chains = hweight16(phy->mt76->chainmask);
int path_delta = mt76_tx_power_path_delta(n_chains);
int pwr_delta = mt7996_eeprom_get_power_delta(dev, sband->band);
- struct mt76_power_limits limits;
+ struct mt76_power_limits *limits;
+
+ limits = kzalloc(sizeof(*limits), GFP_KERNEL);
+ if (!limits)
+ return;
+
+ phy->sku_limit_en = true;
for (i = 0; i < sband->n_channels; i++) {
struct ieee80211_channel *chan = &sband->channels[i];
int target_power = mt7996_eeprom_get_target_power(dev, chan);
+ phy->sku_path_en |= mt7996_has_power_path_limits(phy->mt76, chan);
+
target_power += pwr_delta;
target_power = mt76_get_rate_power_limits(phy->mt76, chan,
- &limits,
+ limits,
target_power);
target_power += path_delta;
target_power = DIV_ROUND_UP(target_power, 2);
@@ -379,6 +387,8 @@ static void __mt7996_init_txpower(struct mt7996_phy *phy,
phy->txpower = max(phy->txpower, chan->max_power);
chan->orig_mpwr = target_power;
}
+
+ kfree(limits);
}
void mt7996_init_txpower(struct mt7996_phy *phy)
@@ -386,6 +396,8 @@ void mt7996_init_txpower(struct mt7996_phy *phy)
if (!phy)
return;
+ phy->sku_path_en = false;
+
if (phy->mt76->cap.has_2ghz)
__mt7996_init_txpower(phy, &phy->mt76->sband_2g.sband);
if (phy->mt76->cap.has_5ghz)
diff --git a/mt7996/main.c b/mt7996/main.c
index c32e7819..f3fec548 100644
--- a/mt7996/main.c
+++ b/mt7996/main.c
@@ -34,6 +34,16 @@ int mt7996_run(struct mt7996_phy *phy)
if (ret)
return ret;
+ ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_SKU_POWER_LIMIT_CTRL,
+ phy->sku_limit_en);
+ if (ret)
+ return ret;
+
+ ret = mt7996_mcu_set_tx_power_ctrl(phy, UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL,
+ phy->sku_path_en);
+ if (ret)
+ return ret;
+
set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
ieee80211_queue_delayed_work(dev->mphy.hw, &phy->mt76->mac_work,
diff --git a/mt7996/mcu.c b/mt7996/mcu.c
index c0b9b1bf..bf66f6d2 100644
--- a/mt7996/mcu.c
+++ b/mt7996/mcu.c
@@ -5,6 +5,7 @@
#include <linux/firmware.h>
#include <linux/fs.h>
+#include <linux/of.h>
#include "mt7996.h"
#include "mcu.h"
#include "mac.h"
@@ -108,6 +109,242 @@ static bool sr_scene_detect = true;
module_param(sr_scene_detect, bool, 0644);
MODULE_PARM_DESC(sr_scene_detect, "Enable firmware scene detection algorithm");
+#define MT7996_SKU_PATH_CCK_LEN 5
+#define MT7996_SKU_PATH_OFDM_LEN 5
+#define MT7996_SKU_PATH_OFDM_BF_LEN 4
+#define MT7996_SKU_PATH_RU_NUM 16
+#define MT7996_SKU_PATH_RU_LEN 15
+#define MT7996_SKU_PATH_RU_GROUPS (MT7996_SKU_PATH_RU_NUM * 2)
+
+#define MT7996_SKU_RATE_CCK_OFDM_LEN 12
+#define MT7996_SKU_RATE_HT20_LEN 8
+#define MT7996_SKU_RATE_HT40_LEN 9
+#define MT7996_SKU_RATE_VHT_NUM 4
+#define MT7996_SKU_RATE_VHT_LEN 10
+#define MT7996_SKU_RATE_VHT_PAD_LEN 2
+#define MT7996_SKU_RATE_HE_LEN 84
+#define MT7996_SKU_RATE_EHT_LEN 256
+
+/*
+ * MTK SDK / UNI_CMD(TXPOWER) POWER_LIMIT_TABLE rate/backoff layout for mt7996.
+ * Keep the backoff table private because older mt76 chipsets use a smaller
+ * connac2 path ABI.
+ */
+struct mt7996_power_path_limits {
+ s8 cck[MT7996_SKU_PATH_CCK_LEN];
+ s8 ofdm[MT7996_SKU_PATH_OFDM_LEN];
+ s8 ofdm_bf[MT7996_SKU_PATH_OFDM_BF_LEN];
+ s8 ru[MT7996_SKU_PATH_RU_NUM][MT7996_SKU_PATH_RU_LEN];
+ s8 ru_bf[MT7996_SKU_PATH_RU_NUM][MT7996_SKU_PATH_RU_LEN];
+};
+
+static const s8 *
+mt7996_of_get_array_s8(struct device_node *np, const char *name,
+ size_t *len, int min)
+{
+ struct property *prop = of_find_property(np, name, NULL);
+
+ if (!prop || !prop->value || prop->length < min)
+ return NULL;
+
+ *len = prop->length;
+
+ return prop->value;
+}
+
+static const __be32 *
+mt7996_of_get_array(struct device_node *np, const char *name,
+ size_t *len, int min)
+{
+ struct property *prop = of_find_property(np, name, NULL);
+
+ if (!prop || !prop->value || prop->length < min * 4)
+ return NULL;
+
+ *len = prop->length;
+
+ return prop->value;
+}
+
+static s8 mt7996_get_txs_delta(struct device_node *np, u8 nss)
+{
+ const __be32 *val;
+ size_t len;
+
+ val = mt7996_of_get_array(np, "txs-delta", &len, nss);
+ if (!val)
+ return 0;
+
+ return be32_to_cpu(val[nss - 1]);
+}
+
+static u8 mt7996_backoff_n_chains(u8 idx)
+{
+ /* 0:1T1ss, 1:2T1ss, ..., 14:5T5ss */
+ static const u8 connac3_table[] = {
+ 1, 2, 3, 4, 5, 2, 3, 4, 5, 3, 4, 5, 4, 5, 5};
+
+ if (idx >= ARRAY_SIZE(connac3_table))
+ return 0;
+
+ return connac3_table[idx];
+}
+
+static void
+mt7996_apply_path_limit(s8 *pwr, size_t pwr_len, const s8 *data,
+ s8 target_power, s8 nss_delta, int n_chains,
+ bool bf)
+{
+ int i;
+
+ if (!data)
+ return;
+
+ for (i = 0; i < pwr_len; i++) {
+ u8 backoff_chain_idx = i + bf;
+ int backoff_n_chains = mt7996_backoff_n_chains(backoff_chain_idx);
+ s8 backoff_delta = mt76_tx_power_path_delta(backoff_n_chains);
+ s8 delta = mt76_tx_power_path_delta(n_chains);
+
+ pwr[i] = min_t(s8, target_power + delta - backoff_delta,
+ data[i] + nss_delta);
+ }
+}
+
+static void
+mt7996_apply_multi_path_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+ const s8 *data, size_t len, s8 target_power,
+ s8 nss_delta, int n_chains, bool bf)
+{
+ int i, cur;
+
+ if (!data)
+ return;
+
+ cur = data[0];
+ for (i = 0; i < pwr_num; i++) {
+ if (len < pwr_len + 1)
+ break;
+
+ mt7996_apply_path_limit(pwr + pwr_len * i, pwr_len, data + 1,
+ target_power, nss_delta, n_chains, bf);
+ if (--cur > 0)
+ continue;
+
+ data += pwr_len + 1;
+ len -= pwr_len + 1;
+ if (!len)
+ break;
+
+ cur = data[0];
+ }
+}
+
+static struct device_node *
+mt7996_find_power_limit_channel(struct mt76_phy *mphy,
+ struct ieee80211_channel *chan)
+{
+ struct device_node *np;
+ char name[16];
+ char band;
+
+ np = mt76_find_power_limits_node(mphy->dev);
+ if (!np)
+ return NULL;
+
+ switch (chan->band) {
+ case NL80211_BAND_2GHZ:
+ band = '2';
+ break;
+ case NL80211_BAND_5GHZ:
+ band = '5';
+ break;
+ case NL80211_BAND_6GHZ:
+ band = '6';
+ break;
+ default:
+ return NULL;
+ }
+
+ snprintf(name, sizeof(name), "txpower-%cg", band);
+ np = of_get_child_by_name(np, name);
+ if (!np)
+ return NULL;
+
+ return mt76_find_channel_node(np, chan);
+}
+
+bool mt7996_has_power_path_limits(struct mt76_phy *mphy,
+ struct ieee80211_channel *chan)
+{
+ struct device_node *np;
+
+ if (!IS_ENABLED(CONFIG_OF))
+ return false;
+
+ np = mt7996_find_power_limit_channel(mphy, chan);
+ if (!np)
+ return false;
+
+ return of_find_property(np, "paths-cck", NULL) ||
+ of_find_property(np, "paths-ofdm", NULL) ||
+ of_find_property(np, "paths-ofdm-bf", NULL) ||
+ of_find_property(np, "paths-ru", NULL) ||
+ of_find_property(np, "paths-ru-bf", NULL);
+}
+
+static void
+mt7996_get_power_path_limits(struct mt76_phy *mphy,
+ struct ieee80211_channel *chan,
+ struct mt7996_power_path_limits *dest,
+ s8 target_power)
+{
+ struct device_node *np;
+ const s8 *val;
+ size_t len;
+ s8 txs_delta;
+ int n_chains = hweight16(mphy->chainmask);
+
+ memset(dest, 0, sizeof(*dest));
+
+ if (!IS_ENABLED(CONFIG_OF))
+ return;
+
+ np = mt7996_find_power_limit_channel(mphy, chan);
+ if (!np)
+ return;
+
+ txs_delta = mt7996_get_txs_delta(np, n_chains);
+
+ val = mt7996_of_get_array_s8(np, "paths-cck", &len,
+ ARRAY_SIZE(dest->cck));
+ mt7996_apply_path_limit(dest->cck, ARRAY_SIZE(dest->cck), val,
+ target_power, txs_delta, n_chains, false);
+
+ val = mt7996_of_get_array_s8(np, "paths-ofdm", &len,
+ ARRAY_SIZE(dest->ofdm));
+ mt7996_apply_path_limit(dest->ofdm, ARRAY_SIZE(dest->ofdm), val,
+ target_power, txs_delta, n_chains, false);
+
+ val = mt7996_of_get_array_s8(np, "paths-ofdm-bf", &len,
+ ARRAY_SIZE(dest->ofdm_bf));
+ mt7996_apply_path_limit(dest->ofdm_bf, ARRAY_SIZE(dest->ofdm_bf), val,
+ target_power, txs_delta, n_chains, true);
+
+ val = mt7996_of_get_array_s8(np, "paths-ru", &len,
+ ARRAY_SIZE(dest->ru[0]) + 1);
+ mt7996_apply_multi_path_limit(dest->ru[0], ARRAY_SIZE(dest->ru[0]),
+ ARRAY_SIZE(dest->ru), val, len,
+ target_power, txs_delta, n_chains, false);
+
+ val = mt7996_of_get_array_s8(np, "paths-ru-bf", &len,
+ ARRAY_SIZE(dest->ru_bf[0]) + 1);
+ mt7996_apply_multi_path_limit(dest->ru_bf[0],
+ ARRAY_SIZE(dest->ru_bf[0]),
+ ARRAY_SIZE(dest->ru_bf), val, len,
+ target_power, txs_delta, n_chains, false);
+}
+
static u8
mt7996_mcu_get_sta_nss(u16 mcs_map)
{
@@ -5404,9 +5641,46 @@ int mt7996_mcu_set_sniffer_mode(struct mt7996_phy *phy, bool enabled)
sizeof(req), true);
}
+int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id,
+ u8 data)
+{
+ struct mt7996_dev *dev = phy->dev;
+ struct tx_power_ctrl req = {
+ .tag = cpu_to_le16(power_ctrl_id),
+ .len = cpu_to_le16(sizeof(req) - 4),
+ .power_ctrl_id = power_ctrl_id,
+ .band_idx = phy->mt76->band_idx,
+ };
+
+ switch (power_ctrl_id) {
+ case UNI_TXPOWER_SKU_POWER_LIMIT_CTRL:
+ req.sku_enable = !!data;
+ break;
+ case UNI_TXPOWER_PERCENTAGE_CTRL:
+ req.percentage_ctrl_enable = !!data;
+ break;
+ case UNI_TXPOWER_PERCENTAGE_DROP_CTRL:
+ req.power_drop_level = data;
+ break;
+ case UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL:
+ req.bf_backoff_enable = !!data;
+ break;
+ case UNI_TXPOWER_ATE_MODE_CTRL:
+ req.ate_mode_enable = !!data;
+ break;
+ default:
+ req.sku_enable = !!data;
+ break;
+ }
+
+ return mt76_mcu_send_msg(&dev->mt76, MCU_WM_UNI_CMD(TXPOWER),
+ &req, sizeof(req), false);
+}
+
int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
{
#define TX_POWER_LIMIT_TABLE_RATE 0
+#define TX_POWER_LIMIT_TABLE_PATH 1
struct mt7996_dev *dev = phy->dev;
struct mt76_phy *mphy = phy->mt76;
struct tx_power_limit_table_ctrl {
@@ -5424,45 +5698,100 @@ int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy)
.power_limit_type = TX_POWER_LIMIT_TABLE_RATE,
.band_idx = phy->mt76->band_idx,
};
- struct mt76_power_limits la = {};
+ struct mt7996_power_path_limits *path;
+ struct mt76_power_limits *la;
struct sk_buff *skb;
- int i, tx_power;
+ int i, ret, target_power, tx_power;
- tx_power = mt76_get_power_bound(mphy, phy->txpower);
- tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
- &la, tx_power);
- mphy->txpower_cur = tx_power;
+ target_power = mt76_get_power_bound(mphy, phy->txpower);
+ tx_power = target_power;
+ if (phy->sku_limit_en) {
+ la = kzalloc(sizeof(*la), GFP_KERNEL);
+ if (!la)
+ return -ENOMEM;
+
+ tx_power = mt76_get_rate_power_limits(mphy, mphy->chandef.chan,
+ la, tx_power);
+ mphy->txpower_cur = tx_power;
+ } else {
+ mphy->txpower_cur = tx_power;
+ return 0;
+ }
skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
sizeof(req) + MT7996_SKU_PATH_NUM);
if (!skb)
- return -ENOMEM;
+ goto err_nomem;
skb_put_data(skb, &req, sizeof(req));
/* cck and ofdm */
- skb_put_data(skb, &la.cck, sizeof(la.cck));
- skb_put_data(skb, &la.ofdm, sizeof(la.ofdm));
+ skb_put_data(skb, &la->cck, MT7996_SKU_RATE_CCK_OFDM_LEN);
/* ht20 */
- skb_put_data(skb, &la.mcs[0], 8);
+ skb_put_data(skb, &la->mcs[0], MT7996_SKU_RATE_HT20_LEN);
/* ht40 */
- skb_put_data(skb, &la.mcs[1], 9);
+ skb_put_data(skb, &la->mcs[1], MT7996_SKU_RATE_HT40_LEN);
/* vht */
- for (i = 0; i < 4; i++) {
- skb_put_data(skb, &la.mcs[i], sizeof(la.mcs[i]));
- skb_put_zero(skb, 2); /* padding */
+ for (i = 0; i < MT7996_SKU_RATE_VHT_NUM; i++) {
+ skb_put_data(skb, &la->mcs[i], MT7996_SKU_RATE_VHT_LEN);
+ skb_put_zero(skb, MT7996_SKU_RATE_VHT_PAD_LEN);
}
/* he */
- skb_put_data(skb, &la.ru[0], sizeof(la.ru));
+ skb_put_data(skb, &la->ru[0], MT7996_SKU_RATE_HE_LEN);
/* eht */
- skb_put_data(skb, &la.eht[0], sizeof(la.eht));
+ skb_put_data(skb, &la->eht[0], MT7996_SKU_RATE_EHT_LEN);
/* padding */
skb_put_zero(skb, MT7996_SKU_PATH_NUM - MT7996_SKU_RATE_NUM);
- return mt76_mcu_skb_send_msg(&dev->mt76, skb,
- MCU_WM_UNI_CMD(TXPOWER), true);
+ ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ MCU_WM_UNI_CMD(TXPOWER), true);
+ if (ret)
+ goto out;
+
+ if (!phy->sku_path_en)
+ goto out;
+
+ path = kzalloc(sizeof(*path), GFP_KERNEL);
+ if (!path)
+ goto err_nomem;
+
+ mt7996_get_power_path_limits(mphy, mphy->chandef.chan, path,
+ target_power);
+
+ skb = mt76_mcu_msg_alloc(&dev->mt76, NULL,
+ sizeof(req) + MT7996_SKU_PATH_NUM);
+ if (!skb)
+ goto err_nomem_path;
+
+ req.power_limit_type = TX_POWER_LIMIT_TABLE_PATH;
+
+ skb_put_data(skb, &req, sizeof(req));
+ skb_put_data(skb, &path->cck, MT7996_SKU_PATH_CCK_LEN);
+ skb_put_data(skb, &path->ofdm, MT7996_SKU_PATH_OFDM_LEN);
+ skb_put_data(skb, &path->ofdm_bf, MT7996_SKU_PATH_OFDM_BF_LEN);
+
+ for (i = 0; i < MT7996_SKU_PATH_RU_GROUPS; i++) {
+ bool bf = i % 2;
+ u8 idx = i / 2;
+ s8 *buf = bf ? path->ru_bf[idx] : path->ru[idx];
+
+ skb_put_data(skb, buf, MT7996_SKU_PATH_RU_LEN);
+ }
+
+ ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ MCU_WM_UNI_CMD(TXPOWER), true);
+ kfree(path);
+ goto out;
+
+err_nomem_path:
+ kfree(path);
+err_nomem:
+ ret = -ENOMEM;
+out:
+ kfree(la);
+ return ret;
}
int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode)
diff --git a/mt7996/mcu.h b/mt7996/mcu.h
index 55d42c9e..fe7b7d9d 100644
--- a/mt7996/mcu.h
+++ b/mt7996/mcu.h
@@ -1030,9 +1030,34 @@ enum {
};
enum {
+ UNI_TXPOWER_SKU_POWER_LIMIT_CTRL = 0,
+ UNI_TXPOWER_PERCENTAGE_CTRL = 1,
+ UNI_TXPOWER_PERCENTAGE_DROP_CTRL = 2,
+ UNI_TXPOWER_BACKOFF_POWER_LIMIT_CTRL = 3,
UNI_TXPOWER_POWER_LIMIT_TABLE_CTRL = 4,
+ UNI_TXPOWER_ATE_MODE_CTRL = 6,
+ UNI_TXPOWER_SHOW_INFO = 7,
};
+struct tx_power_ctrl {
+ u8 _rsv[4];
+
+ __le16 tag;
+ __le16 len;
+
+ u8 power_ctrl_id;
+ union {
+ bool sku_enable;
+ bool ate_mode_enable;
+ bool percentage_ctrl_enable;
+ bool bf_backoff_enable;
+ u8 show_info_category;
+ u8 power_drop_level;
+ };
+ u8 band_idx;
+ u8 rsv[1];
+} __packed;
+
enum {
UNI_CMD_ACCESS_REG_BASIC = 0x0,
UNI_CMD_ACCESS_RF_REG_BASIC,
diff --git a/mt7996/mt7996.h b/mt7996/mt7996.h
index 0d648852..7e9e106f 100644
--- a/mt7996/mt7996.h
+++ b/mt7996/mt7996.h
@@ -400,6 +400,8 @@ struct mt7996_phy {
bool has_aux_rx;
bool counter_reset;
bool rdd_tx_paused;
+ bool sku_limit_en;
+ bool sku_path_en;
};
struct mt7996_dev {
@@ -775,6 +777,10 @@ int mt7996_mcu_get_chan_mib_info(struct mt7996_phy *phy, bool chan_switch);
int mt7996_mcu_get_temperature(struct mt7996_phy *phy);
int mt7996_mcu_set_thermal_throttling(struct mt7996_phy *phy, u8 state);
int mt7996_mcu_set_thermal_protect(struct mt7996_phy *phy, bool enable);
+bool mt7996_has_power_path_limits(struct mt76_phy *mphy,
+ struct ieee80211_channel *chan);
+int mt7996_mcu_set_tx_power_ctrl(struct mt7996_phy *phy, u8 power_ctrl_id,
+ u8 data);
int mt7996_mcu_set_txpower_sku(struct mt7996_phy *phy);
int mt7996_mcu_rdd_resume_tx(struct mt7996_phy *phy);
int mt7996_mcu_rdd_cmd(struct mt7996_dev *dev, int cmd, u8 rdd_idx, u8 val);
--
2.43.0
^ permalink raw reply related
* [PATCH v1 1/2] wifi: mt76: mt7996: refresh power limits on txpower changes
From: Yanghan Ye @ 2026-06-24 14:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Deren Wu
Cc: linux-mediatek, linux-wireless, Yanghan Ye
In-Reply-To: <20260624144516.1841063-1-yyh94306@gmail.com>
mt7996_config() currently ignores mac80211 configuration changes. As a
result, user txpower updates may change the cfg80211 visible power level
without refreshing the firmware SKU table used by mt7996.
Refresh the SKU table when mac80211 reports power or channel changes. Only
copy hw->conf.power_level into the cached PHY txpower on global power
changes so channel-only updates do not overwrite a BSS txpower limit.
Also refresh the SKU table and channel information for BSS txpower changes,
and report MCU failures instead of silently ignoring them.
Signed-off-by: Yanghan Ye <yyh94306@gmail.com>
---
mt7996/main.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 60 insertions(+), 2 deletions(-)
diff --git a/mt7996/main.c b/mt7996/main.c
index 560fe30d..c32e7819 100644
--- a/mt7996/main.c
+++ b/mt7996/main.c
@@ -736,7 +736,50 @@ static int mt7996_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
static int mt7996_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)
{
- return 0;
+ struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ struct mt7996_phy *phy;
+ int ret = 0;
+
+ if (!(changed & (IEEE80211_CONF_CHANGE_POWER |
+ IEEE80211_CONF_CHANGE_CHANNEL)))
+ return 0;
+
+ mutex_lock(&dev->mt76.mutex);
+
+ if (radio_idx >= 0) {
+ if (radio_idx >= ARRAY_SIZE(dev->radio_phy)) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ phy = dev->radio_phy[radio_idx];
+ if (phy) {
+ if (changed & IEEE80211_CONF_CHANGE_POWER)
+ phy->txpower = hw->conf.power_level;
+
+ ret = mt7996_mcu_set_txpower_sku(phy);
+ if (!ret && (changed & IEEE80211_CONF_CHANGE_POWER))
+ ret = mt7996_mcu_set_chan_info(phy,
+ UNI_CHANNEL_SWITCH);
+ }
+ } else {
+ mt7996_for_each_phy(dev, phy) {
+ if (changed & IEEE80211_CONF_CHANGE_POWER)
+ phy->txpower = hw->conf.power_level;
+
+ ret = mt7996_mcu_set_txpower_sku(phy);
+ if (!ret && (changed & IEEE80211_CONF_CHANGE_POWER))
+ ret = mt7996_mcu_set_chan_info(phy,
+ UNI_CHANNEL_SWITCH);
+ if (ret)
+ break;
+ }
+ }
+
+out:
+ mutex_unlock(&dev->mt76.mutex);
+
+ return ret;
}
static int
@@ -1025,9 +1068,24 @@ mt7996_link_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
mt7996_update_mu_group(hw, link, info);
if (changed & BSS_CHANGED_TXPOWER &&
+ info->txpower != INT_MIN &&
info->txpower != phy->txpower) {
+ int ret;
+
phy->txpower = info->txpower;
- mt7996_mcu_set_txpower_sku(phy);
+ ret = mt7996_mcu_set_txpower_sku(phy);
+ if (ret) {
+ dev_err_ratelimited(dev->mt76.dev,
+ "failed to update txpower SKU: %d\n",
+ ret);
+ goto out;
+ }
+
+ ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_SWITCH);
+ if (ret)
+ dev_err_ratelimited(dev->mt76.dev,
+ "failed to update txpower channel info: %d\n",
+ ret);
}
out:
--
2.43.0
^ permalink raw reply related
* [PATCH v1 0/2] wifi: mt76: mt7996: fix runtime txpower limits
From: Yanghan Ye @ 2026-06-24 14:45 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Deren Wu
Cc: linux-mediatek, linux-wireless, Yanghan Ye
Refresh the mt7996 firmware power limit table when mac80211 reports
txpower changes, and enable the firmware TXPOWER SKU/backoff controls
needed for uploaded tables to take effect.
Tested on an XR1710G/MT7996 device with 6 GHz AP mode. The reported
txpower follows `iw dev ... set txpower fixed 1000/2000`, and measured
signal level changes accordingly.
Yanghan Ye (2):
wifi: mt76: mt7996: refresh power limits on txpower changes
wifi: mt76: mt7996: enable firmware txpower limit controls
eeprom.c | 9 ++
mt7996/init.c | 16 ++-
mt7996/main.c | 72 +++++++++-
mt7996/mcu.c | 365 +++++++++++++++++++++++++++++++++++++++++++++---
mt7996/mcu.h | 25 ++++
mt7996/mt7996.h | 6 +
6 files changed, 471 insertions(+), 22 deletions(-)
base-commit: 2dd6e4c8892f59b7943ee163afd6ced881bfb31b
--
2.43.0
^ permalink raw reply
* subscribe linux-wireless
From: Yu Zhang(Yuriy) @ 2026-06-24 11:15 UTC (permalink / raw)
To: linux-wireless
subscribe linux-wireless
^ permalink raw reply
* Invitation to Register as an Approved Vendor with Bapco Energies
From: bh1.bapcoenergies @ 2026-06-24 10:43 UTC (permalink / raw)
To: linux-wireless
Bapco Energies is pleased to invite your organization to participate in our Vendor Registration and Prequalification Program for the 2026/2027 business cycle.
As part of our commitment to building strong and sustainable partnerships, this program is designed to identify qualified, experienced, and reputable suppliers capable of supporting our operational, maintenance, and project requirements. Suppliers who successfully complete the prequalification process will be considered for future procurement opportunities and potential long-term business engagements with Bapco Energies.
Should your organization be interested in participating, please respond to this email or contact our Procurement Team at tender@bhbapco-energies.com to request the Vendor Questionnaire and receive additional information regarding the registration, evaluation, and prequalification procedures.
We appreciate your interest in partnering with Bapco Energies and look forward to the possibility of establishing a successful and mutually beneficial business relationship.
Yours faithfully,
Mr. Firdaus Panthaki
Procurement & Supply Officer
Bapco Energies
^ permalink raw reply
* Re: [PATCH ath-next] wifi: ath12k: remove unused QMI definitions
From: Baochen Qiang @ 2026-06-24 9:41 UTC (permalink / raw)
To: Aaradhana Sahu, ath12k; +Cc: linux-wireless
In-Reply-To: <20260623035104.3765404-1-aaradhana.sahu@oss.qualcomm.com>
On 6/23/2026 11:51 AM, Aaradhana Sahu wrote:
> The driver contains several unused QMI definitions such as response
> length macros, message IDs, firmware segment length definitions, and
> CALDB address size definitions.
>
> Remove these unused definitions as they are not referenced anywhere in
> the driver.
>
> No functional change intended.
>
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
>
> Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply
* Re: [PATCH ath-next] wifi: ath12k: use %u for unsigned variables in QMI debug logs
From: Baochen Qiang @ 2026-06-24 9:39 UTC (permalink / raw)
To: Raj Kumar Bhagat, Jeff Johnson; +Cc: linux-wireless, ath12k, linux-kernel
In-Reply-To: <20260623-qmi-debug-log-v1-1-79471aa8b898@oss.qualcomm.com>
On 6/23/2026 12:04 PM, Raj Kumar Bhagat wrote:
> Replace incorrect %d format specifiers with %u for unsigned variables
> in qmi.c debug messages. Also add missing trailing '\n' in log messages
> to ensure proper termination. No functional change intended.
>
> Tested-on: Compile tested only.
>
> Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply
* Re: [PATCH ath-next] wifi: ath12k: Fix inconsistencies in struct qmi_elem_info initializers
From: Baochen Qiang @ 2026-06-24 9:36 UTC (permalink / raw)
To: Raj Kumar Bhagat, Jeff Johnson; +Cc: linux-wireless, ath12k, linux-kernel
In-Reply-To: <20260623-qmi-inconsistencies-v1-1-0fc17f2b8338@oss.qualcomm.com>
On 6/23/2026 12:13 PM, Raj Kumar Bhagat wrote:
> Currently, the struct qmi_elem_info initializers in qmi.c are inconsistent
> in how they align the assignments, with tabs being used in the majority of
> places but spaces being used in some places. In those places replace the
> spaces with tabs for consistency.
>
> Also fix incorrect and missing terminating records in the following
> qmi_elem_info initializers:
> - qmi_wlanfw_shadow_reg_cfg_s_v01_ei[]
> - qmi_wlanfw_mem_ready_ind_msg_v01_ei[]
> - qmi_wlanfw_fw_ready_ind_msg_v01_ei[]
>
> Tested-on: Compile tested only.
>
> Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply
* Re: [PATCH ath-next v2] wifi: ath12k: advertise ieee_link_id in vdev start MLO params
From: Rameshkumar Sundaram @ 2026-06-24 9:11 UTC (permalink / raw)
To: Manish Dharanenthiran, ath12k
Cc: linux-wireless, Hari Naraayana Desikan Kannan, Karthik M
In-Reply-To: <20260623-ieee_link_id-v2-1-8a89d71baf58@oss.qualcomm.com>
On 6/23/2026 11:16 AM, Manish Dharanenthiran wrote:
> Firmware builds the AP MLD partner profile from the hw_link_id passed in
> the vdev start parameters. However, hw_link_id is not always the same as
> the logical per-MLD ieee_link_id, since ieee_link_id is assigned per MLD
> and not per pdev.
>
> This matters in mixed MLO and SLO setups. For example:
>
> MLD 1 - 5 GHz + 6 GHz (2-link MLO): ieee_link_id 0 and 1
> MLD 2 - 6 GHz only (1-link SLO): ieee_link_id 0
> MLD 3 - 5 GHz only (1-link SLO): ieee_link_id 0
>
> The same physical 6 GHz radio can use ieee_link_id 1 for one
> MLD and ieee_link_id 0 for another. Pass the correct ieee_link_id to
> firmware so it can build accurate per-STA profile elements.
>
> Add ieee_link_id to wmi_vdev_start_mlo_params for the self link and to
> wmi_partner_link_info for each partner link. Populate these fields in
> ath12k_mac_mlo_get_vdev_args() from the corresponding vdev link_id
> before encoding the WMI command.
>
> Introduce two new flags in ML params to indicate to firmware when
> the new fields are valid:
>
> ATH12K_WMI_FLAG_MLO_IEEE_LINK_IDX_VALID BIT(18) for the self link
> ATH12K_WMI_FLAG_MLO_IEEE_LINK_IDX_VALID_PARTNER BIT(19) for partner links
>
> Firmware parses ieee_link_id only when the matching flag is set.
>
> Also fix the debug message by using correct format specifiers and host-endian
> values instead of __le32 values.
>
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
>
> Co-developed-by: Hari Naraayana Desikan Kannan <hari.kannan@oss.qualcomm.com>
> Signed-off-by: Hari Naraayana Desikan Kannan <hari.kannan@oss.qualcomm.com>
> Co-developed-by: Karthik M <karthik.m@oss.qualcomm.com>
> Signed-off-by: Karthik M <karthik.m@oss.qualcomm.com>
> Signed-off-by: Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
--
--
Ramesh
^ permalink raw reply
* [PATCH wireless] wifi: libertas: fix memory leak in helper_firmware_cb()
From: Dawei Feng @ 2026-06-24 8:53 UTC (permalink / raw)
To: linux-wireless
Cc: dcbw, linville, libertas-dev, linux-kernel, jianhao.xu, zilin,
Dawei Feng, stable
helper_firmware_cb() neglects to free the single-stage firmware image
after a successful async load, leading to a memory leak in the USB
firmware-download path.
Fix this memory leak by calling release_firmware() immediately after
lbs_fw_loaded() returns.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
the current wireless tree.
An x86_64 allyesconfig build showed no new warnings. As we do not have
compatible Libertas USB hardware for exercising this firmware-download
path, no runtime testing was able to be performed.
Fixes: 1dfba3060fe7 ("libertas: move firmware lifetime handling to firmware.c")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
drivers/net/wireless/marvell/libertas/firmware.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/marvell/libertas/firmware.c b/drivers/net/wireless/marvell/libertas/firmware.c
index f124110944b7..9bf7d4c207b9 100644
--- a/drivers/net/wireless/marvell/libertas/firmware.c
+++ b/drivers/net/wireless/marvell/libertas/firmware.c
@@ -78,6 +78,7 @@ static void helper_firmware_cb(const struct firmware *firmware, void *context)
} else {
/* No main firmware needed for this helper --> success! */
lbs_fw_loaded(priv, 0, firmware, NULL);
+ release_firmware(firmware);
}
}
--
2.34.1
^ permalink raw reply related
* Re: [PATCH ath-next] wifi: ath12k: Fix inconsistencies in struct qmi_elem_info initializers
From: Rameshkumar Sundaram @ 2026-06-24 8:51 UTC (permalink / raw)
To: Raj Kumar Bhagat, Jeff Johnson; +Cc: linux-wireless, ath12k, linux-kernel
In-Reply-To: <20260623-qmi-inconsistencies-v1-1-0fc17f2b8338@oss.qualcomm.com>
On 6/23/2026 9:43 AM, Raj Kumar Bhagat wrote:
> Currently, the struct qmi_elem_info initializers in qmi.c are inconsistent
> in how they align the assignments, with tabs being used in the majority of
> places but spaces being used in some places. In those places replace the
> spaces with tabs for consistency.
>
> Also fix incorrect and missing terminating records in the following
> qmi_elem_info initializers:
> - qmi_wlanfw_shadow_reg_cfg_s_v01_ei[]
> - qmi_wlanfw_mem_ready_ind_msg_v01_ei[]
> - qmi_wlanfw_fw_ready_ind_msg_v01_ei[]
>
> Tested-on: Compile tested only.
>
> Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
^ permalink raw reply
* [PATCH wireless] wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
From: Dawei Feng @ 2026-06-24 8:44 UTC (permalink / raw)
To: miriam.rachel.korenblit
Cc: tglx, mingo, jiasheng, kees, johannes.berg, error27,
emmanuel.grumbach, linux-wireless, linux-kernel, jianhao.xu,
zilin, Dawei Feng, stable
In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses
the out_free_eeprom_blob label. Consequently, error paths triggered after
successfully parsing the EEPROM free priv->nvm_data but leak
priv->eeprom_blob.
Fix this memory leak by reordering the error handling labels so
that out_free_eeprom falls through to out_free_eeprom_blob.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc6.
An x86_64 allyesconfig build showed no new warnings. As we do not have
supported Intel DVM wireless hardware and firmware to test with, no
runtime testing was able to be performed.
Fixes: 26a7ca9a71a3 ("iwlwifi: refactor EEPROM reading/parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
drivers/net/wireless/intel/iwlwifi/dvm/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
index ca5a8140908a..6bd5b6d84b2a 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
@@ -1511,10 +1511,10 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
priv->workqueue = NULL;
out_uninit_drv:
iwl_uninit_drv(priv);
-out_free_eeprom_blob:
- kfree(priv->eeprom_blob);
out_free_eeprom:
kfree(priv->nvm_data);
+out_free_eeprom_blob:
+ kfree(priv->eeprom_blob);
out_leave_trans:
iwl_trans_op_mode_leave(priv->trans);
out_free_hw:
--
2.34.1
^ permalink raw reply related
* Re: [PATCH ath-next] wifi: ath12k: use %u for unsigned variables in QMI debug logs
From: Rameshkumar Sundaram @ 2026-06-24 8:33 UTC (permalink / raw)
To: Raj Kumar Bhagat, Jeff Johnson; +Cc: linux-wireless, ath12k, linux-kernel
In-Reply-To: <20260623-qmi-debug-log-v1-1-79471aa8b898@oss.qualcomm.com>
On 6/23/2026 9:34 AM, Raj Kumar Bhagat wrote:
> Replace incorrect %d format specifiers with %u for unsigned variables
> in qmi.c debug messages. Also add missing trailing '\n' in log messages
> to ensure proper termination. No functional change intended.
>
> Tested-on: Compile tested only.
>
> Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
^ permalink raw reply
* Re: [PATCH v10] Add device-specific reset for Qualcomm devices
From: Baochen Qiang @ 2026-06-24 7:47 UTC (permalink / raw)
To: Jose Ignacio Tornos Martinez, bhelgaas, alex, mani
Cc: jjohnson, linux-pci, linux-wireless, ath11k, ath12k, mhi,
linux-kernel
In-Reply-To: <20260623183115.1585273-1-jtornosm@redhat.com>
On 6/24/2026 2:31 AM, Jose Ignacio Tornos Martinez wrote:
> Some Qualcomm PCIe devices (WCN6855/WCN7850 WiFi cards, SDX62/SDX65 modems)
> lack working reset methods for VFIO passthrough scenarios. These devices
> have no FLR capability, advertise NoSoftRst+ (blocking PM reset), and have
> broken bus reset.
>
> The problem manifests in VFIO passthrough scenarios:
>
> - WCN6855 (17cb:1103) and WCN7850 (17cb:1107) WiFi devices:
> Normal VM operation works fine, including clean shutdown/reboot.
> However, when the VM terminates uncleanly (crash, force-off), VFIO
> attempts to reset the device before it can be assigned to another VM.
> Without a working reset method, the device remains in an undefined state,
> preventing reuse.
>
> - SDX62/SDX65 (17cb:0308) 5G modems: Never successfully initialize even
> on first VM assignment without proper reset capability.
>
> Add device-specific reset methods using BAR-space hardware reset registers
> that exist in these devices:
>
> - WCN6855/WCN7850 WiFi devices use SoC global reset via BAR0 (sequence from
> ath11k/ath12k driver: ath11k_pci_soc_global_reset(), ath11k_pci_sw_reset(),
> ath11k_mhi_set_mhictrl_reset()):
> - Write/clear reset bit at offset 0x3008
> - Wait for PCIe link recovery (up to 5 seconds)
> - Clear MHI controller SYSERR status at offset 0x38
>
> - SDX62/SDX65 modem devices use MHI SoC reset via BAR0 (sequence from MHI
> driver: mhi_soc_reset(), mhi_pci_reset_prepare()):
> - Write reset request to offset 0xb0
> - Wait 2 seconds for reset completion
>
> These are true hardware reset mechanisms (not power management or firmware
> error recovery), providing proper device reset for VFIO scenarios.
>
> Testing was performed on desktop platforms with M.2 WiFi and modem cards
> using M.2-to-PCIe adapters, including extensive force-reset cycling to
> verify stability.
>
> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
> ---
> v10:
> - Complete redesign based on maintainer feedback (Manivannan Sadhasivam,
> Alex Williamson): use actual hardware reset registers from
> device drivers instead of D3hot power cycling
> v9: https://lore.kernel.org/all/20260612142638.1243895-1-jtornosm@redhat.com/
>
> drivers/pci/quirks.c | 118 +++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 118 insertions(+)
>
> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index 431c021d7414..8ad3f214e520 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c
> @@ -4240,6 +4240,121 @@ static int reset_hinic_vf_dev(struct pci_dev *pdev, bool probe)
> return 0;
> }
>
> +#define QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET 0x3008
> +#define QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET_V BIT(0)
> +#define QUALCOMM_WIFI_MHISTATUS 0x48
> +#define QUALCOMM_WIFI_MHICTRL 0x38
> +#define QUALCOMM_WIFI_MHICTRL_RESET_MASK 0x2
> +
> +/*
> + * Qualcomm WiFi device-specific reset using SoC global reset via BAR0
> + * registers.
> + */
> +static int reset_qualcomm_wifi(struct pci_dev *pdev, bool probe)
> +{
> + bool link_recovered = false;
> + unsigned long timeout;
> + void __iomem *bar;
> + u32 val;
> + u16 cmd;
> +
> + if (probe)
> + return 0;
> +
> + if (pdev->current_state != PCI_D0)
> + return -EINVAL;
> +
> + pci_read_config_word(pdev, PCI_COMMAND, &cmd);
> + pci_write_config_word(pdev, PCI_COMMAND, cmd | PCI_COMMAND_MEMORY);
> +
> + bar = pci_iomap(pdev, 0, 0);
> + if (!bar) {
> + pci_write_config_word(pdev, PCI_COMMAND, cmd);
> + return -ENODEV;
> + }
> +
> + val = ioread32(bar + QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET);
QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET is beyond the first 4K bar area hence requires MHI
wakeup before accessing, see [1]. the wakeup callback for WCN6855 is
ath11k_pci_bus_wake_up() which calls mhi_device_get_sync(). Not sure how this can be done
here. Maybe Mani can provide some hints?
[1]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/wireless/ath/ath11k/pcic.c#n216
> + val |= QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET_V;
> + iowrite32(val, bar + QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET);
> + ioread32(bar + QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET);
> +
> + msleep(10);
> +
> + val &= ~QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET_V;
> + iowrite32(val, bar + QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET);
> + ioread32(bar + QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET);
> +
> + msleep(10);
> +
> + timeout = jiffies + msecs_to_jiffies(5000);
> + while (time_before(jiffies, timeout)) {
> + val = ioread32(bar + QUALCOMM_WIFI_PCIE_SOC_GLOBAL_RESET);
> + if (val != 0xffffffff) {
> + link_recovered = true;
> + break;
> + }
> + msleep(20);
> + }
> +
> + if (!link_recovered) {
> + pci_err(pdev, "PCIe link failed to recover after reset\n");
> + goto out_restore;
> + }
> +
> + /* After SOC_GLOBAL_RESET, MHISTATUS may still have SYSERR bit set
> + * and thus need to set MHICTRL_RESET to clear SYSERR.
> + */
> + iowrite32(QUALCOMM_WIFI_MHICTRL_RESET_MASK, bar + QUALCOMM_WIFI_MHICTRL);
> + ioread32(bar + QUALCOMM_WIFI_MHICTRL);
> +
> + msleep(10);
> +
> +out_restore:
> + pci_iounmap(pdev, bar);
> + pci_write_config_word(pdev, PCI_COMMAND, cmd);
> +
> + return link_recovered ? 0 : -ETIMEDOUT;
> +}
> +
> +#define MHI_SOC_RESET_REQ_OFFSET 0xb0
> +#define MHI_SOC_RESET_REQ BIT(0)
> +
> +/*
> + * Qualcomm modem device-specific reset using MHI SoC reset via BAR0
> + * register.
> + */
> +static int reset_qualcomm_modem(struct pci_dev *pdev, bool probe)
> +{
> + void __iomem *bar;
> + u16 cmd;
> +
> + if (probe)
> + return 0;
> +
> + if (pdev->current_state != PCI_D0)
> + return -EINVAL;
> +
> + pci_read_config_word(pdev, PCI_COMMAND, &cmd);
> + pci_write_config_word(pdev, PCI_COMMAND, cmd | PCI_COMMAND_MEMORY);
> +
> + bar = pci_iomap(pdev, 0, 0);
> + if (!bar) {
> + pci_write_config_word(pdev, PCI_COMMAND, cmd);
> + return -ENODEV;
> + }
> +
> + iowrite32(MHI_SOC_RESET_REQ, bar + MHI_SOC_RESET_REQ_OFFSET);
> + ioread32(bar + MHI_SOC_RESET_REQ_OFFSET);
> +
> + /* Be sure device reset has been executed */
> + msleep(2000);
> +
> + pci_iounmap(pdev, bar);
> + pci_write_config_word(pdev, PCI_COMMAND, cmd);
> +
> + return 0;
> +}
> +
> static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
> { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82599_SFP_VF,
> reset_intel_82599_sfp_virtfn },
> @@ -4255,6 +4370,9 @@ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
> reset_chelsio_generic_dev },
> { PCI_VENDOR_ID_HUAWEI, PCI_DEVICE_ID_HINIC_VF,
> reset_hinic_vf_dev },
> + { PCI_VENDOR_ID_QCOM, 0x1103, reset_qualcomm_wifi }, /* WCN6855 WiFi */
> + { PCI_VENDOR_ID_QCOM, 0x1107, reset_qualcomm_wifi }, /* WCN7850 WiFi */
> + { PCI_VENDOR_ID_QCOM, 0x0308, reset_qualcomm_modem }, /* SDX62/SDX65 modems */
> { 0 }
> };
>
^ permalink raw reply
* [PATCH] wifi: carl9170: bail out on invalid command response to fix stack-out-of-bounds write
From: hewei-gikaku @ 2026-06-24 5:32 UTC (permalink / raw)
To: Christian Lamparter
Cc: linux-wireless, linux-kernel, HE WEI, syzbot+5c1ca6ccaa1215781cac
From: HE WEI (ギカク) <skyexpoc@gmail.com>
carl9170_cmd_callback() copies a command response coming from the USB
device into ar->readbuf using the device-reported length:
memcpy(ar->readbuf, buffer + 4, len - 4);
ar->readbuf points at the buffer supplied by the caller of
carl9170_exec_cmd(), which is frequently an on-stack buffer sized to the
expected response length (ar->readlen).
The preceding sanity check only emits a warning and schedules a restart
when ar->readlen != len - 4; it does not stop processing, so the
memcpy() still runs with the attacker-controlled length. A malicious or
malfunctioning AR9170 USB device can therefore answer a pending command
with an over-sized response and overflow ar->readbuf, as reported by
syzbot:
BUG: KASAN: stack-out-of-bounds Write in carl9170_handle_command_response
The comment in that branch already documents the intended behaviour
("Do not complete. The command times out, and we get a stack trace from
there."), but the return statement was missing. Return after
carl9170_restart() so an over-/under-sized response is neither copied
into ar->readbuf nor completed; carl9170_exec_cmd() then times out and
clears readbuf in its error path.
Reported-by: syzbot+5c1ca6ccaa1215781cac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
Signed-off-by: HE WEI (ギカク) <skyexpoc@gmail.com>
---
drivers/net/wireless/ath/carl9170/rx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -145,6 +145,7 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
* and we get a stack trace from there.
*/
carl9170_restart(ar, CARL9170_RR_INVALID_RSP);
+ return;
}
spin_lock(&ar->cmd_lock);
--
2.43.0
^ permalink raw reply
* RE: [REGRESSION] rtw89: RTL8922AE Wi-Fi broken in Kernel 7.0 (and 6.18+) due to mac80211 API changes
From: Ping-Ke Shih @ 2026-06-24 5:23 UTC (permalink / raw)
To: Gmail, linux-wireless@vger.kernel.org
In-Reply-To: <c26fda96-aa91-4372-8d24-35d3fa44fc09@gmail.com>
Gmail <helder.bertoldo@gmail.com> wrote:
> I am reporting a regression regarding the Realtek RTL8922AE Wi-Fi
> adapter (rtw89) on a Gigabyte X870M Aorus Elite Wifi7 motherboard.
>
> The adapter works perfectly on Kernel 6.17.7, but it fails to initialize
> or is not recognized in newer kernels, specifically 6.18, 6.19, and the
> current 7.0.x series used in the Bazzite (Fedora-based) testing branch.
Please share kernel log of 6.17.7 (work well) and 6.18 (failed to initialize).
I checked the change of the rtw89 driver from 6.17 to 6.18, but I can't
find the obvious change for RTL8922AE though.
>
> Technical details:
> The issue seems related to recent architectural changes in the mac80211
> subsystem:
>
> 1. Signature changes in 'struct ieee80211_ops': Several callbacks
> (including .config, .stop, and .set_rts_threshold) now require the
> 'radio_idx' parameter to support multi-radio wiphy/MLO. It appears the
> rtw89 driver in these kernel builds might not have been fully updated to
> match these new signatures, leading to incompatible pointer type errors
> or initialization failures.
Are you sure? The changes of API will be compatible with existing
functionalities.
>
> 2. Removal of init_dummy_netdev: The driver code seems to still
> reference init_dummy_netdev, which was replaced by alloc_netdev_dummy()
> in the wireless-next/net-next trees.
It has been alloc_netdev_dummy() already.
If you are using out-of-tree driver, please just use in-tree driver.
>
> Hardware Info:
> - Chipset: Realtek RTL8922AE
> - PCI ID: [10ec:8922] (Please verify this ID on your system using 'lspci
> -nn')
> - Working Kernel: 6.17.7
> - Broken Kernels: 6.18.x, 6.19.x, 7.0.x
>
> I am using the OGC Kernel from the Bazzite project, but the issue
> appears to stem from the upstream driver synchronization with the new
> mac80211 API.
Can you use 6.17.7 and then apply patches of the rtw89 driver one by one
from 6.18.x? That can find the cause.
>
> Are there any pending patches in the rtw-next tree that address these
> specific ieee80211_ops signature changes for the 8922AE?
The number of rtw89 patches between 6.17 and 6.18 is about 40.
Trying above suggestion will be easier to address problem.
^ permalink raw reply
* [PATCH rtw-next 10/10] wifi: rtw89: coex: Add RTL8922D chip string
From: Ping-Ke Shih @ 2026-06-24 3:39 UTC (permalink / raw)
To: linux-wireless; +Cc: ku920601
In-Reply-To: <20260624033941.45918-1-pkshih@realtek.com>
From: Ching-Te Ku <ku920601@realtek.com>
Add string for logic using and show logs.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/coex.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index 6f9bb31b5263..1361d4d54528 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -313,6 +313,7 @@ static u32 chip_id_to_bt_rom_code_id(u32 id)
case RTL8851B:
return 0x8851;
case RTL8922A:
+ case RTL8922D:
return 0x8922;
default:
return 0;
@@ -347,6 +348,8 @@ static char *chip_id_str(u32 id)
return "RTL8851B";
case RTL8922A:
return "RTL8922A";
+ case RTL8922D:
+ return "RTL8922D";
default:
return "UNKNOWN";
}
--
2.25.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox