Commit graph

1,426,898 commits

Author SHA1 Message Date
Jack Kao
2a035ae206 wifi: mt76: mt7925: cqm rssi low/high event notify
The implementation amounts to setting the driver flag
IEEE80211_VIF_SUPPORTS_CQM_RSSI, and then providing
mechanisms for continuously updating enough information
to be able to provide notifications to userspace when
RSSI drops below a certain threshold

Signed-off-by: Jack Kao <jack.kao@mediatek.com>
Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251001012506.2168037-1-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:59:11 +01:00
Marco Crivellari
ee518f914c wifi: mt76: replace use of system_wq with system_percpu_wq
Currently if a user enqueue a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.

This lack of consistentcy cannot be addressed without refactoring the API.
For more details see the Link tag below.

This continues the effort to refactor workqueue APIs, which began with
the introduction of new workqueues and a new alloc_workqueue flag in:

commit 128ea9f6cc ("workqueue: Add system_percpu_wq and system_dfl_wq")
commit 930c2ea566 ("workqueue: Add new WQ_PERCPU flag")

Switch to using system_percpu_wq because system_wq is going away as part of
a workqueue restructuring.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Link: https://patch.msgid.link/20250922093243.140946-2-marco.crivellari@suse.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:58:52 +01:00
Denis Benato
f72c8ab579
platform/x86: asus-armoury: fix only DC tunables being available
Module asus-armoury must use AC tunables to check availability
of power-related firmware attributes: fix missing attributes
by using AC attributes instead of DC.

Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20251123150535.267339-1-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-11-24 15:53:36 +02:00
Fedor Pchelkin
5ef6de7bad wifi: mt76: adjust BSS conf pointer handling
Passing a BSS conf pointer to mt76_connac2_mac_tx_rate_val() currently has
two inconsistencies.

When called from mt76_connac2_mac_write_txwi(), BSS conf is got by
dereferencing a vif pointer.  A NULL vif isn't accounted for though the
function itself supposes it to be NULL and tries to handle this case in
previous checks.  This looks like a cosmetic change since the drivers
calling the function (namely, mt7915 and mt7921) set WANT_MONITOR_VIF flag
so judging by info->control.vif initialization inside ieee80211_tx_*()
routines it can't actually come as NULL here.

The same holds for the BSS conf pointer handling inside
mt76_connac2_mac_tx_rate_val().  It is dereferenced before being checked
for NULL.  The function supposes to handle the case so reorder the check
and dereference of the pointer.  Again, this looks like a syntax issue
only.

Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.

Co-developed-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20251027111843.38975-2-pchelkin@ispras.ru
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Fedor Pchelkin
cdb2941a51 Revert "wifi: mt76: mt792x: improve monitor interface handling"
This reverts commit 55e95ce469.

mt792x drivers don't seem to support multi-radio devices yet.  At least
they don't mess with `struct wiphy_radio` at the moment.

Packet capturing on monitor interface doesn't work after the blamed patch:

  tcpdump -i wls6mon -n -vvv

Revert the NO_VIRTUAL_MONITOR feature for now to resolve the issue.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 55e95ce469 ("wifi: mt76: mt792x: improve monitor interface handling")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20251027111843.38975-1-pchelkin@ispras.ru
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Caleb James DeLisle
2df00805f7 wifi: mt76: mmio_*_copy fix byte order and alignment
Update functions which copy to and from MMIO to load bytes as Little
Endian, and also support unaligned buffers.

PCI devices almost universally use Little Endian ordering for MMIO
registers, mt76 is no exception. PCI hardware that is designed to work
with Big Endian CPUs often (but not always) "helps" by transparently
byte-swapping MMIO reads and writes on the wire. If this is enabled
then it cannot be turned off for a single write. On hardware which does
not support this, writel() does the swap in software. When we are
transferring arbitrary bytes to MMIO space, we need them to arrive in
the same order they were in memory, so when the hardware swaps them
this is a problem. Rather than care about how our PCI host controller
works, we instead load bytes as Little Endian - so on a Big Endian
machine this will reverse them, then we use writel() which will put
them back in the right order again. This way we do not make it our
business whether the swapping is done in software or hardware.

Furthermore, inspection of the code shows that these functions are
often called with stack-allocated u8 arrays which have no alignment
guarantees so we now use (get|put)_unaligned_le32().

Fixes this issue:
mt76x2e 0000:02:00.0: ROM patch build: 20141115060606a
mt76x2e 0000:02:00.0: Firmware Version: 0.0.00
mt76x2e 0000:02:00.0: Build: 1
mt76x2e 0000:02:00.0: Build Time: 201607111443____
mt76x2e 0000:02:00.0: Firmware failed to start
mt76x2e 0000:02:00.0: probe with driver mt76x2e failed with error -145

Tested on:
SmartFiber XP8421-B (Big Endian MIPS 34Kc)
  - MT7612 -> 5g / ap / psk2
  - MT7603 -> 2g / sta / psk2
  - MT7603 -> 2g / ap / psk2
TpLink Archer v1200v-v2 (Big Endian MIPS 34Kc)
  - MT7613 -> 5g / ap / psk2
  - MT7603 -> 2g / sta / psk2

Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://patch.msgid.link/20251029184143.3991388-1-cjd@cjdns.fr
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Ming Yen Hsieh
992c304112 wifi: mt76: mt7925: disable auto regd changes after user set
Add regd_user flag to block automatic regulatory domain updates
if set by user.

Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251031090352.1400079-7-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Ming Yen Hsieh
3bc62aa448 wifi: mt76: mt7925: add auto regdomain switch support
Implement 802.11d-based automatic regulatory domain switching to
dynamically determine the regulatory domain at runtime.

Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251031090352.1400079-6-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Ming Yen Hsieh
6338709a4f wifi: mt76: mt7925: improve EHT capability control in regulatory flow
Move EHT flag handling into mt7925_regd_channel_update() to ensure
correct channel capability reporting.

Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251031090352.1400079-5-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Ming Yen Hsieh
3305100859 wifi: mt76: mt7925: refactor regulatory notifier flow
Rename mt7925_regd_update() to mt7925_mcu_regd_update() to centralize
regd updates with error handling.

Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251031090352.1400079-4-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Ming Yen Hsieh
e323b84127 wifi: mt76: mt7925: refactor CLC support check flow
Move the disable_clc module parameter to regd.c and introduce
mt7925_regd_clc_supported() to centralize CLC support checks.

Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251031090352.1400079-3-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Ming Yen Hsieh
87c3941270 wifi: mt76: mt7925: refactor regulatory domain handling to regd.[ch]
Move regd logic to regd.c and regd.h files

Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
Link: https://patch.msgid.link/20251031090352.1400079-2-mingyen.hsieh@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Rob Herring (Arm)
c1d8beea63 wifi: mt76: Use of_reserved_mem_region_to_resource() for "memory-region"
Use the newly added of_reserved_mem_region_to_resource() function to
handle "memory-region" properties.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patch.msgid.link/20251031175113.1453100-1-robh@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:55 +01:00
Alok Tiwari
9ba77f1a63 wifi: mt76: mt7996: fix typos in comments
Fix two minor comment typos in the mt7996 driver:
- "Tx/Tx" -> "Rx/Tx"
- "tnterrupt" -> "interrupt"

Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Link: https://patch.msgid.link/20251021064812.1778297-1-alok.a.tiwari@oracle.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Lorenzo Bianconi
377aa17d2a wifi: mt76: mt7996: Add NPU offload support to MT7996 driver
Introduce Airoha NPU support to MT7996 driver. NPU is used to enable
traffic forward offloading between the MT76 NIC and the Airoha ethernet one
available on the Airoha EN7581 SoC using Netfilter Flowtable APIs.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-5-ddaa90901723@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Lorenzo Bianconi
7fb554b1b6 wifi: mt76: Introduce the NPU generic layer
Add the NPU generic layer in mt76 module. NPU will be used to enable
traffic forward offloading between the MT76 NIC and the Airoha ethernet one
available on the Airoha EN7581 SoC using Netfilter Flowtable APIs.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-4-ddaa90901723@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Lorenzo Bianconi
f7632a7fdd wifi: mt76: Add the capability to set TX token start ID
This is a preliminary patch to enable traffic forward offloading via the
Airoha NPU module available on the Airoha EN7581 SoC.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-3-ddaa90901723@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Lorenzo Bianconi
a7fb9aac3e wifi: mt76: Add mt76_dev pointer in mt76_queue struct.
This is a preliminary patch to enable traffic forward offloading via the
Airoha NPU module available on the Airoha EN7581 SoC.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-2-ddaa90901723@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Lorenzo Bianconi
e627439aec wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h
This is a preliminary patch to enable traffic forward offloading between
the MT76 NIC and the Airoha ethernet one via the Airoha NPU module
available on the Airoha EN7581 SoC.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-1-ddaa90901723@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Lorenzo Bianconi
2157e49892 wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
Get rid of useless null-pointer check in mt7996_msdu_page_get_from_cache
since we have already verfied the list is not empty.

Fixes: b1e58e137b ("wifi: mt76: mt7996: Introduce RRO MSDU callbacks")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/r/202510100155.MS0IXhzm-lkp@intel.com/
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251014-mt7996_msdu_page_get_from_cache-remove-null-ptr-check-v1-1-fbeb7881e192@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Felix Fietkau
a96fed2825 wifi: mt76: relicense to BSD-3-Clause-Clear
MediaTek has asked to switch from the ISC license to BSD-3-Clause-Clear,
in order to improve clarity and the legal integrity of the code.

The BSD-3-Clause license includes the "no endorsement" clause, which is
important for protecting the reputation of the original authors and
contributors by preventing unauthorized use of their names for endorsement
purposes.

This clause is absent in the BSD-2-Clause license, which is more permissive
but lacks this specific protection.

This change also cleans up the license of some Kconfig/Makefile files,
which were accidentally marked as GPL.

The GPL 2.0 remains in use on mt76x0, as well as two source files in mt7615
for which the license situation still needs to be clarified.

Link: https://patch.msgid.link/20251008104250.46292-2-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Felix Fietkau
909675fd43 wifi: mt76: fix license/copyright of util.h
The extra copyright line for Ivo van Doorn and GPL license was only there
because of code that I had already removed before the initial upstream
submission of mt76.
Remove it and make this header file use ISC license like the rest of the
source files.

Link: https://patch.msgid.link/20251008104250.46292-1-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:54 +01:00
Peter Chiu
a9730354ca wifi: mt76: use GFP_DMA32 for page_pool buffer allocation
Set GFP_DMA32 flag for page_pool buffers allocation since the hw relies
on 32-bit DMA addresses for WED offloading.

Tested-by: Daniel Pawlik <pawlik.dan@gmail.com>
Tested-by: Matteo Croce <teknoraver@meta.com>
Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251008-wed-fixes-v1-2-8f7678583385@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Lorenzo Bianconi
385aab8fcc wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
MT7996 driver can use both wed and wed_hif2 devices to offload traffic
from/to the wireless NIC. In the current codebase we assume to always
use the primary wed device in wed callbacks resulting in the following
crash if the hw runs wed_hif2 (e.g. 6GHz link).

[  297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a
[  297.464928] Mem abort info:
[  297.467722]   ESR = 0x0000000096000005
[  297.471461]   EC = 0x25: DABT (current EL), IL = 32 bits
[  297.476766]   SET = 0, FnV = 0
[  297.479809]   EA = 0, S1PTW = 0
[  297.482940]   FSC = 0x05: level 1 translation fault
[  297.487809] Data abort info:
[  297.490679]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[  297.496156]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  297.501196]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000
[  297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000
[  297.523532] Internal error: Oops: 0000000096000005 [#1] SMP
[  297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G           O       6.12.50 #0
[  297.723908] Tainted: [O]=OOT_MODULE
[  297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT)
[  297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table]
[  297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76]
[  297.752688] lr : mtk_wed_flow_remove+0x58/0x80
[  297.757126] sp : ffffffc080fe3ae0
[  297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7
[  297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00
[  297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018
[  297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000
[  297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000
[  297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da
[  297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200
[  297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002
[  297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000
[  297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8
[  297.831686] Call trace:
[  297.834123]  mt76_wed_offload_disable+0x64/0xa0 [mt76]
[  297.839254]  mtk_wed_flow_remove+0x58/0x80
[  297.843342]  mtk_flow_offload_cmd+0x434/0x574
[  297.847689]  mtk_wed_setup_tc_block_cb+0x30/0x40
[  297.852295]  nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table]
[  297.858466]  nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table]
[  297.864463]  process_one_work+0x174/0x300
[  297.868465]  worker_thread+0x278/0x430
[  297.872204]  kthread+0xd8/0xdc
[  297.875251]  ret_from_fork+0x10/0x20
[  297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421)
[  297.884901] ---[ end trace 0000000000000000 ]---

Fix the issue detecting the proper wed reference to use running wed
callabacks.

Fixes: 83eafc9251 ("wifi: mt76: mt7996: add wed tx support")
Tested-by: Daniel Pawlik <pawlik.dan@gmail.com>
Tested-by: Matteo Croce <teknoraver@meta.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251008-wed-fixes-v1-1-8f7678583385@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Shayne Chen
b05ab4be9f wifi: mt76: mt7915: add bf backoff limit table support
The commit 22b980badc ("mt76: add functions for parsing rate power limits
from DT") introduced generic support for rates limits in the devicetree.
But the mt7915 supports beamforming and has another table for configuring
the backoff limits. These can be configured in the DT with the paths-*
properties. The path-*-bf are the ones relevant for beamforming and the
ones without -bf suffix for "traditional" path backoff.

Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Link: https://patch.msgid.link/20251007-backoff-table-support-v3-3-fd6e2684988f@simonwunderlich.de
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Sven Eckelmann (Plasma Cloud)
6b9833c611 dt-bindings: net: wireless: mt76: introduce backoff limit properties
Introduce path backoff limit properties in mt76 binding in order to specify
beamforming and non-beamforming backoff limits for 802.11n/ac/ax.

Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Link: https://patch.msgid.link/20251007-backoff-table-support-v3-2-fd6e2684988f@simonwunderlich.de
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Sven Eckelmann (Plasma Cloud)
9a04a69b68 dt-bindings: net: wireless: mt76: Document power-limits country property
The commit 22b980badc ("mt76: add functions for parsing rate power limits
from DT") added filtering of the power limits based on two properties:

* regdomain
* country

If either the country or the regdomain matches, the power limits are
applied and the search is aborted. If none of the two is defined for the
power limit, it is a global (or "fallback") power limit. The last
"fallback" power limit in the list will be returned when not matching
regdomain or country was found.

The idea is here to allow to specify "overwriting" country limits in front
of the list - just in case a regdomain is shared but a country has
additional limitations.

But this property was forgotten to be defined in commit 2de6ccebe0
("dt-bindings:net:wireless:mediatek,mt76: introduce power-limits node").

Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20251007-backoff-table-support-v3-1-fd6e2684988f@simonwunderlich.de
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Sven Eckelmann (Plasma Cloud)
38b845e1f9 wifi: mt76: Fix DTS power-limits on little endian systems
The power-limits for ru and mcs and stored in the devicetree as bytewise
array (often with sizes which are not a multiple of 4). These arrays have a
prefix which defines for how many modes a line is applied. This prefix is
also only a byte - but the code still tried to fix the endianness of this
byte with a be32 operation. As result, loading was mostly failing or was
sending completely unexpected values to the firmware.

Since the other rates are also stored in the devicetree as bytewise arrays,
just drop the u32 access + be32_to_cpu conversion and directly access them
as bytes arrays.

Cc: stable@vger.kernel.org
Fixes: 22b980badc ("mt76: add functions for parsing rate power limits from DT")
Fixes: a9627d992b ("mt76: extend DT rate power limits to support 11ax devices")
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Thorsten Blum
8c5b063061 wifi: mt76: connac: Replace memcpy + hard-coded size with strscpy
Replace memcpy() and the hard-coded string length with strscpy() to
safely copy the string and improve mt76_connac_mcu_chip_config().

No functional changes.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20250923213831.1896823-2-thorsten.blum@linux.dev
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Lorenzo Bianconi
084922069c wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
Remove unnecessary link_id checks in mt7996_tx routine since if the link
identifier provided by mac80211 is unspecified the value will be
overwritten at the beginning on the function.

Fixes: f940c9b7ae ("wifi: mt76: mt7996: Set proper link destination address in mt7996_tx()")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250924-mt76_tx_unnecessary-check-v1-1-e595930a5662@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Felix Fietkau
79277f8ad1 wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
If a link does not have an assigned channel yet, mt7996_vif_link returns
NULL. We still need to store the updated queue settings in that case, and
apply them later.
Move the location of the queue params to within struct mt7996_vif_link.

Fixes: c0df2f0caa ("wifi: mt76: mt7996: prepare mt7996_mcu_set_tx for MLO support")
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250929111723.52486-1-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-11-24 14:37:53 +01:00
Jonathan Marek
165eb13e48 arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY
The "drop print" commit removed the whole branch and not just the print.
For some ARM64 cpus, this leads to hard lockup when
CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not enabled.

Fixes: 62e72463ca ("arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY")
Signed-off-by: Jonathan Marek <jonathan@marek.ca>
Signed-off-by: Will Deacon <will@kernel.org>
2025-11-24 13:31:50 +00:00
Marc Zyngier
7c16c02e86 ACPI: GTDT: Correctly number platform devices for MMIO timers
Use the actual timer counter instead of the watchdog counter.

Fixes: 5669d92f3e ("ACPI: GTDT: Generate platform devices for MMIO timers")
Reported-by: Pavan Kondeti <pavan.kondeti@oss.qualcomm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Mark Rutland <mark.rutland@arm.com>
Acked-by: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Will Deacon <will@kernel.org>
2025-11-24 13:17:45 +00:00
Will Deacon
9238fa35a3 Revert "arm64: acpi: Enable ACPI CCEL support"
This reverts commit d02c2e45b1.

Mauro reports that this breaks APEI notifications on his QEMU setup
because the "reserved for firmware" region still needs to be writable
by Linux in order to signal _back_ to the firmware after processing
the reported error:

  | {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
  | ...
  | [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error
  | Unable to handle kernel write to read-only memory at virtual address ffff800080035018
  | Mem abort info:
  |   ESR = 0x000000009600004f
  |   EC = 0x25: DABT (current EL), IL = 32 bits
  |   SET = 0, FnV = 0
  |   EA = 0, S1PTW = 0
  |   FSC = 0x0f: level 3 permission fault
  | Data abort info:
  |   ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000
  |   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
  | swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000505d7000
  | pgd=10000000510bc003, p4d=1000000100229403, pud=100000010022a403, pmd=100000010022b403, pte=0060000139b90483
  | Internal error: Oops: 000000009600004f [#1]  SMP

For now, revert the offending commit. We can presumably switch back to
PAGE_KERNEL when bringing this back in the future.

Link: https://lore.kernel.org/r/20251121224611.07efa95a@foz.lan
Reported-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
2025-11-24 13:14:50 +00:00
Kuninori Morimoto
54618003a1 um: drivers: virtio: use string choices helper
Remove hard-coded strings by using the string helper functions

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87h5uywtwp.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-24 14:12:09 +01:00
Dan Carpenter
9b9c0adbc3
platform/x86: intel: punit_ipc: fix memory corruption
This passes the address of the pointer "&punit_ipcdev" when the intent
was to pass the pointer itself "punit_ipcdev" (without the ampersand).
This means that the:

	complete(&ipcdev->cmd_complete);

in intel_punit_ioc() will write to a wrong memory address corrupting it.

Fixes: fdca4f16f5 ("platform:x86: add Intel P-Unit mailbox IPC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-11-24 15:03:22 +02:00
Johan Hovold
620a8f1311 drm: sti: fix device leaks at component probe
Make sure to drop the references taken to the vtg devices by
of_find_device_by_node() when looking up their driver data during
component probe.

Note that holding a reference to a platform device does not prevent its
driver data from going away so there is no point in keeping the
reference after the lookup helper returns.

Fixes: cc6b741c6f ("drm: sti: remove useless fields from vtg structure")
Cc: stable@vger.kernel.org	# 4.16
Cc: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
2025-11-24 13:56:16 +01:00
Hans de Goede
a8e5a110c0 wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
The Acer A1 840 tablet contains quite generic names in the sys_vendor and
product_name DMI strings, without this patch brcmfmac will try to load:
brcmfmac43340-sdio.Insyde-BayTrail.txt as nvram file which is a bit
too generic.

Add a DMI quirk so that a unique and clearly identifiable nvram file name
is used on the Acer A1 840 tablet.

Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20251103100314.353826-1-hansg@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-24 13:07:11 +01:00
Johannes Berg
9f33477b9a wifi: cfg80211: stop radar detection in cfg80211_leave()
If an interface is set down or, per the previous patch, changes
type, radar detection for it should be cancelled. This is done
for AP mode in mac80211 (somewhat needlessly, since cfg80211 can
do it, but didn't until now), but wasn't handled for mesh, so if
radar detection was started and then the interface set down or
its type switched (the latter sometimes happning in the hwsim
test 'mesh_peer_connected_dfs'), radar detection would be around
with the interface unknown to the driver, later leading to some
warnings around chanctx usage.

Link: https://patch.msgid.link/20251121174021.290120e419e3.I2a5650c9062e29c988992dd8ce0d8eb570d23267@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-24 13:05:23 +01:00
Johannes Berg
7a27b73943 wifi: cfg80211: use cfg80211_leave() in iftype change
When changing the interface type, all activity on the interface has
to be stopped first. This was done independent of existing code in
cfg80211_leave(), so didn't handle e.g. background radar detection.
Use cfg80211_leave() to handle it the same way.

Note that cfg80211_leave() behaves slightly differently for IBSS in
wireless extensions, it won't send an event in that case. We could
handle that, but since nl80211 was used to change the type, IBSS is
rare, and wext is already a corner case, it doesn't seem worth it.

Link: https://patch.msgid.link/20251121174021.922ef48ce007.I970c8514252ef8a864a7fbdab9591b71031dee03@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-24 13:05:23 +01:00
Johannes Berg
de3c514234 wifi: mac80211: fix channel switching code
My prior commit here introduced a bug due to copy/paste,
it was iterating the links assigned to 'ctx->replace_ctx'
and I replaced it by iterating links assigned to 'ctx' by
accident, then modified it for the iteration later.

Fix it to iterate the users of the correct chanctx, i.e.
'ctx->replace_ctx'.

Ultimately, this issue led to a crash in a hwsim test
(multi_ap_wps_shared_apdev_csa) because it would actually
do the switch (rather than refuse here) and then later
have a double-free of the original chanctx, because it
was still in use by another interface yet freed as part
of the switching.

Fixes: a1dc648aa7 ("wifi: mac80211: remove chanctx to link back-references")
Link: https://patch.msgid.link/20251121113733.7710a58d45eb.Ie9ec010b52b1baed93dbe44f968c2119b6b5d98d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-24 13:05:11 +01:00
Johannes Berg
49a9feaf30 rtw-next patches for v6.19
Main changes are about rtw89 USB support, which two USB devices are added
 with proper TX status, and other notable items are listed below.
 
 rtl8xxxu:
 
  - fix 40MHz bandwidth connection
 
 rtw89:
 
  - support USB devices RTL8852AU and RTL8852CU
 
  - report TX status from air for USB devices
 
  - resolve racing between processes of TX and TX report
 
  - resolve racing of skb queue of C2H events
 
  - support injected packets with bandwidth and data rate
 
  - more materials for coming RTL8922DE
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuyEnvMdOsBl1WjpdjlvZYmhshd8FAmkgShMACgkQjlvZYmhs
 hd/PZxAArklUs1/aVdvm8s3y5Aq2mi8M0t8iKHDgM9ciH2ikGRSV0e8PHb/bwtg3
 CvuMrrVhjgyUp+IlhSOFLVO2cIvDsq2HidTBxGBrczlCdzTNCQwgQE5jqSX6jPhL
 1sJ6X/JwZff8XJz+WowhnxIsd2mHnO9Mh6+DR6y+IMkksnSsICoKz0hP+g9UQi9o
 57d7KjBJL3cMCkL8g48Ynbr4IMmpt1mdxDSlD7RNkDhKr40UAEIJ9blvtSz+X0UD
 8fJqqUX6r6cD5qTvA3DY8sbKE0wHXj7buIEIUtifz1ylgPcKMGTpKGAY5yVs12ke
 q2qSZDTWZfdpxiQdVJ2ta3mRRcrCQBAkqj0GwxLSfWEl3twB00gntxiMg16STDLp
 q7ATrejMKYLpVZ8/IZdjjoQgPd3ucGCQBnqj+n7J55Vv4x6mUlEBms59sTYARwpE
 UJFuEx+9+mRyOj7RYpWlPf4Yj1Mypl2QyKhbCmcr9FN0e9flgves67ZLmmCuP/Nh
 zpZunln1IGeB+t5pp0i3Yi7xpmcefm1GKZ3y9fhMEkFy9AnBuBDuoDxW8ZCbOZej
 qgxPXX8ZblD+asne8y1oHMjP7yujRZTxyju6rDOjQnPkNHCdYtllUG1fs115raGH
 eUslj4OKr45eDcX6CgDz/QNyWB5k07NbMM5MvRTPT2G7ymBgFOY=
 =uV+u
 -----END PGP SIGNATURE-----

Merge tag 'rtw-next-2025-11-21-v2' of https://github.com/pkshih/rtw

Ping-Ke Shih says:
==================
rtw-next patches for v6.19

Main changes are about rtw89 USB support, which two USB devices are added
with proper TX status, and other notable items are listed below.

rtl8xxxu:

 - fix 40MHz bandwidth connection

rtw89:

 - support USB devices RTL8852AU and RTL8852CU

 - report TX status from air for USB devices

 - resolve racing between processes of TX and TX report

 - resolve racing of skb queue of C2H events

 - support injected packets with bandwidth and data rate

 - more materials for coming RTL8922DE
==================

Link: https://patch.msgid.link/45eed1763a354460acba15a8e69f9e3e@realtek.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-24 13:02:21 +01:00
Haotian Zhang
a90903c2a3
spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
devm_pm_runtime_enable() can fail due to memory allocation. The current
code ignores its return value, potentially causing runtime PM operations
to fail silently after autosuspend configuration.

Check the return value of devm_pm_runtime_enable() and return on failure.

Fixes: 909fac05b9 ("spi: add support for Amlogic A1 SPI Flash Controller")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251124015852.937-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-11-24 11:31:27 +00:00
Shenghao Ding
950167a99d
ASoC: tas2781: correct the wrong period
A wrong preiod at the end of the sentence was reported by one of my
customers. Their thorough code review is greatly appreciated.

Fixes: 49e2e353fb ("ASoC: tas2781: Add Calibration Kcontrols for Chromebook")
Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
Link: https://patch.msgid.link/20251121234427.402-1-shenghao-ding@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-11-24 11:31:21 +00:00
Baojun Xu
34b78ddd78
ASoC: tas2781: Correct the wrong chip ID for reset variable check
The new variable of reset was added for TAS58XX on TAS5825 first.
And TAS5802/5815... was added later, so this reset variable check
should be changed to lowest chip of TAS58XX.

Fixes: 53a3c6e222 ("ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver")
Signed-off-by: Baojun Xu <baojun.xu@ti.com>
Link: https://patch.msgid.link/20251124031542.2793-1-baojun.xu@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-11-24 11:31:20 +00:00
Heiko Carstens
f5730d44e0 s390: Add stackprotector support
Stackprotector support was previously unavailable on s390 because by
default compilers generate code which is not suitable for the kernel:
the canary value is accessed via thread local storage, where the address
of thread local storage is within access registers 0 and 1.

Using those registers also for the kernel would come with a significant
performance impact and more complicated kernel entry/exit code, since
access registers contents would have to be exchanged on every kernel entry
and exit.

With the upcoming gcc 16 release new compiler options will become available
which allow to generate code suitable for the kernel. [1]

Compiler option -mstack-protector-guard=global instructs gcc to generate
stackprotector code that refers to a global stackprotector canary value via
symbol __stack_chk_guard. Access to this value is guaranteed to occur via
larl and lgrl instructions.

Furthermore, compiler option -mstack-protector-guard-record generates a
section containing all code addresses that reference the canary value.

To allow for per task canary values the instructions which load the address
of __stack_chk_guard are patched so they access a lowcore field instead: a
per task canary value is available within the task_struct of each task, and
is written to the per-cpu lowcore location on each context switch.

Also add sanity checks and debugging option to be consistent with other
kernel code patching mechanisms.

Full debugging output can be enabled with the following kernel command line
options:

debug_stackprotector
bootdebug
ignore_loglevel
earlyprintk
dyndbg="file stackprotector.c +p"

Example debug output:

stackprot: 0000021e402d4eda: c010005a9ae3 -> c01f00070240

where "<insn address>: <old insn> -> <new insn>".

[1] gcc commit 0cd1f03939d5 ("s390: Support global stack protector")

Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-24 11:45:21 +01:00
Heiko Carstens
1d7764cfe3 s390/modules: Simplify module_finalize() slightly
Preinitialize the return value, and break out the for loop in
module_finalize() in case of an error to get rid of an ifdef.

This makes it easier to add additional code, which may also depend
on config options.

Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-24 11:45:21 +01:00
Heiko Carstens
c3d17464f0 s390: Remove KMSG_COMPONENT macro
The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel
message catalog" which never made it upstream.

Remove the macro in order to get rid of a pointless indirection. Replace
all users with the string it defines. In almost all cases this leads to a
simple replacement like this:

 - #define KMSG_COMPONENT "appldata"
 - #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 + #define pr_fmt(fmt) "appldata: " fmt

Except for some special cases this is just mechanical/scripted work.

Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-24 11:45:21 +01:00
Heiko Carstens
e950d1f84d s390/percpu: Get rid of ARCH_MODULE_NEEDS_WEAK_PER_CPU
Since the rework of the kernel virtual address space [1] the module area
and the kernel image are within the same 4GB area. Therefore there is no
need for the weak per cpu workaround for modules anymore. Remove it.

[1] commit c98d2ecae0 ("s390/mm: Uncouple physical vs virtual address spaces")

Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-24 11:45:20 +01:00
Heiko Carstens
f555d885bf Merge branch 'ap-driver-override' into features
Harald Freudenberger says:

====================

Support for driver override on AP queues.

Add a new sysfs attribute driver_override the AP queue's directory. Writing
in a string overrides the default driver determination and the drivers are
matched against this string instead. This overrules the driver binding
determined by the apmask/aqmask bitmask fields. With the write to the
attribute a check is done if the queue is in use by an mdev device.
If this is true, the write is aborted and EBUSY is returned.

As there exists some tooling for this kind of driver_override
(see package driverctl) the AP bus behavior for re-binding
should be compatible to this. The steps for a driver_override are:
 1) unbind the current driver from the device. For example
    echo "17.0005" > /sys/devices/ap/card17/17.0005/driver/unbind
 2) set the new driver for this device in the sysfs
    driver_override attribute. For example
    echo "vfio_ap" > /sys//devices/ap/card17/17.0005/driver_override
 3) trigger a bus reprobe of this device. For example
    echo "17.0005" > /sys/bus/ap/drivers_probe
With the driverctl package this is more comfortable and
the settings get persisted:
  driverctl -b ap set-override 17.0005 vfio_ap
and unset with
  driverctl -b ap unset-override 17.0005

====================

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-24 11:43:19 +01:00