31 Commits
Author SHA1 Message Date
Felix Fietkau bd41e0fbea wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates
mt7615_tx() falls back to the vif BSS wcid when mac80211 hands a frame
over without a station, e.g. while a station is being torn down, and to
the global wcid when there is no vif either. Both tx_prepare_skb
implementations derive a mt7615_sta from that wcid unconditionally and,
if the rate control probe flag is set, pass it to mt7615_mac_set_rates(),
which dereferences the NULL vif backpointer of the per-vif embedded sta:

  Unable to handle kernel read from unreadable memory at virtual
  address 0000000000000002
  ...
  pc : mt7615_mac_set_rates
  lr : mt7615_tx_prepare_skb

Neither entry is rate controlled by mac80211: the embedded sta has an
empty rate set, and for the global wcid the container_of does not yield a
valid mt7615_sta at all. Only resolve the sta for wcids that belong to a
station.

Reported-by: Chad Monroe <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2026-07-24 14:45:39 +02:00
Thomas GleixnerandFelix Fietkau e9d08e12bd treewide: Switch/rename to timer_delete[_sync]()
timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree
over and remove the historical wrapper inlines.

Conversion was done with coccinelle plus manual fixups where necessary.

Signed-off-by: Thomas Gleixner <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>
2026-01-27 11:19:09 +00:00
Felix Fietkau 33f29d2345 wifi: mt76: relicense to BSD-3-Clause-Clear
MediaTek has asked to switch from the ISC license to BSD-3-Clause-Clear,
in order to improve clarity and the legal integrity of the code.

The BSD-3-Clause license includes the "no endorsement" clause, which is
important for protecting the reputation of the original authors and
contributors by preventing unauthorized use of their names for endorsement
purposes.

This clause is absent in the BSD-2-Clause license, which is more permissive
but lacks this specific protection.

This change also cleans up the license of some Kconfig/Makefile files,
which were accidentally marked as GPL.

The GPL 2.0 remains in use on mt76x0, as well as two source files in mt7615
for which the license situation still needs to be clarified.

Signed-off-by: Felix Fietkau <[email protected]>
2025-10-13 11:11:19 +02:00
Jakub KicinskiandFelix Fietkau 0ba7a69f89 wifi: mt76: move napi_enable() from under BH
mt76 does a lot of:

  local_bh_disable();
  napi_enable(...napi);
  napi_schedule(...napi);
  local_bh_enable();

local_bh_disable() is not a real lock, its most likely taken
because napi_schedule() requires that we invoke softirqs at
some point. napi_enable() needs to take a mutex, so move it
from under the BH protection.

Fixes: 413f0271f396 ("net: protect NAPI enablement with netdev_lock()")
Reported-by: Dan Carpenter <[email protected]>
Link: https://lore.kernel.org/[email protected]
Reviewed-by: Eric Dumazet <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
2025-03-11 11:23:49 +01:00
Felix Fietkau 8cd0263f92 wifi: mt76: rename struct mt76_vif to mt76_vif_link
Preparation to use it for private bss link data instead of the full vif
on MLO capable devices.

Signed-off-by: Felix Fietkau <[email protected]>
2024-10-22 10:18:59 +02:00
Felix Fietkau 8d5ea32d48 wifi: mt76: remove unused error path in mt76_connac_tx_complete_skb
The error handling code was added in order to allow tx enqueue to fail after
calling .tx_prepare_skb. Since this can no longer happen, the error handling
code is unused.

Signed-off-by: Felix Fietkau <[email protected]>
2023-09-11 15:15:19 +02:00
Lorenzo BianconiandFelix Fietkau 4bf8c20a95 mt76: convert MT_TX_HW_QUEUE_EXT_PHY to MT_TX_HW_QUEUE_PHY
Report phy_indx in tx_info->hw_queue. This is a preliminary patch to add
newer chipset support

Co-developed-by: Bo Jiao <[email protected]>
Signed-off-by: Bo Jiao <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
2022-07-11 13:38:17 +02:00
Lorenzo BianconiandFelix Fietkau eb19ac83c0 mt76: introduce phys array in mt76_dev structure
Introduce phys array in mt76_dev structure to reference mt76_phy
supported by the chipset. This is a preliminary patch to introduce
newer chipset support.

Signed-off-by: Lorenzo Bianconi <[email protected]>
2022-07-11 13:38:17 +02:00
Felix Fietkau af406a2d1c mt76: do not use skb_set_queue_mapping for internal purposes
Previously the code used skb_set_queue_mapping for management or non-bufferable
powersave frames that need to be sent to a different hardware queue.
This can confuse AQL, which expects the value to remain the same until the tx
status report.
The only place that currently uses the altered skb queue mapping is the txwi
write function. Change the code to pass the hardware queue id as a function
parameter instead.

Signed-off-by: Felix Fietkau <[email protected]>
2022-07-02 15:57:02 +02:00
Lorenzo BianconiandFelix Fietkau 0993f4ef96 mt76: connac: move mt76_connac_write_hw_txp in shared code
Now we can move mt76_connac_write_hw_txp routine in mt76-connac module
and reuse it in mt7921e and mt7615e driver.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-21 20:47:36 +02:00
Lorenzo BianconiandFelix Fietkau c42d45278f mt76: connac: move mt76_connac_tx_complete_skb in shared code
Since now txp structures are in common code we can reuse
mt76_connac_tx_complete_skb routine in mt7921e, mt7915e and mt7615e
drivers.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-21 20:47:36 +02:00
Lorenzo BianconiandFelix Fietkau 899d192e8a mt76: move mt7615_txp_ptr in mt76_connac module
Since mt7615_txp_ptr is shared between mt7615 and mt7921 move it in
mt76_connac module.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-21 20:47:36 +02:00
Lorenzo BianconiandFelix Fietkau 149e95f5d7 mt76: connac: move mt76_connac_fw_txp in common module
Since mt76_connac_fw_txp struct is shared between mt7615e, mt7915e and
mt7921e, move it in mt76_connac module.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-21 20:47:36 +02:00
Ryder LeeandFelix Fietkau cdd66d6429 mt76: add DBDC rxq handlings into mac_reset_work
Enable/disable rx napi for DBDC.

Signed-off-by: Bo Jiao <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2022-06-02 21:39:30 +02:00
Lorenzo BianconiandFelix Fietkau 46261d4bbf mt76: fix possible pktid leak
Fix a possible idr pkt-id leak if the packet is dropped on tx side

Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-11-23 13:20:47 +01:00
Lorenzo BianconiandFelix Fietkau bcc8d9e03a mt76: remove mt76_wcid pointer from mt76_tx_status_check signature
Remove mt76_wcid pointer from mt76_tx_status_check signature since it is
always set to NULL

Tested-by: [email protected]
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-10-11 09:19:04 +02:00
Felix Fietkau 8ee6446075 mt76: disable BH around napi_schedule() calls
napi_schedule() can call __raise_softirq_irqoff(), which can perform softirq
handling, so it must not be called in a pure process context with BH enabled.

Signed-off-by: Felix Fietkau <[email protected]>
2021-09-24 17:54:42 +02:00
Lorenzo BianconiandFelix Fietkau 3a71e71a55 mt76: mt7615: set macwork timeout according to runtime-pm
Set macwork timeout value according to runtime-pm in order to reduce
power consumption

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-06-18 17:19:44 +02:00
Lorenzo BianconiandFelix Fietkau 5c2baab92c mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb()
Fix theoretical NULL pointer dereference in mt7615_tx_prepare_skb and
mt7663_usb_sdio_tx_prepare_skb routines. This issue has been identified
by code analysis.

Fixes: 6aa4ed7927f11 ("mt76: mt7615: implement DMA support for MT7622")
Fixes: 4bb586bc33b98 ("mt76: mt7663u: sync probe sampling with rate configuration")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-05-13 10:18:25 +02:00
Lorenzo BianconiandFelix Fietkau 8d5c456be1 mt76: move token utilities in mt76 common module
Move token management in mt76 common module since it is shared between
mt7615, mt7915 and mt7921 drivers

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-04-21 14:30:19 +02:00
Lorenzo BianconiandFelix Fietkau ade1f5aad4 mt76: move token_lock, token and token_count in mt76_dev
Move token_lock, token and token_count data structures in mt76_dev.
This is a preliminary patch to move token management in mt76 common
module since it is shared by mt7615, mt7915 and mt7921 drivers.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-04-21 14:30:19 +02:00
Felix Fietkau 23ecadd4af mt76: mt7615: fix hardware error recovery for mt7663
MT7663 uses different bits for communicating reset commands/status between MCU
and host. Also add an extra initial reset command.

Signed-off-by: Felix Fietkau <[email protected]>
2021-04-16 09:36:45 +02:00
Felix Fietkau 5ac02e22fb mt76: flush tx status queue on DMA reset
After DMA reset, tx status information for queued frames will never arrive.
Flush the queue to free skbs immediately instead of waiting for a timeout

Signed-off-by: Felix Fietkau <[email protected]>
2021-04-13 20:10:31 +02:00
Ryder LeeandFelix Fietkau 0ce955b04b mt76: mt7615: only free skbs after mt7615_dma_reset() when reset happens
In mt7615_mac_reset_work(), make sure freeing skbs after mt7615_dma_reset().

Signed-off-by: Ryder Lee <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-04-13 10:15:11 +02:00
Felix Fietkau b860906689 mt76: mt7615: fix chip reset on MT7622 and MT7663e
After chip reset, the DMA scheduler needs to be initialized as well.
Since the code is PCI/SoC specific, move it to pci_mac.c, so that it
can depend on a function in dma.c

Signed-off-by: Felix Fietkau <[email protected]>
2021-03-26 21:54:26 +01:00
Lorenzo BianconiandFelix Fietkau 261d184ceb mt76: introduce mt76_vif data structure
Introduce mt76_vif data structure to share common fields between
mt7615_vif and mt7921_vif and create a mcu common library

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2021-01-29 18:18:43 +01:00
Felix Fietkau e861cb0518 mt76: rely on AQL for burst size limits on tx queueing
Now that AQL works well on all mt76 drivers, completely replace the arbitrary
burst sizing and number of bursts logic for tx scheduling.
For the short period of time in which AQL does not work well yet, limit each
stations to 16 in-flight packets that have no estimated tx time.
This should avoid filling the queue if a station connects and queues up a
large number of packets before rate control information is available, especially
with hardware rate control

Signed-off-by: Felix Fietkau <[email protected]>
2020-08-24 20:59:30 +02:00
Felix Fietkau 780cdabb86 mt76: remove qid argument to drv->tx_complete_skb
It is not needed

Signed-off-by: Felix Fietkau <[email protected]>
2020-08-24 20:59:30 +02:00
Felix Fietkau 825343467d mt76: fix double DMA unmap of the first buffer on 7615/7915
A small part of the first skb buffer is passed to the firmware for parsing
via DMA, while the full buffer is passed as part of the TXP.

Avoid calling DMA unmap on the first part (with a different length than map)

Signed-off-by: Felix Fietkau <[email protected]>
2020-08-05 11:31:29 +02:00
Lorenzo BianconiandFelix Fietkau a873b7c8e3 mt76: mt7663u: sync probe sampling with rate configuration
On usb device rate configuration for sampling is performed relying on a
workqueue since it is not possible to access the device in the interrupt
context. Move the configuration of the probe_rate flag in the workqueue
in order to keep probe sampling in sync with actual rate configuration

Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2020-07-10 14:45:30 +02:00
Lorenzo BianconiandFelix Fietkau d4e6e225bc mt76: mt7615: move core shared code in mt7615-common module
Create mt7615-common module in order to collect shared code between usb
and mmio code. Move the following source files in mt7615-common module:
- main.c
- init.c
- mcu.c
- mac.c
- debugfs.c
- eeprom.c
- trace.c

Create the following source files for mmio only source code and move them
in mt7615e module:
- pci_init.c
- dma.c
- pci_mac.c

Signed-off-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>
2020-04-17 14:46:00 +02:00