Commit Graph
4666 Commits
Author SHA1 Message Date
Johan HovoldandFelix Fietkau 49a0aa659f wifi: mt76: drop redundant device reference
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.

Signed-off-by: Johan Hovold <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-27 13:23:21 +02:00
Hongling ZengandFelix Fietkau 97fc0e785d wifi: mt76: mt7921: fix uninitialized variable warning
Move the initialization of 'dev' before the error path that uses it.
This fixes the compiler warning:
  drivers/net/wireless/mediatek/mt76/mt7921/pci.c:347:6: warning:
  variable 'dev' is used uninitialized whenever 'if' condition is true

Fixes: 0d56655a74ef ("wifi: mt76: mt7921: fix resource leak in probe error path")
Reported-by: kernel test robot <[email protected]>
Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
Signed-off-by: Hongling Zeng <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-27 13:21:31 +02:00
Rajat GuptaandFelix Fietkau fe0555feb3 wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
mt76_put_vif_phy_link() frees the offchannel mlink with plain kfree()
after rcu_assign_pointer(NULL). However, rcu_assign_pointer only prevents
future RCU readers from obtaining the pointer -- it does not wait for
existing readers that already hold it via rcu_dereference.

The TX datapath (e.g. mt7996_mac_write_txwi) dereferences mlink->wcid
and mlink->idx under rcu_read_lock. If a TX softirq obtained the pointer
via rcu_dereference just before the NULL assignment, it will dereference
freed memory after the kfree.

struct mt76_vif_link already contains an rcu_head field that is unused at
this free site -- a developer oversight, since the adjacent
kfree_rcu_mightsleep call for rx_sc in the same function shows the
pattern was understood.

Replace kfree(mlink) with kfree_rcu(mlink, rcu_head).

Fixes: a8f424c1287c ("wifi: mt76: add multi-radio remain_on_channel functions")
Signed-off-by: Rajat Gupta <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-27 13:20:44 +02:00
ElXrenoandFelix Fietkau 0753cf183d wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
On a STATION vif, removing a TDLS peer takes the mt7925_mac_sta_remove
-> mt7925_mac_sta_remove_links path. The first loop in that function
calls mt7925_mcu_add_bss_info(..., enable=false) for every link of the
station being removed. For a non-MLO STATION vif there is exactly one
link, link 0, whose bss_conf is the AP's. TDLS peers do not have their
own bss_conf - they share the AP's BSS.

The result is that every TDLS peer teardown sends a BSS_INFO_UPDATE
with enable=0 for the AP's BSS to the firmware, which wipes the AP-side
rate-control context. The connection stays associated and TX from the
host still works at the negotiated rate, but the AP's downlink to us
collapses to the lowest mandatory OFDM rate (HE-MCS 0 / 6 Mbit/s OFDM)
and only slowly recovers as rate adaptation re-learns under sustained
traffic. With brief or bursty traffic the link can stay at 6-72 Mbit/s
indefinitely, requiring a manual reconnect.

mt7925_mac_link_sta_remove() already guards its own
mt7925_mcu_add_bss_info(..., false) call with
"vif->type == NL80211_IFTYPE_STATION && !link_sta->sta->tdls".
Add the equivalent guard at the top of the cleanup loop in
mt7925_mac_sta_remove_links(), above the link_sta / link_conf /
mlink / mconf lookups, so TDLS peer teardown skips the loop body
entirely without doing the per-link work that would just be thrown
away.

Verified on mt7925e by triggering Samsung-S938B auto-TDLS via iperf3
and watching iw rx bitrate after teardown:

  Before: rx bitrate collapses to 6.0-72.0 Mbit/s, oscillates 17/72/
          137/288/432 Mbit/s for 30+ seconds, no full recovery without
          a manual reassoc.
  After:  rx bitrate stays at 1200.9 Mbit/s HE-MCS 11 NSS 2 80 MHz
          across the entire TDLS lifecycle.

bpftrace confirms a single mt7925_mcu_add_bss_info(enable=0) call per
teardown before the fix; zero such calls after.

Fixes: 3878b4333602 ("wifi: mt76: mt7925: update mt7925_mac_link_sta_[add, assoc, remove] for MLO")
Cc: [email protected]
Signed-off-by: ElXreno <[email protected]>
Assisted-by: Claude:claude-opus-4-7 bpftrace
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-27 13:20:44 +02:00
ElXrenoandFelix Fietkau 6ae6f2b58c wifi: mt76: route TDLS-peer frames as 3-addr non-DS in HW encap
With HW TX encap offload enabled, the mt76 firmware builds the 802.11
header for the 802.3 frame using the per-WCID context. For a STATION
vif the HDR_TRANS TLV currently sets ToDS=1, which makes the firmware
default to the BSSID as A1 and emit STA->AP-formatted frames
regardless of which peer the WCID points to.

For TDLS-paired peers this is wrong. Data frames go on air addressed
to the AP, the AP MAC-ACKs and silently drops them per IEEE 802.11z
(an AP must not forward to a TDLS-paired peer). Management and
control frames bypass the HW encap path and still reach the peer;
only user data fails.

Add MT_WCID_FLAG_TDLS_PEER, set it in mt7915, mt7921, mt7925 and
mt7996 sta-add paths when sta->tdls is true, and override the
HDR_TRANS TLV in mt76_connac_mcu_wtbl_hdr_trans_tlv() (Connac2 -
mt7915 / mt7921 / mt7922), mt7925_mcu_sta_hdr_trans_tlv() (mt7925)
and mt7996_mcu_sta_hdr_trans_tlv() (mt7996) to set ToDS=0, FromDS=0
when the flag is set. The 3-addr non-DS form matches what 802.11z
uses for direct links; the firmware then constructs the frame with
A1=peer rather than A1=BSSID. HW encap offload remains enabled for
AP and any non-TDLS traffic.

Verified on mt7925e + Samsung S938B over a 5 GHz HE 80 MHz channel
with iperf3 -t 30 to the TDLS peer:

  before fix:  over the TDLS direct link, 7 TDLS Setup action
               frames and 3 RTS frames reach the peer; 0 QoS
               Data frames make it through (mgmt/control paths
               bypass HW encap, the data path does not). iperf3
               stalls.
  after fix:   2.90 GBytes transferred at 830 Mbit/s sustained,
               0 TCP retransmits.

mt7915, mt7921, mt7922 and mt7996 are not regression-tested in this
change for lack of hardware. Their HDR_TRANS handling mirrors the
verified mt7925 change; the firmware behavior is shared across these
chips.

Signed-off-by: ElXreno <[email protected]>
Assisted-by: Claude:claude-opus-4-7 bpftrace tcpdump
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-27 13:20:44 +02:00
Arjan van de VenandFelix Fietkau dd1459c0c7 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
This patch is based on a BUG as reported by Bongani Hlope at
https://lore.kernel.org/all/[email protected]/

When a channel-switch announcement (CSA) beacon is received,
cfg80211 queues a wiphy work item that eventually calls
mt7921_channel_switch_rx_beacon(). If the station disconnects
(or the channel context is otherwise torn down) between the
time the work is queued and the time it runs, the driver's
dev->new_ctx pointer can already have been cleared to NULL.
mt7921_channel_switch_rx_beacon() then dereferences new_ctx
unconditionally, triggering a NULL pointer dereference at
address 0x0:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common]

The same missing guard exists in mt7925_channel_switch_rx_beacon(),
which shares the same code pattern introduced by the same commit.

Add an early-return NULL check for dev->new_ctx in both
mt7921_channel_switch_rx_beacon() and
mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is
no pending channel switch to process, so returning immediately is
the correct and safe action.

Fixes: 8aa2f59260eb ("wifi: mt76: mt7921: introduce CSA support")
Reported-by: Bongani Hlope <[email protected]>
Oops-Analysis: http://oops.fenrus.org/reports/lkml/[email protected]/report.html
Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Arjan van de Ven <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Felix Fietkau <[email protected]>
Cc: Lorenzo Bianconi <[email protected]>
Cc: Ryder Lee <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-12 13:08:20 +00:00
Hongling ZengandFelix Fietkau d463ed9490 wifi: mt76: mt7921: fix resource leak in probe error path
When pcim_iomap_region() or devm_kmemdup() fail, the code returns
directly without cleaning up previously allocated resources:
  - mt76_device allocated by mt76_alloc_device()
  - pci irq vectors allocated by pci_alloc_irq_vectors()
Fix this by jumping to the existing error cleanup path instead of
returning directly.

Fixes: ee5bb35d2b83 ("wifi: mt76: mt7921: switch to pcim_iomap_region")
Signed-off-by: Hongling Zeng <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-12 13:04:38 +00:00
Ryder LeeandFelix Fietkau 381582f2a5 wifi: mt76: mt7996: avoid memset overwriting tx_info->control.flags
mt76_tx_status_skb_add uses memset on status.status_driver_data, which
overwrite  info->control.flags in ieee80211_tx_info. Copy tx_info before
calling mt76_tx_status_skb_add to ensure control fields are preserved
and remain valid for later processing.

Reported-By: Roy Luo <[email protected]>
Signed-off-by: Ryder Lee <[email protected]>
Link: https://patch.msgid.link/5ecac6a9b7d29526e8438dea105b58f5487c93aa.1778521232.git.ryder.lee@mediatek.com
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-12 13:03:59 +00:00
Ruslan IsaevandFelix Fietkau 4ab8f2122d wifi: mt76: disable rx napi before queue cleanup
mt76_dma_cleanup() already disables tx napi before deleting it, but
it still removes rx napi instances while they can remain enabled on the
normal device remove path. On mt7915 this triggers a warning.

Disable each rx napi instance before netif_napi_del() and page pool
destruction. This fixes repeated warnings on rmmod mt7915e on
mt7915e/mt7981b.

Signed-off-by: Ruslan Isaev <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-12 13:03:08 +00:00
Myeonghun PakandFelix Fietkau 34064bd58b wifi: mt76: mt7925: clean up DMA on probe failure
mt7925_pci_probe() initializes DMA before registering the device. If
mt7925_register_device() fails, probe returns through err_free_irq without
tearing down DMA state.

That leaves the TX NAPI instance enabled and skips the DMA queue cleanup
that the normal remove path performs through mt7925e_unregister_device().
Add a dedicated unwind label for failures after mt7925_dma_init() succeeds.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Co-developed-by: Ijae Kim <[email protected]>
Signed-off-by: Ijae Kim <[email protected]>
Signed-off-by: Myeonghun Pak <[email protected]>
Link: https://patch.msgid.link/20260426143728.41534-1-pakmyeonghun@bagmyeonghun-ui-MacBookPro.local
Signed-off-by: Felix Fietkau <[email protected]>
2026-05-12 12:55:34 +00:00
Felix Fietkau b0af99f238 wifi: mt76: mt7996: handle UNI PS sync events
Enable MT_DRV_HW_PS_BUFFERING and handle MCU_UNI_EVENT_PS_SYNC with
all three TLV formats (single client, multi-client packed entries,
and bitmap).

Signed-off-by: Felix Fietkau <[email protected]>
2026-05-07 08:39:05 +00:00
Felix Fietkau 9e613fb007 wifi: mt76: mt7915: handle MCU PS sync events
Enable MT_DRV_HW_PS_BUFFERING and handle MCU_EXT_EVENT_PS_SYNC to
track station power-save state via firmware notifications.

Signed-off-by: Felix Fietkau <[email protected]>
2026-05-07 08:39:05 +00:00
Felix Fietkau 9a46d8d21d wifi: mt76: add PS buffering support for HW-managed TIM drivers
Add MT_DRV_HW_PS_BUFFERING flag for drivers where firmware controls
the TIM bit based on buffered frames. Instead of blocking all TX to
PS stations (which starves firmware and prevents TIM from being set),
allow limited frame delivery using AQL pending airtime as the
throttle. Replenish the firmware buffer on TX completion.

Add mt76_sta_ps_transition() helper for drivers to call from MCU
PS sync events.

Signed-off-by: Felix Fietkau <[email protected]>
2026-05-07 08:39:05 +00:00
Mieczyslaw NalewajandFelix Fietkau d2b01fbc32 mt76: pass LED define via ccflags-y
Replace the deprecated EXTRA_CFLAGS with ccflags-y so that
the -DCONFIG_MT76_LEDS define is applied correctly by the kernel
build system. EXTRA_CFLAGS is no longer honored by recent
kbuilds[1]; ccflags-y is the supported variable and works
on kernels 6.12 and 6.18.

1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.18.20&id=f77bf01425b11947eeb3b5b54685212c302741b8

Signed-off-by: Mieczyslaw Nalewaj <[email protected]>
2026-05-04 08:37:03 +00:00
Mieczyslaw NalewajandFelix Fietkau 012e52ae38 wifi: mt76: use hrtimer_setup() in mt76x02u beacon init
Replace the two-step hrtimer initialization pattern with a single
consolidated call to hrtimer_setup().
The legacy approach of calling hrtimer_init() followed by manual
assignment to timer.function is deprecated. The new hrtimer_setup()
helper atomically initializes the timer and assigns the callback
function in one operation, eliminating the race-prone intermediate
state where the timer is initialized but lacks a handler.

Signed-off-by: Mieczyslaw Nalewaj <[email protected]>
2026-05-04 08:36:55 +00:00
Lorenzo BianconiandFelix Fietkau 018f60316d wifi: mt76: mt7996: Destroy active sta links in mt7996_mac_sta_remove()
Similar to vif link management, postpone sta link destuction in
mt7996_mac_sta_remove() introducing mt7996_mac_sta_remove_link utility
routine and just disable sta link running mt7996_mac_sta_remove_links
routine.
This is a preliminary patch in order to support MLO link reconfiguration
in MT7996 driver.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:24:20 +00:00
Shayne ChenandFelix Fietkau a4c790aef4 wifi: mt76: mt7996: Add mcu APIs to enable/disable vif links.
Introduce mt7996_mcu_mld_reconf_stop_link and mt7996_mcu_mld_link_oper
utility routines in order to communicate to the mcu fw to disable/enable
a specific vif link. Please note these APIs are currently supported by
the MT7996 firmware only in AP mode.

Signed-off-by: Shayne Chen <[email protected]>
Co-developed-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:24:20 +00:00
Lorenzo BianconiandFelix Fietkau efebeea5c0 wifi: mt76: mt7996: Destroy vif active links in mt7996_remove_interface()
MT7996 hw requires to remove active links from the mcu BSSINFO table
destroying the interface. For this reason introduce mt7996_vif_link_destroy
routine and remove active (non-offchannel) vif links running
mt7996_remove_interface routine.
This is a preliminary patch in order to support MLO link reconfiguration
in MT7996 driver.

Co-developed-by: Shayne Chen <[email protected]>
Signed-off-by: Shayne Chen <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:24:20 +00:00
Shayne ChenandFelix Fietkau ade83e44ed wifi: mt76: mt7996: Move mlink deallocation in mt7996_vif_link_remove()
Destroy mt76_vif_link struct in mt7996_vif_link_remove routine and not
in mt76_unassign_vif_chanctx(). This is necessary since, in order to
properly support MLO link reconfiguration, we will destroy mt76_vif_link
struct during AP tear-down process and not running unassign_vif_chanctx
mac80211 callback.
This patch does not introduce any regression since
mt76_assign_vif_chanctx/mt76_unassign_vif_chanctx APIs are currently
used just by MT7996 driver.

Signed-off-by: Shayne Chen <[email protected]>
Co-developed-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:24:20 +00:00
Shayne ChenandFelix Fietkau 492a407111 wifi: mt76: mt7996: Account active links in valid_links fields
Track active vif links in mt7996_vif_link_add and mt7996_vif_link_remove
routines.
This is a preliminary patch in order to remove AP MLD links from MCU
configuration during AP tear-down process and to support MLO link
reconfiguration in MT7996 driver.

Signed-off-by: Shayne Chen <[email protected]>
Co-developed-by: Lorenzo Bianconi <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:24:20 +00:00
Lorenzo BianconiandFelix Fietkau 7fa21be01b wifi: mt76: mt7996: Rely on msta_link link_id in mt7996_vif_link_remove()
Rely on msta_link link_id value in mt7996_vif_link_remove routine
instead of using link_conf pointer. This assumption is correct since
msta_link link_id is set to link_conf link_id value in mt7996_vif_link_add
routine.
Moreover, fallback to default ieee80211_bss_conf struct if the link_conf
pointer in mt7996_vif_link_remove() is NULL.
MT7996 hw requires to remove AP MLD links from MCU configuration during
AP tear-down process (e.g. running mt7996_remove_interface()). Doing so,
we can't assume link_conf pointer is always non-NULL running
mt7996_vif_link_remove routine.

Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:24:20 +00:00
Lorenzo BianconiandFelix Fietkau 0c1dedac48 wifi: mt76: mt7996: Switch deflink to seclink only if link lookup does not fail
Do not switch default link to the secondary link in
mt7996_mac_sta_remove_links routine if the lookup for the secondary
msta_link fails.

Fixes: d7e5444f9eb02 ("wifi: mt76: mt7996: Switch to the secondary link if the default one is removed")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:22:45 +00:00
Lorenzo BianconiandFelix Fietkau 1b26f5f63d wifi: mt76: mt7996: Decrement sta counter removing the link in mt7996_mac_reset_sta_iter()
Fixes tracking per-phy stations for offchannel switching.

Fixes: ace5d3b6b49e8 ("wifi: mt76: mt7996: improve hardware restart reliability")
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/20260308-mt7996_mac_reset_vif_iter-fix-v1-1-57f640aa2dcf@kernel.org
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 08:21:45 +00:00
Felix Fietkau a665659dee wifi: mt76: fix beacon monitor for MBSSID nontransmitted BSS
When associated with a nontransmitted BSS in an MBSSID set, the beacon
frame's BSSID (addr3) contains the transmitting AP's BSSID, not the
station's associated BSSID. The beacon matching in mt76_rx_beacon_iter()
only compared against link_conf->bssid, so beacons were never matched,
causing false beacon loss reports.

Add a fallback check against link_conf->transmitter_bssid when
link_conf->nontransmitted is set, mirroring mac80211's
ieee80211_rx_our_beacon() logic.

Signed-off-by: Felix Fietkau <[email protected]>
2026-03-21 04:12:46 +00:00
Peter ChiuandFelix Fietkau 39c960c3ad wifi: mt76: mt7996: fix frequency separation for station STR mode
Fix frequency separation field for STR in MLD capabilities to get the
correct chip capability.

Signed-off-by: Peter Chiu <[email protected]>
Signed-off-by: Lorenzo Bianconi <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-19 12:27:03 +00:00
Felix Fietkau ca81c5c18e Revert "wifi: mt76: mt7915: sync station power save state"
This reverts commit be3aad4c2e.
This causes a regression by preventing queueing of frames that would
otherwise lead to a PS station being woken up.

Fixes: https://github.com/openwrt/mt76/issues/1068
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-19 12:20:40 +00:00
Felix Fietkau 24c298a04f Revert "wifi: mt76: mt7915: set mt76 specific PS flag"
This reverts commit bada63e285.
2026-03-19 12:19:27 +00:00
Sean WangandFelix Fietkau 2cdcad1bb6 wifi: mt76: mt7925: host-only unwind published links on add failure
Release host link resources when mt7925_mac_sta_add_links() fails after
partial success.

msta->link[] and dev->mt76.wcid[] may already be published, so unwind
the host state to avoid leaving stale links behind.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 8be7277306 wifi: mt76: mt7925: publish msta->link after successful link add
Move the msta->link[link_id] publication until after
mt7925_mac_link_sta_add() succeeds.

msta->link[] is RCU-visible, so publishing it before setup completes can
expose a link whose add path later fails. Publish it only after success
to avoid partially initialized link state becoming visible.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 9fbe29ba42 wifi: mt76: mt7925: switch link STA allocation to RCU lifetime
Allocate mt792x_link_sta with kzalloc() and free it with kfree_rcu()
instead of devm-managed memory.

msta->link[] is published via RCU, so the link STA must remain valid
until readers have quiesced after teardown. Manage the object lifetime
with kfree_rcu() to match its RCU-visible publication.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 9cbcc7e59d wifi: mt76: mt7925: move WCID teardown into link_sta_remove()
Move WCID teardown into mt7925_mac_link_sta_remove() to mirror the
dev->mt76.wcid[] publish done during link add.

This clears the published WCID before the rest of teardown, so WCID
lookups no longer expose a link that is being removed.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 471d6b3404 wifi: mt76: mt7925: drop WCID reinit after publish
Remove the redundant mt76_wcid_init() call after publishing the WCID in
mt7925_mac_link_sta_add().

WCID is already initialized before publication, so reinitializing it
afterward is unnecessary and makes the setup ordering less clear.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 98cb4c0f5d wifi: mt76: mt7925: unwind WCID setup on link STA add failure
Undo the published WCID state when mt7925_mac_link_sta_add() fails after
WCID setup.

The add path can fail after dev->mt76.wcid[] is published, so the error
path must clear the partial host-side WCID state to avoid leaving stale
entries behind.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 215e122415 wifi: mt76: mt7925: make WCID cleanup unconditional in sta_remove_links()
Drop the dead pri_link check in mt7925_mac_sta_remove_links() and
perform WCID cleanup unconditionally.

mlink->pri_link is already cleared before the test, making the branch
ineffective. This matches the actual teardown behaviour and simplifies
the remove path.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 6c64c41fcc wifi: mt76: mt7925: pass mconf and mlink to wtbl_update_hdr_trans()
Drop the mt792x_vif_to_link() lookup in mt7925_mcu_wtbl_update_hdr_trans()
and pass the resolved mconf and mlink from the caller instead. The link
context is already known at the call site, making the lookup redundant.

This keeps the helper lookup-free and makes link ownership explicit.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 3b1e74d14b wifi: mt76: mt7925: resolve link after acquiring mt76 mutex
mt792x_sta_to_link() uses rcu_dereference_protected() and therefore
expects mt76.mutex to be held. Move the lookup after
mt792x_mutex_acquire() to make the locking explicit and correct.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 826ecd386b wifi: mt76: mt7925: pass mlink to set_link_key()
Drop the mt792x_sta_to_link() lookup in mt7925_set_link_key() and pass
the resolved mlink from the caller instead. The link context is already
known at the call site, making the lookup redundant.

This keeps the helper lookup-free and makes link ownership explicit.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 6e66c08ac0 wifi: mt76: mt7925: pass mlink to wtbl_update_hdr_trans()
Drop the mt792x_sta_to_link() lookup in mt7925_mcu_wtbl_update_hdr_trans()
and pass the resolved mlink from the caller instead. The link context is
already known at the call site, making the lookup redundant.

This keeps the helper lookup-free and makes link ownership explicit.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 5eb53c948b wifi: mt76: mt7925: validate mlink in sta_hdr_trans_tlv()
Replace the dead wcid NULL check in mt7925_mcu_sta_hdr_trans_tlv() with
a WARN_ON_ONCE() guard on mlink before dereferencing mlink->wcid.

wcid is always derived from mlink, so mlink is the only meaningful
object to validate here.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau ea1a80f7cf wifi: mt76: mt7925: pass mlink to sta_hdr_trans_tlv()
Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_hdr_trans_tlv()
and pass the resolved mlink from the caller instead. The link is
already known at the call site, making the lookup redundant.

This keeps the helper lookup-free and makes WCID selection explicit.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 130184621d wifi: mt76: mt7925: pass mlink to mac_link_sta_remove()
Drop the mt792x_sta_to_link() lookup in mt7925_mac_link_sta_remove()
and pass mlink from mt7925_mac_sta_remove_links() instead. The link is
already resolved there, making the extra lookup redundant.

This keeps the remove helper lookup-free and avoids hidden dependence on
msta->link[link_id] during teardown.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau b7fee4e5e5 wifi: mt76: mt7925: resolve primary mlink via def_wcid
Use mlink->wcid.def_wcid to obtain the primary mlink in
mt7925_mac_link_sta_add() instead of calling mt792x_sta_to_link().

The primary link context is already carried by the WCID, so the extra
lookup is redundant. This makes the add path follow the existing WCID
association directly.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau dce1e6e4ce wifi: mt76: mt7925: pass mlink to mcu_sta_update()
Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_update() and
pass the resolved mlink from the caller instead. The link context is
already known at the call site, making the lookup redundant.

This keeps the helper lookup-free and makes WCID selection explicit.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau aac117362e wifi: mt76: mt7925: pass mlink and mconf to sta_mld_tlv()
Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_mld_tlv() and
pass mlink and mconf from the caller instead. The link context is
already known at the call site, making the lookup redundant.

This keeps the helper lookup-free and makes MLD link selection
explicit.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau f716cf9b6e wifi: mt76: mt7925: pass WCID indices to bss_basic_tlv()
Drop the mt792x_sta_to_link() lookup in mt7925_mcu_bss_basic_tlv() and
pass the resolved WCID indices from the caller instead. The link
context is already known, so the lookup is redundant.

This makes link ownership explicit and keeps the helper lookup-free.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
Sean WangandFelix Fietkau 99e8e3cb98 wifi: mt76: mt7925: pass mlink to sta_amsdu_tlv()
Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_amsdu_tlv() and
pass mlink from the caller instead. The link context is already known
so the lookup is redundant.

This makes link ownership explicit and keeps the helper lookup-free.

No functional change intended.

Signed-off-by: Sean Wang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 18:10:20 +00:00
David BauerandFelix Fietkau bada63e285 wifi: mt76: mt7915: set mt76 specific PS flag
mt76 tracks the PSM state of a sta internally with a wcid flag. TX to
such clients is skipped based on the presence of this flag.

This flag was not added to the PS state notify handler for MT7915 chips.
Without this flag, mt76 queues pending frames to the hardware,
accounting for airtime when a PSM notification is received while in a TX
iteration.

Set the PS flag for the STA WCID to prevent this from happening. TX gets
skipped in presence of this flag.

Signed-off-by: David Bauer <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 08:32:20 +00:00
StanleyYP WangandFelix Fietkau 3a16c78c9e wifi: mt76: mt7996: fix issues with manually triggered radar detection
Disallow triggering radar detection on non-DFS channels to prevent paused
TX queues from failing to resume, as a channel switch is not performed in
this case.

Signed-off-by: StanleyYP Wang <[email protected]>
Signed-off-by: Shayne Chen <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 08:32:20 +00:00
StanleyYP WangandFelix Fietkau b4ec73b335 wifi: mt76: mt7996: fix the temporary buffer for calibration-free data
Move the declaration of buf[] outside the for loop, since it must be
preserved across iterations.

Fixes: 224c7c2be578 ("wifi: mt76: mt7996: apply calibration-free data from OTP")
Signed-off-by: StanleyYP Wang <[email protected]>
Signed-off-by: Shayne Chen <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 08:32:20 +00:00
Rex LuandFelix Fietkau 4edbdf38c6 wifi: mt76: mt7996: adjust timeout value for boot-up calibration commands
Align the vendor driver by adjusting the timeout values for the
MCU_UNI_CMD_EFUSE_CTRL and MCU_UNI_CMD_EXT_EEPROM_CTRL commands.
Without this adjustment, false positive command timeout errors may occur,
especially on some iPA variants.

Signed-off-by: Rex Lu <[email protected]>
Signed-off-by: Shayne Chen <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
2026-03-14 08:32:20 +00:00