summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-03-24wifi: mt76: abort ROC on chanctx changesFelix Fietkau1-0/+3
mt76_change_chanctx() calls mt76_phy_update_channel() which switches the hardware channel. If ROC is active on the same phy, this switches away from the ROC channel and clears offchannel, but leaves ROC state intact. Mac80211 still thinks the phy is on the ROC channel. Abort any active ROC before proceeding, matching the pattern already used in add, remove, assign, unassign, and switch chanctx functions. Link: https://patch.msgid.link/20260309060730.87840-5-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: check chanctx before restoring channel after ROCFelix Fietkau1-1/+1
mt76_remove_chanctx() sets phy->chanctx to NULL but does not clear phy->main_chandef. If ROC is later performed on that phy, completion tries to restore the stale main_chandef channel, programming the hardware to sit on a channel with no active context. Add a chanctx check to avoid restoring a channel when no context is active. Link: https://patch.msgid.link/20260309060730.87840-4-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: add offchannel check to mt76_roc_completeFelix Fietkau1-1/+1
mt76_roc_complete() unconditionally calls __mt76_set_channel() to restore the operating channel. The scan equivalent mt76_scan_complete() checks phy->offchannel first, skipping the restore if the phy is already back on-channel. Without this check, ROC completion performs a redundant full hardware channel switch when something has already moved the phy back. Link: https://patch.msgid.link/20260309060730.87840-3-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: support upgrading passive scans to activeChad Monroe4-3/+56
On channels with NO_IR or RADAR flags, wait for beacon before sending probe requests. Allows active scanning and WPS on restricted channels if another AP is already present. Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support") Tested-by: Piotr Kubik <piotr.kubik@adtran.com> Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/20251118102723.47997-2-nbd@nbd.name Link: https://patch.msgid.link/20260309060730.87840-2-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: fix multi-radio on-channel scanningChad Monroe1-5/+12
avoid unnecessary channel switch when performing an on-channel scan using a multi-radio device. Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support") Signed-off-by: Chad Monroe <chad@monroe.io> Link: https://patch.msgid.link/20251118102723.47997-1-nbd@nbd.name Link: https://patch.msgid.link/20260309060730.87840-1-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Decrement sta counter removing the link in ↵Lorenzo Bianconi1-0/+5
mt7996_mac_reset_sta_iter() Fixes tracking per-phy stations for offchannel switching. Fixes: ace5d3b6b49e8 ("wifi: mt76: mt7996: improve hardware restart reliability") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260308-mt7996_mac_reset_vif_iter-fix-v1-1-57f640aa2dcf@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Remove unnecessary phy filed in mt7996_vif_link structLorenzo Bianconi5-39/+101
Remove unnecessary phy pointer in mt7996_vif_link struct and rely on mt7996_vif_link_phy() utility routine. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260306-mt7996-deflink-lookup-link-remove-v1-4-7162b332873c@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Remove link pointer dependency in ↵Lorenzo Bianconi1-10/+4
mt7996_mac_sta_remove_links() Remove link pointer dependency in mt7996_mac_sta_remove_links routine to get the mt7996_phy pointer since the link can be already offchannel running mt7996_mac_sta_remove_links(). Rely on __mt7996_phy routine instead. Fixes: 344dd6a4c919 ("wifi: mt76: mt7996: Move num_sta accounting in mt7996_mac_sta_{add,remove}_links") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260306-mt7996-deflink-lookup-link-remove-v1-1-7162b332873c@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA propertyLorenzo Bianconi1-0/+1
Enable missing CHANCTX_STA_CSA property required for MLO. Fixes: f5160304d57c ("wifi: mt76: mt7996: Enable MLO support for client interfaces") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20250928-mt7996_chanctx_sta_csa-v1-1-82e455185990@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7925: fix incorrect TLV length in CLC commandQuan Zhou1-1/+1
The previous implementation of __mt7925_mcu_set_clc() set the TLV length field (.len) incorrectly during CLC command construction. The length was initialized as sizeof(req) - 4, regardless of the actual segment length. This could cause the WiFi firmware to misinterpret the command payload, resulting in command execution errors. This patch moves the TLV length assignment to after the segment is selected, and sets .len to sizeof(req) + seg->len - 4, matching the actual command content. This ensures the firmware receives the correct TLV length and parses the command properly. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Acked-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/f56ae0e705774dfa8aab3b99e5bbdc92cd93523e.1772011204.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: add missing lock protection in mt76_sta_state for sta_event callbackZiyi Guo1-0/+2
mt76_sta_state() calls the sta_event callback without holding dev->mutex. However, mt7915_mac_sta_event() (MT7915 implementation of this callback) calls mt7915_mac_twt_teardown_flow() which has lockdep_assert_held(&dev->mt76.mutex) indicating that callers must hold this lock. The locking pattern in mt76_sta_state() is inconsistent: - mt76_sta_add() acquires dev->mutex before calling dev->drv->sta_add - mt76_sta_remove() acquires dev->mutex before calling __mt76_sta_remove - But sta_event callback is called without acquiring the lock Add mutex_lock()/mutex_unlock() around the mt7915_mac_twt_teardown_flow invocation to fix the missing lock protection and maintain consistency with the existing locking pattern. Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Link: https://patch.msgid.link/20260131035210.2198259-1-n7l8m4@u.northwestern.edu Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: fix 6GHz regulatory update on connectionMichael Lo1-1/+2
Call mt7921_regd_update() instead of mt7921_mcu_set_clc() when setting the 6GHz power type after connection, so that regulatory limits and SAR power are also applied. Fixes: 51ba0e3a15eb ("wifi: mt76: mt7921: add 6GHz power type support for clc") Signed-off-by: Michael Lo <michael.lo@mediatek.com> Link: https://patch.msgid.link/20260211095025.2415624-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Disable Rx hdr_trans in monitor modeRyder Lee2-0/+5
Ensure raw frames are captured without header modification. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/04008426d6cd5de3995beefb98f9d13f35526c25.1770969275.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Add eMLSR supportMeiChia Chiu4-0/+84
Implement set_eml_op_mode mac80211 callback in order to introduce eMLSR support. Tested-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260203-mt7996-emlsr-v1-1-38ffb3d5110c@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()Duoming Zhou1-0/+1
When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work. Fixes: 878161d5d4a4 ("wifi: mt76: mt7996: enable coredump support") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://patch.msgid.link/20260131024731.18741-1-duoming@zju.edu.cn Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()Duoming Zhou1-0/+1
When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7915_pci_remove() | mt7915_sys_recovery_set() mt7915_unregister_device() | mt7915_reset() mt7915_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7915_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7915_unregister_device() to synchronize with any pending or executing dump work. Fixes: 4dbcb9125cc3 ("wifi: mt76: mt7915: enable coredump support") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Link: https://patch.msgid.link/20260130145759.84272-1-duoming@zju.edu.cn Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: don't return TXQ when exceeding max non-AQL packetsDavid Bauer1-0/+16
mt76_txq_send_burst does check if the number of non-AQL frames exceeds the maximum. In this case the queue is returned to ieee80211_return_txq when iterating over the scheduled TXQs in mt76_txq_schedule_list. This has the effect of inserting said TXQ at the head of the list. This means the loop will get the same TXQ again, which will terminate the scheduling round. TXQs following in the list thus never get scheduled for transmission. This can manifest in high latency low throughput or broken connections for said STAs. Check if the non-AQL packet count exceeds the limit and not return the TXQ in this case. Schedule all TXQs for the STA in case the non-AQL limit can be satisfied again. Signed-off-by: David Bauer <mail@david-bauer.net> Link: https://patch.msgid.link/20260129232321.276575-1-mail@david-bauer.net Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch ↵StanleyYP Wang1-2/+1
reason Previously, we used the IEEE80211_CONF_IDLE flag to avoid setting the parking channel with the CH_SWITCH_NORMAL reason, which could trigger TX emission before bootup CAC. However, we found that this flag can be set after triggering scanning on a connected station interface, and the reason CH_SWITCH_SCAN_BYPASS_DPD will be used when switching back to the operating channel, which makes the firmware failed to resume paused AC queues. Seems that we should avoid relying on this flag after switching to single multi-radio architecture. Instead, use the existence of chanctx as the condition. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: avoid to set ACK for MCU command if wait_resp is not setStanleyYP Wang2-7/+6
When wait_resp is not set but the ACK option is enabled in the MCU TXD, the ACK event is enqueued to the MCU event queue without being dequeued by the original MCU command request. Any orphaned ACK events will only be removed from the queue when another MCU command requests a response. Due to sequence index mismatches, these events are discarded one by one until a matching sequence index is found. However, if several MCU commands that do not require a response continue to fill up the event queue, there is a risk that when an MCU command with wait_resp enabled is issued, it may dequeue the wrong event skb, especially if the queue contains events with all possible sequence indices. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix struct mt7996_mcu_uni_eventStanleyYP Wang2-3/+3
The cid field is defined as a two-byte value in the firmware. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXPShayne Chen1-2/+4
The struct mt76_connac_fw_txp is used for HIF TXP. Change to use the struct mt76_connac_hw_txp to fix the wrong DMAD length for MAC TXP. Fixes: cb6ebbdffef2 ("wifi: mt76: mt7996: support writing MAC TXD for AddBA Request") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260203155532.1098290-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902 SDIO device supportSean Wang1-0/+4
Register the MT7902 SDIO device ID in the mt7921 driver and add its corresponding firmware and ROM patch names. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-11-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902 PCIe device supportSean Wang1-0/+4
Register the MT7902 PCI device ID in the mt7921 driver and add its corresponding firmware and ROM patch names. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-10-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt792x: add MT7902 WFDMA prefetch configurationSean Wang1-0/+16
Configure the RX/TX ring prefetch setting for MT7902 PCIe device. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-9-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902 MCU supportSean Wang3-2/+16
Add MCU support for the MT7902 chipset. runtime pm is not yet supported by the driver, but normal mac80211 operation is unaffected. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-8-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt792x: ensure MCU ready before ROM patch downloadSean Wang1-0/+7
Restart the MCU and poll FW state to ensure correct MCU status before downloading the ROM patch. This is a prerequisite for enabling MT7902 PCIe and has been validated on MT7921 and MT7925 since they share the common code path. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-7-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt792x: add PSE handling barrier for the large MCU cmdSean Wang2-0/+6
Add a dummy register read in mt76_connac_mcu_rate_txpower_band() to act as a PSE barrier. This would release PSE pages and prevents buffer underflow issues when handling MCU commands with larger payloads without the response in mt76_connac_mcu_set_rate_txpower(). This is a prerequisite patch before enabling MT7902 PCIe and SDIO support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-6-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: connac: mark MT7902 as hw txp devicesSean Wang1-0/+1
Add MT7902 to is_mt76_fw_txp() so it follows the legacy TX descriptor path like the other connac2 chips that return false. This is a prerequisite patch before enabling MT7902 pcie support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-5-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: add MT7902e DMA layout supportSean Wang2-9/+46
Add MT7902 PCIe specific DMA layout overrides for MCU TXQ index, RX ring size, and MCU_WA usage. Common layout remains the default for other chips. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-4-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: handle MT7902 irq_map quirk with mutable copySean Wang1-0/+14
MT7902 PCIe requires a different wm2_complete_mask value, so introduce a mutable per-device copy of the default irq_map and override the field only for this chip. Other devices continue using the shared const template. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com> Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-3-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7921: use mt76_for_each_q_rx() in reset pathSean Wang1-3/+3
Replace explicit napi_disable() calls for RX queues with mt76_for_each_q_rx() in mt7921e_mac_reset(). This removes hardcoded queue indices and disables all configured RX queues during reset. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: connac: use is_connac2() to replace is_mt7921() checksSean Wang6-25/+25
Unify all per-chip conditionals under the new is_connac2() helper. This avoids confusion caused by the previous is_mt7921() check, which implicitly covered multiple connac2 chipsets and no longer reflected its actual scope. This is a clean-up only change with no functional impact. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260219004007.19733-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: apply calibration-free data from OTPStanleyYP Wang2-19/+158
Before sending the current EEPROM data to the firmware, read the calibration-free data (FT data) from the efuse and merge it with the existing EEPROM data. Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20260212090310.3335392-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: add variant for MT7992 chipsetsShayne Chen4-2/+15
Introduce VAR_TYPE_24 for the MT7992 chipsets, a dual-band variant supporting 3T3R/2SS on the 2 GHz band and 5T5R/4SS on the 5GHz band. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20260212090310.3335392-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: add external EEPROM support for mt799x chipsetsStanleyYP Wang6-61/+148
For the MT7992 and MT7990 chipsets, efuse mode is not supported because there is insufficient space in the efuse to store the calibration data. Therefore, an additional on-chip EEPROM is added to address this limitation. Co-developed-by: Elwin Huang <s09289728096@gmail.com> Signed-off-by: Elwin Huang <s09289728096@gmail.com> Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20260212090310.3335392-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: b43: kzalloc + kcalloc to kzalloc_flexRosen Penev2-12/+10
Simplifies allocation and allows using __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260311004736.32730-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-24wifi: mac80211_hwsim: advertise basic UHR supportJohannes Berg1-0/+35
Just add support for ELR, and nothing else since the spec isn't really all that well-specified yet. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260320101624.77af6463920e.I257e525a461c350bed87cfaefc52de25e37afcfb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-24Merge tag 'ath-next-20260324' of ↵Johannes Berg12-135/+180
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.1 (PR #2) A few small cleanups and bug fixes across ath drivers. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-24drm: fix dead default for DRM_TTM_KUNIT_TESTJulian Braha1-1/+0
The DRM_TTM_KUNIT_TEST config option should default to KUNIT_ALL_TESTS so that if all tests are enabled then it is included, but currently the 'default KUNIT_ALL_TESTS' statement is shadowed by an unconditional 'default n', meaning that this second default statement is currently dead code. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://lore.kernel.org/r/20260323124118.1414913-1-julianbraha@gmail.com
2026-03-24media: rzv2h-ivc: Replace workqueue with direct function callJacopo Mondi3-17/+9
Scheduling of work items with an async workqueue opens the door to potential races between multiple instances of a work item. While the frame transfer function is now protected against races, using a workqueue doesn't provide much benefit considering the limited cost of creating a job transfer. Replace the usage of the work queue with direct function calls. Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: rzv2h-ivc: Avoid double job schedulingJacopo Mondi1-4/+7
The scheduling of a new buffer transfer in the IVC driver is triggered by two occurrences of the "frame completed" interrupt. The first interrupt occurrence identifies when all image data have been transferred to the ISP, the second occurrence identifies when the post-transfer VBLANK has completed and a new buffer can be transferred. Under heavy system load conditions the actual execution of the workqueue item might be delayed and two items might happen to run concurrently, leading to a new frame transfer being triggered while the previous one has not yet finished. This error condition is only visible because the driver maintains a status variable that counts the number of interrupts since the last transfer, and warns in case an IRQ happens before the counter has been reset. To ensure sequential execution of the worqueue items and avoid a double buffer transfer to run concurrently, protect the whole function body with the spinlock that so far was solely used to reset the counter and inspect the interrupt counter variable at the beginning of the buffer transfer function. As soon as the ongoing transfer completes, the workqueue item will be re-scheduled and will consume the pending buffer. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: rzv2h-ivc: Fix concurrent buffer list accessBarnabás Pőcze1-6/+5
The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a spinlock (`rzv2h_ivc::buffers.lock`). However, in `rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the `list_del()` call is executed without holding the spinlock, which makes it possible for the list to be concurrently modified Fix that by removing a buffer from the list in the lock protected section. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com> [assign ivc->buffers.curr in critical section as reported by Barnabas] Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: rzv2h-ivc: Fix FM_STOP register writeBarnabás Pőcze2-2/+4
Bit 20 should be written in this register to stop frame processing. So fix that, as well as the poll condition. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: rzv2h-ivc: Write AXIRX_PIXFMT onceBarnabás Pőcze2-7/+8
The documentation prescribes that invalid formats should not be set, so do a single write to ensure that both the CLFMT and DTYPE fields are set to valid values. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: rzv2h-ivc: Fix AXIRX_VBLANK register writeBarnabás Pőcze2-3/+6
According to the documentation there are writable reserved bits in the register and those should not be set to 0. So use `rzv2h_ivc_update_bits()` with a proper bitmask. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: rzv2h-ivc: Revise default VBLANK formulaDaniel Scally1-1/+1
The vertical blanking settings for the IVC block are dependent on settings in the ISP. This was originally set to calculate as the worst-case possible value, but it seems that this can cause the IVC block to hang. Instead calculate the vblank to match the default settings (which are currently all the driver sets anyway). Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Signed-off-by: Daniel Scally <dan.scally+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: mali-c55: Bypass Purple Fringe CorrectionJacopo Mondi1-2/+3
The Purple Fringe Correction module is enabled by default with a POR configuration which might not be correct for the lens/sensor combination in use. If the Purple Fringe Correction module has to be used, it needs to be supported in the driver's uAPI and properly configured by userspace. As the driver doesn't support it at the moment, bypass it by default. Reviewed-by: Barnabás Pőcze <barnabas.pocze@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: mali-c55: Bypass the Iridix Tonemap engineJacopo Mondi1-0/+5
The Iridix Tonemap engine, if not bypassed, applies a digital gain in order to compensate under-exposed images. This however breaks the exposure and gain regulation performed on the sensor. If the Iridix Tonemap has to be used, it need to be supported in the ISP uAPI and properly configured by userspace. As the driver doesn't support it at the moment, bypass it by default. Reviewed-by: Barnabás Pőcze <barnabas.pocze@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: mali-c55: Fix Iridix bypass macrosDaniel Scally1-2/+2
The Mali C55 Iridix block has a digital gain function and tone mapping function, whose enablement is controlled by two different bits in the BYPASS_3 register. Unfortunately, the "Gain" and "Tonemap" bypass bit definitions are the wrong way around. Swap them. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Reviewed-by: Barnabás Pőcze <barnabas.pocze@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-24media: mali-c55: Fully reset the ISP configurationJacopo Mondi1-0/+50
The Mali C55 driver uses an auto-suspend delay of 2000 milli-seconds. As the delay is quite large, it is certainly possible that two consecutive calls to enable_streams() do not go through a suspend of the peripheral, meaning we cannot rely on POW register values for the ISP configuration. To prevent a streaming session to be initialized with settings from the previous one, reset the full ISP configuration to know state disabling or bypassing all the ISP blocks the driver supports. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
generated by cgit v1.2.3 (git 2.39.0) at 2026-06-01 03:07:39 +0300