[Deepin-Kernel-SIG] [linux 6.12-y] [Upstream] fix mt7925 performance to merge mt76 from stable v6.14.11

[opsiff]

Reported-by: Ke Zhang zhangkeb@uniontech.com
Benjamin Berg (1):
wifi: mac80211: fix MPDU length parsing for EHT 5/6 GHz

Christophe JAILLET (1):
wifi: cfg80211: Fix an error handling path in nl80211_start_ap()

Felix Fietkau (5):
wifi: mac80211: fix vif addr when switching from monitor to station
wifi: mt76: scan: fix setting tx_info fields
wifi: mt76: mt7996: implement driver specific get_txpower function
wifi: mt76: mt7996: use the correct vif link for scanning/roc
wifi: mt76: scan: set vif offchannel link for scanning/roc

Feng Jiang (1):
wifi: mt76: scan: Fix 'mlink' dereferenced before IS_ERR_OR_NULL check

Johannes Berg (1):
wifi: mac80211: fix WARN_ON for monitor mode on some devices

Lorenzo Bianconi (1):
Revert "wifi: mt76: Check link_conf pointer in
mt76_connac_mcu_sta_basic_tlv()"

Ming Yen Hsieh (5):
wifi: mt76: mt792x: re-register CHANCTX_STA_CSA only for the mt7921
series
wifi: mt76: mt7925: integrate *mlo_sta_cmd and *sta_cmd
wifi: mt76: mt7925: update the power-saving flow
wifi: mt76: mt7925: fix missing hdr_trans_tlv command for broadcast
wtbl
wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state
for sta_cmd

Nikita Zhandarovich (1):
wifi: mt76: mt7915: fix possible integer overflows in
mt7915_muru_stats_show()

Quan Zhou (1):
wifi: mt76: mt7925: Simplify HIF suspend handling to avoid suspend
fail

Sean Wang (1):
Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"

Shayne Chen (1):
wifi: mt76: Check link_conf pointer in mt76_connac_mcu_sta_basic_tlv()

drivers/net/wireless/mediatek/mt76/channel.c | 5 +
drivers/net/wireless/mediatek/mt76/mt76.h | 2 +
.../wireless/mediatek/mt76/mt7915/debugfs.c | 45 +++---
.../net/wireless/mediatek/mt76/mt7925/init.c | 1 +
.../net/wireless/mediatek/mt76/mt7925/main.c | 78 ++++++++--
.../net/wireless/mediatek/mt76/mt7925/mcu.c | 137 ++++--------------
.../wireless/mediatek/mt76/mt7925/mt7925.h | 3 +-
drivers/net/wireless/mediatek/mt76/mt792x.h | 9 ++
.../net/wireless/mediatek/mt76/mt792x_core.c | 3 +-
.../net/wireless/mediatek/mt76/mt7996/mac.c | 40 +++--
.../net/wireless/mediatek/mt76/mt7996/main.c | 30 +++-
drivers/net/wireless/mediatek/mt76/scan.c | 21 ++-
include/net/mac80211.h | 3 +
net/mac80211/eht.c | 9 +-
net/mac80211/iface.c | 11 +-
net/mac80211/main.c | 13 +-
net/wireless/nl80211.c | 8 +-
17 files changed, 232 insertions(+), 186 deletions(-)

Summary by Sourcery

Update Mediatek mt76 drivers and mac80211/cfg80211 to improve mt7925 performance and stability, refine MLO power management and offchannel handling, and fix various correctness and capability issues across MT79xx chipsets and AP/monitor operation.

New Features:

• Introduce MLO power-management state tracking and deferred per-link PS updates for mt7925 multi-link stations.
• Add a driver-specific TX power reporting implementation for mt7996 based on the active PHY and chain configuration.

Bug Fixes:

• Simplify mt7925 HIF suspend handling to avoid suspend failures while still warning on non-idle traffic.
• Fix AMPDU BA setup for mt7925 to derive WCID from the station context and operate on the default link, avoiding incorrect multi-link iteration.
• Ensure mt76 offchannel virtual links are tracked via RCU and used in mt7996 TXWI preparation and BSS index selection for correct offchannel scanning/ROC behavior.
• Prevent integer overflows in mt7915 MU/OFDMA MURU debug statistics by casting counters to 64-bit before accumulation.
• Correct mac80211 EHT MPDU length parsing so non-2.4 GHz bands rely on VHT/HE capabilities instead of reserved EHT bits.
• Avoid unnecessary WARN_ON in mac80211 link info notifications by skipping monitor/AP-VLAN interfaces without appropriate driver support.
• Ensure virtual interface addresses are always populated and tracked via an addr_valid flag, fixing address handling for monitor and other special interfaces.
• Fix nl80211_start_ap() SMPS parameter validation to run before allocation and setup, returning proper errors on unsupported SMPS modes.
• Guard mt76_connac station basic TLV construction against NULL link_conf pointers to avoid dereferencing invalid configuration.
• Restrict CHANCTX_STA_CSA capability to mt7921 devices, avoiding improper usage on other mt792x variants.

Enhancements:

• Rework mt7925 station command path to use a unified MLO-aware implementation that consistently adds PHY, rate control, MLD and header translation TLVs.
• Refine mt7925 BSS power-save handling to distinguish legacy from multi-link cases, using state-driven updates and a delayed workqueue for MLO PS propagation.
• Adjust mt76 scan probe transmission flow so skb preparation is validated before setting TX control flags and queuing to hardware.

[sourcery-ai]

Reviewer's Guide

Backports a set of upstream Wi‑Fi fixes and mt76 driver updates (primarily for mt7925/mt7996) to improve MLO/AMPDU handling, power‑save and HIF suspend behavior, off‑channel scanning, and statistics safety, while also fixing mac80211/cfg80211 correctness issues such as EHT MPDU length parsing, monitor vifs, and AP start SMPS validation.

File-Level Changes

Change	Details	Files
Refactor mt7925 BA/MLO STA command handling and add MLO‑aware power‑save coordination for multi‑link operation.	Make mt7925_mcu_sta_ba derive WCID from ieee80211_ampdu_params->sta instead of a separate argument and drop the explicit WCID parameter. Simplify mt7925_mcu_uni_[tx,rx]_ba to operate on the station’s default link via mt792x_sta->vif instead of iterating all usable links, and update all AMPDU action call sites accordingly. Merge the previous single‑link and MLO variants into a unified mt7925_mcu_sta_cmd implementation, reusing the richer MLO path (including MLD/EHT TLVs and hdr_trans TLV) and always routing sta_update through it. Introduce an mt792x_mlo_pm_state enum and per‑vif state machine plus a delayed work item (mlo_pm_work) to coordinate BSS power‑save updates across multiple links, including state transitions on association, PS changes, link info changes, and station removal. Initialize and reset mvif->mlo_pm_state appropriately when interfaces are added/removed and register mlo_pm_work in mt7925 init.	drivers/net/wireless/mediatek/mt76/mt7925/mcu.c drivers/net/wireless/mediatek/mt76/mt7925/main.c drivers/net/wireless/mediatek/mt76/mt7925/init.c drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h drivers/net/wireless/mediatek/mt76/mt792x.h
Relax mt7925 HIF suspend handling to avoid spurious suspend failures while still logging busy traffic conditions.	On HIF suspend, unconditionally mark dev->hif_idle=true and only log a dev_info message when TX/RX traffic status is not idle, instead of treating that as a failure state. Keep HIF resume behavior unchanged (set dev->hif_resumed) while simplifying conditional branches.	drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
Fix mt7996 multi‑link/off‑channel scanning behavior and implement a driver‑specific get_txpower callback.	Track an offchannel_link pointer per mt76_vif_data and set/clear it in mt76_get_vif_phy_link/mt76_put_vif_phy_link, and mark the associated WCID as offchannel for added links. Update mt7996_mac_write_txwi and mt7996_tx_prepare_skb to choose link‑specific omac/wmm/band indices and BSS index based on the WCID’s offchannel flag, falling back to the default link when no off‑channel link is active. Use per‑link rate table indices (basic/mcast/beacon) instead of vif‑wide indices when building TX descriptors for beacons and multicast traffic. Add mt7996_get_txpower that derives the current txpower in dBm from the PHY chainmask/txpower_cur (including NSS delta), and register it as the ieee80211_ops .get_txpower hook in place of the generic helper.	drivers/net/wireless/mediatek/mt76/channel.c drivers/net/wireless/mediatek/mt76/mt76.h drivers/net/wireless/mediatek/mt76/mt76.h drivers/net/wireless/mediatek/mt76/mt76.h drivers/net/wireless/mediatek/mt76/mt7996/mac.c drivers/net/wireless/mediatek/mt76/mt7996/main.c
Rework mt76 scan probe transmission setup order and tx_info flags to match mac80211 expectations.	Defer filling ieee80211_tx_info flags (NO_CCK, DONT_USE_RATE_MASK) until after ieee80211_tx_prepare_skb succeeds, and invert the success check so that mt76_tx is only called when preparation returns non‑zero. Call ieee80211_free_txskb and skip transmission when ieee80211_tx_prepare_skb fails, ensuring that no partially prepared skb is sent. Leave skb queue mapping and IE construction logic unchanged.	drivers/net/wireless/mediatek/mt76/scan.c
Limit CHANCTX_STA_CSA hardware capability to mt7921 and hook up MLO power‑save work into mt792x core.	Gate ieee80211_hw_set(hw, CHANCTX_STA_CSA) behind an is_mt7921() check so only mt7921 advertises this capability. Add a delayed_work field for MLO PM into the mt792x_dev structure and initialize it to mt7925_mlo_pm_work during device registration.	drivers/net/wireless/mediatek/mt76/mt792x_core.c drivers/net/wireless/mediatek/mt76/mt792x.h drivers/net/wireless/mediatek/mt76/mt7925/init.c
Fix mac80211 EHT MPDU length parsing, monitor interface address semantics, and link‑info notifications.	In ieee80211_eht_cap_ie_to_sta_eht_cap, skip EHT MPDU length decoding for non‑2.4 GHz bands since those bits are reserved and length is governed by VHT/HE caps; update copyright year. In ieee80211_link_info_change_notify, refine early‑exit logic so AP_VLAN always returns, monitor interfaces only proceed when WANT_MONITOR_VIF is set, and other types are handled normally, avoiding WARN_ON noise for unsupported monitor vifs. Simplify _ieee80211_change_mac to always copy the new MAC into vif.addr and vif.bss_conf.addr regardless of the check_dup flag, and introduce/maintain a vif.addr_valid flag that is false for passive monitor interfaces and true otherwise.	net/mac80211/eht.c net/mac80211/main.c net/mac80211/iface.c include/net/mac80211.h
Tighten cfg80211 nl80211_start_ap SMPS validation and fix its error‑handling path.	Move the SMPS mode check to the beginning of nl80211_start_ap and return -EOPNOTSUPP immediately if a non‑OFF SMPS mode is requested, before allocating and filling the AP parameters structure. Remove the duplicate SMPS validation that previously occurred later in the function, avoiding leaks or inconsistent state when failing after partial setup.	net/wireless/nl80211.c
Prevent overflow in mt7915 MU‑RU statistics debugfs output.	Cast MIB counters to u64 before summing them for sub_total_cnt and total_ppdu_cnt in mt7915_muru_stats_show, covering VHT MU‑MIMO, HE MU‑MIMO/OFDMA, and HE TB PPDU counters. Ensure final seq_printf calls operate on 64‑bit totals rather than potentially overflowed 32‑bit arithmetic.	drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
Harden mt76 sta basic TLV building for MLO and broadcast cases.	Guard mt76_connac_mcu_sta_basic_tlv against a NULL link_conf pointer when configuring STA records, and only copy the BSSID when both the interface type and link_conf are valid. Ensure basic connection TLV generation doesn’t dereference link_conf for non‑station or partially initialized links.	drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Cryolitia]

LGTM

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Cryolitia
Once this PR has been reviewed and has the lgtm label, please ask for approval from opsiff. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• In the new offchannel_link handling (mt76_vif_data.offchannel_link, mt76_get_vif_phy_link/mt76_put_vif_phy_link, and mt7996_mac_write_txwi/mt7996_tx_prepare_skb), the offchannel_link pointer is updated with rcu_assign_pointer and dereferenced under RCU, but the corresponding mlink is kfree()'d immediately after clearing the pointer; consider using kfree_rcu() or an explicit synchronize_rcu() to avoid readers accessing a freed mlink.
• The new mt7996_get_txpower() implementation ignores the link_id argument and always uses the deflink/radio_phy; if multi-link operation is expected, it would be good to either derive the PHY from link_id or document why this is safe for all current callers.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In the new offchannel_link handling (mt76_vif_data.offchannel_link, mt76_get_vif_phy_link/mt76_put_vif_phy_link, and mt7996_mac_write_txwi/mt7996_tx_prepare_skb), the offchannel_link pointer is updated with rcu_assign_pointer and dereferenced under RCU, but the corresponding mlink is kfree()'d immediately after clearing the pointer; consider using kfree_rcu() or an explicit synchronize_rcu() to avoid readers accessing a freed mlink.
- The new mt7996_get_txpower() implementation ignores the link_id argument and always uses the deflink/radio_phy; if multi-link operation is expected, it would be good to either derive the PHY from link_id or document why this is safe for all current callers.

## Individual Comments

### Comment 1
<location> `drivers/net/wireless/mediatek/mt76/mt7925/main.c:430` </location>
<code_context>
 	mvif->bss_conf.vif = mvif;
 	mvif->sta.vif = mvif;
 	mvif->deflink_id = IEEE80211_LINK_UNSPECIFIED;
+	mvif->mlo_pm_state = MT792x_MLO_LINK_DISASSOC;

 	ret = mt7925_mac_link_bss_add(dev, &vif->bss_conf, &mvif->sta.deflink);
</code_context>

<issue_to_address>
**issue (complexity):** Consider introducing small helper functions to centralize MLO power-management state transitions and PS handling so the state machine is explicit and not scattered across multiple call sites.

A focused helper-based encapsulation would reduce the scattered state machine and branching without changing behavior.

You can centralize state transitions and MLO-vs-legacy branching like this:

```c
enum mt792x_mlo_pm_state
mt7925_mlo_pm_next_state_assoc(struct mt792x_vif *mvif)
{
	if (!ieee80211_vif_is_mld(mvif_to_vif(mvif)))
		return mvif->mlo_pm_state;

	return MT792x_MLO_LINK_ASSOC;
}

enum mt792x_mlo_pm_state
mt7925_mlo_pm_next_state_ps(struct mt792x_vif *mvif)
{
	if (hweight16(mvif->valid_links) < 2)
		return mvif->mlo_pm_state; /* legacy: no state change */

	switch (mvif->mlo_pm_state) {
	case MT792x_MLO_LINK_ASSOC:
		return MT792x_MLO_CHANGED_PS_PENDING;
	case MT792x_MLO_CHANGED_PS:
		return MT792x_MLO_CHANGED_PS;
	default:
		return mvif->mlo_pm_state;
	}
}
```

Then keep the actual PS/BSSID work in small helpers and call them from the existing hooks:

```c
static void mt7925_mlo_pm_apply_ps(struct mt792x_dev *dev,
				   struct ieee80211_vif *vif,
				   struct mt792x_vif *mvif)
{
	unsigned long valid = ieee80211_vif_is_mld(vif) ?
			      mvif->valid_links : BIT(0);
	struct ieee80211_bss_conf *bss_conf;
	int i;

	if (hweight16(mvif->valid_links) < 2) {
		/* legacy */
		bss_conf = &vif->bss_conf;
		mt7925_mcu_uni_bss_ps(dev, bss_conf);
		return;
	}

	if (mvif->mlo_pm_state != MT792x_MLO_CHANGED_PS)
		return;

	for_each_set_bit(i, &valid, IEEE80211_MLD_MAX_NUM_LINKS) {
		bss_conf = mt792x_vif_to_bss_conf(vif, i);
		mt7925_mcu_uni_bss_ps(dev, bss_conf);
	}
}
```

Usage in `mt7925_bss_info_changed()` becomes simpler and localizes decisions:

```c
if (changed & BSS_CHANGED_ASSOC) {
	mt7925_mcu_sta_update(dev, NULL, vif, true,
			      MT76_STA_INFO_STATE_ASSOC);
	mt7925_mcu_set_beacon_filter(dev, vif, vif->cfg.assoc);

	mvif->mlo_pm_state = mt7925_mlo_pm_next_state_assoc(mvif);
}

if (changed & BSS_CHANGED_PS) {
	mvif->mlo_pm_state = mt7925_mlo_pm_next_state_ps(mvif);
	mt7925_mlo_pm_apply_ps(dev, vif, mvif);
}
```

Similarly, the link-info path and work item can be narrowed to only express their phase, instead of owning parts of the state machine:

```c
static void mt7925_mlo_pm_secondary_setup_done(struct mt792x_dev *dev,
					       struct ieee80211_hw *hw,
					       struct ieee80211_bss_conf *info,
					       struct mt792x_vif *mvif)
{
	if (mvif->mlo_pm_state != MT792x_MLO_CHANGED_PS_PENDING)
		return;

	mt7925_mcu_uni_bss_bcnft(dev, info, true);
	ieee80211_queue_delayed_work(hw, &dev->mlo_pm_work, 5 * HZ);
	mvif->mlo_pm_state = MT792x_MLO_CHANGED_PS;
}
```

And in `mt7925_link_info_changed()`:

```c
if (changed & (BSS_CHANGED_QOS | BSS_CHANGED_BEACON_ENABLED))
	mt7925_mcu_set_tx(dev, info);

mt7925_mlo_pm_secondary_setup_done(dev, hw, info, mvif);
```

Finally, the work callback can be expressed as “apply pending PS for all MLO links” using the same `mt7925_mlo_pm_apply_ps()` helper, instead of directly checking `mlo_pm_state` in yet another place. This removes duplicated transition logic and makes the legal state flow explicit and easy to adjust.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Copilot]

Pull request overview

This PR backports upstream mt76 driver fixes to Linux kernel 6.12 to improve mt7925 wireless performance and stability. The changes include bug fixes for mac80211 subsystem and enhancements to the Mediatek mt76 driver focusing on multi-link operation (MLO) support, power management, and offchannel handling.

Changes:

• Fixed mac80211 issues including monitor mode WARN_ON, EHT MPDU length parsing for 5/6 GHz, and virtual interface address handling
• Improved mt7925 driver MLO power-save flow with state machine and deferred updates
• Simplified mt7925 BA (block acknowledgment) commands to use default link instead of iterating all MLO links
• Enhanced mt7996 offchannel handling with proper link selection for scanning/ROC operations

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
net/wireless/nl80211.c	Move SMPS mode validation before memory allocation to fix error handling path
net/mac80211/main.c	Skip link info notifications for monitor interfaces without WANT_MONITOR_VIF
net/mac80211/iface.c	Always populate vif address and add addr_valid flag for monitor interfaces
net/mac80211/eht.c	Fix EHT MPDU length parsing to only apply on 2.4 GHz band
include/net/mac80211.h	Add addr_valid field to ieee80211_vif structure
drivers/net/wireless/mediatek/mt76/scan.c	Validate skb preparation before setting TX info flags
drivers/net/wireless/mediatek/mt76/mt7996/main.c	Implement driver-specific get_txpower function
drivers/net/wireless/mediatek/mt76/mt7996/mac.c	Use offchannel_link for proper BSS index and rate table selection
drivers/net/wireless/mediatek/mt76/mt792x_core.c	Restrict CHANCTX_STA_CSA capability to mt7921 devices only
drivers/net/wireless/mediatek/mt76/mt792x.h	Add MLO power management state enum and delayed work
drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h	Remove vif parameter from BA command function signatures
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c	Unify station command path and simplify BA commands to use default link
drivers/net/wireless/mediatek/mt76/mt7925/main.c	Implement MLO power-save state machine with deferred updates
drivers/net/wireless/mediatek/mt76/mt7925/init.c	Initialize mlo_pm_work delayed work
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c	Cast to u64 to prevent integer overflows in MU-MIMO/OFDMA statistics
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c	Add NULL pointer check for link_conf before dereferencing
drivers/net/wireless/mediatek/mt76/mt76.h	Add offchannel bit to wcid and offchannel_link to vif_data
drivers/net/wireless/mediatek/mt76/channel.c	Assign offchannel_link via RCU for proper synchronization

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.