* [PATCH wireless-next 4/4] wifi: mac80211_hwsim: background CAC support
From: Janusz Dziedzic @ 2026-02-03 18:53 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260203185717.103810-1-janusz.dziedzic@gmail.com>
Report background CAC support and add allow
to cancel background CAC and simulate radar.
echo cancel > /sys/kernel/debug/ieee80211/phy2/hwsim/dfs_background_cac
echo radar > /sys/kernel/debug/ieee80211/phy2/hwsim/dfs_background_cac
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 77 +++++++++++++++++++
drivers/net/wireless/virtual/mac80211_hwsim.h | 2 +
2 files changed, 79 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 4d9f5f87e814..8b5618c2111f 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -715,6 +715,7 @@ struct mac80211_hwsim_data {
} ps;
bool ps_poll_pending;
struct dentry *debugfs;
+ struct cfg80211_chan_def radar_background_chandef;
atomic_t pending_cookie;
struct sk_buff_head pending; /* packets pending */
@@ -936,6 +937,7 @@ static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
[HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
[HWSIM_ATTR_MULTI_RADIO] = { .type = NLA_FLAG },
[HWSIM_ATTR_SUPPORT_NAN_DEVICE] = { .type = NLA_FLAG },
+ [HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR] = { .type = NLA_FLAG },
};
#if IS_REACHABLE(CONFIG_VIRTIO)
@@ -1164,6 +1166,41 @@ static int hwsim_write_simulate_radar(void *dat, u64 val)
DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
hwsim_write_simulate_radar, "%llu\n");
+static ssize_t hwsim_background_cac_write(struct file *file,
+ const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ struct mac80211_hwsim_data *data = file->private_data;
+ char buf[8] = {};
+
+ if (count >= sizeof(buf))
+ return -EINVAL;
+
+ if (copy_from_user(buf, user_buf, count))
+ return -EFAULT;
+
+ /* Check if background radar channel is configured */
+ if (!data->radar_background_chandef.chan)
+ return -ENOENT;
+
+ if (sysfs_streq(buf, "radar"))
+ cfg80211_background_radar_event(data->hw->wiphy,
+ &data->radar_background_chandef,
+ GFP_KERNEL);
+ else if (sysfs_streq(buf, "cancel"))
+ cfg80211_background_cac_abort(data->hw->wiphy);
+ else
+ return -EINVAL;
+
+ return count;
+}
+
+static const struct file_operations hwsim_background_cac_ops = {
+ .write = hwsim_background_cac_write,
+ .open = simple_open,
+ .llseek = default_llseek,
+};
+
static int hwsim_fops_group_read(void *dat, u64 *val)
{
struct mac80211_hwsim_data *data = dat;
@@ -4154,6 +4191,24 @@ static int mac80211_hwsim_change_nan_config(struct ieee80211_hw *hw,
return 0;
}
+static int mac80211_hwsim_set_radar_background(struct ieee80211_hw *hw,
+ struct cfg80211_chan_def *chan)
+{
+ struct mac80211_hwsim_data *data = hw->priv;
+
+ if (!wiphy_ext_feature_isset(hw->wiphy,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND))
+ return -EOPNOTSUPP;
+
+ if (chan)
+ data->radar_background_chandef = *chan;
+ else
+ memset(&data->radar_background_chandef, 0,
+ sizeof(data->radar_background_chandef));
+
+ return 0;
+}
+
#ifdef CONFIG_MAC80211_DEBUGFS
#define HWSIM_DEBUGFS_OPS \
.link_add_debugfs = mac80211_hwsim_link_add_debugfs,
@@ -4189,6 +4244,7 @@ static int mac80211_hwsim_change_nan_config(struct ieee80211_hw *hw,
.start_nan = mac80211_hwsim_start_nan, \
.stop_nan = mac80211_hwsim_stop_nan, \
.nan_change_conf = mac80211_hwsim_change_nan_config, \
+ .set_radar_background = mac80211_hwsim_set_radar_background, \
HWSIM_DEBUGFS_OPS
#define HWSIM_NON_MLO_OPS \
@@ -4255,6 +4311,7 @@ struct hwsim_new_radio_params {
bool mlo;
const struct cfg80211_pmsr_capabilities *pmsr_capa;
bool nan_device;
+ bool background_radar;
};
static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
@@ -4340,6 +4397,12 @@ static int append_radio_msg(struct sk_buff *skb, int id,
if (ret < 0)
return ret;
}
+
+ if (param->background_radar) {
+ ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR);
+ if (ret < 0)
+ return ret;
+ }
return 0;
}
@@ -5794,6 +5857,9 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
wiphy_ext_feature_set(hw->wiphy,
NL80211_EXT_FEATURE_DFS_CONCURRENT);
+ if (param->background_radar)
+ wiphy_ext_feature_set(hw->wiphy,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND);
if (param->no_vif)
ieee80211_hw_set(hw, NO_AUTO_VIF);
@@ -5832,6 +5898,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
debugfs_create_file("dfs_simulate_radar", 0222,
data->debugfs,
data, &hwsim_simulate_radar);
+ if (param->background_radar)
+ debugfs_create_file("dfs_background_cac", 0200,
+ data->debugfs,
+ data, &hwsim_background_cac_ops);
if (param->pmsr_capa) {
data->pmsr_capa = *param->pmsr_capa;
@@ -5950,6 +6020,9 @@ static int mac80211_hwsim_get_radio(struct sk_buff *skb,
param.channels = data->channels;
param.hwname = wiphy_name(data->hw->wiphy);
param.pmsr_capa = &data->pmsr_capa;
+ param.background_radar =
+ wiphy_ext_feature_isset(data->hw->wiphy,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND);
res = append_radio_msg(skb, data->idx, ¶m);
if (res < 0)
@@ -6387,6 +6460,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
if (info->attrs[HWSIM_ATTR_MULTI_RADIO])
param.multi_radio = true;
+ if (info->attrs[HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR])
+ param.background_radar = true;
+
if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
param.reg_alpha2 =
nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
@@ -7165,6 +7241,7 @@ static int __init init_mac80211_hwsim(void)
param.p2p_device = support_p2p_device;
param.mlo = mlo;
param.multi_radio = multi_radio;
+ param.background_radar = true;
param.use_chanctx = channels > 1 || mlo || multi_radio;
param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
if (param.p2p_device)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.h b/drivers/net/wireless/virtual/mac80211_hwsim.h
index c2d06cf852a5..a022cd5c0f1c 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.h
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.h
@@ -161,6 +161,7 @@ enum hwsim_commands {
* Adds one radio for each band. Number of supported channels will be set for
* each radio instead of for the wiphy.
* @HWSIM_ATTR_SUPPORT_NAN_DEVICE: support NAN Device virtual interface (flag)
+ * @HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR: background radar/CAC support (flag)
* @__HWSIM_ATTR_MAX: enum limit
*/
enum hwsim_attrs {
@@ -195,6 +196,7 @@ enum hwsim_attrs {
HWSIM_ATTR_PMSR_RESULT,
HWSIM_ATTR_MULTI_RADIO,
HWSIM_ATTR_SUPPORT_NAN_DEVICE,
+ HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR,
__HWSIM_ATTR_MAX,
};
#define HWSIM_ATTR_MAX (__HWSIM_ATTR_MAX - 1)
--
2.43.0
^ permalink raw reply related
* [PATCH wireless-next 3/4] wifi: cfg80211: events, report background radar
From: Janusz Dziedzic @ 2026-02-03 18:53 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260203185717.103810-1-janusz.dziedzic@gmail.com>
In case we report radar event add also information
this is connected with background one, so user mode
application like hostapd, could check it and behave
correctly.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
net/wireless/mlme.c | 6 ++++--
net/wireless/nl80211.c | 7 +++++++
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index cafb39596a40..da3786417713 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1226,11 +1226,12 @@ void cfg80211_background_cac_done_wk(struct work_struct *work)
guard(wiphy)(&rdev->wiphy);
rdev_set_radar_background(rdev, NULL);
- rdev->background_radar_wdev = NULL;
__cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
&rdev->background_radar_chandef,
NL80211_RADAR_CAC_FINISHED);
+
+ rdev->background_radar_wdev = NULL;
}
void cfg80211_background_cac_abort_wk(struct work_struct *work)
@@ -1330,11 +1331,12 @@ void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
return;
rdev_set_radar_background(rdev, NULL);
- rdev->background_radar_wdev = NULL; /* Release offchain ownership */
__cfg80211_background_cac_event(rdev, wdev,
&rdev->background_radar_chandef,
NL80211_RADAR_CAC_ABORTED);
+
+ rdev->background_radar_wdev = NULL;
}
int cfg80211_assoc_ml_reconf(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f9a739d1ebfb..47b7e0559c73 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -21238,6 +21238,13 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
goto nla_put_failure;
}
+ if (rdev->background_radar_wdev &&
+ cfg80211_chandef_identical(&rdev->background_radar_chandef,
+ chandef)) {
+ if (nla_put_flag(msg, NL80211_ATTR_RADAR_BACKGROUND))
+ goto nla_put_failure;
+ }
+
if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
goto nla_put_failure;
--
2.43.0
^ permalink raw reply related
* [PATCH wireless-next 2/4] wifi: cfg80211: set and report chandef CAC ongoing
From: Janusz Dziedzic @ 2026-02-03 18:53 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260203185717.103810-1-janusz.dziedzic@gmail.com>
Allow to track and check CAC state from user mode by
simple check phy channels eg. using iw phy1 channels
command.
This is done for regular CAC and background CAC.
It is important for background CAC while we can start
it from any app (eg. iw or hostapd).
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
include/net/cfg80211.h | 3 +++
include/uapi/linux/nl80211.h | 6 ++++++
net/wireless/chan.c | 27 +++++++++++++++++++++++++++
net/wireless/core.h | 4 ++++
net/wireless/mlme.c | 7 +++++++
net/wireless/nl80211.c | 7 +++++++
6 files changed, 54 insertions(+)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index fc01de19c798..e00045c150e7 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -190,6 +190,8 @@ enum ieee80211_channel_flags {
* on this channel.
* @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
* @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
+ * @cac_start_time: timestamp (CLOCK_BOOTTIME, nanoseconds) when CAC was
+ * started on this channel. Zero when CAC is not in progress.
* @psd: power spectral density (in dBm)
*/
struct ieee80211_channel {
@@ -207,6 +209,7 @@ struct ieee80211_channel {
enum nl80211_dfs_state dfs_state;
unsigned long dfs_state_entered;
unsigned int dfs_cac_ms;
+ u64 cac_start_time;
s8 psd;
};
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b63f71850906..c75aa039f096 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -4480,6 +4480,10 @@ enum nl80211_wmm_rule {
* as a non-primary subchannel. Only applicable to S1G channels.
* @NL80211_FREQUENCY_ATTR_NO_UHR: UHR operation is not allowed on this channel
* in current regulatory domain.
+ * @NL80211_FREQUENCY_ATTR_CAC_START_TIME: Channel Availability Check (CAC)
+ * start time (CLOCK_BOOTTIME, nanoseconds). Only present when CAC is
+ * currently in progress on this channel.
+ * @NL80211_FREQUENCY_ATTR_PAD: attribute used for padding for 64-bit alignment
* @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
* currently defined
* @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
@@ -4530,6 +4534,8 @@ enum nl80211_frequency_attr {
NL80211_FREQUENCY_ATTR_NO_16MHZ,
NL80211_FREQUENCY_ATTR_S1G_NO_PRIMARY,
NL80211_FREQUENCY_ATTR_NO_UHR,
+ NL80211_FREQUENCY_ATTR_CAC_START_TIME,
+ NL80211_FREQUENCY_ATTR_PAD,
/* keep last */
__NL80211_FREQUENCY_ATTR_AFTER_LAST,
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 68221b1ab45e..dfe319565280 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -642,6 +642,33 @@ void cfg80211_set_dfs_state(struct wiphy *wiphy,
}
}
+void cfg80211_set_cac_state(struct wiphy *wiphy,
+ const struct cfg80211_chan_def *chandef,
+ bool cac_ongoing)
+{
+ struct ieee80211_channel *c;
+ int width;
+ u64 cac_time;
+
+ if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+ return;
+
+ width = cfg80211_chandef_get_width(chandef);
+ if (width < 0)
+ return;
+
+ /* Get the same timestamp for all subchannels */
+ cac_time = cac_ongoing ? ktime_get_boottime_ns() : 0;
+
+ for_each_subchan(chandef, freq, cf) {
+ c = ieee80211_get_channel_khz(wiphy, freq);
+ if (!c)
+ continue;
+
+ c->cac_start_time = cac_time;
+ }
+}
+
static bool
cfg80211_dfs_permissive_check_wdev(struct cfg80211_registered_device *rdev,
enum nl80211_iftype iftype,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 6ac57b7b2615..6cace846d7a3 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -481,6 +481,10 @@ void cfg80211_set_dfs_state(struct wiphy *wiphy,
const struct cfg80211_chan_def *chandef,
enum nl80211_dfs_state dfs_state);
+void cfg80211_set_cac_state(struct wiphy *wiphy,
+ const struct cfg80211_chan_def *chandef,
+ bool cac_ongoing);
+
void cfg80211_dfs_channels_update_work(struct work_struct *work);
void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 212178d04efa..cafb39596a40 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1162,9 +1162,11 @@ void cfg80211_cac_event(struct net_device *netdev,
fallthrough;
case NL80211_RADAR_CAC_ABORTED:
wdev->links[link_id].cac_started = false;
+ cfg80211_set_cac_state(wiphy, chandef, false);
break;
case NL80211_RADAR_CAC_STARTED:
wdev->links[link_id].cac_started = true;
+ cfg80211_set_cac_state(wiphy, chandef, true);
break;
default:
WARN_ON(1);
@@ -1192,15 +1194,18 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
switch (event) {
case NL80211_RADAR_CAC_FINISHED:
cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
+ cfg80211_set_cac_state(wiphy, chandef, false);
memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
cfg80211_sched_dfs_chan_update(rdev);
break;
case NL80211_RADAR_CAC_ABORTED:
+ cfg80211_set_cac_state(wiphy, chandef, false);
if (!cancel_delayed_work(&rdev->background_cac_done_wk))
return;
break;
case NL80211_RADAR_CAC_STARTED:
+ cfg80211_set_cac_state(wiphy, chandef, true);
break;
default:
return;
@@ -1306,7 +1311,9 @@ void cfg80211_stop_radar_detection(struct wireless_dev *wdev)
continue;
chandef = *wdev_chandef(wdev, link_id);
+ wdev->links[link_id].cac_started = false;
rdev_end_cac(rdev, wdev->netdev, link_id);
+ cfg80211_set_cac_state(wiphy, &chandef, false);
nl80211_radar_notify(rdev, &chandef, NL80211_RADAR_CAC_ABORTED,
wdev->netdev, GFP_KERNEL);
}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 6e58b238a1f8..f9a739d1ebfb 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1334,6 +1334,12 @@ static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
if ((chan->flags & IEEE80211_CHAN_NO_UHR) &&
nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_UHR))
goto nla_put_failure;
+ if (chan->cac_start_time &&
+ nla_put_u64_64bit(msg,
+ NL80211_FREQUENCY_ATTR_CAC_START_TIME,
+ chan->cac_start_time,
+ NL80211_FREQUENCY_ATTR_PAD))
+ goto nla_put_failure;
}
if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
@@ -11354,6 +11360,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
wdev->links[link_id].cac_started = true;
wdev->links[link_id].cac_start_time = jiffies;
wdev->links[link_id].cac_time_ms = cac_time_ms;
+ cfg80211_set_cac_state(wiphy, &chandef, true);
return 0;
}
--
2.43.0
^ permalink raw reply related
* [PATCH wireless-next 1/4] wifi: cfg80211: fix background CAC
From: Janusz Dziedzic @ 2026-02-03 18:53 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260203185717.103810-1-janusz.dziedzic@gmail.com>
Fix:
- Send CAC_ABORT event when background CAC is canceled
- Cancel CAC done workqueue when radar is detected
- Release background wdev ownership when CAC is aborted or passed
- Clean lower layer background radar state when CAC is aborted or passed
- Prevent sending abort event when radar event is sent
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
net/wireless/mlme.c | 40 +++++++++++++++++++---------------------
1 file changed, 19 insertions(+), 21 deletions(-)
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 3fc175f9f868..212178d04efa 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1115,8 +1115,10 @@ void __cfg80211_radar_event(struct wiphy *wiphy,
*/
cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
- if (offchan)
+ if (offchan) {
+ cancel_delayed_work(&rdev->background_cac_done_wk);
queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+ }
cfg80211_sched_dfs_chan_update(rdev);
@@ -1187,21 +1189,16 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
if (!cfg80211_chandef_valid(chandef))
return;
- if (!rdev->background_radar_wdev)
- return;
-
switch (event) {
case NL80211_RADAR_CAC_FINISHED:
cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
cfg80211_sched_dfs_chan_update(rdev);
- wdev = rdev->background_radar_wdev;
break;
case NL80211_RADAR_CAC_ABORTED:
if (!cancel_delayed_work(&rdev->background_cac_done_wk))
return;
- wdev = rdev->background_radar_wdev;
break;
case NL80211_RADAR_CAC_STARTED:
break;
@@ -1213,17 +1210,6 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
}
-static void
-cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
- const struct cfg80211_chan_def *chandef,
- enum nl80211_radar_event event)
-{
- guard(wiphy)(&rdev->wiphy);
-
- __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
- chandef, event);
-}
-
void cfg80211_background_cac_done_wk(struct work_struct *work)
{
struct delayed_work *delayed_work = to_delayed_work(work);
@@ -1231,18 +1217,30 @@ void cfg80211_background_cac_done_wk(struct work_struct *work)
rdev = container_of(delayed_work, struct cfg80211_registered_device,
background_cac_done_wk);
- cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
- NL80211_RADAR_CAC_FINISHED);
+
+ guard(wiphy)(&rdev->wiphy);
+
+ rdev_set_radar_background(rdev, NULL);
+ rdev->background_radar_wdev = NULL;
+
+ __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
+ &rdev->background_radar_chandef,
+ NL80211_RADAR_CAC_FINISHED);
}
void cfg80211_background_cac_abort_wk(struct work_struct *work)
{
struct cfg80211_registered_device *rdev;
+ struct wireless_dev *wdev;
rdev = container_of(work, struct cfg80211_registered_device,
background_cac_abort_wk);
- cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
- NL80211_RADAR_CAC_ABORTED);
+
+ guard(wiphy)(&rdev->wiphy);
+
+ wdev = rdev->background_radar_wdev;
+ if (wdev)
+ cfg80211_stop_background_radar_detection(wdev);
}
void cfg80211_background_cac_abort(struct wiphy *wiphy)
--
2.43.0
^ permalink raw reply related
* [PATCH wireless-next 0/4] DFS/CAC changes
From: Janusz Dziedzic @ 2026-02-03 18:53 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
- report CAC ongoing to user mode
- add hwsim support for background CAC
Janusz Dziedzic (4):
wifi: cfg80211: fix background CAC
wifi: cfg80211: set and report chandef CAC ongoing
wifi: cfg80211: events, report background radar
wifi: mac80211_hwsim: background CAC support
drivers/net/wireless/virtual/mac80211_hwsim.c | 77 +++++++++++++++++++
drivers/net/wireless/virtual/mac80211_hwsim.h | 2 +
include/net/cfg80211.h | 3 +
include/uapi/linux/nl80211.h | 6 ++
net/wireless/chan.c | 27 +++++++
net/wireless/core.h | 4 +
net/wireless/mlme.c | 51 ++++++------
net/wireless/nl80211.c | 14 ++++
8 files changed, 162 insertions(+), 22 deletions(-)
--
2.43.0
^ permalink raw reply
* Potential firmware selection issue with QCNFA765 on ThinkPad P14s Gen 5
From: Mohamed Sallam @ 2026-02-03 18:54 UTC (permalink / raw)
To: ath11k; +Cc: linux-wireless
Hi ath11k maintainers,
I'm not very experienced with Linux - I'm an end user who noticed something
strange with my WiFi and wanted to share my findings in case it helps others.
Full disclosure: I used AI tools to help me investigate this issue and
understand the driver behavior. If I'm misunderstanding something fundamental,
please let me know.
WHAT I OBSERVED
===============
I have a Lenovo ThinkPad P14s Gen 5 AMD with a Qualcomm QCNFA765 WiFi card
(PCI ID 17cb:1103, subsystem 17aa:9309). I'm running Arch Linux with kernel
6.12.68-1-lts and firmware package linux-firmware-atheros 20260110-1.
I noticed that channels 149-165 in the 5 GHz band are marked with (no IR),
preventing me from using them. This happens consistently on my system.
WHAT I FOUND
============
While trying to understand why this happens, I discovered that the
linux-firmware package contains two different firmware files:
- Generic: ath11k/WCN6855/hw2.0/amss.bin
- Card-specific: ath11k/WCN6855/hw2.0/nfa765/amss.bin
When I manually create a symlink to use the nfa765 variant instead of the
default, the (no IR) restrictions disappear and all channels work normally.
This suggests the driver might not be selecting the optimal firmware for
this specific card variant.
The AI analysis suggested that:
- The driver looks for firmware at ath11k/<chip>/<hw_rev>/<filename>
- There's a "firmware-name" property that can override this, but it seems
to only work on ARM platforms with device trees, not x86 laptops
- The PCI subsystem ID (17aa:9309) might be available to the driver but
isn't being used to pick different firmware files
I don't know if this is accurate - it's just what the AI told me based on
looking at the driver code. The key point is that the firmware swap fixes
the issue for me.
REPRODUCTION STEPS
==================
On my system, with the default setup:
1. Check channel flags: iw phy | grep -E "5745|5765|5785|5805|5825"
2. Channels 149-165 show (no IR)
After applying the workaround (symlink nfa765 firmware):
1. Same check shows channels without (no IR) restrictions
2. WiFi works on all channels
TECHNICAL DETAILS
=================
Hardware: Lenovo ThinkPad P14s Gen 5 AMD (21ME001MUS)
WiFi: Qualcomm QCNFA765 (WCN6855 hw2.1)
PCI: 17cb:1103, subsystem 17aa:9309 (Lenovo)
Kernel: 6.12.68-1-lts
Firmware: linux-firmware-atheros 20260110-1
Firmware ver: WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Logs from my system:
$ dmesg | grep ath11k
[ 2.845632] ath11k_pci 0000:02:00.0: chip_id 0x0 chip_family 0x0
board_id 0xff
[ 2.845778] ath11k_pci 0000:02:00.0: fw_version 0x1019B0E1
fw_build_timestamp 2024-12-19
[ 2.845789] ath11k_pci 0000:02:00.0: fw_build_id
WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
[ 2.845806] ath11k_pci 0000:02:00.0: qmi failed to load bdf
[ 2.845809] ath11k_pci 0000:02:00.0: qmi failed to load cal data,
fallback to 0xff
$ lspci -vnns 02:00.0
02:00.0 0280: 17cb:1103 (rev 01)
Subsystem: 17aa:9309
Kernel driver in use: ath11k_pci
With default firmware:
$ iw phy | grep -E "5745|5765|5785|5805|5825"
* 5745.0 MHz [149] (14.0 dBm) (no IR)
* 5765.0 MHz [153] (14.0 dBm) (no IR)
* 5785.0 MHz [157] (14.0 dBm) (no IR)
* 5805.0 MHz [161] (14.0 dBm) (no IR)
* 5825.0 MHz [165] (14.0 dBm) (no IR)
With nfa765 firmware symlinked:
* 5745.0 MHz [149] (23.0 dBm)
* 5765.0 MHz [153] (23.0 dBm)
* 5785.0 MHz [157] (23.0 dBm)
* 5805.0 MHz [161] (23.0 dBm)
* 5825.0 MHz [165] (23.0 dBm)
MY WORKAROUND
=============
I'm currently using this workaround:
sudo ln -sf ../hw2.0/nfa765/amss.bin.zst \
/lib/firmware/ath11k/WCN6855/hw2.1/amss.bin.zst
This fixes the issue for me, but I understand it's a hack, not a proper
solution.
QUESTIONS
=========
1. Is the driver supposed to automatically select card-specific firmware
based on PCI subsystem ID, or is this working as designed?
2. If it's supposed to work this way, could there be a bug in the firmware
path selection logic?
3. Is there a better workaround than manually symlinking firmware files?
Thank you for your time and for maintaining this driver. I appreciate
any guidance you can provide, even if it's just to tell me this is
expected behavior and I'm misunderstanding something.
Best regards,
Mohamed Sallam
^ permalink raw reply
* [PATCH mt76 v2 3/4] wifi: mt76: avoid to set ACK for MCU command if wait_resp is not set
From: Shayne Chen @ 2026-02-03 15:55 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, StanleyYP Wang, Shayne Chen
In-Reply-To: <20260203155532.1098290-1-shayne.chen@mediatek.com>
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
When wait_resp is not set but the ACK option is enabled in the MCU TXD,
the ACK event is enqueued to the MCU event queue without being dequeued
by the original MCU command request.
Any orphaned ACK events will only be removed from the queue when another
MCU command requests a response. Due to sequence index mismatches, these
events are discarded one by one until a matching sequence index is found.
However, if several MCU commands that do not require a response continue
to fill up the event queue, there is a risk that when an MCU command with
wait_resp enabled is issued, it may dequeue the wrong event skb,
especially if the queue contains events with all possible sequence
indices.
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 11 +++++------
2 files changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mcu.c b/drivers/net/wireless/mediatek/mt76/mcu.c
index 535c3d8a9cc0..cbfb3bbec503 100644
--- a/drivers/net/wireless/mediatek/mt76/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mcu.c
@@ -98,7 +98,7 @@ int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
/* orig skb might be needed for retry, mcu_skb_send_msg consumes it */
if (orig_skb)
skb_get(orig_skb);
- ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, &seq);
+ ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, wait_resp ? &seq : NULL);
if (ret < 0)
goto out;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 285cd83e7117..68d698033e43 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -322,13 +322,12 @@ mt7996_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
uni_txd->pkt_type = MCU_PKT_ID;
uni_txd->seq = seq;
- if (cmd & __MCU_CMD_FIELD_QUERY)
- uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
- else
- uni_txd->option = MCU_CMD_UNI_EXT_ACK;
+ uni_txd->option = MCU_CMD_UNI;
+ if (!(cmd & __MCU_CMD_FIELD_QUERY))
+ uni_txd->option |= MCU_CMD_SET;
- if (mcu_cmd == MCU_UNI_CMD_SDO)
- uni_txd->option &= ~MCU_CMD_ACK;
+ if (wait_seq)
+ uni_txd->option |= MCU_CMD_ACK;
if ((cmd & __MCU_CMD_FIELD_WA) && (cmd & __MCU_CMD_FIELD_WM))
uni_txd->s2d_index = MCU_S2D_H2CN;
--
2.51.0
^ permalink raw reply related
* [PATCH mt76 v2 2/4] wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
From: Shayne Chen @ 2026-02-03 15:55 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, StanleyYP Wang, Shayne Chen
In-Reply-To: <20260203155532.1098290-1-shayne.chen@mediatek.com>
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
The cid field is defined as a two-byte value in the firmware.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 8e1c8e1d6a99..285cd83e7117 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -242,7 +242,7 @@ mt7996_mcu_parse_response(struct mt76_dev *mdev, int cmd,
event = (struct mt7996_mcu_uni_event *)skb->data;
ret = le32_to_cpu(event->status);
/* skip invalid event */
- if (mcu_cmd != event->cid)
+ if (mcu_cmd != le16_to_cpu(event->cid))
ret = -EAGAIN;
} else {
skb_pull(skb, sizeof(struct mt7996_mcu_rxd));
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
index d9fb49f7b01b..d70540982983 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
@@ -25,8 +25,8 @@ struct mt7996_mcu_rxd {
};
struct mt7996_mcu_uni_event {
- u8 cid;
- u8 __rsv[3];
+ __le16 cid;
+ u8 __rsv[2];
__le32 status; /* 0: success, others: fail */
} __packed;
--
2.51.0
^ permalink raw reply related
* [PATCH mt76 v2 4/4] wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch reason
From: Shayne Chen @ 2026-02-03 15:55 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, StanleyYP Wang, Shayne Chen
In-Reply-To: <20260203155532.1098290-1-shayne.chen@mediatek.com>
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Previously, we used the IEEE80211_CONF_IDLE flag to avoid setting the
parking channel with the CH_SWITCH_NORMAL reason, which could trigger TX
emission before bootup CAC.
However, we found that this flag can be set after triggering scanning on a
connected station interface, and the reason CH_SWITCH_SCAN_BYPASS_DPD will
be used when switching back to the operating channel, which makes the
firmware failed to resume paused AC queues.
Seems that we should avoid relying on this flag after switching to single
multi-radio architecture. Instead, use the existence of chanctx as the
condition.
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
v2:
- change to use the existence of chanctx as the condition
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 68d698033e43..9ccf9f97c984 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3924,8 +3924,7 @@ int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag)
if (phy->mt76->hw->conf.flags & IEEE80211_CONF_MONITOR)
req.switch_reason = CH_SWITCH_NORMAL;
- else if (phy->mt76->offchannel ||
- phy->mt76->hw->conf.flags & IEEE80211_CONF_IDLE)
+ else if (phy->mt76->offchannel || !phy->mt76->chanctx)
req.switch_reason = CH_SWITCH_SCAN_BYPASS_DPD;
else if (!cfg80211_reg_can_beacon(phy->mt76->hw->wiphy, chandef,
NL80211_IFTYPE_AP))
--
2.51.0
^ permalink raw reply related
* [PATCH mt76 v2 1/4] wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP
From: Shayne Chen @ 2026-02-03 15:55 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, Shayne Chen
The struct mt76_connac_fw_txp is used for HIF TXP. Change to use the
struct mt76_connac_hw_txp to fix the wrong DMAD length for MAC TXP.
Fixes: cb6ebbdffef2 ("wifi: mt76: mt7996: support writing MAC TXD for AddBA Request")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 77a036ac043c..3b09eff216c3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -1099,10 +1099,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
* req
*/
if (le32_to_cpu(ptr[7]) & MT_TXD7_MAC_TXD) {
- u32 val;
+ u32 val, mac_txp_size = sizeof(struct mt76_connac_hw_txp);
ptr = (__le32 *)(txwi + MT_TXD_SIZE);
- memset((void *)ptr, 0, sizeof(struct mt76_connac_fw_txp));
+ memset((void *)ptr, 0, mac_txp_size);
val = FIELD_PREP(MT_TXP0_TOKEN_ID0, id) |
MT_TXP0_TOKEN_ID0_VALID_MASK;
@@ -1121,6 +1121,8 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
tx_info->buf[1].addr >> 32);
#endif
ptr[3] = cpu_to_le32(val);
+
+ tx_info->buf[0].len = MT_TXD_SIZE + mac_txp_size;
} else {
struct mt76_connac_txp_common *txp;
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2] wifi: brcmfmac: Fix potential kernel oops when probe fails
From: Marek Szyprowski @ 2026-02-03 14:05 UTC (permalink / raw)
To: Arend van Spriel, linux-wireless, brcm80211,
brcm80211-dev-list.pdl
In-Reply-To: <b49e525c-6dfc-4cf4-9aae-b22485341c67@broadcom.com>
On 03.02.2026 12:45, Arend van Spriel wrote:
> On 03/02/2026 11:21, Marek Szyprowski wrote:
>> When probe of the sdio brcmfmac device fails for some reasons (i.e.
>> missing firmware), the sdiodev->bus is set to error instead of NULL,
>> thus
>> the cleanup later in brcmf_sdio_remove() tries to free resources via
>> invalid bus pointer. This happens because sdiodev->bus is set 2 times:
>> first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix
>> this by chaning the brcmf_sdio_probe() function to return the error code
>> and set sdio->bus only there.
>
> Looks much better, but wanted to see what was done in the commit
> referenced in the Fixes: tag.
>
>> Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable
>> support")
>
That was the commit which introduced this regression,
earlierbrcmf_sdio_probe() returned NULL in case of error and the check
for sdio->bus was fine.
> So that patch wanted to propagate the result of
> devm_clk_get_optional_enabled() call in brcmf_of_probe():of.c to retry
> later. It ends up in brcmf_sdio_probe_attach() which is called in
> brcmf_sdio_probe(). Anyway, it seems okay to me. Will give it a spin
> in my setup just to be sure.
>
Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland
^ permalink raw reply
* pull-request: iwlwifi-fixes-2026-02-03
From: Korenblit, Miriam Rachel @ 2026-02-03 13:10 UTC (permalink / raw)
To: Linux Wireless
The following changes since commit 1cac38910ecb881b09f61f57545a771bbe57ba68:
Merge tag 'net-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-01-29 10:21:52 -0800)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git/ tags/iwlwifi-fixes-2026-02-03
for you to fetch changes up to fb7f54aa2a99b07945911152c5d3d4a6eb39f797:
wifi: iwlwifi: mvm: pause TCM on fast resume (2026-02-03 15:02:05 +0200)
----------------------------------------------------------------
iwlwifi fixes
- Cancel mlo_scan_work on disassoc
- Pause TCM work on suspend
----------------------------------------------------------------
Miri Korenblit (2):
wifi: iwlwifi: mld: cancel mlo_scan_start_wk
wifi: iwlwifi: mvm: pause TCM on fast resume
drivers/net/wireless/intel/iwlwifi/mld/iface.c | 2 --
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 ++
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 6 +++++-
3 files changed, 7 insertions(+), 3 deletions(-)
^ permalink raw reply
* Re: [PATCH v2] wifi: brcmfmac: Fix potential kernel oops when probe fails
From: Arend van Spriel @ 2026-02-03 11:45 UTC (permalink / raw)
To: Marek Szyprowski, linux-wireless, brcm80211,
brcm80211-dev-list.pdl
In-Reply-To: <20260203102133.1478331-1-m.szyprowski@samsung.com>
On 03/02/2026 11:21, Marek Szyprowski wrote:
> When probe of the sdio brcmfmac device fails for some reasons (i.e.
> missing firmware), the sdiodev->bus is set to error instead of NULL, thus
> the cleanup later in brcmf_sdio_remove() tries to free resources via
> invalid bus pointer. This happens because sdiodev->bus is set 2 times:
> first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix
> this by chaning the brcmf_sdio_probe() function to return the error code
> and set sdio->bus only there.
Looks much better, but wanted to see what was done in the commit
referenced in the Fixes: tag.
> Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable support")
So that patch wanted to propagate the result of
devm_clk_get_optional_enabled() call in brcmf_of_probe():of.c to retry
later. It ends up in brcmf_sdio_probe_attach() which is called in
brcmf_sdio_probe(). Anyway, it seems okay to me. Will give it a spin in
my setup just to be sure.
Thanks,
Arend
^ permalink raw reply
* Re: [PATCH 00/13] Ranging support enhancements
From: Lachlan Hodges @ 2026-02-03 11:40 UTC (permalink / raw)
To: Peddolla Harshavardhan Reddy; +Cc: johannes, linux-wireless
In-Reply-To: <20260130160039.2823409-1-peddolla.reddy@oss.qualcomm.com>
Hi,
> Peddolla Harshavardhan Reddy (12):
> wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
> request
> wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
> wifi: nl80211/cfg80211: add continuous ranging and PD request support
> wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
> wifi: nl80211/cfg80211: add peer measurement abort command
> wifi: nl80211/cfg80211: add role-based PD peer limits
> wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
> wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
> wifi: nl80211/cfg80211: add FTM range report negotiation support
> wifi: nl80211/cfg80211: add result reporting control for PD requests
> wifi: nl80211/cfg80211: add MAC randomization support for PD requests
> wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging
Could you not just have "wifi: cfg80211: ..." for each commit? I think
having both nl80211 and cfg80211 just adds unnecessary noise when
ultimately this is all within cfg80211.
lachlan
^ permalink raw reply
* [PATCH v2] wifi: brcmfmac: Fix potential kernel oops when probe fails
From: Marek Szyprowski @ 2026-02-03 10:21 UTC (permalink / raw)
To: linux-wireless, brcm80211, brcm80211-dev-list.pdl
Cc: Marek Szyprowski, Arend van Spriel
In-Reply-To: <CGME20260203102148eucas1p10c43be72827d74e5be41fe40a84fbd59@eucas1p1.samsung.com>
When probe of the sdio brcmfmac device fails for some reasons (i.e.
missing firmware), the sdiodev->bus is set to error instead of NULL, thus
the cleanup later in brcmf_sdio_remove() tries to free resources via
invalid bus pointer. This happens because sdiodev->bus is set 2 times:
first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix
this by chaning the brcmf_sdio_probe() function to return the error code
and set sdio->bus only there.
Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable support")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
---
Changelog:
v2:
- changed return type of brcmf_sdio_probe() function
v1: https://lore.kernel.org/all/20251231143544.4158840-1-m.szyprowski@samsung.com
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 +++----
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 2 +-
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index 6a3f187320fc..13952dfeb3e3 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -951,11 +951,10 @@ int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
goto out;
/* try to attach to the target device */
- sdiodev->bus = brcmf_sdio_probe(sdiodev);
- if (IS_ERR(sdiodev->bus)) {
- ret = PTR_ERR(sdiodev->bus);
+ ret = brcmf_sdio_probe(sdiodev);
+ if (ret)
goto out;
- }
+
brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
out:
if (ret)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 8cf9d7e7c3f7..4e6ed02c1591 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4445,7 +4445,7 @@ brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
return fwreq;
}
-struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
{
int ret;
struct brcmf_sdio *bus;
@@ -4551,11 +4551,12 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
goto fail;
}
- return bus;
+ return 0;
fail:
brcmf_sdio_remove(bus);
- return ERR_PTR(ret);
+ sdiodev->bus = NULL;
+ return ret;
}
/* Detach and free everything */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
index 0d18ed15b403..80180d5c6c87 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
@@ -358,7 +358,7 @@ void brcmf_sdiod_freezer_uncount(struct brcmf_sdio_dev *sdiodev);
int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev);
int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev);
-struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
void brcmf_sdio_remove(struct brcmf_sdio *bus);
void brcmf_sdio_isr(struct brcmf_sdio *bus, bool in_isr);
--
2.34.1
^ permalink raw reply related
* [PATCH mt76] wifi: mt76: mt7996: Add eMLSR support
From: Lorenzo Bianconi @ 2026-02-03 8:32 UTC (permalink / raw)
To: Felix Fietkau, Ryder Lee, Shayne Chen, Sean Wang,
Matthias Brugger, AngeloGioacchino Del Regno
Cc: linux-wireless, linux-arm-kernel, linux-mediatek, MeiChia Chiu,
Christian Marangi, Lorenzo Bianconi
From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
Implement set_eml_op_mode mac80211 callback in order to introduce eMLSR
support.
Tested-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 9 ++++
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 16 +++++++
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 55 ++++++++++++++++++++++
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 4 ++
4 files changed, 84 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
index f44977f9093da76a9f5e2b4d7ce147de28c5b18e..b8629c0a1639b3f55d2133bdea28fa6cae552cac 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -628,6 +628,13 @@ struct sta_rec_tx_proc {
__le32 flag;
} __packed;
+struct sta_rec_eml_op {
+ __le16 tag;
+ __le16 len;
+ u8 link_bitmap;
+ u8 link_ant_num[3];
+} __packed;
+
/* wtbl_rec */
struct wtbl_req_hdr {
@@ -796,6 +803,7 @@ struct wtbl_raw {
sizeof(struct sta_rec_he_6g_capa) + \
sizeof(struct sta_rec_pn_info) + \
sizeof(struct sta_rec_tx_proc) + \
+ sizeof(struct sta_rec_eml_op) + \
sizeof(struct tlv) + \
MT76_CONNAC_WTBL_UPDATE_MAX_SIZE)
@@ -832,6 +840,7 @@ enum {
STA_REC_PN_INFO = 0x26,
STA_REC_KEY_V3 = 0x27,
STA_REC_HDRT = 0x28,
+ STA_REC_EML_OP = 0x29,
STA_REC_HDR_TRANS = 0x2B,
STA_REC_MAX_NUM
};
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 7046bf26d8ed6776ea114592f8b89c8b2a605339..48e4cd5af9293cedb9018fd9148dceac67bc4653 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -2368,6 +2368,21 @@ mt7996_reconfig_complete(struct ieee80211_hw *hw,
MT7996_WATCHDOG_TIME);
}
+static int
+mt7996_set_eml_op_mode(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct ieee80211_eml_params *eml_params)
+{
+ struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ int ret;
+
+ mutex_lock(&dev->mt76.mutex);
+ ret = mt7996_mcu_set_emlsr_mode(dev, vif, sta, eml_params);
+ mutex_unlock(&dev->mt76.mutex);
+
+ return ret;
+}
+
const struct ieee80211_ops mt7996_ops = {
.add_chanctx = mt76_add_chanctx,
.remove_chanctx = mt76_remove_chanctx,
@@ -2431,4 +2446,5 @@ const struct ieee80211_ops mt7996_ops = {
.change_vif_links = mt7996_change_vif_links,
.change_sta_links = mt7996_mac_sta_change_links,
.reconfig_complete = mt7996_reconfig_complete,
+ .set_eml_op_mode = mt7996_set_eml_op_mode,
};
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 8e1c8e1d6a99f093a2b7d7dc3a0c56f3a4bc220b..3098bddc5f6d6d33433bc653d5ef63bbe5c740fb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -1302,6 +1302,61 @@ int mt7996_mcu_set_protection(struct mt7996_phy *phy, struct mt7996_vif_link *li
MCU_WM_UNI_CMD(BSS_INFO_UPDATE), true);
}
+int mt7996_mcu_set_emlsr_mode(struct mt7996_dev *dev,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct ieee80211_eml_params *eml_params)
+{
+ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+ struct mt7996_sta_link *msta_link;
+ struct sta_rec_eml_op *eml_op;
+ struct mt7996_vif_link *link;
+ struct sk_buff *skb;
+ struct tlv *tlv;
+
+ msta_link = mt76_dereference(msta->link[eml_params->link_id],
+ &dev->mt76);
+ if (!msta_link)
+ return -EINVAL;
+
+ link = mt7996_vif_link(dev, vif, eml_params->link_id);
+ if (!link)
+ return -EINVAL;
+
+ skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76,
+ &msta_link->wcid,
+ MT7996_STA_UPDATE_MAX_SIZE);
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+ tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_EML_OP, sizeof(*eml_op));
+ eml_op = (struct sta_rec_eml_op *)tlv;
+ eml_op->link_bitmap = 0;
+
+ if (eml_params->control & IEEE80211_EML_CTRL_EMLSR_MODE) {
+ unsigned long link_bitmap = eml_params->link_bitmap;
+ unsigned int link_id;
+
+ for_each_set_bit(link_id, &link_bitmap,
+ IEEE80211_MLD_MAX_NUM_LINKS) {
+ struct mt76_phy *mphy;
+
+ link = mt7996_vif_link(dev, vif, link_id);
+ if (!link)
+ continue;
+
+ mphy = mt76_vif_link_phy(&link->mt76);
+ if (!mphy)
+ continue;
+
+ eml_op->link_bitmap |= BIT(mphy->band_idx);
+ }
+ }
+
+ return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
+}
+
int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
struct ieee80211_bss_conf *link_conf)
{
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 3ff730e36fa60830cc9ba5311643b008860cec22..c5d60c273cf8e15e3d54e2d851acbd83ce69719d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -875,6 +875,10 @@ int mt7996_mcu_wtbl_update_hdr_trans(struct mt7996_dev *dev,
struct mt7996_vif_link *link,
struct mt7996_sta_link *msta_link);
int mt7996_mcu_cp_support(struct mt7996_dev *dev, u8 mode);
+int mt7996_mcu_set_emlsr_mode(struct mt7996_dev *dev,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct ieee80211_eml_params *eml_params);
#ifdef CONFIG_MAC80211_DEBUGFS
void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
struct ieee80211_sta *sta, struct dentry *dir);
---
base-commit: 4eefc435c985f4dfdba9afb1c705f0e17377c084
change-id: 20260203-mt7996-emlsr-9cc8a684ccba
Best regards,
--
Lorenzo Bianconi <lorenzo@kernel.org>
^ permalink raw reply related
* Re: [PATCH] wifi: brcmfmac: Fix potential kernel oops when probe fails
From: Arend van Spriel @ 2026-02-03 6:24 UTC (permalink / raw)
To: Marek Szyprowski, linux-wireless, brcm80211,
brcm80211-dev-list.pdl
In-Reply-To: <19c1f9f9108.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com>
Op 2 februari 2026 19:31:17 schreef Arend van Spriel
<arend.vanspriel@broadcom.com>:
> Op 15 januari 2026 00:16:31 schreef Marek Szyprowski
> <m.szyprowski@samsung.com>:
>
>> On 14.01.2026 14:45, Arend van Spriel wrote:
>>> On 12/31/2025 3:35 PM, Marek Szyprowski wrote:
>>>> When probe of the sdio brcmfmac device fails for some reasons (i.e.
>>>> missing firmware), the sdiodev->bus is set to error instead of NULL,
>>>> thus
>>>> the cleanup later in brcmf_sdio_remove() tries to free resources via
>>>> invalid bus pointer. Fix this.
>>>
>>> Hi Marek,
>>>
>>> Thanks for the fix. Please consider my suggestion below...
>>>
>>>> Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable
>>>> support")
>>>> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
>>>> ---
>>>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
>>>> 1 file changed, 1 insertion(+)
>>>>
>>>> diff --git
>>>> a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
>>>> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
>>>> index 6a3f187320fc..6615748fa5bb 100644
>>>> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
>>>> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
>>>> @@ -954,6 +954,7 @@ int brcmf_sdiod_probe(struct brcmf_sdio_dev
>>>> *sdiodev)
>>>
>>> Maybe use a local variable bus and assign it only on success:
>>>
>>>> bus = brcmf_sdio_probe(sdiodev);
>>>> if (IS_ERR(bus)) {
>>>> ret = PTR_ERR(bus);
>>>> goto out;
>>>> }
>>>> + sdiodev->bus = bus;
>>>> brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
>> Well, that would look much better, but sdiodev->bus is also assigned
>> inside brcmf_sdio_probe() and I didn't check if this is required by the
>> functions called there or not. Maybe brcmf_sdio_probe() should simply
>> return error code to make things easier to track?
Correcting some typos here...
>>
> Sorry for the late response. Indeed the bus instance is allocated and
> assigned to sdiodev
...in brcmf_sdio_probe.
> So that is
*NOT*
> something the caller needs to repeat. So changing the return type of
> brcmf_sdio_probe() makes sense. The only thing that should be taken care of
> in the failure path of brcmf_sdio_probe() is to set sdiodev->bus to NULL
> after calling brcmf_sdio_remove().
Regards,
Arend
^ permalink raw reply
* Re: [PATCH] wifi: ath12k: fix CMA error and MHI state mismatch during resume
From: Baochen Qiang @ 2026-02-03 6:08 UTC (permalink / raw)
To: Jayasaikiran Banigallapati, Baochen Qiang, jjohnson, kvalo
Cc: linux-wireless, ath12k, linux-kernel
In-Reply-To: <aa252da5-a9fc-4c86-ae78-1de1f7c34bb2@gmail.com>
On 2/3/2026 1:51 PM, Jayasaikiran Banigallapati wrote:
>
> On 2/3/26 11:00, Baochen Qiang wrote:
>>
>> On 2/3/2026 1:02 PM, Jayasaikiran Banigallapati wrote:
>>> On 2/3/26 08:21, Baochen Qiang wrote:
>>>> On 2/2/2026 11:17 PM, Saikiran wrote:
>>>>> Commit 8d5f4da8d70b ("wifi: ath12k: support suspend/resume") introduced
>>>>> system suspend/resume support but caused a critical regression where
>>>>> CMA pages are corrupted during resume.
>>>>>
>>>>> 1. CMA page corruption:
>>>>> Calling mhi_unprepare_after_power_down() during suspend (via
>>>>> ATH12K_MHI_DEINIT) prematurely frees the fbc_image and rddm_image
>>>>> DMA buffers. When these pages are accessed during resume, the kernel
>>>>> detects corruption (Bad page state).
>>>> How, FBC image and RDDM image get re-allocated at resume, no?
>>>>
>>>> To clarify, the BUG: Bad page state crash actually occurs during the suspend phase,
>>>> specifically when ath12k_mhi_stop() calls mhi_unprepare_after_power_down().
>>>>
>>>> The stack trace shows the panic happens inside mhi_free_bhie_table() while trying to
>>>> free the pages:
>>>>
>>>> mhi_free_bhie_table+0x50/0xa0 [mhi]
>>>> mhi_unprepare_after_power_down+0x30/0x70 [mhi]
>>>> ath12k_mhi_stop+0xf8/0x210 [ath12k]
>>>> ath12k_core_suspend_late+0x94/0xc0 [ath12k]
>>>>
>>>> The kernel reports nonzero _refcount when attempting to free the CMA pages (fbc_image/
>>>> rddm_image). This suggests that something is still holding a reference to these pages
>>>> when DEINIT attempts to free them, causing the kernel to panic before we reach the
>>>> resume stage.
>> this seems like a bug either in MHI stack or in kernel DMA/MM subsystems, rather than in
>> ath12k
>>
>>>> Since the pages cannot be safely freed during suspend, skipping DEINIT (and using
>>>> MHI_POWER_OFF_KEEP_DEV) avoids this invalid free operation. This also aligns with the
>>>> existing comment in ath12k_mhi_stop which suggests using mhi_power_down_keep_dev() for
>>>> suspend.
>> first of all, this is a workaround rather than fix. Ideally we should try to root cause
>> the issue and fix it in the right way.
>
>
> The original comment in existing code:
>
>
> /* During suspend we need to use mhi_power_down_keep_dev()
> * workaround, otherwise ath12k_core_resume() will timeout
> * during resume.
> */
>
> This patch aligns the code with this existing intent. The driver was previously
>
> calling DEINIT (and freeing resources) despite the comment advising to use keep_dev.
>
> If the intention of the driver authors was to use keep_dev for suspend,
>
> then my understanding is DEINIT is incorrect here (Correct me if I am wrong)
>
> regardless of the underlying MM behavior.
keep_dev means not to destroy the mhi_device instance while going to suspend. The purpose
is to get rid of the PROBE_DEFER problem in MHI during resume. You may want to check the
upstream discussion to learn about the history.
>
>>
>> Secondly the workaround here seems problematic: you skip INIT druing resume. However note
>> several hardware registers need to be re-programmed during this stage, how could the
>> target work if its power is cutoff during suspend and the register context is not restored
>> during resume?
>
>
> In my testing, WiFi functionality was fully restored after resume.
>
> The device associates and passes traffic immediately.
I can imagine two reasons: either WLAN target's power is not cutoff during suspend, or you
did not get into the issue scenario. For the latter, I mean you may need to trigger a
firmware crash to see if RDDM works normally, since you skip RDDM register context restore
during resume.
>
> My understanding is that:
>
> ATH12K_MHI_INIT primarily handles host memory allocation (which we preserved by skipping
> DEINIT).
In addition to memory allocation, there is also register programming. See
mhi_prepare_for_power_up() and mhi_rddm_prepare().
>
> ATH12K_MHI_POWER_ON calls mhi_sync_power_up(). This function triggers the MHI state machine,
>
> which handles the necessary BHI/BHIE programming and firmware download (SBL) sequence.
>
> Since mhi_sync_power_up() is still called during resume, the target is correctly re-
> initialized and
>
> registers are programmed, even if we skip the redundant host memory allocation step (INIT).
>
> Thanks & Regards,
> Saikiran
>
^ permalink raw reply
* Re: [PATCH] wifi: ath12k: fix CMA error and MHI state mismatch during resume
From: Jayasaikiran Banigallapati @ 2026-02-03 5:51 UTC (permalink / raw)
To: Baochen Qiang, jjohnson, kvalo
Cc: quic_bqiang, linux-wireless, ath12k, linux-kernel
In-Reply-To: <eda602b5-6d6c-4ef1-b07a-53af4b226549@oss.qualcomm.com>
On 2/3/26 11:00, Baochen Qiang wrote:
>
> On 2/3/2026 1:02 PM, Jayasaikiran Banigallapati wrote:
>> On 2/3/26 08:21, Baochen Qiang wrote:
>>> On 2/2/2026 11:17 PM, Saikiran wrote:
>>>> Commit 8d5f4da8d70b ("wifi: ath12k: support suspend/resume") introduced
>>>> system suspend/resume support but caused a critical regression where
>>>> CMA pages are corrupted during resume.
>>>>
>>>> 1. CMA page corruption:
>>>> Calling mhi_unprepare_after_power_down() during suspend (via
>>>> ATH12K_MHI_DEINIT) prematurely frees the fbc_image and rddm_image
>>>> DMA buffers. When these pages are accessed during resume, the kernel
>>>> detects corruption (Bad page state).
>>> How, FBC image and RDDM image get re-allocated at resume, no?
>>>
>>> To clarify, the BUG: Bad page state crash actually occurs during the suspend phase,
>>> specifically when ath12k_mhi_stop() calls mhi_unprepare_after_power_down().
>>>
>>> The stack trace shows the panic happens inside mhi_free_bhie_table() while trying to
>>> free the pages:
>>>
>>> mhi_free_bhie_table+0x50/0xa0 [mhi]
>>> mhi_unprepare_after_power_down+0x30/0x70 [mhi]
>>> ath12k_mhi_stop+0xf8/0x210 [ath12k]
>>> ath12k_core_suspend_late+0x94/0xc0 [ath12k]
>>>
>>> The kernel reports nonzero _refcount when attempting to free the CMA pages (fbc_image/
>>> rddm_image). This suggests that something is still holding a reference to these pages
>>> when DEINIT attempts to free them, causing the kernel to panic before we reach the
>>> resume stage.
> this seems like a bug either in MHI stack or in kernel DMA/MM subsystems, rather than in
> ath12k
>
>>> Since the pages cannot be safely freed during suspend, skipping DEINIT (and using
>>> MHI_POWER_OFF_KEEP_DEV) avoids this invalid free operation. This also aligns with the
>>> existing comment in ath12k_mhi_stop which suggests using mhi_power_down_keep_dev() for
>>> suspend.
> first of all, this is a workaround rather than fix. Ideally we should try to root cause
> the issue and fix it in the right way.
The original comment in existing code:
/* During suspend we need to use mhi_power_down_keep_dev()
* workaround, otherwise ath12k_core_resume() will timeout
* during resume.
*/
This patch aligns the code with this existing intent. The driver was
previously
calling DEINIT (and freeing resources) despite the comment advising to
use keep_dev.
If the intention of the driver authors was to use keep_dev for suspend,
then my understanding is DEINIT is incorrect here (Correct me if I am
wrong)
regardless of the underlying MM behavior.
>
> Secondly the workaround here seems problematic: you skip INIT druing resume. However note
> several hardware registers need to be re-programmed during this stage, how could the
> target work if its power is cutoff during suspend and the register context is not restored
> during resume?
In my testing, WiFi functionality was fully restored after resume.
The device associates and passes traffic immediately.
My understanding is that:
ATH12K_MHI_INIT primarily handles host memory allocation (which we
preserved by skipping DEINIT).
ATH12K_MHI_POWER_ON calls mhi_sync_power_up(). This function triggers
the MHI state machine,
which handles the necessary BHI/BHIE programming and firmware download
(SBL) sequence.
Since mhi_sync_power_up() is still called during resume, the target is
correctly re-initialized and
registers are programmed, even if we skip the redundant host memory
allocation step (INIT).
Thanks & Regards,
Saikiran
^ permalink raw reply
* Re: [PATCH] wifi: ath12k: fix CMA error and MHI state mismatch during resume
From: Baochen Qiang @ 2026-02-03 5:30 UTC (permalink / raw)
To: Jayasaikiran Banigallapati, jjohnson, kvalo
Cc: quic_bqiang, linux-wireless, ath12k, linux-kernel
In-Reply-To: <399d4ea0-5f70-4678-b0d6-9a80c3399ceb@gmail.com>
On 2/3/2026 1:02 PM, Jayasaikiran Banigallapati wrote:
>
> On 2/3/26 08:21, Baochen Qiang wrote:
>>
>> On 2/2/2026 11:17 PM, Saikiran wrote:
>>> Commit 8d5f4da8d70b ("wifi: ath12k: support suspend/resume") introduced
>>> system suspend/resume support but caused a critical regression where
>>> CMA pages are corrupted during resume.
>>>
>>> 1. CMA page corruption:
>>> Calling mhi_unprepare_after_power_down() during suspend (via
>>> ATH12K_MHI_DEINIT) prematurely frees the fbc_image and rddm_image
>>> DMA buffers. When these pages are accessed during resume, the kernel
>>> detects corruption (Bad page state).
>> How, FBC image and RDDM image get re-allocated at resume, no?
>>
>> To clarify, the BUG: Bad page state crash actually occurs during the suspend phase,
>> specifically when ath12k_mhi_stop() calls mhi_unprepare_after_power_down().
>>
>> The stack trace shows the panic happens inside mhi_free_bhie_table() while trying to
>> free the pages:
>>
>> mhi_free_bhie_table+0x50/0xa0 [mhi]
>> mhi_unprepare_after_power_down+0x30/0x70 [mhi]
>> ath12k_mhi_stop+0xf8/0x210 [ath12k]
>> ath12k_core_suspend_late+0x94/0xc0 [ath12k]
>>
>> The kernel reports nonzero _refcount when attempting to free the CMA pages (fbc_image/
>> rddm_image). This suggests that something is still holding a reference to these pages
>> when DEINIT attempts to free them, causing the kernel to panic before we reach the
>> resume stage.
this seems like a bug either in MHI stack or in kernel DMA/MM subsystems, rather than in
ath12k
>>
>> Since the pages cannot be safely freed during suspend, skipping DEINIT (and using
>> MHI_POWER_OFF_KEEP_DEV) avoids this invalid free operation. This also aligns with the
>> existing comment in ath12k_mhi_stop which suggests using mhi_power_down_keep_dev() for
>> suspend.
first of all, this is a workaround rather than fix. Ideally we should try to root cause
the issue and fix it in the right way.
Secondly the workaround here seems problematic: you skip INIT druing resume. However note
several hardware registers need to be re-programmed during this stage, how could the
target work if its power is cutoff during suspend and the register context is not restored
during resume?
>>
>> Thanks & Regards,
>> Saikiran
^ permalink raw reply
* Re: [PATCH] wifi: ath12k: fix CMA error and MHI state mismatch during resume
From: Jayasaikiran Banigallapati @ 2026-02-03 5:02 UTC (permalink / raw)
To: Baochen Qiang, jjohnson, kvalo
Cc: quic_bqiang, linux-wireless, ath12k, linux-kernel
In-Reply-To: <125f0ecb-79a5-4806-aa93-aecaf937885e@oss.qualcomm.com>
On 2/3/26 08:21, Baochen Qiang wrote:
>
> On 2/2/2026 11:17 PM, Saikiran wrote:
>> Commit 8d5f4da8d70b ("wifi: ath12k: support suspend/resume") introduced
>> system suspend/resume support but caused a critical regression where
>> CMA pages are corrupted during resume.
>>
>> 1. CMA page corruption:
>> Calling mhi_unprepare_after_power_down() during suspend (via
>> ATH12K_MHI_DEINIT) prematurely frees the fbc_image and rddm_image
>> DMA buffers. When these pages are accessed during resume, the kernel
>> detects corruption (Bad page state).
> How, FBC image and RDDM image get re-allocated at resume, no?
>
> To clarify, the BUG: Bad page state crash actually occurs during the
> suspend phase, specifically when ath12k_mhi_stop() calls
> mhi_unprepare_after_power_down().
>
> The stack trace shows the panic happens inside mhi_free_bhie_table()
> while trying to free the pages:
>
> mhi_free_bhie_table+0x50/0xa0 [mhi]
> mhi_unprepare_after_power_down+0x30/0x70 [mhi]
> ath12k_mhi_stop+0xf8/0x210 [ath12k]
> ath12k_core_suspend_late+0x94/0xc0 [ath12k]
>
> The kernel reports nonzero _refcount when attempting to free the CMA
> pages (fbc_image/rddm_image). This suggests that something is still
> holding a reference to these pages when DEINIT attempts to free them,
> causing the kernel to panic before we reach the resume stage.
>
> Since the pages cannot be safely freed during suspend, skipping DEINIT
> (and using MHI_POWER_OFF_KEEP_DEV) avoids this invalid free operation.
> This also aligns with the existing comment in ath12k_mhi_stop which
> suggests using mhi_power_down_keep_dev() for suspend.
>
> Thanks & Regards,
> Saikiran
^ permalink raw reply
* [PATCH 6.12.y] wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
From: Li hongliang @ 2026-02-03 3:13 UTC (permalink / raw)
To: gregkh, stable, quic_kangyang
Cc: patches, linux-kernel, kvalo, jjohnson, quic_vthiagar,
quic_vnaralas, quic_msinada, gseset, linux-wireless, ath11k,
quic_jjohnson, jeff.johnson
From: Kang Yang <quic_kangyang@quicinc.com>
[ Upstream commit 63b7af49496d0e32f7a748b6af3361ec138b1bd3 ]
ath11k_hal_srng_* should be used with srng->lock to protect srng data.
For ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(),
they use ath11k_hal_srng_* for many times but never call srng->lock.
So when running (full) monitor mode, warning will occur:
RIP: 0010:ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k]
Call Trace:
? ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k]
ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k]
? idr_alloc_u32+0x97/0xd0
ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k]
ath11k_dp_service_srng+0x289/0x5a0 [ath11k]
ath11k_pcic_ext_grp_napi_poll+0x30/0xd0 [ath11k]
__napi_poll+0x30/0x1f0
net_rx_action+0x198/0x320
__do_softirq+0xdd/0x319
So add srng->lock for them to avoid such warnings.
Inorder to fetch the srng->lock, should change srng's definition from
'void' to 'struct hal_srng'. And initialize them elsewhere to prevent
one line of code from being too long. This is consistent with other ring
process functions, such as ath11k_dp_process_rx().
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Kang Yang <quic_kangyang@quicinc.com>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Link: https://patch.msgid.link/20241219110531.2096-3-quic_kangyang@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Li hongliang <1468888505@139.com>
---
drivers/net/wireless/ath/ath11k/dp_rx.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 9373bfe50526..ff97c2649ce5 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -5142,7 +5142,7 @@ static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
const struct ath11k_hw_hal_params *hal_params;
void *ring_entry;
- void *mon_dst_srng;
+ struct hal_srng *mon_dst_srng;
u32 ppdu_id;
u32 rx_bufs_used;
u32 ring_id;
@@ -5159,6 +5159,7 @@ static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
spin_lock_bh(&pmon->mon_lock);
+ spin_lock_bh(&mon_dst_srng->lock);
ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng);
ppdu_id = pmon->mon_ppdu_info.ppdu_id;
@@ -5217,6 +5218,7 @@ static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
mon_dst_srng);
}
ath11k_hal_srng_access_end(ar->ab, mon_dst_srng);
+ spin_unlock_bh(&mon_dst_srng->lock);
spin_unlock_bh(&pmon->mon_lock);
@@ -5606,7 +5608,7 @@ static int ath11k_dp_full_mon_process_rx(struct ath11k_base *ab, int mac_id,
struct hal_sw_mon_ring_entries *sw_mon_entries;
struct ath11k_pdev_mon_stats *rx_mon_stats;
struct sk_buff *head_msdu, *tail_msdu;
- void *mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id];
+ struct hal_srng *mon_dst_srng;
void *ring_entry;
u32 rx_bufs_used = 0, mpdu_rx_bufs_used;
int quota = 0, ret;
@@ -5622,6 +5624,9 @@ static int ath11k_dp_full_mon_process_rx(struct ath11k_base *ab, int mac_id,
goto reap_status_ring;
}
+ mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id];
+ spin_lock_bh(&mon_dst_srng->lock);
+
ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng);
while ((ring_entry = ath11k_hal_srng_dst_peek(ar->ab, mon_dst_srng))) {
head_msdu = NULL;
@@ -5665,6 +5670,7 @@ static int ath11k_dp_full_mon_process_rx(struct ath11k_base *ab, int mac_id,
}
ath11k_hal_srng_access_end(ar->ab, mon_dst_srng);
+ spin_unlock_bh(&mon_dst_srng->lock);
spin_unlock_bh(&pmon->mon_lock);
if (rx_bufs_used) {
--
2.34.1
^ permalink raw reply related
* [PATCH 6.6.y] wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
From: Li hongliang @ 2026-02-03 3:13 UTC (permalink / raw)
To: gregkh, stable, quic_kangyang
Cc: patches, linux-kernel, kvalo, jjohnson, quic_vthiagar,
quic_vnaralas, quic_msinada, gseset, linux-wireless, ath11k,
quic_jjohnson, jeff.johnson
From: Kang Yang <quic_kangyang@quicinc.com>
[ Upstream commit 63b7af49496d0e32f7a748b6af3361ec138b1bd3 ]
ath11k_hal_srng_* should be used with srng->lock to protect srng data.
For ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(),
they use ath11k_hal_srng_* for many times but never call srng->lock.
So when running (full) monitor mode, warning will occur:
RIP: 0010:ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k]
Call Trace:
? ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k]
ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k]
? idr_alloc_u32+0x97/0xd0
ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k]
ath11k_dp_service_srng+0x289/0x5a0 [ath11k]
ath11k_pcic_ext_grp_napi_poll+0x30/0xd0 [ath11k]
__napi_poll+0x30/0x1f0
net_rx_action+0x198/0x320
__do_softirq+0xdd/0x319
So add srng->lock for them to avoid such warnings.
Inorder to fetch the srng->lock, should change srng's definition from
'void' to 'struct hal_srng'. And initialize them elsewhere to prevent
one line of code from being too long. This is consistent with other ring
process functions, such as ath11k_dp_process_rx().
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Kang Yang <quic_kangyang@quicinc.com>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Link: https://patch.msgid.link/20241219110531.2096-3-quic_kangyang@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Li hongliang <1468888505@139.com>
---
drivers/net/wireless/ath/ath11k/dp_rx.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index dc54ea16c12a..ed1ea61c8142 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -5093,7 +5093,7 @@ static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
struct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;
const struct ath11k_hw_hal_params *hal_params;
void *ring_entry;
- void *mon_dst_srng;
+ struct hal_srng *mon_dst_srng;
u32 ppdu_id;
u32 rx_bufs_used;
u32 ring_id;
@@ -5117,6 +5117,7 @@ static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
spin_lock_bh(&pmon->mon_lock);
+ spin_lock_bh(&mon_dst_srng->lock);
ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng);
ppdu_id = pmon->mon_ppdu_info.ppdu_id;
@@ -5175,6 +5176,7 @@ static void ath11k_dp_rx_mon_dest_process(struct ath11k *ar, int mac_id,
mon_dst_srng);
}
ath11k_hal_srng_access_end(ar->ab, mon_dst_srng);
+ spin_unlock_bh(&mon_dst_srng->lock);
spin_unlock_bh(&pmon->mon_lock);
@@ -5564,7 +5566,7 @@ static int ath11k_dp_full_mon_process_rx(struct ath11k_base *ab, int mac_id,
struct hal_sw_mon_ring_entries *sw_mon_entries;
struct ath11k_pdev_mon_stats *rx_mon_stats;
struct sk_buff *head_msdu, *tail_msdu;
- void *mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id];
+ struct hal_srng *mon_dst_srng;
void *ring_entry;
u32 rx_bufs_used = 0, mpdu_rx_bufs_used;
int quota = 0, ret;
@@ -5580,6 +5582,9 @@ static int ath11k_dp_full_mon_process_rx(struct ath11k_base *ab, int mac_id,
goto reap_status_ring;
}
+ mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id];
+ spin_lock_bh(&mon_dst_srng->lock);
+
ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng);
while ((ring_entry = ath11k_hal_srng_dst_peek(ar->ab, mon_dst_srng))) {
head_msdu = NULL;
@@ -5623,6 +5628,7 @@ static int ath11k_dp_full_mon_process_rx(struct ath11k_base *ab, int mac_id,
}
ath11k_hal_srng_access_end(ar->ab, mon_dst_srng);
+ spin_unlock_bh(&mon_dst_srng->lock);
spin_unlock_bh(&pmon->mon_lock);
if (rx_bufs_used) {
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] wifi: ath12k: fix CMA error and MHI state mismatch during resume
From: Baochen Qiang @ 2026-02-03 2:51 UTC (permalink / raw)
To: Saikiran, jjohnson, kvalo
Cc: quic_bqiang, linux-wireless, ath12k, linux-kernel
In-Reply-To: <20260202151720.49904-1-bjsaikiran@gmail.com>
On 2/2/2026 11:17 PM, Saikiran wrote:
> Commit 8d5f4da8d70b ("wifi: ath12k: support suspend/resume") introduced
> system suspend/resume support but caused a critical regression where
> CMA pages are corrupted during resume.
>
> 1. CMA page corruption:
> Calling mhi_unprepare_after_power_down() during suspend (via
> ATH12K_MHI_DEINIT) prematurely frees the fbc_image and rddm_image
> DMA buffers. When these pages are accessed during resume, the kernel
> detects corruption (Bad page state).
How, FBC image and RDDM image get re-allocated at resume, no?
>
> To fix this corruption, the driver must skip ATH12K_MHI_DEINIT during
> suspend, preserving the DMA buffers. However, implementing this fix
> exposes a second issue in the state machine:
>
> 2. Resume failure due to MHI state mismatch:
> When DEINIT is skipped during suspend to protect the memory, the
> ATH12K_MHI_INIT bit remains set. On resume, ath12k_mhi_start()
> blindly attempts to set INIT again, but the state machine rejects
> the transition:
>
> ath12k_wifi7_pci ...: failed to set mhi state INIT(0) in current
> mhi state (0x1)
>
> Fix the corruption and enable the correct suspend flow by:
>
> 1. In ath12k_mhi_stop(), skipping ATH12K_MHI_DEINIT if suspending.
> This prevents the memory corruption by keeping the device context
> valid (MHI_POWER_OFF_KEEP_DEV).
>
> 2. In ath12k_mhi_start(), checking if MHI_INIT is already set.
> This accommodates the new suspend flow where the device remains
> initialized, allowing the driver to proceed directly to POWER_ON.
>
> Tested with suspend/resume cycles on Qualcomm Snapdragon X Elite
> (SC8380XP) with WCN7850 WiFi. No CMA corruption observed, WiFi resumes
> successfully, and deep sleep works correctly.
>
> Fixes: 8d5f4da8d70b ("wifi: ath12k: support suspend/resume")
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302 (Lenovo Yoga Slim 7x)
> Signed-off-by: Saikiran <bjsaikiran@gmail.com>
> ---
> drivers/net/wireless/ath/ath12k/mhi.c | 24 +++++++++++++++++-------
> 1 file changed, 17 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath12k/mhi.c b/drivers/net/wireless/ath/ath12k/mhi.c
> index 45c0f66dcc5e..1a0b3bcc6bbf 100644
> --- a/drivers/net/wireless/ath/ath12k/mhi.c
> +++ b/drivers/net/wireless/ath/ath12k/mhi.c
> @@ -485,9 +485,14 @@ int ath12k_mhi_start(struct ath12k_pci *ab_pci)
>
> ab_pci->mhi_ctrl->timeout_ms = MHI_TIMEOUT_DEFAULT_MS;
>
> - ret = ath12k_mhi_set_state(ab_pci, ATH12K_MHI_INIT);
> - if (ret)
> - goto out;
> + /* In case of suspend/resume, MHI INIT is already done.
> + * So check if MHI INIT is set or not.
> + */
> + if (!test_bit(ATH12K_MHI_INIT, &ab_pci->mhi_state)) {
> + ret = ath12k_mhi_set_state(ab_pci, ATH12K_MHI_INIT);
> + if (ret)
> + goto out;
> + }
>
> ret = ath12k_mhi_set_state(ab_pci, ATH12K_MHI_POWER_ON);
> if (ret)
> @@ -501,16 +506,21 @@ int ath12k_mhi_start(struct ath12k_pci *ab_pci)
>
> void ath12k_mhi_stop(struct ath12k_pci *ab_pci, bool is_suspend)
> {
> - /* During suspend we need to use mhi_power_down_keep_dev()
> - * workaround, otherwise ath12k_core_resume() will timeout
> - * during resume.
> + /* During suspend, we need to use mhi_power_down_keep_dev()
> + * and avoid calling MHI_DEINIT. The deinit frees BHIE tables
> + * which causes memory corruption when those pages are
> + * accessed/freed again during resume. We want to keep the
> + * device prepared for resume, otherwise ath12k_core_resume()
> + * will timeout.
> */
> if (is_suspend)
> ath12k_mhi_set_state(ab_pci, ATH12K_MHI_POWER_OFF_KEEP_DEV);
> else
> ath12k_mhi_set_state(ab_pci, ATH12K_MHI_POWER_OFF);
>
> - ath12k_mhi_set_state(ab_pci, ATH12K_MHI_DEINIT);
> + /* Only deinit when doing full power down, not during suspend */
> + if (!is_suspend)
> + ath12k_mhi_set_state(ab_pci, ATH12K_MHI_DEINIT);
> }
>
> void ath12k_mhi_suspend(struct ath12k_pci *ab_pci)
^ permalink raw reply
* Re: [PATCH net-next] net: remove unnecessary module_init/exit functions
From: patchwork-bot+netdevbpf @ 2026-02-03 1:50 UTC (permalink / raw)
To: Ethan Nelson-Moore
Cc: netdev, linux-can, linux-wireless, m.grzeschik, andrew+netdev,
davem, edumazet, kuba, pabeni, mkl, mailhol, idosch, petrm,
sridhar.samudrala, toke, pkshih, tmuehlbacher, socketcan
In-Reply-To: <20260131004327.18112-1-enelsonmoore@gmail.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 30 Jan 2026 16:42:56 -0800 you wrote:
> Many network drivers have unnecessary empty module_init and module_exit
> functions. Remove them (including some that just print a message). Note
> that if a module_init function exists, a module_exit function must also
> exist; otherwise, the module cannot be unloaded.
>
> Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
>
> [...]
Here is the summary with links:
- [net-next] net: remove unnecessary module_init/exit functions
https://git.kernel.org/netdev/net-next/c/e0221553436b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox