* Re: New warning `ath10k_pci 0000:3a:00.0: not found station for peer stats`
From: Paul Menzel @ 2026-02-07 5:55 UTC (permalink / raw)
To: Jeff Johnson; +Cc: linux-wireless, ath10k, Baochen Qiang
In-Reply-To: <57671b89-ec9f-4e6c-992c-45eb8e75929c@molgen.mpg.de>
[Cc: +Baochen]
Dear Linux folks,
Am 19.01.26 um 17:41 schrieb Paul Menzel:
> Since January 10th, I have started seeing the warning below in my Linux
> logs, that reach back to September 24th, 2025:
>
> [ 37.108902] ath10k_pci 0000:3a:00.0: not found station for peer stats
> [ 37.108906] ath10k_pci 0000:3a:00.0: failed to parse stats info tlv: -22
>
> It started appearing with 6.19.0-rc4-00282-gb6151c4e60e5, the version
> running before is 6.19.0-rc4-00003-g3609fa95fb0f, but I do not see
> anything related in the commit list:
>
> git log --oneline 3609fa95fb0f...b6151c4e60e5
>
> The warning log from `drivers/net/wireless/ath/ath10k/wmi-tlv.c` has
> also been there since 2021.
>
> Do you have an idea? Please find the output of `dmesg` attached.
Looking through the commit list from above again, commit a203dbeeca15
(wifi: mac80211: collect station statistics earlier when disconnect)
probably introduced the new behavior.
Kind regards,
Paul
^ permalink raw reply
* [PATCH] wifi: mac80211: skip BSS_CHANGED_TXPOWER notification for monitor mode
From: Dhyan K Prajapati @ 2026-02-07 5:00 UTC (permalink / raw)
To: Johannes Berg
Cc: linux-wireless, linux-kernel, Dhyan K Prajapati,
Dhyan K Prajapati
From: Dhyan K Prajapati <dhyaan19022009@gmail.com>
Monitor mode interfaces don't maintain BSS context. The BSS_CHANGED_TXPOWER notification
indicates transmit power constrains recieved from an associated access point which isn't really
applicable to monitor mode as it does not associate with any BSS
after a commit back in july 2025,("wifi: mac80211: fix WARN_ON for monitor mode
on some devices") monitor interfaces with WANT_MONITOR_VIF began recieving link
change notifications during ieee_add_virtual_monitor(), when ieee_link_use_channel()
assigns a channel context it triggers ieee_recalc_power() which sends BSS_CHANGED_TXPOWER
notifications to driver, driver using legacy bss_info_changed callbeack recieve
link->conf as the bss_conf parameter for monitor mode that points to vif.bss_conf which is not fully initialised
in monitor interfaces, so drivers like iwldvm dereference null and crash
since BSS_CHANGED_TXPOWER notifications are meaningless for monitor mode, we can skip
the notification entirely,monitor mode transmit power remains configurable via
nl80211
Hardware: Dell Latitude E6430
Device: Intel Centrino Advanced-N 6205 [Taylor Peak]
Crash trace:
BUG: kernel NULL pointer dereference at 0000000000000000
RIP: iwlagn_bss_info_changed+0x19d/0x640 [iwldvm]
Call Trace:
drv_link_info_changed+0x2b5/0x2c0
ieee80211_link_info_change_notify+0x13d/0x160
__ieee80211_recalc_txpower+0x44/0xd0
ieee80211_recalc_txpower+0x5c/0x60
ieee80211_assign_link_chanctx+0x182/0x410
ieee80211_link_use_channel+0x413/0x450
ieee80211_add_virtual_monitor+0x17c/0x2b0
Tested-by: Dhyan K Prajapati <dhyan19022009@gmail.com>
Signed-off-by: Dhyan K Prajapati <dhyan19022009@gmail.com>
---
net/mac80211/iface.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 515384ca2..2d5b4cc60 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -76,10 +76,16 @@ bool __ieee80211_recalc_txpower(struct ieee80211_link_data *link)
void ieee80211_recalc_txpower(struct ieee80211_link_data *link,
bool update_bss)
{
+ struct ieee80211_sub_if_data *sdata = link->sdata;
+
if (__ieee80211_recalc_txpower(link) ||
- (update_bss && ieee80211_sdata_running(link->sdata)))
+ (update_bss && ieee80211_sdata_running(link->sdata))) {
+ if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+ return;
+
ieee80211_link_info_change_notify(link->sdata, link,
BSS_CHANGED_TXPOWER);
+ }
}
static u32 __ieee80211_idle_off(struct ieee80211_local *local)
--
2.43.0
^ permalink raw reply related
* [PATCH] wifi: libertas: fix use-after-free in lbs_free_adapter()
From: Daniel Hodges @ 2026-02-06 19:53 UTC (permalink / raw)
To: linux-wireless
Cc: libertas-dev, linux-kernel, stable, Daniel Drake, Dan Williams,
Daniel Hodges
The lbs_free_adapter() function uses timer_delete() (non-synchronous)
for both command_timer and tx_lockup_timer before the structure is
freed. This is incorrect because timer_delete() does not wait for
any running timer callback to complete.
If a timer callback is executing when lbs_free_adapter() is called,
the callback will access freed memory since lbs_cfg_free() frees the
containing structure immediately after lbs_free_adapter() returns.
Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)
access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,
which would all be use-after-free violations.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
This bug was introduced in commit 8f641d93c38a ("libertas: detect TX
lockups and reset hardware") where del_timer() was used instead of
del_timer_sync() in the cleanup path. The command_timer has had the
same issue since the driver was first written.
Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware")
Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
drivers/net/wireless/marvell/libertas/main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
index d44e02c6fe38..dd97f1b61f4d 100644
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -799,8 +799,8 @@ static void lbs_free_adapter(struct lbs_private *priv)
{
lbs_free_cmd_buffer(priv);
kfifo_free(&priv->event_fifo);
- timer_delete(&priv->command_timer);
- timer_delete(&priv->tx_lockup_timer);
+ timer_delete_sync(&priv->command_timer);
+ timer_delete_sync(&priv->tx_lockup_timer);
}
static const struct net_device_ops lbs_netdev_ops = {
--
2.52.0
^ permalink raw reply related
* [PATCH] wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
From: Daniel Hodges @ 2026-02-06 19:44 UTC (permalink / raw)
To: Brian Norris, linux-wireless
Cc: Francesco Dolcini, Johannes Berg, Kalle Valo, linux-kernel,
stable, Daniel Hodges
The mwifiex_adapter_cleanup() function uses timer_delete()
(non-synchronous) for the wakeup_timer before the adapter structure is
freed. This is incorrect because timer_delete() does not wait for any
running timer callback to complete.
If the wakeup_timer callback (wakeup_timer_fn) is executing when
mwifiex_adapter_cleanup() is called, the callback will continue to
access adapter fields (adapter->hw_status, adapter->if_ops.card_reset,
etc.) which may be freed by mwifiex_free_adapter() called later in the
mwifiex_remove_card() path.
Use timer_delete_sync() instead to ensure any running timer callback has
completed before returning.
Fixes: 4636187da60b ("mwifiex: add wakeup timer based recovery mechanism")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
drivers/net/wireless/marvell/mwifiex/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/init.c b/drivers/net/wireless/marvell/mwifiex/init.c
index 4820010a86f6..5902e2c821f2 100644
--- a/drivers/net/wireless/marvell/mwifiex/init.c
+++ b/drivers/net/wireless/marvell/mwifiex/init.c
@@ -391,7 +391,7 @@ static void mwifiex_invalidate_lists(struct mwifiex_adapter *adapter)
static void
mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
{
- timer_delete(&adapter->wakeup_timer);
+ timer_delete_sync(&adapter->wakeup_timer);
cancel_delayed_work_sync(&adapter->devdump_work);
mwifiex_cancel_all_pending_cmd(adapter);
wake_up_interruptible(&adapter->cmd_wait_q.wait);
--
2.52.0
^ permalink raw reply related
* [PATCH] wifi: ath6kl: fix use-after-free in aggr_reset_state()
From: Daniel Hodges @ 2026-02-06 18:52 UTC (permalink / raw)
To: linux-wireless
Cc: tglx, mingo, joe, vthiagar, rmani, jouni, kvalo, linux-kernel,
stable, Daniel Hodges
The aggr_reset_state() function uses timer_delete() (non-synchronous)
for the aggregation timer before proceeding to delete TID state and
before the structure is freed by callers like aggr_module_destroy().
If the timer callback (aggr_timeout) is executing when aggr_reset_state()
is called, the callback will continue to access aggr_conn fields like
rx_tid[] and stat[] which may be freed immediately after by
kfree(aggr_info->aggr_conn) in aggr_module_destroy().
Additionally, the timer callback can re-arm itself via mod_timer() while
aggr_reset_state() is running, creating a more complex race condition.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
drivers/net/wireless/ath/ath6kl/txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index c3b06b515c4f..25ff5dec221c 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -1828,7 +1828,7 @@ void aggr_reset_state(struct aggr_info_conn *aggr_conn)
return;
if (aggr_conn->timer_scheduled) {
- timer_delete(&aggr_conn->timer);
+ timer_delete_sync(&aggr_conn->timer);
aggr_conn->timer_scheduled = false;
}
--
2.52.0
^ permalink raw reply related
* [PATCH] wireless: intel/ipw2200: switch printk(KERN_*) to pr_*()
From: Oleksandr Veselov @ 2026-02-06 18:50 UTC (permalink / raw)
To: Stanislav Yakovlev; +Cc: linux-wireless, linux-kernel, Oleksandr Veselov
Signed-off-by: Oleksandr Veselov <ltwod205@gmail.com>
---
drivers/net/wireless/intel/ipw2x00/ipw2200.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.h b/drivers/net/wireless/intel/ipw2x00/ipw2200.h
index 19310fd0d8eb..7f661c3272e7 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.h
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.h
@@ -1377,12 +1377,12 @@ BIT_ARG16(x)
#define IPW_DEBUG(level, fmt, args...) \
do { if (ipw_debug_level & (level)) \
- printk(KERN_DEBUG DRV_NAME": %s " fmt, __func__ , ## args); } while (0)
+ pr_debug(DRV_NAME": %s " fmt, __func__ , ## args); } while (0)
#ifdef CONFIG_IPW2200_DEBUG
#define IPW_LL_DEBUG(level, fmt, args...) \
do { if (ipw_debug_level & (level)) \
- printk(KERN_DEBUG DRV_NAME": %s " fmt, __func__ , ## args); } while (0)
+ pr_debug(DRV_NAME": %s " fmt, __func__ , ## args); } while (0)
#else
#define IPW_LL_DEBUG(level, fmt, args...) do {} while (0)
#endif /* CONFIG_IPW2200_DEBUG */
@@ -1448,8 +1448,8 @@ do { if (ipw_debug_level & (level)) \
#define IPW_DL_MERGE (1<<30)
#define IPW_DL_QOS (1<<31)
-#define IPW_ERROR(f, a...) printk(KERN_ERR DRV_NAME ": " f, ## a)
-#define IPW_WARNING(f, a...) printk(KERN_WARNING DRV_NAME ": " f, ## a)
+#define IPW_ERROR(f, a...) pr_err(DRV_NAME ": " f, ## a)
+#define IPW_WARNING(f, a...) pr_warn(DRV_NAME ": " f, ## a)
#define IPW_DEBUG_INFO(f, a...) IPW_DEBUG(IPW_DL_INFO, f, ## a)
#define IPW_DEBUG_WX(f, a...) IPW_DEBUG(IPW_DL_WX, f, ## a)
--
2.52.0
^ permalink raw reply related
* [PATCH rtw-next] wifi: rtw89: Turbo mode for RTL8851BU/RTL8852BU
From: Bitterblue Smith @ 2026-02-06 18:01 UTC (permalink / raw)
To: linux-wireless@vger.kernel.org; +Cc: Ping-Ke Shih
RTL8851BU and RTL8852BU currently have much lower TX speed than
expected, ~100 and ~300 Mbps, respectively. This is because part of the
chip's memory is allocated for some unknown firmware features instead of
the TX buffers.
The vendor drivers have a module parameter called "rtw_quota_turbo_en",
which can be used to choose between full TX speed or the unknown
firmware features. It is on by default.
Change the relevant chip parameters to implement the turbo mode. Do it
only for USB because PCI is already fast even without the turbo mode.
It's unclear if SDIO will need it or not.
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
---
What firmware features are we missing when we use the turbo mode?
Is it anything important?
---
drivers/net/wireless/realtek/rtw89/mac.c | 31 +++++++++---------
drivers/net/wireless/realtek/rtw89/mac.h | 16 +++++-----
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 32 +++++++++----------
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 24 +++++++-------
4 files changed, 51 insertions(+), 52 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 8472f1a63951..c98ca2a82194 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -1729,8 +1729,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
/* 8852C PCIE SCC */
.wde_size19 = {RTW89_WDE_PG_64, 3328, 0,},
.wde_size23 = {RTW89_WDE_PG_64, 1022, 2,},
- /* 8852B USB2.0/USB3.0 SCC */
- .wde_size25 = {RTW89_WDE_PG_64, 162, 94,},
+ /* 8852B USB2.0/USB3.0 SCC turbo */
+ .wde_size30 = {RTW89_WDE_PG_64, 220, 36,},
/* 8852C USB2.0 */
.wde_size31 = {RTW89_WDE_PG_64, 384, 0,},
/* PCIE */
@@ -1754,10 +1754,10 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.ple_size19 = {RTW89_PLE_PG_128, 1904, 16,},
.ple_size20_v1 = {RTW89_PLE_PG_128, 2554, 182, 40960,},
.ple_size22_v1 = {RTW89_PLE_PG_128, 2736, 0, 40960,},
- /* 8852B USB2.0 SCC */
- .ple_size32 = {RTW89_PLE_PG_128, 620, 20,},
- /* 8852B USB3.0 SCC */
- .ple_size33 = {RTW89_PLE_PG_128, 632, 8,},
+ /* 8851B USB2.0 SCC turbo */
+ .ple_size27 = {RTW89_PLE_PG_128, 1396, 12,},
+ /* 8852B USB3.0 SCC turbo */
+ .ple_size31 = {RTW89_PLE_PG_128, 1392, 16,},
/* 8852C USB2.0 */
.ple_size34 = {RTW89_PLE_PG_128, 3374, 18,},
/* PCIE 64 */
@@ -1780,8 +1780,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.wde_qt18 = {3228, 60, 0, 40,},
.wde_qt19_v1 = {613, 6, 0, 20,},
.wde_qt23 = {958, 48, 0, 16,},
- /* 8852B USB2.0/USB3.0 SCC */
- .wde_qt25 = {152, 2, 0, 8,},
+ /* 8852B USB2.0/USB3.0 SCC turbo */
+ .wde_qt30 = {210, 2, 0, 8,},
/* 8852C USB2.0 */
.wde_qt31 = {338, 6, 0, 40,},
.ple_qt0 = {320, 320, 32, 16, 13, 13, 292, 292, 64, 18, 1, 4, 0,},
@@ -1799,6 +1799,9 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
/* 8852A USB SCC */
.ple_qt25 = {1536, 0, 16, 48, 13, 13, 360, 0, 32, 40, 8, 0,},
.ple_qt26 = {2654, 0, 1134, 48, 64, 13, 1478, 0, 64, 128, 120, 0,},
+ /* 8852B USB3.0 SCC turbo */
+ .ple_qt27 = {1040, 0, 16, 48, 13, 13, 178, 0, 32, 14, 8, 0,},
+ .ple_qt28 = {1040, 0, 32, 48, 43, 13, 208, 0, 62, 14, 24, 0,},
/* USB 52C USB3.0 */
.ple_qt42 = {1068, 0, 16, 48, 4, 13, 178, 0, 16, 1, 8, 16, 0,},
.ple_qt42_v2 = {91, 91, 32, 16, 19, 13, 91, 91, 44, 18, 1, 4, 0, 0,},
@@ -1817,13 +1820,9 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
/* PCIE 64 */
.ple_qt58 = {147, 0, 16, 20, 157, 13, 229, 0, 172, 14, 24, 0,},
.ple_qt59 = {147, 0, 32, 20, 1860, 13, 2025, 0, 1879, 14, 24, 0,},
- /* USB2.0 52B SCC */
- .ple_qt72 = {130, 0, 16, 48, 4, 13, 322, 0, 32, 14, 8, 0, 0,},
- /* USB2.0 52B 92K */
- .ple_qt73 = {130, 0, 32, 48, 37, 13, 355, 0, 65, 14, 24, 0, 0,},
- /* USB3.0 52B 92K */
- .ple_qt74 = {286, 0, 16, 48, 4, 13, 178, 0, 32, 14, 8, 0, 0,},
- .ple_qt75 = {286, 0, 32, 48, 37, 13, 211, 0, 65, 14, 24, 0, 0,},
+ /* 8851B USB2.0 SCC turbo */
+ .ple_qt61 = {858, 0, 16, 48, 4, 13, 370, 0, 32, 14, 8, 0, 0,},
+ .ple_qt62 = {858, 0, 32, 48, 37, 13, 403, 0, 65, 14, 24, 0, 0,},
/* USB2.0 52C */
.ple_qt78 = {1560, 0, 16, 48, 13, 13, 390, 0, 32, 38, 8, 16, 0,},
/* USB2.0 52C */
@@ -2004,7 +2003,7 @@ static u32 dle_expected_used_size(struct rtw89_dev *rtwdev,
{
u32 size = rtwdev->chip->fifo_size;
- if (mode == RTW89_QTA_SCC)
+ if (mode == RTW89_QTA_SCC && rtwdev->hci.type != RTW89_HCI_TYPE_USB)
size -= rtwdev->chip->dle_scc_rsvd_size;
return size;
diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
index e71a71648ab8..e6b715b95409 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.h
+++ b/drivers/net/wireless/realtek/rtw89/mac.h
@@ -938,7 +938,7 @@ struct rtw89_mac_size_set {
const struct rtw89_dle_size wde_size18_v1;
const struct rtw89_dle_size wde_size19;
const struct rtw89_dle_size wde_size23;
- const struct rtw89_dle_size wde_size25;
+ const struct rtw89_dle_size wde_size30;
const struct rtw89_dle_size wde_size31;
const struct rtw89_dle_size ple_size0;
const struct rtw89_dle_size ple_size1;
@@ -953,8 +953,8 @@ struct rtw89_mac_size_set {
const struct rtw89_dle_size ple_size19;
const struct rtw89_dle_size ple_size20_v1;
const struct rtw89_dle_size ple_size22_v1;
- const struct rtw89_dle_size ple_size32;
- const struct rtw89_dle_size ple_size33;
+ const struct rtw89_dle_size ple_size27;
+ const struct rtw89_dle_size ple_size31;
const struct rtw89_dle_size ple_size34;
const struct rtw89_wde_quota wde_qt0;
const struct rtw89_wde_quota wde_qt1;
@@ -968,7 +968,7 @@ struct rtw89_mac_size_set {
const struct rtw89_wde_quota wde_qt18;
const struct rtw89_wde_quota wde_qt19_v1;
const struct rtw89_wde_quota wde_qt23;
- const struct rtw89_wde_quota wde_qt25;
+ const struct rtw89_wde_quota wde_qt30;
const struct rtw89_wde_quota wde_qt31;
const struct rtw89_ple_quota ple_qt0;
const struct rtw89_ple_quota ple_qt1;
@@ -980,6 +980,8 @@ struct rtw89_mac_size_set {
const struct rtw89_ple_quota ple_qt18;
const struct rtw89_ple_quota ple_qt25;
const struct rtw89_ple_quota ple_qt26;
+ const struct rtw89_ple_quota ple_qt27;
+ const struct rtw89_ple_quota ple_qt28;
const struct rtw89_ple_quota ple_qt42;
const struct rtw89_ple_quota ple_qt42_v2;
const struct rtw89_ple_quota ple_qt43;
@@ -991,10 +993,8 @@ struct rtw89_mac_size_set {
const struct rtw89_ple_quota ple_qt57;
const struct rtw89_ple_quota ple_qt58;
const struct rtw89_ple_quota ple_qt59;
- const struct rtw89_ple_quota ple_qt72;
- const struct rtw89_ple_quota ple_qt73;
- const struct rtw89_ple_quota ple_qt74;
- const struct rtw89_ple_quota ple_qt75;
+ const struct rtw89_ple_quota ple_qt61;
+ const struct rtw89_ple_quota ple_qt62;
const struct rtw89_ple_quota ple_qt78;
const struct rtw89_ple_quota ple_qt79;
const struct rtw89_ple_quota ple_qt_52a_wow;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b.c b/drivers/net/wireless/realtek/rtw89/rtw8851b.c
index d6deb44a685b..b63c0e785209 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b.c
@@ -52,25 +52,25 @@ static const struct rtw89_hfc_param_ini rtw8851b_hfc_param_ini_pcie[] = {
};
static const struct rtw89_hfc_ch_cfg rtw8851b_hfc_chcfg_usb[] = {
- {18, 152, grp_0}, /* ACH 0 */
- {18, 152, grp_0}, /* ACH 1 */
- {18, 152, grp_0}, /* ACH 2 */
- {18, 152, grp_0}, /* ACH 3 */
+ {18, 210, grp_0}, /* ACH 0 */
+ {18, 210, grp_0}, /* ACH 1 */
+ {18, 210, grp_0}, /* ACH 2 */
+ {18, 210, grp_0}, /* ACH 3 */
{0, 0, grp_0}, /* ACH 4 */
{0, 0, grp_0}, /* ACH 5 */
{0, 0, grp_0}, /* ACH 6 */
{0, 0, grp_0}, /* ACH 7 */
- {18, 152, grp_0}, /* B0MGQ */
- {18, 152, grp_0}, /* B0HIQ */
+ {18, 210, grp_0}, /* B0MGQ */
+ {18, 210, grp_0}, /* B0HIQ */
{0, 0, grp_0}, /* B1MGQ */
{0, 0, grp_0}, /* B1HIQ */
{0, 0, 0} /* FWCMDQ */
};
static const struct rtw89_hfc_pub_cfg rtw8851b_hfc_pubcfg_usb = {
- 152, /* Group 0 */
+ 210, /* Group 0 */
0, /* Group 1 */
- 152, /* Public Max */
+ 210, /* Public Max */
0 /* WP threshold */
};
@@ -111,10 +111,10 @@ static const struct rtw89_dle_mem rtw8851b_dle_mem_pcie[] = {
};
static const struct rtw89_dle_mem rtw8851b_dle_mem_usb2[] = {
- [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size25,
- &rtw89_mac_size.ple_size32, &rtw89_mac_size.wde_qt25,
- &rtw89_mac_size.wde_qt25, &rtw89_mac_size.ple_qt72,
- &rtw89_mac_size.ple_qt73},
+ [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size30,
+ &rtw89_mac_size.ple_size27, &rtw89_mac_size.wde_qt30,
+ &rtw89_mac_size.wde_qt30, &rtw89_mac_size.ple_qt61,
+ &rtw89_mac_size.ple_qt62},
[RTW89_QTA_DLFW] = {RTW89_QTA_DLFW, &rtw89_mac_size.wde_size9,
&rtw89_mac_size.ple_size8, &rtw89_mac_size.wde_qt4,
&rtw89_mac_size.wde_qt4, &rtw89_mac_size.ple_qt13,
@@ -124,10 +124,10 @@ static const struct rtw89_dle_mem rtw8851b_dle_mem_usb2[] = {
};
static const struct rtw89_dle_mem rtw8851b_dle_mem_usb3[] = {
- [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size25,
- &rtw89_mac_size.ple_size33, &rtw89_mac_size.wde_qt25,
- &rtw89_mac_size.wde_qt25, &rtw89_mac_size.ple_qt74,
- &rtw89_mac_size.ple_qt75},
+ [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size30,
+ &rtw89_mac_size.ple_size31, &rtw89_mac_size.wde_qt30,
+ &rtw89_mac_size.wde_qt30, &rtw89_mac_size.ple_qt27,
+ &rtw89_mac_size.ple_qt28},
[RTW89_QTA_DLFW] = {RTW89_QTA_DLFW, &rtw89_mac_size.wde_size9,
&rtw89_mac_size.ple_size8, &rtw89_mac_size.wde_qt4,
&rtw89_mac_size.wde_qt4, &rtw89_mac_size.ple_qt13,
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b.c b/drivers/net/wireless/realtek/rtw89/rtw8852b.c
index 197e3f5fb21b..393986b297ea 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852b.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852b.c
@@ -50,25 +50,25 @@ static const struct rtw89_hfc_param_ini rtw8852b_hfc_param_ini_pcie[] = {
};
static const struct rtw89_hfc_ch_cfg rtw8852b_hfc_chcfg_usb[] = {
- {18, 152, grp_0}, /* ACH 0 */
- {18, 152, grp_0}, /* ACH 1 */
- {18, 152, grp_0}, /* ACH 2 */
- {18, 152, grp_0}, /* ACH 3 */
+ {18, 210, grp_0}, /* ACH 0 */
+ {18, 210, grp_0}, /* ACH 1 */
+ {18, 210, grp_0}, /* ACH 2 */
+ {18, 210, grp_0}, /* ACH 3 */
{0, 0, grp_0}, /* ACH 4 */
{0, 0, grp_0}, /* ACH 5 */
{0, 0, grp_0}, /* ACH 6 */
{0, 0, grp_0}, /* ACH 7 */
- {18, 152, grp_0}, /* B0MGQ */
- {18, 152, grp_0}, /* B0HIQ */
+ {18, 210, grp_0}, /* B0MGQ */
+ {18, 210, grp_0}, /* B0HIQ */
{0, 0, grp_0}, /* B1MGQ */
{0, 0, grp_0}, /* B1HIQ */
{0, 0, 0} /* FWCMDQ */
};
static const struct rtw89_hfc_pub_cfg rtw8852b_hfc_pubcfg_usb = {
- 152, /* Group 0 */
+ 210, /* Group 0 */
0, /* Group 1 */
- 152, /* Public Max */
+ 210, /* Public Max */
0 /* WP threshold */
};
@@ -109,10 +109,10 @@ static const struct rtw89_dle_mem rtw8852b_dle_mem_pcie[] = {
};
static const struct rtw89_dle_mem rtw8852b_dle_mem_usb3[] = {
- [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size25,
- &rtw89_mac_size.ple_size33, &rtw89_mac_size.wde_qt25,
- &rtw89_mac_size.wde_qt25, &rtw89_mac_size.ple_qt74,
- &rtw89_mac_size.ple_qt75},
+ [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size30,
+ &rtw89_mac_size.ple_size31, &rtw89_mac_size.wde_qt30,
+ &rtw89_mac_size.wde_qt30, &rtw89_mac_size.ple_qt27,
+ &rtw89_mac_size.ple_qt28},
[RTW89_QTA_DLFW] = {RTW89_QTA_DLFW, &rtw89_mac_size.wde_size9,
&rtw89_mac_size.ple_size8, &rtw89_mac_size.wde_qt4,
&rtw89_mac_size.wde_qt4, &rtw89_mac_size.ple_qt13,
--
2.52.0
^ permalink raw reply related
* [PATCH rtw-next] wifi: rtw88: WARN only once in rtw_phy_get_tx_power_limit()
From: Bitterblue Smith @ 2026-02-06 18:00 UTC (permalink / raw)
To: linux-wireless@vger.kernel.org; +Cc: Ping-Ke Shih
This function WARNs when the wifi band, channel number, channel width,
rate, or RF path are invalid. Two or three people have reported that it
floods the kernel log with warnings because they try to switch to
invalid channel numbers, like 130.
One warning is probably enough, so turn WARN into WARN_ONCE.
Closes: https://github.com/lwfinger/rtw88/issues/428
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
---
drivers/net/wireless/realtek/rtw88/phy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/phy.c b/drivers/net/wireless/realtek/rtw88/phy.c
index e2ac5c6fd500..2a3929561664 100644
--- a/drivers/net/wireless/realtek/rtw88/phy.c
+++ b/drivers/net/wireless/realtek/rtw88/phy.c
@@ -2210,8 +2210,8 @@ static s8 rtw_phy_get_tx_power_limit(struct rtw_dev *rtwdev, u8 band,
return power_limit;
err:
- WARN(1, "invalid arguments, band=%d, bw=%d, path=%d, rate=%d, ch=%d\n",
- band, bw, rf_path, rate, channel);
+ WARN_ONCE(1, "invalid arguments, band=%d, bw=%d, path=%d, rate=%d, ch=%d\n",
+ band, bw, rf_path, rate, channel);
return (s8)rtwdev->chip->max_power_index;
}
--
2.52.0
^ permalink raw reply related
* [PATCH v2 wireless-next 4/4] wifi: mac80211_hwsim: background CAC support
From: Janusz Dziedzic @ 2026-02-06 17:15 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260206171830.553879-1-janusz.dziedzic@gmail.com>
Report background CAC support and add allow
to cancel background CAC and simulate radar.
echo cancel > /sys/kernel/debug/ieee80211/phy2/hwsim/dfs_background_cac
echo radar > /sys/kernel/debug/ieee80211/phy2/hwsim/dfs_background_cac
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 77 +++++++++++++++++++
drivers/net/wireless/virtual/mac80211_hwsim.h | 2 +
2 files changed, 79 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 4d9f5f87e814..8b5618c2111f 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -715,6 +715,7 @@ struct mac80211_hwsim_data {
} ps;
bool ps_poll_pending;
struct dentry *debugfs;
+ struct cfg80211_chan_def radar_background_chandef;
atomic_t pending_cookie;
struct sk_buff_head pending; /* packets pending */
@@ -936,6 +937,7 @@ static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
[HWSIM_ATTR_PMSR_RESULT] = NLA_POLICY_NESTED(hwsim_pmsr_peers_result_policy),
[HWSIM_ATTR_MULTI_RADIO] = { .type = NLA_FLAG },
[HWSIM_ATTR_SUPPORT_NAN_DEVICE] = { .type = NLA_FLAG },
+ [HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR] = { .type = NLA_FLAG },
};
#if IS_REACHABLE(CONFIG_VIRTIO)
@@ -1164,6 +1166,41 @@ static int hwsim_write_simulate_radar(void *dat, u64 val)
DEFINE_DEBUGFS_ATTRIBUTE(hwsim_simulate_radar, NULL,
hwsim_write_simulate_radar, "%llu\n");
+static ssize_t hwsim_background_cac_write(struct file *file,
+ const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ struct mac80211_hwsim_data *data = file->private_data;
+ char buf[8] = {};
+
+ if (count >= sizeof(buf))
+ return -EINVAL;
+
+ if (copy_from_user(buf, user_buf, count))
+ return -EFAULT;
+
+ /* Check if background radar channel is configured */
+ if (!data->radar_background_chandef.chan)
+ return -ENOENT;
+
+ if (sysfs_streq(buf, "radar"))
+ cfg80211_background_radar_event(data->hw->wiphy,
+ &data->radar_background_chandef,
+ GFP_KERNEL);
+ else if (sysfs_streq(buf, "cancel"))
+ cfg80211_background_cac_abort(data->hw->wiphy);
+ else
+ return -EINVAL;
+
+ return count;
+}
+
+static const struct file_operations hwsim_background_cac_ops = {
+ .write = hwsim_background_cac_write,
+ .open = simple_open,
+ .llseek = default_llseek,
+};
+
static int hwsim_fops_group_read(void *dat, u64 *val)
{
struct mac80211_hwsim_data *data = dat;
@@ -4154,6 +4191,24 @@ static int mac80211_hwsim_change_nan_config(struct ieee80211_hw *hw,
return 0;
}
+static int mac80211_hwsim_set_radar_background(struct ieee80211_hw *hw,
+ struct cfg80211_chan_def *chan)
+{
+ struct mac80211_hwsim_data *data = hw->priv;
+
+ if (!wiphy_ext_feature_isset(hw->wiphy,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND))
+ return -EOPNOTSUPP;
+
+ if (chan)
+ data->radar_background_chandef = *chan;
+ else
+ memset(&data->radar_background_chandef, 0,
+ sizeof(data->radar_background_chandef));
+
+ return 0;
+}
+
#ifdef CONFIG_MAC80211_DEBUGFS
#define HWSIM_DEBUGFS_OPS \
.link_add_debugfs = mac80211_hwsim_link_add_debugfs,
@@ -4189,6 +4244,7 @@ static int mac80211_hwsim_change_nan_config(struct ieee80211_hw *hw,
.start_nan = mac80211_hwsim_start_nan, \
.stop_nan = mac80211_hwsim_stop_nan, \
.nan_change_conf = mac80211_hwsim_change_nan_config, \
+ .set_radar_background = mac80211_hwsim_set_radar_background, \
HWSIM_DEBUGFS_OPS
#define HWSIM_NON_MLO_OPS \
@@ -4255,6 +4311,7 @@ struct hwsim_new_radio_params {
bool mlo;
const struct cfg80211_pmsr_capabilities *pmsr_capa;
bool nan_device;
+ bool background_radar;
};
static void hwsim_mcast_config_msg(struct sk_buff *mcast_skb,
@@ -4340,6 +4397,12 @@ static int append_radio_msg(struct sk_buff *skb, int id,
if (ret < 0)
return ret;
}
+
+ if (param->background_radar) {
+ ret = nla_put_flag(skb, HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR);
+ if (ret < 0)
+ return ret;
+ }
return 0;
}
@@ -5794,6 +5857,9 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
wiphy_ext_feature_set(hw->wiphy,
NL80211_EXT_FEATURE_DFS_CONCURRENT);
+ if (param->background_radar)
+ wiphy_ext_feature_set(hw->wiphy,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND);
if (param->no_vif)
ieee80211_hw_set(hw, NO_AUTO_VIF);
@@ -5832,6 +5898,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
debugfs_create_file("dfs_simulate_radar", 0222,
data->debugfs,
data, &hwsim_simulate_radar);
+ if (param->background_radar)
+ debugfs_create_file("dfs_background_cac", 0200,
+ data->debugfs,
+ data, &hwsim_background_cac_ops);
if (param->pmsr_capa) {
data->pmsr_capa = *param->pmsr_capa;
@@ -5950,6 +6020,9 @@ static int mac80211_hwsim_get_radio(struct sk_buff *skb,
param.channels = data->channels;
param.hwname = wiphy_name(data->hw->wiphy);
param.pmsr_capa = &data->pmsr_capa;
+ param.background_radar =
+ wiphy_ext_feature_isset(data->hw->wiphy,
+ NL80211_EXT_FEATURE_RADAR_BACKGROUND);
res = append_radio_msg(skb, data->idx, ¶m);
if (res < 0)
@@ -6387,6 +6460,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
if (info->attrs[HWSIM_ATTR_MULTI_RADIO])
param.multi_radio = true;
+ if (info->attrs[HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR])
+ param.background_radar = true;
+
if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
param.reg_alpha2 =
nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
@@ -7165,6 +7241,7 @@ static int __init init_mac80211_hwsim(void)
param.p2p_device = support_p2p_device;
param.mlo = mlo;
param.multi_radio = multi_radio;
+ param.background_radar = true;
param.use_chanctx = channels > 1 || mlo || multi_radio;
param.iftypes = HWSIM_IFTYPE_SUPPORT_MASK;
if (param.p2p_device)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.h b/drivers/net/wireless/virtual/mac80211_hwsim.h
index c2d06cf852a5..a022cd5c0f1c 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.h
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.h
@@ -161,6 +161,7 @@ enum hwsim_commands {
* Adds one radio for each band. Number of supported channels will be set for
* each radio instead of for the wiphy.
* @HWSIM_ATTR_SUPPORT_NAN_DEVICE: support NAN Device virtual interface (flag)
+ * @HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR: background radar/CAC support (flag)
* @__HWSIM_ATTR_MAX: enum limit
*/
enum hwsim_attrs {
@@ -195,6 +196,7 @@ enum hwsim_attrs {
HWSIM_ATTR_PMSR_RESULT,
HWSIM_ATTR_MULTI_RADIO,
HWSIM_ATTR_SUPPORT_NAN_DEVICE,
+ HWSIM_ATTR_SUPPORT_BACKGROUND_RADAR,
__HWSIM_ATTR_MAX,
};
#define HWSIM_ATTR_MAX (__HWSIM_ATTR_MAX - 1)
--
2.43.0
^ permalink raw reply related
* [PATCH v2 wireless-next 3/4] wifi: cfg80211: events, report background radar
From: Janusz Dziedzic @ 2026-02-06 17:15 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260206171830.553879-1-janusz.dziedzic@gmail.com>
In case we report radar event add also information
this is connected with background one, so user mode
application like hostapd, could check it and behave
correctly.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
net/wireless/mlme.c | 6 ++++--
net/wireless/nl80211.c | 7 +++++++
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 283ea4c7c61e..5cd86253a62e 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1226,11 +1226,12 @@ void cfg80211_background_cac_done_wk(struct work_struct *work)
guard(wiphy)(&rdev->wiphy);
rdev_set_radar_background(rdev, NULL);
- rdev->background_radar_wdev = NULL;
__cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
&rdev->background_radar_chandef,
NL80211_RADAR_CAC_FINISHED);
+
+ rdev->background_radar_wdev = NULL;
}
void cfg80211_background_cac_abort_wk(struct work_struct *work)
@@ -1330,11 +1331,12 @@ void cfg80211_stop_background_radar_detection(struct wireless_dev *wdev)
return;
rdev_set_radar_background(rdev, NULL);
- rdev->background_radar_wdev = NULL; /* Release offchain ownership */
__cfg80211_background_cac_event(rdev, wdev,
&rdev->background_radar_chandef,
NL80211_RADAR_CAC_ABORTED);
+
+ rdev->background_radar_wdev = NULL;
}
int cfg80211_assoc_ml_reconf(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f9a739d1ebfb..47b7e0559c73 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -21238,6 +21238,13 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
goto nla_put_failure;
}
+ if (rdev->background_radar_wdev &&
+ cfg80211_chandef_identical(&rdev->background_radar_chandef,
+ chandef)) {
+ if (nla_put_flag(msg, NL80211_ATTR_RADAR_BACKGROUND))
+ goto nla_put_failure;
+ }
+
if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
goto nla_put_failure;
--
2.43.0
^ permalink raw reply related
* [PATCH v2 wireless-next 2/4] wifi: cfg80211: set and report chandef CAC ongoing
From: Janusz Dziedzic @ 2026-02-06 17:15 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260206171830.553879-1-janusz.dziedzic@gmail.com>
Allow to track and check CAC state from user mode by
simple check phy channels eg. using iw phy1 channels
command.
This is done for regular CAC and background CAC.
It is important for background CAC while we can start
it from any app (eg. iw or hostapd).
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
include/net/cfg80211.h | 3 +++
include/uapi/linux/nl80211.h | 6 ++++++
net/wireless/chan.c | 27 +++++++++++++++++++++++++++
net/wireless/core.h | 4 ++++
net/wireless/mlme.c | 7 +++++++
net/wireless/nl80211.c | 7 +++++++
6 files changed, 54 insertions(+)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index fc01de19c798..e00045c150e7 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -190,6 +190,8 @@ enum ieee80211_channel_flags {
* on this channel.
* @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
* @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
+ * @cac_start_time: timestamp (CLOCK_BOOTTIME, nanoseconds) when CAC was
+ * started on this channel. Zero when CAC is not in progress.
* @psd: power spectral density (in dBm)
*/
struct ieee80211_channel {
@@ -207,6 +209,7 @@ struct ieee80211_channel {
enum nl80211_dfs_state dfs_state;
unsigned long dfs_state_entered;
unsigned int dfs_cac_ms;
+ u64 cac_start_time;
s8 psd;
};
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b63f71850906..c75aa039f096 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -4480,6 +4480,10 @@ enum nl80211_wmm_rule {
* as a non-primary subchannel. Only applicable to S1G channels.
* @NL80211_FREQUENCY_ATTR_NO_UHR: UHR operation is not allowed on this channel
* in current regulatory domain.
+ * @NL80211_FREQUENCY_ATTR_CAC_START_TIME: Channel Availability Check (CAC)
+ * start time (CLOCK_BOOTTIME, nanoseconds). Only present when CAC is
+ * currently in progress on this channel.
+ * @NL80211_FREQUENCY_ATTR_PAD: attribute used for padding for 64-bit alignment
* @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
* currently defined
* @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
@@ -4530,6 +4534,8 @@ enum nl80211_frequency_attr {
NL80211_FREQUENCY_ATTR_NO_16MHZ,
NL80211_FREQUENCY_ATTR_S1G_NO_PRIMARY,
NL80211_FREQUENCY_ATTR_NO_UHR,
+ NL80211_FREQUENCY_ATTR_CAC_START_TIME,
+ NL80211_FREQUENCY_ATTR_PAD,
/* keep last */
__NL80211_FREQUENCY_ATTR_AFTER_LAST,
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 68221b1ab45e..dfe319565280 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -642,6 +642,33 @@ void cfg80211_set_dfs_state(struct wiphy *wiphy,
}
}
+void cfg80211_set_cac_state(struct wiphy *wiphy,
+ const struct cfg80211_chan_def *chandef,
+ bool cac_ongoing)
+{
+ struct ieee80211_channel *c;
+ int width;
+ u64 cac_time;
+
+ if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+ return;
+
+ width = cfg80211_chandef_get_width(chandef);
+ if (width < 0)
+ return;
+
+ /* Get the same timestamp for all subchannels */
+ cac_time = cac_ongoing ? ktime_get_boottime_ns() : 0;
+
+ for_each_subchan(chandef, freq, cf) {
+ c = ieee80211_get_channel_khz(wiphy, freq);
+ if (!c)
+ continue;
+
+ c->cac_start_time = cac_time;
+ }
+}
+
static bool
cfg80211_dfs_permissive_check_wdev(struct cfg80211_registered_device *rdev,
enum nl80211_iftype iftype,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 6ac57b7b2615..6cace846d7a3 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -481,6 +481,10 @@ void cfg80211_set_dfs_state(struct wiphy *wiphy,
const struct cfg80211_chan_def *chandef,
enum nl80211_dfs_state dfs_state);
+void cfg80211_set_cac_state(struct wiphy *wiphy,
+ const struct cfg80211_chan_def *chandef,
+ bool cac_ongoing);
+
void cfg80211_dfs_channels_update_work(struct work_struct *work);
void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 212178d04efa..283ea4c7c61e 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1162,9 +1162,11 @@ void cfg80211_cac_event(struct net_device *netdev,
fallthrough;
case NL80211_RADAR_CAC_ABORTED:
wdev->links[link_id].cac_started = false;
+ cfg80211_set_cac_state(wiphy, chandef, false);
break;
case NL80211_RADAR_CAC_STARTED:
wdev->links[link_id].cac_started = true;
+ cfg80211_set_cac_state(wiphy, chandef, true);
break;
default:
WARN_ON(1);
@@ -1192,15 +1194,18 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
switch (event) {
case NL80211_RADAR_CAC_FINISHED:
cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
+ cfg80211_set_cac_state(wiphy, chandef, false);
memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
cfg80211_sched_dfs_chan_update(rdev);
break;
case NL80211_RADAR_CAC_ABORTED:
+ cfg80211_set_cac_state(wiphy, chandef, false);
if (!cancel_delayed_work(&rdev->background_cac_done_wk))
return;
break;
case NL80211_RADAR_CAC_STARTED:
+ cfg80211_set_cac_state(wiphy, chandef, true);
break;
default:
return;
@@ -1307,6 +1312,8 @@ void cfg80211_stop_radar_detection(struct wireless_dev *wdev)
chandef = *wdev_chandef(wdev, link_id);
rdev_end_cac(rdev, wdev->netdev, link_id);
+ wdev->links[link_id].cac_started = false;
+ cfg80211_set_cac_state(wiphy, &chandef, false);
nl80211_radar_notify(rdev, &chandef, NL80211_RADAR_CAC_ABORTED,
wdev->netdev, GFP_KERNEL);
}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 6e58b238a1f8..f9a739d1ebfb 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1334,6 +1334,12 @@ static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
if ((chan->flags & IEEE80211_CHAN_NO_UHR) &&
nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_UHR))
goto nla_put_failure;
+ if (chan->cac_start_time &&
+ nla_put_u64_64bit(msg,
+ NL80211_FREQUENCY_ATTR_CAC_START_TIME,
+ chan->cac_start_time,
+ NL80211_FREQUENCY_ATTR_PAD))
+ goto nla_put_failure;
}
if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
@@ -11354,6 +11360,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
wdev->links[link_id].cac_started = true;
wdev->links[link_id].cac_start_time = jiffies;
wdev->links[link_id].cac_time_ms = cac_time_ms;
+ cfg80211_set_cac_state(wiphy, &chandef, true);
return 0;
}
--
2.43.0
^ permalink raw reply related
* [PATCH v2 wireless-next 1/4] wifi: cfg80211: fix background CAC
From: Janusz Dziedzic @ 2026-02-06 17:15 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
In-Reply-To: <20260206171830.553879-1-janusz.dziedzic@gmail.com>
Fix:
- Send CAC_ABORT event when background CAC is canceled
- Cancel CAC done workqueue when radar is detected
- Release background wdev ownership when CAC is aborted or passed
- Clean lower layer background radar state when CAC is aborted or passed
- Prevent sending abort event when radar event is sent
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
---
net/wireless/mlme.c | 40 +++++++++++++++++++---------------------
1 file changed, 19 insertions(+), 21 deletions(-)
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 3fc175f9f868..212178d04efa 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -1115,8 +1115,10 @@ void __cfg80211_radar_event(struct wiphy *wiphy,
*/
cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
- if (offchan)
+ if (offchan) {
+ cancel_delayed_work(&rdev->background_cac_done_wk);
queue_work(cfg80211_wq, &rdev->background_cac_abort_wk);
+ }
cfg80211_sched_dfs_chan_update(rdev);
@@ -1187,21 +1189,16 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
if (!cfg80211_chandef_valid(chandef))
return;
- if (!rdev->background_radar_wdev)
- return;
-
switch (event) {
case NL80211_RADAR_CAC_FINISHED:
cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
memcpy(&rdev->cac_done_chandef, chandef, sizeof(*chandef));
queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
cfg80211_sched_dfs_chan_update(rdev);
- wdev = rdev->background_radar_wdev;
break;
case NL80211_RADAR_CAC_ABORTED:
if (!cancel_delayed_work(&rdev->background_cac_done_wk))
return;
- wdev = rdev->background_radar_wdev;
break;
case NL80211_RADAR_CAC_STARTED:
break;
@@ -1213,17 +1210,6 @@ __cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
nl80211_radar_notify(rdev, chandef, event, netdev, GFP_KERNEL);
}
-static void
-cfg80211_background_cac_event(struct cfg80211_registered_device *rdev,
- const struct cfg80211_chan_def *chandef,
- enum nl80211_radar_event event)
-{
- guard(wiphy)(&rdev->wiphy);
-
- __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
- chandef, event);
-}
-
void cfg80211_background_cac_done_wk(struct work_struct *work)
{
struct delayed_work *delayed_work = to_delayed_work(work);
@@ -1231,18 +1217,30 @@ void cfg80211_background_cac_done_wk(struct work_struct *work)
rdev = container_of(delayed_work, struct cfg80211_registered_device,
background_cac_done_wk);
- cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
- NL80211_RADAR_CAC_FINISHED);
+
+ guard(wiphy)(&rdev->wiphy);
+
+ rdev_set_radar_background(rdev, NULL);
+ rdev->background_radar_wdev = NULL;
+
+ __cfg80211_background_cac_event(rdev, rdev->background_radar_wdev,
+ &rdev->background_radar_chandef,
+ NL80211_RADAR_CAC_FINISHED);
}
void cfg80211_background_cac_abort_wk(struct work_struct *work)
{
struct cfg80211_registered_device *rdev;
+ struct wireless_dev *wdev;
rdev = container_of(work, struct cfg80211_registered_device,
background_cac_abort_wk);
- cfg80211_background_cac_event(rdev, &rdev->background_radar_chandef,
- NL80211_RADAR_CAC_ABORTED);
+
+ guard(wiphy)(&rdev->wiphy);
+
+ wdev = rdev->background_radar_wdev;
+ if (wdev)
+ cfg80211_stop_background_radar_detection(wdev);
}
void cfg80211_background_cac_abort(struct wiphy *wiphy)
--
2.43.0
^ permalink raw reply related
* [PATCH v2 wireless-next 0/4] DFS/CAC changes
From: Janusz Dziedzic @ 2026-02-06 17:15 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Janusz Dziedzic
V2:
- fix warning and fail of hwsim DFS test cases
V1:
- report CAC ongoing to user mode
- add hwsim support for background CAC
Janusz Dziedzic (4):
wifi: cfg80211: fix background CAC
wifi: cfg80211: set and report chandef CAC ongoing
wifi: cfg80211: events, report background radar
wifi: mac80211_hwsim: background CAC support
drivers/net/wireless/virtual/mac80211_hwsim.c | 77 +++++++++++++++++++
drivers/net/wireless/virtual/mac80211_hwsim.h | 2 +
include/net/cfg80211.h | 3 +
include/uapi/linux/nl80211.h | 6 ++
net/wireless/chan.c | 27 +++++++
net/wireless/core.h | 4 +
net/wireless/mlme.c | 51 ++++++------
net/wireless/nl80211.c | 14 ++++
8 files changed, 162 insertions(+), 22 deletions(-)
--
2.43.0
^ permalink raw reply
* Re: [PATCH v2 2/3] AP: Always re-add stations that use MLO
From: Benjamin Berg @ 2026-02-06 9:05 UTC (permalink / raw)
To: Ramasamy Kaliappan, Rameshkumar Sundaram, hostap
Cc: linux-wireless, Andrei Otcheretianski
In-Reply-To: <0c167905-6ba7-4e6e-8a4e-455507d8497e@oss.qualcomm.com>
On Thu, 2026-02-05 at 22:34 +0530, Ramasamy Kaliappan wrote:
> Hi,
>
> On 1/30/2026 5:32 PM, Benjamin Berg wrote:
> > Hi,
> >
> > On Thu, 2026-01-29 at 22:56 +0530, Rameshkumar Sundaram wrote:
> > > On 1/29/2026 3:38 PM, Benjamin Berg wrote:
> > > > [SNIP]
> > > > That said, to properly fix this we need an nl80211/mac80211 API that
> > > > permits us to disable address translation for the frame. Otherwise we
> > > > would still get the address translated to the old link address should
> > > > the new link address match the MLD address.
> > > >
> > >
> > > That's true—even probe responses get translated when the old link
> > > address matches the new link MLD address.
> > >
> > > Few other cases I encountered:
> > > Consider an ML STA with ML address M associated with link A and link B,
> > > using link addresses X and Y respectively. If the STA sends an
> > > authentication frame with address Y on link A, it gets translated to M
> > > (even though link A has no STA with address Y) and forwarded to link B.
> > > As a result, hostapd is unaware of the actual TA and queues the
> > > authentication reply to the MLD address on link B. This frame will
> > > eventually be transmitted over the air on link B with address Y.
> >
> > Honestly, that type of link confusion seems like a bug. We should be
> > able to avoid that as we hopefully know on which link the frame was
> > received.
> >
> > > This will be true even if STA associated in one link and tries to roam
> > > to other link of MLD using same link and ML addresses.
> > >
> > > There also cases where an ML STA roams/re-associates as legacy (non-ML)
> > > STA with ML address as link address. The reply would go out with old
> > > link address.
> >
> > Yes, I think that case is similar a station using its MLD Address on
> > the association link and returning on another link.
> >
> > > It seems that address translation at the driver/mac80211 level for
> > > management frames could be avoided for both TX and RX, allowing hostapd
> > > to handle these frames and their replies more efficiently in cases of
> > > roaming and address reuse.
> >
> > Doing address translation in the TX path is required if the
> > hardware/driver should decide on which link to TX the frame. For RX, it
> > seems sensible to me to do the translation when it is possible.
> >
> > I talked a bit to Johannes about this today, and my current proposal
> > would be add a new flag that is set when mac80211 did not find (RX) or
> > should not use (TX) a STA for the frame.
> >
> > More specifically I think that we could:
> > * Fix the link address based STA lookup to only work when the frame
> > was received on the correct link (the bug from above).
> > * Make sure we drop robust management frames without a STA as we do
> > not want to get into trouble with the next change.
> > * Change ieee80211_rx_for_interface so that it uses only
> > link_sta_info_get_bss if we are an MLD and sta_info_get_bss
> > otherwise.
> > Right now, we will find the station if we see the MLD Address in the
> > frame even when it is not a valid link address.
> > * Add a new nl80211 attribute NL80211_ATTR_FRAME_NO_STA to be used
> > together with NL80211_CMD_FRAME for both TX and RX.
> > - In the RX case, add the attribute if we have no station. If the
> > attribute does not exist, then hostapd should assume the address was
> > translated.
> > - In the TX case, plumb the information through to mac80211 and avoid
> > doing a station lookup based on the address.
> >
> > I think this would be enough to then solve the problem in hostapd.
> >
>
> I feel this approach should work. I'm trying to understand how it
> behaves in the following scenario where the STA reconnects with the same
> link address but a new(different) MLD address.
>
> Consider a situation where an already associated STA sends a reconnect
> request using the same link addresses but a different MLD address.
>
> For example, assume the station was originally connected using M as the
> MLD address, with L1 and L2 as its link addresses. When the STA
> reconnects (or roam back), it may use a new MLD address B while still
> using the same link addresses L1 and L2.
>
> In such a case, mac80211 will still find the existing STA entry based on
> the link address, and address translation would map the link address to
> the old mld address. Since the STA lookup succeeds,
> NL80211_ATTR_FRAME_NO_STA would be set to 0.
>
> How is this expected to be handled in hostapd? I believe hostapd will
> also need additional logic to correctly handle this case, since the
> link address maps to an already‑known STA, but the MLD address has changed.
> Otherwise, hostapd may end up replying to the old MLD address or
> associating the frame with the wrong MLD context.
I am not sure we really need to care about this case, but, I think we
can handle it just fine if we want to.
In this case is mac80211 would translate the address to the MLD Address
and would not include the NO_STA flag. hostapd can look up the MLD
Address in its database and translate the address back to the link
address for its internal use. It can also explicitly TX the response to
the link address by setting the NO_STA flag.
So, I think it is an interesting corner case and we need to make sure
to not get confused by it. But, hostapd should be able to handle it.
Either by simply rejecting the AUTH or by making sure the MLD addresses
are all correct if the association succeeds.
Btw. I did start looking into doing the mac80211/cfg80211 changes. How
should we do it with hostapd? Is someone on your side maybe able to
work on the hostapd part?
Benjamin
^ permalink raw reply
* [bug report] wl12xx: add driver
From: Dan Carpenter @ 2026-02-06 8:17 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless
Hello Kalle Valo,
Commit 2f01a1f58889 ("wl12xx: add driver") from Apr 29, 2009
(linux-next), leads to the following Smatch static checker warning:
drivers/net/wireless/ti/wl1251/cmd.c:247 wl1251_cmd_join()
index hardmax out of bounds 'bssid[i]' size=4 max='5' rl='0-5'
drivers/net/wireless/ti/wl1251/cmd.c
229 int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 channel,
230 u16 beacon_interval, u8 dtim_interval)
231 {
232 struct cmd_join *join;
233 int ret, i;
234 u8 *bssid;
235
236 join = kzalloc(sizeof(*join), GFP_KERNEL);
237 if (!join)
238 return -ENOMEM;
239
240 wl1251_debug(DEBUG_CMD, "cmd join%s ch %d %d/%d",
241 bss_type == BSS_TYPE_IBSS ? " ibss" : "",
242 channel, beacon_interval, dtim_interval);
243
244 /* Reverse order BSSID */
245 bssid = (u8 *) &join->bssid_lsb;
246 for (i = 0; i < ETH_ALEN; i++)
--> 247 bssid[i] = wl->bssid[ETH_ALEN - i - 1];
This is fine, but it should use a struct_group() or the KSan stuff
will complain.
248
249 join->rx_config_options = wl->rx_config;
250 join->rx_filter_options = wl->rx_filter;
251
252 join->basic_rate_set = RATE_MASK_1MBPS | RATE_MASK_2MBPS |
253 RATE_MASK_5_5MBPS | RATE_MASK_11MBPS;
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH wireless-next 0/4] DFS/CAC changes
From: Johannes Berg @ 2026-02-06 8:13 UTC (permalink / raw)
To: Janusz Dziedzic; +Cc: linux-wireless
In-Reply-To: <CAFED-j=jC=Czf37TqeKqJy15on1pdDM3bxG4WCDbMWV2jrXxug@mail.gmail.com>
On Wed, 2026-02-04 at 18:08 +0100, Janusz Dziedzic wrote:
> śr., 4 lut 2026 o 13:05 Johannes Berg <johannes@sipsolutions.net> napisał(a):
> >
> > Hmm.
> >
> > This patchset causes dfs_cac_restart_on_enable and
> > dfs_us_chan_switch_precac tests from upstream hostap to fail for me, so
> > I'm dropping it for now.
> >
>
> Doing smth wrong (hostap/main)?
>
> janusz@hp:~/github/hostap/tests/hwsim$ sudo ./run-tests.py --long
> dfs_us_chan_switch_precac
I guess you're running on HW while I'm running on UML:
$ ./tests/hwsim/vm/vm-run.sh dfs_cac_restart_on_enable dfs_us_chan_switch_precac
Starting test run in a virtual machine
./run-all.sh: running inside a VM
./run-all.sh: passing the following args to run-tests.py: --long dfs_cac_restart_on_enable dfs_us_chan_switch_precac
START dfs_cac_restart_on_enable 1/2
FAIL dfs_cac_restart_on_enable 6.219229 2026-02-06 08:10:21.198402
START dfs_us_chan_switch_precac 2/2
FAIL dfs_us_chan_switch_precac 68.059958 2026-02-06 08:11:29.258403
failed tests: dfs_cac_restart_on_enable dfs_us_chan_switch_precac
Oh! It fails with a kernel warning:
WARNING: net/mac80211/driver-ops.c:366 at drv_unassign_vif_chanctx+0x1d3/0x39e, CPU#0: hostapd/496
wlan3: Failed check-sdata-in-driver check, flags: 0x0
Modules linked in:
CPU: 0 UID: 0 PID: 496 Comm: hostapd Tainted: G W 6.19.0-rc7-01110-gad3a0d7c543a
Tainted: [W]=WARN
Stack:
00000000 00000001 ffffff00 60a32e7b
6d56f5a0 60031ac4 6d56f520 6003a286
00000000 60b341d8 60730181 00000000
Call Trace:
[<60031ac4>] ? _printk+0x0/0x49
[<6003f6f9>] show_stack+0x10e/0x11a
[<60031ac4>] ? _printk+0x0/0x49
[<6003a286>] dump_stack_lvl+0x74/0xbc
[<60730181>] ? drv_unassign_vif_chanctx+0x1d3/0x39e
[<6003a2ec>] dump_stack+0x1e/0x20
[<60058e4d>] __warn+0x113/0x221
[<60059008>] warn_slowpath_fmt+0xad/0x108
[<60730181>] drv_unassign_vif_chanctx+0x1d3/0x39e
[<607a8422>] ieee80211_assign_link_chanctx+0x176/0x4fd
[<607aa0ee>] __ieee80211_link_release_channel+0x171/0x1c4
[<6043bae1>] ? rtnl_is_locked+0x0/0x23
[<607aaa2f>] ieee80211_link_release_channel+0x94/0x9a
[<6075e998>] ieee80211_link_stop+0x143/0x14b
[<607570e9>] ieee80211_teardown_sdata+0xd1/0xd6
[<6075d453>] ieee80211_if_change_type+0x384/0x3b8
[<6076b076>] ieee80211_change_iface+0x88/0x194
[<606ba5b2>] cfg80211_change_iface+0x36e/0x4b7
[<606f4f9f>] nl80211_set_interface+0x24e/0x2b2
But it's consistent with your patches, and doesn't appear without them.
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 1/3] wifi: cfg80211: Add support for S1G Response Indication Configuration
From: Johannes Berg @ 2026-02-06 7:57 UTC (permalink / raw)
To: Ria Thomas
Cc: linux-wireless, lachlan.hodges, arien.judge, pradeep.reddy, simon
In-Reply-To: <20260206061139.6fdwaazvk4swpreo@1207>
Hi Ria,
> Just wanted to follow up on the earlier reply and check if you've
> had a chance to review it.
Sorry, I had seen it, but it took a backseat to shuffling patches and
other things I had to do, on top of having been somewhat sick until
early this week.
> To explain the implementation a bit more clearly: The issue is that
> response indication from a MAC perspective doesn't really make sense
> elsewhere. It's simply embedded into the PPDU for the VIF that has
> response indication configured, and the receiver uses it to determine
> which type (if any) of ACK to respond with. So it's entirely handled
> by the lower MAC besides of course setting the value from the upper MAC.
Let me summarise that how I understand what you said, and the spec:
The transmitter MAC sets the RESPONSE_INDICATION in the TXVECTOR for the
PHY-TXSTART.request primitive. The (S1G) PHY then embeds this in the
preamble, so that the receiver can react accordingly. There are certain
rules for both transmitter and receiver, but the transmitter MAC has a
certain set of choices for how to set this.
And for the certification test, presumably the choice for testbed STA
(for certain frames at least, I guess not intended to break the rules
for cases where there's no/less choice) is not meant to be left to the
implementation, but rather meant to be set, presumably to check that the
receiver reacts correctly.
(If I got this wrong so far, probably better to stop reading here and
tell me.)
> While it may seem more ideal to sit in a per station or something similar
> where the lifetimes are more natural, there isn't a capability exchange
> that occurs - configuration is more for local transmitter config. On the
> receiver side, it isn't communicated to the upper MAC at all - so considering
> it as a STA entry dosen't really make much sense.
Yes, I can understand that argument in some way. OTOH, while I'd tend to
agree that it somewhat argues against it being a per-STA configuration,
I'm not really sure it really argues _for_ it being an interface config.
Based on the understanding I outlined above, I'd argue the spec doesn't
really say anything to this effect at all. It leaves a choice to the MAC
implementation on how to set it for every individual PPDU it sends.
Now, clearly we can't very well have an implementation where something
in userspace decides for every PPDU, so we have to make an
implementation choice of how the MAC decides. You've made a choice here
that it should be decided per interface, and due to lifetime issue I've
outlined a choice where it decides per (destination) STA. I don't think
from a spec perspective this choice really matters at all, since the
setting of the TXVECTOR is independent for each PHY-TXSTART.request.
Now that I've described it this way, I think the biggest question I have
is actually how, if at all, we need this in a non-testing scenario?
Which choices of implementation makes sense there? What are the use
cases for this other than testing? I think this could inform the
implementation choice here.
(And as an aside, if it ends up being only for testing, then I think we
can also simply stick it in mac80211 debugfs rather than building out
the elaborate cfg80211/nl80211 infrastructure. But we still need to
decide where it should live, although in that case I'd be more willing
to accept an interface setting despite the lifetime issues.)
johannes
^ permalink raw reply
* Re: [PATCH] rtw: btcoex: clean up style and documentation
From: Dan Carpenter @ 2026-02-06 7:43 UTC (permalink / raw)
To: bubupersonal; +Cc: Linux Staging, Linux Wireless
In-Reply-To: <OkisUHh--F-9@tutamail.com>
On Thu, Feb 05, 2026 at 06:38:06PM +0100, bubupersonal@tutamail.com wrote:
> Here's the correct patch.
Nope. That's not a patch.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH wireless-next v2 1/3] wifi: cfg80211: Add support for S1G Response Indication Configuration
From: Ria Thomas @ 2026-02-06 6:11 UTC (permalink / raw)
To: Johannes Berg
Cc: linux-wireless, lachlan.hodges, arien.judge, pradeep.reddy, simon
In-Reply-To: <048c2715d08822d7f79b082cbe332f982d8ced61.camel@sipsolutions.net>
> Actually, reading the spec, are you sure it's even on an *interface*
> scope? A lot of this seems to me like it should be per intended
> receiver, and you need to know its capabilities for generating the
> intended response?
>
> If it were per-STA then I think that'd have a much more natural lifetime
> (since it cannot exceed that of the STA) which seems far better to me.
>
Just wanted to follow up on the earlier reply and check if you've
had a chance to review it.
To explain the implementation a bit more clearly: The issue is that
response indication from a MAC perspective doesn't really make sense
elsewhere. It's simply embedded into the PPDU for the VIF that has
response indication configured, and the receiver uses it to determine
which type (if any) of ACK to respond with. So it's entirely handled
by the lower MAC besides of course setting the value from the upper MAC.
While it may seem more ideal to sit in a per station or something similar
where the lifetimes are more natural, there isn't a capability exchange
that occurs - configuration is more for local transmitter config. On the
receiver side, it isn't communicated to the upper MAC at all - so considering
it as a STA entry dosen't really make much sense.
Please let me know if you see any issues with this approach.
Looking forward to hear your thoughts on this whenever you have a chance
Ria
^ permalink raw reply
* Re: [PATCH] wifi: nl80211: drop impossible negative band check
From: sun jian @ 2026-02-06 2:16 UTC (permalink / raw)
To: Jeff Johnson; +Cc: Johannes Berg, linux-wireless, linux-kernel
In-Reply-To: <9f3b472d-a8d1-4c51-9eed-6ef0ec5b28a3@oss.qualcomm.com>
On Thu, Feb 5, 2026 at 12:20 AM Jeff Johnson
<jeff.johnson@oss.qualcomm.com> wrote:
>
> For future reference, if you are fixing a warning, then your commit text
> should include that information. That way someone else who has that warning
> can search the archives for that warning and then find your fix.
>
Ack, thanks, I will include the exact warning text in future
warning-fix commits.
sun jian
^ permalink raw reply
* Re: [PATCH v6 wireless] mac80211: fix NULL pointer dereference in monitor mode
From: Jakub Kicinski @ 2026-02-06 0:20 UTC (permalink / raw)
To: Dhyan K Prajapati
Cc: Greg KH, Johannes Berg, linux-wireless, netdev, stable,
Dhyan K Prajapati, Johannes Berg
In-Reply-To: <20260205175213.5005-1-dhyaan19022009@gmail.com>
On Thu, 5 Feb 2026 23:22:13 +0530 Dhyan K Prajapati wrote:
> Cc: netdev@vger.kernel.org
If you have to CC netdev on your failed attempts to produce a patch
please follow our posting guidance:
https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr
^ permalink raw reply
* (no subject)
From: Alexander Schnaidt @ 2026-02-05 22:47 UTC (permalink / raw)
To: linux-wireless
unsubscribe linux-wireless
^ permalink raw reply
* [wireless-next:main] BUILD SUCCESS 333225e1e9ead7b06e5363389403bdac72ba3046
From: kernel test robot @ 2026-02-05 21:37 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Johannes Berg, linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
branch HEAD: 333225e1e9ead7b06e5363389403bdac72ba3046 Merge tag 'wireless-next-2026-02-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next
elapsed time: 722m
configs tested: 352
configs skipped: 3
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-22
arc allyesconfig gcc-15.2.0
arc defconfig gcc-15.2.0
arc randconfig-001-20260205 gcc-8.5.0
arc randconfig-001-20260206 gcc-8.5.0
arc randconfig-002-20260205 gcc-8.5.0
arc randconfig-002-20260206 gcc-8.5.0
arm allnoconfig clang-22
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm defconfig clang-22
arm defconfig gcc-15.2.0
arm ep93xx_defconfig clang-22
arm jornada720_defconfig clang-22
arm multi_v4t_defconfig gcc-15.2.0
arm randconfig-001-20260205 clang-22
arm randconfig-001-20260205 gcc-8.5.0
arm randconfig-001-20260206 gcc-8.5.0
arm randconfig-002-20260205 gcc-8.5.0
arm randconfig-002-20260206 gcc-8.5.0
arm randconfig-003-20260205 clang-22
arm randconfig-003-20260205 gcc-8.5.0
arm randconfig-003-20260206 gcc-8.5.0
arm randconfig-004-20260205 gcc-8.5.0
arm randconfig-004-20260206 gcc-8.5.0
arm sp7021_defconfig gcc-15.2.0
arm spear13xx_defconfig gcc-15.2.0
arm sunxi_defconfig clang-22
arm vf610m4_defconfig clang-22
arm vt8500_v6_v7_defconfig clang-22
arm64 allmodconfig clang-19
arm64 allmodconfig clang-22
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260205 clang-22
arm64 randconfig-001-20260205 gcc-10.5.0
arm64 randconfig-001-20260206 gcc-13.4.0
arm64 randconfig-002-20260205 gcc-10.5.0
arm64 randconfig-002-20260206 gcc-13.4.0
arm64 randconfig-003-20260205 clang-22
arm64 randconfig-003-20260205 gcc-10.5.0
arm64 randconfig-003-20260206 gcc-13.4.0
arm64 randconfig-004-20260205 clang-19
arm64 randconfig-004-20260205 gcc-10.5.0
arm64 randconfig-004-20260206 gcc-13.4.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260205 gcc-10.5.0
csky randconfig-001-20260205 gcc-9.5.0
csky randconfig-001-20260206 gcc-13.4.0
csky randconfig-002-20260205 gcc-10.5.0
csky randconfig-002-20260206 gcc-13.4.0
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-22
hexagon allnoconfig gcc-15.2.0
hexagon defconfig clang-22
hexagon defconfig gcc-15.2.0
hexagon randconfig-001-20260205 clang-22
hexagon randconfig-001-20260205 gcc-15.2.0
hexagon randconfig-001-20260206 clang-22
hexagon randconfig-002-20260205 clang-22
hexagon randconfig-002-20260205 gcc-15.2.0
hexagon randconfig-002-20260206 clang-22
i386 alldefconfig clang-22
i386 allmodconfig clang-20
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001-20260205 gcc-13
i386 buildonly-randconfig-001-20260205 gcc-14
i386 buildonly-randconfig-001-20260206 clang-20
i386 buildonly-randconfig-002-20260205 clang-20
i386 buildonly-randconfig-002-20260205 gcc-14
i386 buildonly-randconfig-002-20260206 clang-20
i386 buildonly-randconfig-003-20260205 clang-20
i386 buildonly-randconfig-003-20260205 gcc-14
i386 buildonly-randconfig-003-20260206 clang-20
i386 buildonly-randconfig-004-20260205 clang-20
i386 buildonly-randconfig-004-20260205 gcc-14
i386 buildonly-randconfig-004-20260206 clang-20
i386 buildonly-randconfig-005-20260205 gcc-14
i386 buildonly-randconfig-005-20260206 clang-20
i386 buildonly-randconfig-006-20260205 gcc-14
i386 buildonly-randconfig-006-20260206 clang-20
i386 defconfig clang-20
i386 defconfig gcc-15.2.0
i386 randconfig-001-20260205 gcc-13
i386 randconfig-001-20260205 gcc-14
i386 randconfig-001-20260206 gcc-14
i386 randconfig-002-20260205 clang-20
i386 randconfig-002-20260205 gcc-13
i386 randconfig-002-20260206 gcc-14
i386 randconfig-003-20260205 gcc-13
i386 randconfig-003-20260206 gcc-14
i386 randconfig-004-20260205 gcc-13
i386 randconfig-004-20260205 gcc-14
i386 randconfig-004-20260206 gcc-14
i386 randconfig-005-20260205 clang-20
i386 randconfig-005-20260205 gcc-13
i386 randconfig-005-20260206 gcc-14
i386 randconfig-006-20260205 gcc-13
i386 randconfig-006-20260206 gcc-14
i386 randconfig-007-20260205 gcc-13
i386 randconfig-007-20260205 gcc-14
i386 randconfig-007-20260206 gcc-14
i386 randconfig-011-20260205 clang-20
i386 randconfig-011-20260205 gcc-14
i386 randconfig-011-20260206 clang-20
i386 randconfig-012-20260205 clang-20
i386 randconfig-012-20260206 clang-20
i386 randconfig-013-20260205 clang-20
i386 randconfig-013-20260205 gcc-14
i386 randconfig-013-20260206 clang-20
i386 randconfig-014-20260205 clang-20
i386 randconfig-014-20260206 clang-20
i386 randconfig-015-20260205 clang-20
i386 randconfig-015-20260205 gcc-14
i386 randconfig-015-20260206 clang-20
i386 randconfig-016-20260205 clang-20
i386 randconfig-016-20260206 clang-20
i386 randconfig-017-20260205 clang-20
i386 randconfig-017-20260205 gcc-14
i386 randconfig-017-20260206 clang-20
loongarch allmodconfig clang-19
loongarch allmodconfig clang-22
loongarch allnoconfig clang-22
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001-20260205 clang-22
loongarch randconfig-001-20260205 gcc-15.2.0
loongarch randconfig-001-20260206 clang-22
loongarch randconfig-002-20260205 gcc-15.2.0
loongarch randconfig-002-20260206 clang-22
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
m68k apollo_defconfig gcc-15.2.0
m68k atari_defconfig gcc-15.2.0
m68k defconfig clang-19
m68k defconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
microblaze defconfig gcc-15.2.0
microblaze mmu_defconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips cavium_octeon_defconfig clang-22
mips ip22_defconfig clang-22
mips malta_qemu_32r6_defconfig gcc-15.2.0
mips maltaup_defconfig gcc-15.2.0
nios2 allmodconfig clang-22
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-22
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-19
nios2 defconfig gcc-11.5.0
nios2 randconfig-001-20260205 gcc-11.5.0
nios2 randconfig-001-20260205 gcc-15.2.0
nios2 randconfig-001-20260206 clang-22
nios2 randconfig-002-20260205 gcc-11.5.0
nios2 randconfig-002-20260205 gcc-15.2.0
nios2 randconfig-002-20260206 clang-22
openrisc allmodconfig clang-22
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig clang-22
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
openrisc virt_defconfig clang-22
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-22
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc randconfig-001-20260205 gcc-9.5.0
parisc randconfig-001-20260206 gcc-8.5.0
parisc randconfig-002-20260205 gcc-8.5.0
parisc randconfig-002-20260205 gcc-9.5.0
parisc randconfig-002-20260206 gcc-8.5.0
parisc64 defconfig clang-19
parisc64 defconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-22
powerpc allnoconfig gcc-15.2.0
powerpc asp8347_defconfig clang-22
powerpc canyonlands_defconfig clang-22
powerpc currituck_defconfig clang-22
powerpc eiger_defconfig gcc-15.2.0
powerpc iss476-smp_defconfig clang-22
powerpc mpc832x_rdb_defconfig gcc-15.2.0
powerpc pmac32_defconfig clang-22
powerpc ps3_defconfig gcc-15.2.0
powerpc randconfig-001-20260205 gcc-15.2.0
powerpc randconfig-001-20260205 gcc-9.5.0
powerpc randconfig-001-20260206 gcc-8.5.0
powerpc randconfig-002-20260205 clang-16
powerpc randconfig-002-20260205 gcc-9.5.0
powerpc randconfig-002-20260206 gcc-8.5.0
powerpc tqm8xx_defconfig clang-22
powerpc64 randconfig-001-20260205 clang-22
powerpc64 randconfig-001-20260205 gcc-9.5.0
powerpc64 randconfig-001-20260206 gcc-8.5.0
powerpc64 randconfig-002-20260205 clang-22
powerpc64 randconfig-002-20260205 gcc-9.5.0
powerpc64 randconfig-002-20260206 gcc-8.5.0
riscv allmodconfig clang-22
riscv allnoconfig clang-22
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260205 clang-19
riscv randconfig-001-20260206 clang-22
riscv randconfig-002-20260205 clang-19
riscv randconfig-002-20260205 clang-22
riscv randconfig-002-20260206 clang-22
s390 allmodconfig clang-18
s390 allmodconfig clang-19
s390 allnoconfig clang-22
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260205 clang-18
s390 randconfig-001-20260205 clang-19
s390 randconfig-001-20260206 clang-22
s390 randconfig-002-20260205 clang-19
s390 randconfig-002-20260205 clang-22
s390 randconfig-002-20260206 clang-22
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-22
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sh defconfig gcc-14
sh randconfig-001-20260205 clang-19
sh randconfig-001-20260205 gcc-15.2.0
sh randconfig-001-20260206 clang-22
sh randconfig-002-20260205 clang-19
sh randconfig-002-20260205 gcc-10.5.0
sh randconfig-002-20260206 clang-22
sh secureedge5410_defconfig gcc-15.2.0
sh shmin_defconfig clang-22
sparc alldefconfig gcc-15.2.0
sparc allnoconfig clang-22
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001-20260205 gcc-12.5.0
sparc randconfig-001-20260205 gcc-15.2.0
sparc randconfig-001-20260206 gcc-12.5.0
sparc randconfig-002-20260205 gcc-12.5.0
sparc randconfig-002-20260206 gcc-12.5.0
sparc64 allmodconfig clang-22
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260205 gcc-12.5.0
sparc64 randconfig-001-20260205 gcc-8.5.0
sparc64 randconfig-001-20260206 gcc-12.5.0
sparc64 randconfig-002-20260205 gcc-12.5.0
sparc64 randconfig-002-20260205 gcc-8.5.0
sparc64 randconfig-002-20260206 gcc-12.5.0
um allmodconfig clang-19
um allnoconfig clang-22
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260205 clang-22
um randconfig-001-20260205 gcc-12.5.0
um randconfig-001-20260206 gcc-12.5.0
um randconfig-002-20260205 gcc-12.5.0
um randconfig-002-20260205 gcc-13
um randconfig-002-20260206 gcc-12.5.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allnoconfig clang-22
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001-20260205 clang-20
x86_64 buildonly-randconfig-001-20260205 gcc-14
x86_64 buildonly-randconfig-001-20260206 gcc-14
x86_64 buildonly-randconfig-002-20260205 clang-20
x86_64 buildonly-randconfig-002-20260205 gcc-14
x86_64 buildonly-randconfig-002-20260206 gcc-14
x86_64 buildonly-randconfig-003-20260205 gcc-14
x86_64 buildonly-randconfig-003-20260206 gcc-14
x86_64 buildonly-randconfig-004-20260205 clang-20
x86_64 buildonly-randconfig-004-20260205 gcc-14
x86_64 buildonly-randconfig-004-20260206 gcc-14
x86_64 buildonly-randconfig-005-20260205 clang-20
x86_64 buildonly-randconfig-005-20260205 gcc-14
x86_64 buildonly-randconfig-005-20260206 gcc-14
x86_64 buildonly-randconfig-006-20260205 gcc-14
x86_64 buildonly-randconfig-006-20260206 gcc-14
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001-20260205 clang-20
x86_64 randconfig-001-20260205 gcc-12
x86_64 randconfig-002-20260205 clang-20
x86_64 randconfig-003-20260205 clang-20
x86_64 randconfig-004-20260205 clang-20
x86_64 randconfig-005-20260205 clang-20
x86_64 randconfig-005-20260205 gcc-14
x86_64 randconfig-006-20260205 clang-20
x86_64 randconfig-011-20260205 clang-20
x86_64 randconfig-012-20260205 clang-20
x86_64 randconfig-012-20260205 gcc-14
x86_64 randconfig-013-20260205 clang-20
x86_64 randconfig-013-20260205 gcc-14
x86_64 randconfig-014-20260205 clang-20
x86_64 randconfig-015-20260205 clang-20
x86_64 randconfig-015-20260205 gcc-14
x86_64 randconfig-016-20260205 clang-20
x86_64 randconfig-071-20260205 clang-20
x86_64 randconfig-071-20260206 gcc-14
x86_64 randconfig-072-20260205 clang-20
x86_64 randconfig-072-20260206 gcc-14
x86_64 randconfig-073-20260205 clang-20
x86_64 randconfig-073-20260206 gcc-14
x86_64 randconfig-074-20260205 clang-20
x86_64 randconfig-074-20260206 gcc-14
x86_64 randconfig-075-20260205 clang-20
x86_64 randconfig-075-20260206 gcc-14
x86_64 randconfig-076-20260205 clang-20
x86_64 randconfig-076-20260206 gcc-14
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-22
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-22
xtensa allyesconfig gcc-15.2.0
xtensa cadence_csp_defconfig clang-22
xtensa randconfig-001-20260205 gcc-12.5.0
xtensa randconfig-001-20260205 gcc-8.5.0
xtensa randconfig-001-20260206 gcc-12.5.0
xtensa randconfig-002-20260205 gcc-12.5.0
xtensa randconfig-002-20260206 gcc-12.5.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [wireless:for-next] BUILD SUCCESS 7d6ba706ae5ef7d3d00b67140d2873ae1da6d41f
From: kernel test robot @ 2026-02-05 21:07 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Johannes Berg, linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git for-next
branch HEAD: 7d6ba706ae5ef7d3d00b67140d2873ae1da6d41f Merge tag 'wireless-2026-02-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
elapsed time: 980m
configs tested: 362
configs skipped: 3
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig clang-22
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-22
arc allyesconfig gcc-15.2.0
arc defconfig gcc-15.2.0
arc randconfig-001-20260205 gcc-8.5.0
arc randconfig-001-20260206 gcc-8.5.0
arc randconfig-002-20260205 gcc-8.5.0
arc randconfig-002-20260206 gcc-8.5.0
arm allnoconfig clang-22
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm bcm2835_defconfig gcc-15.2.0
arm defconfig gcc-15.2.0
arm ep93xx_defconfig clang-22
arm jornada720_defconfig clang-22
arm mps2_defconfig clang-22
arm multi_v4t_defconfig gcc-15.2.0
arm omap1_defconfig gcc-15.2.0
arm randconfig-001-20260205 clang-22
arm randconfig-001-20260205 gcc-8.5.0
arm randconfig-001-20260206 gcc-8.5.0
arm randconfig-002-20260205 gcc-8.5.0
arm randconfig-002-20260206 gcc-8.5.0
arm randconfig-003-20260205 clang-22
arm randconfig-003-20260205 gcc-8.5.0
arm randconfig-003-20260206 gcc-8.5.0
arm randconfig-004-20260205 gcc-8.5.0
arm randconfig-004-20260206 gcc-8.5.0
arm sp7021_defconfig gcc-15.2.0
arm sunxi_defconfig clang-22
arm vf610m4_defconfig clang-22
arm vt8500_v6_v7_defconfig clang-22
arm64 allmodconfig clang-19
arm64 allmodconfig clang-22
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260205 clang-22
arm64 randconfig-001-20260205 gcc-10.5.0
arm64 randconfig-001-20260206 gcc-13.4.0
arm64 randconfig-002-20260205 gcc-10.5.0
arm64 randconfig-002-20260206 gcc-13.4.0
arm64 randconfig-003-20260205 clang-22
arm64 randconfig-003-20260205 gcc-10.5.0
arm64 randconfig-003-20260206 gcc-13.4.0
arm64 randconfig-004-20260205 clang-19
arm64 randconfig-004-20260205 gcc-10.5.0
arm64 randconfig-004-20260206 gcc-13.4.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260205 gcc-10.5.0
csky randconfig-001-20260205 gcc-9.5.0
csky randconfig-001-20260206 gcc-13.4.0
csky randconfig-002-20260205 gcc-10.5.0
csky randconfig-002-20260206 gcc-13.4.0
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-22
hexagon allnoconfig gcc-15.2.0
hexagon defconfig gcc-15.2.0
hexagon randconfig-001-20260205 clang-22
hexagon randconfig-001-20260205 gcc-15.2.0
hexagon randconfig-001-20260206 clang-22
hexagon randconfig-002-20260205 clang-22
hexagon randconfig-002-20260205 gcc-15.2.0
hexagon randconfig-002-20260206 clang-22
i386 alldefconfig clang-22
i386 allmodconfig clang-20
i386 allnoconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 buildonly-randconfig-001-20260205 gcc-13
i386 buildonly-randconfig-001-20260205 gcc-14
i386 buildonly-randconfig-001-20260206 clang-20
i386 buildonly-randconfig-002-20260205 clang-20
i386 buildonly-randconfig-002-20260205 gcc-14
i386 buildonly-randconfig-002-20260206 clang-20
i386 buildonly-randconfig-003-20260205 clang-20
i386 buildonly-randconfig-003-20260205 gcc-14
i386 buildonly-randconfig-003-20260206 clang-20
i386 buildonly-randconfig-004-20260205 clang-20
i386 buildonly-randconfig-004-20260205 gcc-14
i386 buildonly-randconfig-004-20260206 clang-20
i386 buildonly-randconfig-005-20260205 gcc-14
i386 buildonly-randconfig-005-20260206 clang-20
i386 buildonly-randconfig-006-20260205 gcc-14
i386 buildonly-randconfig-006-20260206 clang-20
i386 defconfig gcc-15.2.0
i386 randconfig-001-20260205 gcc-13
i386 randconfig-001-20260205 gcc-14
i386 randconfig-001-20260206 gcc-14
i386 randconfig-002-20260205 clang-20
i386 randconfig-002-20260205 gcc-13
i386 randconfig-002-20260206 gcc-14
i386 randconfig-003-20260205 gcc-13
i386 randconfig-003-20260206 gcc-14
i386 randconfig-004-20260205 gcc-13
i386 randconfig-004-20260205 gcc-14
i386 randconfig-004-20260206 gcc-14
i386 randconfig-005-20260205 clang-20
i386 randconfig-005-20260205 gcc-13
i386 randconfig-005-20260206 gcc-14
i386 randconfig-006-20260205 gcc-13
i386 randconfig-006-20260206 gcc-14
i386 randconfig-007-20260205 gcc-13
i386 randconfig-007-20260205 gcc-14
i386 randconfig-007-20260206 gcc-14
i386 randconfig-011-20260205 clang-20
i386 randconfig-011-20260205 gcc-14
i386 randconfig-011-20260206 clang-20
i386 randconfig-012-20260205 clang-20
i386 randconfig-012-20260206 clang-20
i386 randconfig-013-20260205 clang-20
i386 randconfig-013-20260205 gcc-14
i386 randconfig-013-20260206 clang-20
i386 randconfig-014-20260205 clang-20
i386 randconfig-014-20260206 clang-20
i386 randconfig-015-20260205 clang-20
i386 randconfig-015-20260205 gcc-14
i386 randconfig-015-20260206 clang-20
i386 randconfig-016-20260205 clang-20
i386 randconfig-016-20260206 clang-20
i386 randconfig-017-20260205 clang-20
i386 randconfig-017-20260205 gcc-14
i386 randconfig-017-20260206 clang-20
loongarch allmodconfig clang-19
loongarch allmodconfig clang-22
loongarch allnoconfig clang-22
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001-20260205 clang-22
loongarch randconfig-001-20260205 gcc-15.2.0
loongarch randconfig-001-20260206 clang-22
loongarch randconfig-002-20260205 gcc-15.2.0
loongarch randconfig-002-20260206 clang-22
m68k alldefconfig gcc-15.2.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
m68k atari_defconfig gcc-15.2.0
m68k defconfig clang-19
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips cavium_octeon_defconfig clang-22
mips db1xxx_defconfig gcc-15.2.0
mips decstation_64_defconfig gcc-15.2.0
mips gpr_defconfig clang-18
mips ip22_defconfig clang-22
mips ip22_defconfig gcc-15.2.0
mips malta_kvm_defconfig gcc-15.2.0
mips maltasmvp_eva_defconfig clang-18
mips maltaup_defconfig gcc-15.2.0
nios2 allmodconfig clang-22
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-22
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-19
nios2 randconfig-001-20260205 gcc-11.5.0
nios2 randconfig-001-20260205 gcc-15.2.0
nios2 randconfig-001-20260206 clang-22
nios2 randconfig-002-20260205 gcc-11.5.0
nios2 randconfig-002-20260205 gcc-15.2.0
nios2 randconfig-002-20260206 clang-22
openrisc allmodconfig clang-22
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig clang-22
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
openrisc virt_defconfig clang-22
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-22
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc randconfig-001-20260205 gcc-9.5.0
parisc randconfig-001-20260206 gcc-8.5.0
parisc randconfig-002-20260205 gcc-8.5.0
parisc randconfig-002-20260205 gcc-9.5.0
parisc randconfig-002-20260206 gcc-8.5.0
parisc64 defconfig clang-19
powerpc akebono_defconfig clang-18
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-22
powerpc allnoconfig gcc-15.2.0
powerpc canyonlands_defconfig clang-22
powerpc currituck_defconfig clang-22
powerpc eiger_defconfig gcc-15.2.0
powerpc holly_defconfig clang-18
powerpc iss476-smp_defconfig clang-22
powerpc mgcoge_defconfig gcc-15.2.0
powerpc mpc8315_rdb_defconfig gcc-15.2.0
powerpc mpc832x_rdb_defconfig gcc-15.2.0
powerpc pmac32_defconfig clang-22
powerpc powernv_defconfig clang-18
powerpc randconfig-001-20260205 gcc-15.2.0
powerpc randconfig-001-20260205 gcc-9.5.0
powerpc randconfig-001-20260206 gcc-8.5.0
powerpc randconfig-002-20260205 clang-16
powerpc randconfig-002-20260205 gcc-9.5.0
powerpc randconfig-002-20260206 gcc-8.5.0
powerpc tqm8555_defconfig gcc-15.2.0
powerpc tqm8xx_defconfig clang-22
powerpc wii_defconfig gcc-15.2.0
powerpc64 alldefconfig clang-18
powerpc64 randconfig-001-20260205 clang-22
powerpc64 randconfig-001-20260205 gcc-9.5.0
powerpc64 randconfig-001-20260206 gcc-8.5.0
powerpc64 randconfig-002-20260205 clang-22
powerpc64 randconfig-002-20260205 gcc-9.5.0
powerpc64 randconfig-002-20260206 gcc-8.5.0
riscv allmodconfig clang-22
riscv allnoconfig clang-22
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260205 clang-19
riscv randconfig-001-20260206 clang-22
riscv randconfig-002-20260205 clang-19
riscv randconfig-002-20260205 clang-22
riscv randconfig-002-20260206 clang-22
s390 allmodconfig clang-18
s390 allmodconfig clang-19
s390 allnoconfig clang-22
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260205 clang-18
s390 randconfig-001-20260205 clang-19
s390 randconfig-001-20260206 clang-22
s390 randconfig-002-20260205 clang-19
s390 randconfig-002-20260205 clang-22
s390 randconfig-002-20260206 clang-22
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-22
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sh defconfig gcc-14
sh randconfig-001-20260205 clang-19
sh randconfig-001-20260205 gcc-15.2.0
sh randconfig-001-20260206 clang-22
sh randconfig-002-20260205 clang-19
sh randconfig-002-20260205 gcc-10.5.0
sh randconfig-002-20260206 clang-22
sh rsk7201_defconfig clang-18
sh rsk7264_defconfig clang-22
sh rts7751r2d1_defconfig clang-22
sh se7343_defconfig clang-22
sh se7619_defconfig gcc-15.2.0
sh secureedge5410_defconfig gcc-15.2.0
sh sh2007_defconfig gcc-15.2.0
sh sh7757lcr_defconfig clang-18
sh shmin_defconfig clang-22
sparc allnoconfig clang-22
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001-20260205 gcc-12.5.0
sparc randconfig-001-20260205 gcc-15.2.0
sparc randconfig-001-20260206 gcc-12.5.0
sparc randconfig-002-20260205 gcc-12.5.0
sparc randconfig-002-20260206 gcc-12.5.0
sparc64 allmodconfig clang-22
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260205 gcc-12.5.0
sparc64 randconfig-001-20260205 gcc-8.5.0
sparc64 randconfig-001-20260206 gcc-12.5.0
sparc64 randconfig-002-20260205 gcc-12.5.0
sparc64 randconfig-002-20260205 gcc-8.5.0
sparc64 randconfig-002-20260206 gcc-12.5.0
um allmodconfig clang-19
um allnoconfig clang-22
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260205 clang-22
um randconfig-001-20260205 gcc-12.5.0
um randconfig-001-20260206 gcc-12.5.0
um randconfig-002-20260205 gcc-12.5.0
um randconfig-002-20260205 gcc-13
um randconfig-002-20260206 gcc-12.5.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allnoconfig clang-22
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001-20260205 clang-20
x86_64 buildonly-randconfig-001-20260205 gcc-14
x86_64 buildonly-randconfig-001-20260206 gcc-14
x86_64 buildonly-randconfig-002-20260205 clang-20
x86_64 buildonly-randconfig-002-20260205 gcc-14
x86_64 buildonly-randconfig-002-20260206 gcc-14
x86_64 buildonly-randconfig-003-20260205 gcc-14
x86_64 buildonly-randconfig-003-20260206 gcc-14
x86_64 buildonly-randconfig-004-20260205 clang-20
x86_64 buildonly-randconfig-004-20260205 gcc-14
x86_64 buildonly-randconfig-004-20260206 gcc-14
x86_64 buildonly-randconfig-005-20260205 clang-20
x86_64 buildonly-randconfig-005-20260205 gcc-14
x86_64 buildonly-randconfig-005-20260206 gcc-14
x86_64 buildonly-randconfig-006-20260205 gcc-14
x86_64 buildonly-randconfig-006-20260206 gcc-14
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001-20260205 clang-20
x86_64 randconfig-001-20260205 gcc-12
x86_64 randconfig-002-20260205 clang-20
x86_64 randconfig-003-20260205 clang-20
x86_64 randconfig-004-20260205 clang-20
x86_64 randconfig-005-20260205 clang-20
x86_64 randconfig-005-20260205 gcc-14
x86_64 randconfig-006-20260205 clang-20
x86_64 randconfig-011-20260205 clang-20
x86_64 randconfig-012-20260205 clang-20
x86_64 randconfig-012-20260205 gcc-14
x86_64 randconfig-013-20260205 clang-20
x86_64 randconfig-013-20260205 gcc-14
x86_64 randconfig-014-20260205 clang-20
x86_64 randconfig-015-20260205 clang-20
x86_64 randconfig-015-20260205 gcc-14
x86_64 randconfig-016-20260205 clang-20
x86_64 randconfig-071-20260205 clang-20
x86_64 randconfig-071-20260206 gcc-14
x86_64 randconfig-072-20260205 clang-20
x86_64 randconfig-072-20260206 gcc-14
x86_64 randconfig-073-20260205 clang-20
x86_64 randconfig-073-20260206 gcc-14
x86_64 randconfig-074-20260205 clang-20
x86_64 randconfig-074-20260206 gcc-14
x86_64 randconfig-075-20260205 clang-20
x86_64 randconfig-075-20260206 gcc-14
x86_64 randconfig-076-20260205 clang-20
x86_64 randconfig-076-20260206 gcc-14
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-22
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-22
xtensa allyesconfig gcc-15.2.0
xtensa cadence_csp_defconfig clang-22
xtensa randconfig-001-20260205 gcc-12.5.0
xtensa randconfig-001-20260205 gcc-8.5.0
xtensa randconfig-001-20260206 gcc-12.5.0
xtensa randconfig-002-20260205 gcc-12.5.0
xtensa randconfig-002-20260206 gcc-12.5.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH v6 wireless] mac80211: fix NULL pointer dereference in monitor mode
From: Dhyan K Prajapati @ 2026-02-05 17:52 UTC (permalink / raw)
To: Greg KH
Cc: Johannes Berg, linux-wireless, netdev, stable, Dhyan K Prajapati,
Johannes Berg
Crash trace:
RIP: iwlagn_bss_info_changed+0x19d/0x640 [iwldvm]
Code: 49 8b 46 10 <8b> 10
RAX: 0000000000000000 (NULL link->conf->bss)
wifi: mac80211: fix NULL pointer deref regression in link notify
Commit c57e5b974514 ("wifi: mac80211: fix WARN_ON for monitor mode on
some devices") reorganized link change notifications. This caused a
regression for hardware using IEEE80211_HW_WANT_MONITOR_VIF. In monitor
mode, link->conf->bss is uninitialized, but current logic allows these
notifications to reach driver callbacks, causing a deterministic NULL
dereference in drivers like iwldvm. Fix this by validating the BSS
context before driver notification.
Device: Intel Centrino Advanced-n 6205
Fixes: c57e5b974514 ("wifi: mac80211: fix WARN_ON for monitor mode on some devices")
Cc: stable@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-wireless@vger.kernel.org
Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Dhyan K Prajapati <dhyaan19022009@gmail.com>
---
net/mac80211/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index b05e313c7..190222c26 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -416,6 +416,8 @@ void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
case NL80211_IFTYPE_MONITOR:
if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF))
return;
+ if (!link->conf->bss)
+ return;
break;
default:
break;
--
2.43.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox