* [RFC PATCH 8/8] wifi: mac80211: pass error station if non-STA transmit was requested
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
When cfg80211 requested a transmit without a station, pass an error
station to ieee80211_tx_skb_tid instead of the correct one.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
net/mac80211/offchannel.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 0a8b4c5e8c12..24a55186b87f 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -857,8 +857,10 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
need_offchan = true;
rcu_read_lock();
- sta = sta_info_get_bss(sdata, mgmt->da);
- mlo_sta = sta && sta->sta.mlo;
+ if (!params->no_sta) {
+ sta = sta_info_get_bss(sdata, mgmt->da);
+ mlo_sta = sta && sta->sta.mlo;
+ }
if (!ieee80211_is_action(mgmt->frame_control) ||
mgmt->u.action.category == WLAN_CATEGORY_PUBLIC ||
@@ -887,7 +889,8 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
local->ops->remain_on_channel &&
memcmp(sdata->vif.cfg.ap_addr, mgmt->bssid, ETH_ALEN))) {
need_offchan = true;
- } else if (sdata->u.mgd.associated &&
+ } else if (!params->no_sta &&
+ sdata->u.mgd.associated &&
ether_addr_equal(sdata->vif.cfg.ap_addr, mgmt->da)) {
sta = sta_info_get_bss(sdata, mgmt->da);
mlo_sta = sta && sta->sta.mlo;
@@ -1026,7 +1029,9 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
}
if (!need_offchan) {
- ieee80211_tx_skb_tid(sdata, skb, NULL, 7, link_id);
+ ieee80211_tx_skb_tid(sdata, skb,
+ sta ? sta : ERR_PTR(-ENOENT),
+ 7, link_id);
ret = 0;
goto out_unlock;
}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 7/8] wifi: mac80211: pass station to ieee80211_tx_skb_tid
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
The station may be relevant for queuing and will also generally be
resolved in some cases. However, we want to be able to prevent looking
up the station based on the address.
Add a station parameter, which can be set to the correct station, to an
error value to prevent station lookup or to NULL to get the old
behaviour where the address is used to find the appropriate station.
Also disable the station lookup for ieee80211_tx_skb_tid_band already as
it does not make any sense to find a station when doing an off-channel
transmit.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
net/mac80211/agg-tx.c | 6 +++---
net/mac80211/ht.c | 4 ++--
net/mac80211/ieee80211_i.h | 14 ++++++++------
net/mac80211/offchannel.c | 2 +-
net/mac80211/rx.c | 2 +-
net/mac80211/tdls.c | 4 ++--
net/mac80211/tx.c | 8 +++++---
7 files changed, 22 insertions(+), 18 deletions(-)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index d981b0fc57bf..6a5754351f08 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 - 2024 Intel Corporation
+ * Copyright (C) 2018 - 2024, 2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -97,7 +97,7 @@ static void ieee80211_send_addba_request(struct sta_info *sta, u16 tid,
if (sta->sta.deflink.he_cap.has_he)
ieee80211_add_addbaext(skb, 0, agg_size);
- ieee80211_tx_skb_tid(sdata, skb, tid, -1);
+ ieee80211_tx_skb_tid(sdata, skb, NULL, tid, -1);
}
void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
@@ -126,7 +126,7 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
IEEE80211_TX_CTL_REQ_TX_STATUS;
- ieee80211_tx_skb_tid(sdata, skb, tid, -1);
+ ieee80211_tx_skb_tid(sdata, skb, NULL, tid, -1);
}
EXPORT_SYMBOL(ieee80211_send_bar);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 1c82a28b03de..f98f5a9a2ebe 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright 2017 Intel Deutschland GmbH
- * Copyright(c) 2020-2025 Intel Corporation
+ * Copyright(c) 2020-2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -571,7 +571,7 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
info->status_data = IEEE80211_STATUS_TYPE_SMPS |
u16_encode_bits(status_link_id << 2 | smps,
IEEE80211_STATUS_SUBDATA_MASK);
- ieee80211_tx_skb_tid(sdata, skb, 7, link_id);
+ ieee80211_tx_skb_tid(sdata, skb, NULL, 7, link_id);
return 0;
}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e60b814dd89e..793331c1d748 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2393,7 +2393,8 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
struct sta_info *sta, struct sk_buff *skb);
void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
- struct sk_buff *skb, int tid, int link_id,
+ struct sk_buff *skb, struct sta_info *sta,
+ int tid, int link_id,
enum nl80211_band band);
static inline bool ieee80211_require_encrypted_assoc(__le16 fc,
@@ -2411,22 +2412,23 @@ int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
static inline void
ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
- struct sk_buff *skb, int tid,
- enum nl80211_band band)
+ struct sk_buff *skb, int tid, enum nl80211_band band)
{
rcu_read_lock();
- __ieee80211_tx_skb_tid_band(sdata, skb, tid, -1, band);
+ __ieee80211_tx_skb_tid_band(sdata, skb, ERR_PTR(-ENOENT),
+ tid, -1, band);
rcu_read_unlock();
}
void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
- struct sk_buff *skb, int tid, int link_id);
+ struct sk_buff *skb, struct sta_info *sta,
+ int tid, int link_id);
static inline void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb)
{
/* Send all internal mgmt frames on VO. Accordingly set TID to 7. */
- ieee80211_tx_skb_tid(sdata, skb, 7, -1);
+ ieee80211_tx_skb_tid(sdata, skb, NULL, 7, -1);
}
/**
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index ae82533e3c02..0a8b4c5e8c12 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -1026,7 +1026,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
}
if (!need_offchan) {
- ieee80211_tx_skb_tid(sdata, skb, 7, link_id);
+ ieee80211_tx_skb_tid(sdata, skb, NULL, 7, link_id);
ret = 0;
goto out_unlock;
}
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c547ad56a539..2de8c135f169 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -4072,7 +4072,7 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
local->hw.offchannel_tx_hw_queue;
}
- __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, -1,
+ __ieee80211_tx_skb_tid_band(rx->sdata, nskb, rx->sta, 7, -1,
status->band);
}
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index dbbfe2d6842f..39a880ab7edb 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -6,7 +6,7 @@
* Copyright 2014, Intel Corporation
* Copyright 2014 Intel Mobile Communications GmbH
* Copyright 2015 - 2016 Intel Deutschland GmbH
- * Copyright (C) 2019, 2021-2025 Intel Corporation
+ * Copyright (C) 2019, 2021-2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -1067,7 +1067,7 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
}
if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) {
- ieee80211_tx_skb_tid(sdata, skb, 7, link_id);
+ ieee80211_tx_skb_tid(sdata, skb, sta, 7, link_id);
return 0;
}
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 007f5a368d41..c788d48ef365 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -6235,7 +6235,8 @@ void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
EXPORT_SYMBOL(ieee80211_unreserve_tid);
void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
- struct sk_buff *skb, int tid, int link_id,
+ struct sk_buff *skb, struct sta_info *sta,
+ int tid, int link_id,
enum nl80211_band band)
{
const struct ieee80211_hdr *hdr = (void *)skb->data;
@@ -6292,7 +6293,8 @@ void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
}
void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
- struct sk_buff *skb, int tid, int link_id)
+ struct sk_buff *skb, struct sta_info *sta,
+ int tid, int link_id)
{
struct ieee80211_chanctx_conf *chanctx_conf;
enum nl80211_band band;
@@ -6317,7 +6319,7 @@ void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
band = 0;
}
- __ieee80211_tx_skb_tid_band(sdata, skb, tid, link_id, band);
+ __ieee80211_tx_skb_tid_band(sdata, skb, sta, tid, link_id, band);
rcu_read_unlock();
}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 6/8] wifi: mac80211: report to cfg80211 when no STA is known for a frame
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
This is relevant for hostapd to know whether address translation was
done on a received management frame.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
net/mac80211/rx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0afb67019da7..c547ad56a539 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3948,6 +3948,7 @@ ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
.len = rx->skb->len,
.link_id = rx->link_id,
.have_link_id = rx->link_id >= 0,
+ .no_sta = !rx->sta,
};
/* skip known-bad action frames and return them in the next handler */
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 5/8] wifi: cfg80211: add attribute for TX/RX denoting there is no station
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
For MLD stations, userspace may need to explicitly transmit a frame to
a specific link address. In that case, it needs to ensure that no
address translation happens.
In the reverse case of an RX, userspace may need to know the link
address for a frame. By passing the information whether a STA is known
for the frame, userspace knows whether link translation happened and
can do the reverse lookup when needed.
This is important for flows where a STA is still registered but the
connection has been lost and it is returning again.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
include/net/cfg80211.h | 4 ++++
include/uapi/linux/nl80211.h | 7 +++++++
net/wireless/nl80211.c | 8 +++++++-
3 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index fc01de19c798..5063911cba56 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3919,6 +3919,7 @@ struct cfg80211_update_ft_ies_params {
* @link_id: for MLO, the link ID to transmit on, -1 if not given; note
* that the link ID isn't validated (much), it's in range but the
* link might not exist (or be used by the receiver STA)
+ * @no_sta: set if the frame should not be transmitted using an existing STA
*/
struct cfg80211_mgmt_tx_params {
struct ieee80211_channel *chan;
@@ -3931,6 +3932,7 @@ struct cfg80211_mgmt_tx_params {
int n_csa_offsets;
const u16 *csa_offsets;
int link_id;
+ bool no_sta;
};
/**
@@ -9025,6 +9027,7 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
* @flags: flags, as defined in &enum nl80211_rxmgmt_flags
* @rx_tstamp: Hardware timestamp of frame RX in nanoseconds
* @ack_tstamp: Hardware timestamp of ack TX in nanoseconds
+ * @no_sta: set if no station is known for the frame (relevant for MLD)
*/
struct cfg80211_rx_info {
int freq;
@@ -9036,6 +9039,7 @@ struct cfg80211_rx_info {
u32 flags;
u64 rx_tstamp;
u64 ack_tstamp;
+ bool no_sta;
};
/**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b63f71850906..1466c043974c 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2984,6 +2984,11 @@ enum nl80211_commands {
* this feature during association. This is a flag attribute.
* Currently only supported in mac80211 drivers.
*
+ * @NL80211_ATTR_FRAME_CMD_NO_STA: Valid for NL80211_CMD_FRAME to denote that
+ * the kernel had no station for a received frame or should not use a
+ * known station to transmit a frame. This is relevant to know whether
+ * MLD address translation happened or to disable it when sending a frame.
+ *
* @NUM_NL80211_ATTR: total number of nl80211_attrs available
* @NL80211_ATTR_MAX: highest attribute number currently defined
* @__NL80211_ATTR_AFTER_LAST: internal use
@@ -3557,6 +3562,8 @@ enum nl80211_attrs {
NL80211_ATTR_UHR_CAPABILITY,
NL80211_ATTR_DISABLE_UHR,
+ NL80211_ATTR_FRAME_CMD_NO_STA,
+
/* add attributes here, update the policy in nl80211.c */
__NL80211_ATTR_AFTER_LAST,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 6e58b238a1f8..56a9c63ddd76 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -946,6 +946,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
[NL80211_ATTR_UHR_CAPABILITY] =
NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_uhr_capa, 255),
[NL80211_ATTR_DISABLE_UHR] = { .type = NLA_FLAG },
+ [NL80211_ATTR_FRAME_CMD_NO_STA] = { .type = NLA_FLAG },
};
/* policy for the key attributes */
@@ -14020,6 +14021,9 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
!(wdev->valid_links & BIT(params.link_id)))
return -EINVAL;
+ params.no_sta =
+ nla_get_flag(info->attrs[NL80211_ATTR_FRAME_CMD_NO_STA]);
+
params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
@@ -20581,7 +20585,9 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
(info->ack_tstamp && nla_put_u64_64bit(msg,
NL80211_ATTR_TX_HW_TIMESTAMP,
info->ack_tstamp,
- NL80211_ATTR_PAD)))
+ NL80211_ATTR_PAD)) ||
+ (info->no_sta &&
+ nla_put_flag(msg, NL80211_ATTR_FRAME_CMD_NO_STA)))
goto nla_put_failure;
genlmsg_end(msg, hdr);
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 3/8] wifi: mac80211: refactor RX link_id and station handling
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
The link ID for one frequency may be different between VIFs. As such,
the sensible thing is to set the link ID later in the flow once the SKB
is duplicated for each VIF. As the link ID is not passed in from outside
mac80211 it is always valid and the corresponding bit can be dropped.
Also switch a few more places to pass the link STA as that is a natural
way to pass the link information around.
This fixes the per-link statistics when frames are reordered.
Note that this patch deliberately leaves some places unchanged and even
incorrect as this will be addressed by further refactorings.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
include/net/mac80211.h | 9 +-
net/mac80211/eht.c | 3 -
net/mac80211/iface.c | 7 +-
net/mac80211/mlme.c | 9 +-
net/mac80211/rx.c | 209 ++++++++++++++++++-----------------------
net/mac80211/scan.c | 10 +-
6 files changed, 105 insertions(+), 142 deletions(-)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 4d9dbd35369b..6db15227d4e1 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1655,10 +1655,9 @@ enum mac80211_rx_encoding {
* @ampdu_reference: A-MPDU reference number, must be a different value for
* each A-MPDU but the same for each subframe within one A-MPDU
* @zero_length_psdu_type: radiotap type of the 0-length PSDU
- * @link_valid: if the link which is identified by @link_id is valid. This flag
- * is set only when connection is MLO.
- * @link_id: id of the link used to receive the packet. This is used along with
- * @link_valid.
+ * @link_id: id of the link used to receive the packet. Set and used by
+ * mac80211 internally, it uses @freq set by the driver to identify the
+ * correct link per vif.
*/
struct ieee80211_rx_status {
u64 mactime;
@@ -1698,7 +1697,7 @@ struct ieee80211_rx_status {
u8 chains;
s8 chain_signal[IEEE80211_MAX_CHAINS];
u8 zero_length_psdu_type;
- u8 link_valid:1, link_id:4;
+ u8 link_id:4;
};
static inline u32
diff --git a/net/mac80211/eht.c b/net/mac80211/eht.c
index 75096b2195d2..f49c4729e8e8 100644
--- a/net/mac80211/eht.c
+++ b/net/mac80211/eht.c
@@ -174,9 +174,6 @@ void ieee80211_rx_eml_op_mode_notif(struct ieee80211_sub_if_data *sdata,
if (!ift_ext_capa)
return;
- if (!status->link_valid)
- return;
-
sta = sta_info_get_bss(sdata, mgmt->sa);
if (!sta)
return;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 676b2a43c9f2..ddb384d7cfa2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1611,11 +1611,8 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
break;
status = IEEE80211_SKB_RXCB(skb);
- if (!status->link_valid)
- link_sta = &sta->deflink;
- else
- link_sta = rcu_dereference_protected(sta->link[status->link_id],
- lockdep_is_held(&local->hw.wiphy->mtx));
+ link_sta = wiphy_dereference(local->hw.wiphy,
+ sta->link[status->link_id]);
if (link_sta)
ieee80211_ht_handle_chanwidth_notif(local, sdata, sta,
link_sta, chanwidth,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e83582b2c377..4190c2830ac5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -8273,12 +8273,9 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
mgmt = (struct ieee80211_mgmt *) skb->data;
fc = le16_to_cpu(mgmt->frame_control);
- if (rx_status->link_valid) {
- link = sdata_dereference(sdata->link[rx_status->link_id],
- sdata);
- if (!link)
- return;
- }
+ link = sdata_dereference(sdata->link[rx_status->link_id], sdata);
+ if (!link)
+ return;
switch (fc & IEEE80211_FCTL_STYPE) {
case IEEE80211_STYPE_BEACON:
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 4098f63ec824..1b8ec391991f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -222,43 +222,21 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
}
static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
- int link_id,
- struct sta_info *sta,
+ struct link_sta_info *link_sta,
struct sk_buff *skb)
{
- struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-
- if (link_id >= 0) {
- status->link_valid = 1;
- status->link_id = link_id;
- } else {
- status->link_valid = 0;
- }
-
skb_queue_tail(&sdata->skb_queue, skb);
wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
- if (sta) {
- struct link_sta_info *link_sta_info;
-
- if (link_id >= 0) {
- link_sta_info = rcu_dereference(sta->link[link_id]);
- if (!link_sta_info)
- return;
- } else {
- link_sta_info = &sta->deflink;
- }
-
- link_sta_info->rx_stats.packets++;
- }
+ if (link_sta)
+ link_sta->rx_stats.packets++;
}
static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
- int link_id,
- struct sta_info *sta,
+ struct link_sta_info *link_sta,
struct sk_buff *skb)
{
skb->protocol = 0;
- __ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
+ __ieee80211_queue_skb_to_iface(sdata, link_sta, skb);
}
static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
@@ -301,7 +279,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
if (!skb)
return;
- ieee80211_queue_skb_to_iface(sdata, -1, NULL, skb);
+ ieee80211_queue_skb_to_iface(sdata, NULL, skb);
}
/*
@@ -1496,7 +1474,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
/* if this mpdu is fragmented - terminate rx aggregation session */
sc = le16_to_cpu(hdr->seq_ctrl);
if (sc & IEEE80211_SCTL_FRAG) {
- ieee80211_queue_skb_to_iface(rx->sdata, rx->link_id, NULL, skb);
+ ieee80211_queue_skb_to_iface(rx->sdata, NULL, skb);
return;
}
@@ -2498,7 +2476,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
out:
ieee80211_led_rx(rx->local);
- if (rx->sta)
+ if (rx->link_sta)
rx->link_sta->rx_stats.packets++;
return RX_CONTINUE;
}
@@ -3309,8 +3287,8 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
(tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
- __ieee80211_queue_skb_to_iface(sdata, rx->link_id,
- rx->sta, rx->skb);
+ __ieee80211_queue_skb_to_iface(sdata, rx->link_sta,
+ rx->skb);
return RX_QUEUED;
}
}
@@ -3956,7 +3934,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
return RX_QUEUED;
queue:
- ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
+ ieee80211_queue_skb_to_iface(sdata, rx->link_sta, rx->skb);
return RX_QUEUED;
}
@@ -4113,7 +4091,7 @@ ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
return RX_DROP_U_UNEXPECTED_EXT_FRAME;
/* for now only beacons are ext, so queue them */
- ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
+ ieee80211_queue_skb_to_iface(sdata, rx->link_sta, rx->skb);
return RX_QUEUED;
}
@@ -4170,7 +4148,7 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
return RX_DROP_U_UNHANDLED_MGMT_STYPE;
}
- ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
+ ieee80211_queue_skb_to_iface(sdata, rx->link_sta, rx->skb);
return RX_QUEUED;
}
@@ -4214,12 +4192,28 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
spin_lock_bh(&rx->local->rx_path_lock);
while ((skb = __skb_dequeue(frames))) {
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+
/*
- * all the other fields are valid across frames
- * that belong to an aMPDU since they are on the
- * same TID from the same station
+ * Most fields are valid across frames. However,
+ * in the case of reordering frames may have arrived
+ * on different links, so adjust the link_id, link
+ * and link_sta accordingly.
*/
rx->skb = skb;
+ if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
+ unlikely(rx->link_id != status->link_id)) {
+ if (rx->sta) {
+ rx->link_sta =
+ rcu_dereference(rx->sta->link[rx->link_id]);
+
+ /* Link got disabled, just use deflink */
+ if (!rx->link_sta)
+ rx->link_sta = &rx->sta->deflink;
+ }
+ rx->link_id = status->link_id;
+ rx->link = rcu_dereference(rx->sdata->link[status->link_id]);
+ }
if (WARN_ON_ONCE(!rx->link)) {
res = RX_DROP_U_NO_LINK;
@@ -4289,7 +4283,10 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
static bool
ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
{
- return !!(sta->valid_links & BIT(link_id));
+ if (sta->mlo)
+ return !!(sta->valid_links & BIT(link_id));
+ else
+ return sta->deflink.link_id == link_id;
}
static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
@@ -4326,11 +4323,13 @@ static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
if (link_id < 0) {
if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
- sta && !sta->sta.valid_links)
+ sta && !sta->sta.valid_links) {
rx->link =
rcu_dereference(rx->sdata->link[sta->deflink.link_id]);
- else
+ rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
+ } else {
rx->link = &rx->sdata->deflink;
+ }
} else if (!ieee80211_rx_data_set_link(rx, link_id)) {
return false;
}
@@ -4353,7 +4352,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
struct tid_ampdu_rx *tid_agg_rx;
int link_id = -1;
- /* FIXME: statistics won't be right with this */
+ /* NOTE: the correct link STA for the frame is set later */
if (sta->sta.valid_links)
link_id = ffs(sta->sta.valid_links) - 1;
@@ -4824,20 +4823,14 @@ static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
{
struct ieee80211_sta_rx_stats *stats;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
- struct sta_info *sta = rx->sta;
- struct link_sta_info *link_sta;
+ struct link_sta_info *link_sta = rx->link_sta;
struct sk_buff *skb = rx->skb;
void *sa = skb->data + ETH_ALEN;
void *da = skb->data;
- if (rx->link_id >= 0) {
- link_sta = rcu_dereference(sta->link[rx->link_id]);
- if (WARN_ON_ONCE(!link_sta)) {
- dev_kfree_skb(rx->skb);
- return;
- }
- } else {
- link_sta = &sta->deflink;
+ if (WARN_ON_ONCE(!link_sta)) {
+ dev_kfree_skb(rx->skb);
+ return;
}
stats = &link_sta->rx_stats;
@@ -5060,6 +5053,9 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
goto drop;
}
+ status = IEEE80211_SKB_RXCB(skb);
+ status->link_id = rx->link_id < 0 ? 0 : rx->link_id;
+
ieee80211_rx_8023(rx, fast_rx, orig_len);
return true;
@@ -5084,6 +5080,7 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
struct ieee80211_hdr *hdr = (void *)skb->data;
struct link_sta_info *link_sta = rx->link_sta;
struct ieee80211_link_data *link = rx->link;
+ struct ieee80211_rx_status *status;
rx->skb = skb;
@@ -5127,6 +5124,9 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
hdr = (struct ieee80211_hdr *)rx->skb->data;
}
+ status = IEEE80211_SKB_RXCB(rx->skb);
+ status->link_id = rx->link_id < 0 ? 0 : rx->link_id;
+
if (unlikely(rx->sta && rx->sta->sta.mlo) &&
is_unicast_ether_addr(hdr->addr1) &&
!ieee80211_is_probe_resp(hdr->frame_control) &&
@@ -5152,22 +5152,19 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
}
static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
- struct ieee80211_sta *pubsta,
+ struct ieee80211_link_sta *link_pubsta,
struct sk_buff *skb,
struct list_head *list)
{
struct ieee80211_local *local = hw_to_local(hw);
- struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_fast_rx *fast_rx;
struct ieee80211_rx_data rx;
struct sta_info *sta;
- int link_id = -1;
memset(&rx, 0, sizeof(rx));
rx.skb = skb;
rx.local = local;
rx.list = list;
- rx.link_id = -1;
I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
@@ -5175,23 +5172,15 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
if (skb->len < sizeof(struct ethhdr))
goto drop;
- if (!pubsta)
+ if (!link_pubsta)
goto drop;
- if (status->link_valid)
- link_id = status->link_id;
-
- /*
- * TODO: Should the frame be dropped if the right link_id is not
- * available? Or may be it is fine in the current form to proceed with
- * the frame processing because with frame being in 802.3 format,
- * link_id is used only for stats purpose and updating the stats on
- * the deflink is fine?
- */
- sta = container_of(pubsta, struct sta_info, sta);
- if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
+ sta = container_of(link_pubsta->sta, struct sta_info, sta);
+ if (!ieee80211_rx_data_set_sta(&rx, sta, link_pubsta->link_id))
goto drop;
+ rx.link_id = link_pubsta->link_id;
+
fast_rx = rcu_dereference(rx.sta->fast_rx);
if (!fast_rx)
goto drop;
@@ -5212,6 +5201,9 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
int link_id = -1;
/*
+ * FIXME: Here we can assume that link addresses have not
+ * been translated.
+ *
* Look up link station first, in case there's a
* chance that they might have a link address that
* is identical to the MLD address, that way we'll
@@ -5225,10 +5217,8 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
sta = sta_info_get_bss(rx->sdata, hdr->addr2);
- if (status->link_valid) {
- link_id = status->link_id;
- } else if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
- status->freq) {
+ if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
+ status->freq) {
struct ieee80211_link_data *link;
struct ieee80211_chanctx_conf *conf;
@@ -5256,12 +5246,11 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
* be called with rcu_read_lock protection.
*/
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
- struct ieee80211_sta *pubsta,
+ struct ieee80211_link_sta *link_pubsta,
struct sk_buff *skb,
struct list_head *list)
{
struct ieee80211_local *local = hw_to_local(hw);
- struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_sub_if_data *sdata;
struct ieee80211_hdr *hdr;
__le16 fc;
@@ -5275,7 +5264,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
rx.skb = skb;
rx.local = local;
rx.list = list;
- rx.link_id = -1;
if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
@@ -5306,35 +5294,14 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
if (ieee80211_is_data(fc)) {
struct sta_info *sta, *prev_sta;
- int link_id = -1;
-
- if (status->link_valid)
- link_id = status->link_id;
- if (pubsta) {
- sta = container_of(pubsta, struct sta_info, sta);
- if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
+ if (link_pubsta) {
+ sta = container_of(link_pubsta->sta,
+ struct sta_info, sta);
+ if (!ieee80211_rx_data_set_sta(&rx, sta,
+ link_pubsta->link_id))
goto out;
- /*
- * In MLO connection, fetch the link_id using addr2
- * when the driver does not pass link_id in status.
- * When the address translation is already performed by
- * driver/hw, the valid link_id must be passed in
- * status.
- */
-
- if (!status->link_valid && pubsta->mlo) {
- struct link_sta_info *link_sta;
-
- link_sta = link_sta_info_get_bss(rx.sdata,
- hdr->addr2);
- if (!link_sta)
- goto out;
-
- ieee80211_rx_data_set_link(&rx, link_sta->link_id);
- }
-
if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
return;
goto out;
@@ -5343,13 +5310,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
prev_sta = NULL;
for_each_sta_info(local, hdr->addr2, sta, tmp) {
+ int link_id;
+
if (!prev_sta) {
prev_sta = sta;
continue;
}
rx.sdata = prev_sta->sdata;
- if (!status->link_valid && prev_sta->sta.mlo) {
+
+ /*
+ * FIXME: This is not correct as the addr2 cannot be a
+ * link address if the loop itself is iterated.
+ */
+ if (prev_sta->sta.mlo) {
struct link_sta_info *link_sta;
link_sta = link_sta_info_get_bss(rx.sdata,
@@ -5358,6 +5332,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
continue;
link_id = link_sta->link_id;
+ } else {
+ link_id = sta->deflink.link_id;
}
if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
@@ -5369,8 +5345,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
}
if (prev_sta) {
+ int link_id;
+
rx.sdata = prev_sta->sdata;
- if (!status->link_valid && prev_sta->sta.mlo) {
+
+ /*
+ * FIXME: This is not correct as the addr2 cannot be a
+ * link address if the loop itself is iterated.
+ */
+ if (prev_sta->sta.mlo) {
struct link_sta_info *link_sta;
link_sta = link_sta_info_get_bss(rx.sdata,
@@ -5379,6 +5362,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
goto out;
link_id = link_sta->link_id;
+ } else {
+ link_id = sta->deflink.link_id;
}
if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
@@ -5441,7 +5426,6 @@ void ieee80211_rx_list(struct ieee80211_hw *hw,
struct ieee80211_supported_band *sband;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
- struct ieee80211_sta *pubsta;
WARN_ON_ONCE(softirq_count() == 0);
@@ -5564,16 +5548,6 @@ void ieee80211_rx_list(struct ieee80211_hw *hw,
}
}
- /* FIXME: Emulate the old driver behaviour for now */
- if (link_pubsta) {
- status->link_valid = 1;
- status->link_id = link_pubsta->link_id;
- pubsta = link_pubsta->sta;
- } else {
- status->link_valid = 0;
- pubsta = NULL;
- }
-
status->rx_flags = 0;
kcov_remote_start_common(skb_get_kcov_handle(skb));
@@ -5592,9 +5566,10 @@ void ieee80211_rx_list(struct ieee80211_hw *hw,
ieee80211_tpt_led_trig_rx(local, skb->len);
if (status->flag & RX_FLAG_8023)
- __ieee80211_rx_handle_8023(hw, pubsta, skb, list);
+ __ieee80211_rx_handle_8023(hw, link_pubsta, skb, list);
else
- __ieee80211_rx_handle_packet(hw, pubsta, skb, list);
+ __ieee80211_rx_handle_packet(hw, link_pubsta, skb,
+ list);
}
kcov_remote_stop();
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 4823c8d45639..bcbae67e2f49 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2013-2015 Intel Mobile Communications GmbH
* Copyright 2016-2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
*/
#include <linux/if_arp.h>
@@ -204,12 +204,10 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
* an indication on which of the links the frame was received
*/
if (ieee80211_vif_is_mld(&scan_sdata->vif)) {
- if (rx_status->link_valid) {
- s8 link_id = rx_status->link_id;
+ s8 link_id = rx_status->link_id;
- link_conf =
- rcu_dereference(scan_sdata->vif.link_conf[link_id]);
- }
+ link_conf =
+ rcu_dereference(scan_sdata->vif.link_conf[link_id]);
} else {
link_conf = &scan_sdata->vif.bss_conf;
}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 4/8] wifi: mac80211: rework RX packet handling
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
The code has grown over time and it was not correctly handling all
cases. Examples of issues are that for management frames we would match
the received address against the MLD address even though we should not
resolve the station in that case. Another issue was that for data frames
we would not correctly fall back to use link addresses when the driver
does not provide the pubsta already.
The new code still uses the same approach as before. For data frames,
assume that we a valid station exists and interfaces do not need to be
iterated. On the other hand, for non-data frames (or if a data frame
without a station is received) all interfaces must be iterated.
Note that this rework makes mac80211 slightly more strict. For example,
previously mac80211 would have incorrectly accepted a data frame that
was transmitted on the wrong link.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
net/mac80211/rx.c | 284 +++++++++++++++++++++++++++-------------------
1 file changed, 170 insertions(+), 114 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1b8ec391991f..0afb67019da7 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -4284,9 +4284,33 @@ static bool
ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
{
if (sta->mlo)
- return !!(sta->valid_links & BIT(link_id));
- else
- return sta->deflink.link_id == link_id;
+ return sta->valid_links & BIT(link_id);
+
+ return sta->deflink.link_id == link_id;
+}
+
+static bool ieee80211_rx_data_set_link_sta(struct ieee80211_rx_data *rx,
+ struct link_sta_info *link_sta)
+{
+ struct sta_info *sta;
+
+ if (WARN_ON_ONCE(!link_sta) ||
+ !ieee80211_rx_is_valid_sta_link_id(&link_sta->sta->sta,
+ link_sta->link_id))
+ return false;
+
+ sta = link_sta->sta;
+
+ rx->sta = sta;
+ rx->local = sta->sdata->local;
+ rx->link = rcu_dereference(sta->sdata->link[link_sta->link_id]);
+ if (!rx->link)
+ return false;
+
+ rx->link_id = rx->link->link_id;
+ rx->link_sta = link_sta;
+
+ return true;
}
static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
@@ -5192,53 +5216,18 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
dev_kfree_skb(skb);
}
-static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
- struct sk_buff *skb, bool consume)
+static bool ieee80211_rx_valid_freq(int freq, struct ieee80211_link_data *link)
{
- struct link_sta_info *link_sta;
- struct ieee80211_hdr *hdr = (void *)skb->data;
- struct sta_info *sta;
- int link_id = -1;
-
- /*
- * FIXME: Here we can assume that link addresses have not
- * been translated.
- *
- * Look up link station first, in case there's a
- * chance that they might have a link address that
- * is identical to the MLD address, that way we'll
- * have the link information if needed.
- */
- link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
- if (link_sta) {
- sta = link_sta->sta;
- link_id = link_sta->link_id;
- } else {
- struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-
- sta = sta_info_get_bss(rx->sdata, hdr->addr2);
- if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
- status->freq) {
- struct ieee80211_link_data *link;
- struct ieee80211_chanctx_conf *conf;
+ struct ieee80211_chanctx_conf *conf;
- for_each_link_data_rcu(rx->sdata, link) {
- conf = rcu_dereference(link->conf->chanctx_conf);
- if (!conf || !conf->def.chan)
- continue;
-
- if (status->freq == conf->def.chan->center_freq) {
- link_id = link->link_id;
- break;
- }
- }
- }
- }
+ if (!freq || link->sdata->vif.type == NL80211_IFTYPE_NAN)
+ return true;
- if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
+ conf = rcu_dereference(link->conf->chanctx_conf);
+ if (!conf || !conf->def.chan)
return false;
- return ieee80211_prepare_and_rx_handle(rx, skb, consume);
+ return freq == conf->def.chan->center_freq;
}
/*
@@ -5252,11 +5241,14 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
{
struct ieee80211_local *local = hw_to_local(hw);
struct ieee80211_sub_if_data *sdata;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_hdr *hdr;
+ struct link_sta_info *link_sta;
+ struct sta_info *sta;
__le16 fc;
struct ieee80211_rx_data rx;
- struct ieee80211_sub_if_data *prev;
struct rhlist_head *tmp;
+ bool rx_data_pending;
int err = 0;
fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
@@ -5292,92 +5284,102 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
ieee80211_is_s1g_beacon(hdr->frame_control)))
ieee80211_scan_rx(local, skb);
+ /*
+ * RX of a data frame should only happen to existing stations.
+ * It is therefore more efficient to use the one provided by the driver
+ * or search based on the station's address.
+ *
+ * Note we will fall through and handle a spurious data frame in the
+ * same way as a management frame.
+ */
if (ieee80211_is_data(fc)) {
- struct sta_info *sta, *prev_sta;
-
if (link_pubsta) {
- sta = container_of(link_pubsta->sta,
- struct sta_info, sta);
- if (!ieee80211_rx_data_set_sta(&rx, sta,
- link_pubsta->link_id))
- goto out;
+ sta = container_of(link_pubsta->sta, struct sta_info,
+ sta);
+ link_sta = rcu_dereference(sta->link[link_pubsta->link_id]);
- if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+ rx.sdata = sta->sdata;
+ if (ieee80211_rx_data_set_link_sta(&rx, link_sta) &&
+ ieee80211_prepare_and_rx_handle(&rx, skb, true))
return;
+
goto out;
}
- prev_sta = NULL;
+ rx_data_pending = false;
+ /* Search for stations on non-MLD interfaces */
for_each_sta_info(local, hdr->addr2, sta, tmp) {
- int link_id;
+ struct ieee80211_link_data *link;
- if (!prev_sta) {
- prev_sta = sta;
+ if (ieee80211_vif_is_mld(&sta->sdata->vif))
continue;
- }
-
- rx.sdata = prev_sta->sdata;
-
- /*
- * FIXME: This is not correct as the addr2 cannot be a
- * link address if the loop itself is iterated.
- */
- if (prev_sta->sta.mlo) {
- struct link_sta_info *link_sta;
- link_sta = link_sta_info_get_bss(rx.sdata,
- hdr->addr2);
- if (!link_sta)
- continue;
+ link = &sta->sdata->deflink;
+ if (!ieee80211_rx_valid_freq(status->freq, link))
+ continue;
- link_id = link_sta->link_id;
- } else {
- link_id = sta->deflink.link_id;
+ if (rx_data_pending) {
+ ieee80211_prepare_and_rx_handle(&rx, skb,
+ false);
+ rx_data_pending = false;
}
- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
- goto out;
-
- ieee80211_prepare_and_rx_handle(&rx, skb, false);
+ rx.sdata = sta->sdata;
+ if (!ieee80211_rx_data_set_link_sta(&rx, &sta->deflink))
+ continue;
- prev_sta = sta;
+ rx_data_pending = true;
}
- if (prev_sta) {
- int link_id;
-
- rx.sdata = prev_sta->sdata;
+ /* And search stations on MLD interfaces */
+ for_each_link_sta_info(local, hdr->addr2, link_sta, tmp) {
+ struct ieee80211_link_data *link;
- /*
- * FIXME: This is not correct as the addr2 cannot be a
- * link address if the loop itself is iterated.
- */
- if (prev_sta->sta.mlo) {
- struct link_sta_info *link_sta;
+ sta = link_sta->sta;
+ sdata = sta->sdata;
+ link = rcu_dereference(sdata->link[link_sta->link_id]);
- link_sta = link_sta_info_get_bss(rx.sdata,
- hdr->addr2);
- if (!link_sta)
- goto out;
+ if (!ieee80211_rx_valid_freq(status->freq, link))
+ continue;
- link_id = link_sta->link_id;
- } else {
- link_id = sta->deflink.link_id;
+ if (rx_data_pending) {
+ ieee80211_prepare_and_rx_handle(&rx, skb,
+ false);
+ rx_data_pending = false;
}
- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
- goto out;
+ rx.sdata = sta->sdata;
+ if (!ieee80211_rx_data_set_link_sta(&rx, link_sta))
+ continue;
+
+ rx_data_pending = true;
+ }
+ if (rx_data_pending) {
if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
return;
- goto out;
+ else
+ goto out;
}
+
+ /* fall through, e.g. for spurious frame notification */
}
- prev = NULL;
+ /*
+ * This is a management frame (or a data frame without a station) and
+ * it will be delivered independent of whether a station exists,
+ * so iterate the interfaces.
+ */
+ rx_data_pending = false;
+
+ /* We expect the driver to provide frequency information */
+ if (WARN_ON_ONCE(!local->emulate_chanctx && !status->freq))
+ goto out;
list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+ struct ieee80211_link_data *link = NULL;
+
if (!ieee80211_sdata_running(sdata))
continue;
@@ -5385,30 +5387,84 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
continue;
+ /* Try to resolve the station */
+ if (!ieee80211_vif_is_mld(&sdata->vif)) {
+ sta = sta_info_get_bss(sdata, hdr->addr2);
+
+ if (sta) {
+ link_sta = &sta->deflink;
+ link = &sdata->deflink;
+ }
+ } else {
+ link_sta = link_sta_info_get_bss(sdata, hdr->addr2);
+
+ if (link_sta) {
+ sta = link_sta->sta;
+ link = rcu_dereference(sdata->link[link_sta->link_id]);
+ }
+ }
+
/*
- * frame is destined for this interface, but if it's
- * not also for the previous one we handle that after
- * the loop to avoid copying the SKB once too much
+ * If we found a STA and it has a valid link information, then
+ * RX using the station.
*/
+ if (link_sta && link &&
+ ieee80211_rx_valid_freq(status->freq, link)) {
+ if (rx_data_pending) {
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+ rx_data_pending = false;
+ }
+
+ /* No valid_links check as we need to RX beacons */
+
+ rx.sdata = sdata;
+ if (ieee80211_rx_data_set_link_sta(&rx, link_sta))
+ rx_data_pending = true;
- if (!prev) {
- prev = sdata;
continue;
}
- rx.sdata = prev;
- ieee80211_rx_for_interface(&rx, skb, false);
+ /* No station, try to resolve the link and RX */
+ if (ieee80211_vif_is_mld(&sdata->vif)) {
+ struct ieee80211_chanctx_conf *conf;
+ bool found = false;
- prev = sdata;
- }
+ for_each_link_data_rcu(sdata, link) {
+ conf = rcu_dereference(link->conf->chanctx_conf);
+ if (!conf || !conf->def.chan)
+ continue;
- if (prev) {
- rx.sdata = prev;
+ if (status->freq == conf->def.chan->center_freq) {
+ found = true;
+ break;
+ }
+ }
- if (ieee80211_rx_for_interface(&rx, skb, true))
- return;
+ if (!found)
+ link = &sdata->deflink;
+ } else {
+ link = &sdata->deflink;
+ }
+
+ if (rx_data_pending) {
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+ rx_data_pending = false;
+ }
+
+ rx.sdata = sdata;
+ rx.local = sdata->local;
+ rx.link = link;
+ rx.link_id = link->link_id;
+ rx.sta = NULL;
+ rx.link_sta = NULL;
+
+ rx_data_pending = true;
}
+ if (rx_data_pending &&
+ ieee80211_prepare_and_rx_handle(&rx, skb, true))
+ return;
+
out:
dev_kfree_skb(skb);
}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 1/8] wifi: iwlwifi: use link_sta internally to the driver
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
Using the link_sta is a natural way to pass both the STA and the link ID
information at the same time. Use that internally to the driver in
preparation to mac80211 changing its API and adopting the same method.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 21 +++++----
drivers/net/wireless/intel/iwlwifi/mld/agg.h | 4 +-
drivers/net/wireless/intel/iwlwifi/mld/rx.c | 45 ++++++++++---------
drivers/net/wireless/intel/iwlwifi/mld/rx.h | 2 +-
.../wireless/intel/iwlwifi/mld/tests/agg.c | 7 +--
5 files changed, 42 insertions(+), 37 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
index 3bf36f8f6874..c4f3552bd2ab 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
@@ -1,13 +1,14 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2024-2025 Intel Corporation
+ * Copyright (C) 2024-2026 Intel Corporation
*/
#include "agg.h"
#include "sta.h"
#include "hcmd.h"
static void
-iwl_mld_reorder_release_frames(struct iwl_mld *mld, struct ieee80211_sta *sta,
+iwl_mld_reorder_release_frames(struct iwl_mld *mld,
+ struct ieee80211_link_sta *link_sta,
struct napi_struct *napi,
struct iwl_mld_baid_data *baid_data,
struct iwl_mld_reorder_buffer *reorder_buf,
@@ -32,7 +33,7 @@ iwl_mld_reorder_release_frames(struct iwl_mld *mld, struct ieee80211_sta *sta,
while ((skb = __skb_dequeue(skb_list))) {
iwl_mld_pass_packet_to_mac80211(mld, napi, skb,
reorder_buf->queue,
- sta);
+ link_sta);
reorder_buf->num_stored--;
}
}
@@ -71,7 +72,7 @@ static void iwl_mld_release_frames_from_notif(struct iwl_mld *mld,
reorder_buf = &ba_data->reorder_buf[queue];
- iwl_mld_reorder_release_frames(mld, link_sta->sta, napi, ba_data,
+ iwl_mld_reorder_release_frames(mld, link_sta, napi, ba_data,
reorder_buf, nssn);
out_unlock:
rcu_read_unlock();
@@ -174,7 +175,7 @@ void iwl_mld_del_ba(struct iwl_mld *mld, int queue,
reorder_buf = &ba_data->reorder_buf[queue];
/* release all frames that are in the reorder buffer to the stack */
- iwl_mld_reorder_release_frames(mld, link_sta->sta, NULL,
+ iwl_mld_reorder_release_frames(mld, link_sta, NULL,
ba_data, reorder_buf,
ieee80211_sn_add(reorder_buf->head_sn,
ba_data->buf_size));
@@ -187,14 +188,14 @@ void iwl_mld_del_ba(struct iwl_mld *mld, int queue,
*/
enum iwl_mld_reorder_result
iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
- int queue, struct ieee80211_sta *sta,
+ int queue, struct ieee80211_link_sta *link_sta,
struct sk_buff *skb, struct iwl_rx_mpdu_desc *desc)
{
struct ieee80211_hdr *hdr = (void *)skb_mac_header(skb);
struct iwl_mld_baid_data *baid_data;
struct iwl_mld_reorder_buffer *buffer;
struct iwl_mld_reorder_buf_entry *entries;
- struct iwl_mld_sta *mld_sta = iwl_mld_sta_from_mac80211(sta);
+ struct iwl_mld_sta *mld_sta;
struct iwl_mld_link_sta *mld_link_sta;
u32 reorder = le32_to_cpu(desc->reorder_data);
bool amsdu, last_subframe, is_old_sn, is_dup;
@@ -217,10 +218,12 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
return IWL_MLD_PASS_SKB;
/* no sta yet */
- if (WARN_ONCE(!sta,
+ if (WARN_ONCE(!link_sta,
"Got valid BAID without a valid station assigned\n"))
return IWL_MLD_PASS_SKB;
+ mld_sta = iwl_mld_sta_from_mac80211(link_sta->sta);
+
/* not a data packet */
if (!ieee80211_is_data_qos(hdr->frame_control) ||
is_multicast_ether_addr(hdr->addr1))
@@ -310,7 +313,7 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
* will be released when the frame release notification arrives.
*/
if (!amsdu || last_subframe)
- iwl_mld_reorder_release_frames(mld, sta, napi, baid_data,
+ iwl_mld_reorder_release_frames(mld, link_sta, napi, baid_data,
buffer, nssn);
else if (buffer->num_stored == 1)
buffer->head_sn = nssn;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.h b/drivers/net/wireless/intel/iwlwifi/mld/agg.h
index 651c80d1c7cd..c6cd5fa219be 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
/*
- * Copyright (C) 2024 Intel Corporation
+ * Copyright (C) 2024, 2026 Intel Corporation
*/
#ifndef __iwl_agg_h__
#define __iwl_agg_h__
@@ -106,7 +106,7 @@ int iwl_mld_ampdu_rx_stop(struct iwl_mld *mld, struct ieee80211_sta *sta,
enum iwl_mld_reorder_result
iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi,
- int queue, struct ieee80211_sta *sta,
+ int queue, struct ieee80211_link_sta *link_sta,
struct sk_buff *skb, struct iwl_rx_mpdu_desc *desc);
void iwl_mld_handle_frame_release_notif(struct iwl_mld *mld,
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/rx.c b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
index 214dcfde2fb4..de2feeb74009 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
@@ -48,7 +48,8 @@ iwl_mld_fill_phy_data_from_mpdu(struct iwl_mld *mld,
}
static inline int iwl_mld_check_pn(struct iwl_mld *mld, struct sk_buff *skb,
- int queue, struct ieee80211_sta *sta)
+ int queue,
+ struct ieee80211_link_sta *link_sta)
{
struct ieee80211_hdr *hdr = (void *)skb_mac_header(skb);
struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
@@ -72,13 +73,13 @@ static inline int iwl_mld_check_pn(struct iwl_mld *mld, struct sk_buff *skb,
return 0;
/* if we are here - this for sure is either CCMP or GCMP */
- if (!sta) {
+ if (!link_sta) {
IWL_DEBUG_DROP(mld,
"expected hw-decrypted unicast frame for station\n");
return -1;
}
- mld_sta = iwl_mld_sta_from_mac80211(sta);
+ mld_sta = iwl_mld_sta_from_mac80211(link_sta->sta);
extiv = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
keyidx = extiv[3] >> 6;
@@ -120,17 +121,17 @@ static inline int iwl_mld_check_pn(struct iwl_mld *mld, struct sk_buff *skb,
void iwl_mld_pass_packet_to_mac80211(struct iwl_mld *mld,
struct napi_struct *napi,
struct sk_buff *skb, int queue,
- struct ieee80211_sta *sta)
+ struct ieee80211_link_sta *link_sta)
{
KUNIT_STATIC_STUB_REDIRECT(iwl_mld_pass_packet_to_mac80211,
- mld, napi, skb, queue, sta);
+ mld, napi, skb, queue, link_sta);
- if (unlikely(iwl_mld_check_pn(mld, skb, queue, sta))) {
+ if (unlikely(iwl_mld_check_pn(mld, skb, queue, link_sta))) {
kfree_skb(skb);
return;
}
- ieee80211_rx_napi(mld->hw, sta, skb, napi);
+ ieee80211_rx_napi(mld->hw, link_sta->sta, skb, napi);
}
EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mld_pass_packet_to_mac80211);
@@ -1728,7 +1729,7 @@ static void iwl_mld_update_last_rx_timestamp(struct iwl_mld *mld, u8 baid)
* Sets *drop to true if the packet should be dropped.
* Returns the station if found, or NULL otherwise.
*/
-static struct ieee80211_sta *
+static struct ieee80211_link_sta *
iwl_mld_rx_with_sta(struct iwl_mld *mld, struct ieee80211_hdr *hdr,
struct sk_buff *skb,
const struct iwl_rx_mpdu_desc *mpdu_desc,
@@ -1803,10 +1804,10 @@ iwl_mld_rx_with_sta(struct iwl_mld *mld, struct ieee80211_hdr *hdr,
queue);
}
- return sta;
+ return link_sta;
}
-static int iwl_mld_rx_mgmt_prot(struct ieee80211_sta *sta,
+static int iwl_mld_rx_mgmt_prot(struct ieee80211_link_sta *link_sta,
struct ieee80211_hdr *hdr,
struct ieee80211_rx_status *rx_status,
u32 mpdu_status,
@@ -1820,7 +1821,6 @@ static int iwl_mld_rx_mgmt_prot(struct ieee80211_sta *sta,
struct ieee80211_key_conf *key;
const u8 *frame = (void *)hdr;
const u8 *mmie;
- u8 link_id;
if ((mpdu_status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
IWL_RX_MPDU_STATUS_SEC_NONE)
@@ -1836,10 +1836,10 @@ static int iwl_mld_rx_mgmt_prot(struct ieee80211_sta *sta,
if (!ieee80211_is_beacon(hdr->frame_control))
return 0;
- if (!sta)
+ if (!link_sta)
return -1;
- mld_sta = iwl_mld_sta_from_mac80211(sta);
+ mld_sta = iwl_mld_sta_from_mac80211(link_sta->sta);
mld_vif = iwl_mld_vif_from_mac80211(mld_sta->vif);
/* key mismatch - will also report !MIC_OK but we shouldn't count it */
@@ -1853,8 +1853,7 @@ static int iwl_mld_rx_mgmt_prot(struct ieee80211_sta *sta,
return 0;
}
- link_id = rx_status->link_valid ? rx_status->link_id : 0;
- link = rcu_dereference(mld_vif->link[link_id]);
+ link = rcu_dereference(mld_vif->link[link_sta->link_id]);
if (WARN_ON_ONCE(!link))
return -1;
@@ -1905,7 +1904,7 @@ static int iwl_mld_rx_mgmt_prot(struct ieee80211_sta *sta,
}
static int iwl_mld_rx_crypto(struct iwl_mld *mld,
- struct ieee80211_sta *sta,
+ struct ieee80211_link_sta *link_sta,
struct ieee80211_hdr *hdr,
struct ieee80211_rx_status *rx_status,
struct iwl_rx_mpdu_desc *desc, int queue,
@@ -1915,7 +1914,7 @@ static int iwl_mld_rx_crypto(struct iwl_mld *mld,
if (unlikely(ieee80211_is_mgmt(hdr->frame_control) &&
!ieee80211_has_protected(hdr->frame_control)))
- return iwl_mld_rx_mgmt_prot(sta, hdr, rx_status, status,
+ return iwl_mld_rx_mgmt_prot(link_sta, hdr, rx_status, status,
le16_to_cpu(desc->mpdu_len));
if (!ieee80211_has_protected(hdr->frame_control) ||
@@ -2023,7 +2022,7 @@ void iwl_mld_rx_mpdu(struct iwl_mld *mld, struct napi_struct *napi,
struct iwl_rx_packet *pkt = rxb_addr(rxb);
struct iwl_mld_rx_phy_data phy_data = {};
struct iwl_rx_mpdu_desc *mpdu_desc = (void *)pkt->data;
- struct ieee80211_sta *sta;
+ struct ieee80211_link_sta *link_sta;
struct ieee80211_hdr *hdr;
struct sk_buff *skb;
size_t mpdu_desc_size = sizeof(*mpdu_desc);
@@ -2086,7 +2085,8 @@ void iwl_mld_rx_mpdu(struct iwl_mld *mld, struct napi_struct *napi,
rcu_read_lock();
- sta = iwl_mld_rx_with_sta(mld, hdr, skb, mpdu_desc, pkt, queue, &drop);
+ link_sta = iwl_mld_rx_with_sta(mld, hdr, skb, mpdu_desc, pkt, queue,
+ &drop);
if (drop)
goto drop;
@@ -2127,7 +2127,7 @@ void iwl_mld_rx_mpdu(struct iwl_mld *mld, struct napi_struct *napi,
iwl_mld_rx_fill_status(mld, link_id, hdr, skb, &phy_data);
- if (iwl_mld_rx_crypto(mld, sta, hdr, rx_status, mpdu_desc, queue,
+ if (iwl_mld_rx_crypto(mld, link_sta, hdr, rx_status, mpdu_desc, queue,
le32_to_cpu(pkt->len_n_flags), &crypto_len))
goto drop;
@@ -2140,7 +2140,8 @@ void iwl_mld_rx_mpdu(struct iwl_mld *mld, struct napi_struct *napi,
if (iwl_mld_time_sync_frame(mld, skb, hdr->addr2))
goto out;
- reorder_res = iwl_mld_reorder(mld, napi, queue, sta, skb, mpdu_desc);
+ reorder_res = iwl_mld_reorder(mld, napi, queue, link_sta, skb,
+ mpdu_desc);
switch (reorder_res) {
case IWL_MLD_PASS_SKB:
break;
@@ -2153,7 +2154,7 @@ void iwl_mld_rx_mpdu(struct iwl_mld *mld, struct napi_struct *napi,
goto drop;
}
- iwl_mld_pass_packet_to_mac80211(mld, napi, skb, queue, sta);
+ iwl_mld_pass_packet_to_mac80211(mld, napi, skb, queue, link_sta);
goto out;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/rx.h b/drivers/net/wireless/intel/iwlwifi/mld/rx.h
index 09dddbd40f55..a54f1a6146ee 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/rx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/rx.h
@@ -64,7 +64,7 @@ void iwl_mld_handle_rx_queues_sync_notif(struct iwl_mld *mld,
void iwl_mld_pass_packet_to_mac80211(struct iwl_mld *mld,
struct napi_struct *napi,
struct sk_buff *skb, int queue,
- struct ieee80211_sta *sta);
+ struct ieee80211_link_sta *link_sta);
void iwl_mld_handle_phy_air_sniffer_notif(struct iwl_mld *mld,
struct napi_struct *napi,
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tests/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/tests/agg.c
index 29b0248cec3d..e9efe2996f07 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/tests/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tests/agg.c
@@ -2,7 +2,7 @@
/*
* KUnit tests for channel helper functions
*
- * Copyright (C) 2024-2025 Intel Corporation
+ * Copyright (C) 2024-2026 Intel Corporation
*/
#include <kunit/test.h>
#include <kunit/static_stub.h>
@@ -441,7 +441,7 @@ static void
fake_iwl_mld_pass_packet_to_mac80211(struct iwl_mld *mld,
struct napi_struct *napi,
struct sk_buff *skb, int queue,
- struct ieee80211_sta *sta)
+ struct ieee80211_link_sta *link_sta)
{
__skb_queue_tail(&g_released_skbs, skb);
g_num_released_skbs++;
@@ -630,7 +630,8 @@ static void test_reorder_buffer(struct kunit *test)
mpdu_desc = setup_mpdu_desc();
rcu_read_lock();
- reorder_res = iwl_mld_reorder(mld, NULL, QUEUE, sta, skb, mpdu_desc);
+ reorder_res = iwl_mld_reorder(mld, NULL, QUEUE, &sta->deflink, skb,
+ mpdu_desc);
rcu_read_unlock();
KUNIT_ASSERT_EQ(test, reorder_res, param->expected.reorder_res);
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 2/8] wifi: mac80211: change public RX API to use link stations
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
In-Reply-To: <20260220141929.206976-10-benjamin@sipsolutions.net>
From: Benjamin Berg <benjamin.berg@intel.com>
If a station is passed then the link ID also needs to be known. As such,
it is a more natural API to simply pass the link station directly rather
than pushing the link information into the RX status.
Furthermore, having the link ID in the RX status is not actually correct
because the link IDs are VIF specific and there may be multiple VIFs. In
the case of a station this relationship is clear, but then one may as
well use the link station.
This patch only changes the API and emulates the old (incorrect)
behaviour for now. The mac80211 RX code will be updated in later
patches.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---
This is obviously incomplete. Though one can adjust drivers easily by
passing sta->link[status->link_id] as that information has been
prepared.
---
drivers/net/wireless/intel/iwlwifi/mld/rx.c | 7 +------
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 6 +++---
drivers/net/wireless/virtual/mac80211_hwsim.c | 3 ---
include/net/mac80211.h | 16 +++++++++++----
net/mac80211/rx.c | 20 ++++++++++++++-----
6 files changed, 32 insertions(+), 22 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/rx.c b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
index de2feeb74009..2a12ae412bfd 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/rx.c
@@ -131,7 +131,7 @@ void iwl_mld_pass_packet_to_mac80211(struct iwl_mld *mld,
return;
}
- ieee80211_rx_napi(mld->hw, link_sta->sta, skb, napi);
+ ieee80211_rx_napi(mld->hw, link_sta, skb, napi);
}
EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mld_pass_packet_to_mac80211);
@@ -1765,11 +1765,6 @@ iwl_mld_rx_with_sta(struct iwl_mld *mld, struct ieee80211_hdr *hdr,
rx_status = IEEE80211_SKB_RXCB(skb);
- if (link_sta && sta->valid_links) {
- rx_status->link_valid = true;
- rx_status->link_id = link_sta->link_id;
- }
-
/* fill checksum */
if (ieee80211_is_data(hdr->frame_control) &&
pkt->len_n_flags & cpu_to_le32(FH_RSCSR_RPA_EN)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index d0c0faae0122..a83bede06487 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -90,7 +90,7 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
fraglen, rxb->truesize);
}
- ieee80211_rx_napi(mvm->hw, sta, skb, napi);
+ ieee80211_rx_napi(mvm->hw, &sta->deflink, skb, napi);
}
/*
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 7f0b4f5daa21..fe5a2d0a798b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation
* Copyright (C) 2013-2015 Intel Mobile Communications GmbH
* Copyright (C) 2015-2017 Intel Deutschland GmbH
*/
@@ -243,7 +243,7 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
return;
}
- ieee80211_rx_napi(mvm->hw, sta, skb, napi);
+ ieee80211_rx_napi(mvm->hw, &sta->deflink, skb, napi);
}
static bool iwl_mvm_used_average_energy(struct iwl_mvm *mvm,
@@ -2528,7 +2528,7 @@ void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
}
rcu_read_lock();
- ieee80211_rx_napi(mvm->hw, sta, skb, napi);
+ ieee80211_rx_napi(mvm->hw, &sta->deflink, skb, napi);
rcu_read_unlock();
}
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 4d9f5f87e814..7d529aa129f8 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -1755,9 +1755,6 @@ static void mac80211_hwsim_rx(struct mac80211_hwsim_data *data,
sp->active_links_rx &= ~BIT(link_id);
else
sp->active_links_rx |= BIT(link_id);
-
- rx_status->link_valid = true;
- rx_status->link_id = link_id;
}
rcu_read_unlock();
}
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 7f9d96939a4e..4d9dbd35369b 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -5207,14 +5207,18 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw);
* mixed for a single hardware. Must not run concurrently with
* ieee80211_tx_status_skb() or ieee80211_tx_status_ni().
*
+ * For data frames, when hardware has done address translation, a link station
+ * has to be provided and the frequency information may be skipped.
+ *
* This function must be called with BHs disabled and RCU read lock
*
* @hw: the hardware this frame came in on
- * @sta: the station the frame was received from, or %NULL
+ * @link_sta: the link station the data frame was received from, or %NULL
* @skb: the buffer to receive, owned by mac80211 after this call
* @list: the destination list
*/
-void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+void ieee80211_rx_list(struct ieee80211_hw *hw,
+ struct ieee80211_link_sta *link_sta,
struct sk_buff *skb, struct list_head *list);
/**
@@ -5232,14 +5236,18 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
* mixed for a single hardware. Must not run concurrently with
* ieee80211_tx_status_skb() or ieee80211_tx_status_ni().
*
+ * For data frames, when hardware has done address translation, a link station
+ * has to be provided and the frequency information may be skipped.
+ *
* This function must be called with BHs disabled.
*
* @hw: the hardware this frame came in on
- * @sta: the station the frame was received from, or %NULL
+ * @link_sta: the link station the data frame was received from, or %NULL
* @skb: the buffer to receive, owned by mac80211 after this call
* @napi: the NAPI context
*/
-void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+void ieee80211_rx_napi(struct ieee80211_hw *hw,
+ struct ieee80211_link_sta *link_sta,
struct sk_buff *skb, struct napi_struct *napi);
/**
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 11d6c56c9d7e..4098f63ec824 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5432,7 +5432,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
* This is the receive path handler. It is called by a low level driver when an
* 802.11 MPDU is received from the hardware.
*/
-void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
+void ieee80211_rx_list(struct ieee80211_hw *hw,
+ struct ieee80211_link_sta *link_pubsta,
struct sk_buff *skb, struct list_head *list)
{
struct ieee80211_local *local = hw_to_local(hw);
@@ -5440,6 +5441,7 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
struct ieee80211_supported_band *sband;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ struct ieee80211_sta *pubsta;
WARN_ON_ONCE(softirq_count() == 0);
@@ -5562,8 +5564,15 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
}
}
- if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
- goto drop;
+ /* FIXME: Emulate the old driver behaviour for now */
+ if (link_pubsta) {
+ status->link_valid = 1;
+ status->link_id = link_pubsta->link_id;
+ pubsta = link_pubsta->sta;
+ } else {
+ status->link_valid = 0;
+ pubsta = NULL;
+ }
status->rx_flags = 0;
@@ -5595,7 +5604,8 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
}
EXPORT_SYMBOL(ieee80211_rx_list);
-void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
+void ieee80211_rx_napi(struct ieee80211_hw *hw,
+ struct ieee80211_link_sta *link_pubsta,
struct sk_buff *skb, struct napi_struct *napi)
{
struct sk_buff *tmp;
@@ -5608,7 +5618,7 @@ void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
* receive processing
*/
rcu_read_lock();
- ieee80211_rx_list(hw, pubsta, skb, &list);
+ ieee80211_rx_list(hw, link_pubsta, skb, &list);
rcu_read_unlock();
if (!napi) {
--
2.53.0
^ permalink raw reply related
* [RFC PATCH 0/8] Adding NO_STA flag and reworking RX link resolution
From: Benjamin Berg @ 2026-02-20 14:19 UTC (permalink / raw)
To: linux-wireless; +Cc: Rameshkumar Sundaram, Ramasamy Kaliappan, Benjamin Berg
From: Benjamin Berg <benjamin.berg@intel.com>
Hi,
This patchset refactors the RX link resolution a bit to fix some issues
where mac80211 might accept frames on the wrong link and incorrectly
translate the address. It also adds a new NL80211_ATTR_FRAME_CMD_NO_STA
flag so that userspace can know whether address translation was done by
the kernel on RX and can also prevent address translation for management
frames during TX.
This together should be enough to fix the existing issues in hostapd
where stations that are still associated try to authenticate again but
hostapd for example ends up sending the frame to an old link address.
I would appreciate if you test the patches and work on the hostapd side.
Note that I have not properly verified the new nl80211 API, so it could
well be that I missed something.
Benjamin
Benjamin Berg (8):
wifi: iwlwifi: use link_sta internally to the driver
wifi: mac80211: change public RX API to use link stations
wifi: mac80211: refactor RX link_id and station handling
wifi: mac80211: rework RX packet handling
wifi: cfg80211: add attribute for TX/RX denoting there is no station
wifi: mac80211: report to cfg80211 when no STA is known for a frame
wifi: mac80211: pass station to ieee80211_tx_skb_tid
wifi: mac80211: pass error station if non-STA transmit was requested
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 21 +-
drivers/net/wireless/intel/iwlwifi/mld/agg.h | 4 +-
drivers/net/wireless/intel/iwlwifi/mld/rx.c | 50 +-
drivers/net/wireless/intel/iwlwifi/mld/rx.h | 2 +-
.../wireless/intel/iwlwifi/mld/tests/agg.c | 7 +-
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 6 +-
drivers/net/wireless/virtual/mac80211_hwsim.c | 3 -
include/net/cfg80211.h | 4 +
include/net/mac80211.h | 25 +-
include/uapi/linux/nl80211.h | 7 +
net/mac80211/agg-tx.c | 6 +-
net/mac80211/eht.c | 3 -
net/mac80211/ht.c | 4 +-
net/mac80211/ieee80211_i.h | 14 +-
net/mac80211/iface.c | 7 +-
net/mac80211/mlme.c | 9 +-
net/mac80211/offchannel.c | 13 +-
net/mac80211/rx.c | 438 ++++++++++--------
net/mac80211/scan.c | 10 +-
net/mac80211/tdls.c | 4 +-
net/mac80211/tx.c | 8 +-
net/wireless/nl80211.c | 8 +-
23 files changed, 358 insertions(+), 297 deletions(-)
--
2.53.0
^ permalink raw reply
* RE: [PATCH v4 wireless-next 03/15] wifi: nl80211/cfg80211: support stations of non-netdev interfaces
From: Korenblit, Miriam Rachel @ 2026-02-20 11:22 UTC (permalink / raw)
To: Jeff Johnson, linux-wireless@vger.kernel.org
In-Reply-To: <68db44c5-0a81-4451-bbb4-1e211d6b7cde@oss.qualcomm.com>
> -----Original Message-----
> From: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
> Sent: Friday, February 20, 2026 3:24 AM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@intel.com>; linux-
> wireless@vger.kernel.org
> Subject: Re: [PATCH v4 wireless-next 03/15] wifi: nl80211/cfg80211: support
> stations of non-netdev interfaces
>
> On 2/19/2026 1:47 AM, Miri Korenblit wrote:
> > diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c
> > b/drivers/net/wireless/ath/ath6kl/cfg80211.c
> > index 88f0197fc041..eecba2201b10 100644
> > --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
> > +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
> > @@ -1775,9 +1775,10 @@ static bool is_rate_ht40(s32 rate, u8 *mcs, bool
> *sgi)
> > return false;
> > }
> >
> > -static int ath6kl_get_station(struct wiphy *wiphy, struct net_device
> > *dev,
> > +static int ath6kl_get_station(struct wiphy *wiphy, struct
> > +wireless_dev *wdev,
> > const u8 *mac, struct station_info *sinfo) {
> > + struct net_device *dev = wdev->netdev;
>
> with the upcoming logic will it ever be possible that wdev->netdev is NULL?
> just want to make sure everything is still safe
No, it is explicitly checked in nl80211_get_station.
In cfg80211_cqm_rssi_update and nl80211_probe_mesh_link - the wdev is fetched from a dev instance itself.
>
> > struct ath6kl *ar = ath6kl_priv(dev);
> > struct ath6kl_vif *vif = netdev_priv(dev);
> > long left;
^ permalink raw reply
* Re: [PATCH] wifi: rt2x00: use non of nvmem_cell_get
From: Stanislaw Gruszka @ 2026-02-20 10:37 UTC (permalink / raw)
To: Rosen Penev; +Cc: linux-wireless, open list
In-Reply-To: <20260220020908.40115-1-rosenp@gmail.com>
On Thu, Feb 19, 2026 at 06:09:08PM -0800, Rosen Penev wrote:
> The library doesn't necessarily depend on OF. This codepath is used by
> both soc (OF only) and pci (no such requirement). After this, the only
> of specific function is of_get_mac_address, which is needed for nvmem.
>
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
> ---
> drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
> index 65d0f805459c..93e4ce604171 100644
> --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
> +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
> @@ -10965,13 +10965,13 @@ EXPORT_SYMBOL_GPL(rt2800_read_eeprom_efuse);
>
> int rt2800_read_eeprom_nvmem(struct rt2x00_dev *rt2x00dev)
> {
> - struct device_node *np = rt2x00dev->dev->of_node;
> + struct device *dev = rt2x00dev->dev;
> unsigned int len = rt2x00dev->ops->eeprom_size;
> struct nvmem_cell *cell;
> const void *data;
> size_t retlen;
>
> - cell = of_nvmem_cell_get(np, "eeprom");
> + cell = nvmem_cell_get(dev, "eeprom");
> if (IS_ERR(cell))
> return PTR_ERR(cell);
>
> --
> 2.53.0
>
^ permalink raw reply
* Re: [PATCH 03/11] wifi: mt76: mt7921: handle MT7902 irq_map quirk with mutable copy
From: Philip Müller @ 2026-02-20 10:09 UTC (permalink / raw)
To: sean.wang, nbd, lorenzo.bianconi
Cc: linux-wireless, linux-mediatek, Sean Wang, Xiong Huang
In-Reply-To: <20260219004007.19733-3-sean.wang@kernel.org>
Hi Sean,
on Linus master tree we still have 'mt76_mmio_init(&dev->mt76,
pcim_iomap_table(pdev)[0]);', hence your patch currently won't apply.
On 2/19/26 01:39, sean.wang@kernel.org wrote:
> From: Sean Wang <sean.wang@mediatek.com>
>
> MT7902 PCIe requires a different wm2_complete_mask value, so introduce a
> mutable per-device copy of the default irq_map and override the field
> only for this chip. Other devices continue using the shared const
> template.
>
> This is a prerequisite patch before enabling MT7902 PCIe support.
>
> Co-developed-by: Xiong Huang <xiong.huang@mediatek.com>
> Signed-off-by: Xiong Huang <xiong.huang@mediatek.com>
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
> drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
> index 65c7fe671137..5f857a21f362 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
> @@ -327,6 +327,20 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
> dev->hif_ops = &mt7921_pcie_ops;
> dev->irq_map = &irq_map;
> mt76_mmio_init(&dev->mt76, regs);
> +
> + if (id->device == 0x7902) {
> + struct mt792x_irq_map *map;
> +
> + /* MT7902 needs a mutable copy because wm2_complete_mask differs */
> + map = devm_kmemdup(&pdev->dev, &irq_map,
> + sizeof(irq_map), GFP_KERNEL);
> + if (!map)
> + return -ENOMEM;
> +
> + map->rx.wm2_complete_mask = 0;
> + dev->irq_map = map;
> + }
> +
> tasklet_init(&mdev->irq_tasklet, mt792x_irq_tasklet, (unsigned long)dev);
>
> dev->phy.dev = dev;
--
Best, Philip
^ permalink raw reply
* Re: [PATCH ath-next v2] wifi: ath12k: add basic hwmon temperature reporting
From: Maharaja Kennadyrajan @ 2026-02-20 9:55 UTC (permalink / raw)
To: Jeff Johnson, Maharaja Kennadyrajan, ath12k; +Cc: linux-wireless, Aishwarya R
In-Reply-To: <6d8849c2-a58c-4aea-863f-6e4c335ea4cc@oss.qualcomm.com>
On 2/20/2026 3:14 AM, Jeff Johnson wrote:
> On 2/18/2026 11:34 PM, Maharaja Kennadyrajan wrote:
>> +int ath12k_thermal_register(struct ath12k_base *ab)
>> +{
>> + struct ath12k *ar;
>> + int i, j, ret;
>> +
>> + if (!IS_REACHABLE(CONFIG_HWMON))
>> + return 0;
>> +
>> + for (i = 0; i < ab->num_radios; i++) {
>> + ar = ab->pdevs[i].ar;
>> + if (!ar)
>> + continue;
>> +
>> + ar->thermal.hwmon_dev =
>> + hwmon_device_register_with_groups(&ar->ah->hw->wiphy->dev,
>> + "ath12k_hwmon", ar,
>> + ath12k_hwmon_groups);
> ath10k and ath11k use devm_hwmon_device_register_with_groups().
> why doesn't ath12k do the same?
> then the code below and in _unregister() that calls hwmon_device_unregister()
> would be unnecessary since the objects would be reclaimed when the dev is
> destroyed.
ath12k_thermal_register() loops all radios and devm-registers hwmon devices. If registration fails for radio N, it returns an error that bubbles up and 'ath12k_core_pdev_create()' unwinds only DP ('ath12k_dp_pdev_free()'),
while already-registered hwmon devices for earlier radios remain bound to `wiphy->dev` via devm. If bring-up aborts (pdev_create fails), those hwmon sysfs nodes may persist until the 'wiphy' device is finally destroyed,
which can be much later or never if the bring-up stops early. It will impact resource/sysfs leak window and possible user-visible stale hwmon entries in failure paths.
Given this, using hwmon_device_register_with_groups() plus explicit unregister keeps lifecycle handling predictable and aligned with ath12k’s recovery paths.
>> + if (IS_ERR(ar->thermal.hwmon_dev)) {
>> + ret = PTR_ERR(ar->thermal.hwmon_dev);
>> + ar->thermal.hwmon_dev = NULL;
>> + ath12k_err(ar->ab, "failed to register hwmon device: %d\n",
>> + ret);
>> + for (j = i - 1; j >= 0; j--) {
>> + ar = ab->pdevs[i].ar;
>> + if (!ar)
>> + continue;
>> +
>> + hwmon_device_unregister(ar->thermal.hwmon_dev);
>> + ar->thermal.hwmon_dev = NULL;
>> + }
>> + return ret;
>> + }
>> + }
>> +
>> + return 0;
>> +}
>> +
>> +void ath12k_thermal_unregister(struct ath12k_base *ab)
>> +{
>> + struct ath12k *ar;
>> + int i;
>> +
>> + if (!IS_REACHABLE(CONFIG_HWMON))
>> + return;
>> +
>> + for (i = 0; i < ab->num_radios; i++) {
>> + ar = ab->pdevs[i].ar;
>> + if (!ar)
>> + continue;
>> +
>> + if (ar->thermal.hwmon_dev) {
>> + hwmon_device_unregister(ar->thermal.hwmon_dev);
>> + ar->thermal.hwmon_dev = NULL;
>> + }
>> + }
>> +}
^ permalink raw reply
* [PATCH rtw-next] wifi: rtw88: check for PCI upstream bridge existence
From: Fedor Pchelkin @ 2026-02-20 9:47 UTC (permalink / raw)
To: Ping-Ke Shih
Cc: Fedor Pchelkin, Jian-Hong Pan, Kalle Valo, Kai-Heng Feng,
linux-wireless, linux-kernel, Bitterblue Smith, Dmitry Antipov,
lvc-project, stable
pci_upstream_bridge() returns NULL if the device is on a root bus. If
8821CE is installed in the system with such a PCI topology, the probing
routine will crash. This has probably been unnoticed as 8821CE is mostly
supplied in laptops where there is a PCI-to-PCI bridge located upstream
from the device. However the card might be installed on a system with
different configuration.
Check if the bridge does exist for the specific workaround to be applied.
Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.
Fixes: 24f5e38a13b5 ("rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
---
I don't have 8821CE but 8822CE instead and I've been able to reproduce the
NULL bridge pointer dereference with rtwdev->chip->id manually adjusted in
the workaround. Wifi devices happen to be located on a root bus in most
of the systems I have access to.
drivers/net/wireless/realtek/rtw88/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index 56b16186d3aa..ec0a45bfb670 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -1804,7 +1804,8 @@ int rtw_pci_probe(struct pci_dev *pdev,
}
/* Disable PCIe ASPM L1 while doing NAPI poll for 8821CE */
- if (rtwdev->chip->id == RTW_CHIP_TYPE_8821C && bridge->vendor == PCI_VENDOR_ID_INTEL)
+ if (rtwdev->chip->id == RTW_CHIP_TYPE_8821C &&
+ bridge && bridge->vendor == PCI_VENDOR_ID_INTEL)
rtwpci->rx_no_aspm = true;
rtw_pci_phy_cfg(rtwdev);
--
2.51.0
^ permalink raw reply related
* Re: [PATCH ath-next v2] wifi: ath12k: add basic hwmon temperature reporting
From: Nicolas Escande @ 2026-02-20 9:26 UTC (permalink / raw)
To: Jeff Johnson, Nicolas Escande, Maharaja Kennadyrajan, ath12k
Cc: linux-wireless, Aishwarya R
In-Reply-To: <017ec99b-693f-47e5-ac38-6c207a32eb62@oss.qualcomm.com>
On Thu Feb 19, 2026 at 10:37 PM CET, Jeff Johnson wrote:
> On 2/19/2026 1:15 AM, Nicolas Escande wrote:
>> On Thu Feb 19, 2026 at 8:34 AM CET, Maharaja Kennadyrajan wrote:
>>> +ath12k-$(CONFIG_THERMAL) += thermal.o
>>>
>>
>> I may be wrong but I do not see Kconfig changes that allows to actually build
>> the new files. Is this intended ?
>
> There is no configuration specifically for the driver -- it just follows
> whatever has been configured globally. So CONFIG_THERMAL would need to be
> enabled to have the file compiled, and CONFIG_HWMON would need to be enabled
> to have the sysfs file exposed. ath10k and ath11k have the same logic.
>
> /jeff
Silly me, thanks.
^ permalink raw reply
* Re: [PATCH 14/15] wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac()
From: Johannes Berg @ 2026-02-20 9:01 UTC (permalink / raw)
To: Eric Biggers
Cc: linux-crypto, linux-kernel, Ard Biesheuvel, Jason A . Donenfeld,
Herbert Xu, linux-arm-kernel, linux-cifs, linux-wireless
In-Reply-To: <20260219220211.GB32578@quark>
On Thu, 2026-02-19 at 14:02 -0800, Eric Biggers wrote:
> > Looks good to me in principle, I suppose we should test it? :)
>
> Yes, I don't expect any issues, but testing of this patch would be
> appreciated. I don't know how to test every kernel subsystem.
Done, works fine. I checked FILS (which is against hostapd userspace
implementation) and validated the MME MIC against wlantest.
> > > + err = aes_cmac_preparekey(&key->u.aes_cmac.key, key_data,
> > > + key_len);
> > > + if (err) {
> > > kfree(key);
> > > return ERR_PTR(err);
> > > }
> >
> > Pretty sure that can't fail, per the documentation for
> > aes_prepareenckey() and then aes_cmac_preparekey(), but it doesn't
> > really matter. We can only get here with a key with size checked by
> > cfg80211_validate_key_settings() already.
>
> aes_cmac_preparekey() indeed always succeeds when passed a valid key
> length, as documented in its kerneldoc. But in this case I recommend
> just checking the error code anyway, since ieee80211_key_alloc() can
> already fail for other reasons (i.e., it needs the ability to report
> errors anyway) and the key length isn't a compile-time constant here.
Right, sure.
> > Since you're probably going to send it through the crypto tree:
> >
> > Acked-by: Johannes Berg <johannes@sipsolutions.net>
>
> For library conversions like this I've usually been taking the library
> itself through libcrypto-next, then sending the subsystem conversions
> afterwards for subsystem maintainers to take in the next release. But
> I'd also be glad to just take this alongside the library itself.
OK, whichever you prefer. Feel free to take it, this code did change
recently for some additional error checking, but it otherwise almost
never changes, so there shouldn't be conflicts.
johannes
^ permalink raw reply
* Re: [PATCH 15/15] wifi: mac80211: Use AES-CMAC library in aes_s2v()
From: Johannes Berg @ 2026-02-20 8:47 UTC (permalink / raw)
To: Eric Biggers
Cc: linux-crypto, linux-kernel, Ard Biesheuvel, Jason A . Donenfeld,
Herbert Xu, linux-arm-kernel, linux-cifs, linux-wireless
In-Reply-To: <20260219221527.GC32578@quark>
On Thu, 2026-02-19 at 14:15 -0800, Eric Biggers wrote:
> > > -static int aes_s2v(struct crypto_shash *tfm,
> > > +static int aes_s2v(const u8 *in_key, size_t key_len,
> > > size_t num_elem, const u8 *addr[], size_t len[], u8 *v)
> > > {
> > > u8 d[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE] = {};
> > > - SHASH_DESC_ON_STACK(desc, tfm);
> > > + struct aes_cmac_key key;
> > > + struct aes_cmac_ctx ctx;
> > > size_t i;
> > > + int res;
> > >
> > > - desc->tfm = tfm;
> > > + res = aes_cmac_preparekey(&key, in_key, key_len);
> > > + if (res)
> > > + return res;
> >
> > Same here, maybe, technically, but also doesn't matter.
> >
> > Acked-by: Johannes Berg <johannes@sipsolutions.net>
> >
> > johannes
>
> In this case aes_s2v() wouldn't otherwise be able to fail, so ignoring
> the aes_cmac_preparekey() return value would indeed be a simplification.
Right.
> However, since the key length isn't a compile-time constant here, we'd
> have to rely on non-local validation, which isn't ideal.
That's true.
> To ignore the return value entirely I'd prefer a static_assert that the
> length is equal to one of AES_KEYSIZE_*, which isn't possible here.
Indeed.
> It's actually not clear to me where the length validation happens before
> here. nl80211_associate() for example just copies the length from
> userspace without validating it. ieee80211_mgd_assoc() only checks that
> the length is at most FILS_MAX_KEK_LEN (64).
Oh, right, I forgot this was FILS and mixed it up with the previous
patch. We probably _should_ check it earlier there, but it won't be
local here either way, and we have the error paths already so that's
fine.
johannes
^ permalink raw reply
* [PATCH wireless-next] wifi: brcmfmac: of: defer probe for MAC address
From: Rosen Penev @ 2026-02-20 2:27 UTC (permalink / raw)
To: linux-wireless
Cc: Arend van Spriel,
open list:BROADCOM BRCM80211 IEEE802.11 WIRELESS DRIVERS,
open list:BROADCOM BRCM80211 IEEE802.11 WIRELESS DRIVERS,
open list
of_get_mac_address can return EPROBE_DEFER if the specific nvmem driver
has not been loaded yet.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
index 1681ad00f82e..03efae36a0b2 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
@@ -128,7 +128,9 @@ int brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
if (err)
brcmf_err("failed to get OF country code map (err=%d)\n", err);
- of_get_mac_address(np, settings->mac);
+ err = of_get_mac_address(np, settings->mac);
+ if (err == -EPROBE_DEFER)
+ return err;
if (bus_type != BRCMF_BUSTYPE_SDIO)
return 0;
--
2.53.0
^ permalink raw reply related
* [PATCH] wifi: rt2x00: use non of nvmem_cell_get
From: Rosen Penev @ 2026-02-20 2:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Stanislaw Gruszka, open list
The library doesn't necessarily depend on OF. This codepath is used by
both soc (OF only) and pci (no such requirement). After this, the only
of specific function is of_get_mac_address, which is needed for nvmem.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
index 65d0f805459c..93e4ce604171 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
@@ -10965,13 +10965,13 @@ EXPORT_SYMBOL_GPL(rt2800_read_eeprom_efuse);
int rt2800_read_eeprom_nvmem(struct rt2x00_dev *rt2x00dev)
{
- struct device_node *np = rt2x00dev->dev->of_node;
+ struct device *dev = rt2x00dev->dev;
unsigned int len = rt2x00dev->ops->eeprom_size;
struct nvmem_cell *cell;
const void *data;
size_t retlen;
- cell = of_nvmem_cell_get(np, "eeprom");
+ cell = nvmem_cell_get(dev, "eeprom");
if (IS_ERR(cell))
return PTR_ERR(cell);
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v4 wireless-next 04/15] wifi: cfg80211: refactor wiphy_suspend
From: Jeff Johnson @ 2026-02-20 1:25 UTC (permalink / raw)
To: Miri Korenblit, linux-wireless
In-Reply-To: <20260219094725.3846371-2-miriam.rachel.korenblit@intel.com>
On 2/19/2026 1:47 AM, Miri Korenblit wrote:
> The sequence of operations that needs to be done in wiphy_suspend is
> identical for the case where there is no wowlan configured, and for the
> case that it is but the driver refused to do wowlan (by returning 1 from
> rdev_suspend).
>
> The current code duplicates this set of operations for each one of the
> cases.
>
> In particular, next patch will change the locking of cfg80211_leave_all to
> not hold the wiphy lock, which will be easier to do if it is not called
> twice.
>
> Change the code to handle first the case that wowlan is configured, and
> then handle both cases (driver refused to do wowlan and no wowlan
> configured) in one place.
>
> Note that this changes the behaviour to set suspended=true also when
> we were not registered yet, but that makes sense anyway, as wiphy works
> can be queued also before registration.
>
> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
> Link: https://patch.msgid.link/20260108102921.00336669ac32.Id76f272662e1315cd93a628808cc2d1625036b00@changeid
> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
FYI my tooling says:
WARNING:BAD_SIGN_OFF: Duplicate signature
Note sure if Johannes cares...
^ permalink raw reply
* Re: [PATCH v4 wireless-next 03/15] wifi: nl80211/cfg80211: support stations of non-netdev interfaces
From: Jeff Johnson @ 2026-02-20 1:24 UTC (permalink / raw)
To: Miri Korenblit, linux-wireless
In-Reply-To: <20260219114327.65c9cc96f814.Ic02066b88bb8ad6b21e15cbea8d720280008c83b@changeid>
On 2/19/2026 1:47 AM, Miri Korenblit wrote:
> diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
> index 88f0197fc041..eecba2201b10 100644
> --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
> +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
> @@ -1775,9 +1775,10 @@ static bool is_rate_ht40(s32 rate, u8 *mcs, bool *sgi)
> return false;
> }
>
> -static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
> +static int ath6kl_get_station(struct wiphy *wiphy, struct wireless_dev *wdev,
> const u8 *mac, struct station_info *sinfo)
> {
> + struct net_device *dev = wdev->netdev;
with the upcoming logic will it ever be possible that wdev->netdev is NULL?
just want to make sure everything is still safe
> struct ath6kl *ar = ath6kl_priv(dev);
> struct ath6kl_vif *vif = netdev_priv(dev);
> long left;
^ permalink raw reply
* Re: [PATCH v4 wireless-next 02/15] wifi: cfg80211: remove unneeded call to cfg80211_leave
From: Jeff Johnson @ 2026-02-20 1:15 UTC (permalink / raw)
To: Miri Korenblit, linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260219114327.c43709c9d3af.I3179a28f237ea3b8ec368af720fbf77455a7763f@changeid>
On 2/19/2026 1:47 AM, Miri Korenblit wrote:
> In cfg80211_destroy_ifaces, we first close all netdev wdevs, which will
> trigger a NETDEV_GOING_DOWN event that will call cfg80211_leave,
> and for non-netdev wdevs, we call cfg80211_remove_virtual_intf which
> calles cfg80211_unregister_wdev, which handles the "leaving" for those
nit: s/calles/calls/
> interfaces (i.e. stop_nan and stop_p2p_device)
>
> Reviewed-by: Johannes Berg <johannes.berg@intel.com>
> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
> ---
> net/wireless/core.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/net/wireless/core.c b/net/wireless/core.c
> index 9af85d655027..328d3036d21f 100644
> --- a/net/wireless/core.c
> +++ b/net/wireless/core.c
> @@ -349,7 +349,6 @@ void cfg80211_destroy_ifaces(struct cfg80211_registered_device *rdev)
>
> guard(wiphy)(&rdev->wiphy);
>
> - cfg80211_leave(rdev, wdev, -1);
> cfg80211_remove_virtual_intf(rdev, wdev);
> }
> }
^ permalink raw reply
* Re: [PATCH 15/15] wifi: mac80211: Use AES-CMAC library in aes_s2v()
From: Eric Biggers @ 2026-02-19 22:15 UTC (permalink / raw)
To: Johannes Berg
Cc: linux-crypto, linux-kernel, Ard Biesheuvel, Jason A . Donenfeld,
Herbert Xu, linux-arm-kernel, linux-cifs, linux-wireless
In-Reply-To: <c62915b1956ee4c5d4bad9315f2bc44aeddbb9bc.camel@sipsolutions.net>
On Thu, Feb 19, 2026 at 12:01:14PM +0100, Johannes Berg wrote:
> On Wed, 2026-02-18 at 13:35 -0800, Eric Biggers wrote:
> > Now that AES-CMAC has a library API, convert aes_s2v() to use it instead
> > of a "cmac(aes)" crypto_shash. The result is faster and simpler code.
> >
> > It's also more reliable, since with the library the only step that can
> > fail is preparing the key. In contrast, crypto_shash_digest(),
> > crypto_shash_init(), crypto_shash_update(), and crypto_shash_final()
> > could all fail and return an errno value. aes_s2v() ignored these
> > errors, which was a bug. So that bug is fixed as well.
> >
> > As part of this, change the prototype of aes_s2v() to take the raw key
> > directly instead of a prepared key. Its only two callers prepare a key
> > for each call, so it might as well be done directly in aes_s2v().
> >
> > Since this removes the last dependency on the "cmac(aes)" crypto_shash
> > from mac80211, also remove the 'select CRYPTO_CMAC'.
> >
>
> > -static int aes_s2v(struct crypto_shash *tfm,
> > +static int aes_s2v(const u8 *in_key, size_t key_len,
> > size_t num_elem, const u8 *addr[], size_t len[], u8 *v)
> > {
> > u8 d[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE] = {};
> > - SHASH_DESC_ON_STACK(desc, tfm);
> > + struct aes_cmac_key key;
> > + struct aes_cmac_ctx ctx;
> > size_t i;
> > + int res;
> >
> > - desc->tfm = tfm;
> > + res = aes_cmac_preparekey(&key, in_key, key_len);
> > + if (res)
> > + return res;
>
> Same here, maybe, technically, but also doesn't matter.
>
> Acked-by: Johannes Berg <johannes@sipsolutions.net>
>
> johannes
In this case aes_s2v() wouldn't otherwise be able to fail, so ignoring
the aes_cmac_preparekey() return value would indeed be a simplification.
However, since the key length isn't a compile-time constant here, we'd
have to rely on non-local validation, which isn't ideal.
To ignore the return value entirely I'd prefer a static_assert that the
length is equal to one of AES_KEYSIZE_*, which isn't possible here.
It's actually not clear to me where the length validation happens before
here. nl80211_associate() for example just copies the length from
userspace without validating it. ieee80211_mgd_assoc() only checks that
the length is at most FILS_MAX_KEK_LEN (64).
- Eric
^ permalink raw reply
* Re: [PATCH 14/15] wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac()
From: Eric Biggers @ 2026-02-19 22:02 UTC (permalink / raw)
To: Johannes Berg
Cc: linux-crypto, linux-kernel, Ard Biesheuvel, Jason A . Donenfeld,
Herbert Xu, linux-arm-kernel, linux-cifs, linux-wireless
In-Reply-To: <c3b53ea083fa26c863c6a954d13bbd2ef91e1732.camel@sipsolutions.net>
On Thu, Feb 19, 2026 at 12:00:03PM +0100, Johannes Berg wrote:
> On Wed, 2026-02-18 at 13:35 -0800, Eric Biggers wrote:
> > Now that AES-CMAC has a library API, convert the mac80211 AES-CMAC
> > packet authentication code to use it instead of a "cmac(aes)"
> > crypto_shash. This has multiple benefits, such as:
> >
> > - It's faster. The AES-CMAC code is now called directly, without
> > unnecessary overhead such as indirect calls.
> >
> > - MAC calculation can no longer fail.
> >
> > - The AES-CMAC key struct is now a fixed size, allowing it to be
> > embedded directly into 'struct ieee80211_key' rather than using a
> > separate allocation. Note that although this increases the size of
> > the 'u.cmac' field of 'struct ieee80211_key', it doesn't cause it to
> > exceed the size of the largest variant of the union 'u'. Therefore,
> > the size of 'struct ieee80211_key' itself is unchanged.
> >
>
> Looks good to me in principle, I suppose we should test it? :)
Yes, I don't expect any issues, but testing of this patch would be
appreciated. I don't know how to test every kernel subsystem.
> > + err = aes_cmac_preparekey(&key->u.aes_cmac.key, key_data,
> > + key_len);
> > + if (err) {
> > kfree(key);
> > return ERR_PTR(err);
> > }
>
> Pretty sure that can't fail, per the documentation for
> aes_prepareenckey() and then aes_cmac_preparekey(), but it doesn't
> really matter. We can only get here with a key with size checked by
> cfg80211_validate_key_settings() already.
aes_cmac_preparekey() indeed always succeeds when passed a valid key
length, as documented in its kerneldoc. But in this case I recommend
just checking the error code anyway, since ieee80211_key_alloc() can
already fail for other reasons (i.e., it needs the ability to report
errors anyway) and the key length isn't a compile-time constant here.
> Since you're probably going to send it through the crypto tree:
>
> Acked-by: Johannes Berg <johannes@sipsolutions.net>
For library conversions like this I've usually been taking the library
itself through libcrypto-next, then sending the subsystem conversions
afterwards for subsystem maintainers to take in the next release. But
I'd also be glad to just take this alongside the library itself.
- Eric
^ permalink raw reply
* Re: [PATCH ath-next v2] wifi: ath12k: add basic hwmon temperature reporting
From: Jeff Johnson @ 2026-02-19 21:44 UTC (permalink / raw)
To: Maharaja Kennadyrajan, ath12k; +Cc: linux-wireless, Aishwarya R
In-Reply-To: <20260219073440.19618-1-maharaja.kennadyrajan@oss.qualcomm.com>
On 2/18/2026 11:34 PM, Maharaja Kennadyrajan wrote:
> +int ath12k_thermal_register(struct ath12k_base *ab)
> +{
> + struct ath12k *ar;
> + int i, j, ret;
> +
> + if (!IS_REACHABLE(CONFIG_HWMON))
> + return 0;
> +
> + for (i = 0; i < ab->num_radios; i++) {
> + ar = ab->pdevs[i].ar;
> + if (!ar)
> + continue;
> +
> + ar->thermal.hwmon_dev =
> + hwmon_device_register_with_groups(&ar->ah->hw->wiphy->dev,
> + "ath12k_hwmon", ar,
> + ath12k_hwmon_groups);
ath10k and ath11k use devm_hwmon_device_register_with_groups().
why doesn't ath12k do the same?
then the code below and in _unregister() that calls hwmon_device_unregister()
would be unnecessary since the objects would be reclaimed when the dev is
destroyed.
> + if (IS_ERR(ar->thermal.hwmon_dev)) {
> + ret = PTR_ERR(ar->thermal.hwmon_dev);
> + ar->thermal.hwmon_dev = NULL;
> + ath12k_err(ar->ab, "failed to register hwmon device: %d\n",
> + ret);
> + for (j = i - 1; j >= 0; j--) {
> + ar = ab->pdevs[i].ar;
> + if (!ar)
> + continue;
> +
> + hwmon_device_unregister(ar->thermal.hwmon_dev);
> + ar->thermal.hwmon_dev = NULL;
> + }
> + return ret;
> + }
> + }
> +
> + return 0;
> +}
> +
> +void ath12k_thermal_unregister(struct ath12k_base *ab)
> +{
> + struct ath12k *ar;
> + int i;
> +
> + if (!IS_REACHABLE(CONFIG_HWMON))
> + return;
> +
> + for (i = 0; i < ab->num_radios; i++) {
> + ar = ab->pdevs[i].ar;
> + if (!ar)
> + continue;
> +
> + if (ar->thermal.hwmon_dev) {
> + hwmon_device_unregister(ar->thermal.hwmon_dev);
> + ar->thermal.hwmon_dev = NULL;
> + }
> + }
> +}
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox