* [PATCH wireless-next v2 10/16] wifi: cfg80211: add ingress/egress distance thresholds for FTM
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Proximity detection applications need to receive measurement results
only when devices cross specific distance boundaries to avoid
unnecessary host wakeups and reduce power consumption. Currently,
there is no mechanism for applications to specify these distance
thresholds.
Introduce configurable distance-based reporting thresholds that
drivers can use to implement selective result reporting. Add
ingress and egress distance parameters allowing applications to
specify when results should be reported as peers cross these
boundaries, enabling drivers to reduce unnecessary data transfer
and host wakeups.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 9 +++++++++
include/uapi/linux/nl80211.h | 9 +++++++++
net/wireless/nl80211.c | 2 ++
net/wireless/pmsr.c | 8 ++++++++
4 files changed, 28 insertions(+)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8bbca2a98ac1..1b663627a0e6 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4439,6 +4439,13 @@ struct cfg80211_pmsr_result {
* in units of milli seconds. Only valid if @non_trigger_based is set.
* @measurements_per_aw: number of measurement attempts per availability window
* with a maximum value of 4. Only valid if @non_trigger_based is set.
+ * @ingress_distancemm: the measurement result of the peer needs
+ * to be indicated in case the device moves into this range.(units mm, u64)
+ * measurement results need to be sent on a burst index basis in this case.
+ * @egress_distancemm: the measurement result of the peer needs
+ * to be indicated in case the device moves out of this range.
+ * (units mm, u64). measurement results need to be sent on a burst index
+ * basis in this case.
*
* See also nl80211 for the respective attribute documentation.
*/
@@ -4463,6 +4470,8 @@ struct cfg80211_pmsr_ftm_request_peer {
u32 availability_window;
u32 nominal_time;
u32 measurements_per_aw;
+ u64 ingress_distancemm;
+ u64 egress_distancemm;
};
/**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 83d2a822c770..174592017486 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -8049,6 +8049,12 @@ enum nl80211_peer_measurement_ftm_capa {
* @NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW: meas per AW field shall indicate the
* number of measurements attempts per AW with a maximum value of 4 (u32).
* Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_PAD: ignore, for u64/s64 padding only
+ * @NL80211_PMSR_FTM_REQ_ATTR_INGRESS: the measurement result of the peer needs
+ * to be indicated in case the device moves into this range.(units mm, u64)
+ * @NL80211_PMSR_FTM_REQ_ATTR_EGRESS: the measurement result of the peer needs
+ * to be indicated in case the device moves out of this range.
+ * (units mm, u64)
*
* @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
* @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8075,6 +8081,9 @@ enum nl80211_peer_measurement_ftm_req {
NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
+ NL80211_PMSR_FTM_REQ_ATTR_PAD,
+ NL80211_PMSR_FTM_REQ_ATTR_INGRESS,
+ NL80211_PMSR_FTM_REQ_ATTR_EGRESS,
/* keep last */
NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5222ac8e8471..e6969578f4f1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -381,6 +381,8 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION] = NLA_POLICY_MAX(NLA_U32, 255),
[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = NLA_POLICY_MAX(NLA_U32, 4),
+ [NL80211_PMSR_FTM_REQ_ATTR_INGRESS] = { .type = NLA_U64 },
+ [NL80211_PMSR_FTM_REQ_ATTR_EGRESS] = { .type = NLA_U64 },
};
static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 3ca0e589d7cc..f2bbbf8eb6f2 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -225,6 +225,14 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
return -EINVAL;
}
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS])
+ out->ftm.ingress_distancemm =
+ nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_INGRESS]);
+
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS])
+ out->ftm.egress_distancemm =
+ nla_get_u64(tb[NL80211_PMSR_FTM_REQ_ATTR_EGRESS]);
+
return 0;
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 09/16] wifi: cfg80211: add role-based PD peer limits
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Peer measurement capabilities currently advertise a single maximum
peer count regardless of device role for proximity detection (PD).
Some devices support different peer limits when operating as PD
initiator versus PD responder.
Introduce separate peer limit capabilities for each PD role. When a
device supports concurrent initiator and responder operation,
enforce the sum of both limits to prevent resource oversubscription.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 12 ++++++++++++
include/uapi/linux/nl80211.h | 16 ++++++++++++++++
net/wireless/nl80211.c | 12 ++++++++++++
net/wireless/pmsr.c | 32 ++++++++++++++++++++++++++++----
4 files changed, 68 insertions(+), 4 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index febd7bf50d88..8bbca2a98ac1 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5776,6 +5776,16 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
* multi-peer request this will indicate if the device can act
* simultaneously as initiator and a responder. Only valid if @pd_support
* is set.
+ * @pd_max_peer_ista_role: Maximum number of peers allowed for a device
+ * operating in the ISTA role under proximity detection. Only valid if
+ * @pd_support is set. Sum of both @pd_max_peer_ista_role and
+ * @pd_max_peer_rsta_role is considered to enforce the max peers supported
+ * in case the request is of peer-to-peer PD type.
+ * @pd_max_peer_rsta_role: Maximum number of peers allowed for a device
+ * operating in the RSTA role under proximity detection. Only valid if
+ * @pd_support is set. Sum of both @pd_max_peer_ista_role and
+ * @pd_max_peer_rsta_role is considered to enforce the max peers supported
+ * in case the request is of peer-to-peer PD type
* @ftm: FTM measurement data
* @ftm.supported: FTM measurement is supported
* @ftm.asap: ASAP-mode is supported
@@ -5820,6 +5830,8 @@ struct cfg80211_pmsr_capabilities {
randomize_mac_addr:1,
pd_support:1,
pd_concurrent_ista_rsta_support:1;
+ u32 pd_max_peer_ista_role;
+ u32 pd_max_peer_rsta_role;
struct {
u32 preambles;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 67cc1ce6d2a1..83d2a822c770 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7841,6 +7841,20 @@ enum nl80211_peer_measurement_peer_attrs {
* multi-peer request, the device can act simultaneously as initiator and
* a responder, where the multiple requests are being processed
* simultaneously
+ * @NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE: u32 attribute indicating the
+ * maximum number of peers allowed for a device operating in the ISTA
+ * (Initiator STA) role under proximity detection. Only valid if
+ * %NL80211_PMSR_ATTR_PD_SUPPORT is set. Sum of both
+ * %NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
+ * %NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
+ * max peers supported in case the request is of peer-to-peer PD type
+ * @NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE: u32 attribute indicating the
+ * maximum number of peers allowed for a device operating in the RSTA
+ * (Responder STA) role under proximity detection. Only valid if
+ * %NL80211_PMSR_ATTR_PD_SUPPORT is set. Sum of both
+ * %NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE and
+ * %NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE is considered to enforce the
+ * max peers supported in case the request is of peer-to-peer PD type
*
* @NUM_NL80211_PMSR_ATTR: internal
* @NL80211_PMSR_ATTR_MAX: highest attribute number
@@ -7855,6 +7869,8 @@ enum nl80211_peer_measurement_attrs {
NL80211_PMSR_ATTR_PEERS,
NL80211_PMSR_ATTR_PD_SUPPORT,
NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
+ NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
+ NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
/* keep last */
NUM_NL80211_PMSR_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2b7de56c466f..5222ac8e8471 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -418,6 +418,8 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
[NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT] = {
.type = NLA_REJECT
},
+ [NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE] = { .type = NLA_REJECT },
+ [NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE] = { .type = NLA_REJECT },
};
static const struct nla_policy
@@ -2450,6 +2452,16 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
nla_put_flag(msg,
NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT))
return -ENOBUFS;
+
+ if (cap->pd_max_peer_ista_role &&
+ nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_ISTA_ROLE,
+ cap->pd_max_peer_ista_role))
+ return -ENOBUFS;
+
+ if (cap->pd_max_peer_rsta_role &&
+ nla_put_u32(msg, NL80211_PMSR_ATTR_PD_MAX_PEER_RSTA_ROLE,
+ cap->pd_max_peer_rsta_role))
+ return -ENOBUFS;
}
caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
if (!caps)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index a230bb95f5e3..3ca0e589d7cc 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -317,12 +317,15 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
{
struct nlattr *reqattr = info->attrs[NL80211_ATTR_PEER_MEASUREMENTS];
struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ int count, rem, err, idx, pd_count, max_pd_peers;
struct wireless_dev *wdev = info->user_ptr[1];
+ const struct cfg80211_pmsr_capabilities *capa;
struct cfg80211_pmsr_request *req;
struct nlattr *peers, *peer;
- int count, rem, err, idx;
- if (!rdev->wiphy.pmsr_capa)
+ capa = rdev->wiphy.pmsr_capa;
+
+ if (!capa)
return -EOPNOTSUPP;
if (!reqattr)
@@ -337,7 +340,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
nla_for_each_nested(peer, peers, rem) {
count++;
- if (count > rdev->wiphy.pmsr_capa->max_peers) {
+ if (count > capa->max_peers) {
NL_SET_ERR_MSG_ATTR(info->extack, peer,
"Too many peers used");
return -EINVAL;
@@ -353,7 +356,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
req->timeout = nla_get_u32(info->attrs[NL80211_ATTR_TIMEOUT]);
if (info->attrs[NL80211_ATTR_MAC]) {
- if (!rdev->wiphy.pmsr_capa->randomize_mac_addr) {
+ if (!capa->randomize_mac_addr) {
NL_SET_ERR_MSG_ATTR(info->extack,
info->attrs[NL80211_ATTR_MAC],
"device cannot randomize MAC address");
@@ -378,6 +381,27 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
goto out_err;
idx++;
}
+
+ /* Count PD requests and validate against PD peer limits */
+ if (capa->pd_support) {
+ pd_count = 0;
+
+ max_pd_peers = capa->pd_max_peer_ista_role +
+ capa->pd_max_peer_rsta_role;
+
+ for (idx = 0; idx < req->n_peers; idx++) {
+ if (req->peers[idx].pd_request) {
+ pd_count++;
+
+ if (pd_count > max_pd_peers) {
+ NL_SET_ERR_MSG(info->extack,
+ "Too many PD peers used");
+ err = -EINVAL;
+ goto out_err;
+ }
+ }
+ }
+ }
req->cookie = cfg80211_assign_cookie(rdev);
req->nl_portid = info->snd_portid;
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 08/16] wifi: cfg80211: extend PMSR FTM response for proximity ranging
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Applications need negotiated session parameters to interpret
proximity ranging results and perform post-processing. Currently,
the FTM response lacks LTF repetition counts, time constraints,
spatial stream configuration, and availability window parameters.
Extend the FTM response structure to report these negotiated
parameters, enabling applications to track session configuration
and use them in post-processing to increase ranging precision.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 61 ++++++++++++++++++++++++++++++++++--
include/uapi/linux/nl80211.h | 42 ++++++++++++++++++++++++-
net/wireless/pmsr.c | 16 ++++++++++
3 files changed, 116 insertions(+), 3 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index b66300497312..febd7bf50d88 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4260,6 +4260,27 @@ struct cfg80211_ftm_responder_stats {
* (must have either this or @rtt_avg)
* @dist_variance: variance of distances measured (see also @rtt_variance)
* @dist_spread: spread of distances measured (see also @rtt_spread)
+ * @tx_ltf_repetition_count: negotiated value of number of tx ltf repetitions
+ * in NDP frames
+ * @rx_ltf_repetition_count: negotiated value of number of rx ltf repetitions
+ * in NDP frames
+ * @max_time_between_measurements: the negotiated maximum interval (in units of
+ * 10 ms) by which the ISTA must complete the next measurement cycle.
+ * @min_time_between_measurements: the negotiated minimum interval (in units of
+ * 100 us) between two consecutive range measurements initiated by the
+ * ISTA.
+ * @num_tx_spatial_streams: number of Tx space-time streams used in the NDP
+ * frame during the measurement sounding phase.
+ * @num_rx_spatial_streams: number of Rx space-time streams used in the NDP
+ * frame during the measurement sounding phase.
+ * @nominal_time: negotiated nominal duration between adjacent availability
+ * windows in units of milliseconds (u32).
+ * @availability_window: negotiated availability window time used in this
+ * session in units of milliseconds (u32).
+ * @measurements_per_aw: negotiated number of measurement attempts per
+ * availability window.
+ * @chan_width: band width used for measurement.
+ * @preamble: preamble used for measurement.
* @num_ftmr_attempts_valid: @num_ftmr_attempts is valid
* @num_ftmr_successes_valid: @num_ftmr_successes is valid
* @rssi_avg_valid: @rssi_avg is valid
@@ -4272,6 +4293,19 @@ struct cfg80211_ftm_responder_stats {
* @dist_avg_valid: @dist_avg is valid
* @dist_variance_valid: @dist_variance is valid
* @dist_spread_valid: @dist_spread is valid
+ * @tx_ltf_repetition_count_valid: @tx_ltf_repetition_count is valid
+ * @rx_ltf_repetition_count_valid: @rx_ltf_repetition_count is valid
+ * @max_time_between_measurements_valid: @max_time_between_measurements is valid
+ * @min_time_between_measurements_valid: @min_time_between_measurements is valid
+ * @num_tx_spatial_streams_valid: @num_tx_spatial_streams is valid
+ * @num_rx_spatial_streams_valid: @num_rx_spatial_streams is valid
+ * @nominal_time_valid: @nominal_time is valid
+ * @availability_window_valid: @availability_window is valid
+ * @measurements_per_aw_valid: @measurements_per_aw is valid
+ * @chan_width_valid: @chan_width is valid.
+ * @preamble_valid: @preamble is valid.
+ * @is_delayed_lmr: indicates if the reported LMR is of the current burst or the
+ * previous burst, flag.
*/
struct cfg80211_pmsr_ftm_result {
const u8 *lci;
@@ -4295,8 +4329,19 @@ struct cfg80211_pmsr_ftm_result {
s64 dist_avg;
s64 dist_variance;
s64 dist_spread;
+ u32 tx_ltf_repetition_count;
+ u32 rx_ltf_repetition_count;
+ u32 max_time_between_measurements;
+ u32 min_time_between_measurements;
+ u32 num_tx_spatial_streams;
+ u32 num_rx_spatial_streams;
+ u32 nominal_time;
+ u32 availability_window;
+ u32 measurements_per_aw;
+ enum nl80211_chan_width chan_width;
+ enum nl80211_preamble preamble;
- u16 num_ftmr_attempts_valid:1,
+ u32 num_ftmr_attempts_valid:1,
num_ftmr_successes_valid:1,
rssi_avg_valid:1,
rssi_spread_valid:1,
@@ -4307,7 +4352,19 @@ struct cfg80211_pmsr_ftm_result {
rtt_spread_valid:1,
dist_avg_valid:1,
dist_variance_valid:1,
- dist_spread_valid:1;
+ dist_spread_valid:1,
+ tx_ltf_repetition_count_valid:1,
+ rx_ltf_repetition_count_valid:1,
+ max_time_between_measurements_valid:1,
+ min_time_between_measurements_valid:1,
+ num_tx_spatial_streams_valid:1,
+ num_rx_spatial_streams_valid:1,
+ nominal_time_valid:1,
+ availability_window_valid:1,
+ measurements_per_aw_valid:1,
+ chan_width_valid:1,
+ preamble_valid:1,
+ is_delayed_lmr:1;
};
/**
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 4dafaf25b0f6..67cc1ce6d2a1 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -8145,7 +8145,35 @@ enum nl80211_peer_measurement_ftm_failure_reasons {
* @NL80211_PMSR_FTM_RESP_ATTR_PAD: ignore, for u64/s64 padding only
* @NL80211_PMSR_FTM_RESP_ATTR_BURST_PERIOD: actual burst period used by
* the responder (similar to request, u16)
- *
+ * @NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT: negotiated value of
+ * number of tx ltf repetitions in NDP frames (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT: negotiated value of
+ * number of rx ltf repetitions in NDP frames (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS: negotiated value
+ * where latest time by which the ISTA needs to complete the next round of
+ * measurements, in units of 10 ms (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS: negotiated
+ * minimum time between two consecutive range measurements initiated by an
+ * ISTA, in units of 100 us (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS: number of Tx space-time
+ * streams used in NDP frames during the measurement sounding phase
+ * (u32, optional).
+ * @NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS: number of Rx space-time
+ * streams used in the NDP frames during the measurement sounding phase
+ * (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME: negotiated nominal time used in
+ * this session in milliseconds. (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW: negotiated availability
+ * window time used in this session, in units of milli seconds.
+ * (u32, optional)
+ * @NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW: negotiated measurements
+ * per availability window (u32, optional, max value 4)
+ * @NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH: u32 attribute indicating channel
+ * width used for measurement, see &enum nl80211_chan_width (optional).
+ * @NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE: u32 attribute indicating the preamble
+ * type used for the measurement, see &enum nl80211_preamble (optional).
+ * @NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR: flag, indicates if the
+ * current result is delayed LMR data.
* @NUM_NL80211_PMSR_FTM_RESP_ATTR: internal
* @NL80211_PMSR_FTM_RESP_ATTR_MAX: highest attribute number
*/
@@ -8174,6 +8202,18 @@ enum nl80211_peer_measurement_ftm_resp {
NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC,
NL80211_PMSR_FTM_RESP_ATTR_PAD,
NL80211_PMSR_FTM_RESP_ATTR_BURST_PERIOD,
+ NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT,
+ NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT,
+ NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
+ NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
+ NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS,
+ NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS,
+ NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME,
+ NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW,
+ NL80211_PMSR_FTM_RESP_ATTR_MEASUREMENTS_PER_AW,
+ NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH,
+ NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE,
+ NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR,
/* keep last */
NUM_NL80211_PMSR_FTM_RESP_ATTR,
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 4ae25b946111..a230bb95f5e3 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -518,6 +518,22 @@ static int nl80211_pmsr_send_ftm_res(struct sk_buff *msg,
PUTOPT_U64(DIST_AVG, dist_avg);
PUTOPT_U64(DIST_VARIANCE, dist_variance);
PUTOPT_U64(DIST_SPREAD, dist_spread);
+ PUTOPT(u32, TX_LTF_REPETITION_COUNT, tx_ltf_repetition_count);
+ PUTOPT(u32, RX_LTF_REPETITION_COUNT, rx_ltf_repetition_count);
+ PUTOPT(u32, MAX_TIME_BETWEEN_MEASUREMENTS,
+ max_time_between_measurements);
+ PUTOPT(u32, MIN_TIME_BETWEEN_MEASUREMENTS,
+ min_time_between_measurements);
+ PUTOPT(u32, NUM_TX_SPATIAL_STREAMS, num_tx_spatial_streams);
+ PUTOPT(u32, NUM_RX_SPATIAL_STREAMS, num_rx_spatial_streams);
+ PUTOPT(u32, NOMINAL_TIME, nominal_time);
+ PUTOPT(u32, AVAILABILITY_WINDOW, availability_window);
+ PUTOPT(u32, MEASUREMENTS_PER_AW, measurements_per_aw);
+ PUTOPT(u32, CHANNEL_WIDTH, chan_width);
+ PUTOPT(u32, PREAMBLE, preamble);
+ if (res->ftm.is_delayed_lmr &&
+ nla_put_flag(msg, NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR))
+ goto error;
if (res->ftm.lci && res->ftm.lci_len &&
nla_put(msg, NL80211_PMSR_FTM_RESP_ATTR_LCI,
res->ftm.lci_len, res->ftm.lci))
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 07/16] wifi: cfg80211: add continuous ranging and PD request support
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Proximity detection (PD) applications require sustained measurement
sessions without repeated FTM negotiation overhead. Currently, each
ranging session requires separate negotiation.
Enable NTB continuous ranging with configurable timing and
measurement parameters as per the specification "Proximity Ranging
(PR) Implementation Consideration Draft 1.9 Rev 1, section 5.3".
Add PD capability validation to support proximity detection sessions.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 22 +++++++++++++++++-
include/uapi/linux/nl80211.h | 26 ++++++++++++++++++++++
net/wireless/nl80211.c | 10 +++++++++
net/wireless/pmsr.c | 43 +++++++++++++++++++++++++++++++++---
4 files changed, 97 insertions(+), 4 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 62a2139b2f37..b66300497312 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4369,6 +4369,19 @@ struct cfg80211_pmsr_result {
* @bss_color: the bss color of the responder. Optional. Set to zero to
* indicate the driver should set the BSS color. Only valid if
* @non_trigger_based or @trigger_based is set.
+ * @min_time_between_measurements: minimum time between two consecutive range
+ * measurements in units of 100 micro seconds, applicable for
+ * non trigger based ranging. Only valid if @non_trigger_based is set.
+ * @max_time_between_measurements: maximum time between two consecutive range
+ * measurements in units of 10 milli seconds, to avoid FTM negotiation
+ * applicable for non trigger based ranging. Only valid
+ * if @non_trigger_based is set.
+ * @availability_window: duration of the availability window (AW) in units of
+ * 1 millisecond (0-255 ms). Only valid if @non_trigger_based is set.
+ * @nominal_time: Nominal duration between adjacent availability windows
+ * in units of milli seconds. Only valid if @non_trigger_based is set.
+ * @measurements_per_aw: number of measurement attempts per availability window
+ * with a maximum value of 4. Only valid if @non_trigger_based is set.
*
* See also nl80211 for the respective attribute documentation.
*/
@@ -4388,6 +4401,11 @@ struct cfg80211_pmsr_ftm_request_peer {
u8 ftms_per_burst;
u8 ftmr_retries;
u8 bss_color;
+ u32 min_time_between_measurements;
+ u32 max_time_between_measurements;
+ u32 availability_window;
+ u32 nominal_time;
+ u32 measurements_per_aw;
};
/**
@@ -4395,12 +4413,14 @@ struct cfg80211_pmsr_ftm_request_peer {
* @addr: MAC address
* @chandef: channel to use
* @report_ap_tsf: report the associated AP's TSF
+ * @pd_request: indicates a peer-to-peer PD request
* @ftm: FTM data, see &struct cfg80211_pmsr_ftm_request_peer
*/
struct cfg80211_pmsr_request_peer {
u8 addr[ETH_ALEN];
struct cfg80211_chan_def chandef;
- u8 report_ap_tsf:1;
+ u8 report_ap_tsf:1,
+ pd_request:1;
struct cfg80211_pmsr_ftm_request_peer ftm;
};
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 59e8ba9c37c4..4dafaf25b0f6 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7792,6 +7792,8 @@ enum nl80211_peer_measurement_resp {
* @NL80211_PMSR_PEER_ATTR_RESP: This is a nested attribute indexed by
* measurement type, with attributes from the
* &enum nl80211_peer_measurement_resp inside.
+ * @NL80211_PMSR_PEER_ATTR_PD_REQUEST: flag attribute indicating this is a
+ * peer-to-peer PD request
*
* @NUM_NL80211_PMSR_PEER_ATTRS: internal
* @NL80211_PMSR_PEER_ATTR_MAX: highest attribute number
@@ -7803,6 +7805,7 @@ enum nl80211_peer_measurement_peer_attrs {
NL80211_PMSR_PEER_ATTR_CHAN,
NL80211_PMSR_PEER_ATTR_REQ,
NL80211_PMSR_PEER_ATTR_RESP,
+ NL80211_PMSR_PEER_ATTR_PD_REQUEST,
/* keep last */
NUM_NL80211_PMSR_PEER_ATTRS,
@@ -8012,6 +8015,24 @@ enum nl80211_peer_measurement_ftm_capa {
* %NL80211_ATTR_TIMEOUT has expired.
* Set %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK to ensure RSTA will have
* the measurement results to report back in the FTM response.
+ * @NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS: minimum time
+ * between two consecutive range measurements in units of 100 microseconds,
+ * applicable for non-trigger based ranging (u32). Only valid if
+ * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS: maximum time
+ * between two consecutive range measurements in units of 10 milliseconds,
+ * to avoid FTM negotiation, applicable for non-trigger based ranging (u32)
+ * . Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME: the nominal time field shall be set
+ * to the nominal duration between adjacent Availability Windows in units
+ * of milli seconds (u32). Only valid if
+ * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION: The AW duration field shall be set
+ * to the duration of the AW in units of 1ms (0-255 ms) (u32).
+ * Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
+ * @NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW: meas per AW field shall indicate the
+ * number of measurements attempts per AW with a maximum value of 4 (u32).
+ * Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set.
*
* @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
* @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
@@ -8033,6 +8054,11 @@ enum nl80211_peer_measurement_ftm_req {
NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK,
NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR,
NL80211_PMSR_FTM_REQ_ATTR_RSTA,
+ NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS,
+ NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS,
+ NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME,
+ NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION,
+ NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW,
/* keep last */
NUM_NL80211_PMSR_FTM_REQ_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 77447f63d112..2b7de56c466f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -372,6 +372,15 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
[NL80211_PMSR_FTM_REQ_ATTR_RSTA] = { .type = NLA_FLAG },
+ [NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS] = {
+ .type = NLA_U32
+ },
+ [NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS] = {
+ .type = NLA_U32
+ },
+ [NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME] = { .type = NLA_U32 },
+ [NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION] = NLA_POLICY_MAX(NLA_U32, 255),
+ [NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW] = NLA_POLICY_MAX(NLA_U32, 4),
};
static const struct nla_policy
@@ -394,6 +403,7 @@ nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
[NL80211_PMSR_PEER_ATTR_REQ] =
NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
[NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
+ [NL80211_PMSR_PEER_ATTR_PD_REQUEST] = { .type = NLA_FLAG },
};
static const struct nla_policy
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 17f0b1c97d58..4ae25b946111 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -91,11 +91,10 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);
if (capa->ftm.max_ftms_per_burst &&
- (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst ||
- out->ftm.ftms_per_burst == 0)) {
+ (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst)) {
NL_SET_ERR_MSG_ATTR(info->extack,
tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],
- "FTM: FTMs per burst must be set lower than the device limit but non-zero");
+ "FTM: FTMs per burst must be set lower than the device limit");
return -EINVAL;
}
@@ -196,6 +195,36 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
return -EOPNOTSUPP;
}
+ if (out->ftm.non_trigger_based) {
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS])
+ out->ftm.min_time_between_measurements =
+ nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS]);
+
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS])
+ out->ftm.max_time_between_measurements =
+ nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS]);
+
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION])
+ out->ftm.availability_window =
+ nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION]);
+
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME])
+ out->ftm.nominal_time =
+ nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME]);
+
+ if (tb[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW])
+ out->ftm.measurements_per_aw =
+ nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_MEAS_PER_AW]);
+ }
+
+ if (!out->ftm.rsta && out->ftm.ftms_per_burst == 0 &&
+ out->ftm.measurements_per_aw == 0) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ ftmreq,
+ "FTM: Invalid parameters:Both Ftm's per burst and measurements per avail window are zero");
+ return -EINVAL;
+ }
+
return 0;
}
@@ -223,6 +252,14 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,
memcpy(out->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]), ETH_ALEN);
+ out->pd_request = !!tb[NL80211_PMSR_PEER_ATTR_PD_REQUEST];
+
+ if (out->pd_request && !rdev->wiphy.pmsr_capa->pd_support) {
+ NL_SET_ERR_MSG_ATTR(info->extack,
+ tb[NL80211_PMSR_PEER_ATTR_PD_REQUEST],
+ "PD request not supported by device");
+ return -EINVAL;
+ }
/* reuse info->attrs */
memset(info->attrs, 0, sizeof(*info->attrs) * (NL80211_ATTR_MAX + 1));
err = nla_parse_nested_deprecated(info->attrs, NL80211_ATTR_MAX,
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 06/16] wifi: cfg80211: add proximity detection capabilities to PMSR
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Introduce Proximity Detection (PD) capabilities in Peer Measurement
Service (PMSR) as defined in the Wi-Fi Alliance specification
"Proximity Ranging (PR) Implementation Consideration Draft 1.9 Rev 1
section 3.3". This enables devices to advertise PD support and
concurrent ISTA/RSTA operation for simultaneous initiator and
responder roles.
Extend FTM capabilities to support PASN negotiation and device timing
constraints. Add antenna configuration for PR Element during PASN
negotiation as per the specification. Add ranging interval limits to
advertise device timing capabilities for EDCA and NTB-based ranging.
Add EDCA-based responder support to indicate if the device can operate
as FTM responder for EDCA-based ranging. These capabilities allow
proper negotiation and validation of PD sessions between peers.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 28 ++++++++++++++++++++++++++--
include/uapi/linux/nl80211.h | 29 +++++++++++++++++++++++++++++
net/wireless/nl80211.c | 32 ++++++++++++++++++++++++++++++++
net/wireless/pmsr.c | 3 ++-
4 files changed, 89 insertions(+), 3 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 099a2ff9af58..62a2139b2f37 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5692,6 +5692,13 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
* @max_peers: maximum number of peers in a single measurement
* @report_ap_tsf: can report assoc AP's TSF for radio resource measurement
* @randomize_mac_addr: can randomize MAC address for measurement
+ * @pd_support: supports peer-to-peer ranging as mentioned in the specification
+ * "PR Implementation Consideration Draft 1.9 rev 1" where PD stands for
+ * proximity detection
+ * @pd_concurrent_ista_rsta_support: As the peer measurement request can be a
+ * multi-peer request this will indicate if the device can act
+ * simultaneously as initiator and a responder. Only valid if @pd_support
+ * is set.
* @ftm: FTM measurement data
* @ftm.supported: FTM measurement is supported
* @ftm.asap: ASAP-mode is supported
@@ -5718,12 +5725,24 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type);
* (0 means unknown)
* @ftm.max_total_ltf_rx: maximum total number of LTFs that can be received
* (0 means unknown)
+ * @ftm.max_no_of_tx_antennas: maximum number of transmit antennas supported for
+ * ranging
+ * @ftm.max_no_of_rx_antennas: maximum number of receive antennas supported for
+ * ranging
+ * @ftm.min_allowed_ranging_interval_edca: Minimum EDCA ranging
+ * interval supported by the device in milli seconds. (0 means unknown)
+ * @ftm.min_allowed_ranging_interval_ntb: Minimum NTB ranging
+ * interval supported by the device in milli seconds. (0 means unknown)
* @ftm.support_rsta: supports operating as RSTA in PMSR FTM request
+ * @ftm.support_edca_responder: supports operating as FTM responder in PMSR FTM
+ * request for EDCA-based ranging
*/
struct cfg80211_pmsr_capabilities {
unsigned int max_peers;
u8 report_ap_tsf:1,
- randomize_mac_addr:1;
+ randomize_mac_addr:1,
+ pd_support:1,
+ pd_concurrent_ista_rsta_support:1;
struct {
u32 preambles;
@@ -5744,7 +5763,12 @@ struct cfg80211_pmsr_capabilities {
u8 max_rx_sts;
u8 max_total_ltf_tx;
u8 max_total_ltf_rx;
- u8 support_rsta:1;
+ u32 max_no_of_tx_antennas;
+ u32 max_no_of_rx_antennas;
+ u32 min_allowed_ranging_interval_edca;
+ u32 min_allowed_ranging_interval_ntb;
+ u8 support_rsta:1,
+ support_edca_responder:1;
} ftm;
};
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 55a882535e2b..59e8ba9c37c4 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7829,6 +7829,15 @@ enum nl80211_peer_measurement_peer_attrs {
* meaningless, just a list of peers to measure with, with the
* sub-attributes taken from
* &enum nl80211_peer_measurement_peer_attrs.
+ * @NL80211_PMSR_ATTR_PD_SUPPORT: flag attribute in capability indicating
+ * that the device supports peer-to-peer ranging as mentioned in the
+ * specification "PR Implementation Consideration Draft 1.9 rev 1" where
+ * PD stands for proximity detection
+ * @NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT: flag attribute in
+ * capability indicating that as the peer measurement request can be a
+ * multi-peer request, the device can act simultaneously as initiator and
+ * a responder, where the multiple requests are being processed
+ * simultaneously
*
* @NUM_NL80211_PMSR_ATTR: internal
* @NL80211_PMSR_ATTR_MAX: highest attribute number
@@ -7841,6 +7850,8 @@ enum nl80211_peer_measurement_attrs {
NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR,
NL80211_PMSR_ATTR_TYPE_CAPA,
NL80211_PMSR_ATTR_PEERS,
+ NL80211_PMSR_ATTR_PD_SUPPORT,
+ NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT,
/* keep last */
NUM_NL80211_PMSR_ATTR,
@@ -7899,6 +7910,19 @@ enum nl80211_peer_measurement_attrs {
* This limits the allowed combinations of LTF repetitions and STS.
* @NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT: flag attribute indicating the
* device supports operating as the RSTA in PMSR FTM request
+ * @NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER: flag attribute indicating
+ * the device supports operating as the Responder in PMSR FTM request for
+ * EDCA-based ranging.
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS: u32 attribute indicating
+ * the maximum number of transmit antennas supported for ranging
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS: u32 attribute indicating
+ * the maximum number of receive antennas supported for ranging
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA: u32 attribute indicating
+ * the minimum EDCA ranging interval supported by the device
+ * in milli seconds. (0 means unknown)
+ * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB: u32 attribute indicating
+ * the minimum NTB ranging interval supported by the device
+ * in milli seconds. (0 means unknown)
*
* @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal
* @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number
@@ -7924,6 +7948,11 @@ enum nl80211_peer_measurement_ftm_capa {
NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_TX,
NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_RX,
NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT,
+ NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER,
+ NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS,
+ NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,
+ NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,
+ NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
/* keep last */
NUM_NL80211_PMSR_FTM_CAPA_ATTR,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0ae96063c032..77447f63d112 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -404,6 +404,10 @@ nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
[NL80211_PMSR_ATTR_PEERS] =
NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
+ [NL80211_PMSR_ATTR_PD_SUPPORT] = { .type = NLA_REJECT },
+ [NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT] = {
+ .type = NLA_REJECT
+ },
};
static const struct nla_policy
@@ -2375,6 +2379,25 @@ nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
if (cap->ftm.support_rsta &&
nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT))
return -ENOBUFS;
+ if (cap->ftm.support_edca_responder &&
+ nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_EDCA_BASED_RESPONDER))
+ return -ENOBUFS;
+ if (cap->ftm.max_no_of_tx_antennas &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS,
+ cap->ftm.max_no_of_tx_antennas))
+ return -ENOBUFS;
+ if (cap->ftm.max_no_of_rx_antennas &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS,
+ cap->ftm.max_no_of_rx_antennas))
+ return -ENOBUFS;
+ if (cap->ftm.min_allowed_ranging_interval_edca &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA,
+ cap->ftm.min_allowed_ranging_interval_edca))
+ return -ENOBUFS;
+ if (cap->ftm.min_allowed_ranging_interval_ntb &&
+ nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB,
+ cap->ftm.min_allowed_ranging_interval_ntb))
+ return -ENOBUFS;
nla_nest_end(msg, ftm);
return 0;
@@ -2409,6 +2432,15 @@ static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
return -ENOBUFS;
+ if (cap->pd_support) {
+ if (nla_put_flag(msg, NL80211_PMSR_ATTR_PD_SUPPORT))
+ return -ENOBUFS;
+
+ if (cap->pd_concurrent_ista_rsta_support &&
+ nla_put_flag(msg,
+ NL80211_PMSR_ATTR_PD_CONCURRENT_ISTA_RSTA_SUPPORT))
+ return -ENOBUFS;
+ }
caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
if (!caps)
return -ENOBUFS;
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index c2977a37add2..17f0b1c97d58 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -188,7 +188,8 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
}
out->ftm.rsta = !!tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA];
- if (out->ftm.rsta && !capa->ftm.support_rsta) {
+ if (out->ftm.rsta && !capa->ftm.support_rsta &&
+ !capa->ftm.support_edca_responder) {
NL_SET_ERR_MSG_ATTR(info->extack,
tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],
"FTM: RSTA not supported by device");
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 05/16] wifi: cfg80211: add start/stop proximity detection commands
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Currently, the proximity detection (PD) interface type has no
start/stop commands defined, preventing user space from
controlling PD operations through the nl80211 interface.
Add NL80211_CMD_START_PD and NL80211_CMD_STOP_PD commands to
allow user space to start and stop a PD interface. Add the
corresponding start_pd and stop_pd operations to cfg80211_ops
and ieee80211_ops, along with nl80211 command handlers, rdev
wrappers, and tracing support. Validate that drivers advertising
PD interface support implement the required operations. Handle
PD interface teardown during device unregistration and when
the interface leaves the network.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 5 ++++
include/uapi/linux/nl80211.h | 9 ++++++
net/wireless/core.c | 32 ++++++++++++++++++++-
net/wireless/core.h | 2 ++
net/wireless/nl80211.c | 54 ++++++++++++++++++++++++++++++++++++
net/wireless/rdev-ops.h | 19 +++++++++++++
net/wireless/trace.h | 20 +++++++++++++
7 files changed, 140 insertions(+), 1 deletion(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 73cfe1a14c01..099a2ff9af58 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4900,6 +4900,9 @@ struct mgmt_frame_regs {
* links by calling cfg80211_mlo_reconf_add_done(). When calling
* cfg80211_mlo_reconf_add_done() the bss pointer must be given for each
* link for which MLO reconfiguration 'add' operation was requested.
+ *
+ * @start_pd: Start the PD interface.
+ * @stop_pd: Stop the PD interface.
*/
struct cfg80211_ops {
int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -5271,6 +5274,8 @@ struct cfg80211_ops {
struct cfg80211_ml_reconf_req *req);
int (*set_epcs)(struct wiphy *wiphy, struct net_device *dev,
bool val);
+ int (*start_pd)(struct wiphy *wiphy, struct wireless_dev *wdev);
+ void (*stop_pd)(struct wiphy *wiphy, struct wireless_dev *wdev);
};
/*
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index b1f0e72ec953..55a882535e2b 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1369,6 +1369,12 @@
* %NL80211_ATTR_INCUMBENT_SIGNAL_INTERFERENCE_BITMAP. The current channel
* definition is also sent.
*
+ * @NL80211_CMD_START_PD: Start PD operation, identified by its
+ * %NL80211_ATTR_WDEV interface. This interface must have been previously
+ * created with %NL80211_CMD_NEW_INTERFACE.
+ * @NL80211_CMD_STOP_PD: Stop the PD operation, identified by
+ * its %NL80211_ATTR_WDEV interface.
+ *
* @NL80211_CMD_MAX: highest used command number
* @__NL80211_CMD_AFTER_LAST: internal use
*/
@@ -1634,6 +1640,9 @@ enum nl80211_commands {
NL80211_CMD_INCUMBENT_SIGNAL_DETECT,
+ NL80211_CMD_START_PD,
+ NL80211_CMD_STOP_PD,
+
/* add new commands above here */
/* used to define NL80211_CMD_MAX below */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 67a603129c42..7bab8c4fb873 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -270,6 +270,25 @@ void cfg80211_stop_nan(struct cfg80211_registered_device *rdev,
rdev->opencount--;
}
+void cfg80211_stop_pd(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev)
+{
+ lockdep_assert_held(&rdev->wiphy.mtx);
+
+ if (WARN_ON(wdev->iftype != NL80211_IFTYPE_PD))
+ return;
+
+ if (!wdev_running(wdev))
+ return;
+
+ cfg80211_pmsr_wdev_down(wdev);
+
+ rdev_stop_pd(rdev, wdev);
+ wdev->is_running = false;
+
+ rdev->opencount--;
+}
+
void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy)
{
struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
@@ -294,6 +313,9 @@ void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy)
case NL80211_IFTYPE_NAN:
cfg80211_stop_nan(rdev, wdev);
break;
+ case NL80211_IFTYPE_PD:
+ cfg80211_stop_pd(rdev, wdev);
+ break;
default:
break;
}
@@ -760,6 +782,9 @@ int wiphy_register(struct wiphy *wiphy)
!rdev->ops->add_nan_func || !rdev->ops->del_nan_func ||
!(wiphy->nan_supported_bands & BIT(NL80211_BAND_2GHZ)))))
return -EINVAL;
+ if (WARN_ON((wiphy->interface_modes & BIT(NL80211_IFTYPE_PD)) &&
+ (!rdev->ops->start_pd || !rdev->ops->stop_pd)))
+ return -EINVAL;
if (WARN_ON(wiphy->interface_modes & BIT(NL80211_IFTYPE_WDS)))
return -EINVAL;
@@ -1309,6 +1334,9 @@ static void _cfg80211_unregister_wdev(struct wireless_dev *wdev,
case NL80211_IFTYPE_NAN:
cfg80211_stop_nan(rdev, wdev);
break;
+ case NL80211_IFTYPE_PD:
+ cfg80211_stop_pd(rdev, wdev);
+ break;
default:
break;
}
@@ -1418,9 +1446,11 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
case NL80211_IFTYPE_NAN:
cfg80211_stop_nan(rdev, wdev);
break;
+ case NL80211_IFTYPE_PD:
+ cfg80211_stop_pd(rdev, wdev);
+ break;
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MONITOR:
- case NL80211_IFTYPE_PD:
/* nothing to do */
break;
case NL80211_IFTYPE_UNSPECIFIED:
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 6cace846d7a3..f631b6997988 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -550,6 +550,8 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
void cfg80211_stop_nan(struct cfg80211_registered_device *rdev,
struct wireless_dev *wdev);
+void cfg80211_stop_pd(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev);
struct cfg80211_internal_bss *
cfg80211_bss_update(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 293fdd07ac7a..0ae96063c032 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -16296,6 +16296,46 @@ static int nl80211_nan_change_config(struct sk_buff *skb,
return rdev_nan_change_conf(rdev, wdev, &conf, changed);
}
+static int nl80211_start_pd(struct sk_buff *skb, struct genl_info *info)
+{
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ struct wireless_dev *wdev = info->user_ptr[1];
+ int err;
+
+ if (wdev->iftype != NL80211_IFTYPE_PD)
+ return -EOPNOTSUPP;
+
+ if (wdev_running(wdev))
+ return -EEXIST;
+
+ if (rfkill_blocked(rdev->wiphy.rfkill))
+ return -ERFKILL;
+
+ if (!rdev->ops->start_pd)
+ return -EOPNOTSUPP;
+
+ err = rdev_start_pd(rdev, wdev);
+ if (err)
+ return err;
+ wdev->is_running = true;
+ rdev->opencount++;
+
+ return 0;
+}
+
+static int nl80211_stop_pd(struct sk_buff *skb, struct genl_info *info)
+{
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ struct wireless_dev *wdev = info->user_ptr[1];
+
+ if (wdev->iftype != NL80211_IFTYPE_PD)
+ return -EOPNOTSUPP;
+
+ cfg80211_stop_pd(rdev, wdev);
+
+ return 0;
+}
+
void cfg80211_nan_match(struct wireless_dev *wdev,
struct cfg80211_nan_match_params *match, gfp_t gfp)
{
@@ -18977,6 +19017,20 @@ static const struct genl_small_ops nl80211_small_ops[] = {
.flags = GENL_ADMIN_PERM,
.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
},
+ {
+ .cmd = NL80211_CMD_START_PD,
+ .doit = nl80211_start_pd,
+ .flags = GENL_ADMIN_PERM,
+ .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
+ NL80211_FLAG_NEED_RTNL),
+ },
+ {
+ .cmd = NL80211_CMD_STOP_PD,
+ .doit = nl80211_stop_pd,
+ .flags = GENL_ADMIN_PERM,
+ .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
+ NL80211_FLAG_NEED_RTNL),
+ },
{
.cmd = NL80211_CMD_SET_MCAST_RATE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 3c0fff3cb5ac..921566fa802d 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -1061,6 +1061,25 @@ rdev_nan_change_conf(struct cfg80211_registered_device *rdev,
return ret;
}
+static inline int rdev_start_pd(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev)
+{
+ int ret;
+
+ trace_rdev_start_pd(&rdev->wiphy, wdev);
+ ret = rdev->ops->start_pd(&rdev->wiphy, wdev);
+ trace_rdev_return_int(&rdev->wiphy, ret);
+ return ret;
+}
+
+static inline void rdev_stop_pd(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev)
+{
+ trace_rdev_stop_pd(&rdev->wiphy, wdev);
+ rdev->ops->stop_pd(&rdev->wiphy, wdev);
+ trace_rdev_return_void(&rdev->wiphy);
+}
+
static inline int rdev_set_mac_acl(struct cfg80211_registered_device *rdev,
struct net_device *dev,
struct cfg80211_acl_data *params)
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 56718e250d31..978c019c01b4 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2375,6 +2375,26 @@ DEFINE_EVENT(wiphy_wdev_evt, rdev_stop_nan,
TP_ARGS(wiphy, wdev)
);
+TRACE_EVENT(rdev_start_pd,
+ TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
+ TP_ARGS(wiphy, wdev),
+ TP_STRUCT__entry(
+ WIPHY_ENTRY
+ WDEV_ENTRY
+ ),
+ TP_fast_assign(
+ WIPHY_ASSIGN;
+ WDEV_ASSIGN;
+ ),
+ TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT,
+ WIPHY_PR_ARG, WDEV_PR_ARG)
+);
+
+DEFINE_EVENT(wiphy_wdev_evt, rdev_stop_pd,
+ TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
+ TP_ARGS(wiphy, wdev)
+);
+
TRACE_EVENT(rdev_add_nan_func,
TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev,
const struct cfg80211_nan_func *func),
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 04/16] wifi: cfg80211/mac80211: Add NL80211_IFTYPE_PD for PD PASN and PMSR operations
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Add a new wdev-only interface type NL80211_IFTYPE_PD to support
Proximity Detection (PD) operations such as PASN, key install and
peer measurement operations. This interface type operates without
a netdev, similar to P2P_DEVICE and NAN interfaces.
Implement support across cfg80211 and mac80211 layers with key
management gated by the NL80211_EXT_FEATURE_SECURE_RTT feature
flag, management frame registration and transmission capabilities,
and proper channel context handling where PD interfaces are
excluded from bandwidth calculations.
The PD interface provides isolated functionality for PD PASN
and PMSR without affecting existing network operations.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/uapi/linux/nl80211.h | 2 ++
net/mac80211/cfg.c | 2 ++
net/mac80211/chan.c | 2 ++
net/mac80211/iface.c | 6 +++++-
net/mac80211/offchannel.c | 1 +
net/mac80211/rx.c | 1 +
net/mac80211/util.c | 1 +
net/wireless/chan.c | 2 ++
net/wireless/core.c | 1 +
net/wireless/mlme.c | 1 +
net/wireless/nl80211.c | 27 +++++++++++++++++++++++++--
net/wireless/reg.c | 3 +++
net/wireless/util.c | 4 +++-
13 files changed, 49 insertions(+), 4 deletions(-)
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 49f4704ce627..b1f0e72ec953 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -3671,6 +3671,7 @@ enum nl80211_attrs {
* @NL80211_IFTYPE_OCB: Outside Context of a BSS
* This mode corresponds to the MIB variable dot11OCBActivated=true
* @NL80211_IFTYPE_NAN: NAN device interface type (not a netdev)
+ * @NL80211_IFTYPE_PD: PD device interface type (not a netdev)
* @NL80211_IFTYPE_MAX: highest interface type number currently defined
* @NUM_NL80211_IFTYPES: number of defined interface types
*
@@ -3692,6 +3693,7 @@ enum nl80211_iftype {
NL80211_IFTYPE_P2P_DEVICE,
NL80211_IFTYPE_OCB,
NL80211_IFTYPE_NAN,
+ NL80211_IFTYPE_PD,
/* keep last */
NUM_NL80211_IFTYPES,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index ee64ac8e0f61..dac211f9a438 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -713,6 +713,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct wireless_dev *wdev,
case NL80211_IFTYPE_MONITOR:
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
case NL80211_IFTYPE_UNSPECIFIED:
case NUM_NL80211_IFTYPES:
case NL80211_IFTYPE_P2P_CLIENT:
@@ -3183,6 +3184,7 @@ static int ieee80211_scan(struct wiphy *wiphy,
}
break;
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
default:
return -EOPNOTSUPP;
}
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 4447cf03c41b..00cbb13fb74b 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -473,6 +473,7 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
break;
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
continue;
case NL80211_IFTYPE_MONITOR:
WARN_ON_ONCE(!ieee80211_hw_check(&local->hw,
@@ -1414,6 +1415,7 @@ ieee80211_link_chanctx_reservation_complete(struct ieee80211_link_data *link)
case NL80211_IFTYPE_P2P_GO:
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
case NUM_NL80211_IFTYPES:
WARN_ON(1);
break;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 676b2a43c9f2..b647c6394b28 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1369,6 +1369,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_OCB:
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
/* no special treatment */
break;
case NL80211_IFTYPE_UNSPECIFIED:
@@ -1489,7 +1490,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
FIF_PROBE_REQ);
if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
- sdata->vif.type != NL80211_IFTYPE_NAN)
+ sdata->vif.type != NL80211_IFTYPE_NAN &&
+ sdata->vif.type != NL80211_IFTYPE_PD)
changed |= ieee80211_reset_erp_info(sdata);
ieee80211_link_info_change_notify(sdata, &sdata->deflink,
changed);
@@ -1504,6 +1506,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
break;
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
break;
default:
/* not reached */
@@ -1935,6 +1938,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
break;
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_P2P_DEVICE:
+ case NL80211_IFTYPE_PD:
sdata->vif.bss_conf.bssid = sdata->vif.addr;
break;
case NL80211_IFTYPE_UNSPECIFIED:
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 5f398d38d1c9..04c6031dc46b 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -898,6 +898,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
need_offchan = true;
break;
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
break;
default:
return -EOPNOTSUPP;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 6c4b549444c6..ed3f7e3094ea 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -4621,6 +4621,7 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
(ieee80211_is_public_action(hdr, skb->len) ||
(ieee80211_is_auth(hdr->frame_control) &&
ether_addr_equal(sdata->vif.addr, hdr->addr1)));
+ case NL80211_IFTYPE_PD:
default:
break;
}
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index b2e6c8b98381..2fa81fb57093 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2121,6 +2121,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MONITOR:
case NL80211_IFTYPE_P2P_DEVICE:
+ case NL80211_IFTYPE_PD:
/* nothing to do */
break;
case NL80211_IFTYPE_UNSPECIFIED:
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d9d4e043bb39..31b621de3f9b 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -796,6 +796,7 @@ int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
case NL80211_IFTYPE_MONITOR:
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_P2P_DEVICE:
+ case NL80211_IFTYPE_PD:
break;
case NL80211_IFTYPE_WDS:
case NL80211_IFTYPE_UNSPECIFIED:
@@ -919,6 +920,7 @@ bool cfg80211_beaconing_iface_active(struct wireless_dev *wdev)
case NL80211_IFTYPE_P2P_DEVICE:
/* Can NAN type be considered as beaconing interface? */
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
break;
case NL80211_IFTYPE_UNSPECIFIED:
case NL80211_IFTYPE_WDS:
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 23afc250bc10..67a603129c42 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1420,6 +1420,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
break;
case NL80211_IFTYPE_AP_VLAN:
case NL80211_IFTYPE_MONITOR:
+ case NL80211_IFTYPE_PD:
/* nothing to do */
break;
case NL80211_IFTYPE_UNSPECIFIED:
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 5cd86253a62e..6d13093ce449 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -939,6 +939,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
* public action frames
*/
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
default:
err = -EOPNOTSUPP;
break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2d22fd405c39..293fdd07ac7a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1711,6 +1711,11 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
NL80211_EXT_FEATURE_SECURE_NAN))
return 0;
return -EINVAL;
+ case NL80211_IFTYPE_PD:
+ if (wiphy_ext_feature_isset(wdev->wiphy,
+ NL80211_EXT_FEATURE_SECURE_RTT))
+ return 0;
+ return -EINVAL;
case NL80211_IFTYPE_UNSPECIFIED:
case NL80211_IFTYPE_OCB:
case NL80211_IFTYPE_MONITOR:
@@ -4739,6 +4744,7 @@ static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
return -EOPNOTSUPP;
if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
+ type == NL80211_IFTYPE_PD ||
rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
info->attrs[NL80211_ATTR_MAC]) {
nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
@@ -4795,8 +4801,9 @@ static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
break;
case NL80211_IFTYPE_NAN:
case NL80211_IFTYPE_P2P_DEVICE:
+ case NL80211_IFTYPE_PD:
/*
- * P2P Device and NAN do not have a netdev, so don't go
+ * P2P Device, NAN and PD do not have a netdev, so don't go
* through the netdev notifier and must be added here
*/
cfg80211_init_wdev(wdev);
@@ -10537,7 +10544,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
wiphy = &rdev->wiphy;
- if (wdev->iftype == NL80211_IFTYPE_NAN)
+ if (wdev->iftype == NL80211_IFTYPE_NAN ||
+ wdev->iftype == NL80211_IFTYPE_PD)
return -EOPNOTSUPP;
if (!rdev->ops->scan)
@@ -13954,6 +13962,11 @@ static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
WIPHY_NAN_FLAGS_USERSPACE_DE))
return -EOPNOTSUPP;
break;
+ case NL80211_IFTYPE_PD:
+ if (!wiphy_ext_feature_isset(wdev->wiphy,
+ NL80211_EXT_FEATURE_SECURE_RTT))
+ return -EOPNOTSUPP;
+ break;
default:
return -EOPNOTSUPP;
}
@@ -14017,6 +14030,11 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
WIPHY_NAN_FLAGS_USERSPACE_DE))
return -EOPNOTSUPP;
break;
+ case NL80211_IFTYPE_PD:
+ if (!wiphy_ext_feature_isset(wdev->wiphy,
+ NL80211_EXT_FEATURE_SECURE_RTT))
+ return -EOPNOTSUPP;
+ break;
default:
return -EOPNOTSUPP;
}
@@ -14142,6 +14160,11 @@ static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *in
NL80211_EXT_FEATURE_SECURE_NAN))
return -EOPNOTSUPP;
break;
+ case NL80211_IFTYPE_PD:
+ if (!wiphy_ext_feature_isset(wdev->wiphy,
+ NL80211_EXT_FEATURE_SECURE_RTT))
+ return -EOPNOTSUPP;
+ break;
default:
return -EOPNOTSUPP;
}
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 1c5c38d18feb..fb7eaee734b4 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2411,6 +2411,9 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
case NL80211_IFTYPE_NAN:
/* we have no info, but NAN is also pretty universal */
continue;
+ case NL80211_IFTYPE_PD:
+ /* we have no info, but PD is also pretty universal */
+ continue;
default:
/* others not implemented for now */
WARN_ON_ONCE(1);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 0a0cea018fc5..d558c4bc00f0 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1186,7 +1186,8 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
/* cannot change into P2P device or NAN */
if (ntype == NL80211_IFTYPE_P2P_DEVICE ||
- ntype == NL80211_IFTYPE_NAN)
+ ntype == NL80211_IFTYPE_NAN ||
+ ntype == NL80211_IFTYPE_PD)
return -EOPNOTSUPP;
if (!rdev->ops->change_virtual_intf ||
@@ -1250,6 +1251,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
case NL80211_IFTYPE_P2P_DEVICE:
case NL80211_IFTYPE_WDS:
case NL80211_IFTYPE_NAN:
+ case NL80211_IFTYPE_PD:
WARN_ON(1);
break;
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 03/16] wifi: cfg80211: Add MAC address filter to remain_on_channel
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Currently the remain_on_channel operation does not support
filtering incoming frames by destination MAC address. This
prevents use cases such as PASN authentication in the
responder side that need to receive frames addressed to a
specific MAC during the off-channel period.
Add an rx_addr parameter to the remain_on_channel operation
callback and propagate it through the call chain from nl80211
to driver implementations. Introduce the extended feature
NL80211_EXT_FEATURE_ROC_ADDR_FILTER as a capability gate so
that cfg80211 rejects the request if the driver does not
advertise support for address filtering. Extract the address
from the NL80211_ATTR_MAC attribute when provided in the
netlink message and update the tracing infrastructure to
include the address in remain_on_channel trace events. The
rx_addr parameter is optional and can be NULL, maintaining
backward compatibility with existing drivers.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath6kl/cfg80211.c | 3 ++-
drivers/net/wireless/ath/wil6210/cfg80211.c | 3 ++-
.../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 4 +++-
.../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 ++-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 3 ++-
drivers/net/wireless/microchip/wilc1000/cfg80211.c | 3 ++-
include/net/cfg80211.h | 2 +-
include/uapi/linux/nl80211.h | 11 ++++++++++-
net/mac80211/ieee80211_i.h | 3 ++-
net/mac80211/offchannel.c | 3 ++-
net/wireless/nl80211.c | 11 ++++++++++-
net/wireless/rdev-ops.h | 7 ++++---
net/wireless/trace.h | 12 ++++++++----
13 files changed, 50 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 739a24a6ad67..cc0f2c45fc3a 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1,6 +1,7 @@
/*
* Copyright (c) 2004-2011 Atheros Communications Inc.
* Copyright (c) 2011-2012 Qualcomm Atheros, Inc.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -3033,7 +3034,7 @@ static int ath6kl_remain_on_channel(struct wiphy *wiphy,
struct wireless_dev *wdev,
struct ieee80211_channel *chan,
unsigned int duration,
- u64 *cookie)
+ u64 *cookie, const u8 *rx_addr)
{
struct ath6kl_vif *vif = ath6kl_vif_from_wdev(wdev);
struct ath6kl *ar = ath6kl_priv(vif->ndev);
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 3d6e5aad48b1..d6ef92cfcbaf 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -2,6 +2,7 @@
/*
* Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/etherdevice.h>
@@ -1734,7 +1735,7 @@ static int wil_remain_on_channel(struct wiphy *wiphy,
struct wireless_dev *wdev,
struct ieee80211_channel *chan,
unsigned int duration,
- u64 *cookie)
+ u64 *cookie, const u8 *rx_addr)
{
struct wil6210_priv *wil = wiphy_to_wil(wiphy);
int rc;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index e1752a513c73..92c16a317328 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -970,10 +970,12 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
* @channel: channel to stay on.
* @duration: time in ms to remain on channel.
* @cookie: cookie.
+ * @rx_addr: Address to match against the destination of received frames
*/
int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
struct ieee80211_channel *channel,
- unsigned int duration, u64 *cookie)
+ unsigned int duration, u64 *cookie,
+ const u8 *rx_addr)
{
struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
struct brcmf_p2p_info *p2p = &cfg->p2p;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
index d3137ebd7158..9f3f01ade2b7 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -157,7 +157,8 @@ int brcmf_p2p_scan_prep(struct wiphy *wiphy,
struct brcmf_cfg80211_vif *vif);
int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
struct ieee80211_channel *channel,
- unsigned int duration, u64 *cookie);
+ unsigned int duration, u64 *cookie,
+ const u8 *rx_addr);
int brcmf_p2p_notify_listen_complete(struct brcmf_if *ifp,
const struct brcmf_event_msg *e,
void *data);
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index c9a651bdf882..c9daf893472f 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -304,7 +304,8 @@ static int
mwifiex_cfg80211_remain_on_channel(struct wiphy *wiphy,
struct wireless_dev *wdev,
struct ieee80211_channel *chan,
- unsigned int duration, u64 *cookie)
+ unsigned int duration, u64 *cookie,
+ const u8 *rx_addr)
{
struct mwifiex_private *priv = mwifiex_netdev_get_priv(wdev->netdev);
int ret;
diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
index 3a774cc44b26..6654fce4ded8 100644
--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
@@ -1100,7 +1100,8 @@ static void wilc_wfi_remain_on_channel_expired(struct wilc_vif *vif, u64 cookie)
static int remain_on_channel(struct wiphy *wiphy,
struct wireless_dev *wdev,
struct ieee80211_channel *chan,
- unsigned int duration, u64 *cookie)
+ unsigned int duration, u64 *cookie,
+ const u8 *rx_addr)
{
int ret = 0;
struct wilc_vif *vif = netdev_priv(wdev->netdev);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index a54300b6899a..73cfe1a14c01 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5082,7 +5082,7 @@ struct cfg80211_ops {
struct wireless_dev *wdev,
struct ieee80211_channel *chan,
unsigned int duration,
- u64 *cookie);
+ u64 *cookie, const u8 *rx_addr);
int (*cancel_remain_on_channel)(struct wiphy *wiphy,
struct wireless_dev *wdev,
u64 cookie);
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 8e4f9192d8b7..49f4704ce627 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -729,7 +729,9 @@
* to remain on the channel. This command is also used as an event to
* notify when the requested duration starts (it may take a while for the
* driver to schedule this time due to other concurrent needs for the
- * radio).
+ * radio). An optional attribute %NL80211_ATTR_MAC can be used to filter
+ * incoming frames during remain-on-channel, such that frames
+ * addressed to the specified destination MAC are reported.
* When called, this operation returns a cookie (%NL80211_ATTR_COOKIE)
* that will be included with any events pertaining to this request;
* the cookie is also used to cancel the request.
@@ -6828,6 +6830,12 @@ enum nl80211_feature_flags {
* (NL80211_CMD_AUTHENTICATE) in non-AP STA mode, as specified in
* "IEEE P802.11bi/D4.0, 12.16.5".
*
+ * @NL80211_EXT_FEATURE_ROC_ADDR_FILTER: Driver supports MAC address
+ * filtering during remain-on-channel. When %NL80211_ATTR_MAC is
+ * provided with %NL80211_CMD_REMAIN_ON_CHANNEL, the driver will
+ * forward frames with a matching MAC address to userspace during
+ * the off-channel period.
+ *
* @NUM_NL80211_EXT_FEATURES: number of extended features.
* @MAX_NL80211_EXT_FEATURES: highest extended feature index.
*/
@@ -6907,6 +6915,7 @@ enum nl80211_ext_feature_index {
NL80211_EXT_FEATURE_EPPKE,
NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION,
NL80211_EXT_FEATURE_IEEE8021X_AUTH,
+ NL80211_EXT_FEATURE_ROC_ADDR_FILTER,
/* add new features before the definition below */
NUM_NL80211_EXT_FEATURES,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index a4babf7624e5..c8e58877e2a3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2068,7 +2068,8 @@ void ieee80211_roc_purge(struct ieee80211_local *local,
struct ieee80211_sub_if_data *sdata);
int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
struct ieee80211_channel *chan,
- unsigned int duration, u64 *cookie);
+ unsigned int duration, u64 *cookie,
+ const u8 *rx_addr);
int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
struct wireless_dev *wdev, u64 cookie);
int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index f60f6a58948b..5f398d38d1c9 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -706,7 +706,8 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
struct ieee80211_channel *chan,
- unsigned int duration, u64 *cookie)
+ unsigned int duration, u64 *cookie,
+ const u8 *rx_addr)
{
struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
struct ieee80211_local *local = sdata->local;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2225f5d0b124..2d22fd405c39 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13798,6 +13798,7 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
unsigned int link_id = nl80211_link_id(info->attrs);
struct wireless_dev *wdev = info->user_ptr[1];
struct cfg80211_chan_def chandef;
+ const u8 *rx_addr = NULL;
struct sk_buff *msg;
void *hdr;
u64 cookie;
@@ -13810,6 +13811,14 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
+ if (info->attrs[NL80211_ATTR_MAC])
+ rx_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+ if (rx_addr &&
+ !wiphy_ext_feature_isset(wdev->wiphy,
+ NL80211_EXT_FEATURE_ROC_ADDR_FILTER))
+ return -EOPNOTSUPP;
+
if (!rdev->ops->remain_on_channel ||
!(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
return -EOPNOTSUPP;
@@ -13857,7 +13866,7 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
}
err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
- duration, &cookie);
+ duration, &cookie, rx_addr);
if (err)
goto free_msg;
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 2bad8b60b7c9..3c0fff3cb5ac 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -736,12 +736,13 @@ static inline int
rdev_remain_on_channel(struct cfg80211_registered_device *rdev,
struct wireless_dev *wdev,
struct ieee80211_channel *chan,
- unsigned int duration, u64 *cookie)
+ unsigned int duration, u64 *cookie, const u8 *rx_addr)
{
int ret;
- trace_rdev_remain_on_channel(&rdev->wiphy, wdev, chan, duration);
+ trace_rdev_remain_on_channel(&rdev->wiphy, wdev, chan, duration,
+ rx_addr);
ret = rdev->ops->remain_on_channel(&rdev->wiphy, wdev, chan,
- duration, cookie);
+ duration, cookie, rx_addr);
trace_rdev_return_int_cookie(&rdev->wiphy, ret, *cookie);
return ret;
}
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index af23f4fca90a..56718e250d31 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2155,22 +2155,26 @@ DEFINE_EVENT(rdev_pmksa, rdev_del_pmksa,
TRACE_EVENT(rdev_remain_on_channel,
TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev,
struct ieee80211_channel *chan,
- unsigned int duration),
- TP_ARGS(wiphy, wdev, chan, duration),
+ unsigned int duration, const u8 *rx_addr),
+ TP_ARGS(wiphy, wdev, chan, duration, rx_addr),
TP_STRUCT__entry(
WIPHY_ENTRY
WDEV_ENTRY
CHAN_ENTRY
__field(unsigned int, duration)
+ MAC_ENTRY(rx_addr)
),
TP_fast_assign(
WIPHY_ASSIGN;
WDEV_ASSIGN;
CHAN_ASSIGN(chan);
__entry->duration = duration;
+ MAC_ASSIGN(rx_addr, rx_addr);
),
- TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT ", " CHAN_PR_FMT ", duration: %u",
- WIPHY_PR_ARG, WDEV_PR_ARG, CHAN_PR_ARG, __entry->duration)
+ TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT ", " CHAN_PR_FMT
+ ", duration: %u, %pM",
+ WIPHY_PR_ARG, WDEV_PR_ARG, CHAN_PR_ARG, __entry->duration,
+ __entry->rx_addr)
);
TRACE_EVENT(rdev_return_int_cookie,
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 02/16] wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
When the nl80211 socket that originated a PMSR request is
closed, cfg80211_release_pmsr() sets the request's nl_portid
to zero and schedules pmsr_free_wk to process the abort
asynchronously. If the interface is concurrently torn down
before that work runs, cfg80211_pmsr_wdev_down() calls
cfg80211_pmsr_process_abort() directly. However, the already-
scheduled pmsr_free_wk work item remains pending and may run
after the interface has been removed from the driver. This
could cause the driver's abort_pmsr callback to operate on a
torn-down interface, leading to undefined behavior and
potential crashes.
Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()
before calling cfg80211_pmsr_process_abort(). This ensures any
pending or in-progress work is drained before interface teardown
proceeds, preventing the work from invoking the driver abort
callback after the interface is gone.
Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API")
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
net/wireless/pmsr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index b875b61c0b48..c2977a37add2 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -658,6 +658,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
}
spin_unlock_bh(&wdev->pmsr_lock);
+ cancel_work_sync(&wdev->pmsr_free_wk);
if (found)
cfg80211_pmsr_process_abort(wdev);
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 01/16] wifi: cfg80211: Allow RSTA role without LMR request
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
In-Reply-To: <20260304071538.3833062-1-peddolla.reddy@oss.qualcomm.com>
Currently when enabling RSTA role in PMSR FTM requests,
pmsr_parse_ftm() mandates LMR feedback to be requested. This
prevents valid use cases where devices need to operate as RSTA
without waking the host for measurement reports.
Remove the check that enforces LMR feedback for RSTA role and
update the documentation to clarify that LMR feedback is optional,
though required if measurement results are needed.
This allows devices to act as RSTA for proximity detection without
unnecessary host wakeups while maintaining the option to receive
results when needed through LMR feedback.
Fixes: 853800c746d3 ("wifi: nl80211/cfg80211: support operating as RSTA in PMSR FTM request")
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
---
include/net/cfg80211.h | 5 +++--
include/uapi/linux/nl80211.h | 5 ++---
net/wireless/pmsr.c | 7 -------
3 files changed, 5 insertions(+), 12 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8cd870ece351..a54300b6899a 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4363,8 +4363,9 @@ struct cfg80211_pmsr_result {
* EDCA based ranging will be used.
* @lmr_feedback: negotiate for I2R LMR feedback. Only valid if either
* @trigger_based or @non_trigger_based is set.
- * @rsta: Operate as the RSTA in the measurement. Only valid if @lmr_feedback
- * and either @trigger_based or @non_trigger_based is set.
+ * @rsta: Operate as the RSTA in the measurement. Only valid if either
+ * @trigger_based or @non_trigger_based is set. Set @lmr_feedback
+ * to receive measurement results in response.
* @bss_color: the bss color of the responder. Optional. Set to zero to
* indicate the driver should set the BSS color. Only valid if
* @non_trigger_based or @trigger_based is set.
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 0b7a06c2b9f7..8e4f9192d8b7 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -7961,9 +7961,8 @@ enum nl80211_peer_measurement_ftm_capa {
* channel specified in %NL80211_PMSR_PEER_ATTR_CHAN until it receives the
* FTM request from the peer or the timeout specified by
* %NL80211_ATTR_TIMEOUT has expired.
- * Only valid if %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK is set (so the
- * RSTA will have the measurement results to report back in the FTM
- * response).
+ * Set %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK to ensure RSTA will have
+ * the measurement results to report back in the FTM response.
*
* @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal
* @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 556f30f5d60a..b875b61c0b48 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -195,13 +195,6 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
return -EOPNOTSUPP;
}
- if (out->ftm.rsta && !out->ftm.lmr_feedback) {
- NL_SET_ERR_MSG_ATTR(info->extack,
- tb[NL80211_PMSR_FTM_REQ_ATTR_RSTA],
- "FTM: RSTA set without LMR feedback");
- return -EINVAL;
- }
-
return 0;
}
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v2 00/16] wifi: Ranging support enhancements
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:15 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, kavita.kavita
This patch series introduces Fine Timing Measurement (FTM)
enhancements and Proximity Detection (PD) capabilities. The
implementation follows the Wi-Fi Alliance "PR Implementation
Consideration Draft 1.9 Rev 1" specification and extends the
existing peer measurement framework with advanced ranging
features.
---
Changes in v2:
- Addressed comments.
- Removed ABORT command implementation as it is not needed.
- Added a patch for enhancement of Remain on channel command.
- Intoduced a new interface type PD.
- Added a patch for suppressing ranging results when requested.
---
Kavita Kavita (1):
wifi: mac80211_hwsim: Add support for extended FTM ranging
Peddolla Harshavardhan Reddy (15):
wifi: cfg80211: Allow RSTA role without LMR request
wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
wifi: cfg80211: Add MAC address filter to remain_on_channel
wifi: cfg80211/mac80211: Add NL80211_IFTYPE_PD for PD PASN and PMSR
operations
wifi: cfg80211: add start/stop proximity detection commands
wifi: cfg80211: add proximity detection capabilities to PMSR
wifi: cfg80211: add continuous ranging and PD request support
wifi: cfg80211: extend PMSR FTM response for proximity ranging
wifi: cfg80211: add role-based PD peer limits
wifi: cfg80211: add ingress/egress distance thresholds for FTM
wifi: cfg80211: add PD-specific preamble and bandwidth capabilities
wifi: cfg80211: add FTM range report negotiation support
wifi: cfg80211: add result reporting control for PD requests
wifi: cfg80211: add MAC randomization support for PD requests
wifi: cfg80211: add LTF keyseed support for secure ranging
drivers/net/wireless/ath/ath6kl/cfg80211.c | 3 +-
drivers/net/wireless/ath/wil6210/cfg80211.c | 3 +-
.../broadcom/brcm80211/brcmfmac/p2p.c | 4 +-
.../broadcom/brcm80211/brcmfmac/p2p.h | 3 +-
.../net/wireless/marvell/mwifiex/cfg80211.c | 3 +-
.../wireless/microchip/wilc1000/cfg80211.c | 3 +-
drivers/net/wireless/virtual/mac80211_hwsim.c | 171 +++++++++++++++
include/net/cfg80211.h | 181 ++++++++++++++-
include/uapi/linux/nl80211.h | 206 +++++++++++++++++-
net/mac80211/cfg.c | 2 +
net/mac80211/chan.c | 2 +
net/mac80211/ieee80211_i.h | 3 +-
net/mac80211/iface.c | 6 +-
net/mac80211/offchannel.c | 4 +-
net/mac80211/rx.c | 1 +
net/mac80211/util.c | 1 +
net/wireless/chan.c | 2 +
net/wireless/core.c | 31 +++
net/wireless/core.h | 2 +
net/wireless/mlme.c | 1 +
net/wireless/nl80211.c | 183 +++++++++++++++-
net/wireless/pmsr.c | 169 ++++++++++++--
net/wireless/rdev-ops.h | 26 ++-
net/wireless/reg.c | 3 +
net/wireless/trace.h | 32 ++-
net/wireless/util.c | 4 +-
26 files changed, 1000 insertions(+), 49 deletions(-)
base-commit: 5d048bbed1bb2bbef612dad0bb9c177c434e63a4
--
2.34.1
^ permalink raw reply
* Re: [PATCH 00/13] Ranging support enhancements
From: Peddolla Harshavardhan Reddy @ 2026-03-04 7:01 UTC (permalink / raw)
To: Lachlan Hodges; +Cc: johannes, linux-wireless
In-Reply-To: <gxhpubndywl7jrqb6rmvta7yzcyid3drr5jtsz6xfiel7aiaig@q22wvfrfo3ik>
On 03-Feb-26 5:10 PM, Lachlan Hodges wrote:
> Hi,
>
>> Peddolla Harshavardhan Reddy (12):
>> wifi: nl80211/cfg80211: Allow RSTA role to be enabled without LMR
>> request
>> wifi: nl80211/cfg80211: add proximity detection capabilities to PMSR
>> wifi: nl80211/cfg80211: add continuous ranging and PD request support
>> wifi: nl80211/cfg80211: extend PMSR FTM response for proximity ranging
>> wifi: nl80211/cfg80211: add peer measurement abort command
>> wifi: nl80211/cfg80211: add role-based PD peer limits
>> wifi: nl80211/cfg80211: add ingress/egress distance thresholds for FTM
>> wifi: nl80211/cfg80211: add PD-specific bandwidth capabilities for FTM
>> wifi: nl80211/cfg80211: add FTM range report negotiation support
>> wifi: nl80211/cfg80211: add result reporting control for PD requests
>> wifi: nl80211/cfg80211: add MAC randomization support for PD requests
>> wifi: nl80211/cfg80211: add LTF keyseed support for secure ranging
> Could you not just have "wifi: cfg80211: ..." for each commit? I think
> having both nl80211 and cfg80211 just adds unnecessary noise when
> ultimately this is all within cfg80211.
>
> lachlan
Sure, will use "wifi: cfg80211: ..." format, Thanks.
^ permalink raw reply
* Re: [PATCH 05/13] wifi: nl80211/cfg80211: add peer measurement abort command
From: Peddolla Harshavardhan Reddy @ 2026-03-04 6:59 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless
In-Reply-To: <8dd352f984cfd23ed178d5917419e15af0c201e7.camel@sipsolutions.net>
On 30-Jan-26 9:45 PM, Johannes Berg wrote:
> On Fri, 2026-01-30 at 21:30 +0530, Peddolla Harshavardhan Reddy wrote:
>> Add support for aborting ongoing peer measurement sessions
>> through a new NL80211_CMD_PEER_MEASUREMENT_ABORT command.
>> This allows userspace to cancel continuous ranging or other
>> long-running measurement sessions before completion.
>>
>> The abort operation is identified by the measurement cookie.
>> When a matching request is found, it is marked for cleanup
>> and the existing free work is scheduled to handle the
>> abortion and notify the driver.
> Originally, the idea was that we don't need this, since it's easy to
> just close the socket. Are there any resource constraints in socket
> handling in userspace that make this necessary? I'm not necessarily
> totally opposed to this, but you also haven't explained why it's
> necessary at all.
>
> johannes
We’ll be dropping this. As you pointed out, PMSR abort can be handled by closing the socket. Thanks.
^ permalink raw reply
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Johannes Berg @ 2026-03-04 6:57 UTC (permalink / raw)
To: Hillf Danton
Cc: Ben Greear, linux-wireless, Korenblit, Miriam Rachel, linux-mm,
Tejun Heo, linux-kernel
In-Reply-To: <20260304030835.610-1-hdanton@sina.com>
On Wed, 2026-03-04 at 11:08 +0800, Hillf Danton wrote:
> >
> > Fair. I don't know, I don't think there's anything that even shows that
> > there's a dependency between the two workqueues and the
> > "((wq_completion)events_unbound)" and "((wq_completion)events)", and
> > there would have to be for it to deadlock this way because of that?
> >
> Given the locks held [1],
>
> kworker/1:0/39480 kworker/u32:11/34989
> rtnl_mutex
> &rdev->wiphy.mtx
> __lru_add_drain_all
> flush_work(&per_cpu(lru_add_drain_work, cpu))
> &rdev->wiphy.mtx
>
> __if__ there is one work item queued __before__ one of the flush targets on
> workqueue and it acquires the rtnl mutex, then no deadlock can rise,
> because worker-xyz gets off CPU due to failing to take the rtnl lock then
> worker-xyz+1 dequeus the flush target and completes it due to nothing
> with rtnl. Same applies to the wiphy lock.
Right.
> BTW any chance for queuing work that acquires rtnl lock on mm_percpu_wq?
There really is only the work I was describing and vmstat_work (calling
vmstat_update) on that workqueue, afaict.
johannes
^ permalink raw reply
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Hillf Danton @ 2026-03-04 3:08 UTC (permalink / raw)
To: Johannes Berg
Cc: Ben Greear, linux-wireless, Korenblit, Miriam Rachel, linux-mm,
Tejun Heo, linux-kernel
In-Reply-To: <35779061f94c2a55bb58dcd619ae91c618509cf4.camel@sipsolutions.net>
On Tue, 03 Mar 2026 12:49:24 +0100 Johannes Berg wrote:
>On Mon, 2026-03-02 at 07:50 -0800, Ben Greear wrote:
>> On 3/2/26 07:38, Johannes Berg wrote:
>> > On Mon, 2026-03-02 at 07:26 -0800, Ben Greear wrote:
>> > > >
>> > > > Was this with lockdep? If so, it complain about anything?
>> > > >
>> > > > I'm having a hard time seeing why it would deadlock at all when wifi
>> > > > uses schedule_work() and therefore the system_percpu_wq, and
>> > > > __lru_add_drain_all() flushes lru_add_drain_work on mm_percpu_wq, and
>> > > > lru_add_and_bh_lrus_drain() doesn't really _seem_ to do anything related
>> > > > to RTNL etc.?
>> > > >
>> > > > I think we need a real explanation here rather than "if I randomly
>> > > > change this, it no longer appears".
>> > >
>> > > The path where iwlwifi acquires CMA holds rtnl and/or wiphy locks before
>> > > allocating CMA memory, as expected.
>> > >
>> > > And the CMA allocation path attempts to flush the work queues in
>> > > at least some cases.
>> > >
>> > > If there is a work item queued that is trying to grab rtnl and/or wiphy lock
>> > > when CMA attempts to flush, then the flush work cannot complete, so it deadlocks.
>> > >
>> > > Lockdep doesn't warn about this.
>> >
>> > It really should, in cases where it can actually happen, I wrote the
>> > code myself for that... Though things have changed since, and the checks
>> > were lost at least once (and re-added), so I suppose it's possible that
>> > they were lost _again_, but the flushing system is far more flexible now
>> > and it's not flushing the same workqueue anyway, so it shouldn't happen.
>> >
>> > I stand by what I said before, need to show more precisely what depends
>> > on what, and I'm not going to accept a random kthread into this.
>>
>> My first email on the topic has process stack traces as well as lockdep
>> locks-held printout that points to the deadlock. I'm not sure what else to offer...please let me know
>> what you'd like to see.
>
> Fair. I don't know, I don't think there's anything that even shows that
> there's a dependency between the two workqueues and the
> "((wq_completion)events_unbound)" and "((wq_completion)events)", and
> there would have to be for it to deadlock this way because of that?
>
Given the locks held [1],
kworker/1:0/39480 kworker/u32:11/34989
rtnl_mutex
&rdev->wiphy.mtx
__lru_add_drain_all
flush_work(&per_cpu(lru_add_drain_work, cpu))
&rdev->wiphy.mtx
__if__ there is one work item queued __before__ one of the flush targets on
workqueue and it acquires the rtnl mutex, then no deadlock can rise,
because worker-xyz gets off CPU due to failing to take the rtnl lock then
worker-xyz+1 dequeus the flush target and completes it due to nothing
with rtnl. Same applies to the wiphy lock.
BTW any chance for queuing work that acquires rtnl lock on mm_percpu_wq?
[1] Subject: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
https://lore.kernel.org/linux-wireless/fa4e82ee-eb14-3930-c76c-f3bd59c5f258@candelatech.com/
^ permalink raw reply
* Re: [RFC wireless-next 8/8] wifi: mac80211: set AP NPCA parameters in bss_conf
From: Lachlan Hodges @ 2026-03-04 2:56 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, Johannes Berg
In-Reply-To: <20260303153435.75b65c3144b6.I3db62b48d6afefd23b50fd14663f863e6f9974ca@changeid>
> + npca = ieee80211_uhr_npca_info(params->uhr_oper);
> + if (!npca) {
> + chanreq.oper.npca_chan = NULL;
> + chanreq.oper.npca_punctured = 0;
> + } else {
> + npca_params.min_dur_thresh =
> + le32_get_bits(npca->params,
> + IEEE80211_UHR_NPCA_PARAMS_MIN_DUR_THRESH);
> + npca_params.switch_delay =
> + le32_get_bits(npca->params,
> + IEEE80211_UHR_NPCA_PARAMS_SWITCH_DELAY);
> + npca_params.switch_back_delay =
> + le32_get_bits(npca->params,
> + IEEE80211_UHR_NPCA_PARAMS_SWITCH_BACK_DELAY);
> + npca_params.init_qsrc =
> + le32_get_bits(npca->params,
> + IEEE80211_UHR_NPCA_PARAMS_INIT_QSRC);
> + npca_params.moplen =
> + le32_get_bits(npca->params,
> + IEEE80211_UHR_NPCA_PARAMS_MOPLEN);
> + npca_params.enabled = true;
> + }
Minor nit, and I can't really comment on the actual UHR code - but would
it be nicer to have
if (npca) {
npca_params.min_dur_thresh = ...
...
} else {
chanreq.oper.npca_chan = NULL;
chanreq.oper.npca_punctured = 0;
}
instead? I have no strong feelings of course, I was just perusing and
felt it was a bit strange to read.
lachlan
^ permalink raw reply
* Re: New warning `ath10k_pci 0000:3a:00.0: not found station for peer stats`
From: Baochen Qiang @ 2026-03-04 1:47 UTC (permalink / raw)
To: Paul Menzel, Jeff Johnson; +Cc: linux-wireless, ath10k
In-Reply-To: <e71b2039-0478-4775-b221-753dc25647d5@molgen.mpg.de>
On 3/4/2026 4:01 AM, Paul Menzel wrote:
> Dear Baochen,
>
>
> Am 11.02.26 um 06:43 schrieb Baochen Qiang:
>
>> On 2/10/2026 6:31 AM, Paul Menzel wrote:
>
>>> Am 09.02.26 um 03:44 schrieb Baochen Qiang:
>>>
>>>> On 2/7/2026 1:55 PM, Paul Menzel wrote:
>>>
>>>>> Am 19.01.26 um 17:41 schrieb Paul Menzel:
>>>>>
>>>>>> Since January 10th, I have started seeing the warning below in
>>>>>> my Linux logs, that reach back to September 24th, 2025:
>>>>>>
>>>>>> [ 37.108902] ath10k_pci 0000:3a:00.0: not found station for peer stats
>>>>>> [ 37.108906] ath10k_pci 0000:3a:00.0: failed to parse stats info tlv: -22
>>>>>>
>>>>>> It started appearing with 6.19.0-rc4-00282-gb6151c4e60e5, the
>>>>>> version running before is 6.19.0-rc4-00003-g3609fa95fb0f, but I
>>>>>> do not see anything related in the commit list:
>>>>>>
>>>>>> git log --oneline 3609fa95fb0f...b6151c4e60e5
>>>>>>
>>>>>> The warning log from `drivers/net/wireless/ath/ath10k/wmi-tlv.c` has also been there
>>>>>> since 2021.
>>>>>>
>>>>>> Do you have an idea? Please find the output of `dmesg` attached.
>>>>>
>>>>> Looking through the commit list from above again, commit
>>>>> a203dbeeca15 (wifi: mac80211: collect station statistics earlier
>>>>> when disconnect) probably introduced the new behavior.
>>>>
>>>> is this error seen when disconnecting from AP?
>>>
>>> I attached the logs in my first message. But yes, it looks like this:
>>
>> sorry, didn't notice there was an attachment.
>>
>>>
>>> Feb 07 06:32:52 abreu kernel: wlp58s0: deauthenticating from 74:1a:e0:e7:b4:c8 by
>>> local choice (Reason: 3=DEAUTH_LEAVING)
>>> Feb 07 06:32:52 abreu kernel: ath10k_pci 0000:3a:00.0: not found station for peer
>>> stats
>>> Feb 07 06:32:52 abreu kernel: ath10k_pci 0000:3a:00.0: failed to parse stats info
>>> tlv: -22
>>> Feb 07 06:32:52 abreu wpa_supplicant[846]: wlp58s0: CTRL-EVENT-DISCONNECTED
>>> bssid=74:1a:e0:e7:b4:c8 reason=3 locally_generated=1
>>> Feb 07 06:32:52 abreu wpa_supplicant[846]: BSSID 74:1a:e0:e7:b4:c8 ignore list
>>> count incremented to 2, ignoring for 10 seconds
>>>
>>>> did you try with that commit reverted?
>>>
>>> Yes, I tried it now with Linux 6.19 and reverting the commit. The warnings are gone now.
>>>
>>> Are you able to reproduce the issue? What devices are you testing with?
>>
>> I managed to reproduce this issue locally. Will submit a patch fixing it.
> Sorry for being impatient, but as Linux 7.0-rc2 was tagged, were you able to come up with
> a patch, or should the commit be reverted for now to have more time to analyze this?
The patch is under internal review now, will submit once it is approved.
>
>
> Kind regards,
>
> Paul
^ permalink raw reply
* [wireless:for-next] BUILD SUCCESS 4e10a730d1b511ff49723371ed6d694dd1b2c785
From: kernel test robot @ 2026-03-04 1:09 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git for-next
branch HEAD: 4e10a730d1b511ff49723371ed6d694dd1b2c785 wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
elapsed time: 826m
configs tested: 57
configs skipped: 0
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig gcc-15.2.0
arm allnoconfig clang-23
arm allyesconfig gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allnoconfig gcc-15.2.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
hexagon allmodconfig clang-17
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-23
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allyesconfig gcc-14
loongarch allmodconfig clang-19
loongarch allnoconfig clang-23
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig gcc-11.5.0
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig gcc-15.2.0
parisc allyesconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig gcc-15.2.0
riscv allmodconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
s390 allmodconfig clang-18
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
sh allmodconfig gcc-15.2.0
sh allnoconfig gcc-15.2.0
sh allyesconfig gcc-15.2.0
sparc allnoconfig gcc-15.2.0
sparc64 allmodconfig clang-23
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-15.2.0
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allyesconfig clang-20
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Ben Greear @ 2026-03-04 0:02 UTC (permalink / raw)
To: Tejun Heo
Cc: Johannes Berg, linux-wireless, Korenblit, Miriam Rachel, linux-mm,
linux-kernel
In-Reply-To: <aadYoaA_JYduCx_S@slm.duckdns.org>
On 3/3/26 13:54, Tejun Heo wrote:
> Hello,
>
> On Tue, Mar 03, 2026 at 01:40:54PM -0800, Ben Greear wrote:
>> If I use a kthread to do the blocking reg_todo work, then the problem
>> goes away, so it somehow does appear that the work flush logic down in swap.c
>> is somehow being blocked by the reg_todo work item, not just the swap.c
>> logic somehow blocking against itself.
>>
>> My kthread hack left the reg_todo work item logic in place, but instead of
>> the work item doing any blocking work, it instead just wakes the kthread
>> I added and has that kthread do the work under mutex.
>>
>> The second regulatory related work item in net/wireless/ causes the same
>> lockup, though it was harder to reproduce. Putting that work in the kthread
>> also seems to have fixed it.
>>
>> I could only ever reproduce this with KASAN (and lockdep and other debugging options
>> enabled), my guess is that this is because then the system runs slower and/or there
>> is more memory pressure.
>>
>> I should still be able to reproduce this if I switch to upstream kernel, so
>> if there is any debugging code you'd like me to execute, I will attempt to
>> do so.
>
> I think the main thing is findin out what state the work item is in. Is it
> pending, running, or finished? You can enable wq tracepoints to figure that
> out or if you can take a crashdump when it's stalled, nowadays it's really
> easy to tell the state w/ something like claude code and drgn. Just tell
> claude to use drgn to look at the crashdump and ask it to locate the work
> item and what it's doing. It works surprisingly well.
Could the logic that detects blocked work-queues instead be instrumented
to print out more useful information so that just reproducing the problem
and providing dmesg output will be sufficient? Or does dmesg already provide
enough that would give you a clue as to what is going on?
If I were to attempt to use AI on the coredump, would echoing 'c' to /proc/sysrq-trigger
with kdump enabled (when deadlock is happening) be the appropriate action to grab the core file?
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply
* [syzbot] [wireless?] WARNING: refcount bug in rsi_91x_deinit
From: syzbot @ 2026-03-03 22:48 UTC (permalink / raw)
To: linux-kernel, linux-usb, linux-wireless, netdev, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: bb375c251ab4 dt-bindings: usb: st,st-ohci-300x: convert to..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=1416c5aa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1500201919951cc
dashboard link: https://syzkaller.appspot.com/bug?extid=ba76f6da746fd674d311
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2475c3172471/disk-bb375c25.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/30449aa672dd/vmlinux-bb375c25.xz
kernel image: https://storage.googleapis.com/syzbot-assets/46d3937d1c16/bzImage-bb375c25.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ba76f6da746fd674d311@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x111/0x130 lib/refcount.c:25, CPU#0: kworker/0:1/10
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:refcount_warn_saturate+0x111/0x130 lib/refcount.c:25
Code: cc e8 43 d8 e5 fe 48 8d 3d 4c 6c 28 08 67 48 0f b9 3a e8 32 d8 e5 fe 5b 5d e9 cb 88 9f 04 e8 26 d8 e5 fe 48 8d 3d 3f 6c 28 08 <67> 48 0f b9 3a e8 15 d8 e5 fe 5b 5d c3 cc cc cc cc 48 89 df e8 46
RSP: 0018:ffffc900000aef30 EFLAGS: 00010246
RAX: 0000000000100000 RBX: ffff88811d6f9d28 RCX: ffffc90015361000
RDX: 0000000000100000 RSI: ffffffff82cbe1da RDI: ffffffff8af44e20
RBP: 0000000000000002 R08: 0000000000000005 R09: 0000000000000004
R10: 0000000000000002 R11: ffff8881f5639708 R12: ffff88811bdf0000
R13: ffff88811d6f9d28 R14: 0000000000000000 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff8882686d3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f04409cb6b0 CR3: 0000000121146000 CR4: 00000000003506f0
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:289 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_task_struct include/linux/sched/task.h:116 [inline]
kthread_stop+0x602/0x680 kernel/kthread.c:785
rsi_kill_thread drivers/net/wireless/rsi/rsi_common.h:78 [inline]
rsi_91x_deinit+0x102/0x1f0 drivers/net/wireless/rsi/rsi_91x_main.c:405
rsi_probe+0xd27/0x1aa0 drivers/net/wireless/rsi/rsi_91x_usb.c:861
usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:583 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:661
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:803
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833
__device_attach_driver+0x1ff/0x3e0 drivers/base/dd.c:961
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1033
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x64/0x160 drivers/base/bus.c:574
device_add+0x11d9/0x1950 drivers/base/core.c:3689
usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2208
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:583 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:661
__driver_probe_device+0x1de/0x400 drivers/base/dd.c:803
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:833
__device_attach_driver+0x1ff/0x3e0 drivers/base/dd.c:961
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1033
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x64/0x160 drivers/base/bus.c:574
device_add+0x11d9/0x1950 drivers/base/core.c:3689
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275
process_scheduled_works kernel/workqueue.c:3358 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3439
kthread+0x370/0x450 kernel/kthread.c:467
ret_from_fork+0x6c3/0xcb0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------------
Code disassembly (best guess):
0: cc int3
1: e8 43 d8 e5 fe call 0xfee5d849
6: 48 8d 3d 4c 6c 28 08 lea 0x8286c4c(%rip),%rdi # 0x8286c59
d: 67 48 0f b9 3a ud1 (%edx),%rdi
12: e8 32 d8 e5 fe call 0xfee5d849
17: 5b pop %rbx
18: 5d pop %rbp
19: e9 cb 88 9f 04 jmp 0x49f88e9
1e: e8 26 d8 e5 fe call 0xfee5d849
23: 48 8d 3d 3f 6c 28 08 lea 0x8286c3f(%rip),%rdi # 0x8286c69
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e8 15 d8 e5 fe call 0xfee5d849
34: 5b pop %rbx
35: 5d pop %rbp
36: c3 ret
37: cc int3
38: cc int3
39: cc int3
3a: cc int3
3b: 48 89 df mov %rbx,%rdi
3e: e8 .byte 0xe8
3f: 46 rex.RX
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Tejun Heo @ 2026-03-03 21:54 UTC (permalink / raw)
To: Ben Greear
Cc: Johannes Berg, linux-wireless, Korenblit, Miriam Rachel, linux-mm,
linux-kernel
In-Reply-To: <35a7ebcf-862f-0b3a-a245-c32196a58692@candelatech.com>
Hello,
On Tue, Mar 03, 2026 at 01:40:54PM -0800, Ben Greear wrote:
> If I use a kthread to do the blocking reg_todo work, then the problem
> goes away, so it somehow does appear that the work flush logic down in swap.c
> is somehow being blocked by the reg_todo work item, not just the swap.c
> logic somehow blocking against itself.
>
> My kthread hack left the reg_todo work item logic in place, but instead of
> the work item doing any blocking work, it instead just wakes the kthread
> I added and has that kthread do the work under mutex.
>
> The second regulatory related work item in net/wireless/ causes the same
> lockup, though it was harder to reproduce. Putting that work in the kthread
> also seems to have fixed it.
>
> I could only ever reproduce this with KASAN (and lockdep and other debugging options
> enabled), my guess is that this is because then the system runs slower and/or there
> is more memory pressure.
>
> I should still be able to reproduce this if I switch to upstream kernel, so
> if there is any debugging code you'd like me to execute, I will attempt to
> do so.
I think the main thing is findin out what state the work item is in. Is it
pending, running, or finished? You can enable wq tracepoints to figure that
out or if you can take a crashdump when it's stalled, nowadays it's really
easy to tell the state w/ something like claude code and drgn. Just tell
claude to use drgn to look at the crashdump and ask it to locate the work
item and what it's doing. It works surprisingly well.
Thanks.
--
tejun
^ permalink raw reply
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Ben Greear @ 2026-03-03 21:40 UTC (permalink / raw)
To: Johannes Berg, Tejun Heo
Cc: linux-wireless, Korenblit, Miriam Rachel, linux-mm, linux-kernel
In-Reply-To: <3303d57a4ea6776dbc66ca72441023f76e6f1234.camel@sipsolutions.net>
On 3/3/26 13:12, Johannes Berg wrote:
> On Tue, 2026-03-03 at 10:52 -1000, Tejun Heo wrote:
>> Hello,
>>
>> On Tue, Mar 03, 2026 at 12:49:24PM +0100, Johannes Berg wrote:
>>> Fair. I don't know, I don't think there's anything that even shows that
>>> there's a dependency between the two workqueues and the
>>> "((wq_completion)events_unbound)" and "((wq_completion)events)", and
>>> there would have to be for it to deadlock this way because of that?
>>>
>>> But one is mm_percpu_wq and the other is system_percpu_wq.
>>>
>>> Tejun, does the workqueue code somehow introduce a dependency between
>>> different per-CPU workqueues that's not modelled in lockdep?
>>
>> Hopefully not. Kinda late to the party. Why isn't mm_percpu_wq making
>> forward progress? That should in all circumstances. What's the work item and
>> kworker doing?
>
> Oh and in addition: the worker that's kicked off by
> __lru_add_drain_all() doesn't really seem to do anything long-running?
> It's lru_add_drain_per_cpu(), which is lru_add_and_bh_lrus_drain(),
> which would appear to be entirely non-sleepable code (holding either
> local locks or having irqs disabled.) It also doesn't show up in the
> log, apparently, hence my question about strange dependencies.
Hello Tejun,
If I use a kthread to do the blocking reg_todo work, then the problem
goes away, so it somehow does appear that the work flush logic down in swap.c
is somehow being blocked by the reg_todo work item, not just the swap.c
logic somehow blocking against itself.
My kthread hack left the reg_todo work item logic in place, but instead of
the work item doing any blocking work, it instead just wakes the kthread
I added and has that kthread do the work under mutex.
The second regulatory related work item in net/wireless/ causes the same
lockup, though it was harder to reproduce. Putting that work in the kthread
also seems to have fixed it.
I could only ever reproduce this with KASAN (and lockdep and other debugging options
enabled), my guess is that this is because then the system runs slower and/or there
is more memory pressure.
I should still be able to reproduce this if I switch to upstream kernel, so
if there is any debugging code you'd like me to execute, I will attempt to
do so.
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply
* [PATCH v2 wireless-next] wifi: nl80211: split out UHR operation information
From: Johannes Berg @ 2026-03-03 21:17 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
From: Johannes Berg <johannes.berg@intel.com>
The beacon doesn't contain the full UHR operation, a number
of fields (such as NPCA) are only partially there. Add a new
attribute to contain the full information, so it's available
to the driver/mac80211.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
v2: fix double opening bracket from backport removal
---
include/uapi/linux/nl80211.h | 6 ++++++
net/wireless/nl80211.c | 26 ++++++++++++++++----------
2 files changed, 22 insertions(+), 10 deletions(-)
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 0b7a06c2b9f7..67d764023988 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -3001,6 +3001,10 @@ enum nl80211_commands {
* interference detection is not performed on these sub-channels, their
* corresponding bits are consistently set to zero.
*
+ * @NL80211_ATTR_UHR_OPERATION: Full UHR Operation element, as it appears in
+ * association response etc., since it's abridged in the beacon. Used
+ * for START_AP etc.
+ *
* @NUM_NL80211_ATTR: total number of nl80211_attrs available
* @NL80211_ATTR_MAX: highest attribute number currently defined
* @__NL80211_ATTR_AFTER_LAST: internal use
@@ -3576,6 +3580,8 @@ enum nl80211_attrs {
NL80211_ATTR_INCUMBENT_SIGNAL_INTERFERENCE_BITMAP,
+ NL80211_ATTR_UHR_OPERATION,
+
/* add attributes here, update the policy in nl80211.c */
__NL80211_ATTR_AFTER_LAST,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2225f5d0b124..6b402197f1dd 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -342,6 +342,17 @@ static int validate_uhr_capa(const struct nlattr *attr,
return ieee80211_uhr_capa_size_ok(data, len, false);
}
+static int validate_uhr_operation(const struct nlattr *attr,
+ struct netlink_ext_ack *extack)
+{
+ const u8 *data = nla_data(attr);
+ unsigned int len = nla_len(attr);
+
+ if (!ieee80211_uhr_oper_size_ok(data, len, false))
+ return -EINVAL;
+ return 0;
+}
+
/* policy for the attributes */
static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
@@ -947,6 +958,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
[NL80211_ATTR_UHR_CAPABILITY] =
NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_uhr_capa, 255),
[NL80211_ATTR_DISABLE_UHR] = { .type = NLA_FLAG },
+ [NL80211_ATTR_UHR_OPERATION] =
+ NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_uhr_operation),
};
/* policy for the key attributes */
@@ -6499,16 +6512,6 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
return -EINVAL;
}
- cap = cfg80211_find_ext_elem(WLAN_EID_EXT_UHR_OPER, ies, ies_len);
- if (cap) {
- if (!cap->datalen)
- return -EINVAL;
- params->uhr_oper = (void *)(cap->data + 1);
- if (!ieee80211_uhr_oper_size_ok((const u8 *)params->uhr_oper,
- cap->datalen - 1, true))
- return -EINVAL;
- }
-
return 0;
}
@@ -6950,6 +6953,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
if (err)
goto out;
+ if (info->attrs[NL80211_ATTR_UHR_OPERATION])
+ params->uhr_oper = nla_data(info->attrs[NL80211_ATTR_UHR_OPERATION]);
+
err = nl80211_validate_ap_phy_operation(params);
if (err)
goto out;
--
2.53.0
^ permalink raw reply related
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Johannes Berg @ 2026-03-03 21:12 UTC (permalink / raw)
To: Tejun Heo
Cc: Ben Greear, linux-wireless, Korenblit, Miriam Rachel, linux-mm,
linux-kernel
In-Reply-To: <aadKDCKGHk1Ua-7_@slm.duckdns.org>
On Tue, 2026-03-03 at 10:52 -1000, Tejun Heo wrote:
> Hello,
>
> On Tue, Mar 03, 2026 at 12:49:24PM +0100, Johannes Berg wrote:
> > Fair. I don't know, I don't think there's anything that even shows that
> > there's a dependency between the two workqueues and the
> > "((wq_completion)events_unbound)" and "((wq_completion)events)", and
> > there would have to be for it to deadlock this way because of that?
> >
> > But one is mm_percpu_wq and the other is system_percpu_wq.
> >
> > Tejun, does the workqueue code somehow introduce a dependency between
> > different per-CPU workqueues that's not modelled in lockdep?
>
> Hopefully not. Kinda late to the party. Why isn't mm_percpu_wq making
> forward progress? That should in all circumstances. What's the work item and
> kworker doing?
Oh and in addition: the worker that's kicked off by
__lru_add_drain_all() doesn't really seem to do anything long-running?
It's lru_add_drain_per_cpu(), which is lru_add_and_bh_lrus_drain(),
which would appear to be entirely non-sleepable code (holding either
local locks or having irqs disabled.) It also doesn't show up in the
log, apparently, hence my question about strange dependencies.
johannes
^ permalink raw reply
* Re: 6.18.13 iwlwifi deadlock allocating cma while work-item is active.
From: Johannes Berg @ 2026-03-03 21:03 UTC (permalink / raw)
To: Tejun Heo
Cc: Ben Greear, linux-wireless, Korenblit, Miriam Rachel, linux-mm,
linux-kernel
In-Reply-To: <aadKDCKGHk1Ua-7_@slm.duckdns.org>
On Tue, 2026-03-03 at 10:52 -1000, Tejun Heo wrote:
> Hello,
>
> On Tue, Mar 03, 2026 at 12:49:24PM +0100, Johannes Berg wrote:
> > Fair. I don't know, I don't think there's anything that even shows that
> > there's a dependency between the two workqueues and the
> > "((wq_completion)events_unbound)" and "((wq_completion)events)", and
> > there would have to be for it to deadlock this way because of that?
> >
> > But one is mm_percpu_wq and the other is system_percpu_wq.
> >
> > Tejun, does the workqueue code somehow introduce a dependency between
> > different per-CPU workqueues that's not modelled in lockdep?
>
> Hopefully not. Kinda late to the party.
Yeah, sorry, should've included a link:
https://lore.kernel.org/linux-wireless/fa4e82ee-eb14-3930-c76c-f3bd59c5f258@candelatech.com/
> Why isn't mm_percpu_wq making
> forward progress? That should in all circumstances. What's the work item and
> kworker doing?
So it seems that first iwlwifi is holding the RTNL:
ieee80211_open+0x62/0xe0 [mac80211]
__dev_open+0x11a/0x2e0
__dev_change_flags+0x1f8/0x280
netif_change_flags+0x22/0x60
do_setlink.isra.0+0xe57/0x11a0
rtnl_newlink+0x7e8/0xb50
(last stack trace at the above link)
This stuff definitely happens with the RTNL held, although I didn't
check now which function actually acquires it in this stack.
Simultaneously the kworker/6:0 is stuck in reg_todo(), trying to acquire
the RTNL.
So far that seems fairly much normal. The kworker/6:0 running reg_todo()
is from net/wireless/reg.c, reg_work, scheduled to system_percpu_wq (by
simply schedule_work.)
Now iwlwifi is also trying to allocate coherent DMA memory (continuing
the stack trace), potentially a significant chunk for firmware loading:
dma_direct_alloc+0x7b/0x250
dma_alloc_attrs+0xa1/0x2a0
_iwl_pcie_ctxt_info_dma_alloc_coherent+0x31/0xb0 [iwlwifi]
iwl_pcie_ctxt_info_alloc_dma+0x20/0x50 [iwlwifi]
iwl_pcie_init_fw_sec+0x2fc/0x380 [iwlwifi]
iwl_pcie_ctxt_info_v2_alloc+0x19e/0x530 [iwlwifi]
iwl_trans_pcie_gen2_start_fw+0x2e2/0x820 [iwlwifi]
iwl_trans_start_fw+0x77/0x90 [iwlwifi]
iwl_mld_load_fw_wait_alive+0x97/0x2c0 [iwlmld]
iwl_mld_load_fw+0x91/0x240 [iwlmld]
iwl_mld_start_fw+0x44/0x470 [iwlmld]
iwl_mld_mac80211_start+0x3d/0x1b0 [iwlmld]
drv_start+0x6f/0x1d0 [mac80211]
ieee80211_do_open+0x2d6/0x960 [mac80211]
ieee80211_open+0x62/0xe0 [mac80211]
This is fine, but then it gets into __flush_work() in
__lru_add_drain_all():
__flush_work+0x34e/0x530
__lru_add_drain_all+0x19b/0x220
alloc_contig_range_noprof+0x1de/0x8a0
__cma_alloc+0x1f1/0x6a0
__dma_direct_alloc_pages.isra.0+0xcb/0x2f0
dma_direct_alloc+0x7b/0x250
which is because __lru_add_drain_all() schedules a bunch of workers, one
for each CPU, onto the mm_percpu_wq and then waits for them.
Conceptually, I see nothing wrong with this, hence my question; Ben says
that the system stops making progress at this point.
johannes
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox