* [PATCH v3 1/3] dt-bindings: remoteproc: qcom,wcnss-pil: Add wcn3610 compatible
From: Kerigan Creighton @ 2026-03-06 0:43 UTC (permalink / raw)
To: linux-wireless
Cc: loic.poulain, wcn36xx, andersson, mathieu.poirier,
linux-remoteproc, linux-arm-msm, robh, krzk+dt, conor+dt,
devicetree, linux-kernel, Kerigan Creighton
In-Reply-To: <20260306004344.10968-1-kerigancreighton@gmail.com>
The Qualcomm WCN3610 is a 2.4GHz-only WLAN/BT combo chip.
It's similar to the WCN3620, though more basic. Add a
wcn3610 compatible for use in device trees.
It needs its own compatible because of chip-specific
configuration done in wcn36xx.
Signed-off-by: Kerigan Creighton <kerigancreighton@gmail.com>
---
Changes in v2:
- Move the Documentation patch to the beginning of the patch set.
Changes in v3:
- Describe the hardware rather than the driver in the
dt-bindings patch [Krzysztof].
---
Documentation/devicetree/bindings/remoteproc/qcom,wcnss-pil.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/remoteproc/qcom,wcnss-pil.yaml b/Documentation/devicetree/bindings/remoteproc/qcom,wcnss-pil.yaml
index 117fb4d0c4..018cdf5177 100644
--- a/Documentation/devicetree/bindings/remoteproc/qcom,wcnss-pil.yaml
+++ b/Documentation/devicetree/bindings/remoteproc/qcom,wcnss-pil.yaml
@@ -109,6 +109,7 @@ properties:
properties:
compatible:
enum:
+ - qcom,wcn3610
- qcom,wcn3620
- qcom,wcn3660
- qcom,wcn3660b
--
2.53.0
^ permalink raw reply related
* [PATCH v3 2/3] remoteproc: qcom_wcnss_iris: Add support for WCN3610
From: Kerigan Creighton @ 2026-03-06 0:43 UTC (permalink / raw)
To: linux-wireless
Cc: loic.poulain, wcn36xx, andersson, mathieu.poirier,
linux-remoteproc, linux-arm-msm, robh, krzk+dt, conor+dt,
devicetree, linux-kernel, Kerigan Creighton, Dmitry Baryshkov
In-Reply-To: <20260306004344.10968-1-kerigancreighton@gmail.com>
WCN3610 has the same regulator requirements as
WCN3620, so in qcom_wcnss_iris, we can use wcn3620_data.
A separate compatible is needed for WCN3610 because the
wcn36xx driver uses it for chip-specific configuration.
Specifically, it sets BTC (Bluetooth Coexistence) CFGs,
disables ENABLE_DYNAMIC_RA_START_RATE, and disables
STA_POWERSAVE for this specific chip for stable
functionality.
Signed-off-by: Kerigan Creighton <kerigancreighton@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
Changes in v2:
- Move remoteproc compatible string addition to the middle of
the patch set.
- Add Reviewed-by Dmitry (thanks!)
Changes in v3:
- Describe why we need a new compatible in the remoteproc
patch [Krzysztof].
---
drivers/remoteproc/qcom_wcnss_iris.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/remoteproc/qcom_wcnss_iris.c b/drivers/remoteproc/qcom_wcnss_iris.c
index 2b89b4db6c..e58b59355f 100644
--- a/drivers/remoteproc/qcom_wcnss_iris.c
+++ b/drivers/remoteproc/qcom_wcnss_iris.c
@@ -95,6 +95,7 @@ void qcom_iris_disable(struct qcom_iris *iris)
}
static const struct of_device_id iris_of_match[] = {
+ { .compatible = "qcom,wcn3610", .data = &wcn3620_data },
{ .compatible = "qcom,wcn3620", .data = &wcn3620_data },
{ .compatible = "qcom,wcn3660", .data = &wcn3660_data },
{ .compatible = "qcom,wcn3660b", .data = &wcn3680_data },
--
2.53.0
^ permalink raw reply related
* [PATCH v3 3/3] wifi: wcn36xx: Add support for WCN3610
From: Kerigan Creighton @ 2026-03-06 0:43 UTC (permalink / raw)
To: linux-wireless
Cc: loic.poulain, wcn36xx, andersson, mathieu.poirier,
linux-remoteproc, linux-arm-msm, robh, krzk+dt, conor+dt,
devicetree, linux-kernel, Kerigan Creighton
In-Reply-To: <20260306004344.10968-1-kerigancreighton@gmail.com>
The WCN3610 has a lot in common with the other wcn36xx
chips, so much of that code was reused.
The WCN3610 requires specific configuration values for
stable Wi-Fi. Without these values, there's packet loss.
An extra CFG table was made so other chips are not affected.
ENABLE_DYNAMIC_RA_START_RATE=0 was discovered from the
downstream prima driver. That brought it from 95% to 5%
packet loss. The rest of the CFG values came from my own
observations and experimentation. The current settings
allow for 0% packet loss.
STA_POWERSAVE resulted in BMPS errors and unstable
functionality, thus it has been disabled for just this
chip.
Tested on an Anki Vector 1.0 and 2.0 robot with 3
different APs. Support for other WCN36xx chips has not
been affected.
Signed-off-by: Kerigan Creighton <kerigancreighton@gmail.com>
---
Changes in v2:
- Move wcn36xx driver changes to the end of the patch set.
Changes in v3:
- Describe where the CFG values came from in the wcn36xx
driver patch [Konrad].
---
drivers/net/wireless/ath/wcn36xx/main.c | 4 +-
drivers/net/wireless/ath/wcn36xx/smd.c | 61 +++++++++++++++++++++-
drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
3 files changed, 64 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index c3f0860873..6c90c13251 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1438,7 +1438,7 @@ static int wcn36xx_init_ieee80211(struct wcn36xx *wcn)
BIT(NL80211_IFTYPE_MESH_POINT);
wcn->hw->wiphy->bands[NL80211_BAND_2GHZ] = &wcn_band_2ghz;
- if (wcn->rf_id != RF_IRIS_WCN3620)
+ if (wcn->rf_id != RF_IRIS_WCN3620 && wcn->rf_id != RF_IRIS_WCN3610)
wcn->hw->wiphy->bands[NL80211_BAND_5GHZ] = &wcn_band_5ghz;
if (wcn->rf_id == RF_IRIS_WCN3680)
@@ -1535,6 +1535,8 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
/* External RF module */
iris_node = of_get_child_by_name(mmio_node, "iris");
if (iris_node) {
+ if (of_device_is_compatible(iris_node, "qcom,wcn3610"))
+ wcn->rf_id = RF_IRIS_WCN3610;
if (of_device_is_compatible(iris_node, "qcom,wcn3620"))
wcn->rf_id = RF_IRIS_WCN3620;
if (of_device_is_compatible(iris_node, "qcom,wcn3660") ||
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 813553edcb..8d5a746de7 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -83,6 +83,61 @@ static struct wcn36xx_cfg_val wcn36xx_cfg_vals[] = {
WCN36XX_CFG_VAL(LINK_FAIL_TX_CNT, 1000),
};
+static struct wcn36xx_cfg_val wcn3610_cfg_vals[] = {
+ WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
+ WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
+ WCN36XX_CFG_VAL(LOW_GAIN_OVERRIDE, 0),
+ WCN36XX_CFG_VAL(POWER_STATE_PER_CHAIN, 785),
+ WCN36XX_CFG_VAL(CAL_PERIOD, 5),
+ WCN36XX_CFG_VAL(CAL_CONTROL, 1),
+ WCN36XX_CFG_VAL(PROXIMITY, 0),
+ WCN36XX_CFG_VAL(NETWORK_DENSITY, 3),
+ WCN36XX_CFG_VAL(MAX_MEDIUM_TIME, 6000),
+ WCN36XX_CFG_VAL(MAX_MPDUS_IN_AMPDU, 64),
+ WCN36XX_CFG_VAL(RTS_THRESHOLD, 2347),
+ WCN36XX_CFG_VAL(SHORT_RETRY_LIMIT, 15),
+ WCN36XX_CFG_VAL(LONG_RETRY_LIMIT, 15),
+ WCN36XX_CFG_VAL(FRAGMENTATION_THRESHOLD, 8000),
+ WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ZERO, 5),
+ WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ONE, 10),
+ WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_TWO, 15),
+ WCN36XX_CFG_VAL(FIXED_RATE, 0),
+ WCN36XX_CFG_VAL(RETRYRATE_POLICY, 4),
+ WCN36XX_CFG_VAL(RETRYRATE_SECONDARY, 131),
+ WCN36XX_CFG_VAL(RETRYRATE_TERTIARY, 129),
+ WCN36XX_CFG_VAL(FORCE_POLICY_PROTECTION, 5),
+ WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_24GHZ, 1),
+ WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_5GHZ, 5),
+ WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_5GHZ, 5),
+ WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_24GHZ, 6),
+ WCN36XX_CFG_VAL(MAX_BA_SESSIONS, 40),
+ WCN36XX_CFG_VAL(PS_DATA_INACTIVITY_TIMEOUT, 200),
+ WCN36XX_CFG_VAL(PS_ENABLE_BCN_FILTER, 1),
+ WCN36XX_CFG_VAL(PS_ENABLE_RSSI_MONITOR, 1),
+ WCN36XX_CFG_VAL(NUM_BEACON_PER_RSSI_AVERAGE, 20),
+ WCN36XX_CFG_VAL(STATS_PERIOD, 10),
+ WCN36XX_CFG_VAL(CFP_MAX_DURATION, 30000),
+ WCN36XX_CFG_VAL(FRAME_TRANS_ENABLED, 0),
+ WCN36XX_CFG_VAL(BA_THRESHOLD_HIGH, 128),
+ WCN36XX_CFG_VAL(MAX_BA_BUFFERS, 2560),
+ WCN36XX_CFG_VAL(DYNAMIC_PS_POLL_VALUE, 0),
+ WCN36XX_CFG_VAL(TX_PWR_CTRL_ENABLE, 1),
+ WCN36XX_CFG_VAL(ENABLE_CLOSE_LOOP, 1),
+ WCN36XX_CFG_VAL(ENABLE_LPWR_IMG_TRANSITION, 0),
+ WCN36XX_CFG_VAL(BTC_EXECUTION_MODE, 2),
+ WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_ACTIVE_WLAN_LEN, 90000),
+ WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_ACTIVE_BT_LEN, 60000),
+ WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN, 30000),
+ WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_IDLE_BT_LEN, 120000),
+ WCN36XX_CFG_VAL(BTC_FAST_WLAN_CONN_PREF, 1),
+ WCN36XX_CFG_VAL(BTC_STATIC_LEN_LE_BT, 120000),
+ WCN36XX_CFG_VAL(BTC_STATIC_LEN_LE_WLAN, 30000),
+ WCN36XX_CFG_VAL(MAX_ASSOC_LIMIT, 10),
+ WCN36XX_CFG_VAL(ENABLE_MCC_ADAPTIVE_SCHEDULER, 0),
+ WCN36XX_CFG_VAL(ENABLE_DYNAMIC_RA_START_RATE, 0),
+ WCN36XX_CFG_VAL(LINK_FAIL_TX_CNT, 1000),
+};
+
static struct wcn36xx_cfg_val wcn3680_cfg_vals[] = {
WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
@@ -632,6 +687,9 @@ int wcn36xx_smd_start(struct wcn36xx *wcn)
if (wcn->rf_id == RF_IRIS_WCN3680) {
cfg_vals = wcn3680_cfg_vals;
cfg_elements = ARRAY_SIZE(wcn3680_cfg_vals);
+ } else if (wcn->rf_id == RF_IRIS_WCN3610) {
+ cfg_vals = wcn3610_cfg_vals;
+ cfg_elements = ARRAY_SIZE(wcn3610_cfg_vals);
} else {
cfg_vals = wcn36xx_cfg_vals;
cfg_elements = ARRAY_SIZE(wcn36xx_cfg_vals);
@@ -2380,7 +2438,8 @@ int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn)
mutex_lock(&wcn->hal_mutex);
INIT_HAL_MSG(msg_body, WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ);
- wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
+ if (wcn->rf_id != RF_IRIS_WCN3610)
+ wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
if (wcn->rf_id == RF_IRIS_WCN3680) {
wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, DOT11AC);
wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, WLAN_CH144);
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index 7ee79593cd..cb409d48f7 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -96,6 +96,7 @@ enum wcn36xx_ampdu_state {
#define WCN36XX_MAX_POWER(__wcn) (__wcn->hw->conf.chandef.chan->max_power)
#define RF_UNKNOWN 0x0000
+#define RF_IRIS_WCN3610 0x3610
#define RF_IRIS_WCN3620 0x3620
#define RF_IRIS_WCN3660 0x3660
#define RF_IRIS_WCN3680 0x3680
--
2.53.0
^ permalink raw reply related
* RE: [PATCH 00/13] wifi: drop redundant USB device references
From: Ping-Ke Shih @ 2026-03-06 1:40 UTC (permalink / raw)
To: Johan Hovold, linux-wireless@vger.kernel.org
Cc: Brian Norris, Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi,
Ryder Lee, Shayne Chen, Sean Wang, Jakub Kicinski,
Stanislaw Gruszka, Hin-Tak Leung, Jes Sorensen, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, libertas-dev@lists.infradead.org,
linux-kernel@vger.kernel.org, Greg Kroah-Hartman
In-Reply-To: <20260305110713.17725-1-johan@kernel.org>
// +Cc Greg
Hi Johan,
Johan Hovold <johan@kernel.org> wrote:
[...]
> drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 4 ----
> drivers/net/wireless/realtek/rtl8xxxu/core.c | 11 +++--------
> drivers/net/wireless/realtek/rtlwifi/usb.c | 4 ----
Acked to changes of these Realtek WiFi drivers. But I'd like to know why
rtw88/rtw89 aren't included in this patchset? Greg sent a patch [1] to
correct error path of USB probe for rtw88. In the discussion, he also
mentioned the simplest way is to drop usb_get_dev()/usb_put_dev() like
this patchset does. Will you share patches for rtw88/rtw89? I so, I'd
drop Greg's patch and apply yours.
[1] https://lore.kernel.org/linux-wireless/2026022333-periscope-unusual-f0a0@gregkh/
Ping-Ke
^ permalink raw reply
* Re: [BUG] wifi: mt76: mt7925u: probe with driver mt7925u failed with error -110
From: Sean Wang @ 2026-03-06 2:04 UTC (permalink / raw)
To: Nick
Cc: linux-wireless, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Deren Wu, Leon Yen
In-Reply-To: <CAFktD2eaVpRAJRkaGOj4y-m0woK-sNeCM+h_7A=9GELSce6TcQ@mail.gmail.com>
On Thu, Mar 5, 2026 at 12:28 PM Nick <morrownr@gmail.com> wrote:
>
> Reference: https://github.com/morrownr/USB-WiFi/issues/688#issuecomment-3999038526
>
> The above thread is rather lengthy as we have been working on this
> issue since Dec. 25.
>
> Testing with a Netgear A9000 USB WiFi adapter (mt7925u driver). Kernel
> 7.0 rc2 and a x86_64 system. Additional testing with older kernels was
> also performed with the same results.
>
> Problem description:
>
> Cold boot shows the adapter coming up and operating normally.
>
> Removing the adapter from the USB port and replacing it shows the
> adapter coming up and operating normally.
>
> A warm reboot does not provide a WiFi interface and shows the
> following in the system log:
>
> mt7925u 2-3.2:1.0: probe with driver mt7925u failed with error -110
>
> Using the commands rmmod and modeprobe do not provide a WiFi interface.
>
> Thoughts: The problem likely is not the module teardown. The problem
> seems to be that the firmware (or the mt7925u driver) leaves the
> adapter in a strange state such that a power cycle of the adapter
> hardware is needed before the mt7925u driver can properly initialize
> it a second time.
>
Hi Nick,
Could you enable debug logs and check whether the driver can still
read the correct chip ID after a warm reboot, and at which step the
initialization fails before the -110 error? Thanks for continuing to
test and gather this useful information.
Sean
> Also: Testing with an adapter that uses the mt7921u driver does not
> show this problem.
>
^ permalink raw reply
* [PATCH ath-next] wifi: ath12k: Use .mbn firmware for AHB devices
From: Aaradhana Sahu @ 2026-03-06 3:22 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, Aaradhana Sahu
Currently ath12k AHB devices request firmware in .mdt/.bxx split
format. AHB firmware is transitioning from the split format to a
single .mbn file.
Update ath12k to request q6_fw.mbn and iu_fw.mbn instead of q6_fw.mdt
iu_fw.mdt respectively.
Note: There is no impact to current devices since ath12k AHB support
is not yet complete and no AHB firmware files are currently present in
linux-firmware.
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.7-00587-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/ahb.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/ahb.h b/drivers/net/wireless/ath/ath12k/ahb.h
index 8a040d03d27a..be9e31b3682d 100644
--- a/drivers/net/wireless/ath/ath12k/ahb.h
+++ b/drivers/net/wireless/ath/ath12k/ahb.h
@@ -21,8 +21,8 @@
#define ATH12K_ROOTPD_READY_TIMEOUT (5 * HZ)
#define ATH12K_RPROC_AFTER_POWERUP QCOM_SSR_AFTER_POWERUP
#define ATH12K_AHB_FW_PREFIX "q6_fw"
-#define ATH12K_AHB_FW_SUFFIX ".mdt"
-#define ATH12K_AHB_FW2 "iu_fw.mdt"
+#define ATH12K_AHB_FW_SUFFIX ".mbn"
+#define ATH12K_AHB_FW2 "iu_fw.mbn"
#define ATH12K_AHB_UPD_SWID 0x12
#define ATH12K_USERPD_SPAWN_TIMEOUT (5 * HZ)
#define ATH12K_USERPD_READY_TIMEOUT (10 * HZ)
base-commit: 9942b3f80f4ebe6852663e0d35ecaf6b7a97c8da
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next v6 0/1] wifi: cfg80211/mac80211: add support to handle incumbent signal detected event
From: Amith A @ 2026-03-06 6:09 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, amith.a
This patch series adds support to handle incumbent signal interference
detected event in 6 GHz band. When an incumbent signal is detected by an
AP/mesh interface operating in 6 GHz band, the AP/mesh is expected to
vacate the channels affected by it.
Driver is expected to call the newly introduced API with required
information to notify the interference detection. This information will be
ultimately sent to user space via NL802111 command. User space is expected
to process it and take further action - vacate the channel, or reduce the
bandwidth.
Aditya Kumar Singh (1):
wifi: mac80211_hwsim: add incumbent signal interference detection
support
---
Changes in v6:
- Simplified chanctx iterator plumbing, tightened input length validation
replaced strsep/kstrtou32 parsing with sscanf and collapsed local
variables to reduce complexity.
- Removed patch "wifi: cfg80211: add support to handle incumbent
signal detected event from mac80211/driver" from the series as it
got accepted.
Changes in v5:
- Made chandef const in cfg80211_incumbent_signal_notify()
- Removed mac80211 wrapper ieee80211_incumbent_signal_detected().
Driver/hwsim calls cfg80211 notify directly.
- In mac80211_hwsim, switched debugfs to custom fops with .write that
accepts “freq_mhz bitmap”. Now 6 GHz chanctx is selected by primary
20 MHz center.
Changes in v4:
- Restored gfp_t in cfg80211_incumbent_signal_notify().
- Dropped incumbt_sig_intf_bmap from ieee80211_chanctx_conf and passed
bitmap directly.
- Updated trace/call path: api_incumbent_signal_detected() to take bitmap
- Simplified hwsim: removed helper struct.
Changes in v3:
- Removed the workqueue mechanism in ieee80211_incumbent_signal_detected(),
exported the cfg80211_ function that sends the NL80211 command and called
it from ieee80211_incumbent_signal_detected() directly.
- Renamed nl80211_incumbent_signal_notify() to
cfg80211_incumbent_signal_notify() and removed the gfp argument from it.
Changes in v2:
- Updated the kernel doc of NL80211_ATTR_INCUMBENT_SIGNAL_INTERFERENCE_BITMAP
to include details of how it interacts with puncturing.
- Rebased on ToT
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 64 +++++++++++++++++++
1 file changed, 64 insertions(+)
base-commit: 5d048bbed1bb2bbef612dad0bb9c177c434e63a4
--
2.34.1
^ permalink raw reply
* [PATCH wireless-next v6 1/1] wifi: mac80211_hwsim: add incumbent signal interference detection support
From: Amith A @ 2026-03-06 6:09 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, amith.a, Aditya Kumar Singh
In-Reply-To: <20260306060927.504567-1-amith.a@oss.qualcomm.com>
From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Add a debugfs 'simulate_incumbent_signal_interference' with custom
file_operations and a .write that accepts "<freq_mhz> <bitmap>". The
handler selects the 6 GHz chanctx whose primary 20 MHz center matches
<freq_mhz> and reports the event via cfg80211_incumbent_signal_notify().
The bitmap marks affected 20 MHz segments within the current chandef
(lowest bit = lowest segment)
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Signed-off-by: Amith A <amith.a@oss.qualcomm.com>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 64 +++++++++++++++++++
1 file changed, 64 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 475918ee8132..37d1c9022752 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -36,6 +36,8 @@
#include <linux/virtio.h>
#include <linux/virtio_ids.h>
#include <linux/virtio_config.h>
+#include <linux/uaccess.h>
+#include <linux/string.h>
#include "mac80211_hwsim.h"
#define WARN_QUEUE 100
@@ -1201,6 +1203,65 @@ static const struct file_operations hwsim_background_cac_ops = {
.llseek = default_llseek,
};
+struct hwsim_chanctx_iter_arg {
+ struct ieee80211_chanctx_conf *conf;
+ u32 freq_mhz;
+};
+
+static void hwsim_6ghz_chanctx_iter(struct ieee80211_hw *hw,
+ struct ieee80211_chanctx_conf *conf,
+ void *data)
+{
+ struct hwsim_chanctx_iter_arg *arg = data;
+
+ if (conf->def.chan &&
+ conf->def.chan->band == NL80211_BAND_6GHZ &&
+ conf->def.chan->center_freq == arg->freq_mhz)
+ arg->conf = conf;
+}
+
+static ssize_t hwsim_simulate_incumbent_signal_write(struct file *file,
+ const char __user *ubuf,
+ size_t len, loff_t *ppos)
+{
+ struct mac80211_hwsim_data *data = file->private_data;
+ struct hwsim_chanctx_iter_arg arg = {};
+ u32 bitmap;
+ char buf[64];
+
+ if (!len || len > sizeof(buf) - 1)
+ return -EINVAL;
+
+ if (copy_from_user(buf, ubuf, len))
+ return -EFAULT;
+ buf[len] = '\0';
+
+ if (sscanf(buf, "%u %i", &arg.freq_mhz, &bitmap) != 2)
+ return -EINVAL;
+
+ if (!arg.freq_mhz)
+ return -EINVAL;
+
+ ieee80211_iter_chan_contexts_atomic(data->hw,
+ hwsim_6ghz_chanctx_iter,
+ &arg);
+
+ if (!arg.conf)
+ return -EINVAL;
+
+ cfg80211_incumbent_signal_notify(data->hw->wiphy,
+ &arg.conf->def,
+ bitmap,
+ GFP_KERNEL);
+
+ return len;
+}
+
+static const struct file_operations hwsim_simulate_incumbent_signal_fops = {
+ .open = simple_open,
+ .write = hwsim_simulate_incumbent_signal_write,
+};
+
static int hwsim_fops_group_read(void *dat, u64 *val)
{
struct mac80211_hwsim_data *data = dat;
@@ -5948,6 +6009,9 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
debugfs_create_file("dfs_background_cac", 0200,
data->debugfs,
data, &hwsim_background_cac_ops);
+ debugfs_create_file("simulate_incumbent_signal_interference", 0200,
+ data->debugfs,
+ data, &hwsim_simulate_incumbent_signal_fops);
if (param->pmsr_capa) {
data->pmsr_capa = *param->pmsr_capa;
--
2.34.1
^ permalink raw reply related
* [PATCH v2] wifi: rtl8xxxu: fix potential use of uninitialized value
From: Yi Cong @ 2026-03-06 7:16 UTC (permalink / raw)
To: pkshih, Jes.Sorensen; +Cc: linux-wireless, Yi Cong, stable
From: Yi Cong <yicong@kylinos.cn>
The local variables 'mcs' and 'nss' in rtl8xxxu_update_ra_report() are
passed to rtl8xxxu_desc_to_mcsrate() as output parameters. If the helper
function encounters an unhandled rate index, it may return without setting
these values, leading to the use of uninitialized stack data.
Remove the helper rtl8xxxu_desc_to_mcsrate() and inline the logic into
rtl8xxxu_update_ra_report(). This fixes the use of uninitialized 'mcs'
and 'nss' variables for legacy rates.
The new implementation explicitly handles:
- Legacy rates: Set bitrate only.
- HT rates (MCS0-15): Set MCS flags, index, and NSS (1 or 2) directly.
- Invalid rates: Return early.
Fixes: 7de16123d9e2 ("wifi: rtl8xxxu: Introduce rtl8xxxu_update_ra_report")
Cc: stable@vger.kernel.org
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Yi Cong <yicong@kylinos.cn>
Link: https://lore.kernel.org/all/96e31963da0c42dcb52ce44f818963d7@realtek.com/
---
v2: Explicitly handle invalid rates by returning early instead of falling through.
---
drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 ++++++--------------
1 file changed, 8 insertions(+), 20 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wireless/realtek/rtl8xxxu/core.c
index 794187d28caa..2f872c4f2eee 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
@@ -4697,20 +4697,6 @@ static const struct ieee80211_rate rtl8xxxu_legacy_ratetable[] = {
{.bitrate = 540, .hw_value = 0x0b,},
};
-static void rtl8xxxu_desc_to_mcsrate(u16 rate, u8 *mcs, u8 *nss)
-{
- if (rate <= DESC_RATE_54M)
- return;
-
- if (rate >= DESC_RATE_MCS0 && rate <= DESC_RATE_MCS15) {
- if (rate < DESC_RATE_MCS8)
- *nss = 1;
- else
- *nss = 2;
- *mcs = rate - DESC_RATE_MCS0;
- }
-}
-
static void rtl8xxxu_set_basic_rates(struct rtl8xxxu_priv *priv, u32 rate_cfg)
{
struct ieee80211_hw *hw = priv->hw;
@@ -4820,23 +4806,25 @@ static void rtl8xxxu_set_aifs(struct rtl8xxxu_priv *priv, u8 slot_time)
void rtl8xxxu_update_ra_report(struct rtl8xxxu_ra_report *rarpt,
u8 rate, u8 sgi, u8 bw)
{
- u8 mcs, nss;
-
rarpt->txrate.flags = 0;
if (rate <= DESC_RATE_54M) {
rarpt->txrate.legacy = rtl8xxxu_legacy_ratetable[rate].bitrate;
- } else {
- rtl8xxxu_desc_to_mcsrate(rate, &mcs, &nss);
+ } else if (rate >= DESC_RATE_MCS0 && rate <= DESC_RATE_MCS15) {
rarpt->txrate.flags |= RATE_INFO_FLAGS_MCS;
+ if (rate < DESC_RATE_MCS8)
+ rarpt->txrate.nss = 1;
+ else
+ rarpt->txrate.nss = 2;
- rarpt->txrate.mcs = mcs;
- rarpt->txrate.nss = nss;
+ rarpt->txrate.mcs = rate - DESC_RATE_MCS0;
if (sgi)
rarpt->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
rarpt->txrate.bw = bw;
+ } else {
+ return;
}
rarpt->bit_rate = cfg80211_calculate_bitrate(&rarpt->txrate);
--
2.25.1
^ permalink raw reply related
* [PATCH v2] wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
From: Kuniyuki Iwashima @ 2026-03-06 7:24 UTC (permalink / raw)
To: Johannes Berg
Cc: Lorenzo Bianconi, Kuniyuki Iwashima, Kuniyuki Iwashima,
linux-wireless, syzbot+feb9ce36a95341bb47a4
syzbot reported static_branch_dec() underflow in aql_enable_write(). [0]
The problem is that aql_enable_write() does not serialise concurrent
write()s to the debugfs.
aql_enable_write() checks static_key_false(&aql_disable.key) and
later calls static_branch_inc() or static_branch_dec(), but the
state may change between the two calls.
aql_disable does not need to track inc/dec.
Let's use static_branch_enable() and static_branch_disable().
[0]:
val == 0
WARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288
Modules linked in:
CPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311
Code: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00
RSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4
RDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a
R13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98
FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0
Call Trace:
<TASK>
__static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]
__static_key_slow_dec kernel/jump_label.c:321 [inline]
static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336
aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343
short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383
vfs_write+0x2aa/0x1070 fs/read_write.c:684
ksys_pwrite64 fs/read_write.c:793 [inline]
__do_sys_pwrite64 fs/read_write.c:801 [inline]
__se_sys_pwrite64 fs/read_write.c:798 [inline]
__x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f530cf9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9
RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010
RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978
</TASK>
Fixes: e908435e402a ("mac80211: introduce aql_enable node in debugfs")
Reported-by: syzbot+feb9ce36a95341bb47a4@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69a8979e.a70a0220.b118c.0025.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
v2: Use static_key_enable/disable()
v1: https://lore.kernel.org/linux-wireless/20260304204317.1921550-1-kuniyu@google.com/
---
net/mac80211/debugfs.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index d02f07368c51..687a66cd4943 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -320,7 +320,6 @@ static ssize_t aql_enable_read(struct file *file, char __user *user_buf,
static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
size_t count, loff_t *ppos)
{
- bool aql_disabled = static_key_false(&aql_disable.key);
char buf[3];
size_t len;
@@ -335,15 +334,12 @@ static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
if (len > 0 && buf[len - 1] == '\n')
buf[len - 1] = 0;
- if (buf[0] == '0' && buf[1] == '\0') {
- if (!aql_disabled)
- static_branch_inc(&aql_disable);
- } else if (buf[0] == '1' && buf[1] == '\0') {
- if (aql_disabled)
- static_branch_dec(&aql_disable);
- } else {
+ if (buf[0] == '0' && buf[1] == '\0')
+ static_branch_enable(&aql_disable);
+ else if (buf[0] == '1' && buf[1] == '\0')
+ static_branch_disable(&aql_disable);
+ else
return -EINVAL;
- }
return count;
}
--
2.53.0.473.g4a7958ca14-goog
^ permalink raw reply related
* Re: [PATCH v3 2/3] remoteproc: qcom_wcnss_iris: Add support for WCN3610
From: Krzysztof Kozlowski @ 2026-03-06 7:25 UTC (permalink / raw)
To: Kerigan Creighton, linux-wireless
Cc: loic.poulain, wcn36xx, andersson, mathieu.poirier,
linux-remoteproc, linux-arm-msm, robh, krzk+dt, conor+dt,
devicetree, linux-kernel, Dmitry Baryshkov
In-Reply-To: <20260306004344.10968-3-kerigancreighton@gmail.com>
On 06/03/2026 01:43, Kerigan Creighton wrote:
> WCN3610 has the same regulator requirements as
> WCN3620, so in qcom_wcnss_iris, we can use wcn3620_data.
>
> A separate compatible is needed for WCN3610 because the
> wcn36xx driver uses it for chip-specific configuration.
> Specifically, it sets BTC (Bluetooth Coexistence) CFGs,
> disables ENABLE_DYNAMIC_RA_START_RATE, and disables
> STA_POWERSAVE for this specific chip for stable
> functionality.
This goes to the binding description where you describe the hardware,
how I asked.
Please wrap commit message according to Linux coding style / submission
process (neither too early nor over the limit):
https://elixir.bootlin.com/linux/v6.4-rc1/source/Documentation/process/submitting-patches.rst#L597
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH v3 1/3] dt-bindings: remoteproc: qcom,wcnss-pil: Add wcn3610 compatible
From: Krzysztof Kozlowski @ 2026-03-06 7:26 UTC (permalink / raw)
To: Kerigan Creighton, linux-wireless
Cc: loic.poulain, wcn36xx, andersson, mathieu.poirier,
linux-remoteproc, linux-arm-msm, robh, krzk+dt, conor+dt,
devicetree, linux-kernel
In-Reply-To: <20260306004344.10968-2-kerigancreighton@gmail.com>
On 06/03/2026 01:43, Kerigan Creighton wrote:
> The Qualcomm WCN3610 is a 2.4GHz-only WLAN/BT combo chip.
> It's similar to the WCN3620, though more basic. Add a
> wcn3610 compatible for use in device trees.
>
> It needs its own compatible because of chip-specific
> configuration done in wcn36xx.
Please wrap commit message according to Linux coding style / submission
process (neither too early nor over the limit):
https://elixir.bootlin.com/linux/v6.4-rc1/source/Documentation/process/submitting-patches.rst#L597
With the changes from patch 2:
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH 00/13] wifi: drop redundant USB device references
From: Johan Hovold @ 2026-03-06 8:09 UTC (permalink / raw)
To: Ping-Ke Shih
Cc: linux-wireless@vger.kernel.org, Brian Norris, Francesco Dolcini,
Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Jakub Kicinski, Stanislaw Gruszka, Hin-Tak Leung,
Jes Sorensen, Nicolas Ferre, Alexandre Belloni, Claudiu Beznea,
Matthias Brugger, AngeloGioacchino Del Regno,
libertas-dev@lists.infradead.org, linux-kernel@vger.kernel.org,
Greg Kroah-Hartman
In-Reply-To: <0c75afbbe7bb419cab648f94191fe47f@realtek.com>
On Fri, Mar 06, 2026 at 01:40:31AM +0000, Ping-Ke Shih wrote:
> // +Cc Greg
>
> Hi Johan,
>
> Johan Hovold <johan@kernel.org> wrote:
>
> [...]
>
> > drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 4 ----
> > drivers/net/wireless/realtek/rtl8xxxu/core.c | 11 +++--------
> > drivers/net/wireless/realtek/rtlwifi/usb.c | 4 ----
>
> Acked to changes of these Realtek WiFi drivers. But I'd like to know why
> rtw88/rtw89 aren't included in this patchset?
I used a more specific grep pattern to catch driver releasing references
in disconnect() and therefore missed a few that dropped the reference in
helper functions (or used non-standard names for their disconnect
function such as ath10k, I see now).
> Greg sent a patch [1] to
> correct error path of USB probe for rtw88. In the discussion, he also
> mentioned the simplest way is to drop usb_get_dev()/usb_put_dev() like
> this patchset does. Will you share patches for rtw88/rtw89? I so, I'd
> drop Greg's patch and apply yours.
>
> [1] https://lore.kernel.org/linux-wireless/2026022333-periscope-unusual-f0a0@gregkh/
Sure, I can include rtw88 (and ath10k and ath6kl) in a v2.
Do you really prefer replacing Greg's fix or shall I send an incremental
patch on top?
Johan
^ permalink raw reply
* Re: [PATCH wireless-next 23/35] wifi: mm81x: add sdio.c
From: Johannes Berg @ 2026-03-06 8:20 UTC (permalink / raw)
To: Lachlan Hodges, Krzysztof Kozlowski
Cc: Dan Callaghan, Arien Judge, ayman.grais, linux-wireless,
linux-kernel, Ulf Hansson
In-Reply-To: <sze5g6binniqbqzwvn4nx5qbytsxu3f2rne7wqtdsmlgzqcq6c@4rwtkq7nyptu>
On Mon, 2026-03-02 at 17:30 +1100, Lachlan Hodges wrote:
> >
> Ultimately the structure of our commits is up to Johannes since we are
> going through the wireless tree, but since we have patches that
> touch different subsytems that also needs to be considered. Open to
> suggestions :).
I think what I would like you to do once all the reviews settle down is
send a pull request which contains just a single commit with all the Co-
developed-by: etc. (similar to ath12k). Of course separate from commits
that touch things outside the driver itself (I think that's the SDIO IDs
and DT bindings), so we'd have a couple of patches:
- SDIO IDs (now patch 33)
- DT bindings (patches 31 and 32)
- one big commit adding the driver (all the rest)
Mostly just so I'm not making up a set of fake commit from all the
patches on the list.
I'll take a quick look now, but I'm still holding out hope someone else
might too, and either way even for 7.1 we have a couple of weeks.
johannes
^ permalink raw reply
* Re: [PATCH wireless-next 02/35] wifi: mm81x: add command.c
From: Johannes Berg @ 2026-03-06 8:38 UTC (permalink / raw)
To: Lachlan Hodges, Dan Callaghan, Arien Judge
Cc: ayman.grais, linux-wireless, linux-kernel
In-Reply-To: <20260227041108.66508-3-lachlan.hodges@morsemicro.com>
Hi,
Hm. So I _was_ going to say this just _looked_ bad, but now I think it's
actually wrong:
On Fri, 2026-02-27 at 15:10 +1100, Lachlan Hodges wrote:
> +int mm81x_cmd_sta_state(struct mm81x *mm, struct mm81x_vif *mm_vif, u16 aid,
> + struct ieee80211_sta *sta,
> + enum ieee80211_sta_state state)
> +{
> + struct host_cmd_req_set_sta_state req;
> + struct host_cmd_resp_set_sta_state resp;
> +
> + memset(&req, 0, sizeof(req));
This is fine of course.
> + mm81x_cmd_init(mm, &req.hdr, HOST_CMD_ID_SET_STA_STATE, mm_vif->id,
> + sizeof(req));
> +
> + memcpy(req.sta_addr, sta->addr, sizeof(req.sta_addr));
> + req.aid = cpu_to_le16(aid);
> + req.state = cpu_to_le16(state);
> + req.uapsd_queues = sta->uapsd_queues;
(you write other fields here otherwise it'd be useless)
But then there are cases like this:
> +int mm81x_cmd_add_if(struct mm81x *mm, u16 *vif_id, const u8 *addr,
> + enum nl80211_iftype type)
> +{
> + int ret;
> + struct host_cmd_req_add_interface req;
> + struct host_cmd_resp_add_interface resp;
> +
> + mm81x_cmd_init(mm, &req.hdr, HOST_CMD_ID_ADD_INTERFACE, 0, sizeof(req));
> +
> + switch (type) {
> + case NL80211_IFTYPE_STATION:
> + req.interface_type = cpu_to_le32(HOST_CMD_INTERFACE_TYPE_STA);
> + break;
> + case NL80211_IFTYPE_AP:
> + req.interface_type = cpu_to_le32(HOST_CMD_INTERFACE_TYPE_AP);
> + break;
> + default:
> + return -EOPNOTSUPP;
> + }
> +
> + memcpy(req.addr.octet, addr, sizeof(req.addr.octet));
> +
> + ret = mm81x_cmd_tx(mm, (struct host_cmd_resp *)&resp,
> + (struct host_cmd_req *)&req, sizeof(resp), 0);
Where you're sending uninitialised data to the firmware, regardless of
what the actual command does, mm81x_cmd_init() doesn't initialise the
'pad' field in the header, and there might be per-command fields too?
It'd also be far more obvious that it's not sending uninitialised data
if it was simply each command built as a C99 initialiser:
#define INIT_HDR(_var, _cmd, _vif_id) \
{ \
.message_id = cpu_to_le16(_cmd), \
.vif_id = cpu_to_le16(_vif_id), \
.len = sizeof(_var) - sizeof(_var).hdr, \
}
...
int mm81x_cmd_sta_state(struct mm81x *mm, struct mm81x_vif *mm_vif, u16 aid,
struct ieee80211_sta *sta,
enum ieee80211_sta_state state)
{
struct host_cmd_req_set_sta_state req = {
.hdr = INIT_HDR(req, HOST_CMD_ID_SET_STA_STATE, mm_vif->id),
.aid = cpu_to_le16(aid),
.state = cpu_to_le16(state),
.uapsd_queues = sta->uapsd_queues,
};
struct host_cmd_resp_set_sta_state resp;
memcpy(req.sta_addr, sta->addr, sizeof(req.sta_addr));
return mm81x_cmd_tx(mm, (struct host_cmd_resp *)&resp,
(struct host_cmd_req *)&req, sizeof(resp), 0);
}
etc.
That assumes .hdr is always the header, but that didn't seem
unreasonable. It also doesn't work for a few cases that dynamically
allocate (filter), but that could just use kzalloc() instead.
It also seems (and that's really nitpicking now) that the response
argument to mm81x_cmd_tx() is actually optional, so a few (more) places
like this one could use NULL there (e.g. also key removal, beacon timer,
frag threshold)
johannes
^ permalink raw reply
* Re: [PATCH v3 3/3] wifi: wcn36xx: Add support for WCN3610
From: Loic Poulain @ 2026-03-06 8:41 UTC (permalink / raw)
To: Kerigan Creighton
Cc: linux-wireless, wcn36xx, andersson, mathieu.poirier,
linux-remoteproc, linux-arm-msm, robh, krzk+dt, conor+dt,
devicetree, linux-kernel
In-Reply-To: <20260306004344.10968-4-kerigancreighton@gmail.com>
On Fri, Mar 6, 2026 at 1:44 AM Kerigan Creighton
<kerigancreighton@gmail.com> wrote:
>
> The WCN3610 has a lot in common with the other wcn36xx
> chips, so much of that code was reused.
>
> The WCN3610 requires specific configuration values for
> stable Wi-Fi. Without these values, there's packet loss.
> An extra CFG table was made so other chips are not affected.
>
> ENABLE_DYNAMIC_RA_START_RATE=0 was discovered from the
> downstream prima driver. That brought it from 95% to 5%
> packet loss. The rest of the CFG values came from my own
> observations and experimentation. The current settings
> allow for 0% packet loss.
>
> STA_POWERSAVE resulted in BMPS errors and unstable
> functionality, thus it has been disabled for just this
> chip.
>
> Tested on an Anki Vector 1.0 and 2.0 robot with 3
> different APs. Support for other WCN36xx chips has not
> been affected.
>
> Signed-off-by: Kerigan Creighton <kerigancreighton@gmail.com>
STA_POWERSAVE is disabled, but the interface still enters BMPS mode as
controlled by mac80211. If you get the opportunity, It would be useful
to air-capture the power‑save entry and exit events when this occurs,
so we can verify that the transitions behave as expected.
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
> Changes in v2:
> - Move wcn36xx driver changes to the end of the patch set.
>
> Changes in v3:
> - Describe where the CFG values came from in the wcn36xx
> driver patch [Konrad].
> ---
> drivers/net/wireless/ath/wcn36xx/main.c | 4 +-
> drivers/net/wireless/ath/wcn36xx/smd.c | 61 +++++++++++++++++++++-
> drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
> 3 files changed, 64 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
> index c3f0860873..6c90c13251 100644
> --- a/drivers/net/wireless/ath/wcn36xx/main.c
> +++ b/drivers/net/wireless/ath/wcn36xx/main.c
> @@ -1438,7 +1438,7 @@ static int wcn36xx_init_ieee80211(struct wcn36xx *wcn)
> BIT(NL80211_IFTYPE_MESH_POINT);
>
> wcn->hw->wiphy->bands[NL80211_BAND_2GHZ] = &wcn_band_2ghz;
> - if (wcn->rf_id != RF_IRIS_WCN3620)
> + if (wcn->rf_id != RF_IRIS_WCN3620 && wcn->rf_id != RF_IRIS_WCN3610)
> wcn->hw->wiphy->bands[NL80211_BAND_5GHZ] = &wcn_band_5ghz;
>
> if (wcn->rf_id == RF_IRIS_WCN3680)
> @@ -1535,6 +1535,8 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
> /* External RF module */
> iris_node = of_get_child_by_name(mmio_node, "iris");
> if (iris_node) {
> + if (of_device_is_compatible(iris_node, "qcom,wcn3610"))
> + wcn->rf_id = RF_IRIS_WCN3610;
> if (of_device_is_compatible(iris_node, "qcom,wcn3620"))
> wcn->rf_id = RF_IRIS_WCN3620;
> if (of_device_is_compatible(iris_node, "qcom,wcn3660") ||
> diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
> index 813553edcb..8d5a746de7 100644
> --- a/drivers/net/wireless/ath/wcn36xx/smd.c
> +++ b/drivers/net/wireless/ath/wcn36xx/smd.c
> @@ -83,6 +83,61 @@ static struct wcn36xx_cfg_val wcn36xx_cfg_vals[] = {
> WCN36XX_CFG_VAL(LINK_FAIL_TX_CNT, 1000),
> };
>
> +static struct wcn36xx_cfg_val wcn3610_cfg_vals[] = {
> + WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
> + WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
> + WCN36XX_CFG_VAL(LOW_GAIN_OVERRIDE, 0),
> + WCN36XX_CFG_VAL(POWER_STATE_PER_CHAIN, 785),
> + WCN36XX_CFG_VAL(CAL_PERIOD, 5),
> + WCN36XX_CFG_VAL(CAL_CONTROL, 1),
> + WCN36XX_CFG_VAL(PROXIMITY, 0),
> + WCN36XX_CFG_VAL(NETWORK_DENSITY, 3),
> + WCN36XX_CFG_VAL(MAX_MEDIUM_TIME, 6000),
> + WCN36XX_CFG_VAL(MAX_MPDUS_IN_AMPDU, 64),
> + WCN36XX_CFG_VAL(RTS_THRESHOLD, 2347),
> + WCN36XX_CFG_VAL(SHORT_RETRY_LIMIT, 15),
> + WCN36XX_CFG_VAL(LONG_RETRY_LIMIT, 15),
> + WCN36XX_CFG_VAL(FRAGMENTATION_THRESHOLD, 8000),
> + WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ZERO, 5),
> + WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ONE, 10),
> + WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_TWO, 15),
> + WCN36XX_CFG_VAL(FIXED_RATE, 0),
> + WCN36XX_CFG_VAL(RETRYRATE_POLICY, 4),
> + WCN36XX_CFG_VAL(RETRYRATE_SECONDARY, 131),
> + WCN36XX_CFG_VAL(RETRYRATE_TERTIARY, 129),
> + WCN36XX_CFG_VAL(FORCE_POLICY_PROTECTION, 5),
> + WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_24GHZ, 1),
> + WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_5GHZ, 5),
> + WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_5GHZ, 5),
> + WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_24GHZ, 6),
> + WCN36XX_CFG_VAL(MAX_BA_SESSIONS, 40),
> + WCN36XX_CFG_VAL(PS_DATA_INACTIVITY_TIMEOUT, 200),
> + WCN36XX_CFG_VAL(PS_ENABLE_BCN_FILTER, 1),
> + WCN36XX_CFG_VAL(PS_ENABLE_RSSI_MONITOR, 1),
> + WCN36XX_CFG_VAL(NUM_BEACON_PER_RSSI_AVERAGE, 20),
> + WCN36XX_CFG_VAL(STATS_PERIOD, 10),
> + WCN36XX_CFG_VAL(CFP_MAX_DURATION, 30000),
> + WCN36XX_CFG_VAL(FRAME_TRANS_ENABLED, 0),
> + WCN36XX_CFG_VAL(BA_THRESHOLD_HIGH, 128),
> + WCN36XX_CFG_VAL(MAX_BA_BUFFERS, 2560),
> + WCN36XX_CFG_VAL(DYNAMIC_PS_POLL_VALUE, 0),
> + WCN36XX_CFG_VAL(TX_PWR_CTRL_ENABLE, 1),
> + WCN36XX_CFG_VAL(ENABLE_CLOSE_LOOP, 1),
> + WCN36XX_CFG_VAL(ENABLE_LPWR_IMG_TRANSITION, 0),
> + WCN36XX_CFG_VAL(BTC_EXECUTION_MODE, 2),
> + WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_ACTIVE_WLAN_LEN, 90000),
> + WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_ACTIVE_BT_LEN, 60000),
> + WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_IDLE_WLAN_LEN, 30000),
> + WCN36XX_CFG_VAL(BTC_STATIC_OPP_WLAN_IDLE_BT_LEN, 120000),
> + WCN36XX_CFG_VAL(BTC_FAST_WLAN_CONN_PREF, 1),
> + WCN36XX_CFG_VAL(BTC_STATIC_LEN_LE_BT, 120000),
> + WCN36XX_CFG_VAL(BTC_STATIC_LEN_LE_WLAN, 30000),
> + WCN36XX_CFG_VAL(MAX_ASSOC_LIMIT, 10),
> + WCN36XX_CFG_VAL(ENABLE_MCC_ADAPTIVE_SCHEDULER, 0),
> + WCN36XX_CFG_VAL(ENABLE_DYNAMIC_RA_START_RATE, 0),
> + WCN36XX_CFG_VAL(LINK_FAIL_TX_CNT, 1000),
> +};
> +
> static struct wcn36xx_cfg_val wcn3680_cfg_vals[] = {
> WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
> WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
> @@ -632,6 +687,9 @@ int wcn36xx_smd_start(struct wcn36xx *wcn)
> if (wcn->rf_id == RF_IRIS_WCN3680) {
> cfg_vals = wcn3680_cfg_vals;
> cfg_elements = ARRAY_SIZE(wcn3680_cfg_vals);
> + } else if (wcn->rf_id == RF_IRIS_WCN3610) {
> + cfg_vals = wcn3610_cfg_vals;
> + cfg_elements = ARRAY_SIZE(wcn3610_cfg_vals);
> } else {
> cfg_vals = wcn36xx_cfg_vals;
> cfg_elements = ARRAY_SIZE(wcn36xx_cfg_vals);
> @@ -2380,7 +2438,8 @@ int wcn36xx_smd_feature_caps_exchange(struct wcn36xx *wcn)
> mutex_lock(&wcn->hal_mutex);
> INIT_HAL_MSG(msg_body, WCN36XX_HAL_FEATURE_CAPS_EXCHANGE_REQ);
>
> - wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
> + if (wcn->rf_id != RF_IRIS_WCN3610)
> + wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, STA_POWERSAVE);
> if (wcn->rf_id == RF_IRIS_WCN3680) {
> wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, DOT11AC);
> wcn36xx_firmware_set_feat_caps(msg_body.feat_caps, WLAN_CH144);
> diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
> index 7ee79593cd..cb409d48f7 100644
> --- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
> +++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
> @@ -96,6 +96,7 @@ enum wcn36xx_ampdu_state {
> #define WCN36XX_MAX_POWER(__wcn) (__wcn->hw->conf.chandef.chan->max_power)
>
> #define RF_UNKNOWN 0x0000
> +#define RF_IRIS_WCN3610 0x3610
> #define RF_IRIS_WCN3620 0x3620
> #define RF_IRIS_WCN3660 0x3660
> #define RF_IRIS_WCN3680 0x3680
> --
> 2.53.0
>
^ permalink raw reply
* [PATCH v2 07/18] wifi: libertas: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/marvell/libertas/if_usb.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
index 8a6bf1365cfa..05fcf9cc28fa 100644
--- a/drivers/net/wireless/marvell/libertas/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas/if_usb.c
@@ -276,7 +276,6 @@ static int if_usb_probe(struct usb_interface *intf,
cardp->boot2_version = udev->descriptor.bcdDevice;
- usb_get_dev(udev);
usb_set_intfdata(intf, cardp);
r = lbs_get_firmware_async(priv, &udev->dev, cardp->model,
@@ -287,7 +286,6 @@ static int if_usb_probe(struct usb_interface *intf,
return 0;
err_get_fw:
- usb_put_dev(udev);
lbs_remove_card(priv);
err_add_card:
if_usb_reset_device(cardp);
@@ -321,7 +319,6 @@ static void if_usb_disconnect(struct usb_interface *intf)
kfree(cardp);
usb_set_intfdata(intf, NULL);
- usb_put_dev(interface_to_usbdev(intf));
}
/**
--
2.52.0
^ permalink raw reply related
* [PATCH v2 00/18] wifi: drop redundant USB device references
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop redundant device references to reduce cargo culting, make it easier
to spot drivers where an extra reference is needed, and reduce the risk
of memory leaks when drivers fail to release them.
Note that I sent an ath9k patch separately here:
https://lore.kernel.org/all/20260305105803.17011-1-johan@kernel.org/
but I included it here in v2 for completeness.
Also note that Greg had already sent a fix for rtw88 which has been
picked up by Ping-Ke, but who asked me to send a replacement. If an
incremental patch is preferred I can instead send a follow up for that
one later.
Johan
Changes in v2:
- include ath9k, previously submitted separately
- include ath6kl and ath10k
- rename the ath6kl and ath10k disconnect callbacks
- fix a reference leak in rtw88 previously reported (and fixed
differently) by Greg
Johan Hovold (18):
wifi: ath6kl: drop redundant device reference
wifi: ath6kl: rename disconnect callback
wifi: ath9k: drop redundant device reference
wifi: ath10k: drop redundant device reference
wifi: ath10k: rename disconnect callback
wifi: at76c50x: drop redundant device reference
wifi: libertas: drop redundant device reference
wifi: libertas_tf: drop redundant device reference
wifi: mwifiex: drop redundant device reference
wifi: mt76: drop redundant device reference
wifi: mt76x0u: drop redundant device reference
wifi: mt76x2u: drop redundant device reference
wifi: mt76: mt792xu: drop redundant device reference
wifi: mt7601u: drop redundant device reference
wifi: rt2x00: drop redundant device reference
wifi: rtl818x: drop redundant device reference
wifi: rtl8xxxu: drop redundant device reference
wifi: rtw88: fix device leak on probe failure
drivers/net/wireless/ath/ath10k/usb.c | 8 ++------
drivers/net/wireless/ath/ath6kl/usb.c | 16 ++++------------
drivers/net/wireless/ath/ath9k/hif_usb.c | 4 ----
drivers/net/wireless/atmel/at76c50x-usb.c | 12 ++++--------
drivers/net/wireless/marvell/libertas/if_usb.c | 3 ---
.../net/wireless/marvell/libertas_tf/if_usb.c | 2 --
drivers/net/wireless/marvell/mwifiex/usb.c | 4 ----
drivers/net/wireless/mediatek/mt76/mt7615/usb.c | 3 ---
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3 ---
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 4 ----
drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 2 --
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 2 --
drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 1 -
drivers/net/wireless/mediatek/mt7601u/usb.c | 3 ---
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 12 +-----------
.../net/wireless/realtek/rtl818x/rtl8187/dev.c | 4 ----
drivers/net/wireless/realtek/rtl8xxxu/core.c | 11 +++--------
drivers/net/wireless/realtek/rtw88/usb.c | 3 +--
18 files changed, 15 insertions(+), 82 deletions(-)
--
2.52.0
^ permalink raw reply
* [PATCH v2 03/18] wifi: ath9k: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 8533b88974b2..821909b81ea9 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1382,8 +1382,6 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
goto err_alloc;
}
- usb_get_dev(udev);
-
hif_dev->udev = udev;
hif_dev->interface = interface;
hif_dev->usb_device_id = id;
@@ -1403,7 +1401,6 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
err_fw_req:
usb_set_intfdata(interface, NULL);
kfree(hif_dev);
- usb_put_dev(udev);
err_alloc:
return ret;
}
@@ -1451,7 +1448,6 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
kfree(hif_dev);
dev_info(&udev->dev, "ath9k_htc: USB layer deinitialized\n");
- usb_put_dev(udev);
}
#ifdef CONFIG_PM
--
2.52.0
^ permalink raw reply related
* [PATCH v2 06/18] wifi: at76c50x: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/atmel/at76c50x-usb.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c
index 6445332801a4..44b04ea3cc8b 100644
--- a/drivers/net/wireless/atmel/at76c50x-usb.c
+++ b/drivers/net/wireless/atmel/at76c50x-usb.c
@@ -2440,13 +2440,11 @@ static int at76_probe(struct usb_interface *interface,
struct mib_fw_version *fwv;
int board_type = (int)id->driver_info;
- udev = usb_get_dev(interface_to_usbdev(interface));
+ udev = interface_to_usbdev(interface);
fwv = kmalloc_obj(*fwv);
- if (!fwv) {
- ret = -ENOMEM;
- goto exit;
- }
+ if (!fwv)
+ return -ENOMEM;
/* Load firmware into kernel memory */
fwe = at76_load_firmware(udev, board_type);
@@ -2534,8 +2532,7 @@ static int at76_probe(struct usb_interface *interface,
exit:
kfree(fwv);
- if (ret < 0)
- usb_put_dev(udev);
+
return ret;
}
@@ -2552,7 +2549,6 @@ static void at76_disconnect(struct usb_interface *interface)
wiphy_info(priv->hw->wiphy, "disconnecting\n");
at76_delete_device(priv);
- usb_put_dev(interface_to_usbdev(interface));
dev_info(&interface->dev, "disconnected\n");
}
--
2.52.0
^ permalink raw reply related
* [PATCH v2 09/18] wifi: mwifiex: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/usb.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 947ecb0a7b40..f4b94a1054f6 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -520,8 +520,6 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
return ret;
}
- usb_get_dev(udev);
-
return 0;
}
@@ -666,8 +664,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
mwifiex_dbg(adapter, FATAL,
"%s: removing card\n", __func__);
mwifiex_remove_card(adapter);
-
- usb_put_dev(interface_to_usbdev(intf));
}
static void mwifiex_usb_coredump(struct device *dev)
--
2.52.0
^ permalink raw reply related
* [PATCH v2 11/18] wifi: mt76x0u: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index 90e5666c0857..2acce121fb14 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -245,7 +245,6 @@ static int mt76x0u_probe(struct usb_interface *usb_intf,
if (id->driver_info)
dev->no_2ghz = true;
- usb_dev = usb_get_dev(usb_dev);
usb_reset_device(usb_dev);
usb_set_intfdata(usb_intf, dev);
@@ -284,7 +283,6 @@ static int mt76x0u_probe(struct usb_interface *usb_intf,
err:
usb_set_intfdata(usb_intf, NULL);
- usb_put_dev(interface_to_usbdev(usb_intf));
mt76u_queues_deinit(&dev->mt76);
mt76_free_device(&dev->mt76);
@@ -303,7 +301,6 @@ static void mt76x0_disconnect(struct usb_interface *usb_intf)
mt76x0u_cleanup(dev);
usb_set_intfdata(usb_intf, NULL);
- usb_put_dev(interface_to_usbdev(usb_intf));
mt76_free_device(&dev->mt76);
}
--
2.52.0
^ permalink raw reply related
* [PATCH v2 05/18] wifi: ath10k: rename disconnect callback
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Rename the disconnect callback so that it reflects the callback name for
consistency with the rest of the kernel (e.g. makes it easier to grep
for).
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/ath/ath10k/usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index ad1cf0681b19..987d57a01ddf 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1057,7 +1057,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
return ret;
}
-static void ath10k_usb_remove(struct usb_interface *interface)
+static void ath10k_usb_disconnect(struct usb_interface *interface)
{
struct ath10k_usb *ar_usb;
@@ -1113,7 +1113,7 @@ static struct usb_driver ath10k_usb_driver = {
.probe = ath10k_usb_probe,
.suspend = ath10k_usb_pm_suspend,
.resume = ath10k_usb_pm_resume,
- .disconnect = ath10k_usb_remove,
+ .disconnect = ath10k_usb_disconnect,
.id_table = ath10k_usb_ids,
.supports_autosuspend = true,
.disable_hub_initiated_lpm = 1,
--
2.52.0
^ permalink raw reply related
* [PATCH v2 12/18] wifi: mt76x2u: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
index 01cb3b2830f3..8af360bca643 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
@@ -57,7 +57,6 @@ static int mt76x2u_probe(struct usb_interface *intf,
dev = container_of(mdev, struct mt76x02_dev, mt76);
- udev = usb_get_dev(udev);
usb_reset_device(udev);
usb_set_intfdata(intf, dev);
@@ -84,14 +83,12 @@ static int mt76x2u_probe(struct usb_interface *intf,
mt76u_queues_deinit(&dev->mt76);
mt76_free_device(&dev->mt76);
usb_set_intfdata(intf, NULL);
- usb_put_dev(udev);
return err;
}
static void mt76x2u_disconnect(struct usb_interface *intf)
{
- struct usb_device *udev = interface_to_usbdev(intf);
struct mt76x02_dev *dev = usb_get_intfdata(intf);
struct ieee80211_hw *hw = mt76_hw(dev);
@@ -100,7 +97,6 @@ static void mt76x2u_disconnect(struct usb_interface *intf)
mt76x2u_cleanup(dev);
mt76_free_device(&dev->mt76);
usb_set_intfdata(intf, NULL);
- usb_put_dev(udev);
}
static int __maybe_unused mt76x2u_suspend(struct usb_interface *intf,
--
2.52.0
^ permalink raw reply related
* [PATCH v2 10/18] wifi: mt76: drop redundant device reference
From: Johan Hovold @ 2026-03-06 8:51 UTC (permalink / raw)
To: linux-wireless
Cc: Jeff Johnson, Toke Høiland-Jørgensen, Brian Norris,
Francesco Dolcini, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Jakub Kicinski, Stanislaw Gruszka,
Hin-Tak Leung, Jes Sorensen, Ping-Ke Shih, Nicolas Ferre,
Alexandre Belloni, Claudiu Beznea, Matthias Brugger,
AngeloGioacchino Del Regno, Greg Kroah-Hartman, libertas-dev,
linux-kernel, Johan Hovold
In-Reply-To: <20260306085144.12064-1-johan@kernel.org>
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/usb.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
index d91feffadda9..bab7b91f14be 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
@@ -151,7 +151,6 @@ static int mt7663u_probe(struct usb_interface *usb_intf,
return -ENOMEM;
dev = container_of(mdev, struct mt7615_dev, mt76);
- udev = usb_get_dev(udev);
usb_reset_device(udev);
usb_set_intfdata(usb_intf, dev);
@@ -193,7 +192,6 @@ static int mt7663u_probe(struct usb_interface *usb_intf,
error:
mt76u_queues_deinit(&dev->mt76);
usb_set_intfdata(usb_intf, NULL);
- usb_put_dev(interface_to_usbdev(usb_intf));
mt76_free_device(&dev->mt76);
@@ -211,7 +209,6 @@ static void mt7663u_disconnect(struct usb_interface *usb_intf)
mt7663u_cleanup(dev);
usb_set_intfdata(usb_intf, NULL);
- usb_put_dev(interface_to_usbdev(usb_intf));
mt76_free_device(&dev->mt76);
}
--
2.52.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox