* Re: [PATCH wireless-next v2 1/4] wifi: nl80211: rename PROBE_CLIENT to PROBE_PEER and add STA-side probing support
From: Johannes Berg @ 2026-05-05 12:37 UTC (permalink / raw)
To: Priyansha Tiwari; +Cc: linux-wireless, quic_drohan
In-Reply-To: <20260417133124.3412752-2-pritiwa@qti.qualcomm.com>
On Fri, 2026-04-17 at 19:01 +0530, Priyansha Tiwari wrote:
> From: Priyansha Tiwari <priyansha.tiwari@oss.qualcomm.com>
>
> Rename NL80211_CMD_PROBE_CLIENT to NL80211_CMD_PROBE_PEER to generalize
> peer probing, AP/GO continue to probe associated STAs (legacy PROBE_CLIENT
> behavior) while, when the driver advertises NL80211_EXT_FEATURE_PROBE_AP,
> a STA/P2P-client may probe its currently associated AP to quickly verify link
> responsiveness without waiting for traffic or long timeouts.
>
> Userspace and cfg80211 rely on this feature flag to determine whether
> STA-mode probing is supported. The command returns a cookie in the direct
> reply and delivers an event that indicates ACK (and, if available,
> signed-dBm ACK_SIGNAL).
>
> For MLO connections the event carries MLO_LINK_ID identifying the link on
> which the probe was ACKed. In AP/GO mode the peer MAC is required, while in
> STA/P2P-client mode the MAC is omitted (AP implied).
> NL80211_CMD_PROBE_CLIENT is retained as a compatibility alias.
This doesn't actually do what the subject says. You also don't need to
describe the existing behaviour like MLO stuff.
johannes
^ permalink raw reply
* [PATCH wireless] wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage
From: Johannes Berg @ 2026-05-05 11:38 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
From: Johannes Berg <johannes.berg@intel.com>
This is documented as a u8 and has a policy of NLA_U8, but uses
nla_get_u32() which means it's completely broken on big-endian.
Fix it to use nla_get_u8().
Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
net/wireless/pmsr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 951ba0b96da2..ca1229b93bb9 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -88,7 +88,7 @@ static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
out->ftm.ftms_per_burst = 0;
if (tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST])
out->ftm.ftms_per_burst =
- nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);
+ nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);
if (capa->ftm.max_ftms_per_burst &&
out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst) {
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v4 3/3 omap] ARM: dts: omap2: add stlc4560 spi-wireless node
From: Linus Walleij @ 2026-05-05 10:41 UTC (permalink / raw)
To: Arnd Bergmann
Cc: netdev, Arnd Bergmann, Aaro Koskinen, Andreas Kemnade,
Bartosz Golaszewski, Benoît Cousson, David S. Miller,
Dmitry Torokhov, Eric Dumazet, Felipe Balbi, Jakub Kicinski,
Johannes Berg, Kevin Hilman, Krzysztof Kozlowski, Paolo Abeni,
Rob Herring, Roger Quadros, Tony Lindgren, linux-wireless,
devicetree, linux-kernel, linux-arm-kernel, linux-gpio,
linux-omap, Krzysztof Kozlowski
In-Reply-To: <20260430081242.3686993-4-arnd@kernel.org>
On Thu, Apr 30, 2026 at 10:13 AM Arnd Bergmann <arnd@kernel.org> wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> Converted from the platform_device creation in board-n8x0.c.
>
> Link: https://lore.kernel.org/all/20230314163201.955689-1-arnd@kernel.org/
> Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Yours,
Linus Walleij
^ permalink raw reply
* Re: [PATCH v4 2/3 net-next] p54spi: convert to devicetree
From: Linus Walleij @ 2026-05-05 10:37 UTC (permalink / raw)
To: Arnd Bergmann
Cc: netdev, Arnd Bergmann, Aaro Koskinen, Andreas Kemnade,
Bartosz Golaszewski, Benoît Cousson, David S. Miller,
Dmitry Torokhov, Eric Dumazet, Felipe Balbi, Jakub Kicinski,
Johannes Berg, Kevin Hilman, Krzysztof Kozlowski, Paolo Abeni,
Rob Herring, Roger Quadros, Tony Lindgren, linux-wireless,
devicetree, linux-kernel, linux-arm-kernel, linux-gpio,
linux-omap, Christian Lamparter
In-Reply-To: <20260430081242.3686993-3-arnd@kernel.org>
On Thu, Apr 30, 2026 at 10:13 AM Arnd Bergmann <arnd@kernel.org> wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> The Prism54 SPI driver hardcodes GPIO numbers and expects users to
> pass them as module parameters, apparently a relic from its life as a
> staging driver. This works because there is only one user, the Nokia
> N8x0 tablet.
>
> Convert this to the gpio descriptor interface and DT based probing
> to improve this and simplify the code at the same time.
>
> Acked-by: Christian Lamparter <chunkeey@gmail.com>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Yours,
Linus Walleij
^ permalink raw reply
* Re: [PATCH v2] iw: Makefile: support out-of-tree builds
From: Johannes Berg @ 2026-05-05 10:35 UTC (permalink / raw)
To: Maxin John, linux-wireless
In-Reply-To: <20260429210808.1497335-1-maxin.john@gmail.com>
On Thu, 2026-04-30 at 00:08 +0300, Maxin John wrote:
> - Add support for kernel-style out-of-tree builds using:
> make O=<builddir>
> - Make SRCDIR computation whitespace-safe by switching to realpath
> - Remove ambiguous use of "-I." from CPPFLAGS
Thanks for fixing that.
Right now I don't really see _why_ it doesn't work, but it seems
confusing that if you build in-tree first and then try to build out-of-
tree, it just says
make[1]: Nothing to be done for 'all'.
Maybe that should abort? Or work?
It seems that removing VPATH and changing the %.o rule
-%.o: %.c iw.h nl80211.h nl80211-commands.inc
+%.o: $(SRCDIR)/%.c $(SRCDIR)/iw.h $(SRCDIR)/nl80211.h nl80211-commands.inc
makes that work?
I'll leave it to you though.
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 0/2] wifi: cfg80211/mac80211: optimize station info handling
From: Johannes Berg @ 2026-05-05 10:21 UTC (permalink / raw)
To: Sarika Sharma; +Cc: linux-wireless
In-Reply-To: <20260430053810.2088793-1-sarika.sharma@oss.qualcomm.com>
On Thu, 2026-04-30 at 11:08 +0530, Sarika Sharma wrote:
> This series improve memory and logic efficiency in cfg80211 and
> mac80211 during NL80211_CMD_GET_STATION. Allocate link_sinfo and
> link tidstats objects only for valid links to reduce memory usage.
> Avoid setting non-MLO applicable fields for MLO stations to
> eliminate redundant operations and simplify the code path.
OK ... so taking a closer look now.
There's altogether too much going on in these patches - the first one is
really cfg80211 only and should be tagged as such (API updates across
consumers don't count), and I'm not sure the cfg80211_free_link_sinfo()
refactoring is useful - but if so maybe it should be NULL checked
inside?
The second patch *should* be mac80211 only, but magically removes also
the cfg80211 code ... I guess I can see that's no longer needed, but it
might better be a separate commit that explains that.
And finally, given that all of this is entirely dead code since my
commit c3f8d13357de ("wifi: nl80211: completely disable per-link stats
for now"), I'm not really all that interested in optimising it.
If you care so much about memory consumption then we can just delete the
code. If you actually care about exposing the information to userspace
(e.g. for the, entirely broken, MLO_SIGNAL_POLL in wpa_s) then you
should really fix those issues, and maybe then figure out any memory
issues.
johannes
^ permalink raw reply
* Re: [PATCH v2 1/2] wifi: nl80211: require CAP_NET_ADMIN over the target netns in SET_WIPHY_NETNS
From: Johannes Berg @ 2026-05-05 10:00 UTC (permalink / raw)
To: Maoyi Xie; +Cc: linux-wireless, linux-kernel
In-Reply-To: <20260504135420.1178443-2-maoyi.xie@ntu.edu.sg>
On Mon, 2026-05-04 at 21:54 +0800, Maoyi Xie wrote:
[...]
> Reported-by: Maoyi Xie <maoyi.xie@ntu.edu.sg>
Crediting yourself with finding the bug seems ... a bit weird?
But anyway
> Signed-off-by: Maoyi Xie <maoyi.xie@ntu.edu.sg>
Bot reports
WARNING: From:/Signed-off-by: email address mismatch: 'From: Maoyi Xie <maoyixie.tju@gmail.com>' != 'Signed-off-by: Maoyi Xie <maoyi.xie@ntu.edu.sg>'
so wonder if that was intentional? Maybe you wanted to include another
From: line?
johannes
^ permalink raw reply
* Re: [PATCH v4 0/2] wifi: libertas: fix two OOB reads from firmware fields
From: Johannes Berg @ 2026-05-05 9:52 UTC (permalink / raw)
To: Tristan Madani, linux-wireless; +Cc: error27, kuba, dcbw, linville, lkp
In-Reply-To: <20260504191452.3408257-1-tristan@talencesecurity.com>
Tristan,
This is going to be the last time I reply to you if you continue this.
Please:
1) Send patches that actually apply to the relevant tree
(wireless or wireless-next in this case, ideally tagging it in the
subject such as "[PATCH wireless v5 1/2]")
2) Consider feedback you get. Even in another driver it's not useful to
check one size against another size if both are provided by the
device, unless the other is already validated. If so, add a comment.
3) Disclose AI/LLM usage per
https://docs.kernel.org/process/coding-assistants.html
(Yes, I don't believe you came out of nowhere without it.)
johannes
^ permalink raw reply
* Re: [PATCH v2 0/3] wifi: iwlwifi: add Device Tree hardware integration information
From: Krzysztof Kozlowski @ 2026-05-05 9:19 UTC (permalink / raw)
To: Avinash Bhatt
Cc: devicetree, linux-wireless, robh, krzk+dt, conor+dt, johannes,
miriam.rachel.korenblit, linux-kernel, kobi.guetta,
emmanuel.grumbach
In-Reply-To: <20260504095327.30892-1-avinash.bhatt@intel.com>
On Mon, May 04, 2026 at 12:53:24PM +0300, Avinash Bhatt wrote:
> Add Device Tree support for Intel Wi-Fi hardware integration information
> on platforms that do not provide UEFI variables or ACPI methods.
>
> Patch 1/3 adds the DT binding schema for the Intel iwlwifi compatible
> node. Patches 2/3 and 3/3 add the driver infrastructure and integrate DT
> as the lowest-priority fallback after UEFI and ACPI.
Please provide link to any upstream DTS user of this binding, either
complete or work in progress.
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH v2 2/3] wifi: iwlwifi: dt: add Device Tree BIOS configuration infrastructure
From: Krzysztof Kozlowski @ 2026-05-05 9:18 UTC (permalink / raw)
To: Avinash Bhatt
Cc: devicetree, linux-wireless, robh, krzk+dt, conor+dt, johannes,
miriam.rachel.korenblit, linux-kernel, kobi.guetta,
emmanuel.grumbach
In-Reply-To: <20260504095327.30892-3-avinash.bhatt@intel.com>
On Mon, May 04, 2026 at 12:53:26PM +0300, Avinash Bhatt wrote:
> +
> +/*
> + * Mapping from DSM function index to Device Tree property name.
> + * Returns the DT property name for a given DSM function, or NULL if the
> + * function has no Device Tree representation.
> + */
> +static const char *dsm_func_to_prop_name(enum iwl_dsm_funcs func)
> +{
> + switch (func) {
> + case DSM_FUNC_DISABLE_SRD: return IWL_DT_PROP_SRD;
> + case DSM_FUNC_ENABLE_6E: return IWL_DT_PROP_6E_UHB;
> + case DSM_FUNC_REGULATORY_CONFIG: return IWL_DT_PROP_REG_SPECIAL;
> + case DSM_FUNC_ACTIVATE_CHANNEL: return IWL_DT_PROP_ACTIVATE_CH;
> + case DSM_FUNC_FORCE_DISABLE_CHANNELS:
> + return IWL_DT_PROP_FORCE_DISABLE_CH;
> + case DSM_FUNC_ENABLE_11BE: return IWL_DT_PROP_11BE;
> + default: return NULL;
Pointless function and only making DT ABI checks difficult. Drop.
Don't invent API wrappers or other HAL over simple calls to OF or device
API.
Drop also ALL defines and use OF API like EVERY other driver. This is
not a special place.
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH v2 1/3] dt-bindings: net: wireless: intel,iwlwifi: add binding
From: Krzysztof Kozlowski @ 2026-05-05 9:15 UTC (permalink / raw)
To: Avinash Bhatt
Cc: devicetree, linux-wireless, robh, krzk+dt, conor+dt, johannes,
miriam.rachel.korenblit, linux-kernel, kobi.guetta,
emmanuel.grumbach
In-Reply-To: <20260504095327.30892-2-avinash.bhatt@intel.com>
On Mon, May 04, 2026 at 12:53:25PM +0300, Avinash Bhatt wrote:
> Add a devicetree schema binding for Intel discrete Wi-Fi 7 BE200 PCIe
> adapters.
A nit, subject: drop second/last, redundant "binding". The
"dt-bindings" prefix is already stating that these are bindings.
See also:
https://elixir.bootlin.com/linux/v6.17-rc3/source/Documentation/devicetree/bindings/submitting-patches.rst#L18
Just describe hardware.
>
> The binding documents OEM platform configuration properties for
No, describe hardware.
> platforms that use Device Tree instead of platform firmware
> methods. All properties mirror the existing equivalents in
> structure and semantics, covering SAR power limits (intel,wrds),
> 6 GHz AP type support (intel,uats), static power limit
> (intel,splc), channel puncturing (intel,wcpe), 320 MHz per-MCC
> enablement (intel,wbem), ETSI SRD channel configuration
> (intel,srd), 6-7 GHz UHB country enable bitmask (intel,6e-uhb),
> and additional regulatory override properties.
>
>
> Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com>
> ---
> .../bindings/net/wireless/intel,iwlwifi.yaml | 430 ++++++++++++++++++
> 1 file changed, 430 insertions(+)
> create mode 100644 Documentation/devicetree/bindings/net/wireless/intel,iwlwifi.yaml
>
> diff --git a/Documentation/devicetree/bindings/net/wireless/intel,iwlwifi.yaml b/Documentation/devicetree/bindings/net/wireless/intel,iwlwifi.yaml
> new file mode 100644
> index 000000000000..210063c6183d
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/net/wireless/intel,iwlwifi.yaml
Filename should match actual device compatibles. iwlwifi is driver, so
not really relevant here.
> @@ -0,0 +1,430 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +# Copyright (c) 2026 Intel Corporation
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/net/wireless/intel,iwlwifi.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: Intel iwlwifi PCIe Wi-Fi devices
There is no such thing as "iwlwifi" device. Google for it - I see
"Intel® Wireless Wi-Fi Drivers for Linux".
Again, describe hardware.
> +
> +maintainers:
> + - Avinash Bhatt <avinash.bhatt@intel.com>
> +
> +description:
> + Intel iwlwifi IEEE 802.11be discrete Wi-Fi adapters connected over PCIe.
> +
> +properties:
> + compatible:
> + enum:
> + - pci8086,272b
> +
> + reg:
> + maxItems: 1
> +
> + intel,wrds:
> + description: |
> + Wi-Fi Regulatory Domain Settings (WRDS). SAR (Specific Absorption Rate)
> + transmit power limits per antenna chain and frequency subband. Values
> + are 8-bit unsigned in units of 0.125 dBm.
> +
> + Revision 3 layout: 4 chains x 12 subbands = 50 cells total.
> + Chain A and Chain B are the two physical antenna paths; CDB Chain A
> + and CDB Chain B carry separate limits for simultaneous dual-band
> + operation.
> +
> + Header (2 cells):
> + [0] revision - structure revision, must be 0x03
> + [1] mode - bit 0: 0 = SAR disabled, 1 = SAR enabled;
> + bits [8:1]: set to 0
> +
> + Followed by 4 chains in order: chain_a, chain_b, cdb_chain_a,
> + cdb_chain_b, each containing 12 subband values:
> +
> + Subband index to frequency range mapping:
> + [0] 2.4 GHz ch 1-13 (2412-2472 MHz)
> + [1] 5 GHz ch 36-64 (5180-5320 MHz, UNII-1/2)
> + [2] 5 GHz ch 68-96 (5340-5480 MHz, UNII-2)
> + [3] 5 GHz ch 100-144 (5500-5720 MHz, UNII-2e)
> + [4] 5 GHz ch 149-188 (5745-5940 MHz, UNII-3/4)
> + [5] 6 GHz ch 1-45 (5955-6175 MHz, UNII-5 lower)
> + [6] 6 GHz ch 49-93 (6195-6415 MHz, UNII-5 upper)
> + [7] 6 GHz ch 97-115 (6435-6525 MHz, UNII-6)
> + [8] 6 GHz ch 117-151 (6535-6705 MHz, UNII-7 lower)
> + [9] 6 GHz ch 153-183 (6715-6865 MHz, UNII-7 upper)
> + [10] 6 GHz ch 185-233 (6875-7115 MHz, UNII-8)
> + [11] 6 GHz ch 237-253 (7135-7215 MHz, UNII-9)
> + allOf:
Don't invent your own syntax. Drop. There are no other bindings using
it, so why are you coming with something completely new?
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - minItems: 50
> + maxItems: 50
> +
> + intel,uats:
> + description: |
> + UHB (Ultra High Band / 6 GHz) AP Type Support (UATS). Per-country
> + enablement matrix for 6 GHz AP types. Uses byte array format
> + (DTS [ ... ] notation).
> +
> + In the 6 GHz band, regulatory rules differ per country and per AP
> + type: AFC (Standard Power), LPI (Low Power Indoor), and VLP (Very
> + Low Power). This matrix encodes which AP types are permitted to
> + operate in each country.
> +
> + Revision 1 layout (339 bytes total):
> + [0] revision - structure revision, must be 0x01
> + [1+] country_map - 338-byte matrix encoding AP type allowances
> + per country.
> +
> + Countries are identified by their ISO 3166-1
> + alpha-2 code (two letters, A-Z each). The
> + matrix covers all 26x26 = 676 possible
> + two-letter combinations (AA..ZZ), most of
> + which are unused (set to 0x0).
> +
> + Each country entry is 4 bits (a nibble). Two
> + entries are packed per byte: the low nibble
> + holds the even-indexed entry, the high nibble
> + holds the odd-indexed entry. For example,
> + byte value 0x53 means: entry[even]=0x3,
> + entry[odd]=0x5.
> +
> + The matrix is stored column-major by first
> + letter: all 26 second-letter variants for
> + first letter 'A' occupy bytes [0..12], then
> + first letter 'B' occupies bytes [13..25],
> + and so on for all 26 first letters.
> + 26 columns x 13 bytes = 338 bytes total.
> +
> + Each 4-bit nibble encodes AP type allowances
> + for one country:
> + bit 0: AFC (Standard Power AP) allowed
> + bit 1: VLP (Very Low Power AP) allowed
> + bit 2: LPI (Low Power Indoor AP) allowed
> + bit 3: reserved, must be 0
> +
> + Note: each bit is only effective when the
> + corresponding control bit in intel,6e-uhb
> + is also set (bit 30 for AFC, bit 29
> + for VLP, bit 31 for LPI country-by-country
> + mode).
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint8-array
> + - minItems: 339
> + maxItems: 339
> +
> + intel,srd:
> + description: |
> + ETSI 5.8 GHz SRD (Short Range Device) channel configuration.
> + Controls how the driver handles the 5725-5875 MHz (5.8 GHz) SRD
> + channels in ETSI regulatory domains.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
What? If it is 0 then just drop it. Same comments everywhere else.
> + [1] value - channel configuration:
> + 0 = active scan permitted (default behaviour)
> + 1 = passive scan only; device may associate and
> + transfer data but must not transmit probe
> + requests on SRD channels
> + 2 = SRD channels fully disabled; the device must
> + not scan, associate, or operate on any of the
> + 5725-5875 MHz SRD channels
I have doubts this is regulatory/certification property.
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
Drop
> + - enum: [0, 1, 2]
Use string
> +
> + intel,6e-uhb:
> + description: |
> + 6-7 GHz Ultra-High Band (UHB) per-country enable bitmask.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] bitmap - UHB enablement control:
> + bit 0: override control; 0 = use device defaults,
> + 1 = force-disable all countries not
> + explicitly enabled in bits 1-25
> + bits 1-25: per-country/region enable flags:
> + bit 1 = USA
> + bit 2 = Rest of World (ROW)
> + bit 3 = EU
> + bit 4 = South Korea
> + bit 5 = Brazil
> + bit 6 = Chile
> + bit 7 = Japan
> + bit 8 = Canada
> + bit 9 = Morocco
> + bit 10 = Mongolia
> + bit 11 = Malaysia
> + bit 12 = Saudi Arabia
> + bit 13 = Mexico
> + bit 14 = Nigeria
> + bit 15 = Thailand
> + bit 16 = Singapore
> + bit 17 = Taiwan
> + bit 18 = South Africa
> + bit 19 = Philippines
> + bit 20 = Serbia
> + bit 21 = Indonesia
> + bit 22 = Azerbaijan
> + bit 23 = Paraguay
> + bit 24 = Vietnam
> + bit 25 = India
> + bit 26: reserved, must be 0
Bindings CANNOT be reserved.
> + bit 27: enable VLP active scan, SoftAP, and
> + P2P-GO operation in Japan
> + bit 28: reserved, must be 0
NAK
> + bit 29: enable VLP (Very Low Power) mode per
> + country-by-country table
> + bit 30: enable AFC (Standard Power) mode per
> + country-by-country table
> + bit 31: LPI override mode; 0 = use grouping
> + mechanism, 1 = use country-by-country table
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
No. If it is const, then it is implied by compatible.
> + - {}
> +
> + intel,regulatory-special:
> + description: |
> + Regulatory Special Configurations.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
NAK
> + [1] bitmap - configuration flags:
> + bits 0-3: reserved, must be 0
> + bit 4 = Australia UHB extension
> + bits 5-31: reserved, must be 0
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - {}
> +
> + intel,activate-channel:
> + description: |
> + Indoor channel activation bitmask. Sets specific frequency bands to
> + active (rather than passive or disabled) when the platform is
> + confirmed to be operating indoors.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] bitmap - per-region indoor activation flags:
> + bit 0 = enable EU U-NII-1 (5.2 GHz) for indoors only
> + bit 1 = enable Japan U-NII-1 (5.2 GHz) for indoors only
> + bit 2 = enable China Mainland U-NII-1 (5.2 GHz)
> + for indoors only
> + bit 3 = enable USA U-NII-4 (5.9 GHz) for indoors only
> + bit 4 = enable WW U-NII-1 (5.2 GHz) for indoors in any
> + country where the band is permitted
> + bit 5 = enable Canada U-NII-4 (5.9 GHz) for indoors only
> + bit 6 = enable USA + Canada + WW U-NII-4 (5.9 GHz) for
> + indoors only
> + bits 7-31: reserved, must be 0
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - {}
> +
> + intel,force-disable-channels:
> + description: |
> + Selective Wi-Fi band force-disable bitmask. Allows the platform to
> + permanently disable specific frequency bands regardless of regulatory
> + domain.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] bitmap - per-band force-disable flags:
> + bit 0 = force disable 2.4 GHz (channels 1-13)
> + bit 1 = force disable 5.2 GHz (channels 36-48)
> + bit 2 = force disable 5.3 GHz (channels 52-64)
> + bit 3 = force disable 5.5 GHz (channels 100-144)
> + bit 4 = force disable 5.8 GHz (channels 149-165)
> + bit 5 = force disable 5.9 GHz (channels 169-177)
> + bit 6 = force disable 6.2 GHz (channels 1-93)
> + bit 7 = force disable 6.5 GHz (channels 97-113)
> + bit 8 = force disable 6.6 GHz (channels 117-153)
> + bit 9 = force disable 6.8 GHz (channels 157-185)
> + bit 10 = force disable 7.0 GHz (channels 185-233)
> + bits 11-31: reserved, must be 0
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - {}
> +
> + intel,11be:
> + description: |
> + 802.11be (Wi-Fi 7) per-country enable bitmask. Controls whether
> + 802.11be operation is permitted in specific countries.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] bitmap - per-country enable flags:
> + bit 0 = enable 802.11be in China (CB/CN)
> + bit 1 = enable 802.11be in South Korea
> + bits 2-31: reserved, must be 0
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - {}
> +
> + intel,splc:
> + description: |
> + Wi-Fi Static Power Limit Capabilities (SPLC). Sets the platform thermal
> + power limit for the Wi-Fi core in mW. Omit this property entirely if
> + no platform power limit applies; the device will use its certified
> + maximum in that case.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] power_limit - maximum platform power budget in mW, must be
> + non-zero (a zero value is equivalent to omitting
> + the property)
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - minimum: 1
> +
> + intel,wcpe:
> + description: |
> + Wi-Fi Channel Puncturing Enablement (WCPE). Enables 802.11be channel
> + puncturing for specific regulatory domains.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] puncturing - per-country enable bitmask:
> + bit 0: 1 = channel puncturing enabled for USA
> + bit 1: 1 = channel puncturing enabled for Canada
> + bits 2-31: reserved, must be 0
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - {}
> +
> + intel,wbem:
> + description: |
> + Wi-Fi 320 MHz Bandwidth Enablement per MCC (WBEM). Controls whether
> + 320 MHz operation is permitted in specific countries.
> +
> + Layout (2 cells):
> + [0] revision - structure revision, must be 0x00
> + [1] wifi320mhz_mcc - per-country enable bitmask:
> + bit 0: 1 = 320 MHz enabled for Japan
> + bit 1: 1 = 320 MHz enabled for South Korea
> + bits 2-31: reserved, must be 0
> +
> + Each bit takes effect only if the installed
> + module is certified for 320 MHz in that country.
> + allOf:
> + - $ref: /schemas/types.yaml#/definitions/uint32-array
> + - items:
> + - const: 0
> + - {}
> +
> +required:
> + - compatible
> + - reg
> +
Missing ref to ieee80211 schema.
> +additionalProperties: false
Best regards,
Krzysztof
^ permalink raw reply
* [PATCH] wifi: mt76: mt7925: Add coredump callback in pci_driver
From: JB Tsai @ 2026-05-05 5:52 UTC (permalink / raw)
To: nbd, lorenzo
Cc: linux-wireless, linux-mediatek, Deren.Wu, Sean.Wang, Quan.Zhou,
Ryder.Lee, Leon.Yen, litien.chang, jeff.hsu, jb.tsai, Jeff Hsu
From: Jeff Hsu <Jeff.Hsu@mediatek.com>
Register coredump callback(mt7925_coredump) in pci_driver,
it can let platform can trigger core dump to collect the
log and recover back after coredump complete without debugfs
Some platform not have debugfs
Signed-off-by: Jeff Hsu <Jeff.Hsu@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 12 ++++++++++++
2 files changed, 13 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 37cdf3e8a067..cd502166a7f9 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -1014,6 +1014,7 @@ int mt7925_mcu_chip_config(struct mt792x_dev *dev, const char *cmd)
return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(CHIP_CONFIG),
&req, sizeof(req), false);
}
+EXPORT_SYMBOL_GPL(mt7925_mcu_chip_config);
int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable)
{
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
index c4161754c01d..5b3e62e5f157 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -610,6 +610,17 @@ static int mt7925_pci_restore(struct device *device)
return _mt7925_pci_resume(device, true);
}
+static void mt7925_coredump(struct device *dev)
+{
+ struct pci_dev *pdev = to_pci_dev(device);
+ struct mt76_dev *mdev = pci_get_drvdata(pdev);
+ struct mt792x_dev *dev_792x = container_of(mdev, struct mt792x_dev, mt76);
+
+ mt792x_mutex_acquire(dev_792x);
+ mt7925_mcu_chip_config(dev_792x, "assert");
+ mt792x_mutex_release(dev_792x);
+}
+
static const struct dev_pm_ops mt7925_pm_ops = {
.suspend = pm_sleep_ptr(mt7925_pci_suspend),
.resume = pm_sleep_ptr(mt7925_pci_resume),
@@ -626,6 +637,7 @@ static struct pci_driver mt7925_pci_driver = {
.remove = mt7925_pci_remove,
.shutdown = mt7925_pci_shutdown,
.driver.pm = pm_sleep_ptr(&mt7925_pm_ops),
+ .driver.coredump = mt7925_coredump,
};
module_pci_driver(mt7925_pci_driver);
--
2.45.2
^ permalink raw reply related
* [wireless:for-next] BUILD SUCCESS 65493f27a6008bf84bd11bd41c5e1ea6b0bf3c3d
From: kernel test robot @ 2026-05-05 4:15 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git for-next
branch HEAD: 65493f27a6008bf84bd11bd41c5e1ea6b0bf3c3d wifi: cw1200: Revert "Fix locking in error paths"
elapsed time: 1262m
configs tested: 408
configs skipped: 97
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-19
arc allyesconfig clang-23
arc defconfig gcc-15.2.0
arc randconfig-001 gcc-8.5.0
arc randconfig-001-20260504 gcc-13.4.0
arc randconfig-001-20260504 gcc-8.5.0
arc randconfig-001-20260505 gcc-8.5.0
arc randconfig-002 gcc-8.5.0
arc randconfig-002-20260504 gcc-13.4.0
arc randconfig-002-20260504 gcc-8.5.0
arc randconfig-002-20260505 gcc-8.5.0
arm allnoconfig clang-23
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm allyesconfig gcc-15.2.0
arm aspeed_g4_defconfig clang-23
arm davinci_all_defconfig clang-19
arm defconfig clang-23
arm defconfig gcc-15.2.0
arm mvebu_v5_defconfig gcc-15.2.0
arm randconfig-001 gcc-8.5.0
arm randconfig-001-20260504 gcc-13.4.0
arm randconfig-001-20260504 gcc-8.5.0
arm randconfig-001-20260505 gcc-8.5.0
arm randconfig-002 gcc-8.5.0
arm randconfig-002-20260504 gcc-13.4.0
arm randconfig-002-20260504 gcc-8.5.0
arm randconfig-002-20260505 gcc-8.5.0
arm randconfig-003 gcc-8.5.0
arm randconfig-003-20260504 gcc-13.4.0
arm randconfig-003-20260504 gcc-8.5.0
arm randconfig-003-20260505 gcc-8.5.0
arm randconfig-004 gcc-8.5.0
arm randconfig-004-20260504 gcc-13.4.0
arm randconfig-004-20260504 gcc-8.5.0
arm randconfig-004-20260505 gcc-8.5.0
arm64 allmodconfig clang-19
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001-20260504 gcc-15.2.0
arm64 randconfig-001-20260505 gcc-14.3.0
arm64 randconfig-002-20260504 gcc-15.2.0
arm64 randconfig-002-20260505 gcc-14.3.0
arm64 randconfig-003-20260504 gcc-15.2.0
arm64 randconfig-003-20260505 gcc-14.3.0
arm64 randconfig-004-20260504 gcc-15.2.0
arm64 randconfig-004-20260505 gcc-14.3.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001-20260504 gcc-15.2.0
csky randconfig-001-20260505 gcc-14.3.0
csky randconfig-002-20260504 gcc-15.2.0
csky randconfig-002-20260505 gcc-14.3.0
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig clang-23
hexagon allnoconfig gcc-15.2.0
hexagon defconfig clang-23
hexagon defconfig gcc-15.2.0
hexagon randconfig-001 gcc-11.5.0
hexagon randconfig-001-20260504 clang-23
hexagon randconfig-001-20260505 clang-23
hexagon randconfig-001-20260505 gcc-11.5.0
hexagon randconfig-002 gcc-11.5.0
hexagon randconfig-002-20260504 clang-23
hexagon randconfig-002-20260505 clang-23
hexagon randconfig-002-20260505 gcc-11.5.0
i386 allmodconfig clang-20
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001 gcc-14
i386 buildonly-randconfig-001-20260504 gcc-14
i386 buildonly-randconfig-001-20260505 gcc-14
i386 buildonly-randconfig-002 gcc-14
i386 buildonly-randconfig-002-20260504 gcc-14
i386 buildonly-randconfig-002-20260505 gcc-14
i386 buildonly-randconfig-003 gcc-14
i386 buildonly-randconfig-003-20260504 gcc-14
i386 buildonly-randconfig-003-20260505 gcc-14
i386 buildonly-randconfig-004 gcc-14
i386 buildonly-randconfig-004-20260504 gcc-14
i386 buildonly-randconfig-004-20260505 gcc-14
i386 buildonly-randconfig-005 gcc-14
i386 buildonly-randconfig-005-20260504 gcc-14
i386 buildonly-randconfig-005-20260505 gcc-14
i386 buildonly-randconfig-006 gcc-14
i386 buildonly-randconfig-006-20260504 gcc-14
i386 buildonly-randconfig-006-20260505 gcc-14
i386 defconfig clang-20
i386 defconfig gcc-15.2.0
i386 randconfig-001 clang-20
i386 randconfig-001-20260504 clang-20
i386 randconfig-001-20260505 clang-20
i386 randconfig-002 clang-20
i386 randconfig-002 gcc-14
i386 randconfig-002-20260504 clang-20
i386 randconfig-002-20260504 gcc-14
i386 randconfig-002-20260505 clang-20
i386 randconfig-003 clang-20
i386 randconfig-003 gcc-14
i386 randconfig-003-20260504 clang-20
i386 randconfig-003-20260504 gcc-14
i386 randconfig-003-20260505 clang-20
i386 randconfig-004 clang-20
i386 randconfig-004-20260504 clang-20
i386 randconfig-004-20260504 gcc-14
i386 randconfig-004-20260505 clang-20
i386 randconfig-005 clang-20
i386 randconfig-005 gcc-14
i386 randconfig-005-20260504 clang-20
i386 randconfig-005-20260504 gcc-14
i386 randconfig-005-20260505 clang-20
i386 randconfig-006 clang-20
i386 randconfig-006 gcc-14
i386 randconfig-006-20260504 clang-20
i386 randconfig-006-20260505 clang-20
i386 randconfig-007 clang-20
i386 randconfig-007 gcc-14
i386 randconfig-007-20260504 clang-20
i386 randconfig-007-20260505 clang-20
i386 randconfig-011-20260504 clang-20
i386 randconfig-011-20260505 clang-20
i386 randconfig-011-20260505 gcc-14
i386 randconfig-012-20260504 clang-20
i386 randconfig-012-20260505 clang-20
i386 randconfig-013-20260504 clang-20
i386 randconfig-013-20260505 clang-20
i386 randconfig-014-20260504 clang-20
i386 randconfig-014-20260505 clang-20
i386 randconfig-015-20260504 clang-20
i386 randconfig-015-20260505 clang-20
i386 randconfig-015-20260505 gcc-14
i386 randconfig-016-20260504 clang-20
i386 randconfig-016-20260505 clang-20
i386 randconfig-017-20260504 clang-20
i386 randconfig-017-20260505 clang-20
i386 randconfig-017-20260505 gcc-14
loongarch allmodconfig clang-19
loongarch allmodconfig clang-23
loongarch allnoconfig clang-23
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001 gcc-11.5.0
loongarch randconfig-001-20260504 clang-18
loongarch randconfig-001-20260504 clang-23
loongarch randconfig-001-20260505 clang-23
loongarch randconfig-001-20260505 gcc-11.5.0
loongarch randconfig-002 gcc-11.5.0
loongarch randconfig-002-20260504 clang-23
loongarch randconfig-002-20260505 clang-18
loongarch randconfig-002-20260505 clang-23
loongarch randconfig-002-20260505 gcc-11.5.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k allyesconfig gcc-15.2.0
m68k defconfig clang-19
m68k defconfig gcc-15.2.0
m68k hp300_defconfig gcc-15.2.0
m68k m5249evb_defconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
microblaze defconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips decstation_64_defconfig gcc-15.2.0
mips rs90_defconfig gcc-15.2.0
nios2 allmodconfig clang-23
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-11.5.0
nios2 allnoconfig gcc-15.2.0
nios2 defconfig clang-19
nios2 defconfig gcc-11.5.0
nios2 randconfig-001 gcc-11.5.0
nios2 randconfig-001-20260504 clang-23
nios2 randconfig-001-20260504 gcc-11.5.0
nios2 randconfig-001-20260505 clang-18
nios2 randconfig-001-20260505 clang-23
nios2 randconfig-001-20260505 gcc-11.5.0
nios2 randconfig-002 gcc-11.5.0
nios2 randconfig-002-20260504 clang-23
nios2 randconfig-002-20260504 gcc-11.5.0
nios2 randconfig-002-20260505 clang-18
nios2 randconfig-002-20260505 clang-23
nios2 randconfig-002-20260505 gcc-11.5.0
openrisc allmodconfig clang-23
openrisc allmodconfig gcc-11.5.0
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc generic-64bit_defconfig gcc-15.2.0
parisc randconfig-001 gcc-13.4.0
parisc randconfig-001 gcc-14.3.0
parisc randconfig-001-20260504 gcc-13.4.0
parisc randconfig-001-20260505 gcc-14.3.0
parisc randconfig-002 gcc-13.4.0
parisc randconfig-002 gcc-14.3.0
parisc randconfig-002 gcc-8.5.0
parisc randconfig-002-20260504 gcc-13.4.0
parisc randconfig-002-20260504 gcc-8.5.0
parisc randconfig-002-20260505 gcc-14.3.0
parisc64 defconfig clang-19
parisc64 defconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-15.2.0
powerpc pmac32_defconfig clang-23
powerpc randconfig-001 gcc-13.4.0
powerpc randconfig-001 gcc-14.3.0
powerpc randconfig-001-20260504 gcc-12.5.0
powerpc randconfig-001-20260504 gcc-13.4.0
powerpc randconfig-001-20260505 gcc-14.3.0
powerpc randconfig-002 gcc-10.5.0
powerpc randconfig-002 gcc-13.4.0
powerpc randconfig-002 gcc-14.3.0
powerpc randconfig-002-20260504 clang-23
powerpc randconfig-002-20260504 gcc-13.4.0
powerpc randconfig-002-20260505 gcc-14.3.0
powerpc tqm8560_defconfig gcc-15.2.0
powerpc64 randconfig-001 clang-17
powerpc64 randconfig-001 gcc-13.4.0
powerpc64 randconfig-001 gcc-14.3.0
powerpc64 randconfig-001-20260504 gcc-10.5.0
powerpc64 randconfig-001-20260504 gcc-13.4.0
powerpc64 randconfig-001-20260505 gcc-14.3.0
powerpc64 randconfig-002 clang-23
powerpc64 randconfig-002 gcc-13.4.0
powerpc64 randconfig-002 gcc-14.3.0
powerpc64 randconfig-002-20260504 clang-23
powerpc64 randconfig-002-20260504 gcc-13.4.0
powerpc64 randconfig-002-20260505 gcc-14.3.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig clang-23
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260504 gcc-8.5.0
riscv randconfig-001-20260505 gcc-10.5.0
riscv randconfig-002-20260504 gcc-8.5.0
s390 allmodconfig clang-19
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 defconfig clang-23
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260504 gcc-8.5.0
s390 randconfig-002-20260504 gcc-8.5.0
s390 randconfig-002-20260505 gcc-10.5.0
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-23
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh allyesconfig gcc-15.2.0
sh defconfig gcc-14
sh lboxre2_defconfig gcc-15.2.0
sh randconfig-001-20260504 gcc-8.5.0
sh randconfig-001-20260505 gcc-10.5.0
sh randconfig-002-20260504 gcc-8.5.0
sh randconfig-002-20260505 gcc-10.5.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001 gcc-8.5.0
sparc randconfig-001-20260504 gcc-15.2.0
sparc randconfig-001-20260504 gcc-8.5.0
sparc randconfig-001-20260505 gcc-15.2.0
sparc randconfig-002 gcc-15.2.0
sparc randconfig-002-20260504 gcc-8.5.0
sparc randconfig-002-20260505 gcc-15.2.0
sparc64 allmodconfig clang-23
sparc64 defconfig gcc-14
sparc64 randconfig-001 gcc-8.5.0
sparc64 randconfig-001-20260504 clang-23
sparc64 randconfig-001-20260504 gcc-8.5.0
sparc64 randconfig-001-20260505 gcc-15.2.0
sparc64 randconfig-002 clang-23
sparc64 randconfig-002-20260504 gcc-8.5.0
sparc64 randconfig-002-20260505 gcc-15.2.0
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001 clang-23
um randconfig-001-20260504 clang-19
um randconfig-001-20260504 gcc-8.5.0
um randconfig-001-20260505 gcc-15.2.0
um randconfig-002 clang-23
um randconfig-002-20260504 gcc-14
um randconfig-002-20260504 gcc-8.5.0
um randconfig-002-20260505 gcc-15.2.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allnoconfig clang-23
x86_64 allnoconfig gcc-15.2.0
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001 gcc-12
x86_64 buildonly-randconfig-001-20260504 gcc-12
x86_64 buildonly-randconfig-001-20260505 clang-20
x86_64 buildonly-randconfig-002 gcc-12
x86_64 buildonly-randconfig-002-20260504 gcc-12
x86_64 buildonly-randconfig-002-20260505 clang-20
x86_64 buildonly-randconfig-003 gcc-12
x86_64 buildonly-randconfig-003-20260504 gcc-12
x86_64 buildonly-randconfig-003-20260505 clang-20
x86_64 buildonly-randconfig-004 gcc-12
x86_64 buildonly-randconfig-004-20260504 gcc-12
x86_64 buildonly-randconfig-004-20260505 clang-20
x86_64 buildonly-randconfig-005 gcc-12
x86_64 buildonly-randconfig-005-20260504 gcc-12
x86_64 buildonly-randconfig-005-20260505 clang-20
x86_64 buildonly-randconfig-006 gcc-12
x86_64 buildonly-randconfig-006-20260504 gcc-12
x86_64 buildonly-randconfig-006-20260505 clang-20
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001-20260504 gcc-14
x86_64 randconfig-001-20260505 clang-20
x86_64 randconfig-002-20260504 gcc-14
x86_64 randconfig-002-20260505 clang-20
x86_64 randconfig-002-20260505 gcc-14
x86_64 randconfig-003-20260504 gcc-14
x86_64 randconfig-003-20260505 clang-20
x86_64 randconfig-004-20260504 gcc-14
x86_64 randconfig-004-20260505 clang-20
x86_64 randconfig-005-20260504 gcc-14
x86_64 randconfig-005-20260505 clang-20
x86_64 randconfig-006-20260504 gcc-14
x86_64 randconfig-006-20260505 clang-20
x86_64 randconfig-011 gcc-14
x86_64 randconfig-011-20260504 gcc-14
x86_64 randconfig-011-20260505 clang-20
x86_64 randconfig-012 gcc-14
x86_64 randconfig-012-20260504 gcc-14
x86_64 randconfig-012-20260505 clang-20
x86_64 randconfig-013 gcc-14
x86_64 randconfig-013-20260504 gcc-14
x86_64 randconfig-013-20260505 clang-20
x86_64 randconfig-014 gcc-14
x86_64 randconfig-014-20260504 gcc-14
x86_64 randconfig-014-20260505 clang-20
x86_64 randconfig-015 gcc-14
x86_64 randconfig-015-20260504 gcc-14
x86_64 randconfig-015-20260505 clang-20
x86_64 randconfig-016 gcc-14
x86_64 randconfig-016-20260504 gcc-14
x86_64 randconfig-016-20260505 clang-20
x86_64 randconfig-071 clang-20
x86_64 randconfig-071-20260504 clang-20
x86_64 randconfig-071-20260505 clang-20
x86_64 randconfig-071-20260505 gcc-14
x86_64 randconfig-072 clang-20
x86_64 randconfig-072-20260504 clang-20
x86_64 randconfig-072-20260505 clang-20
x86_64 randconfig-073 clang-20
x86_64 randconfig-073-20260504 clang-20
x86_64 randconfig-073-20260505 clang-20
x86_64 randconfig-073-20260505 gcc-14
x86_64 randconfig-074 clang-20
x86_64 randconfig-074-20260504 clang-20
x86_64 randconfig-074-20260505 clang-20
x86_64 randconfig-074-20260505 gcc-14
x86_64 randconfig-075 clang-20
x86_64 randconfig-075-20260504 clang-20
x86_64 randconfig-075-20260505 clang-20
x86_64 randconfig-076 clang-20
x86_64 randconfig-076-20260504 clang-20
x86_64 randconfig-076-20260505 clang-20
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-23
xtensa allyesconfig gcc-11.5.0
xtensa generic_kc705_defconfig gcc-15.2.0
xtensa randconfig-001 gcc-8.5.0
xtensa randconfig-001-20260504 gcc-8.5.0
xtensa randconfig-001-20260504 gcc-9.5.0
xtensa randconfig-001-20260505 gcc-15.2.0
xtensa randconfig-002 gcc-8.5.0
xtensa randconfig-002-20260504 gcc-13.4.0
xtensa randconfig-002-20260504 gcc-8.5.0
xtensa randconfig-002-20260505 gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH v2] wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode
From: kwan1996 @ 2026-05-05 4:09 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, kwan1996
In monitor mode, the driver incorrectly assigns the legacy rate
to the rate_idx field of the radiotap header for HT/VHT/HE/EHT
frames, ignoring the actual MCS value parsed from the hardware.
This causes packet analyzers (like Wireshark) to display incorrect
MCS values (e.g., legacy base rates instead of the true MCS).
Fix this by assigning ppdu_info->mcs instead of ppdu_info->rate
for HT/VHT/HE/EHT frame types in ath12k_dp_mon_fill_rx_rate()
and ath12k_dp_mon_update_radiotap().
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220864
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ
Signed-off-by: kwan1996 <laicheehou9@gmail.com>
---
v2: Fix indentation and formatting issues in v1.
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index 39d1967..4119bb8 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -1925,6 +1925,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
}
break;
case RX_MSDU_START_PKT_TYPE_11N:
+ rate_mcs = ppdu_info->mcs;
rx_status->encoding = RX_ENC_HT;
if (rate_mcs > ATH12K_HT_MCS_MAX) {
ath12k_warn(ar->ab,
@@ -1937,6 +1938,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
break;
case RX_MSDU_START_PKT_TYPE_11AC:
+ rate_mcs = ppdu_info->mcs;
rx_status->encoding = RX_ENC_VHT;
rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_VHT_MCS_MAX) {
@@ -1949,6 +1951,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
break;
case RX_MSDU_START_PKT_TYPE_11AX:
+ rate_mcs = ppdu_info->mcs;
rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_HE_MCS_MAX) {
ath12k_warn(ar->ab,
@@ -1960,6 +1963,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
rx_status->he_gi = ath12k_he_gi_to_nl80211_he_gi(sgi);
break;
case RX_MSDU_START_PKT_TYPE_11BE:
+ rate_mcs = ppdu_info->mcs;
rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_EHT_MCS_MAX) {
ath12k_warn(ar->ab,
@@ -2259,13 +2263,13 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
rxs->encoding = RX_ENC_HE;
ptr = skb_push(mon_skb, sizeof(struct ieee80211_radiotap_he));
ath12k_dp_mon_rx_update_radiotap_he(ppduinfo, ptr);
- rxs->rate_idx = ppduinfo->rate;
+ rxs->rate_idx = ppduinfo->mcs;
} else if (ppduinfo->vht_flags) {
rxs->encoding = RX_ENC_VHT;
- rxs->rate_idx = ppduinfo->rate;
+ rxs->rate_idx = ppduinfo->mcs;
} else if (ppduinfo->ht_flags) {
rxs->encoding = RX_ENC_HT;
- rxs->rate_idx = ppduinfo->rate;
+ rxs->rate_idx = ppduinfo->mcs;
} else {
rxs->encoding = RX_ENC_LEGACY;
sband = &ar->mac.sbands[rxs->band];
--
2.34.1
^ permalink raw reply related
* [PATCH] wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode
From: kwan1996 @ 2026-05-05 3:50 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, kwan1996
In monitor mode, the driver incorrectly assigns the legacy rate
to the rate_idx field of the radiotap header for HT/VHT/HE/EHT
frames, ignoring the actual MCS value parsed from the hardware.
This causes packet analyzers (like Wireshark) to display incorrect
MCS values (e.g., legacy base rates instead of the true MCS).
Fix this by assigning ppdu_info->mcs instead of ppdu_info->rate
for HT/VHT/HE/EHT frame types in ath12k_dp_mon_fill_rx_rate()
and ath12k_dp_mon_update_radiotap().
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220864
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ
Signed-off-by: kwan1996 <laicheehou9@gmail.com>
---
drivers/net/wireless/ath/ath12k/dp_mon.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
index 39d1967..729b390 100644
--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
+++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
@@ -1925,6 +1925,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
}
break;
case RX_MSDU_START_PKT_TYPE_11N:
+ rate_mcs = ppdu_info->mcs;
rx_status->encoding = RX_ENC_HT;
if (rate_mcs > ATH12K_HT_MCS_MAX) {
ath12k_warn(ar->ab,
@@ -1937,6 +1938,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
break;
case RX_MSDU_START_PKT_TYPE_11AC:
+ rate_mcs = ppdu_info->mcs;
rx_status->encoding = RX_ENC_VHT;
rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_VHT_MCS_MAX) {
@@ -1949,6 +1951,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
break;
case RX_MSDU_START_PKT_TYPE_11AX:
+ rate_mcs = ppdu_info->mcs;
rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_HE_MCS_MAX) {
ath12k_warn(ar->ab,
@@ -1960,6 +1963,7 @@ ath12k_dp_mon_fill_rx_rate(struct ath12k *ar,
rx_status->he_gi = ath12k_he_gi_to_nl80211_he_gi(sgi);
break;
case RX_MSDU_START_PKT_TYPE_11BE:
+ rate_mcs = ppdu_info->mcs;
rx_status->rate_idx = rate_mcs;
if (rate_mcs > ATH12K_EHT_MCS_MAX) {
ath12k_warn(ar->ab,
@@ -2259,13 +2263,13 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
rxs->encoding = RX_ENC_HE;
ptr = skb_push(mon_skb, sizeof(struct ieee80211_radiotap_he));
ath12k_dp_mon_rx_update_radiotap_he(ppduinfo, ptr);
- rxs->rate_idx = ppduinfo->rate;
+ rxs->rate_idx = ppduinfo->mcs;
} else if (ppduinfo->vht_flags) {
rxs->encoding = RX_ENC_VHT;
- rxs->rate_idx = ppduinfo->rate;
+ rxs->rate_idx = ppduinfo->mcs;
} else if (ppduinfo->ht_flags) {
rxs->encoding = RX_ENC_HT;
- rxs->rate_idx = ppduinfo->rate;
+ rxs->rate_idx = ppduinfo->mcs;
} else {
rxs->encoding = RX_ENC_LEGACY;
sband = &ar->mac.sbands[rxs->band];
--
2.34.1
^ permalink raw reply related
* [wireless-next:main] BUILD SUCCESS 6855a52318b3a8c33031209e38bef497c971ef17
From: kernel test robot @ 2026-05-05 1:50 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Johannes Berg, linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
branch HEAD: 6855a52318b3a8c33031209e38bef497c971ef17 Merge tag 'wireless-next-2026-04-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next
elapsed time: 5838m
configs tested: 352
configs skipped: 30
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig clang-16
arc allnoconfig gcc-15.2.0
arc allyesconfig clang-23
arc defconfig gcc-15.2.0
arc randconfig-001 gcc-8.5.0
arc randconfig-001-20260502 gcc-8.5.0
arc randconfig-001-20260504 gcc-13.4.0
arc randconfig-001-20260505 gcc-8.5.0
arc randconfig-002 gcc-8.5.0
arc randconfig-002-20260502 gcc-8.5.0
arc randconfig-002-20260504 gcc-13.4.0
arc randconfig-002-20260505 gcc-8.5.0
arm allnoconfig gcc-15.2.0
arm allyesconfig clang-16
arm aspeed_g4_defconfig clang-23
arm defconfig gcc-15.2.0
arm randconfig-001 gcc-8.5.0
arm randconfig-001-20260502 gcc-8.5.0
arm randconfig-001-20260504 gcc-13.4.0
arm randconfig-001-20260505 gcc-8.5.0
arm randconfig-002 gcc-8.5.0
arm randconfig-002-20260502 gcc-8.5.0
arm randconfig-002-20260504 gcc-13.4.0
arm randconfig-002-20260505 gcc-8.5.0
arm randconfig-003 gcc-8.5.0
arm randconfig-003-20260502 gcc-8.5.0
arm randconfig-003-20260504 gcc-13.4.0
arm randconfig-003-20260505 gcc-8.5.0
arm randconfig-004 gcc-8.5.0
arm randconfig-004-20260502 gcc-8.5.0
arm randconfig-004-20260504 gcc-13.4.0
arm randconfig-004-20260505 gcc-8.5.0
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-15.2.0
arm64 defconfig gcc-15.2.0
arm64 randconfig-001 gcc-10.5.0
arm64 randconfig-001-20260502 gcc-10.5.0
arm64 randconfig-001-20260504 gcc-15.2.0
arm64 randconfig-001-20260505 gcc-14.3.0
arm64 randconfig-002 gcc-10.5.0
arm64 randconfig-002-20260502 gcc-10.5.0
arm64 randconfig-002-20260504 gcc-15.2.0
arm64 randconfig-002-20260505 gcc-14.3.0
arm64 randconfig-003 gcc-10.5.0
arm64 randconfig-003-20260502 gcc-10.5.0
arm64 randconfig-003-20260504 gcc-15.2.0
arm64 randconfig-003-20260505 gcc-14.3.0
arm64 randconfig-004 gcc-10.5.0
arm64 randconfig-004-20260502 gcc-10.5.0
arm64 randconfig-004-20260504 gcc-15.2.0
arm64 randconfig-004-20260505 gcc-14.3.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001 gcc-10.5.0
csky randconfig-001-20260502 gcc-10.5.0
csky randconfig-001-20260504 gcc-15.2.0
csky randconfig-001-20260505 gcc-14.3.0
csky randconfig-002 gcc-10.5.0
csky randconfig-002-20260502 gcc-10.5.0
csky randconfig-002-20260504 gcc-15.2.0
csky randconfig-002-20260505 gcc-14.3.0
hexagon allmodconfig gcc-15.2.0
hexagon allnoconfig gcc-15.2.0
hexagon defconfig gcc-15.2.0
hexagon randconfig-001 gcc-11.5.0
hexagon randconfig-001-20260502 clang-23
hexagon randconfig-001-20260504 clang-23
hexagon randconfig-001-20260505 clang-23
hexagon randconfig-001-20260505 gcc-11.5.0
hexagon randconfig-002 gcc-11.5.0
hexagon randconfig-002-20260502 clang-23
hexagon randconfig-002-20260504 clang-23
hexagon randconfig-002-20260505 clang-23
hexagon randconfig-002-20260505 gcc-11.5.0
i386 allmodconfig clang-20
i386 allmodconfig gcc-14
i386 allnoconfig gcc-15.2.0
i386 allyesconfig clang-20
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001-20260502 gcc-14
i386 buildonly-randconfig-001-20260504 gcc-14
i386 buildonly-randconfig-001-20260505 gcc-14
i386 buildonly-randconfig-002-20260502 gcc-14
i386 buildonly-randconfig-002-20260504 gcc-14
i386 buildonly-randconfig-002-20260505 gcc-14
i386 buildonly-randconfig-003-20260502 gcc-14
i386 buildonly-randconfig-003-20260504 gcc-14
i386 buildonly-randconfig-003-20260505 gcc-14
i386 buildonly-randconfig-004-20260502 gcc-14
i386 buildonly-randconfig-004-20260504 gcc-14
i386 buildonly-randconfig-004-20260505 gcc-14
i386 buildonly-randconfig-005-20260502 gcc-14
i386 buildonly-randconfig-005-20260504 gcc-14
i386 buildonly-randconfig-005-20260505 gcc-14
i386 buildonly-randconfig-006-20260502 gcc-14
i386 buildonly-randconfig-006-20260504 gcc-14
i386 buildonly-randconfig-006-20260505 gcc-14
i386 defconfig gcc-15.2.0
i386 randconfig-001-20260505 clang-20
i386 randconfig-002-20260505 clang-20
i386 randconfig-003-20260505 clang-20
i386 randconfig-004-20260505 clang-20
i386 randconfig-005-20260505 clang-20
i386 randconfig-006-20260505 clang-20
i386 randconfig-007-20260505 clang-20
i386 randconfig-011-20260504 clang-20
i386 randconfig-011-20260505 clang-20
i386 randconfig-011-20260505 gcc-14
i386 randconfig-012-20260504 clang-20
i386 randconfig-012-20260505 clang-20
i386 randconfig-013-20260504 clang-20
i386 randconfig-013-20260505 clang-20
i386 randconfig-014-20260504 clang-20
i386 randconfig-014-20260505 clang-20
i386 randconfig-015-20260504 clang-20
i386 randconfig-015-20260505 clang-20
i386 randconfig-015-20260505 gcc-14
i386 randconfig-016-20260504 clang-20
i386 randconfig-016-20260505 clang-20
i386 randconfig-017-20260504 clang-20
i386 randconfig-017-20260505 clang-20
i386 randconfig-017-20260505 gcc-14
loongarch allmodconfig clang-23
loongarch allnoconfig gcc-15.2.0
loongarch defconfig clang-19
loongarch randconfig-001 gcc-11.5.0
loongarch randconfig-001-20260502 clang-23
loongarch randconfig-001-20260504 clang-23
loongarch randconfig-001-20260505 clang-23
loongarch randconfig-001-20260505 gcc-11.5.0
loongarch randconfig-002 gcc-11.5.0
loongarch randconfig-002-20260502 clang-23
loongarch randconfig-002-20260504 clang-23
loongarch randconfig-002-20260505 clang-18
loongarch randconfig-002-20260505 clang-23
loongarch randconfig-002-20260505 gcc-11.5.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig clang-16
m68k defconfig clang-19
m68k defconfig gcc-15.2.0
m68k hp300_defconfig gcc-15.2.0
m68k m5249evb_defconfig gcc-15.2.0
m68k mvme147_defconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig clang-19
microblaze defconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
mips decstation_64_defconfig gcc-15.2.0
mips rs90_defconfig gcc-15.2.0
nios2 allmodconfig clang-23
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-15.2.0
nios2 defconfig clang-19
nios2 defconfig gcc-15.2.0
nios2 randconfig-001 gcc-11.5.0
nios2 randconfig-001-20260502 clang-23
nios2 randconfig-001-20260504 clang-23
nios2 randconfig-001-20260505 clang-18
nios2 randconfig-001-20260505 clang-23
nios2 randconfig-001-20260505 gcc-11.5.0
nios2 randconfig-002 gcc-11.5.0
nios2 randconfig-002-20260502 clang-23
nios2 randconfig-002-20260504 clang-23
nios2 randconfig-002-20260505 clang-18
nios2 randconfig-002-20260505 clang-23
nios2 randconfig-002-20260505 gcc-11.5.0
openrisc allmodconfig clang-23
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-15.2.0
parisc allyesconfig clang-19
parisc defconfig gcc-15.2.0
parisc randconfig-001 gcc-12.5.0
parisc randconfig-001-20260502 gcc-12.5.0
parisc randconfig-001-20260504 gcc-13.4.0
parisc randconfig-001-20260505 gcc-14.3.0
parisc randconfig-002 gcc-12.5.0
parisc randconfig-002-20260502 gcc-12.5.0
parisc randconfig-002-20260504 gcc-13.4.0
parisc randconfig-002-20260505 gcc-14.3.0
parisc64 defconfig clang-19
parisc64 defconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-15.2.0
powerpc randconfig-001 gcc-12.5.0
powerpc randconfig-001-20260502 gcc-12.5.0
powerpc randconfig-001-20260504 gcc-13.4.0
powerpc randconfig-001-20260505 gcc-14.3.0
powerpc randconfig-002 gcc-12.5.0
powerpc randconfig-002-20260502 gcc-12.5.0
powerpc randconfig-002-20260504 gcc-13.4.0
powerpc randconfig-002-20260505 gcc-14.3.0
powerpc tqm8560_defconfig gcc-15.2.0
powerpc64 randconfig-001 gcc-12.5.0
powerpc64 randconfig-001-20260502 gcc-12.5.0
powerpc64 randconfig-001-20260504 gcc-13.4.0
powerpc64 randconfig-001-20260505 gcc-14.3.0
powerpc64 randconfig-002 gcc-12.5.0
powerpc64 randconfig-002-20260502 gcc-12.5.0
powerpc64 randconfig-002-20260504 gcc-13.4.0
powerpc64 randconfig-002-20260505 gcc-14.3.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv defconfig gcc-15.2.0
riscv randconfig-001-20260502 gcc-14.3.0
riscv randconfig-001-20260504 gcc-8.5.0
riscv randconfig-001-20260505 gcc-10.5.0
riscv randconfig-002-20260502 gcc-14.3.0
riscv randconfig-002-20260504 gcc-8.5.0
s390 allmodconfig clang-19
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 defconfig gcc-15.2.0
s390 randconfig-001-20260502 gcc-14.3.0
s390 randconfig-001-20260504 gcc-8.5.0
s390 randconfig-002-20260502 gcc-14.3.0
s390 randconfig-002-20260504 gcc-8.5.0
s390 randconfig-002-20260505 gcc-10.5.0
sh allmodconfig gcc-15.2.0
sh allnoconfig clang-23
sh allnoconfig gcc-15.2.0
sh allyesconfig clang-19
sh defconfig gcc-14
sh randconfig-001-20260502 gcc-14.3.0
sh randconfig-001-20260504 gcc-8.5.0
sh randconfig-001-20260505 gcc-10.5.0
sh randconfig-002-20260502 gcc-14.3.0
sh randconfig-002-20260504 gcc-8.5.0
sh randconfig-002-20260505 gcc-10.5.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001-20260502 gcc-8.5.0
sparc randconfig-001-20260505 gcc-15.2.0
sparc randconfig-002-20260502 gcc-8.5.0
sparc randconfig-002-20260505 gcc-15.2.0
sparc64 allmodconfig clang-23
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260502 gcc-8.5.0
sparc64 randconfig-001-20260505 gcc-15.2.0
sparc64 randconfig-002-20260502 gcc-8.5.0
sparc64 randconfig-002-20260505 gcc-15.2.0
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-15.2.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260502 gcc-8.5.0
um randconfig-001-20260505 gcc-15.2.0
um randconfig-002-20260502 gcc-8.5.0
um randconfig-002-20260505 gcc-15.2.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-23
x86_64 allnoconfig gcc-15.2.0
x86_64 allyesconfig clang-20
x86_64 buildonly-randconfig-001 clang-20
x86_64 buildonly-randconfig-001-20260502 clang-20
x86_64 buildonly-randconfig-001-20260504 gcc-12
x86_64 buildonly-randconfig-001-20260505 clang-20
x86_64 buildonly-randconfig-002 clang-20
x86_64 buildonly-randconfig-002-20260502 clang-20
x86_64 buildonly-randconfig-002-20260504 gcc-12
x86_64 buildonly-randconfig-002-20260505 clang-20
x86_64 buildonly-randconfig-003 clang-20
x86_64 buildonly-randconfig-003-20260502 clang-20
x86_64 buildonly-randconfig-003-20260504 gcc-12
x86_64 buildonly-randconfig-003-20260505 clang-20
x86_64 buildonly-randconfig-004 clang-20
x86_64 buildonly-randconfig-004-20260502 clang-20
x86_64 buildonly-randconfig-004-20260504 gcc-12
x86_64 buildonly-randconfig-004-20260505 clang-20
x86_64 buildonly-randconfig-005 clang-20
x86_64 buildonly-randconfig-005-20260502 clang-20
x86_64 buildonly-randconfig-005-20260504 gcc-12
x86_64 buildonly-randconfig-005-20260505 clang-20
x86_64 buildonly-randconfig-006 clang-20
x86_64 buildonly-randconfig-006-20260502 clang-20
x86_64 buildonly-randconfig-006-20260504 gcc-12
x86_64 buildonly-randconfig-006-20260505 clang-20
x86_64 defconfig gcc-14
x86_64 kexec clang-20
x86_64 randconfig-001-20260502 clang-20
x86_64 randconfig-001-20260505 clang-20
x86_64 randconfig-002-20260502 clang-20
x86_64 randconfig-002-20260505 clang-20
x86_64 randconfig-003-20260502 clang-20
x86_64 randconfig-003-20260505 clang-20
x86_64 randconfig-004-20260502 clang-20
x86_64 randconfig-004-20260505 clang-20
x86_64 randconfig-005-20260502 clang-20
x86_64 randconfig-005-20260505 clang-20
x86_64 randconfig-006-20260502 clang-20
x86_64 randconfig-006-20260505 clang-20
x86_64 randconfig-011-20260505 clang-20
x86_64 randconfig-012-20260505 clang-20
x86_64 randconfig-013-20260505 clang-20
x86_64 randconfig-014-20260505 clang-20
x86_64 randconfig-015-20260505 clang-20
x86_64 randconfig-016-20260505 clang-20
x86_64 randconfig-071 clang-20
x86_64 randconfig-071-20260502 gcc-14
x86_64 randconfig-071-20260504 clang-20
x86_64 randconfig-071-20260505 clang-20
x86_64 randconfig-072 clang-20
x86_64 randconfig-072-20260502 gcc-14
x86_64 randconfig-072-20260504 clang-20
x86_64 randconfig-072-20260505 clang-20
x86_64 randconfig-073 clang-20
x86_64 randconfig-073-20260502 gcc-14
x86_64 randconfig-073-20260504 clang-20
x86_64 randconfig-073-20260505 clang-20
x86_64 randconfig-074 clang-20
x86_64 randconfig-074-20260502 gcc-14
x86_64 randconfig-074-20260504 clang-20
x86_64 randconfig-074-20260505 clang-20
x86_64 randconfig-075 clang-20
x86_64 randconfig-075-20260502 gcc-14
x86_64 randconfig-075-20260504 clang-20
x86_64 randconfig-075-20260505 clang-20
x86_64 randconfig-076 clang-20
x86_64 randconfig-076-20260502 gcc-14
x86_64 randconfig-076-20260504 clang-20
x86_64 randconfig-076-20260505 clang-20
x86_64 rhel-9.4 clang-20
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-20
x86_64 rhel-9.4-kselftests clang-20
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig clang-23
xtensa randconfig-001-20260502 gcc-8.5.0
xtensa randconfig-001-20260505 gcc-15.2.0
xtensa randconfig-002-20260502 gcc-8.5.0
xtensa randconfig-002-20260505 gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [bug report] wifi: mt76: mt7925: nl80211 set_antenna returns -ENOTSUPP without extack
From: Bradley Pizzimenti @ 2026-05-04 22:04 UTC (permalink / raw)
To: linux-wireless
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, linux-kernel
Hi there maintainers,
`iw phy phy0 set antenna <mask> <mask>` always returns -ENOTSUPP (-95)
on mt7925, regardless of mask value or interface state. The driver
implements mt7925_set_antenna() in mainline (which would itself
return -EINVAL for invalid masks), so the rejection appears to happen
before that function is reached, and there is no extack reason.
Filing as a breadcrumb -- haven't bisected which layer (cfg80211 /
mac80211 / nl80211) is producing the -ENOTSUPP.
Hardware
--------
MEDIATEK MT7925 [Filogic 360], 802.11be 2x2, PCI 14c3:7925
ASIC revision 0x79250000
Driver in use: mt7925e (in-tree)
Firmware (from dmesg at probe)
------------------------------
mt7925e 0000:01:00.0: HW/SW Version: 0x8a108a10,
Build Time: 20260106153007a
mt7925e 0000:01:00.0: WM Firmware Version: ____000000,
Build Time: 20260106153120
Kernel
------
6.18.18-1-MANJARO (close to vanilla 6.18 stable; not yet tested on
wireless-next or nbd168/wireless HEAD).
Tools: iw version 6.17
Capability advertised
---------------------
$ iw phy phy0 info | grep Antennas
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0x3 RX 0x3
So the wiphy advertises both chains as configurable.
Observed
--------
$ sudo iw --debug phy phy0 set antenna 0x1 0x1
-- Debug: Sent Message:
[GENERIC NETLINK HEADER]
.cmd = 2 (NL80211_CMD_SET_WIPHY)
[PAYLOAD]
attr 0x01 (NL80211_ATTR_WIPHY) = 0
attr 0x69 (NL80211_ATTR_WIPHY_ANTENNA_TX) = 1
attr 0x6a (NL80211_ATTR_WIPHY_ANTENNA_RX) = 1
-- Debug: Received Message:
[ERRORMSG] 20 octets
.error = -95 "Operation not supported"
(no NLMSGERR_ATTR_MSG / extack)
command failed: Operation not supported (-95)
Same result with masks 0x2/0x2 and 0x3/0x3 (i.e. setting the current
configured value also fails). Same result with the netdev
administratively down via `ip link set wlp1s0 down`. The implicit
p2p-device interface is present in all cases (mt7925 is P2P-capable).
Expected
--------
Either reach mt7925_set_antenna() and let the driver validate the
mask (returning -EINVAL for bad input), or return -ENOTSUPP with an
NLMSGERR_ATTR_MSG indicating which layer rejected the request and
why (e.g. "interface running", "capability not actually supported",
etc.). Currently it's hard to tell from userland whether this is a
driver gap, a mac80211 precondition I'm not satisfying, or something
else.
Use case
--------
I have a damaged secondary antenna (chain 1 at -88 dBm vs chain 0 at
-72 dBm, ~33% TX retry rate). I was hoping to mask off the broken
chain in software while waiting on a hardware repair. The capability
mask 0x3/0x3 advertised in `iw phy phy0 info` suggested this was
configurable; the -ENOTSUPP without extack made it hard to tell why
not.
Caveats
-------
- Not yet tested on wireless-next or nbd168/wireless HEAD.
- I have not used ftrace / kprobes to bisect the rejection layer;
reporting the user-visible netlink exchange.
Thanks,
Bradley
^ permalink raw reply
* [bug report] wifi: mt76: mt7925: iw set txpower fixed accepted but ignored
From: Bradley Pizzimenti @ 2026-05-04 22:04 UTC (permalink / raw)
To: linux-wireless
Cc: linux-kernel, nbd, lorenzo, ryder.lee, shayne.chen, sean.wang
Hi there maintainers,
`iw dev <iface> set txpower fixed N` returns success on mt7925 for any
N tested, but the reported txpower never changes from a stuck value of
3.00 dBm. The kernel accepts and ignores the call silently in both
directions (above and below the displayed value), and well below the
regulatory ceiling.
I'm aware there's prior art on the cosmetic 3.00 dBm display issue
(Razvan Grigore's v2 series, Feb 2025; Ming Yen Hsieh's txpower init
refactor, Sept 2025). What seems potentially distinct here is that the
user-issued `iw set txpower fixed N` itself is silently no-op'd,
separate from the reported-value question. Reporting as breadcrumbs
in case the second observation is a separate bug rather than the same
one.
Hardware
--------
MEDIATEK MT7925 [Filogic 360], 802.11be 2x2, PCI 14c3:7925
ASIC revision 0x79250000
Driver in use: mt7925e (in-tree)
Firmware (from dmesg at probe)
------------------------------
mt7925e 0000:01:00.0: HW/SW Version: 0x8a108a10,
Build Time: 20260106153007a
mt7925e 0000:01:00.0: WM Firmware Version: ____000000,
Build Time: 20260106153120
Files: mediatek/mt7925/WIFI_MT7925_PATCH_MCU_1_1_hdr.bin
mediatek/mt7925/WIFI_RAM_CODE_MT7925_1_1.bin
Kernel
------
6.18.18-1-MANJARO (close to vanilla 6.18 stable; not yet tested on
wireless-next or nbd168/wireless HEAD -- happy to retest if needed,
but flagging the data point in case it helps as-is).
Tools: iw version 6.17
Regulatory
----------
$ iw reg get
country US: DFS-FCC
...
(5730 - 5850 @ 80), (N/A, 30), (N/A), AUTO-BW
...
Connection context: 5GHz channel 161 (5805 MHz), 80 MHz, VHT-MCS,
NSS 1. So we are on a band with a 30 dBm regulatory cap.
Observed
--------
$ iw dev wlp1s0 info | grep txpower
txpower 3.00 dBm
$ sudo iw dev wlp1s0 set txpower fixed 100 # 1 dBm
$ iw dev wlp1s0 info | grep txpower
txpower 3.00 dBm
$ sudo iw dev wlp1s0 set txpower fixed 1500 # 15 dBm
$ iw dev wlp1s0 info | grep txpower
txpower 3.00 dBm
$ sudo iw dev wlp1s0 set txpower auto
$ iw dev wlp1s0 info | grep txpower
txpower 3.00 dBm
All four `set` invocations return exit code 0. The reported value
never moves.
Expected
--------
Either:
- The reported txpower follows the requested value (or, where
capped, the actual applied value with extack indicating the
cap reason), or
- The set call returns an error rather than silently ignoring the
request.
Caveats
-------
- Not yet tested on wireless-next or nbd168/wireless HEAD. If a
reproduction on a current dev tree would be useful, I can do that.
- I have not verified whether the actual radiated TX power changes
in response to `set txpower fixed`; I am reporting only the
user-visible behavior.
Thanks,
Bradley
^ permalink raw reply
* ath12k WCN7850: Q6 Hexagon fault at WLAON region 0x1792000 ~2s post-AUTHORIZE on X1E80100
From: Marcus Glocker @ 2026-05-04 21:08 UTC (permalink / raw)
To: ath12k, linux-wireless
Cc: jjohnson, kvalo, manivannan.sadhasivam, Mark Kettenis
Hi,
We're porting ath12k to OpenBSD as the qwz(4) driver, targeting Samsung
Galaxy Book4 Edge (X1E80100 SoC, WCN7850 hw2.0). Scan, auth, 4-way
handshake all complete; ~2 seconds after WPA2 AUTHORIZE the WCN7850
firmware crashes deterministically with:
dlpager_main.c:147 Non Page Fault Exception cause code 0x 23
at Address: 0x 1792000
Cause code 0x23 isn't a valid arm64 exception -- the fault is on the
WCN7850's on-die Hexagon Q6 DSP, with QURT's generic exception handler
(which happens to live in dlpager_main.c) printing it. So this is not
a host CPU fault.
Per the RDDM segment table (at the start of the dump), VA 0x01792000
is the start of the chip's WLAON_DUMP region (size 0x820). The Q6 is
trying to read its own always-on hardware state region and the chip
refuses the access.
(Samsung, Asus, Honor) with multiple FW builds. Currently testing
with WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
(fw 0x110cffff, 2025-06-25) -- the exact blob a Linux ath12k user
runs successfully on the identical Samsung hardware. Same board-2.bin,
same compiled DTB (upstream hamoa.dtsi based).
We've field-compared qwz against ath12k and ruled out (byte-level or
wire-level):
* QMI host_cap, m3_info, wlan_cfg, wlan_ini, bdf_download (all
fields including ce_config, svc_to_ce_map, shadow_reg_v3,
feature_list, m3 paddr/size, nm_modem)
* MHI bringup ordering (BHI -> wait SBL EE -> wait M0 -> BHIE)
* BHI/BHIE DMA coherency
* ASPM disable before MHI start
* WLAON_WARM_SW_ENTRY zeroing + QFPROM_PWR_CTRL VDD4BLOW clear
* static_window_map=false + window-bank register init
* Per-chunk vs monolithic respond_mem allocation
* WMI_PEER_MIMO_PS_STATE = WMI_PEER_SMPS_PS_NONE (added matching
ath12k_setup_peer_smps; doesn't help)
* FW image variation (c5 and c7 both fail identically)
Specifically NOT involved (we have evidence either way):
* Gunyah -- X1E80100 is reportedly run in EL2 without Gunyah by
users where ath12k works; so Gunyah isn't programming WLAON
access for the Q6.
* SMMU / pcie_smmu -- pcie_smmu is status="reserved" upstream,
pcie4 has no iommus property; PCIe DMA bypasses SMMU.
* SCM/PAS -- ath12k's PCIe path makes no qcom_scm_* calls.
Question: what subsystem inside the WCN7850 firmware touches the
WLAON region at 0x01792000 around 2 seconds after the host sends
WMI_PEER_AUTHORIZE? And what host-side configuration (WMI command,
HTT message, MHI state, etc.) primes that path so the access
succeeds on Linux?
Even a pointer at the right Linux code path or the right FW-side
component would unblock us. We have full RDDM dumps and dmesg
captures available; happy to share off-list or as attachments.
Thanks,
Marcus
--
[ -- Marcus Glocker, marcus@nazgul.ch, https://nazgul.ch ------------- ]
^ permalink raw reply
* Re: [PATCH] wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
From: Sean Wang @ 2026-05-04 19:26 UTC (permalink / raw)
To: JB Tsai
Cc: nbd, lorenzo, linux-wireless, linux-mediatek, Deren.Wu, Sean.Wang,
Quan.Zhou, Ryder.Lee, Leon.Yen, litien.chang, eason.lai
In-Reply-To: <20260430084525.3471313-1-jb.tsai@mediatek.com>
Hi,
On Thu, Apr 30, 2026 at 3:50 AM JB Tsai <jb.tsai@mediatek.com> wrote:
>
> From: Eason Lai <Eason.Lai@mediatek.com>
>
> A use-after-free issue occurs in mt76_rx_poll_complete due to a race
> condition. The STA has already been removed, but the rx_status still
> had a pointer to the wcid in the STA.
>
> Use wcid_idx instead of storing the wcid pointer, and look up the wcid
> via rcu_dereference() by wcid_idx.
>
> BUG: KASAN: invalid-access in mt76_rx_poll_complete+0x280/0x470 [mt76]
> Call trace:
> dump_backtrace+0xec/0x128
> show_stack+0x18/0x28
> dump_stack_lvl+0x40/0xc8
> print_report+0x1b8/0x710
> kasan_report+0xe0/0x144
> do_bad_area+0x120/0x260
> do_tag_check_fault+0x20/0x34
> do_mem_abort+0x54/0xa8
> el1_abort+0x3c/0x5c
> el1h_64_sync_handler+0x40/0xcc
> el1h_64_sync+0x7c/0x80
> mt76_rx_poll_complete+0x280/0x470
> mt76_dma_rx_poll+0x114/0x51c
> mt792x_poll_rx+0x60/0xf8
> napi_threaded_poll_loop+0xe0/0x450
> napi_threaded_poll+0x80/0x9c
> kthread+0x11c/0x158
> ret_from_fork+0x10/0x20
>
This patch causes a build error:
mt76x02_mac.c: In function ‘mt76x02_mac_process_rx’:
mt76x02_mac.c:804:15: error: ‘struct mt76_rx_status’ has no member
named ‘wcid’
804 | status->wcid = mt76x02_rx_get_sta_wcid(sta, unicast);
| ^~
Please update the mt76x02 RX path as well, since mt76_rx_status no
longer carries a cached wcid pointer.
Also, after dropping the union:
struct mt76_rx_status {
- union {
- struct mt76_wcid *wcid;
u16 wcid_idx;
- };
};
wcid_idx should be shifted left by one tab to match the surrounding
structure indentation.
The underlying issue looks critical for mt76. The KASAN report shows a
use-after-free in mt76_rx_poll_complete() caused by keeping a stale WCID
pointer after the STA has already been removed. Using wcid_idx and doing
the WCID lookup under RCU is the right direction.
Please also add a proper Fixes tag and Cc stable, so this can be
backported to stable kernels.
> Signed-off-by: Eason Lai <Eason.Lai@mediatek.com>
> ---
> drivers/net/wireless/mediatek/mt76/agg-rx.c | 18 ++++---
> drivers/net/wireless/mediatek/mt76/mac80211.c | 47 ++++++++-----------
> drivers/net/wireless/mediatek/mt76/mt76.h | 7 ++-
> .../net/wireless/mediatek/mt76/mt7603/mac.c | 6 ++-
> .../net/wireless/mediatek/mt76/mt7615/mac.c | 19 +++++---
> .../net/wireless/mediatek/mt76/mt76_connac.h | 3 +-
> .../wireless/mediatek/mt76/mt76_connac_mac.c | 12 ++++-
> .../net/wireless/mediatek/mt76/mt7915/mac.c | 16 +++++--
> .../net/wireless/mediatek/mt76/mt7921/mac.c | 13 +++--
> .../net/wireless/mediatek/mt76/mt7925/mac.c | 19 +++++---
> .../net/wireless/mediatek/mt76/mt7996/mac.c | 29 ++++++++----
> 11 files changed, 114 insertions(+), 75 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c
> index bf1babac3895..b72d13975466 100644
> --- a/drivers/net/wireless/mediatek/mt76/agg-rx.c
> +++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c
> @@ -116,14 +116,15 @@ mt76_rx_aggr_reorder_work(struct work_struct *work)
> }
>
> static void
> -mt76_rx_aggr_check_ctl(struct sk_buff *skb, struct sk_buff_head *frames)
> +mt76_rx_aggr_check_ctl(struct mt76_dev *dev, struct sk_buff *skb,
> + struct sk_buff_head *frames)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> struct ieee80211_bar *bar = mt76_skb_get_hdr(skb);
> - struct mt76_wcid *wcid = status->wcid;
> struct mt76_rx_tid *tid;
> - u8 tidno;
> + struct mt76_wcid *wcid;
> u16 seqno;
> + u8 tidno;
>
> if (!ieee80211_is_ctl(bar->frame_control))
> return;
> @@ -131,6 +132,10 @@ mt76_rx_aggr_check_ctl(struct sk_buff *skb, struct sk_buff_head *frames)
> if (!ieee80211_is_back_req(bar->frame_control))
> return;
>
> + wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
> + if (!wcid)
> + return;
> +
> status->qos_ctl = tidno = le16_to_cpu(bar->control) >> 12;
> seqno = IEEE80211_SEQ_TO_SN(le16_to_cpu(bar->start_seq_num));
> tid = rcu_dereference(wcid->aggr[tidno]);
> @@ -145,10 +150,11 @@ mt76_rx_aggr_check_ctl(struct sk_buff *skb, struct sk_buff_head *frames)
> spin_unlock_bh(&tid->lock);
> }
>
> -void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)
> +void mt76_rx_aggr_reorder(struct mt76_dev *dev, struct sk_buff *skb,
> + struct sk_buff_head *frames)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> - struct mt76_wcid *wcid = status->wcid;
> + struct mt76_wcid *wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
> struct ieee80211_sta *sta;
> struct mt76_rx_tid *tid;
> bool sn_less;
> @@ -164,7 +170,7 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)
>
> if (!status->aggr) {
> if (!(status->flag & RX_FLAG_8023))
> - mt76_rx_aggr_check_ctl(skb, frames);
> + mt76_rx_aggr_check_ctl(dev, skb, frames);
> return;
> }
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
> index 4ae5e4715a9c..2933b29782d3 100644
> --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
> +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
> @@ -1283,21 +1283,24 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
> memcpy(status->chain_signal, mstat.chain_signal,
> sizeof(mstat.chain_signal));
>
> - if (mstat.wcid) {
> - status->link_valid = mstat.wcid->link_valid;
> - status->link_id = mstat.wcid->link_id;
> - }
> + if (mstat.wcid_idx != MT76_WCID_IDX_INVALID) {
> + struct mt76_wcid *wcid = __mt76_wcid_ptr(dev, mstat.wcid_idx);
>
> - *sta = wcid_to_sta(mstat.wcid);
> + if (wcid) {
> + status->link_valid = wcid->link_valid;
> + status->link_id = wcid->link_id;
> + *sta = wcid_to_sta(wcid);
> + }
> + }
> *hw = mt76_phy_hw(dev, mstat.phy_idx);
> }
>
> static void
> -mt76_check_ccmp_pn(struct sk_buff *skb)
> +mt76_check_ccmp_pn(struct mt76_dev *dev, struct sk_buff *skb)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> - struct mt76_wcid *wcid = status->wcid;
> struct ieee80211_hdr *hdr;
> + struct mt76_wcid *wcid;
> int security_idx;
> int ret;
>
> @@ -1307,6 +1310,7 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
> if (status->flag & RX_FLAG_ONLY_MONITOR)
> return;
>
> + wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
> if (!wcid || !wcid->rx_check_pn)
> return;
>
> @@ -1354,7 +1358,7 @@ static void
> mt76_airtime_report(struct mt76_dev *dev, struct mt76_rx_status *status,
> int len)
> {
> - struct mt76_wcid *wcid = status->wcid;
> + struct mt76_wcid *wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
> struct ieee80211_rx_status info = {
> .enc_flags = status->enc_flags,
> .rate_idx = status->rate_idx,
> @@ -1382,19 +1386,9 @@ mt76_airtime_report(struct mt76_dev *dev, struct mt76_rx_status *status,
> static void
> mt76_airtime_flush_ampdu(struct mt76_dev *dev)
> {
> - struct mt76_wcid *wcid;
> - int wcid_idx;
> -
> if (!dev->rx_ampdu_len)
> return;
>
> - wcid_idx = dev->rx_ampdu_status.wcid_idx;
> - if (wcid_idx < ARRAY_SIZE(dev->wcid))
> - wcid = rcu_dereference(dev->wcid[wcid_idx]);
> - else
> - wcid = NULL;
> - dev->rx_ampdu_status.wcid = wcid;
> -
> mt76_airtime_report(dev, &dev->rx_ampdu_status, dev->rx_ampdu_len);
>
> dev->rx_ampdu_len = 0;
> @@ -1405,7 +1399,7 @@ static void
> mt76_airtime_check(struct mt76_dev *dev, struct sk_buff *skb)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> - struct mt76_wcid *wcid = status->wcid;
> + struct mt76_wcid *wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
>
> if (!(dev->drv->drv_flags & MT_DRV_SW_RX_AIRTIME))
> return;
> @@ -1418,8 +1412,6 @@ mt76_airtime_check(struct mt76_dev *dev, struct sk_buff *skb)
>
> if (!ether_addr_equal(hdr->addr1, dev->phy.macaddr))
> return;
> -
> - wcid = NULL;
> }
>
> if (!(status->flag & RX_FLAG_AMPDU_DETAILS) ||
> @@ -1430,7 +1422,6 @@ mt76_airtime_check(struct mt76_dev *dev, struct sk_buff *skb)
> if (!dev->rx_ampdu_len ||
> status->ampdu_ref != dev->rx_ampdu_ref) {
> dev->rx_ampdu_status = *status;
> - dev->rx_ampdu_status.wcid_idx = wcid ? wcid->idx : 0xff;
> dev->rx_ampdu_ref = status->ampdu_ref;
> }
>
> @@ -1448,7 +1439,7 @@ mt76_check_sta(struct mt76_dev *dev, struct sk_buff *skb)
> struct ieee80211_hdr *hdr = mt76_skb_get_hdr(skb);
> struct ieee80211_sta *sta;
> struct ieee80211_hw *hw;
> - struct mt76_wcid *wcid = status->wcid;
> + struct mt76_wcid *wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
> u8 tidno = status->qos_ctl & IEEE80211_QOS_CTL_TID_MASK;
> bool ps;
>
> @@ -1456,8 +1447,10 @@ mt76_check_sta(struct mt76_dev *dev, struct sk_buff *skb)
> if (ieee80211_is_pspoll(hdr->frame_control) && !wcid &&
> !(status->flag & RX_FLAG_8023)) {
> sta = ieee80211_find_sta_by_ifaddr(hw, hdr->addr2, NULL);
> - if (sta)
> - wcid = status->wcid = (struct mt76_wcid *)sta->drv_priv;
> + if (sta) {
> + wcid = (struct mt76_wcid *)sta->drv_priv;
> + status->wcid_idx = wcid->idx;
> + }
> }
>
> mt76_airtime_check(dev, skb);
> @@ -1521,7 +1514,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
> while ((skb = __skb_dequeue(frames)) != NULL) {
> struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
>
> - mt76_check_ccmp_pn(skb);
> + mt76_check_ccmp_pn(dev, skb);
> skb_shinfo(skb)->frag_list = NULL;
> mt76_rx_convert(dev, skb, &hw, &sta);
> ieee80211_rx_list(hw, sta, skb, &list);
> @@ -1563,7 +1556,7 @@ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
> mt76_npu_device_active(dev))
> __skb_queue_tail(&frames, skb);
> else
> - mt76_rx_aggr_reorder(skb, &frames);
> + mt76_rx_aggr_reorder(dev, skb, &frames);
> }
>
> mt76_rx_complete(dev, &frames, napi);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
> index 527bef97e122..fd449298fb11 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76.h
> +++ b/drivers/net/wireless/mediatek/mt76/mt76.h
> @@ -364,6 +364,7 @@ enum mt76_wcid_flags {
> };
>
> #define MT76_N_WCIDS 1088
> +#define MT76_WCID_IDX_INVALID 0xffff
> #define MT76_BEACON_MON_MAX_MISS 7
>
> /* stored in ieee80211_tx_info::hw_queue */
> @@ -728,10 +729,7 @@ struct mt76_mmio {
> };
>
> struct mt76_rx_status {
> - union {
> - struct mt76_wcid *wcid;
> u16 wcid_idx;
> - };
>
> u32 reorder_time;
>
> @@ -1793,7 +1791,8 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
> struct napi_struct *napi);
> void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
> struct napi_struct *napi);
> -void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames);
> +void mt76_rx_aggr_reorder(struct mt76_dev *dev, struct sk_buff *skb,
> + struct sk_buff_head *frames);
> void mt76_testmode_tx_pending(struct mt76_phy *phy);
> void mt76_queue_tx_complete(struct mt76_dev *dev, struct mt76_queue *q,
> struct mt76_queue_entry *e);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
> index d3110eeb45d7..aeb890df808e 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
> @@ -513,6 +513,7 @@ mt7603_mac_fill_rx(struct mt7603_dev *dev, struct sk_buff *skb)
> u32 rxd2 = le32_to_cpu(rxd[2]);
> bool unicast = rxd1 & MT_RXD1_NORMAL_U2M;
> bool insert_ccmp_hdr = false;
> + struct mt76_wcid *wcid;
> bool remove_pad;
> int idx;
> int i;
> @@ -524,7 +525,8 @@ mt7603_mac_fill_rx(struct mt7603_dev *dev, struct sk_buff *skb)
> i >>= 1;
>
> idx = FIELD_GET(MT_RXD2_NORMAL_WLAN_IDX, rxd2);
> - status->wcid = mt7603_rx_get_wcid(dev, idx, unicast);
> + wcid = mt7603_rx_get_wcid(dev, idx, unicast);
> + status->wcid_idx = wcid ? wcid->idx : MT76_WCID_IDX_INVALID;
>
> status->band = sband->band;
> if (i < sband->n_channels)
> @@ -672,7 +674,7 @@ mt7603_mac_fill_rx(struct mt7603_dev *dev, struct sk_buff *skb)
> }
>
> hdr = (struct ieee80211_hdr *)skb->data;
> - if (!status->wcid || !ieee80211_is_data_qos(hdr->frame_control))
> + if (!wcid || !ieee80211_is_data_qos(hdr->frame_control))
> return 0;
>
> status->aggr = unicast &&
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
> index ce0051468501..84be00a13930 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
> @@ -246,17 +246,20 @@ static void mt7615_mac_fill_tm_rx(struct mt7615_phy *phy, __le32 *rxv)
> }
>
> /* The HW does not translate the mac header to 802.3 for mesh point */
> -static int mt7615_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
> +static int mt7615_reverse_frag0_hdr_trans(struct mt7615_dev *dev,
> + struct sk_buff *skb, u16 hdr_gap)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> struct ethhdr *eth_hdr = (struct ethhdr *)(skb->data + hdr_gap);
> - struct mt7615_sta *msta = (struct mt7615_sta *)status->wcid;
> __le32 *rxd = (__le32 *)skb->data;
> struct ieee80211_sta *sta;
> struct ieee80211_vif *vif;
> struct ieee80211_hdr hdr;
> + struct mt7615_sta *msta;
> u16 frame_control;
>
> + msta = (struct mt7615_sta *)mt76_wcid_ptr(dev, status->wcid_idx);
> +
> if (le32_get_bits(rxd[1], MT_RXD1_NORMAL_ADDR_TYPE) !=
> MT_RXD1_NORMAL_U2M)
> return -EINVAL;
> @@ -335,6 +338,7 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb)
> struct ieee80211_supported_band *sband;
> struct ieee80211_hdr *hdr;
> struct mt7615_phy *phy2;
> + struct mt76_wcid *wcid;
> __le32 *rxd = (__le32 *)skb->data;
> u32 rxd0 = le32_to_cpu(rxd[0]);
> u32 rxd1 = le32_to_cpu(rxd[1]);
> @@ -378,12 +382,13 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb)
>
> unicast = (rxd1 & MT_RXD1_NORMAL_ADDR_TYPE) == MT_RXD1_NORMAL_U2M;
> idx = FIELD_GET(MT_RXD2_NORMAL_WLAN_IDX, rxd2);
> - status->wcid = mt7615_rx_get_wcid(dev, idx, unicast);
> + wcid = mt7615_rx_get_wcid(dev, idx, unicast);
> + status->wcid_idx = wcid ? wcid->idx : MT76_WCID_IDX_INVALID;
>
> - if (status->wcid) {
> + if (wcid) {
> struct mt7615_sta *msta;
>
> - msta = container_of(status->wcid, struct mt7615_sta, wcid);
> + msta = container_of(wcid, struct mt7615_sta, wcid);
> mt76_wcid_add_poll(&dev->mt76, &msta->wcid);
> }
>
> @@ -590,7 +595,7 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb)
>
> hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
> if (hdr_trans && ieee80211_has_morefrags(fc)) {
> - if (mt7615_reverse_frag0_hdr_trans(skb, hdr_gap))
> + if (mt7615_reverse_frag0_hdr_trans(dev, skb, hdr_gap))
> return -EINVAL;
> hdr_trans = false;
> } else {
> @@ -638,7 +643,7 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb)
> status->flag |= RX_FLAG_8023;
> }
>
> - if (!status->wcid || !ieee80211_is_data_qos(fc))
> + if (!wcid || !ieee80211_is_data_qos(fc))
> return 0;
>
> status->aggr = unicast &&
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
> index 51423c7740bd..d9ae8d204442 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
> @@ -448,7 +448,8 @@ bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid,
> void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
> struct sk_buff *skb,
> __le32 *rxv, u32 mode);
> -int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif,
> +int mt76_connac2_reverse_frag0_hdr_trans(struct mt76_dev *dev,
> + struct ieee80211_vif *vif,
> struct sk_buff *skb, u16 hdr_offset);
> int mt76_connac2_mac_fill_rx_rate(struct mt76_dev *dev,
> struct mt76_rx_status *status,
> diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
> index 0339e2e7ab60..376d59d517cc 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
> @@ -952,7 +952,8 @@ void mt76_connac2_mac_decode_he_radiotap(struct mt76_dev *dev,
> EXPORT_SYMBOL_GPL(mt76_connac2_mac_decode_he_radiotap);
>
> /* The HW does not translate the mac header to 802.3 for mesh point */
> -int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif,
> +int mt76_connac2_reverse_frag0_hdr_trans(struct mt76_dev *dev,
> + struct ieee80211_vif *vif,
> struct sk_buff *skb, u16 hdr_offset)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> @@ -960,6 +961,7 @@ int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif,
> __le32 *rxd = (__le32 *)skb->data;
> struct ieee80211_sta *sta;
> struct ieee80211_hdr hdr;
> + struct mt76_wcid *wcid;
> u16 frame_control;
>
> if (le32_get_bits(rxd[3], MT_RXD3_NORMAL_ADDR_TYPE) !=
> @@ -969,7 +971,13 @@ int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif,
> if (!(le32_to_cpu(rxd[1]) & MT_RXD1_NORMAL_GROUP_4))
> return -EINVAL;
>
> - sta = container_of((void *)status->wcid, struct ieee80211_sta, drv_priv);
> + wcid = __mt76_wcid_ptr(dev, status->wcid_idx);
> + if (!wcid)
> + return -EINVAL;
> +
> + sta = container_of((void *)wcid, struct ieee80211_sta, drv_priv);
> + if (!sta)
> + return -EINVAL;
>
> /* store the info from RXD and ethhdr to avoid being overridden */
> frame_control = le32_get_bits(rxd[6], MT_RXD6_FRAME_CONTROL);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
> index cec2c4208255..30672713323f 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
> @@ -280,6 +280,7 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
> u8 mode = 0, qos_ctl = 0;
> struct mt7915_sta *msta = NULL;
> u32 csum_status = *(u32 *)skb->cb;
> + struct mt76_wcid *wcid;
> bool hdr_trans;
> u16 hdr_gap;
> u16 seq_ctrl = 0;
> @@ -313,10 +314,13 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
>
> unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
> idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
> - status->wcid = mt7915_rx_get_wcid(dev, idx, unicast);
>
> - if (status->wcid) {
> - msta = container_of(status->wcid, struct mt7915_sta, wcid);
> + wcid = mt7915_rx_get_wcid(dev, idx, unicast);
> +
> + status->wcid_idx = wcid ? wcid->idx : MT76_WCID_IDX_INVALID;
> +
> + if (wcid) {
> + msta = container_of(wcid, struct mt7915_sta, wcid);
> mt76_wcid_add_poll(&dev->mt76, &msta->wcid);
> }
>
> @@ -475,7 +479,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
>
> vif = container_of((void *)msta->vif, struct ieee80211_vif,
> drv_priv);
> - err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
> + err = mt76_connac2_reverse_frag0_hdr_trans(&dev->mt76, vif,
> + skb, hdr_gap);
> if (err)
> return err;
>
> @@ -532,7 +537,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb,
> if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
> mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
>
> - if (!status->wcid || !ieee80211_is_data_qos(fc))
> + if (status->wcid_idx == MT76_WCID_IDX_INVALID ||
> + !ieee80211_is_data_qos(fc))
> return 0;
>
> status->aggr = unicast &&
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
> index 03b4960db73f..59c64b951678 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
> @@ -184,6 +184,7 @@ mt7921_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
> u32 rxd4 = le32_to_cpu(rxd[4]);
> struct mt792x_sta *msta = NULL;
> struct mt792x_link_sta *mlink;
> + struct mt76_wcid *wcid;
> u16 seq_ctrl = 0;
> __le16 fc = 0;
> u8 mode = 0;
> @@ -211,10 +212,11 @@ mt7921_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
> chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
> unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
> idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
> - status->wcid = mt792x_rx_get_wcid(dev, idx, unicast);
> + wcid = mt792x_rx_get_wcid(dev, idx, unicast);
> + status->wcid_idx = wcid ? wcid->idx : MT76_WCID_IDX_INVALID;
>
> - if (status->wcid) {
> - mlink = container_of(status->wcid, struct mt792x_link_sta, wcid);
> + if (wcid) {
> + mlink = container_of(wcid, struct mt792x_link_sta, wcid);
> msta = container_of(mlink, struct mt792x_sta, deflink);
> mt76_wcid_add_poll(&dev->mt76, &mlink->wcid);
> }
> @@ -395,7 +397,8 @@ mt7921_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
>
> vif = container_of((void *)msta->vif, struct ieee80211_vif,
> drv_priv);
> - err = mt76_connac2_reverse_frag0_hdr_trans(vif, skb, hdr_gap);
> + err = mt76_connac2_reverse_frag0_hdr_trans(&dev->mt76, vif,
> + skb, hdr_gap);
> if (err)
> return err;
>
> @@ -433,7 +436,7 @@ mt7921_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
> if (rxv && mode >= MT_PHY_TYPE_HE_SU && !(status->flag & RX_FLAG_8023))
> mt76_connac2_mac_decode_he_radiotap(&dev->mt76, skb, rxv, mode);
>
> - if (!status->wcid || !ieee80211_is_data_qos(fc))
> + if (!wcid || !ieee80211_is_data_qos(fc))
> return 0;
>
> status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
> index c47bd812b66b..e429f78596e2 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
> @@ -166,17 +166,20 @@ void mt7925_mac_set_fixed_rate_table(struct mt792x_dev *dev,
> }
>
> /* The HW does not translate the mac header to 802.3 for mesh point */
> -static int mt7925_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
> +static int mt7925_reverse_frag0_hdr_trans(struct mt792x_dev *dev,
> + struct sk_buff *skb, u16 hdr_gap)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> struct ethhdr *eth_hdr = (struct ethhdr *)(skb->data + hdr_gap);
> - struct mt792x_sta *msta = (struct mt792x_sta *)status->wcid;
> __le32 *rxd = (__le32 *)skb->data;
> struct ieee80211_sta *sta;
> struct ieee80211_vif *vif;
> struct ieee80211_hdr hdr;
> + struct mt792x_sta *msta;
> u16 frame_control;
>
> + msta = (struct mt792x_sta *)mt76_wcid_ptr(dev, status->wcid_idx);
> +
> if (le32_get_bits(rxd[3], MT_RXD3_NORMAL_ADDR_TYPE) !=
> MT_RXD3_NORMAL_U2M)
> return -EINVAL;
> @@ -368,6 +371,7 @@ mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
> u32 rxd3 = le32_to_cpu(rxd[3]);
> u32 rxd4 = le32_to_cpu(rxd[4]);
> struct mt792x_link_sta *mlink;
> + struct mt76_wcid *wcid;
> u8 mode = 0; /* , band_idx; */
> u16 seq_ctrl = 0;
> __le16 fc = 0;
> @@ -392,10 +396,11 @@ mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
> chfreq = FIELD_GET(MT_RXD3_NORMAL_CH_FREQ, rxd3);
> unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
> idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
> - status->wcid = mt792x_rx_get_wcid(dev, idx, unicast);
> + wcid = mt792x_rx_get_wcid(dev, idx, unicast);
> + status->wcid_idx = wcid ? wcid->idx : MT76_WCID_IDX_INVALID;
>
> - if (status->wcid) {
> - mlink = container_of(status->wcid, struct mt792x_link_sta, wcid);
> + if (wcid) {
> + mlink = container_of(wcid, struct mt792x_link_sta, wcid);
> mt76_wcid_add_poll(&dev->mt76, &mlink->wcid);
> }
>
> @@ -545,7 +550,7 @@ mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
>
> hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
> if (hdr_trans && ieee80211_has_morefrags(fc)) {
> - if (mt7925_reverse_frag0_hdr_trans(skb, hdr_gap))
> + if (mt7925_reverse_frag0_hdr_trans(dev, skb, hdr_gap))
> return -EINVAL;
> hdr_trans = false;
> } else {
> @@ -608,7 +613,7 @@ mt7925_mac_fill_rx(struct mt792x_dev *dev, struct sk_buff *skb)
> }
> }
>
> - if (!status->wcid || !ieee80211_is_data_qos(fc))
> + if (!wcid || !ieee80211_is_data_qos(fc))
> return 0;
>
> status->aggr = unicast && !ieee80211_is_qos_nullfunc(fc);
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
> index e2a83da3a09c..98c30957dd76 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
> @@ -186,17 +186,19 @@ static void mt7996_mac_sta_poll(struct mt7996_dev *dev)
> }
>
> /* The HW does not translate the mac header to 802.3 for mesh point */
> -static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
> +static int mt7996_reverse_frag0_hdr_trans(struct mt7996_dev *dev,
> + struct sk_buff *skb, u16 hdr_gap)
> {
> struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
> struct ethhdr *eth_hdr = (struct ethhdr *)(skb->data + hdr_gap);
> - struct mt7996_sta_link *msta_link = (void *)status->wcid;
> - struct mt7996_sta *msta = msta_link->sta;
> + struct mt76_wcid *wcid = mt76_wcid_ptr(dev, status->wcid_idx);
> + struct mt7996_sta_link *msta_link;
> struct ieee80211_bss_conf *link_conf;
> __le32 *rxd = (__le32 *)skb->data;
> struct ieee80211_sta *sta;
> struct ieee80211_vif *vif;
> struct ieee80211_hdr hdr;
> + struct mt7996_sta *msta;
> u16 frame_control;
>
> if (le32_get_bits(rxd[3], MT_RXD3_NORMAL_ADDR_TYPE) !=
> @@ -206,10 +208,16 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
> if (!(le32_to_cpu(rxd[1]) & MT_RXD1_NORMAL_GROUP_4))
> return -EINVAL;
>
> + if (!wcid)
> + return -EINVAL;
> +
> + msta_link = container_of(wcid, struct mt7996_sta_link, wcid);
> + msta = msta_link->sta;
> +
> if (!msta || !msta->vif)
> return -EINVAL;
>
> - sta = wcid_to_sta(status->wcid);
> + sta = wcid_to_sta(wcid);
> vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
> link_conf = rcu_dereference(vif->link_conf[msta_link->wcid.link_id]);
> if (!link_conf)
> @@ -429,6 +437,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
> bool unicast, insert_ccmp_hdr = false;
> u8 remove_pad, amsdu_info, band_idx;
> u8 mode = 0, qos_ctl = 0;
> + struct mt76_wcid *wcid;
> bool hdr_trans;
> u16 hdr_gap;
> u16 seq_ctrl = 0;
> @@ -461,12 +470,14 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
>
> unicast = FIELD_GET(MT_RXD3_NORMAL_ADDR_TYPE, rxd3) == MT_RXD3_NORMAL_U2M;
> idx = FIELD_GET(MT_RXD1_NORMAL_WLAN_IDX, rxd1);
> - status->wcid = mt7996_rx_get_wcid(dev, idx, band_idx);
>
> - if (status->wcid) {
> + wcid = mt7996_rx_get_wcid(dev, idx, band_idx);
> + status->wcid_idx = wcid ? wcid->idx : MT76_WCID_IDX_INVALID;
> +
> + if (wcid) {
> struct mt7996_sta_link *msta_link;
>
> - msta_link = container_of(status->wcid, struct mt7996_sta_link,
> + msta_link = container_of(wcid, struct mt7996_sta_link,
> wcid);
> msta = msta_link->sta;
> mt76_wcid_add_poll(&dev->mt76, &msta_link->wcid);
> @@ -620,7 +631,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
>
> hdr_gap = (u8 *)rxd - skb->data + 2 * remove_pad;
> if (hdr_trans && ieee80211_has_morefrags(fc)) {
> - if (mt7996_reverse_frag0_hdr_trans(skb, hdr_gap))
> + if (mt7996_reverse_frag0_hdr_trans(dev, skb, hdr_gap))
> return -EINVAL;
> hdr_trans = false;
> } else {
> @@ -697,7 +708,7 @@ mt7996_mac_fill_rx(struct mt7996_dev *dev, enum mt76_rxq_id q,
> }
> }
>
> - if (!status->wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
> + if (!wcid || !ieee80211_is_data_qos(fc) || hw_aggr)
> return 0;
>
> status->aggr = unicast &&
> --
> 2.45.2
>
>
^ permalink raw reply
* Re: [PATCH v3 0/3] wifi: wlcore/wl18xx: firmware trust boundary hardening
From: Tristan Madani <Tristan Madani >> @ 2026-05-04 19:16 UTC (permalink / raw)
To: Peter Åstrand; +Cc: linux-wireless
In-Reply-To: <74835891-3336-f0a5-5408-07012c382866@lysator.liu.se>
Hi Peter,
Thanks for the pointer. I took a look at the TI forum thread -- the TSF
instability and kernel oops on debugfs read look like a different class
of issue from what this series addresses. These patches specifically
guard against out-of-bounds access from firmware-supplied index/length
fields (BA link_id, logger buffer size, smart config strings), so they
would not directly help with a TSF read race or firmware timing problem.
That said, the oops trace from the forum post might be worth a separate
look if it is still reproducible on a current kernel.
Thanks,
Best,
Tristan
^ permalink raw reply
* [PATCH v4 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response
From: Tristan Madani @ 2026-05-04 19:14 UTC (permalink / raw)
To: linux-wireless; +Cc: error27, kuba, johannes.berg, dcbw, linville, lkp
In-Reply-To: <20260504191452.3408257-1-tristan@talencesecurity.com>
The firmware-controlled bssdescriptsize field in lbs_ret_scan() is used
to compute the TSF descriptor position without validation against the
response buffer size. An inflated value causes out-of-bounds reads from
the 2312-byte response buffer into adjacent struct lbs_private members.
Add a check using size_add() that bssdescriptsize plus the response
header size does not exceed the total response size, avoiding integer
wrapping on 32-bit platforms.
Fixes: ff9fc791940f ("libertas: first stab at cfg80211 support")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
drivers/net/wireless/marvell/libertas/cfg.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index 41dee6e0ca9fa..8015adf37c4b0 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -13,6 +13,7 @@
#include <linux/sched.h>
#include <linux/wait.h>
#include <linux/slab.h>
+#include <linux/overflow.h>
#include <linux/ieee80211.h>
#include <net/cfg80211.h>
#include <linux/unaligned.h>
@@ -554,8 +555,8 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
- if (bsssize > le16_to_cpu(resp->size) -
- sizeof(struct cmd_ds_802_11_scan_rsp)) {
+ if (size_add(bsssize, sizeof(struct cmd_ds_802_11_scan_rsp)) >
+ le16_to_cpu(resp->size)) {
lbs_deb_scan(
"scan response: bssdescriptsize %d exceeds response\n",
bsssize);
--
2.47.3
^ permalink raw reply related
* [PATCH v4 1/2] wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path
From: Tristan Madani @ 2026-05-04 19:14 UTC (permalink / raw)
To: linux-wireless; +Cc: error27, kuba, johannes.berg, dcbw, linville, lkp
In-Reply-To: <20260504191452.3408257-1-tristan@talencesecurity.com>
lbs_process_rxed_packet() uses the firmware-supplied pkt_ptr as an
offset into the skb data without validating that it falls within the
skb buffer bounds. A malicious pkt_ptr value causes out-of-bounds
memory access when the function subsequently reads ethernet header
fields from p_rx_pkt.
Add a bounds check using size_add() to ensure pkt_ptr plus the minimum
packet header size does not exceed skb->len, without risking integer
overflow on 32-bit platforms.
Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202605030019.lL8x0ZPx-lkp@intel.com/
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
drivers/net/wireless/marvell/libertas/rx.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/wireless/marvell/libertas/rx.c b/drivers/net/wireless/marvell/libertas/rx.c
index c34d30f7cbe03..e6378be4266e1 100644
--- a/drivers/net/wireless/marvell/libertas/rx.c
+++ b/drivers/net/wireless/marvell/libertas/rx.c
@@ -9,6 +9,7 @@
#include <linux/hardirq.h>
#include <linux/slab.h>
#include <linux/types.h>
+#include <linux/overflow.h>
#include <linux/export.h>
#include <net/cfg80211.h>
@@ -73,6 +74,15 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
}
p_rx_pd = (struct rxpd *) skb->data;
+
+ if (size_add(le32_to_cpu(p_rx_pd->pkt_ptr), sizeof(struct rxpackethdr)) >
+ skb->len) {
+ lbs_deb_rx("rx err: pkt_ptr %u beyond skb len %u\n",
+ le32_to_cpu(p_rx_pd->pkt_ptr), skb->len);
+ ret = -EINVAL;
+ dev_kfree_skb(skb);
+ goto done;
+ }
p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
le32_to_cpu(p_rx_pd->pkt_ptr));
--
2.47.3
^ permalink raw reply related
* [PATCH v4 0/2] wifi: libertas: fix two OOB reads from firmware fields
From: Tristan Madani @ 2026-05-04 19:14 UTC (permalink / raw)
To: linux-wireless; +Cc: error27, kuba, johannes.berg, dcbw, linville, lkp
Two fixes for out-of-bounds reads in libertas caused by unchecked
firmware-supplied fields.
Changes since v3:
- Use size_add() instead of raw addition/subtraction in bounds checks
to avoid integer wrapping on 32-bit (Dan Carpenter / kernel test robot)
Tristan Madani (2):
wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path
wifi: libertas: fix OOB read from firmware bssdescriptsize in scan
response
drivers/net/wireless/marvell/libertas/cfg.c | 5 +++--
drivers/net/wireless/marvell/libertas/rx.c | 10 ++++++++++
2 files changed, 13 insertions(+), 2 deletions(-)
--
2.47.3
^ permalink raw reply
* Re: [PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response
From: Tristan Madani @ 2026-05-04 19:05 UTC (permalink / raw)
To: Dan Carpenter
Cc: oe-kbuild, Johannes Berg, lkp, oe-kbuild-all, libertas-dev,
linux-wireless, tristan
In-Reply-To: <afYuwVf23vKag2XA@stanley.mountain>
Hi Dan,
Good catch, thanks. I'll send a V4 with size_add() for both
the pkt_ptr and bssdescriptsize checks.
Thanks,
Tristan
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox