* Re: [PATCH] wifi: ath11k: fix warning when unbinding
From: Rameshkumar Sundaram @ 2026-05-15 2:27 UTC (permalink / raw)
To: Baochen Qiang, Jose Ignacio Tornos Martinez
Cc: ath11k, jjohnson, linux-kernel, linux-wireless, stable
In-Reply-To: <c2523379-ab12-47e1-a0d0-ef6073deaf11@oss.qualcomm.com>
On 5/14/2026 1:45 PM, Baochen Qiang wrote:
>
>
> On 5/14/2026 2:55 PM, Rameshkumar Sundaram wrote:
>> On 5/14/2026 11:48 AM, Jose Ignacio Tornos Martinez wrote:
>>> Hello Rameshkumar,
>>>
>>>> I agree that setting tx_status to NULL makes ath11k_dp_free() more
>>>> defensive, and it matches the ath12k fix.
>>> Ok, I agree too.
>>>
>>>> However, i am still wondering how the second ath11k_dp_free() is reached
>>>> if ATH11K_FLAG_QMI_FAIL is set.
>>>>
>>>> In ath11k_pci_remove(), when ATH11K_FLAG_QMI_FAIL is set, we take the
>>>> qmi_fail path and skip ath11k_core_deinit(). So the normal remove path:
>>>>
>>>> ath11k_pci_remove()
>>>> ath11k_core_deinit()
>>>> ath11k_core_soc_destroy()
>>>> ath11k_dp_free()
>>>>
>>>> should not run.
>>>>
>>>> So if the double free is still reproducible with QMI_FAIL set (with the
>>>> change i proposed), either the flag is not actually set in this failure
>>>> case, or there is another path calling ath11k_dp_free() ?
>>> Let me try to clarify the issue more.
>>> There are two error actions:
>>> - First the previous error. I reproduce the situation as I commented: running
>>> in a VM the default upstream kernel (with this card using PCI passthrough),
>>> since this is always failing. Let me show the logs in this situation:
>>> [ 15.906564] ath11k_pci 0000:07:00.0: BAR 0 [mem 0xfdc00000-0xfddfffff 64bit]: assigned
>>> [ 15.926520] ath11k_pci 0000:07:00.0: MSI vectors: 32
>>> [ 15.928572] ath11k_pci 0000:07:00.0: wcn6855 hw2.0
>>> [ 16.984192] ath11k_pci 0000:07:00.0: chip_id 0x2 chip_family 0xb board_id 0xff soc_id
>>> 0x400c0200
>>> [ 16.984351] ath11k_pci 0000:07:00.0: fw_version 0x11088c35 fw_build_timestamp
>>> 2024-04-17 08:34 fw_build_id WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
>>> [ 18.186971] ath11k_pci 0000:07:00.0: failed to receive control response completion,
>>> polling..
>>> [ 19.211036] ath11k_pci 0000:07:00.0: Service connect timeout
>>> [ 19.211815] ath11k_pci 0000:07:00.0: failed to connect to HTT: -110
>>> [ 19.214181] ath11k_pci 0000:07:00.0: failed to start core: -110
>>> [ 19.531989] ath11k_pci 0000:07:00.0: firmware crashed: MHI_CB_EE_RDDM
>>> [ 19.532930] ath11k_pci 0000:07:00.0: ignore reset dev flags 0xc000
>>> [ 29.259157] ath11k_pci 0000:07:00.0: failed to wait wlan mode request (mode 4): -110
>>> [ 29.259229] ath11k_pci 0000:07:00.0: qmi failed to send wlan mode off: -110
>>> - Second after this, I commanded the unbinded (ath11_pci) and I get the
>>> warning. Let extend here the stack trace:
>>> [ 24.238198] ? free_large_kmalloc+0x57/0x90
>>> [ 24.238199] ? report_bug+0x16b/0x180
>>> [ 24.238210] ? handle_bug+0x3c/0x70
>>> [ 24.238218] ? exc_invalid_op+0x14/0x70
>>> [ 24.238218] ? asm_exc_invalid_op+0x16/0x20
>>> [ 24.238224] ? free_large_kmalloc+0x57/0x90
>>> [ 24.238227] ath11k_dp_free+0x99/0xb0 [ath11k]
>>> [ 24.238275] ath11k_core_deinit+0x12b/0x1a0 [ath11k]
>>> [ 24.238287] ath11k_pci_remove+0x7b/0x120 [ath11k_pci]
>>> [ 24.238294] pci_device_remove+0x3e/0xb0
>>> [ 24.238304] device_release_driver_internal+0x193/0x200
>>> [ 24.238315] unbind_store+0x9d/0xb0
>>> [ 24.238320] kernfs_fop_write_iter+0x13a/0x1d0
>>> [ 24.238330] vfs_write+0x32e/0x470
>>> [ 24.238335] ksys_write+0x5f/0xe0
>>> [ 24.238336] do_syscall_64+0x5f/0xe0
>>> Very easy to reproduce.
>>>
>>
>>
>> Thanks much for the logs, that makes sense. The timestamps explain why my earlier
>> reasoning did not match the trace: unbind reaches ath11k_pci_remove() before
>> ATH11K_FLAG_QMI_FAIL is set by the QMI event worker as it is held up on wlan mode off qmi
>
> how could QMI worker set this flag? the first failure happens in
> ath12k_core_qmi_firmware_ready() and upon this failure the QMI worker just break out
> without setting any flag, no?
>
you mean ath1*1*k_core_qmi_firmware_ready() ?. Yes in ToT it breaks out
without setting any flags, so I proposed to set that on failure case
ATH11K_QMI_EVENT_FW_READY: (similar to case
ATH11K_QMI_EVENT_FW_INIT_DONE:) in this mail thread.
--
Ramesh
^ permalink raw reply
* Re: [PATCH] wifi: ath11k: clear shared SRNG pointer state on restart
From: Rameshkumar Sundaram @ 2026-05-15 2:29 UTC (permalink / raw)
To: kfarnung, Jeff Johnson, Muhammad Usama Anjum, Baochen Qiang
Cc: Jeff Johnson, linux-wireless, ath11k, linux-kernel, santiagorr,
stable
In-Reply-To: <20260513-kfarnung-ath11k-srng-clear-pointer-state-v1-1-bc700dd8b333@gmail.com>
On 5/14/2026 10:22 AM, Kyle Farnung via B4 Relay wrote:
> From: Kyle Farnung <kfarnung@gmail.com>
>
> LMAC rings reuse the shared rdp/wrp pointer buffers without going
> through the normal SRNG hw-init path that zeros non-LMAC ring
> pointers. After restart, ath11k_hal_srng_clear() can therefore hand
> stale hp/tp state from the previous firmware instance back to the new
> one.
>
> Clear the shared pointer buffers while keeping the allocations in
> place so restart still avoids reallocating SRNG DMA memory, but starts
> with fresh ring-pointer state.
>
> Fixes: 32be3ca4cf78b ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/CAOPSVF04q6uvVdq8GTRLHBrVMdpt9=o9wVcFMc6f-yhmSBcZqQ@mail.gmail.com/
> Signed-off-by: Kyle Farnung <kfarnung@gmail.com>
> ---
> This patch is the result of investigating suspend/resume failures on a
> Lenovo ThinkPad P14s Gen 5 AMD with ath11k.
>
> I originally proposed extending the existing ath11k PM quirk for this
> platform, but after discussion in [1] and bisection the issue appears to
> be a regression introduced by [2]. There is also a parallel report in [3]
> that appears consistent with the same root cause. This patch keeps the
> intended no-reallocation behavior from that change, but clears the
> preserved shared SRNG pointer state so restart begins from a clean state.
>
> Testing so far has been limited to local suspend/resume cycling on the
> affected system. The issue was originally reproduced on v7.0.4, and the
> patch was also built and tested on top of ath-current with repeated
> suspend/resume cycles on a Lenovo ThinkPad P14s Gen 5 AMD.
>
> [1] https://lore.kernel.org/all/CAOPSVF04q6uvVdq8GTRLHBrVMdpt9=o9wVcFMc6f-yhmSBcZqQ@mail.gmail.com/
> [2] 32be3ca4cf78b ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again")
> [3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132343
> ---
> drivers/net/wireless/ath/ath11k/hal.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c
> index e821e5a62c1c0..0c0aeb803018e 100644
> --- a/drivers/net/wireless/ath/ath11k/hal.c
> +++ b/drivers/net/wireless/ath/ath11k/hal.c
> @@ -1387,14 +1387,21 @@ EXPORT_SYMBOL(ath11k_hal_srng_deinit);
>
> void ath11k_hal_srng_clear(struct ath11k_base *ab)
> {
> - /* No need to memset rdp and wrp memory since each individual
> - * segment would get cleared in ath11k_hal_srng_src_hw_init()
> - * and ath11k_hal_srng_dst_hw_init().
> + /* Preserve the shared pointer buffers, but clear the previous
> + * firmware instance's hp/tp state before handing them back to FW.
> + * LMAC rings reuse this shared memory without going through the
> + * normal SRNG hw-init path that zeros non-LMAC ring pointers.
> */
> memset(ab->hal.srng_list, 0,
> sizeof(ab->hal.srng_list));
> memset(ab->hal.shadow_reg_addr, 0,
> sizeof(ab->hal.shadow_reg_addr));
> + if (ab->hal.rdp.vaddr)
> + memset(ab->hal.rdp.vaddr, 0,
> + sizeof(*ab->hal.rdp.vaddr) * HAL_SRNG_RING_ID_MAX);
> + if (ab->hal.wrp.vaddr)
> + memset(ab->hal.wrp.vaddr, 0,
> + sizeof(*ab->hal.wrp.vaddr) * HAL_SRNG_NUM_LMAC_RINGS);
> ab->hal.avail_blk_resource = 0;
> ab->hal.current_blk_index = 0;
> ab->hal.num_shadow_reg_configured = 0;
>
> ---
> base-commit: 54a5b38e4396530e5b2f12b54d3844e860ab6784
> change-id: 20260513-kfarnung-ath11k-srng-clear-pointer-state-91d8ab07e5e2
>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
^ permalink raw reply
* [PATCH ath-next] wifi: ath12k: add hardware parameters for maximum supported clients
From: Aaradhana Sahu @ 2026-05-15 3:09 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, Aaradhana Sahu
Currently, the driver uses memory profile parameters to determine the
maximum number of supported clients, with a default limit of 512 for
single-radio and 128 for DBS and DBS+SBS configurations. However,
some devices have lower hardware limits depending on the radio
configuration. Exceeding these hardware-specific limits can lead to
firmware crashes.
Add hardware parameters in ath12k_hw_params to define the maximum supported
clients for each radio configuration. The driver uses the minimum of the
memory profile limit and the hardware capability limit to prevent exceeding
hardware constraints.
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/hw.h | 25 +++++++++++++++---
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 30 ++++++++++++++++++++++
2 files changed, 52 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h
index a9888e0521a1..d135b2936378 100644
--- a/drivers/net/wireless/ath/ath12k/hw.h
+++ b/drivers/net/wireless/ath/ath12k/hw.h
@@ -19,14 +19,28 @@
#define TARGET_NUM_VDEVS(ab) ((ab)->profile_param->num_vdevs)
/* Max num of stations for Single Radio mode */
-#define TARGET_NUM_STATIONS_SINGLE(ab) ((ab)->profile_param->max_client_single)
+#define TARGET_NUM_STATIONS_SINGLE(ab) \
+({ \
+ typeof(ab) _ab = (ab); \
+ min_not_zero(_ab->hw_params->client.max_client_single, \
+ _ab->profile_param->max_client_single); \
+})
/* Max num of stations for DBS */
-#define TARGET_NUM_STATIONS_DBS(ab) ((ab)->profile_param->max_client_dbs)
+#define TARGET_NUM_STATIONS_DBS(ab) \
+({ \
+ typeof(ab) _ab = (ab); \
+ min_not_zero(_ab->hw_params->client.max_client_dbs, \
+ _ab->profile_param->max_client_dbs); \
+})
/* Max num of stations for DBS_SBS */
#define TARGET_NUM_STATIONS_DBS_SBS(ab) \
- ((ab)->profile_param->max_client_dbs_sbs)
+({ \
+ typeof(ab) _ab = (ab); \
+ min_not_zero(_ab->hw_params->client.max_client_dbs_sbs, \
+ _ab->profile_param->max_client_dbs_sbs); \
+})
#define TARGET_NUM_STATIONS(ab, x) TARGET_NUM_STATIONS_##x(ab)
@@ -213,6 +227,11 @@ struct ath12k_hw_params {
/* setup REO queue, frag etc only for primary link peer */
bool dp_primary_link_only:1;
+ struct {
+ u32 max_client_single;
+ u32 max_client_dbs;
+ u32 max_client_dbs_sbs;
+ } client;
};
struct ath12k_hw_ops {
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index cb3185850439..98bf9293dd33 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -434,6 +434,11 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.current_cc_support = false,
.dp_primary_link_only = true,
+ .client = {
+ .max_client_single = 512,
+ .max_client_dbs = 128,
+ .max_client_dbs_sbs = 128,
+ },
},
{
.name = "wcn7850 hw2.0",
@@ -520,6 +525,11 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.current_cc_support = true,
.dp_primary_link_only = false,
+ .client = {
+ .max_client_single = 512,
+ .max_client_dbs = 128,
+ .max_client_dbs_sbs = 128,
+ },
},
{
.name = "qcn9274 hw2.0",
@@ -602,6 +612,11 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.current_cc_support = false,
.dp_primary_link_only = true,
+ .client = {
+ .max_client_single = 512,
+ .max_client_dbs = 128,
+ .max_client_dbs_sbs = 128,
+ },
},
{
.name = "ipq5332 hw1.0",
@@ -677,6 +692,11 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.bdf_addr_offset = 0xC00000,
.dp_primary_link_only = true,
+ .client = {
+ .max_client_single = 256,
+ .max_client_dbs = 128,
+ .max_client_dbs_sbs = 128,
+ },
},
{
.name = "qcc2072 hw1.0",
@@ -764,6 +784,11 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.current_cc_support = true,
.dp_primary_link_only = false,
+ .client = {
+ .max_client_single = 512,
+ .max_client_dbs = 128,
+ .max_client_dbs_sbs = 128,
+ },
},
{
.name = "ipq5424 hw1.0",
@@ -843,6 +868,11 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.current_cc_support = false,
.dp_primary_link_only = true,
+ .client = {
+ .max_client_single = 512,
+ .max_client_dbs = 128,
+ .max_client_dbs_sbs = 128,
+ },
},
};
base-commit: 8b3115499abadba0f4f8408978df0c6d258fe7ea
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] wifi: ath11k: fix warning when unbinding
From: Baochen Qiang @ 2026-05-15 6:39 UTC (permalink / raw)
To: Rameshkumar Sundaram, Jose Ignacio Tornos Martinez
Cc: ath11k, jjohnson, linux-kernel, linux-wireless, stable
In-Reply-To: <fdff6264-9c35-4c77-bab2-6db9125d77af@oss.qualcomm.com>
On 5/15/2026 10:27 AM, Rameshkumar Sundaram wrote:
> On 5/14/2026 1:45 PM, Baochen Qiang wrote:
>>
>>
>> On 5/14/2026 2:55 PM, Rameshkumar Sundaram wrote:
>>> On 5/14/2026 11:48 AM, Jose Ignacio Tornos Martinez wrote:
>>>> Hello Rameshkumar,
>>>>
>>>>> I agree that setting tx_status to NULL makes ath11k_dp_free() more
>>>>> defensive, and it matches the ath12k fix.
>>>> Ok, I agree too.
>>>>
>>>>> However, i am still wondering how the second ath11k_dp_free() is reached
>>>>> if ATH11K_FLAG_QMI_FAIL is set.
>>>>>
>>>>> In ath11k_pci_remove(), when ATH11K_FLAG_QMI_FAIL is set, we take the
>>>>> qmi_fail path and skip ath11k_core_deinit(). So the normal remove path:
>>>>>
>>>>> ath11k_pci_remove()
>>>>> ath11k_core_deinit()
>>>>> ath11k_core_soc_destroy()
>>>>> ath11k_dp_free()
>>>>>
>>>>> should not run.
>>>>>
>>>>> So if the double free is still reproducible with QMI_FAIL set (with the
>>>>> change i proposed), either the flag is not actually set in this failure
>>>>> case, or there is another path calling ath11k_dp_free() ?
>>>> Let me try to clarify the issue more.
>>>> There are two error actions:
>>>> - First the previous error. I reproduce the situation as I commented: running
>>>> in a VM the default upstream kernel (with this card using PCI passthrough),
>>>> since this is always failing. Let me show the logs in this situation:
>>>> [ 15.906564] ath11k_pci 0000:07:00.0: BAR 0 [mem 0xfdc00000-0xfddfffff 64bit]: assigned
>>>> [ 15.926520] ath11k_pci 0000:07:00.0: MSI vectors: 32
>>>> [ 15.928572] ath11k_pci 0000:07:00.0: wcn6855 hw2.0
>>>> [ 16.984192] ath11k_pci 0000:07:00.0: chip_id 0x2 chip_family 0xb board_id 0xff soc_id
>>>> 0x400c0200
>>>> [ 16.984351] ath11k_pci 0000:07:00.0: fw_version 0x11088c35 fw_build_timestamp
>>>> 2024-04-17 08:34 fw_build_id WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
>>>> [ 18.186971] ath11k_pci 0000:07:00.0: failed to receive control response completion,
>>>> polling..
>>>> [ 19.211036] ath11k_pci 0000:07:00.0: Service connect timeout
>>>> [ 19.211815] ath11k_pci 0000:07:00.0: failed to connect to HTT: -110
>>>> [ 19.214181] ath11k_pci 0000:07:00.0: failed to start core: -110
>>>> [ 19.531989] ath11k_pci 0000:07:00.0: firmware crashed: MHI_CB_EE_RDDM
>>>> [ 19.532930] ath11k_pci 0000:07:00.0: ignore reset dev flags 0xc000
>>>> [ 29.259157] ath11k_pci 0000:07:00.0: failed to wait wlan mode request (mode 4): -110
>>>> [ 29.259229] ath11k_pci 0000:07:00.0: qmi failed to send wlan mode off: -110
>>>> - Second after this, I commanded the unbinded (ath11_pci) and I get the
>>>> warning. Let extend here the stack trace:
>>>> [ 24.238198] ? free_large_kmalloc+0x57/0x90
>>>> [ 24.238199] ? report_bug+0x16b/0x180
>>>> [ 24.238210] ? handle_bug+0x3c/0x70
>>>> [ 24.238218] ? exc_invalid_op+0x14/0x70
>>>> [ 24.238218] ? asm_exc_invalid_op+0x16/0x20
>>>> [ 24.238224] ? free_large_kmalloc+0x57/0x90
>>>> [ 24.238227] ath11k_dp_free+0x99/0xb0 [ath11k]
>>>> [ 24.238275] ath11k_core_deinit+0x12b/0x1a0 [ath11k]
>>>> [ 24.238287] ath11k_pci_remove+0x7b/0x120 [ath11k_pci]
>>>> [ 24.238294] pci_device_remove+0x3e/0xb0
>>>> [ 24.238304] device_release_driver_internal+0x193/0x200
>>>> [ 24.238315] unbind_store+0x9d/0xb0
>>>> [ 24.238320] kernfs_fop_write_iter+0x13a/0x1d0
>>>> [ 24.238330] vfs_write+0x32e/0x470
>>>> [ 24.238335] ksys_write+0x5f/0xe0
>>>> [ 24.238336] do_syscall_64+0x5f/0xe0
>>>> Very easy to reproduce.
>>>>
>>>
>>>
>>> Thanks much for the logs, that makes sense. The timestamps explain why my earlier
>>> reasoning did not match the trace: unbind reaches ath11k_pci_remove() before
>>> ATH11K_FLAG_QMI_FAIL is set by the QMI event worker as it is held up on wlan mode off qmi
>>
>> how could QMI worker set this flag? the first failure happens in
>> ath12k_core_qmi_firmware_ready() and upon this failure the QMI worker just break out
>> without setting any flag, no?
>>
>
>
> you mean ath1*1*k_core_qmi_firmware_ready() ?. Yes in ToT it breaks out without setting
> any flags, so I proposed to set that on failure case ATH11K_QMI_EVENT_FW_READY: (similar
> to case ATH11K_QMI_EVENT_FW_INIT_DONE:) in this mail thread.
Hmm, I mixed it with ath12k. You are right, for ATH11K_QMI_EVENT_FW_INIT_DONE, the
ATH11K_FLAG_QMI_FAIL is set upon failure.
>
>
> --
> Ramesh
^ permalink raw reply
* Re: [PATCH] wifi: ath11k: fix warning when unbinding
From: Baochen Qiang @ 2026-05-15 6:40 UTC (permalink / raw)
To: Jose Ignacio Tornos Martinez, jjohnson
Cc: linux-wireless, ath11k, linux-kernel, stable
In-Reply-To: <20260420110130.509670-1-jtornosm@redhat.com>
On 4/20/2026 7:01 PM, Jose Ignacio Tornos Martinez wrote:
> If there is an error during some initialization related to firmware,
> the buffers dp->tx_ring[i].tx_status are released.
> However this is released again when the device is unbinded (ath11k_pci),
> and we get:
> WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90
> Call Trace:
> free_large_kmalloc
> ath11k_dp_free
> ath11k_core_deinit
> ath11k_pci_remove
> ...
>
> The issue is always reproducible from a VM because the MSI addressing
> initialization is failing.
>
> In order to fix the issue, just set the buffers to NULL after releasing in
> order to avoid the double free.
>
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply
* [PATCH] wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
From: Alexandru Hossu @ 2026-05-15 10:29 UTC (permalink / raw)
To: linux-wireless
Cc: johannes, miriam.rachel.korenblit, ilan.peer, netdev,
Alexandru Hossu
IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted
from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.
sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),
making index 15 out-of-bounds.
A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response
action frame with a PER_STA_PROFILE subelement where link_id = 15. The
unsolicited-notification path (dialog_token = 0) is reachable any time
EPCS is already enabled, without any prior client request.
sdata->link[15] reads into the first word of sdata->activate_links_work
(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),
so the NULL check on the result does not catch the invalid access. The
garbage pointer is then passed to ieee80211_sta_wmm_params(), which
dereferences link->sdata and crashes the kernel.
The same class of bug was fixed for ieee80211_ml_reconfiguration() by
commit 162d331d833d ("wifi: mac80211: bounds-check link_id in
ieee80211_ml_reconfiguration").
Fixes: de86c5f60839 ("wifi: mac80211: Add support for EPCS configuration")
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
net/mac80211/mlme.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 5b02141b0cb2..0403ebd11a4d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -11214,6 +11214,9 @@ static void ieee80211_ml_epcs(struct ieee80211_sub_if_data *sdata,
control = get_unaligned_le16(pos);
link_id = control & IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID;
+ if (link_id >= IEEE80211_MLD_MAX_NUM_LINKS)
+ continue;
+
link = sdata_dereference(sdata->link[link_id], sdata);
if (!link)
continue;
--
2.50.0
^ permalink raw reply related
* [PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()
From: Alexandru Hossu @ 2026-05-15 10:42 UTC (permalink / raw)
To: security; +Cc: linux-wireless, johannes
Hi Greg,
Here is the fix.
Alexandru
---
For MLE types with a common_info length field (BASIC, PREQ, TDLS),
ieee80211_mle_size_ok() checks that variable[0] is at least as large as
the mandatory fields, but it does not check that the value fits within
the element itself.
cfg80211_defrag_mle() computes the sub-element area start as:
common_size = ieee80211_mle_common_size((u8 *)res->mle);
ie = res->data + common_size;
ielen = mle_len - common_size;
ieee80211_mle_common_size() returns sizeof(*mle) + mle->variable[0].
If variable[0] is larger than the actual element, common_size exceeds
mle_len and the size_t subtraction wraps. for_each_element_id() then
iterates over arbitrary kernel heap memory past the allocation.
Add the missing upper-bound check so variable[0] cannot exceed the
element size.
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
---
include/linux/ieee80211-eht.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h
index 87d92fb86fab..738a581c3683 100644
--- a/include/linux/ieee80211-eht.h
+++ b/include/linux/ieee80211-eht.h
@@ -908,6 +908,10 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
if (!check_common_len)
return true;
+ /* common_info length must not exceed the element */
+ if (len < fixed + mle->variable[0])
+ return false;
+
/* if present, common length is the first octet there */
return mle->variable[0] >= common;
}
^ permalink raw reply related
* Re: [PATCH v2 7/7] arm64: dts: qcom: milos-fairphone-fp6: Enable WiFi
From: Konrad Dybcio @ 2026-05-15 10:52 UTC (permalink / raw)
To: Luca Weiss, Dmitry Baryshkov, Jeff Johnson, Baochen Qiang
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Alexander Koskovich, Liam Girdwood, Mark Brown,
Bartosz Golaszewski, Marcel Holtmann, Luiz Augusto von Dentz,
Balakrishna Godavarthi, Rocky Liao, Johannes Berg, Jeff Johnson,
~postmarketos/upstreaming, phone-devel, linux-arm-msm,
linux-kernel, devicetree, linux-bluetooth, linux-wireless, ath11k
In-Reply-To: <DI9X9D3TTIRE.1CGHQI2LEZ1UL@fairphone.com>
On 5/4/26 3:21 PM, Luca Weiss wrote:
> On Mon May 4, 2026 at 3:10 PM CEST, Konrad Dybcio wrote:
>> On 5/1/26 11:20 AM, Luca Weiss wrote:
>>> Hi Konrad,
>>>
>>> On Tue Apr 7, 2026 at 3:16 PM CEST, Konrad Dybcio wrote:
>>>> On 4/3/26 9:35 PM, Dmitry Baryshkov wrote:
>>>>> On Fri, Apr 03, 2026 at 03:52:53PM +0200, Luca Weiss wrote:
>>>>>> Configure and enable the WiFi node, and add the required pinctrl to
>>>>>> provide the sleep clock from the PMK8550 (PMK7635) to WCN6755.
>>>>>>
>>>>>> Thanks to Alexander Koskovich for helping with the bringup, adding
>>>>>> the missing pinctrl to make the WPSS stop crashing.
>>>>>>
>>>>>> Link: https://lore.kernel.org/linux-arm-msm/DBF7OWAWQ94M.FSCP4DPF8ZJY@fairphone.com/
>>>>>> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
>>>>>> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
>>>>>> ---
>>>>>> arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts | 19 ++++++++++++++++++-
>>>>>> 1 file changed, 18 insertions(+), 1 deletion(-)
>>>>>>
>>>>>> diff --git a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
>>>>>> index db72418b7195..d8ac495ca7c8 100644
>>>>>> --- a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
>>>>>> +++ b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
>>>>>> @@ -242,7 +242,7 @@ wcn6750-pmu {
>>>>>>
>>>>>> clocks = <&rpmhcc RPMH_RF_CLK1>;
>>>>>>
>>>>>> - pinctrl-0 = <&bluetooth_enable_default>;
>>>>>> + pinctrl-0 = <&bluetooth_enable_default>, <&pmk8550_sleep_clk_default>;
>>>>>> pinctrl-names = "default";
>>>>>>
>>>>>> regulators {
>>>>>> @@ -766,6 +766,17 @@ &pmiv0104_eusb2_repeater {
>>>>>> qcom,tune-usb2-preem = /bits/ 8 <0x6>;
>>>>>> };
>>>>>>
>>>>>> +&pmk8550_gpios {
>>>>>> + pmk8550_sleep_clk_default: sleep-clk-default-state {
>>>>>> + pins = "gpio5";
>>>>>> + function = "func1";
>>>>>> + input-disable;
>>>>>> + output-enable;
>>>>>
>>>>> Hmm, if it's a sleep_clk, should it not be handled via the power
>>>>> sequencer?
>>>>
>>>> If you mean that it may be needed to toggle it with specific timings,
>>>> possibly.. seems that WCN6855 has a "xo-clk" GPIO defined. I requested
>>>> access to some docs that I think should have the answer, hopefully should
>>>> get it soon.
>>>
>>> Did you manage to get anything there yet?
>>
>> Yeah, sorry, it got lost in the sea of emails..
>>
>> The PDF talks about the electrical requirements of the clock signal and
>> the section titled "Power-up sequence timing" doesn't mention it at all,
>> so my assumption would be "OK so long as it's ticking before you power
>> up the WCN"
>
> Thanks for checking!
>
> Is this an R-b then?
Yes
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Konrad
^ permalink raw reply
* [PATCH wireless-next] wifi: cfg80211: add a function to parse UHR DBE
From: Miri Korenblit @ 2026-05-15 11:12 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
From: Johannes Berg <johannes.berg@intel.com>
Add a function that takes the DBE information and parses it
into an existing chandef that should hold the BSS channel.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
include/net/cfg80211.h | 10 ++
net/wireless/chan.c | 130 ++++++++++++++++++++++++++
net/wireless/tests/chan.c | 192 ++++++++++++++++++++++++++++++++++++--
3 files changed, 326 insertions(+), 6 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index ddcf559430dd..69dc9a978861 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1190,6 +1190,16 @@ int cfg80211_chandef_add_npca(struct wiphy *wiphy,
struct cfg80211_chan_def *chandef,
const struct ieee80211_uhr_npca_info *npca);
+/**
+ * cfg80211_chandef_add_dbe - parse and add DBE information to chandef
+ * @chandef: the chandef to expand
+ * @dbe: the DBE information, must be size-checked if not %NULL
+ *
+ * Returns: 0 for success, a negative error code otherwise
+ */
+int cfg80211_chandef_add_dbe(struct cfg80211_chan_def *chandef,
+ const struct ieee80211_uhr_dbe_info *dbe);
+
/**
* nl80211_send_chandef - sends the channel definition.
* @msg: the msg to send channel definition
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index ed35b55b1b67..f0811efb5d0f 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -619,6 +619,136 @@ int cfg80211_chandef_add_npca(struct wiphy *wiphy,
}
EXPORT_SYMBOL(cfg80211_chandef_add_npca);
+int cfg80211_chandef_add_dbe(struct cfg80211_chan_def *chandef,
+ const struct ieee80211_uhr_dbe_info *dbe)
+{
+ struct cfg80211_chan_def new_chandef = *chandef;
+ u16 starting_freq, bw_mhz, start_old, start_new;
+ u8 bw, punct_shift;
+ int offset, index;
+
+ if (!dbe)
+ return 0;
+
+ if (!cfg80211_chandef_valid(chandef))
+ return -EINVAL;
+
+ if (chandef->width == NL80211_CHAN_WIDTH_20_NOHT)
+ return -EINVAL;
+
+ bw = u8_get_bits(dbe->params, IEEE80211_UHR_DBE_OPER_BANDWIDTH);
+
+ switch (chandef->chan->band) {
+ case NL80211_BAND_5GHZ:
+ if (bw > IEEE80211_UHR_DBE_OPER_BW_160)
+ return -EINVAL;
+ if (chandef->chan->center_freq < 5745)
+ starting_freq = 5180; /* channel 36 */
+ else
+ starting_freq = 5745; /* channel 149 */
+ break;
+ case NL80211_BAND_6GHZ:
+ starting_freq = 5955; /* channel 1 center */
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ switch (bw) {
+ case IEEE80211_UHR_DBE_OPER_BW_320_2:
+ case IEEE80211_UHR_DBE_OPER_BW_320_1:
+ if (chandef->width == NL80211_CHAN_WIDTH_160)
+ break;
+ fallthrough;
+ case IEEE80211_UHR_DBE_OPER_BW_160:
+ if (chandef->width == NL80211_CHAN_WIDTH_80)
+ break;
+ fallthrough;
+ case IEEE80211_UHR_DBE_OPER_BW_80:
+ if (chandef->width == NL80211_CHAN_WIDTH_40)
+ break;
+ fallthrough;
+ case IEEE80211_UHR_DBE_OPER_BW_40:
+ if (chandef->width == NL80211_CHAN_WIDTH_20)
+ break;
+ fallthrough;
+ default:
+ return -EINVAL;
+ }
+
+ switch (bw) {
+ case IEEE80211_UHR_DBE_OPER_BW_320_2:
+ /* 320-2 starts shifted by 160 */
+ starting_freq += 160;
+ fallthrough;
+ case IEEE80211_UHR_DBE_OPER_BW_320_1:
+ new_chandef.width = NL80211_CHAN_WIDTH_320;
+ bw_mhz = 320;
+ break;
+ case IEEE80211_UHR_DBE_OPER_BW_160:
+ new_chandef.width = NL80211_CHAN_WIDTH_160;
+ bw_mhz = 160;
+ break;
+ case IEEE80211_UHR_DBE_OPER_BW_80:
+ new_chandef.width = NL80211_CHAN_WIDTH_80;
+ bw_mhz = 80;
+ break;
+ case IEEE80211_UHR_DBE_OPER_BW_40:
+ new_chandef.width = NL80211_CHAN_WIDTH_40;
+ bw_mhz = 40;
+ break;
+ }
+
+ /* this should only happen for 320-2 and misconfigured AP */
+ if (chandef->chan->center_freq < starting_freq)
+ return -EINVAL;
+
+ offset = chandef->chan->center_freq - starting_freq;
+ index = offset / bw_mhz;
+ start_new = starting_freq - 10 + index * bw_mhz;
+ new_chandef.center_freq1 = start_new + bw_mhz / 2;
+
+ start_old = chandef->center_freq1 -
+ cfg80211_chandef_get_width(chandef) / 2;
+
+ /*
+ * If the DBE channel extends downward below the lower
+ * edge of the BSS channel, we need to shift puncturing
+ * bitmaps up to adjust for that.
+ */
+ if (start_new < start_old)
+ punct_shift = (start_old - start_new) / 20;
+ else
+ punct_shift = 0;
+
+ new_chandef.punctured <<= punct_shift;
+ new_chandef.npca_punctured <<= punct_shift;
+
+ if (dbe->params & IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES) {
+ u16 punct_mask = ((1 << (bw_mhz / 40)) - 1) << punct_shift;
+ u16 punctured = le16_to_cpu(dbe->dis_subch_bmap[0]);
+
+ if ((punctured & punct_mask) != (new_chandef.punctured & punct_mask))
+ return -EINVAL;
+
+ new_chandef.punctured = punctured;
+ }
+
+ if (!cfg80211_chandef_valid(&new_chandef))
+ return -EINVAL;
+
+ /*
+ * If e.g. a 40 MHz BSS channel (erroneously) occupies the center of the
+ * DBE 80 MHz channel, they would be incompatible; check and reject.
+ */
+ if (!cfg80211_chandef_compatible(&new_chandef, chandef))
+ return -EINVAL;
+
+ *chandef = new_chandef;
+ return 0;
+}
+EXPORT_SYMBOL(cfg80211_chandef_add_dbe);
+
static const struct cfg80211_chan_def *
check_chandef_primary_compat(const struct cfg80211_chan_def *c1,
const struct cfg80211_chan_def *c2,
diff --git a/net/wireless/tests/chan.c b/net/wireless/tests/chan.c
index 7b97b731993c..65eb18c498de 100644
--- a/net/wireless/tests/chan.c
+++ b/net/wireless/tests/chan.c
@@ -2,13 +2,18 @@
/*
* KUnit tests for channel helper functions
*
- * Copyright (C) 2023-2024 Intel Corporation
+ * Copyright (C) 2023-2024, 2026 Intel Corporation
*/
#include <net/cfg80211.h>
#include <kunit/test.h>
MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+static struct ieee80211_channel chan_2ghz_1 = {
+ .band = NL80211_BAND_2GHZ,
+ .center_freq = 2412,
+};
+
static struct ieee80211_channel chan_6ghz_1 = {
.band = NL80211_BAND_6GHZ,
.center_freq = 5955,
@@ -215,14 +220,189 @@ static void test_chandef_compat(struct kunit *test)
KUNIT_EXPECT_PTR_EQ(test, ret, expect);
}
-static struct kunit_case chandef_compat_test_cases[] = {
+static const struct chandef_dbe_case {
+ const char *desc;
+ struct cfg80211_chan_def c;
+ u8 dbe[3];
+ bool fails;
+ u16 cf1;
+} chandef_dbe_cases[] = {
+ {
+ .desc = "non-HT failure",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_20_NOHT,
+ .chan = &chan_6ghz_1,
+ .center_freq1 = 5955,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_40,
+ .fails = true,
+ },
+ {
+ .desc = "2.4 GHz fails",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_20,
+ .chan = &chan_2ghz_1,
+ .center_freq1 = 2412,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_40,
+ .fails = true,
+ },
+ {
+ .desc = "DBE narrower",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_320,
+ .chan = &chan_6ghz_1,
+ .center_freq1 = 5955 + 10 + 20 + 40 + 80,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_160,
+ .fails = true,
+ },
+ {
+ .desc = "DBE to 320-1",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_1,
+ .cf1 = 6425,
+ },
+ {
+ .desc = "DBE to 320-2",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_2,
+ .cf1 = 6585,
+ },
+ {
+ .desc = "bad disabled subchannel bitmap - not enough in BSS (1)",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0001,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_1 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0 */
+ .fails = true,
+ },
+ {
+ .desc = "bad disabled subchannel bitmap - too much in BSS (1)",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0001,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_1 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0x0300 */
+ .dbe[2] = 0x03,
+ .fails = true,
+ },
+ {
+ .desc = "bad disabled subchannel bitmap - not enough in BSS (2)",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0001,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_2 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0 */
+ .fails = true,
+ },
+ {
+ .desc = "bad disabled subchannel bitmap - too much in BSS (2)",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0001,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_2 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0x03 */
+ .dbe[1] = 0x03,
+ .fails = true,
+ },
+ {
+ .desc = "bad disabled subchannel bitmap - bad bitmap",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0001,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_1 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0x1100 */
+ .dbe[2] = 0x11,
+ .fails = true,
+ },
+ {
+ .desc = "good disabled subchannel bitmap (1)",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0003,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_1 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0x0300 */
+ .dbe[2] = 0x03,
+ .cf1 = 6425,
+ },
+ {
+ .desc = "good disabled subchannel bitmap (2)",
+ .c = {
+ .width = NL80211_CHAN_WIDTH_160,
+ .chan = &chan_6ghz_105,
+ .center_freq1 = 6475 + 30,
+ .punctured = 0x0003,
+ },
+ .dbe[0] = IEEE80211_UHR_DBE_OPER_BW_320_2 |
+ IEEE80211_UHR_DBE_OPER_DIS_SUBCHANNEL_BITMAP_PRES,
+ /* DBE disabled subchannel bitmap == 0x0003 */
+ .dbe[1] = 0x03,
+ .cf1 = 6585,
+ },
+};
+
+KUNIT_ARRAY_PARAM_DESC(chandef_dbe, chandef_dbe_cases, desc)
+
+static void test_chandef_dbe(struct kunit *test)
+{
+ const struct chandef_dbe_case *params = test->param_value;
+ struct cfg80211_chan_def c = params->c;
+ int ret;
+
+ KUNIT_EXPECT_EQ(test, cfg80211_chandef_valid(¶ms->c), true);
+
+ ret = cfg80211_chandef_add_dbe(&c, (void *)params->dbe);
+ KUNIT_EXPECT_EQ(test, ret != 0, params->fails);
+
+ if (params->fails)
+ return;
+
+ KUNIT_EXPECT_EQ(test, c.center_freq1, params->cf1);
+}
+
+static struct kunit_case chandef_test_cases[] = {
KUNIT_CASE_PARAM(test_chandef_compat, chandef_compat_gen_params),
+ KUNIT_CASE_PARAM(test_chandef_dbe, chandef_dbe_gen_params),
{}
};
-static struct kunit_suite chandef_compat = {
- .name = "cfg80211-chandef-compat",
- .test_cases = chandef_compat_test_cases,
+static struct kunit_suite chandef = {
+ .name = "cfg80211-chandef",
+ .test_cases = chandef_test_cases,
};
-kunit_test_suite(chandef_compat);
+kunit_test_suite(chandef);
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next] wifi: mac80211_hwsim: Do not declare NAN support for Extended Key ID
From: Miri Korenblit @ 2026-05-15 11:15 UTC (permalink / raw)
To: linux-wireless; +Cc: Ilan Peer
From: Ilan Peer <ilan.peer@intel.com>
Do not declare support for Extended Key ID for NAN, as defined in
section 7.4 in the WiFi Aware specification v4.0 (in order to support
security association upgrade).
Fixes: eaa7ce66c3e2 ("wifi: mac80211_hwsim: Fix possible NULL dereference")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index dc9775cd9f54..d23b50b1ce86 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -5714,8 +5714,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
hw->wiphy->nan_capa.n_antennas = 0x22;
hw->wiphy->nan_capa.max_channel_switch_time = 0;
- hw->wiphy->nan_capa.dev_capabilities =
- NAN_DEV_CAPA_EXT_KEY_ID_SUPPORTED;
wiphy_ext_feature_set(hw->wiphy,
NL80211_EXT_FEATURE_SECURE_NAN);
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-next] wifi: mac80211: allow cipher change on NAN_DATA interfaces
From: Miri Korenblit @ 2026-05-15 11:28 UTC (permalink / raw)
To: linux-wireless; +Cc: Daniel Gabay, Ilan Peer, Johannes Berg
From: Daniel Gabay <daniel.gabay@intel.com>
ieee80211_key_link() rejects pairwise key installation when the
cipher differs from the existing PTK. Per Wi-Fi Aware version 4.0
section 7.4, the ND-TKSA between the same NDI pair shall be updated
when a new NDP requires a stronger cipher suite.
Exempt NL80211_IFTYPE_NAN_DATA from the same-cipher enforcement so
the PTK can be replaced with a different cipher.
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
net/mac80211/key.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 4b8965633df3..11c666bbbdb2 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -867,11 +867,16 @@ int ieee80211_key_link(struct ieee80211_key *key,
alt_key = wiphy_dereference(sdata->local->hw.wiphy,
sta->ptk[idx ^ 1]);
- /* The rekey code assumes that the old and new key are using
+ /*
+ * The rekey code assumes that the old and new key are using
* the same cipher. Enforce the assumption for pairwise keys.
+ * NAN Data interfaces are exempt: Wi-Fi Aware v4.0 section 7.4
+ * requires upgrading the ND-TKSA when a new NDP negotiates a
+ * stronger cipher suite.
*/
- if ((alt_key && alt_key->conf.cipher != key->conf.cipher) ||
- (old_key && old_key->conf.cipher != key->conf.cipher)) {
+ if (sdata->vif.type != NL80211_IFTYPE_NAN_DATA &&
+ ((alt_key && alt_key->conf.cipher != key->conf.cipher) ||
+ (old_key && old_key->conf.cipher != key->conf.cipher))) {
ret = -EOPNOTSUPP;
goto out;
}
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok()
From: Greg KH @ 2026-05-15 11:36 UTC (permalink / raw)
To: Alexandru Hossu; +Cc: security, linux-wireless, johannes
In-Reply-To: <6a06f87c.643c4978.1f1059.84ae@mx.google.com>
On Fri, May 15, 2026 at 03:42:04AM -0700, Alexandru Hossu wrote:
> Hi Greg,
>
> Here is the fix.
Context matters :)
Also, this isn't in a mergable format, please take a look at the kernel
documentation for how to do this properly.
thanks,
greg k-h
^ permalink raw reply
* [PATCH v2 iwlwifi-next 00/15] wifi: iwlwifi: updates - 2026-05-14
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless
Sending again after fixing a commit message and rebasing
Avraham Stern (2):
wifi: iwlwifi: mld: nan: add availability attribute to schedule config
wifi: iwlwifi: mld: add support for deferred nan schedule config
Daniel Gabay (1):
wifi: iwlwifi: print UHR rate type
Emmanuel Grumbach (1):
wifi: iwlwifi: reduce the log level of firmware debug buffer size
mismatch
Ilan Peer (1):
wifi: iwlwifi: mld: Disallow using a per-STA GTK for Tx
Johannes Berg (7):
wifi: iwlwifi: mld: add UHR DUO support
wifi: iwlwifi: mld: implement UHR multi-link PM
wifi: iwlwifi: mld: rename LINK_DEBUGFS_WRITE_FILE_OPS
wifi: iwlwifi: mld: add link and link station FW IDs to debugfs
wifi: iwlwifi: api: remove NAN_GROUP
wifi: iwlwifi: api: clean up/fix some kernel-doc references
wifi: iwlwifi: pcie: add two LNL PCI IDs
Miri Korenblit (1):
wifi: iwlwifi: mld: evacuate NAN channels on link switch
Pagadala Yesu Anjaneyulu (1):
wifi: iwlwifi: mld: disallow puncturing in US/CA for WH
Shahar Tzarfati (1):
wifi: iwlwifi: mld: expose beacon avg signal
.../wireless/intel/iwlwifi/fw/api/commands.h | 9 +-
.../wireless/intel/iwlwifi/fw/api/location.h | 7 +-
.../wireless/intel/iwlwifi/fw/api/mac-cfg.h | 33 +++++++
drivers/net/wireless/intel/iwlwifi/fw/rs.c | 5 +-
.../wireless/intel/iwlwifi/iwl-nvm-parse.c | 1 +
.../net/wireless/intel/iwlwifi/mld/debugfs.c | 53 +++++++++-
drivers/net/wireless/intel/iwlwifi/mld/key.c | 6 ++
drivers/net/wireless/intel/iwlwifi/mld/link.c | 10 ++
drivers/net/wireless/intel/iwlwifi/mld/link.h | 3 +
.../net/wireless/intel/iwlwifi/mld/mac80211.c | 97 ++++++++++++++++++-
drivers/net/wireless/intel/iwlwifi/mld/mcc.c | 13 ++-
drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 +
drivers/net/wireless/intel/iwlwifi/mld/nan.c | 60 ++++++++++++
drivers/net/wireless/intel/iwlwifi/mld/nan.h | 5 +
.../net/wireless/intel/iwlwifi/mld/notif.c | 4 +
.../net/wireless/intel/iwlwifi/mld/stats.c | 47 ++++++++-
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 +
.../intel/iwlwifi/pcie/gen1_2/trans.c | 8 +-
18 files changed, 344 insertions(+), 20 deletions(-)
--
2.34.1
^ permalink raw reply
* [PATCH v2 iwlwifi-next 01/15] wifi: iwlwifi: mld: nan: add availability attribute to schedule config
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Avraham Stern
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Avraham Stern <avraham.stern@intel.com>
Add the availability attribute to the schedule config command. The
firmware needs to add this attribute to schedule update frames
(e.g. when ULW changed or the local schedule changed).
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/nan.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c
index 530ba263c5f0..d13b2374b642 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c
@@ -693,6 +693,14 @@ void iwl_mld_nan_vif_cfg_changed(struct iwl_mld *mld,
break;
case 2:
cmd_size = sizeof(struct iwl_nan_schedule_cmd);
+
+ if (sched_cfg->avail_blob_len &&
+ !WARN_ON(sched_cfg->avail_blob_len >
+ sizeof(cmd.avail_attr.attr))) {
+ cmd.avail_attr.attr_len = sched_cfg->avail_blob_len;
+ memcpy(cmd.avail_attr.attr, sched_cfg->avail_blob,
+ sched_cfg->avail_blob_len);
+ }
break;
default:
IWL_ERR(mld, "NAN: unsupported NAN schedule cmd version %d\n",
@@ -727,6 +735,15 @@ void iwl_mld_nan_vif_cfg_changed(struct iwl_mld *mld,
BUILD_BUG_ON(ARRAY_SIZE(sched_cfg->channels) !=
ARRAY_SIZE(cmd.channels));
+ /*
+ * mac80211 removes unused channels before adding new ones, so it may
+ * update an empty schedule with an availability attribute because it
+ * is going to add channels later. Since the firmware does not expect
+ * an availability attribute without channels, ignore it in that case.
+ */
+ if (empty_schedule)
+ cmd.avail_attr.attr_len = 0;
+
/* find links we can keep (same chanctx/PHY) */
for (i = 0; i < ARRAY_SIZE(sched_cfg->channels); i++) {
struct ieee80211_chanctx_conf *chanctx;
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 02/15] wifi: iwlwifi: mld: add support for deferred nan schedule config
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Avraham Stern
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Avraham Stern <avraham.stern@intel.com>
Add support for deferred schedule update. Notify mac80211 that the
schedule update is done when the firmware notifies that the schedule
is applied.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
.../wireless/intel/iwlwifi/fw/api/mac-cfg.h | 29 +++++++++++++
drivers/net/wireless/intel/iwlwifi/mld/mld.c | 1 +
drivers/net/wireless/intel/iwlwifi/mld/nan.c | 43 +++++++++++++++++++
drivers/net/wireless/intel/iwlwifi/mld/nan.h | 5 +++
.../net/wireless/intel/iwlwifi/mld/notif.c | 4 ++
5 files changed, 82 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
index d03a2bda4e68..09f869b5be0c 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
@@ -84,6 +84,11 @@ enum iwl_mac_conf_subcmd_ids {
* @NAN_ULW_ATTR_NOTIF: &struct iwl_nan_ulw_attr_notif
*/
NAN_ULW_ATTR_NOTIF = 0xf2,
+ /**
+ * @NAN_SCHED_UPDATE_COMPLETED_NOTIF:
+ * &struct iwl_nan_sched_update_completed_notif
+ */
+ NAN_SCHED_UPDATE_COMPLETED_NOTIF = 0xf3,
/**
* @NAN_DW_END_NOTIF: &struct iwl_nan_dw_end_notif
*/
@@ -1421,4 +1426,28 @@ struct iwl_nan_ulw_attr_notif {
u8 attr[IWL_NAN_MAX_ENDLESS_ULW_ATTR_LEN];
} __packed; /* NAN_ULW_ATTR_NOTIF_API_S_VER_1 */
+/**
+ * enum iwl_nan_sched_update_status - NAN schedule update status
+ *
+ * @IWL_NAN_SCHED_UPDATE_SUCCESS: schedule update completed successfully
+ * @IWL_NAN_SCHED_UPDATE_FAILURE: schedule update failed. Currently not expected
+ * to happen, but reserved for future use.
+ */
+enum iwl_nan_sched_update_status {
+ IWL_NAN_SCHED_UPDATE_SUCCESS = 0,
+ IWL_NAN_SCHED_UPDATE_FAILURE = 1,
+};
+
+/**
+ * struct iwl_nan_sched_update_completed_notif - NAN schedule update completed
+ *
+ * @status: status of the schedule update operation. See
+ * &enum iwl_nan_sched_update_status
+ * @reserved: reserved
+ */
+struct iwl_nan_sched_update_completed_notif {
+ u8 status;
+ u8 reserved[3];
+} __packed; /* NAN_SCHED_UPDATE_COMPLETED_NTF_API_S_VER_1 */
+
#endif /* __iwl_fw_api_mac_cfg_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mld.c b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
index 054bb1134425..0ef7c24831d8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mld.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
@@ -238,6 +238,7 @@ static const struct iwl_hcmd_names iwl_mld_mac_conf_names[] = {
HCMD_NAME(NAN_SCHEDULE_CMD),
HCMD_NAME(NAN_PEER_CMD),
HCMD_NAME(NAN_ULW_ATTR_NOTIF),
+ HCMD_NAME(NAN_SCHED_UPDATE_COMPLETED_NOTIF),
HCMD_NAME(NAN_DW_END_NOTIF),
HCMD_NAME(NAN_JOINED_CLUSTER_NOTIF),
HCMD_NAME(MISSED_BEACONS_NOTIF),
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c
index d13b2374b642..d34a9a2cbeae 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c
@@ -689,11 +689,20 @@ void iwl_mld_nan_vif_cfg_changed(struct iwl_mld *mld,
switch (version) {
case 1:
+ if (sched_cfg->deferred) {
+ IWL_ERR(mld,
+ "NAN: deferred schedule not supported by FW\n");
+ return;
+ }
+
cmd_size = sizeof(struct iwl_nan_schedule_cmd_v1);
break;
case 2:
cmd_size = sizeof(struct iwl_nan_schedule_cmd);
+ if (sched_cfg->deferred)
+ cmd.deferred = 1;
+
if (sched_cfg->avail_blob_len &&
!WARN_ON(sched_cfg->avail_blob_len >
sizeof(cmd.avail_attr.attr))) {
@@ -869,6 +878,40 @@ void iwl_mld_nan_vif_cfg_changed(struct iwl_mld *mld,
}
}
+bool iwl_mld_cancel_nan_sched_update_completed_notif(struct iwl_mld *mld,
+ struct iwl_rx_packet *pkt,
+ u32 obj_id)
+{
+ return true;
+}
+
+void iwl_mld_handle_nan_sched_update_completed_notif(struct iwl_mld *mld,
+ struct iwl_rx_packet *pkt)
+{
+ struct iwl_nan_sched_update_completed_notif *notif = (void *)pkt->data;
+ struct ieee80211_vif *vif = mld->nan_device_vif;
+
+ if (IWL_FW_CHECK(mld, !vif,
+ "NAN: schedule update completed without NAN vif\n"))
+ return;
+
+ if (IWL_FW_CHECK(mld, !ieee80211_vif_nan_started(vif),
+ "NAN: schedule update completed without NAN started\n"))
+ return;
+
+ /*
+ * Deferred schedule update should not fail in firmware since all
+ * channels and links were added.
+ */
+ IWL_FW_CHECK(mld, notif->status != IWL_NAN_SCHED_UPDATE_SUCCESS,
+ "NAN: deferred schedule update failed\n");
+
+ if (WARN_ON(!vif->cfg.nan_sched.deferred))
+ return;
+
+ ieee80211_nan_sched_update_done(vif);
+}
+
int iwl_mld_mac802111_nan_peer_sched_changed(struct ieee80211_hw *hw,
struct ieee80211_sta *sta)
{
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.h b/drivers/net/wireless/intel/iwlwifi/mld/nan.h
index f4e4cd4b4e8d..5411bca52cde 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/nan.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.h
@@ -42,6 +42,8 @@ void iwl_mld_handle_nan_ulw_attr_notif(struct iwl_mld *mld,
struct iwl_rx_packet *pkt);
void iwl_mld_handle_nan_dw_end_notif(struct iwl_mld *mld,
struct iwl_rx_packet *pkt);
+void iwl_mld_handle_nan_sched_update_completed_notif(struct iwl_mld *mld,
+ struct iwl_rx_packet *pkt);
bool iwl_mld_cancel_nan_cluster_notif(struct iwl_mld *mld,
struct iwl_rx_packet *pkt,
u32 obj_id);
@@ -51,6 +53,9 @@ bool iwl_mld_cancel_nan_ulw_attr_notif(struct iwl_mld *mld,
bool iwl_mld_cancel_nan_dw_end_notif(struct iwl_mld *mld,
struct iwl_rx_packet *pkt,
u32 obj_id);
+bool iwl_mld_cancel_nan_sched_update_completed_notif(struct iwl_mld *mld,
+ struct iwl_rx_packet *pkt,
+ u32 obj_id);
void iwl_mld_nan_vif_cfg_changed(struct iwl_mld *mld,
struct ieee80211_vif *vif,
u64 changes);
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/notif.c b/drivers/net/wireless/intel/iwlwifi/mld/notif.c
index a5074bbc7e24..d7383022a0ed 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/notif.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/notif.c
@@ -348,6 +348,8 @@ CMD_VERSIONS(beacon_filter_notif, CMD_VER_ENTRY(2, iwl_beacon_filter_notif))
CMD_VERSIONS(nan_cluster_notif, CMD_VER_ENTRY(1, iwl_nan_cluster_notif))
CMD_VERSIONS(nan_ulw_attr_notif, CMD_VER_ENTRY(1, iwl_nan_ulw_attr_notif))
CMD_VERSIONS(nan_dw_end_notif, CMD_VER_ENTRY(1, iwl_nan_dw_end_notif))
+CMD_VERSIONS(nan_sched_update_completed_notif,
+ CMD_VER_ENTRY(1, iwl_nan_sched_update_completed_notif))
DEFINE_SIMPLE_CANCELLATION(session_prot, iwl_session_prot_notif, mac_link_id)
DEFINE_SIMPLE_CANCELLATION(tlc, iwl_tlc_update_notif, sta_id)
@@ -468,6 +470,8 @@ const struct iwl_rx_handler iwl_mld_rx_handlers[] = {
nan_ulw_attr_notif)
RX_HANDLER_OF_NAN(MAC_CONF_GROUP, NAN_DW_END_NOTIF,
nan_dw_end_notif)
+ RX_HANDLER_OF_NAN(MAC_CONF_GROUP, NAN_SCHED_UPDATE_COMPLETED_NOTIF,
+ nan_sched_update_completed_notif)
};
EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mld_rx_handlers);
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 03/15] wifi: iwlwifi: mld: add UHR DUO support
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg, Emmanuel Grumbach
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
The firmware needs to know whether or not DUO (assisting) is
supported by the AP, and we should claim DUO support ourselves.
Implement this.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h | 2 ++
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 1 +
drivers/net/wireless/intel/iwlwifi/mld/link.c | 5 +++++
3 files changed, 8 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
index 09f869b5be0c..dd69687a4e48 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
@@ -556,6 +556,7 @@ enum iwl_link_ctx_protection_flags {
* of threshold
* @LINK_FLG_NPCA: NPCA enabled
* @LINK_FLG_DPS: AP is a DPS assisting AP
+ * @LINK_FLG_DUO: AP supports UHR DUO
*/
enum iwl_link_ctx_flags {
LINK_FLG_BSS_COLOR_DIS = BIT(0),
@@ -564,6 +565,7 @@ enum iwl_link_ctx_flags {
LINK_FLG_NDP_FEEDBACK_ENABLED = BIT(3),
LINK_FLG_NPCA = BIT(4),
LINK_FLG_DPS = BIT(6),
+ LINK_FLG_DUO = BIT(8),
}; /* LINK_CONTEXT_FLAG_E_VER_1 */
/**
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index f29de029c709..7027bca249a0 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -698,6 +698,7 @@ static const struct ieee80211_sband_iftype_data iwl_iftype_cap[] = {
.mac.mac_cap = {
[0] = IEEE80211_UHR_MAC_CAP0_NPCA_SUPP |
IEEE80211_UHR_MAC_CAP0_DPS_SUPP,
+ [1] = IEEE80211_UHR_MAC_CAP1_DUO_SUPP,
},
},
},
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
index 3c1825ba2b86..4ac2740dd8a1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
@@ -347,6 +347,11 @@ iwl_mld_change_link_in_fw(struct iwl_mld *mld, struct ieee80211_bss_conf *link,
link_sta->uhr_cap.mac.mac_cap[0] &
IEEE80211_UHR_MAC_CAP0_DPS_ASSIST_SUPP)
flags |= LINK_FLG_DPS;
+
+ if (link_sta->uhr_cap.has_uhr &&
+ link_sta->uhr_cap.mac.mac_cap[1] &
+ IEEE80211_UHR_MAC_CAP1_DUO_SUPP)
+ flags |= LINK_FLG_DUO;
}
cmd.htc_trig_based_pkt_ext = link->htc_trig_based_pkt_ext;
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 04/15] wifi: iwlwifi: mld: implement UHR multi-link PM
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg, Emmanuel Grumbach
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
For multi-link power management, the driver really only needs
to advertise the capability and tell the firmware that the AP
has it. Implement this.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h | 2 ++
drivers/net/wireless/intel/iwlwifi/mld/link.c | 5 +++++
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 2 ++
3 files changed, 9 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
index dd69687a4e48..09b2cddc4ad2 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac-cfg.h
@@ -556,6 +556,7 @@ enum iwl_link_ctx_protection_flags {
* of threshold
* @LINK_FLG_NPCA: NPCA enabled
* @LINK_FLG_DPS: AP is a DPS assisting AP
+ * @LINK_FLG_MLPM: AP supports UHR multi-link PM
* @LINK_FLG_DUO: AP supports UHR DUO
*/
enum iwl_link_ctx_flags {
@@ -565,6 +566,7 @@ enum iwl_link_ctx_flags {
LINK_FLG_NDP_FEEDBACK_ENABLED = BIT(3),
LINK_FLG_NPCA = BIT(4),
LINK_FLG_DPS = BIT(6),
+ LINK_FLG_MLPM = BIT(7),
LINK_FLG_DUO = BIT(8),
}; /* LINK_CONTEXT_FLAG_E_VER_1 */
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
index 4ac2740dd8a1..e5e9b7089c14 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
@@ -352,6 +352,11 @@ iwl_mld_change_link_in_fw(struct iwl_mld *mld, struct ieee80211_bss_conf *link,
link_sta->uhr_cap.mac.mac_cap[1] &
IEEE80211_UHR_MAC_CAP1_DUO_SUPP)
flags |= LINK_FLG_DUO;
+
+ if (link_sta->uhr_cap.has_uhr &&
+ mld_vif->ap_sta->ext_mld_capa_ops &
+ IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM)
+ flags |= LINK_FLG_MLPM;
}
cmd.htc_trig_based_pkt_ext = link->htc_trig_based_pkt_ext;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 9736b43155d6..9dc540720ecd 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -420,6 +420,8 @@ static void iwl_mac_hw_set_wiphy(struct iwl_mld *mld)
mld->ext_capab[0].eml_capabilities = IWL_MLD_EMLSR_CAPA;
mld->ext_capab[0].mld_capa_and_ops = IWL_MLD_CAPA_OPS;
+ mld->ext_capab[0].ext_mld_capa_and_ops =
+ IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM;
}
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 05/15] wifi: iwlwifi: mld: evacuate NAN channels on link switch
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
The FW API doesn't allow a station (of certain types, including
STATION_TYPE_PEER) to not be correlated to any link. Therefore,
when switching links, mac80211 first adds the new link and then
removes the old one.
In case we have a NAN interface that operates on 3 links and a
BSS interface that operates on the 4th link, there won't be any
room to perform a link switch that temporarily needs two links
for the BSS interface, but the firmware only has four total.
To mitigate this, try to evacuate a NAN channel in this scenario:
First try to evacuate a NAN channel using the same phy as the BSS
link being deactivated, since we expect NAN to follow the BSS
channel configuration. If that doesn't work, try to evacuate any
NAN channel.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
.../net/wireless/intel/iwlwifi/mld/mac80211.c | 95 ++++++++++++++++++-
1 file changed, 94 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 9dc540720ecd..92858b8f7395 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -2585,15 +2585,108 @@ iwl_mld_mac80211_mgd_protect_tdls_discover(struct ieee80211_hw *hw,
ret);
}
+static int iwl_mld_count_free_link_ids(struct iwl_mld *mld)
+{
+ int free_count = 0;
+
+ for (int i = 0; i < mld->fw->ucode_capa.num_links; i++) {
+ if (!rcu_access_pointer(mld->fw_id_to_bss_conf[i]))
+ free_count++;
+ }
+
+ return free_count;
+}
+
+static bool
+iwl_mld_chanctx_used_by_other_vif(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+ struct ieee80211_chanctx_conf *chanctx_conf)
+{
+ struct ieee80211_bss_conf *iter_link;
+ struct ieee80211_vif *iter_vif;
+ int link_id;
+
+ for_each_active_interface(iter_vif, hw) {
+ if (vif == iter_vif)
+ continue;
+
+ /* NAN doesn't have active links, so we don't count NAN users */
+ for_each_vif_active_link(iter_vif, iter_link, link_id) {
+ if (rcu_access_pointer(iter_link->chanctx_conf) ==
+ chanctx_conf)
+ return true;
+ }
+ }
+
+ return false;
+}
+
static bool iwl_mld_can_activate_links(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
u16 desired_links)
{
struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw);
int n_links = hweight16(desired_links);
+ int n_add = hweight16(desired_links & ~vif->active_links);
+ unsigned long to_deactivate = vif->active_links & ~desired_links;
+ int free_link_ids;
+ int i;
/* Check if HW supports the wanted number of links */
- return n_links <= iwl_mld_max_active_links(mld, vif);
+ if (n_links > iwl_mld_max_active_links(mld, vif))
+ return false;
+
+ /*
+ * During link switch, mac80211 first adds the new links, then removes
+ * the old ones. This means we temporarily need extra link objects
+ * during the transition. Check if we have enough free link IDs.
+ */
+
+ free_link_ids = iwl_mld_count_free_link_ids(mld);
+
+ if (free_link_ids >= n_add)
+ return true;
+
+ if (!mld->nan_device_vif)
+ return false;
+
+ /*
+ * Not enough free link IDs. First try to evacuate NAN from the
+ * channel context of a link that is going to be deactivated.
+ */
+ for_each_set_bit(i, &to_deactivate, IEEE80211_MLD_MAX_NUM_LINKS) {
+ struct ieee80211_bss_conf *link_conf;
+ struct ieee80211_chanctx_conf *chanctx_conf;
+
+ link_conf = link_conf_dereference_protected(vif, i);
+ if (!link_conf)
+ continue;
+
+ chanctx_conf = wiphy_dereference(mld->wiphy, link_conf->chanctx_conf);
+ if (!chanctx_conf)
+ continue;
+
+ if (iwl_mld_chanctx_used_by_other_vif(hw, vif, chanctx_conf))
+ continue;
+
+ if (ieee80211_nan_try_evacuate(hw, chanctx_conf)) {
+ free_link_ids = iwl_mld_count_free_link_ids(mld);
+ /*
+ * Evacuation of one channel should do the job. If not,
+ * something bad is happening. Don't try to evacuate more
+ */
+ return free_link_ids >= n_add;
+ }
+ }
+
+ /* Couldn't find/evacuate any channel going to go unused, try any */
+ if (ieee80211_nan_try_evacuate(hw, NULL)) {
+ free_link_ids = iwl_mld_count_free_link_ids(mld);
+ if (free_link_ids >= n_add)
+ return true;
+ }
+
+ return false;
}
static int
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 06/15] wifi: iwlwifi: reduce the log level of firmware debug buffer size mismatch
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Emmanuel Grumbach
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
This is not really an error and we can safely reduce the log level to
INFO.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c
index e3603571bdd9..50342604491d 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c
@@ -141,10 +141,10 @@ static void iwl_pcie_alloc_fw_monitor_block(struct iwl_trans *trans,
return;
if (power != max_power)
- IWL_ERR(trans,
- "Sorry - debug buffer is only %luK while you requested %luK\n",
- (unsigned long)BIT(power - 10),
- (unsigned long)BIT(max_power - 10));
+ IWL_INFO(trans,
+ "Sorry - debug buffer is only %luK while you requested %luK\n",
+ (unsigned long)BIT(power - 10),
+ (unsigned long)BIT(max_power - 10));
fw_mon->block = block;
fw_mon->physical = physical;
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 07/15] wifi: iwlwifi: print UHR rate type
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Daniel Gabay
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Daniel Gabay <daniel.gabay@intel.com>
Log "UHR" in rs_pretty_print_rate() instead of "Unknown".
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/rs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/rs.c b/drivers/net/wireless/intel/iwlwifi/fw/rs.c
index 746f2acffb8f..2aa300b26158 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/rs.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2021-2022, 2025 Intel Corporation
+ * Copyright (C) 2021-2022, 2025-2026 Intel Corporation
*/
#include <net/mac80211.h>
@@ -124,6 +124,9 @@ int rs_pretty_print_rate(char *buf, int bufsz, const u32 rate)
case RATE_MCS_MOD_TYPE_EHT:
type = "EHT";
break;
+ case RATE_MCS_MOD_TYPE_UHR:
+ type = "UHR";
+ break;
default:
type = "Unknown"; /* shouldn't happen */
}
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 08/15] wifi: iwlwifi: mld: Disallow using a per-STA GTK for Tx
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Ilan Peer, Johannes Berg
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Ilan Peer <ilan.peer@intel.com>
When a GTK is configured for a station, it can only be used for Rx
and never for Tx. In such a case, set the IWL_SEC_KEY_FLAG_NO_TX
flag when the key is installed, so the FW will not use it for Tx.
Specifically, this is needed for per-station GTK installed on NAN
NDI stations associated with NAN Data interfaces.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
tested: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/key.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/key.c b/drivers/net/wireless/intel/iwlwifi/mld/key.c
index a6454d90d0e3..bf80b4770b5a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/key.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/key.c
@@ -49,6 +49,12 @@ static u32 iwl_mld_get_key_flags(struct iwl_mld *mld,
if (key->flags & IEEE80211_KEY_FLAG_SPP_AMSDU)
flags |= IWL_SEC_KEY_FLAG_SPP_AMSDU;
+ /* When a GTK is configured for a station, it can only be
+ * used for Rx and never for Tx. Thus, set the NO TX flag.
+ */
+ if (!pairwise && sta)
+ flags |= IWL_SEC_KEY_FLAG_NO_TX;
+
return flags;
}
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 09/15] wifi: iwlwifi: mld: rename LINK_DEBUGFS_WRITE_FILE_OPS
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
These are with wiphy mutex held, so rename the macro to
LINK_DEBUGFS_WIPHY_WRITE_FILE_OPS indicating that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
tested: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/debugfs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
index ba5a47519aa1..afe972834cb8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
@@ -979,7 +979,8 @@ void iwl_mld_add_vif_debugfs(struct ieee80211_hw *hw,
VIF_DEBUGFS_ADD_FILE(twt_operation, mld_vif_dbgfs, 0200);
VIF_DEBUGFS_ADD_FILE(int_mlo_scan, mld_vif_dbgfs, 0200);
}
-#define LINK_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
+
+#define LINK_DEBUGFS_WIPHY_WRITE_FILE_OPS(name, bufsz) \
WIPHY_DEBUGFS_WRITE_FILE_OPS(link_##name, bufsz, bss_conf)
#define LINK_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) \
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 10/15] wifi: iwlwifi: mld: add link and link station FW IDs to debugfs
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
Add the link and link station FW IDs to debugfs to aid debug
and testing, since assignments can't be known ahead of time,
especially with ID randomisation turned on.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
.../net/wireless/intel/iwlwifi/mld/debugfs.c | 50 +++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
index afe972834cb8..351a4f177e92 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
@@ -983,12 +983,35 @@ void iwl_mld_add_vif_debugfs(struct ieee80211_hw *hw,
#define LINK_DEBUGFS_WIPHY_WRITE_FILE_OPS(name, bufsz) \
WIPHY_DEBUGFS_WRITE_FILE_OPS(link_##name, bufsz, bss_conf)
+/*
+ * Note: no locking is provided, so the function must have its own,
+ * but it cannot acquire the wiphy mutex.
+ */
+#define LINK_DEBUGFS_READ_FILE_OPS(name, bufsz) \
+ _MLD_DEBUGFS_READ_FILE_OPS(link_##name, bufsz, struct ieee80211_bss_conf)
+
#define LINK_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) \
debugfs_create_file(alias, mode, parent, link_conf, \
&iwl_dbgfs_link_##name##_ops)
#define LINK_DEBUGFS_ADD_FILE(name, parent, mode) \
LINK_DEBUGFS_ADD_FILE_ALIAS(#name, name, parent, mode)
+static ssize_t iwl_dbgfs_link_fw_id_read(struct ieee80211_bss_conf *link_conf,
+ size_t buflen, void *buf)
+{
+ struct iwl_mld_link *mld_link;
+
+ guard(rcu)();
+
+ mld_link = iwl_mld_link_from_mac80211(link_conf);
+ if (!mld_link)
+ return -EINVAL;
+
+ return scnprintf(buf, buflen, "%d\n", mld_link->fw_id);
+}
+
+LINK_DEBUGFS_READ_FILE_OPS(fw_id, 64);
+
void iwl_mld_add_link_debugfs(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
struct ieee80211_bss_conf *link_conf,
@@ -1009,6 +1032,8 @@ void iwl_mld_add_link_debugfs(struct ieee80211_hw *hw,
/* Release the reference from debugfs_lookup */
dput(mld_link_dir);
}
+
+ LINK_DEBUGFS_ADD_FILE(fw_id, mld_link_dir, 0400);
}
static ssize_t _iwl_dbgfs_fixed_rate_write(struct iwl_mld *mld, char *buf,
@@ -1092,6 +1117,21 @@ static ssize_t iwl_dbgfs_link_sta_tlc_dhc_write(struct iwl_mld *mld, char *buf,
return ret ? : count;
}
+static ssize_t
+iwl_dbgfs_link_sta_fw_id_read(struct ieee80211_link_sta *link_sta,
+ size_t buflen, void *buf)
+{
+ struct iwl_mld_link_sta *mld_link_sta;
+
+ guard(rcu)();
+
+ mld_link_sta = iwl_mld_link_sta_from_mac80211(link_sta);
+ if (!mld_link_sta)
+ return -EINVAL;
+
+ return scnprintf(buf, buflen, "%u\n", mld_link_sta->fw_id);
+}
+
#define LINK_STA_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) \
debugfs_create_file(alias, mode, parent, link_sta, \
&iwl_dbgfs_link_sta_##name##_ops)
@@ -1101,9 +1141,18 @@ static ssize_t iwl_dbgfs_link_sta_tlc_dhc_write(struct iwl_mld *mld, char *buf,
#define LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(name, bufsz) \
WIPHY_DEBUGFS_WRITE_FILE_OPS(link_sta_##name, bufsz, link_sta)
+/*
+ * Note: no locking is provided, so the function must have its own,
+ * but it cannot acquire the wiphy mutex.
+ */
+#define LINK_STA_DEBUGFS_READ_OPS(name, bufsz) \
+ _MLD_DEBUGFS_READ_FILE_OPS(link_sta_##name, bufsz, \
+ struct ieee80211_link_sta)
+
LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(tlc_dhc, 64);
LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(fixed_rate, 64);
LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(fixed_rate_v3, 64);
+LINK_STA_DEBUGFS_READ_OPS(fw_id, 64);
void iwl_mld_add_link_sta_debugfs(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
@@ -1113,4 +1162,5 @@ void iwl_mld_add_link_sta_debugfs(struct ieee80211_hw *hw,
LINK_STA_DEBUGFS_ADD_FILE(fixed_rate, dir, 0200);
LINK_STA_DEBUGFS_ADD_FILE(fixed_rate_v3, dir, 0200);
LINK_STA_DEBUGFS_ADD_FILE(tlc_dhc, dir, 0200);
+ LINK_STA_DEBUGFS_ADD_FILE(fw_id, dir, 0400);
}
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 11/15] wifi: iwlwifi: api: remove NAN_GROUP
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
This is no longer used by the driver nor supported by firmware,
and the kernel-doc reference to enum iwl_nan_subcmd_ids is long
dead. Remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/commands.h | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
index dcac0ba8cccf..24bac3f00310 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
@@ -22,7 +22,6 @@
* &enum iwl_data_path_subcmd_ids
* @SCAN_GROUP: scan group, uses command IDs from
* &enum iwl_scan_subcmd_ids
- * @NAN_GROUP: NAN group, uses command IDs from &enum iwl_nan_subcmd_ids
* @LOCATION_GROUP: location group, uses command IDs from
* &enum iwl_location_subcmd_ids
* @BT_COEX_GROUP: bt coex group, uses command IDs from
@@ -43,7 +42,6 @@ enum iwl_mvm_command_groups {
PHY_OPS_GROUP = 0x4,
DATA_PATH_GROUP = 0x5,
SCAN_GROUP = 0x6,
- NAN_GROUP = 0x7,
LOCATION_GROUP = 0x8,
BT_COEX_GROUP = 0x9,
PROT_OFFLOAD_GROUP = 0xb,
--
2.34.1
^ permalink raw reply related
* [PATCH v2 iwlwifi-next 12/15] wifi: iwlwifi: api: clean up/fix some kernel-doc references
From: Miri Korenblit @ 2026-05-15 12:09 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260515120948.1157329-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
Some of these structs just don't exist (any more), or other
versions should be referenced, clean that up.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/commands.h | 7 +++----
drivers/net/wireless/intel/iwlwifi/fw/api/location.h | 7 ++++---
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
index 24bac3f00310..abd259350589 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
@@ -57,8 +57,7 @@ enum iwl_legacy_cmds {
/**
* @UCODE_ALIVE_NTFY:
* Alive data from the firmware, as described in
- * &struct iwl_alive_ntf_v3 or &struct iwl_alive_ntf_v4 or
- * &struct iwl_alive_ntf_v5 or &struct iwl_alive_ntf_v7.
+ * &struct iwl_alive_ntf_v3 or &struct iwl_alive_ntf_v7.
*/
UCODE_ALIVE_NTFY = 0x1,
@@ -384,7 +383,7 @@ enum iwl_legacy_cmds {
* @STATISTICS_NOTIFICATION:
* one of &struct iwl_notif_statistics_v10,
* &struct iwl_notif_statistics_v11,
- * &struct iwl_notif_statistic,
+ * &struct iwl_notif_statistics,
* &struct iwl_statistics_operational_ntfy_ver_14
* &struct iwl_statistics_operational_ntfy
*/
@@ -558,7 +557,7 @@ enum iwl_legacy_cmds {
WOWLAN_CONFIGURATION = 0xe1,
/**
- * @WOWLAN_TSC_RSC_PARAM: &struct iwl_wowlan_rsc_tsc_params_cmd_v4,
+ * @WOWLAN_TSC_RSC_PARAM: &struct iwl_wowlan_rsc_tsc_params_cmd_ver_2,
* &struct iwl_wowlan_rsc_tsc_params_cmd
*/
WOWLAN_TSC_RSC_PARAM = 0xe2,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
index 2ee3a48aa5df..d3f774ffacde 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
@@ -2,7 +2,7 @@
/*
* Copyright (C) 2015-2017 Intel Deutschland GmbH
* Copyright (C) 2018-2022 Intel Corporation
- * Copyright (C) 2024-2025 Intel Corporation
+ * Copyright (C) 2024-2026 Intel Corporation
*/
#ifndef __iwl_fw_api_location_h__
#define __iwl_fw_api_location_h__
@@ -81,8 +81,9 @@ enum iwl_location_subcmd_ids {
* @TOF_RANGE_RESPONSE_NOTIF: ranging response, using one of
* &struct iwl_tof_range_rsp_ntfy_v5,
* &struct iwl_tof_range_rsp_ntfy_v6,
- * &struct iwl_tof_range_rsp_ntfy_v7 or
- * &struct iwl_tof_range_rsp_ntfy_v8
+ * &struct iwl_tof_range_rsp_ntfy_v7,
+ * &struct iwl_tof_range_rsp_ntfy_v9 or
+ * &struct iwl_tof_range_rsp_ntfy
*/
TOF_RANGE_RESPONSE_NOTIF = 0xFF,
};
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox