* Re: [PATCH v2 7/7] b43: complete N-PHY rev 8 + radio 2057 rev 8
From: Alessio Ferri @ 2026-05-24 21:36 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel
In-Reply-To: <20260524233228.06b38dba@fedora>
Add the 2.4 GHz RF power offset table for N-PHY rev 8 paired with
radio 2057 rev 8 and wire it to the existing dispatcher.
b43_ntab_get_rf_pwr_offset_table() currently dispatches on phy->rev
== 17 (radio_rev 14) and phy->rev == 16 (radio_rev 9) for 2.4 GHz.
phy->rev == 8 falls through and the function logs:
b43-phyX ERROR: No 2GHz RF power table available for this device
Add a phy->rev == 8 / radio_rev == 8 case returning the new table.
The values are sourced from the proprietary Broadcom wl driver's
nphy_papd_padgain_dlt_2g_2057rev5 array. Reusing the rev 5 values
is structurally appropriate: the IPA TX gain table added by the
preceding patch in this series shares the low 24 bits of every
entry with rev 5 - same gain step amplitudes, only the PAD-gain
selector byte differs. b43's pad_gain extraction in
b43_nphy_tx_pwr_ctl_init() reads bits 19..23 of the gain entry,
which sit in the shared low-24-bit range; the same gain index
therefore maps to the same physical PAD gain code on both
revisions and warrants the same per-index dB offset.
Note that b43_nphy_tx_gain_table_upload() currently has a "TODO:
Enable this once we have gains configured" early-return for
phy->rev >= 7. With that early-return in place, this table is
fetched (silencing the b43err that would otherwise abort PHY
init) but its values are not yet written to MMIO. Resolving the
TODO is a future, separate task.
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/tables_nphy.c | 19
+++++++++++++++++++ 1 file changed, 19 insertions(+)
diff --git a/drivers/net/wireless/broadcom/b43/tables_nphy.c
b/drivers/net/wireless/broadcom/b43/tables_nphy.c index
84e8d718d..ecd660b9c 100644 ---
a/drivers/net/wireless/broadcom/b43/tables_nphy.c +++
b/drivers/net/wireless/broadcom/b43/tables_nphy.c @@ -2923,6 +2923,21
@@ static const s16 b43_ntab_rf_pwr_offset_2057_rev9_5g[] = { 0,
};
+/* Sourced from the rev 5 sibling: the rev 8 IPA TX gain table
+ * shares the low 24 bits of every entry with rev 5 (only the
+ * PAD-gain selector byte differs), so the same gain index maps to
+ * the same physical PAD gain code on both revisions.
+ */
+static const s16 b43_ntab_rf_pwr_offset_2057_rev8_2g[] = {
+ -109, -109, -82, -68, -58,
+ -50, -44, -39, -35, -31,
+ -28, -26, -23, -21, -19,
+ -17, -16, -14, -13, -11,
+ -10, -9, -8, -7, -5,
+ -5, -4, -3, -2, -1,
+ -1, 0,
+};
+
/* Extracted from MMIO dump of 6.30.223.248
* Entries: 0, 26, 28, 29, 30, 31 were guessed
*/
@@ -3782,6 +3797,10 @@ const s16
*b43_ntab_get_rf_pwr_offset_table(struct b43_wldev *dev) if
(phy->radio_rev == 9) return b43_ntab_rf_pwr_offset_2057_rev9_2g;
break;
+ case 8:
+ if (phy->radio_rev == 8)
+ return
b43_ntab_rf_pwr_offset_2057_rev8_2g;
+ break;
}
b43err(dev->wl,
--
2.54.0
^ permalink raw reply
* Re: [PATCH v2 0/7] b43: complete N-PHY rev 8 + radio 2057 rev 8
From: Alessio Ferri @ 2026-05-24 21:35 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel
In-Reply-To: <20260524233228.06b38dba@fedora>
Add the 2.4 GHz IPA TX gain table for N-PHY rev 8 paired with radio
2057 rev 8 and wire it to the existing dispatcher.
b43_nphy_get_ipa_gain_table() in tables_nphy.c currently handles
case 8 only for radio_rev == 5; radio_rev == 8 falls through and
the function logs:
b43-phyX ERROR: No 2GHz IPA gain table available for this device
b43-phyX ERROR: PHY init: Channel switch to default failed
leaving b43_phy_init() to return an error and core_init to abort
before the MAC is enabled.
The high byte of every entry differs from the rev 5 sibling (0x40
vs 0x30): different PAD-gain code prefix for the rev 8 front-end.
The low 24 bits coincide with rev 5 across the whole table - the
gain step amplitudes are the same, only the PAD-gain selector
prefix changes.
Values extracted from an MMIO dump of the proprietary Broadcom wl
driver running on BCM6362 silicon (wl driver 6.30.102.7).
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/tables_nphy.c | 39
+++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
diff --git a/drivers/net/wireless/broadcom/b43/tables_nphy.c
b/drivers/net/wireless/broadcom/b43/tables_nphy.c index
41a25d909..84e8d718d 100644 ---
a/drivers/net/wireless/broadcom/b43/tables_nphy.c +++
b/drivers/net/wireless/broadcom/b43/tables_nphy.c @@ -2715,6 +2715,43
@@ static const u32 b43_ntab_tx_gain_ipa_2057_rev5_2g[] = { 0x300f0715,
0x300f0715, 0x300f0715, 0x300f0715, };
+/* Extracted from MMIO dump of 6.30.102.7 */
+static const u32 b43_ntab_tx_gain_ipa_2057_rev8_2g[] = {
+ 0x40ff0031, 0x40e70031, 0x40e7002e, 0x40cf002e,
+ 0x40bf002e, 0x40af002e, 0x409f002f, 0x407f0033,
+ 0x407f0031, 0x407f002e, 0x4077002e, 0x406f002e,
+ 0x4067002e, 0x405f002f, 0x40570030, 0x4057002d,
+ 0x404f002e, 0x40470031, 0x4047002e, 0x4047002c,
+ 0x40470029, 0x403f002c, 0x403f0029, 0x4037002d,
+ 0x4037002a, 0x40370028, 0x402f002c, 0x402f002a,
+ 0x402f0028, 0x402f0026, 0x4027002c, 0x40270029,
+ 0x40270027, 0x40270025, 0x40270023, 0x401f002c,
+ 0x401f002a, 0x401f0028, 0x401f0025, 0x401f0024,
+ 0x401f0022, 0x401f001f, 0x4017002d, 0x4017002b,
+ 0x40170028, 0x40170026, 0x40170024, 0x40170022,
+ 0x40170020, 0x4017001e, 0x4017001d, 0x4017001b,
+ 0x4017001a, 0x40170018, 0x40170017, 0x40170015,
+ 0x400f002c, 0x400f0029, 0x400f0027, 0x400f0024,
+ 0x400f0022, 0x400f0021, 0x400f001f, 0x400f001d,
+ 0x400f001b, 0x400f001a, 0x400f0018, 0x400f0017,
+ 0x400f0016, 0x400f0015, 0x400f0115, 0x400f0215,
+ 0x400f0315, 0x400f0415, 0x400f0515, 0x400f0615,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+};
+
+
/* Extracted from MMIO dump of 6.30.223.141 */
static const u32 b43_ntab_tx_gain_ipa_2057_rev9_2g[] = {
0x60ff0031, 0x60e7002c, 0x60cf002a, 0x60c70029,
@@ -3651,6 +3688,8 @@ static const u32
*b43_nphy_get_ipa_gain_table(struct b43_wldev *dev) case 8:
if (phy->radio_rev == 5)
return
b43_ntab_tx_gain_ipa_2057_rev5_2g;
+ if (phy->radio_rev == 8)
+ return
b43_ntab_tx_gain_ipa_2057_rev8_2g; break;
case 6:
if (dev->dev->chip_id == BCMA_CHIP_ID_BCM47162)
--
2.54.0
^ permalink raw reply
* Re: [PATCH v2 0/7] b43: complete N-PHY rev 8 + radio 2057 rev 8
From: Alessio Ferri @ 2026-05-24 21:34 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel
In-Reply-To: <20260524233228.06b38dba@fedora>
Add support for radio 2057 revision 8, paired with N-PHY rev 8 on
the Broadcom BCM6362 single-die integrated 2.4 GHz wireless block.
Three correlated changes are needed for the same chip:
- main.c: the radio_rev allow-list under B43_PHYTYPE_N currently
accepts radio 2057 revisions 9 and 14 only; extend to include
rev 8.
- radio_2057.c: the existing r2057_rev8_init[] is a 54-entry stub
declared inside a TODO comment block and never referenced
from r2057_upload_inittabs().
Replace it with the full 412-entry register set actually
programmed by the proprietary Broadcom wl driver on this radio.
I couldn't find the origin of the original 54-entry stub - 8
of its entries do not appear at all in the rev 8 register set
and 7 more carry different values.
Loading it instead of using the real table leaves the radio
hanging producing a "Microcode not responding" timeout.
- radio_2057.c: r2057_upload_inittabs() case 8 handles radio_rev
5 and 7 only; add the radio_rev == 8 branch pointing at the
new table.
The init table is extracted from an MMIO dump of the radio
register set programmed during proprietary driver initialisation
on BCM6362 silicon (Broadcom wl driver 6.30.102.7).
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/main.c | 3 +-
drivers/net/wireless/broadcom/b43/radio_2057.c | 124
+++++++++++++++++++++---- 2 files changed, 110 insertions(+), 17
deletions(-)
diff --git a/drivers/net/wireless/broadcom/b43/main.c
b/drivers/net/wireless/broadcom/b43/main.c index 783af26cb..817448e58
100644 --- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -4617,7 +4617,8 @@ static int b43_phy_versioning(struct b43_wldev
*dev) radio_id != 0x2057)
unsupported = 1;
if (radio_id == 0x2057 &&
- !(radio_rev == 9 || radio_rev == 14))
+ !(radio_rev == 8 || radio_rev == 9 ||
+ radio_rev == 14))
unsupported = 1;
break;
case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/broadcom/b43/radio_2057.c
b/drivers/net/wireless/broadcom/b43/radio_2057.c index
bd7dafb56..9f693d92b 100644 ---
a/drivers/net/wireless/broadcom/b43/radio_2057.c +++
b/drivers/net/wireless/broadcom/b43/radio_2057.c @@ -73,24 +73,112 @@
static u16 r2057_rev7_init[][2] = { { 0x1B7, 0x05 }, { 0x1C2, 0xa0 },
};
-/* TODO: Which devices should use it?
+/* Extracted from MMIO dump of 6.30.102.7 */
static u16 r2057_rev8_init[][2] = {
- { 0x00, 0x08 }, { 0x01, 0x57 }, { 0x02, 0x20 }, { 0x31, 0x00 },
- { 0x32, 0x00 }, { 0x33, 0x00 }, { 0x51, 0x70 }, { 0x59, 0x88 },
- { 0x5C, 0x20 }, { 0x62, 0x33 }, { 0x63, 0x0f }, { 0x64, 0x0f },
- { 0x6E, 0x58 }, { 0x75, 0x13 }, { 0x7B, 0x13 }, { 0x7C, 0x0f },
- { 0x7D, 0xee }, { 0x81, 0x01 }, { 0x91, 0x3f }, { 0x92, 0x36 },
- { 0xA1, 0x20 }, { 0xC9, 0x01 }, { 0xD6, 0x70 }, { 0xDE, 0x88 },
- { 0xE1, 0x20 }, { 0xE8, 0x0f }, { 0xE9, 0x0f }, { 0xF3, 0x58 },
- { 0xFA, 0x13 }, { 0x100, 0x13 }, { 0x101, 0x0f }, { 0x102,
0xee },
- { 0x106, 0x01 }, { 0x116, 0x3f }, { 0x117, 0x36 }, { 0x126,
0x20 },
- { 0x14E, 0x01 }, { 0x15E, 0x00 }, { 0x15F, 0x00 }, { 0x160,
0x00 },
- { 0x161, 0x00 }, { 0x162, 0x00 }, { 0x163, 0x00 }, { 0x16A,
0x00 },
- { 0x16B, 0x00 }, { 0x16C, 0x00 }, { 0x1A4, 0x00 }, { 0x1A5,
0x00 },
- { 0x1A6, 0x00 }, { 0x1AA, 0x00 }, { 0x1AB, 0x00 }, { 0x1AC,
0x00 },
- { 0x1B7, 0x05 }, { 0x1C2, 0xa0 },
+ { 0x0000, 0x0008 }, { 0x0001, 0x0057 }, { 0x0002, 0x0020 }, {
0x0003, 0x001f },
+ { 0x0004, 0x0004 }, { 0x0005, 0x0002 }, { 0x0006, 0x0001 }, {
0x0007, 0x0001 },
+ { 0x0008, 0x0001 }, { 0x0009, 0x0069 }, { 0x000a, 0x0066 }, {
0x000b, 0x0006 },
+ { 0x000c, 0x0018 }, { 0x000d, 0x0003 }, { 0x000e, 0x0020 }, {
0x000f, 0x0020 },
+ { 0x0010, 0x0000 }, { 0x0011, 0x007c }, { 0x0012, 0x0042 }, {
0x0013, 0x00bd },
+ { 0x0014, 0x0007 }, { 0x0015, 0x0087 }, { 0x0016, 0x0008 }, {
0x0017, 0x0017 },
+ { 0x0018, 0x0007 }, { 0x0019, 0x0000 }, { 0x001a, 0x0002 }, {
0x001b, 0x0013 },
+ { 0x001c, 0x003e }, { 0x001d, 0x003e }, { 0x001e, 0x0096 }, {
0x001f, 0x0004 },
+ { 0x0020, 0x0000 }, { 0x0021, 0x0000 }, { 0x0022, 0x0017 }, {
0x0023, 0x0006 },
+ { 0x0024, 0x0001 }, { 0x0025, 0x0006 }, { 0x0026, 0x0004 }, {
0x0027, 0x000d },
+ { 0x0028, 0x000d }, { 0x0029, 0x0030 }, { 0x002a, 0x0032 }, {
0x002b, 0x0008 },
+ { 0x002c, 0x001c }, { 0x002d, 0x0002 }, { 0x002e, 0x0004 }, {
0x002f, 0x007f },
+ { 0x0030, 0x0027 }, { 0x0031, 0x0000 }, { 0x0032, 0x0000 }, {
0x0033, 0x0000 },
+ { 0x0034, 0x0000 }, { 0x0035, 0x0020 }, { 0x0036, 0x0018 }, {
0x0037, 0x0007 },
+ { 0x0038, 0x0066 }, { 0x0039, 0x0066 }, { 0x003a, 0x0066 }, {
0x003b, 0x0066 },
+ { 0x003c, 0x00ff }, { 0x003d, 0x00ff }, { 0x003e, 0x00ff }, {
0x003f, 0x00ff },
+ { 0x0040, 0x0016 }, { 0x0041, 0x0007 }, { 0x0042, 0x0029 }, {
0x0043, 0x0007 },
+ { 0x0044, 0x0006 }, { 0x0045, 0x0003 }, { 0x0046, 0x0001 }, {
0x0047, 0x0007 },
+ { 0x0048, 0x0088 }, { 0x0049, 0x0005 }, { 0x004a, 0x0077 }, {
0x004b, 0x0066 },
+ { 0x004c, 0x0066 }, { 0x004d, 0x0000 }, { 0x004e, 0x0004 }, {
0x004f, 0x000c },
+ { 0x0050, 0x0000 }, { 0x0051, 0x0070 }, { 0x0056, 0x0007 }, {
0x0057, 0x0000 },
+ { 0x0058, 0x0000 }, { 0x0059, 0x0088 }, { 0x005a, 0x0000 }, {
0x005b, 0x001f },
+ { 0x005c, 0x0020 }, { 0x005d, 0x0001 }, { 0x005e, 0x0030 }, {
0x005f, 0x0070 },
+ { 0x0060, 0x0000 }, { 0x0061, 0x0000 }, { 0x0062, 0x0033 }, {
0x0063, 0x000f },
+ { 0x0064, 0x0013 }, { 0x0065, 0x0000 }, { 0x0066, 0x00ee }, {
0x0069, 0x0000 },
+ { 0x006a, 0x007e }, { 0x006b, 0x003f }, { 0x006c, 0x007f }, {
0x006d, 0x0078 },
+ { 0x006e, 0x0058 }, { 0x006f, 0x0088 }, { 0x0070, 0x0008 }, {
0x0071, 0x000f },
+ { 0x0072, 0x00bc }, { 0x0073, 0x0008 }, { 0x0074, 0x0060 }, {
0x0075, 0x001a },
+ { 0x0076, 0x0070 }, { 0x0077, 0x0000 }, { 0x0078, 0x0000 }, {
0x0079, 0x0000 },
+ { 0x007a, 0x0033 }, { 0x007b, 0x001a }, { 0x007c, 0x0014 }, {
0x007d, 0x00ee },
+ { 0x0080, 0x003c }, { 0x0081, 0x0001 }, { 0x0082, 0x000a }, {
0x0083, 0x009d },
+ { 0x0084, 0x000a }, { 0x0085, 0x0000 }, { 0x0086, 0x0040 }, {
0x0087, 0x0040 },
+ { 0x0088, 0x0088 }, { 0x0089, 0x0010 }, { 0x008a, 0x00f0 }, {
0x008b, 0x0010 },
+ { 0x008c, 0x00f0 }, { 0x008d, 0x0000 }, { 0x008e, 0x0000 }, {
0x008f, 0x0010 },
+ { 0x0090, 0x0055 }, { 0x0091, 0x003f }, { 0x0092, 0x0036 }, {
0x0093, 0x0000 },
+ { 0x0094, 0x0000 }, { 0x0095, 0x0000 }, { 0x0096, 0x0087 }, {
0x0097, 0x0011 },
+ { 0x0098, 0x0000 }, { 0x0099, 0x0033 }, { 0x009a, 0x0088 }, {
0x009b, 0x0000 },
+ { 0x009c, 0x0087 }, { 0x009d, 0x0011 }, { 0x009e, 0x0000 }, {
0x009f, 0x0033 },
+ { 0x00a0, 0x0088 }, { 0x00a1, 0x0020 }, { 0x00a2, 0x003f }, {
0x00a3, 0x0044 },
+ { 0x00a4, 0x008c }, { 0x00a5, 0x006c }, { 0x00a6, 0x0022 }, {
0x00a7, 0x00be },
+ { 0x00a8, 0x0055 }, { 0x00aa, 0x000c }, { 0x00ab, 0x00aa }, {
0x00ac, 0x0002 },
+ { 0x00ad, 0x0000 }, { 0x00ae, 0x0010 }, { 0x00af, 0x0001 }, {
0x00b0, 0x0000 },
+ { 0x00b1, 0x0000 }, { 0x00b2, 0x0080 }, { 0x00b3, 0x0060 }, {
0x00b4, 0x0044 },
+ { 0x00b5, 0x0055 }, { 0x00b6, 0x0001 }, { 0x00b7, 0x0055 }, {
0x00b8, 0x0001 },
+ { 0x00b9, 0x0005 }, { 0x00ba, 0x0055 }, { 0x00bb, 0x0055 }, {
0x00c1, 0x0000 },
+ { 0x00c2, 0x0000 }, { 0x00c3, 0x0000 }, { 0x00c4, 0x0000 }, {
0x00c5, 0x0000 },
+ { 0x00c6, 0x0000 }, { 0x00c7, 0x0000 }, { 0x00c8, 0x0000 }, {
0x00c9, 0x0001 },
+ { 0x00ca, 0x0000 }, { 0x00cb, 0x0000 }, { 0x00cc, 0x0000 }, {
0x00cd, 0x0000 },
+ { 0x00ce, 0x005e }, { 0x00cf, 0x000c }, { 0x00d0, 0x000c }, {
0x00d1, 0x000c },
+ { 0x00d2, 0x0000 }, { 0x00d3, 0x002b }, { 0x00d4, 0x000c }, {
0x00d5, 0x0000 },
+ { 0x00d6, 0x0070 }, { 0x00db, 0x0007 }, { 0x00dc, 0x0000 }, {
0x00dd, 0x0000 },
+ { 0x00de, 0x0088 }, { 0x00df, 0x0000 }, { 0x00e0, 0x001f }, {
0x00e1, 0x0020 },
+ { 0x00e2, 0x0001 }, { 0x00e3, 0x0030 }, { 0x00e4, 0x0070 }, {
0x00e5, 0x0000 },
+ { 0x00e6, 0x0000 }, { 0x00e7, 0x0033 }, { 0x00e8, 0x000f }, {
0x00e9, 0x0013 },
+ { 0x00ea, 0x0000 }, { 0x00eb, 0x00ee }, { 0x00ee, 0x0000 }, {
0x00ef, 0x007e },
+ { 0x00f0, 0x003f }, { 0x00f1, 0x007f }, { 0x00f2, 0x0078 }, {
0x00f3, 0x0058 },
+ { 0x00f4, 0x0088 }, { 0x00f5, 0x0008 }, { 0x00f6, 0x000f }, {
0x00f7, 0x00bc },
+ { 0x00f8, 0x0008 }, { 0x00f9, 0x0060 }, { 0x00fa, 0x001a }, {
0x00fb, 0x0070 },
+ { 0x00fc, 0x0000 }, { 0x00fd, 0x0000 }, { 0x00fe, 0x0000 }, {
0x00ff, 0x0033 },
+ { 0x0100, 0x001a }, { 0x0101, 0x0014 }, { 0x0102, 0x00ee }, {
0x0105, 0x003c },
+ { 0x0106, 0x0001 }, { 0x0107, 0x000a }, { 0x0108, 0x009d }, {
0x0109, 0x000a },
+ { 0x010a, 0x0000 }, { 0x010b, 0x0040 }, { 0x010c, 0x0040 }, {
0x010d, 0x0088 },
+ { 0x010e, 0x0010 }, { 0x010f, 0x00f0 }, { 0x0110, 0x0010 }, {
0x0111, 0x00f0 },
+ { 0x0112, 0x0000 }, { 0x0113, 0x0000 }, { 0x0114, 0x0010 }, {
0x0115, 0x0055 },
+ { 0x0116, 0x003f }, { 0x0117, 0x0036 }, { 0x0118, 0x0000 }, {
0x0119, 0x0000 },
+ { 0x011a, 0x0000 }, { 0x011b, 0x0087 }, { 0x011c, 0x0011 }, {
0x011d, 0x0000 },
+ { 0x011e, 0x0033 }, { 0x011f, 0x0088 }, { 0x0120, 0x0000 }, {
0x0121, 0x0087 },
+ { 0x0122, 0x0011 }, { 0x0123, 0x0000 }, { 0x0124, 0x0033 }, {
0x0125, 0x0088 },
+ { 0x0126, 0x0020 }, { 0x0127, 0x003f }, { 0x0128, 0x0044 }, {
0x0129, 0x008c },
+ { 0x012a, 0x006c }, { 0x012b, 0x0022 }, { 0x012c, 0x00be }, {
0x012d, 0x0055 },
+ { 0x012f, 0x000c }, { 0x0130, 0x00aa }, { 0x0131, 0x0002 }, {
0x0132, 0x0000 },
+ { 0x0133, 0x0010 }, { 0x0134, 0x0001 }, { 0x0135, 0x0000 }, {
0x0136, 0x0000 },
+ { 0x0137, 0x0080 }, { 0x0138, 0x0060 }, { 0x0139, 0x0044 }, {
0x013a, 0x0055 },
+ { 0x013b, 0x0001 }, { 0x013c, 0x0055 }, { 0x013d, 0x0001 }, {
0x013e, 0x0005 },
+ { 0x013f, 0x0055 }, { 0x0140, 0x0055 }, { 0x0146, 0x0000 }, {
0x0147, 0x0000 },
+ { 0x0148, 0x0000 }, { 0x0149, 0x0000 }, { 0x014a, 0x0000 }, {
0x014b, 0x0000 },
+ { 0x014c, 0x0000 }, { 0x014d, 0x0000 }, { 0x014e, 0x0001 }, {
0x014f, 0x0000 },
+ { 0x0150, 0x0000 }, { 0x0151, 0x0000 }, { 0x0154, 0x000c }, {
0x0155, 0x000c },
+ { 0x0156, 0x000c }, { 0x0157, 0x0000 }, { 0x0158, 0x002b }, {
0x0159, 0x0084 },
+ { 0x015a, 0x0015 }, { 0x015b, 0x000f }, { 0x015c, 0x0000 }, {
0x015d, 0x0000 },
+ { 0x015e, 0x0000 }, { 0x015f, 0x0000 }, { 0x0160, 0x0000 }, {
0x0161, 0x0000 },
+ { 0x0162, 0x0000 }, { 0x0163, 0x0000 }, { 0x0164, 0x0000 }, {
0x0165, 0x0000 },
+ { 0x0166, 0x0000 }, { 0x0167, 0x0000 }, { 0x0168, 0x0000 }, {
0x0169, 0x0000 },
+ { 0x016a, 0x0000 }, { 0x016b, 0x0000 }, { 0x016c, 0x0000 }, {
0x016d, 0x0000 },
+ { 0x0170, 0x0000 }, { 0x0171, 0x0077 }, { 0x0172, 0x0077 }, {
0x0173, 0x0077 },
+ { 0x0174, 0x0077 }, { 0x0175, 0x0000 }, { 0x0176, 0x0003 }, {
0x0177, 0x0037 },
+ { 0x0178, 0x0003 }, { 0x0179, 0x0000 }, { 0x017a, 0x0021 }, {
0x017b, 0x0002 },
+ { 0x017c, 0x0000 }, { 0x017d, 0x00aa }, { 0x017e, 0x0000 }, {
0x017f, 0x00aa },
+ { 0x0180, 0x0000 }, { 0x0190, 0x0000 }, { 0x0191, 0x0077 }, {
0x0192, 0x0077 },
+ { 0x0193, 0x0077 }, { 0x0194, 0x0077 }, { 0x0195, 0x0000 }, {
0x0196, 0x0003 },
+ { 0x0197, 0x0037 }, { 0x0198, 0x0003 }, { 0x0199, 0x0000 }, {
0x019a, 0x0021 },
+ { 0x019b, 0x0002 }, { 0x019c, 0x0000 }, { 0x019d, 0x00aa }, {
0x019e, 0x0000 },
+ { 0x019f, 0x00aa }, { 0x01a0, 0x0000 }, { 0x01a1, 0x0002 }, {
0x01a2, 0x000f },
+ { 0x01a3, 0x000f }, { 0x01a4, 0x0000 }, { 0x01a5, 0x0000 }, {
0x01a6, 0x0000 },
+ { 0x01a7, 0x0002 }, { 0x01a8, 0x000f }, { 0x01a9, 0x000f }, {
0x01aa, 0x0000 },
+ { 0x01ab, 0x0000 }, { 0x01ac, 0x0000 }, { 0x01ad, 0x0084 }, {
0x01ae, 0x0060 },
+ { 0x01af, 0x0047 }, { 0x01b0, 0x0047 }, { 0x01b1, 0x0000 }, {
0x01b2, 0x0000 },
+ { 0x01b3, 0x0000 }, { 0x01b4, 0x0000 }, { 0x01b5, 0x0000 }, {
0x01b6, 0x0000 },
+ { 0x01b7, 0x0005 }, { 0x01b8, 0x0000 }, { 0x01b9, 0x0000 }, {
0x01ba, 0x0000 },
+ { 0x01bb, 0x0000 }, { 0x01bc, 0x0000 }, { 0x01bd, 0x0000 }, {
0x01be, 0x0000 },
+ { 0x01bf, 0x0000 }, { 0x01c0, 0x0000 }, { 0x01c1, 0x0000 }, {
0x01c2, 0x00a0 },
+ { 0x01c3, 0x0000 }, { 0x01c4, 0x0000 }, { 0x01c5, 0x0000 }, {
0x01c6, 0x0000 },
+ { 0x01c7, 0x0000 }, { 0x01c8, 0x0000 }, { 0x01c9, 0x0000 }, {
0x01ca, 0x0000 }, };
-*/
/* Extracted from MMIO dump of 6.30.223.141 */
static u16 r2057_rev9_init[][2] = {
@@ -539,6 +627,10 @@ void r2057_upload_inittabs(struct b43_wldev *dev)
} else if (phy->radio_rev == 7) {
table = r2057_rev7_init[0];
size = ARRAY_SIZE(r2057_rev7_init);
+ } else if (phy->radio_rev == 8) {
+ /* BCM6362 single-die 2.4 GHz. */
+ table = r2057_rev8_init[0];
+ size = ARRAY_SIZE(r2057_rev8_init);
}
break;
case 9:
--
2.54.0
^ permalink raw reply
* Re: [PATCH v2 6/7] b43: complete N-PHY rev 8 + radio 2057 rev 8
From: Alessio Ferri @ 2026-05-24 21:35 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel
In-Reply-To: <20260524233228.06b38dba@fedora>
Add the 2.4 GHz channel info table for N-PHY rev 8 paired with
radio 2057 rev 8 and wire it to the existing dispatcher in
r2057_get_chantabent_rev7().
The dispatcher's case 8 currently handles radio_rev == 5 only.
For radio_rev == 8 both output pointers stay NULL,
b43_nphy_set_channel() returns an error and channel switch to
the default channel fails.
The new b43_nphy_chantab_phy_rev8_radio_rev8[] is 14 entries
covering the standard 2.4 GHz channel set (2412..2472 in 5 MHz
steps, plus 2484 for channel 14).
Values extracted from an MMIO dump of the proprietary Broadcom wl
driver running on BCM6362 silicon (wl driver 6.30.102.7).
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/radio_2057.c | 106
+++++++++++++++++++++++++ 1 file changed, 106 insertions(+)
diff --git a/drivers/net/wireless/broadcom/b43/radio_2057.c
b/drivers/net/wireless/broadcom/b43/radio_2057.c index
9f693d92b..e761f899b 100644 ---
a/drivers/net/wireless/broadcom/b43/radio_2057.c +++
b/drivers/net/wireless/broadcom/b43/radio_2057.c @@ -445,6 +445,109 @@
static const struct b43_nphy_chantabent_rev7_2g
b43_nphy_chantab_phy_rev17_radio }, };
+/* Extracted from MMIO dump of 6.30.102.7 */
+static const struct b43_nphy_chantabent_rev7_2g
b43_nphy_chantab_phy_rev8_radio_rev8[] = {
+ {
+ .freq = 2412,
+ RADIOREGS7_2G(0x48, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x6c,
+ 0x09, 0x0f, 0x09, 0x07, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f,
0x0443),
+ },
+ {
+ .freq = 2417,
+ RADIOREGS7_2G(0x4b, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x71,
+ 0x09, 0x0f, 0x09, 0x07, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d,
0x0441),
+ },
+ {
+ .freq = 2422,
+ RADIOREGS7_2G(0x4e, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x76,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a,
0x043f),
+ },
+ {
+ .freq = 2427,
+ RADIOREGS7_2G(0x52, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x7b,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438,
0x043d),
+ },
+ {
+ .freq = 2432,
+ RADIOREGS7_2G(0x55, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x80,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436,
0x043a),
+ },
+ {
+ .freq = 2437,
+ RADIOREGS7_2G(0x58, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x85,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434,
0x0438),
+ },
+ {
+ .freq = 2442,
+ RADIOREGS7_2G(0x5c, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x8a,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431,
0x0436),
+ },
+ {
+ .freq = 2447,
+ RADIOREGS7_2G(0x5f, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x8f,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f,
0x0434),
+ },
+ {
+ .freq = 2452,
+ RADIOREGS7_2G(0x62, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x94,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d,
0x0431),
+ },
+ {
+ .freq = 2457,
+ RADIOREGS7_2G(0x66, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x99,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b,
0x042f),
+ },
+ {
+ .freq = 2462,
+ RADIOREGS7_2G(0x69, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0x9e,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429,
0x042d),
+ },
+ {
+ .freq = 2467,
+ RADIOREGS7_2G(0x6c, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0xa3,
+ 0x09, 0x0f, 0x07, 0x04, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427,
0x042b),
+ },
+ {
+ .freq = 2472,
+ RADIOREGS7_2G(0x70, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0xa8,
+ 0x09, 0x0f, 0x07, 0x04, 0x61, 0x73,
0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424,
0x0429),
+ },
+ {
+ .freq = 2484,
+ RADIOREGS7_2G(0x78, 0x16, 0x30, 0x1b, 0x0a, 0x0a,
0x30, 0xb4,
+ 0x09, 0x0f, 0x07, 0x04, 0x61, 0x73,
0xe0, 0x61,
+ 0x73, 0xe0),
+ PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f,
0x0424),
+ }
+};
+
+
/* Extracted from MMIO dump of 6.30.223.141 */
static const struct b43_nphy_chantabent_rev7
b43_nphy_chantab_phy_rev16_radio_rev9[] = { {
@@ -678,6 +781,9 @@ void r2057_get_chantabent_rev7(struct b43_wldev
*dev, u16 freq, if (phy->radio_rev == 5) {
e_r7_2g = b43_nphy_chantab_phy_rev8_radio_rev5;
len =
ARRAY_SIZE(b43_nphy_chantab_phy_rev8_radio_rev5);
+ } else if (phy->radio_rev == 8) {
+ e_r7_2g = b43_nphy_chantab_phy_rev8_radio_rev8;
+ len =
ARRAY_SIZE(b43_nphy_chantab_phy_rev8_radio_rev8); }
break;
case 16:
--
2.54.0
^ permalink raw reply
* [PATCH v2 0/7] b43: complete N-PHY rev 8 + radio 2057 rev 8
From: Alessio Ferri @ 2026-05-24 21:32 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel; +Cc: Alessio Ferri
This series completes b43 support for the Broadcom N-PHY revision 8
paired with radio 2057 revision 8. b43 already supports the surrounding
PHY family - N-PHY rev 8 with radio 2057 rev 5 and rev 7 are handled,
and rev 16 with radio 2057 rev 9 is handled - but the rev 8 + rev 8
combination falls through four dispatcher gaps:
- radio_2057.c, r2057_upload_inittabs(), case 8 lists radio_rev 5
and 7 only;
- radio_2057.c, r2057_get_chantabent_rev7(), case 8 lists radio_rev
5 only;
- tables_nphy.c, b43_nphy_get_ipa_gain_table(), case 8 lists
radio_rev 5 only;
- radio_2057.c carries r2057_rev8_init[] as a 54-entry stub commented
out with "TODO: Which devices should use it?".
Two further pieces of plumbing are needed to reach those dispatchers
in the first place: d11 core revision 0x16 is missing from the b43
bcma id table, firmware name, and the corerev 22 / radio 2057
combination needs the 24-bit indirect radio access path that brcmsmac
uses for the same silicon generation (see brcmsmac/phy/phy_cmn.c
read_radio_reg() / write_radio_reg()).
The series:
1/7 b43: add firmware and initvals names for rev22
2/7 b43: add d11 core revision 0x16 to id table
3/7 b43: route d11 corerev 22 to 24-bit indirect radio access
4/7 b43: support radio 2057 rev 8
5/7 b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8
6/7 b43: add channel info table for N-PHY r8 + radio 2057 r8
7/7 b43: add RF power offset for N-PHY r8 + radio 2057 r8
Patches almost reveal the bringup, the first two are swapped, as
applying 2/7 without 1/7 generate an immediate kernel panic caused
by a null deref.
From the third, each one fixes the next visible failure
in bring-up: 3/7 lets phy versioning read coherent radio identifiers,
4/7 unblocks the boot-time radio calibration that otherwise stalls,
and 5/7-7/7 fill the remaining 2.4 GHz dispatcher entries so
b43_nphy_set_channel completes to the default channel and core_init
proceeds past PHY init.
Tested on a D-Link DSL-3580L (Broadcom BCM6362 SoC, single-die 2.4 GHz
N-PHY rev 8 + radio 2057 rev 8 in 2.4 GHz IPA mode).
b43 is currently Orphan in MAINTAINERS. These patches do not add a
new chip family or PHY infrastructure; they fill four explicit
dispatcher gaps for a combination of an already-supported PHY and
an already-supported radio.
CHANGELOG:
v2:
- Recovered the first patch of the series, so numbering is now /7
- Added Assisted-By header
v1:
https://lore.kernel.org/linux-wireless/8c0a07d2-9ec9-43d6-bdf7-f625bbb4a38a@mythread.it/
Signed-off-by: Alessio <alessio.ferri@mythread.it>
---
Alessio Ferri (7):
b43: add firmware mappings and remove comments wondering about
rev22 initvals b43: add d11 core revision 0x16 to id table
b43: route d11 corerev 22 to 24-bit indirect radio access
b43: support radio 2057 rev 8
b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8
b43: add channel info table for N-PHY r8 + radio 2057 r8
b43: add RF power offset for N-PHY r8 + radio 2057 r8
drivers/net/wireless/broadcom/b43/main.c | 22 ++-
drivers/net/wireless/broadcom/b43/radio_2057.c | 230
++++++++++++++++++++++--
drivers/net/wireless/broadcom/b43/tables_nphy.c | 58 ++++++ 3 files
changed, 290 insertions(+), 20 deletions(-) ---
base-commit: 8bc67e4db64aa72732c474b44ea8622062c903f0
change-id:
20260521-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-a3125f06e21e
--
^ permalink raw reply
* [PATCH] wifi: cfg80211: fix leak if split 6 GHz scanning fails
From: Fedor Pchelkin @ 2026-05-24 16:53 UTC (permalink / raw)
To: Johannes Berg, linux-wireless
Cc: Fedor Pchelkin, Tova Mussai, linux-kernel, lvc-project
rdev->int_scan_req is leaked if cfg80211_scan() fails [1]. It's supposed
to be released at ___cfg80211_scan_done() but this doesn't happen as
rdev->scan_req is NULL at that point, too, leading to the early return
from the freeing function. Anyway scan_done shouldn't ever be expected to
be called if triggering the scan has already failed.
Note that the similar pattern at cfg80211_scan_6ghz() looks okay since
int_scan_req is freed there on error in case first_part is being
processed. On the other side, when first_part is false - called directly
from ___cfg80211_scan_done() - the old int_scan_req is kept then and will
be freed afterwards.
[1]:
unreferenced object 0xffff8881161d0800 (size 512):
comm "wpa_supplicant", pid 379, jiffies 4294749765
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................
backtrace (crc c867fdb6):
kmemleak_alloc+0x89/0x90
__kmalloc_noprof+0x2fd/0x410
cfg80211_scan+0x133/0x730
nl80211_trigger_scan+0xc69/0x1cc0
genl_family_rcv_msg_doit+0x204/0x2f0
genl_rcv_msg+0x431/0x6b0
netlink_rcv_skb+0x143/0x3f0
genl_rcv+0x27/0x40
netlink_unicast+0x4f6/0x820
netlink_sendmsg+0x797/0xce0
__sock_sendmsg+0xc4/0x160
____sys_sendmsg+0x5e4/0x890
___sys_sendmsg+0xf8/0x180
__sys_sendmsg+0x136/0x1e0
__x64_sys_sendmsg+0x76/0xc0
x64_sys_call+0x13f0/0x17d0
Found by Linux Verification Center (linuxtesting.org).
Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
---
net/wireless/scan.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 358cbc9e43d8..fe7b47d046c7 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1071,6 +1071,7 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev)
struct cfg80211_scan_request_int *request;
struct cfg80211_scan_request_int *rdev_req = rdev->scan_req;
u32 n_channels = 0, idx, i;
+ int err;
if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ)) {
rdev_req->req.first_part = true;
@@ -1101,7 +1102,12 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev)
rdev_req->req.scan_6ghz = false;
rdev_req->req.first_part = true;
rdev->int_scan_req = request;
- return rdev_scan(rdev, request);
+ err = rdev_scan(rdev, request);
+ if (err) {
+ kfree(rdev->int_scan_req);
+ rdev->int_scan_req = NULL;
+ }
+ return err;
}
void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
--
2.53.0
^ permalink raw reply related
* wifi: rtw89: 8851bu: add Mercusys MA60XNB (2c4e:0128)
From: Guillermo Servera Negre @ 2026-05-24 13:38 UTC (permalink / raw)
To: linux-wireless
Hi,
The Mercusys MA60XNB (AX900 Nano USB WiFi 6 adapter) works with the rtw89_8851bu driver but its USB ID (2c4e:0128) is not in the device table. Windows identifies the chipset as RTL8851BU.
Adding the following entry to rtw_8851bu_id_table in rtw8851bu.c makes the adapter fully functional:
{ USB_DEVICE_AND_INTERFACE_INFO(0x2C4E, 0x0128, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&rtw89_8851bu_info },
Tested on Fedora 44 with kernel 7.0.8-200.fc44.x86_64 and linux-firmware 20260410-1.fc44.
USB device details:
idVendor 0x2c4e Mercucys INC
idProduct 0x0128
iProduct 2 802.11ax WLAN Adapter
iManufacturer 1 Realtek
bcdUSB 2.00
bNumInterfaces 3
Thanks,
Guillem
^ permalink raw reply
* Re: iwlwifi: HE not negotiated on Wi-Fi 7 BE201 (iwlmld, kernel 7.0.9)
From: Michael Blake @ 2026-05-24 6:50 UTC (permalink / raw)
To: Emmanuel Grumbach; +Cc: linux-wireless
In-Reply-To: <CANUX_P3v7Ecf_C=OUiLk-UZZFevLVTe_1uByEN4C6hLzox3Gaw@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2734 bytes --]
Hi Emmanuel,
Thanks for the quick response.
Before answering, one new observation that may unify the two issues
you split into separate bugs: I have data across several boots
suggesting the cTDP_CONFIG_CMD firmware crash, HE non-engagement, and
the 6 GHz band invisibility (which I separately reported at
https://lore.kernel.org/linux-wireless/CAAecyrURg5npc+coGw7nG58EMUoM2wu1rao0EGL3cV8CqcVA-g@mail.gmail.com/)
all appear to be the same single problem.
Across the last 5 boots on this BE201:
Boot | cTDP crash | HE on assoc | 6 GHz Band exposed
-----------+------------+-------------+-------------------
today A | no | yes | yes
today B | no | yes | yes
yesterday | no | (untested) | (untested)
yesterday | YES | no (VHT/HT) | no (only Band 2)
yesterday | YES | no (HT) | no
When the firmware boots clean (~60% of boots), HE engages on
association and Band 4 (6 GHz) appears in `iw phy phy0 info`. When
the cTDP crash fires (~40% of boots) the driver recovers enough to
associate but HE is never negotiated and 6 GHz channels are not
exposed to userspace.
So there is most likely one root cause -- the post-crash recovery
state -- not three independent bugs. Let me know whether you'd still
prefer separate bugzilla entries (firmware crash and HE non-assoc) or
a single one that frames them together. Happy to file either way.
> Can you attach the full message?
> Or even better, open a bug on bugzilla.kernel.org.
> Pick the drivers network wireless intel as the componen.
Full dmesg from boot 2026-05-23 16:21 (a crash boot) is attached as
`firmware-crash-dmesg-2026-05-23-boot-3.log` (212 lines). I will also
file this on bugzilla.kernel.org under
drivers / network-wireless / intel and link the bug here once it's
filed.
> > Is HE expected to engage on BE201 with the current iwlmld driver?
> > Happy to capture more detailed logs (mac80211 trace, iwlwifi debug
> > masks, association IE dumps) or test patches if useful.
>
> That would be another bug.
> You can run
> trace-cmd record -T -e iwlwifi -e iwlwifi_dbg -e mac80211 -e cfg80211
> and provide the trace.dat file it'll create.
Will do. trace-cmd isn't installed yet on this machine -- I'll
install it and capture trace.dat the next time the firmware crashes
(can't easily reproduce HE non-engagement on a clean boot since HE
engages by default there). Given the ~40% crash rate, a few reboots
after install should produce a captured trace.
Kernel/firmware unchanged from the original report:
Kernel: 7.0.9-arch1-1
Firmware: 101.6e695a70.0 bz-b0-fm-c0-c101.ucode op_mode iwlmld
linux-firmware: 20260410
Thanks,
--
Michael Blake
mgblake7@gmail.com
[-- Attachment #2: firmware-crash-dmesg-2026-05-23-boot-3.log --]
[-- Type: text/x-log, Size: 18509 bytes --]
May 23 16:21:56 omarchy kernel: iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
May 23 16:21:57 omarchy kernel: iwlwifi 0000:00:14.3: Detected crf-id 0x2001910, cnv-id 0x80930 wfpm id 0x80005b20
May 23 16:21:57 omarchy kernel: iwlwifi 0000:00:14.3: PCI dev 7740/00e4, rev=0x461, rfid=0x20112200
May 23 16:21:57 omarchy kernel: iwlwifi 0000:00:14.3: Detected Intel(R) Wi-Fi 7 BE201 320MHz
May 23 16:21:57 omarchy kernel: iwlwifi 0000:00:14.3: loaded firmware version 101.6e695a70.0 bz-b0-fm-c0-c101.ucode op_mode iwlmld
May 23 16:21:57 omarchy kernel: iwlwifi 0000:00:14.3: Detected RF FM, rfid=0x20112200
May 23 16:21:57 omarchy kernel: iwlwifi 0000:00:14.3: base HW address: 00:72:ee:ab:e8:de
May 23 16:21:58 omarchy kernel: soundwire_generic_allocation x86_pkg_temp_thermal snd_soc_sdw_utils snd_soc_acpi snd_hwdep ptp intel_powerclamp soundwire_bus pps_core snd_soc_sdca libarc4 processor_thermal_device_pci snd_soc_core coretemp snd_hda_scodec_cs35l41_spi processor_thermal_device snd_hda_scodec_cs35l41_i2c uvcvideo processor_thermal_wt_hint snd_hda_scodec_cs35l41 snd_compress platform_temperature_control videobuf2_vmalloc ac97_bus processor_thermal_soc_slider btusb snd_soc_cs_amp_lib uvc asus_nb_wmi snd_pcm_dmaengine processor_thermal_rfim iwlwifi videobuf2_memops btmtk snd_soc_cs35l41_lib intel_rapl_msr kvm_intel snd_pcm processor_thermal_rapl btrtl iTCO_wdt videobuf2_v4l2 asus_armoury intel_pmc_bxt mei_gsc_proxy snd_timer intel_rapl_common videobuf2_common ucsi_acpi btbcm hid_multitouch cs_dsp cfg80211 kvm firmware_attributes_class spi_nor i2c_i801 snd btintel processor_thermal_wt_req videodev asus_wmi mei_me processor_thermal_power_floor typec_ucsi soundcore intel_ish_ipc i2c_smbus irqbypass rapl intel_cstate bluetooth mc
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Microcode SW error detected. Restarting 0x0.
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Transport status: 0x0000004B, valid: 6
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Loaded firmware version: 101.6e695a70.0 bz-b0-fm-c0-c101.ucode
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00A002F0 | trm_hw_status0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | trm_hw_status1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002C3EAE | branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002B963C | interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002B963C | interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00015A22 | data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000010 | data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | beacon time
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0002A830 | tsf low
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tsf hi
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | time gp1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0006A583 | time gp2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000001 | uCode revision type
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000065 | uCode version major
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x6E695A70 | uCode version minor
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00080930 | hw version
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x18C80002 | board version
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x8002FD1B | hcmd
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00020000 | isr0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x20000000 | isr1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x58F00082 | isr2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00C0000C | isr3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x02200000 | isr4
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | last cmd Id
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00015A22 | wait_event
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_control
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_duration
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_mhvalid
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_addr_match
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000009 | lmpm_pmg_sel
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | timestamp
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0000082C | flow_handler
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Transport status: 0x0000004B, valid: 6
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Loaded firmware version: 101.6e695a70.0 bz-b0-fm-c0-c101.ucode
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000002F0 | trm_hw_status0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | trm_hw_status1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002C3EAE | branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002B963C | interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002B963C | interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002A715E | data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000010 | data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | beacon time
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0002A839 | tsf low
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tsf hi
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | time gp1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0006A58C | time gp2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000001 | uCode revision type
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000065 | uCode version major
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x6E695A70 | uCode version minor
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00080930 | hw version
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x18C80002 | board version
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x8008FF05 | hcmd
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00020000 | isr0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x60000000 | isr1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x58F80082 | isr2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00C0001C | isr3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x02000000 | isr4
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | last cmd Id
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x002A715E | wait_event
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_control
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_duration
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_mhvalid
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | l2p_addr_match
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0000000B | lmpm_pmg_sel
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | timestamp
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0000082C | flow_handler
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Start IWL Error Log Dump:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Transport status: 0x0000004B, valid: 7
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x20103416 | ADVANCED_SYSASSERT
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | umac branchlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xC00808AE | umac branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xC008201C | umac interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0101C30C | umac interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0D79435E | umac data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | umac data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | umac data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000065 | umac major
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x6E695A70 | umac minor
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0006A57A | frame pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xD00D6E28 | stack pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00090403 | last host cmd
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | isr status reg
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: TCM1 status:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000070 | error ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00002452 | tcm branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001980 | tcm interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001980 | tcm interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x40000000 | tcm data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | tcm data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | tcm data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000024D0 | tcm log PC
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803FF0 | tcm frame pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803F5C | tcm stack pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm msg ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x4008000A | tcm ISR status
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00A002F0 | tcm HW status[0]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm HW status[1]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm HW status[2]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00008100 | tcm HW status[3]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm HW status[4]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00490000 | tcm SW status[0]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: RCM1 status:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000070 | error ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000015D6 | rcm branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000880 | rcm interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000880 | rcm interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x20000000 | rcm data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | rcm data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | rcm data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001640 | rcm log PC
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803FF0 | rcm frame pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803F5C | rcm stack pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | rcm msg ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x20000000 | rcm ISR status
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00020400 | frame HW status
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | LMAC-to-RCM request mbox
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | RCM-to-LMAC request mbox
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | MAC header control
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | MAC header addr1 low
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x003C0000 | MAC header info
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | MAC header error
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: TCM2 status:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000070 | error ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00002452 | tcm branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001980 | tcm interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001980 | tcm interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x40000000 | tcm data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | tcm data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | tcm data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000024D0 | tcm log PC
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803FF0 | tcm frame pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803F5C | tcm stack pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm msg ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x40080000 | tcm ISR status
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000002F0 | tcm HW status[0]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm HW status[1]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm HW status[2]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00008000 | tcm HW status[3]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm HW status[4]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | tcm SW status[0]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: RCM2 status:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000070 | error ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000015D6 | rcm branchlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000880 | rcm interruptlink1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000880 | rcm interruptlink2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x20000000 | rcm data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | rcm data2
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xDEADBEEF | rcm data3
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001640 | rcm log PC
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803FF0 | rcm frame pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00803F5C | rcm stack pointer
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | rcm msg ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x20000000 | rcm ISR status
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00420500 | frame HW status
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | LMAC-to-RCM request mbox
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | RCM-to-LMAC request mbox
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | MAC header control
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | MAC header addr1 low
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x003C0000 | MAC header info
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | MAC header error
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: IML/ROM dump:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000B03 | IML/ROM error/state
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0000E798 | IML/ROM data1
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000080 | IML/ROM WFPM_AUTH_KEY_0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Fseq Registers:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x66A00000 | FSEQ_ERROR_CODE
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x80B10005 | FSEQ_TOP_INIT_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00A30000 | FSEQ_CNVIO_INIT_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0000AA15 | FSEQ_OTP_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x0000000F | FSEQ_TOP_CONTENT_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x4552414E | FSEQ_ALIVE_TOKEN
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00080930 | FSEQ_CNVI_ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x02001910 | FSEQ_CNVR_ID
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00080930 | CNVI_AUX_MISC_CHIP
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x02001910 | CNVR_AUX_MISC_CHIP
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00001BEF | CNVR_SCU_SD_REGS_SD_REG_DIG_DCDC_VTRIM
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00000000 | CNVR_SCU_SD_REGS_SD_REG_ACTIVE_VDIG_MIRROR
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00A30000 | FSEQ_PREV_CNVIO_INIT_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x00B10005 | FSEQ_WIFI_FSEQ_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0xFF37DF27 | FSEQ_BT_FSEQ_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x000000D2 | FSEQ_CLASS_TP_VERSION
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: UMAC CURRENT PC: 0xc0086538
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: LMAC1 CURRENT PC: 0xd0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: LMAC2 CURRENT PC: 0xd0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: UMAC CURRENT PC 1: 0xc008652e
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: TCM1 CURRENT PC: 0xd0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: RCM1 CURRENT PC: 0xd0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: RCM2 CURRENT PC: 0xd0
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: Function Scratch status:
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: 0x01010101 | Func Scratch
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: FW error in SYNC CMD CTDP_CONFIG_CMD
May 23 16:21:58 omarchy kernel: iwl_trans_pcie_send_hcmd+0x485/0x490 [iwlwifi f1f0d5ecdeea62a4e847bff963cd924df1de8463]
May 23 16:21:58 omarchy kernel: iwl_trans_send_cmd+0x3c/0xa0 [iwlwifi f1f0d5ecdeea62a4e847bff963cd924df1de8463]
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: cTDP command failed (err=-5)
May 23 16:21:58 omarchy kernel: iwlwifi 0000:00:14.3: WRT: Collecting data: ini trigger 4 fired (delay=0ms).
^ permalink raw reply
* iwlwifi AX210 JP 6 GHz VLP client restriction hides Pixel 8 hotspot BSS
From: mikairyuu @ 2026-05-23 23:48 UTC (permalink / raw)
To: linux-wireless
Hi,
I filed the following iwlwifi bug with full logs and a local diagnostic patch:
https://bugzilla.kernel.org/show_bug.cgi?id=221568
Short summary: AX210 in JP marks lower 6 GHz channels as
NO_6GHZ_VLP_CLIENT. A Pixel 8 hotspot advertises a VLP AP on 5975 MHz;
cfg80211 receives the BSS but sets use_for=0 and
cannot_use_reasons=6GHZ_PWR_MISMATCH, so nl80211 hides it. Clearing
NL80211_RRF_NO_6GHZ_VLP_CLIENT in iwl_nvm_get_regdom_bw_flags() makes
the BSS visible and the station associates.
Could someone please verify whether JP lower 6 GHz should allow VLP
client operation on AX210, or whether Intel LAR/NVM data intentionally
forbids it?
Thanks.
^ permalink raw reply
* Re: iwlwifi: HE not negotiated on Wi-Fi 7 BE201 (iwlmld, kernel 7.0.9)
From: Emmanuel Grumbach @ 2026-05-23 20:26 UTC (permalink / raw)
To: Michael Blake; +Cc: linux-wireless
In-Reply-To: <CAAecyrWNVtgywvchgHe1XLoGKcubEm_pgSQiv+i=6F4zdQhStQ@mail.gmail.com>
Hi,
>
> Hi,
>>
> iwlwifi 0000:00:14.3: Detected Intel(R) Wi-Fi 7 BE201 320MHz
> iwlwifi 0000:00:14.3: loaded firmware version 101.6e695a70.0
> bz-b0-fm-c0-c101.ucode op_mode iwlmld
> iwlwifi 0000:00:14.3: Microcode SW error detected. Restarting 0x0.
> iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL
> iwlwifi 0000:00:14.3: FW error in SYNC CMD CTDP_CONFIG_CMD
> iwlwifi 0000:00:14.3: cTDP command failed (err=-5)
>
Can you attach the full message?
Or even better, open a bug on bugzilla.kernel.org.
Pick the drivers network wireless intel as the componen.
> Is HE expected to engage on BE201 with the current iwlmld driver?
> Happy to capture more detailed logs (mac80211 trace, iwlwifi debug
> masks, association IE dumps) or test patches if useful.
>
That would be another bug.
You can run
trace-cmd record -T -e iwlwifi -e iwlwifi_dbg -e mac80211 -e cfg80211
and provide the trace.dat file it'll create.
^ permalink raw reply
* [PATCH] wifi: iwlwifi: mvm: handle SEC_UNKNOWN in non-AMPDU rx path
From: Mike Bommarito @ 2026-05-23 14:24 UTC (permalink / raw)
To: Miri Korenblit; +Cc: Johannes Berg, linux-wireless, linux-kernel
iwl_mvm_rx_crypto() does not handle IWL_RX_MPDU_STATUS_SEC_UNKNOWN
explicitly in the non-AMPDU path: the switch's default case fires
"Unhandled alg: 0x71b" for what the firmware documents as a benign
condition (a cipher class not enumerated in the RX status field, or
frames arriving before key install). On a Meteor Lake laptop with
an AX210 this produced 152 warnings across ~43.5 hours of normal
use; net_ratelimit spaced them out but did not silence them. The
AMPDU sibling path at the top of the function already handles this
status explicitly.
Add an explicit SEC_UNKNOWN case that breaks to the final return 0
(passing the frame undecrypted to mac80211, matching the default's
effective behavior), with a dev_info_once() so the condition stays
observable at default log levels without per-frame spam, and an
IWL_DEBUG_DROP per occurrence mirroring the AMPDU handler. Behavior
for every other status value is unchanged.
Link: https://lore.kernel.org/all/0e1a890d2896791d7291f0174cc0e96832d7ed33.camel@intel.com/
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Mike Bommarito <michael.bommarito@gmail.com>
---
Historical context (for reviewers, not the changelog)
The same warning was reported on Intel 9260 in 2019 [1]. Emmanuel
Grumbach acknowledged then that "this print is harmless really",
attributed it to a deprecated firmware flag, and suggested two
fixes: "remove the warning message entirely or limit it to unicast
packets only -- this has been merged in our internal repository and
it will be upstreamed following the regular process." The unicast
restriction is now in tree (the default case guards on
!is_multicast_ether_addr() && net_ratelimit()), but the
remove-the-warning half never landed upstream.
This patch is the narrower of Grumbach's two suggestions: only
IWL_RX_MPDU_STATUS_SEC_UNKNOWN is special-cased, the existing
default-case warning is preserved for genuinely unknown status
values.
Test data
Pre-patch baseline on Framework Laptop 13 (Intel Core Ultra 5 125H,
AX210, Linux 7.1-rc4): 152 "Unhandled alg: 0x71b" entries in dmesg
across ~43.5 hours of mixed use, plus a burst of three within 70 ms
during a single re-association:
[162152.782317] iwlwifi 0000:aa:00.0: Unhandled alg: 0x71b
[162152.813440] iwlwifi 0000:aa:00.0: Unhandled alg: 0x71b
[162152.844499] iwlwifi 0000:aa:00.0: Unhandled alg: 0x71b
Status decoding: 0x71b & 0x700 == SEC_UNKNOWN; low bits are
informational and vary between frames.
Post-patch: module rebuilt + reloaded. Triggered scans and
nmcli reconnect cycles until a SEC_UNKNOWN frame was received.
The new switch case fired its dev_info_once exactly once:
iwlwifi 0000:aa:00.0: RX SEC_UNKNOWN (status=0x707)
Zero "Unhandled alg" warnings observed during the same window.
A CONFIG_IWLWIFI_DEBUG=y build with IWL_DL_DROP enabled would
additionally show one IWL_DEBUG_DROP per qualifying frame; the
test kernel had CONFIG_IWLWIFI_DEBUG=n so those entries are absent
but the dev_info_once carries the per-controller signature.
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 7f0b4f5daa21..f36e99c90ee3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -494,6 +494,19 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
return 0;
case RX_MPDU_RES_STATUS_SEC_CMAC_GMAC_ENC:
break;
+ case IWL_RX_MPDU_STATUS_SEC_UNKNOWN:
+ /*
+ * Firmware-indicated unknown cipher; the AMPDU case is
+ * already handled at the top of this function. For
+ * non-AMPDU frames this is valid (cipher not enumerated
+ * by the RX status field, or frame before key install).
+ * Pass undecrypted to mac80211.
+ */
+ dev_info_once(mvm->dev,
+ "RX SEC_UNKNOWN (status=0x%x)\n", status);
+ IWL_DEBUG_DROP(mvm,
+ "RX SEC_UNKNOWN (status=0x%x)\n", status);
+ break;
default:
/*
* Sometimes we can get frames that were not decrypted
--
2.53.0
^ permalink raw reply related
* Re: [PATCH mt76 v2 7/7] wifi: mt76: mt7996: fix iface combination for different chipsets
From: Ilya K @ 2026-05-23 13:09 UTC (permalink / raw)
To: shayne.chen
Cc: evelyn.tsai, linux-mediatek, linux-wireless, lorenzo, nbd,
ryder.lee
In-Reply-To: <20251215063728.3013365-7-shayne.chen@mediatek.com>
Hey folks, this looks like it broke mt7996 init entirely with stable kernel 7.0.10.
Specifically it trips this check in net/wireless/core.c:681:
if (WARN_ON(types & BIT(NL80211_IFTYPE_ADHOC) &&
c->beacon_int_min_gcd)) {
return -EINVAL;
}
I'm not sure what the correct fix here is, but unsetting beacon_int_min_gcd at least makes AP mode work again...
^ permalink raw reply
* iwlwifi: 6 GHz band not exposed on BE201 in ZA regulatory domain
From: Michael Blake @ 2026-05-23 8:33 UTC (permalink / raw)
To: linux-wireless
Hi,
The Intel Wi-Fi 7 BE201 card does not expose any 6 GHz channels in
country code ZA (South Africa), even though:
- The global regdomain authorises 6 GHz operation in ZA
- The card's self-managed regdomain table includes a 6 GHz entry
- The hardware supports 6 GHz
- A 6 GHz radio is operating in range (TP-Link Deco XE75)
Hardware / software:
PCI ID: 8086:7740 (Arrow Lake CNVi WiFi)
Card: Intel Wi-Fi 7 BE201 320 MHz
Driver: iwlwifi + iwlmld
Kernel: 7.0.9-arch1-1
Firmware: 101.6e695a70.0 bz-b0-fm-c0-c101.ucode op_mode iwlmld
linux-firmware: 20260410
Regulatory state (`iw reg get`):
global
country ZA: DFS-ETSI
(2402 - 2482 @ 40), (N/A, 20), (N/A)
(5170 - 5250 @ 80), (N/A, 20), (N/A), AUTO-BW
(5250 - 5330 @ 80), (N/A, 20), (0 ms), DFS, AUTO-BW
(5490 - 5710 @ 160), (N/A, 30), (N/A)
(5925 - 6425 @ 320), (N/A, 14), (N/A)
phy#0 (self-managed)
country ZA: DFS-UNSET
[2.4 GHz and 5 GHz channels listed, omitted for brevity]
(5945 - 6425 @ 480), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW,
IR-CONCURRENT, PASSIVE-SCAN
The phy's self-managed regdomain lists 6 GHz frequencies in its
output, but `iw phy phy0 info` shows only Band 1 (2.4 GHz) and Band 2
(5 GHz). There is no Band 3. No 6 GHz frequencies are listed under
either Band 1 or Band 2.
This means no 6 GHz channels can be scanned or associated with, and
the neighbouring 6 GHz radio is invisible to the card. iPhone clients
in the same location can see and use the 6 GHz radio.
Is enabling 6 GHz for ZA on Bz / BE2xx-family cards waiting on:
(a) a country-code table update in iwlmld (or wherever the driver
whitelists 6 GHz enablement),
(b) a card NVM/OTP regulatory data update from Intel firmware, or
(c) something else?
Happy to provide additional debug info (full `iw phy phy0 info`,
dmesg with cfg80211 debug enabled, NVM dump if useful) or test
patches.
Thanks,
--
Michael Blake
mgblake7@gmail.com
^ permalink raw reply
* iwlwifi: HE not negotiated on Wi-Fi 7 BE201 (iwlmld, kernel 7.0.9)
From: Michael Blake @ 2026-05-23 8:28 UTC (permalink / raw)
To: linux-wireless
Hi,
On an Intel Wi-Fi 7 BE201 card with the iwlmld driver, associations
never negotiate HE (802.11ax) rates despite both the card and the AP
supporting HE. Connections come up as HT-MCS on 2.4 GHz and VHT-MCS on
5 GHz. HE-MCS rates are never observed in `iw dev wlan0 link` output.
Hardware:
PCI ID: 8086:7740 (Arrow Lake CNVi WiFi)
Subsystem: 8086:00e4
Card: Intel Wi-Fi 7 BE201 320 MHz (per dmesg)
MIMO: 2x2 (Available Antennas: TX 0x3 RX 0x3)
Driver: iwlwifi + iwlmld
Software:
Kernel: 7.0.9-arch1-1 (Arch Linux, mainline)
linux-firmware: 20260410
Firmware loaded: 101.6e695a70.0 bz-b0-fm-c0-c101.ucode op_mode iwlmld
NetworkManager: 1.56.1
Tested backends: iwd 3.12 and wpa_supplicant 2:2.11-5
Module parameters at runtime (no userspace blockers):
disable_11ac: N
disable_11ax: N
disable_11be: N
power_save: N
AP details:
TP-Link Deco XE75 mesh, both BSSes broadcasting the same SSID:
2.4 GHz BSS (ch 3, 40 MHz): HE40/2.4GHz advertised, HE Operation
and HE Capability IEs present
5 GHz BSS (ch 36, 80 MHz): HE advertised, HE Operation IE present
iPhone clients in the same location negotiate HE successfully.
Reproducer:
Connect to either BSS through NetworkManager (with either
wpa_supplicant or iwd as the backend). Association succeeds and is
stable, but rate selection never reaches HE-MCS rates.
Observed link state:
# 2.4 GHz BSS, iwd backend
rx bitrate: 300.0 MBit/s MCS 15 40MHz short GI
tx bitrate: 144.4 MBit/s MCS 15 short GI
# 2.4 GHz BSS, wpa_supplicant backend
rx bitrate: 300.0 MBit/s MCS 15 40MHz short GI
tx bitrate: 104.0 MBit/s MCS 13
# 5 GHz BSS, wpa_supplicant backend
rx bitrate: 351.0 MBit/s VHT-MCS 4 160MHz VHT-NSS 1
tx bitrate: 260.0 MBit/s VHT-MCS 5 80MHz short GI VHT-NSS 1
Expected:
HE-MCS rates in the bitrate output, consistent with card and AP HE
capabilities. Tested over many minutes of sustained traffic so this
is not transient minstrel_ht warm-up.
Additional observation, possibly related: dmesg shows a firmware
crash and restart on the cTDP config command at every boot. The
driver recovers and the device operates normally, but this may
indicate a wider issue with the BE201 firmware path:
iwlwifi 0000:00:14.3: Detected Intel(R) Wi-Fi 7 BE201 320MHz
iwlwifi 0000:00:14.3: loaded firmware version 101.6e695a70.0
bz-b0-fm-c0-c101.ucode op_mode iwlmld
iwlwifi 0000:00:14.3: Microcode SW error detected. Restarting 0x0.
iwlwifi 0000:00:14.3: 0x00000071 | NMI_INTERRUPT_UMAC_FATAL
iwlwifi 0000:00:14.3: FW error in SYNC CMD CTDP_CONFIG_CMD
iwlwifi 0000:00:14.3: cTDP command failed (err=-5)
Is HE expected to engage on BE201 with the current iwlmld driver?
Happy to capture more detailed logs (mac80211 trace, iwlwifi debug
masks, association IE dumps) or test patches if useful.
Thanks,
--
Michael Blake
mgblake7@gmail.com
^ permalink raw reply
* Re: [PATCH] wifi: mt76: disable rx napi before queue cleanup
From: Sean Wang @ 2026-05-22 21:42 UTC (permalink / raw)
To: Ruslan Isaev
Cc: linux-wireless, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang
In-Reply-To: <79943c87-b920-4ef8-a471-61b03792e097@gmail.Com>
Hi,
On Sun, May 17, 2026 at 5:46 PM Ruslan Isaev <legale.legale@gmail.com> wrote:
>
> Gentle ping for review
>
> May 11, 2026 02:58:02 Ruslan Isaev <legale.legale@gmail.com>:
>
> > mt76_dma_cleanup() already disables tx napi before deleting it, but
> > it still removes rx napi instances while they can remain enabled on the
> > normal device remove path. On mt7915 this triggers a warning.
> >
> > Disable each rx napi instance before netif_napi_del() and page pool
> > destruction. This fixes repeated warnings on rmmod mt7915e on
> > mt7915e/mt7981b.
> >
> > Signed-off-by: Ruslan Isaev <legale.legale@gmail.com>
> > ---
> > drivers/net/wireless/mediatek/mt76/dma.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
> > index f8c2fe5f2..12183142f 100644
> > --- a/drivers/net/wireless/mediatek/mt76/dma.c
> > +++ b/drivers/net/wireless/mediatek/mt76/dma.c
> > @@ -1189,6 +1189,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
> > mt76_for_each_q_rx(dev, i) {
> > struct mt76_queue *q = &dev->q_rx[i];
> >
> > + napi_disable(&dev->napi[i]);
> > netif_napi_del(&dev->napi[i]);
> > mt76_dma_rx_cleanup(dev, q);
I do not think this is safe as-is.
1. I tested this on mt7925, and removing the module causes a machine
hang. I found that we can end up disabling NAPI twice on mt7921 and
mt7925. If we still need this patch, it
should be fixed together with the mt7921/mt7925 cleanup paths.
2. mt76_dma_init() skips WED RRO queues when adding RX NAPI, but
this patch disables NAPI for every allocated RX queue during cleanup.
On mt7996/mt7992 HWRRO, WED RRO queues may have
ndesc != 0, so cleanup can call napi_disable() on queues where
mt76 never added/enabled NAPI.
Please make the cleanup path use the same condition as init, for
example by skipping NAPI operations for mt76_queue_is_wed_rro(q), or
by adding a shared helper for the init/cleanup
condition.
> >
> > --
> > 2.39.5
>
^ permalink raw reply
* Re: [PATCH] wifi: mt76: mt7996: avoid memset overwriting tx_info->control.flags
From: Sean Wang @ 2026-05-22 20:35 UTC (permalink / raw)
To: Ryder Lee
Cc: lorenzo.bianconi83@gmail.com, roychl666@gmail.com,
linux-wireless@vger.kernel.org, nbd@nbd.name, lorenzo@kernel.org,
Shayne Chen (陳軒丞),
linux-mediatek@lists.infradead.org, Roy-CH Luo
In-Reply-To: <1e1318a9230533c63c31aecbaddf520b6f68affd.camel@mediatek.com>
Hi,
On Tue, May 19, 2026 at 3:43 PM Ryder Lee <Ryder.Lee@mediatek.com> wrote:
>
> On Tue, 2026-05-19 at 14:24 +0200, Lorenzo Bianconi wrote:
> >
> > External email : Please do not click links or open attachments until
> > you have verified the sender or the content.
> >
> >
> > >
> > > On Mon, May 18, 2026 at 5:31 AM Lorenzo Bianconi
> > > <lorenzo@kernel.org> wrote:
> > > >
> > > > On May 15, Cheng Hao Luo wrote:
> > > > > > struct ieee80211_tx_info {
> > > > > > u32 flags;
> > > > > > /* 0 4 */
> > > > > > u32 band:3;
> > > > > > /* 4: 0 4 */
> > > > > > u32 status_data_idr:1;
> > > > > > /* 4: 3 4 */
> > > > > > u32 status_data:13;
> > > > > > /* 4: 4 4 */
> > > > > > u32 hw_queue:4;
> > > > > > /* 4:17 4 */
> > > > > > u32 tx_time_est:10;
> > > > > > /* 4:21 4 */
> > > > > >
> > > > > > /* XXX 1 bit hole, try to pack */
> > > > > >
> > > > > > union {
> > > > > > struct {
> > > > > > union {
> > > > > > struct {
> > > > > > struct
> > > > > > ieee80211_tx_rate rates[4]; /* 8 12 */
> > > > > > s8
> > > > > > rts_cts_rate_idx; /* 20 1 */
> > > > > > u8 use_rts:1;
> > > > > > /* 21: 0 1 */
> > > > > > u8
> > > > > > use_cts_prot:1; /* 21: 1 1 */
> > > > > > u8
> > > > > > short_preamble:1; /* 21: 2 1 */
> > > > > > u8 skip_table:1;
> > > > > > /* 21: 3 1 */
> > > > > > u8 antennas:2;
> > > > > > /* 21: 4 1 */
> > > > > > };
> > > > > > /* 8 14 */
> > > > > > long unsigned int jiffies;
> > > > > > /* 8 8 */
> > > > > > };
> > > > > > /* 8 16 */
> > > > > > struct ieee80211_vif * vif;
> > > > > > /* 24 8 */
> > > > > > struct ieee80211_key_conf * hw_key;
> > > > > > /* 32 8 */
> > > > > > u32 flags;
> > > > > > /* 40 4 */
> > > > > > codel_time_t enqueue_time;
> > > > > > /* 44 4 */
> > > > > > } control;
> > > > > > /* 8 40 */
> > > > > > struct {
> > > > > > u64 cookie;
> > > > > > /* 8 8 */
> > > > > > } ack;
> > > > > > /* 8 8 */
> > > > > > struct {
> > > > > > struct ieee80211_tx_rate rates[4];
> > > > > > /* 8 12 */
> > > > > > s32 ack_signal;
> > > > > > /* 20 4 */
> > > > > > u8 ampdu_ack_len;
> > > > > > /* 24 1 */
> > > > > > u8 ampdu_len;
> > > > > > /* 25 1 */
> > > > > > u8 antenna;
> > > > > > /* 26 1 */
> > > > > > u8 pad;
> > > > > > /* 27 1 */
> > > > > > u16 tx_time;
> > > > > > /* 28 2 */
> > > > > > u8 flags;
> > > > > > /* 30 1 */
> > > > > > u8 pad2;
> > > > > > /* 31 1 */
> > > > > > void * status_driver_data[2];
> > > > > > /* 32 16 */
> > > > > > } status;
> > > > > > /* 8 40 */
> > > > > > struct {
> > > > > > struct ieee80211_tx_rate
> > > > > > driver_rates[4]; /* 8 12 */
> > > > > > u8 pad[4];
> > > > > > /* 20 4 */
> > > > > > void * rate_driver_data[3];
> > > > > > /* 24 24 */
> > > > > > };
> > > > > > /* 8 40 */
> > > > > > void * driver_data[5];
> > > > > > /* 8 40 */
> > > > > > };
> > > > > > /* 8 40 */
> > > > > >
> > > > > > /* size: 48, cachelines: 1, members: 7 */
> > > > > > /* sum members: 44 */
> > > > > > /* sum bitfield members: 31 bits, bit holes: 1, sum
> > > > > > bit holes: 1 bits */
> > > > > > /* last cacheline: 48 bytes */
> > > > > > };
> > > > > >
> > > > > > According to pahole, the size of the control inner union is
> > > > > > actually 16 bytes
> > > > > > since the compiler adds 2 bytes of padding. Since
> > > > > > mt76_tx_status_skb_add()
> > > > > > meset to 0 just mt76_tx_cb size (that is 16 bytes) I can't
> > > > > > see how
> > > > > > control.flags is overwritten. Am I missing something?
> > > > > >
> > > > > > struct mt76_tx_cb {
> > > > > > long unsigned int jiffies;
> > > > > > /* 0 8 */
> > > > > > u16 wcid;
> > > > > > /* 8 2 */
> > > > > > u8 pktid;
> > > > > > /* 10 1 */
> > > > > > u8 flags;
> > > > > > /* 11 1 */
> > > > > >
> > > > > > /* size: 16, cachelines: 1, members: 4 */
> > > > > > /* padding: 4 */
> > > > > > /* last cacheline: 16 bytes */
> > > > > > };
> > > > >
> > > > > Hi Lorenzo,
> > > > >
> > > > > The mt76_tx_cb is placed at status.status_driver_data (offset
> > > > > 32).
> > > > > It overlaps with hw_key, flags and enqueue_time in the control
> > > > > union.
> > > > >
> > > > > static inline struct mt76_tx_cb *mt76_tx_skb_cb(struct sk_buff
> > > > > *skb)
> > > > > {
> > > > > BUILD_BUG_ON(sizeof(struct mt76_tx_cb) >
> > > > > sizeof(IEEE80211_SKB_CB(skb)->status.status_driver_data));
> > > > > return ((void *)IEEE80211_SKB_CB(skb)-
> > > > > >status.status_driver_data);
> > > > > }
> > > >
> > > > Hi Roy,
> > > >
> > > > I still do not understand since mt76_tx_status_skb_add() sets to
> > > > 0 just sizeof
> > > > of mt76_tx_cb, that according to pahole is 16 bytes, so it can't
> > > > overwrite
> > > > hw_key pointer (whose offset respect to the beginning of the
> > > > control struct is
> > > > 24, 32 - 8).
> > > >
> > > > Regards,
> > > > Lorenzo
> > > >
> > > > >
> > > > > Regards,
> > > > > Roy Luo
> > >
> > > Hi Lorenzo,
> > >
> > > The mt76_tx_status_skb_add() memset zero the 16 bytes starting from
> > > status.status_driver_data (please see the above inline function
> > > shared
> > > in my last response) whose offset with respect to the beginning of
> > > the control/status union is exactly 24 (32 - 8) instead of 0.
> > >
> > > Regards,
> > > Roy Luo
> >
> > Hi Roy,
> >
> > I can see the issue now, I was confusing status.status_driver_data
> > with
> > driver_data. You are right, we have an issue here. However, copying
> > all the
> > ieee80211_tx_info struct seems a bit overkill, what do you think?
> > Moreover, we have the same issue for various chipsets (e.g. mt7925
> > and
> > mt7915). I guess we should try to find a global solution for the
> > problem.
> >
> > Regards,
> > Lorenzo
>
> What about adding an helper for cb operation?
>
> +void
> +mt76_tx_status_skb_cb_add(struct mt76_dev *dev, struct sk_buff *skb,
> + struct mt76_wcid *wcid, int pid)
> +{
> + struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
> +
> + memset(cb, 0, sizeof(*cb));
> +
> + spin_lock_bh(&dev->status_lock);
> + cb->wcid = wcid->idx;
> + cb->pktid = pid;
> + spin_unlock_bh(&dev->status_lock);
> +}
> +EXPORT_SYMBOL_GPL(mt76_tx_status_skb_cb_add);
>
> And add this for each chipset.
>
> index 061ab66..d0b67a2 100644
> --- a/mt7996/mac.c
> +++ b/mt7996/mac.c
> @@ -1108,6 +1108,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev,
> void *txwi_ptr,
> if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
> mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb,
> wcid, key,
> pid, qid, 0);
> + mt76_tx_status_skb_cb_add(dev, tx_info->skb, wcid, pid);
>
>
I would prefer to split the cb init logic out of
mt76_tx_status_skb_add() and add a dedicated helper:
/*
* Must be called only after all TXWI/TXP code has consumed
* IEEE80211_SKB_CB(skb)->control, since this switches skb->cb to the
* mt76 tx status tracking overlay.
*/
void
mt76_tx_status_skb_init(struct mt76_dev *dev, struct mt76_wcid *wcid,
struct sk_buff *skb, int pktid)
{
struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
memset(cb, 0, sizeof(*cb));
if (wcid)
cb->wcid = wcid->idx;
cb->pktid = pktid;
}
EXPORT_SYMBOL_GPL(mt76_tx_status_skb_init);
Then
pid = mt76_tx_status_skb_add(...);
... write TXWI/TXP while info->control is still valid ...
mt76_tx_status_skb_init(...); to fix all drivers under mt76/
Reasons:
1. The helper does not need its own spinlock.
mt76_tx_status_skb_add() already protects the idr/list update with
status_lock; this helper only initializes the skb-local cb overlay.
2. wcid can be NULL on some paths, so the helper should guard against that.
3. mt76_tx_status_skb_init() should be called after
mt76_tx_status_skb_add() and after all TXWI/TXP write helpers in each
mt76 driver. The same skb cb aliasing issue can potentially affect all
drivers that consume IEEE80211_SKB_CB(skb)->control after calling
mt76_tx_status_skb_add().
4. The comment is useful because the ordering requirement is easy
to miss: mt76_tx_status_skb_init() clears the skb cb area used by
IEEE80211_SKB_CB(skb)->control, so it must run only after TXWI/TXP
setup has finished reading that control data.
^ permalink raw reply
* Re: [PATCH v2 3/6] net: mhi_net: Hold runtime PM during active data path operations
From: Loic Poulain @ 2026-05-22 20:09 UTC (permalink / raw)
To: Krishna Chaitanya Chundru
Cc: Manivannan Sadhasivam, Jeff Hugo, Carl Vanderlip, Oded Gabbay,
Jeff Johnson, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Sergey Ryazanov,
Johannes Berg, mhi, linux-arm-msm, linux-kernel, dri-devel,
linux-wireless, ath11k, ath12k, netdev, mayank.rana,
quic_vbadigan, vivek.pernamitta
In-Reply-To: <20260522-mhi_runtimepm-v2-3-fbebf41a82bb@oss.qualcomm.com>
Hi Krishna,
On Fri, May 22, 2026 at 12:01 PM Krishna Chaitanya Chundru
<krishna.chundru@oss.qualcomm.com> wrote:
>
> The mhi_net driver does not coordinate with runtime PM, which allows the
> underlying MHI controller to be runtime-suspended while transmit, receive,
> or RX buffer refill operations are in progress. This can lead to stalled
> transfers or failed queueing once runtime PM is enabled in the MHI core.
>
> Add runtime PM reference counting to the mhi_net data path to keep the
> controller active for the duration of TX, RX, and buffer management
> operations. Enable runtime PM during probe and take/release references
> explicitly around these critical paths.
>
> Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
> ---
> drivers/net/mhi_net.c | 39 +++++++++++++++++++++++++++++++++++++++
> 1 file changed, 39 insertions(+)
>
> diff --git a/drivers/net/mhi_net.c b/drivers/net/mhi_net.c
> index ae169929a9d8..5d7f9ccdb17b 100644
> --- a/drivers/net/mhi_net.c
> +++ b/drivers/net/mhi_net.c
> @@ -9,6 +9,7 @@
> #include <linux/mod_devicetable.h>
> #include <linux/module.h>
> #include <linux/netdevice.h>
> +#include <linux/pm_runtime.h>
> #include <linux/skbuff.h>
> #include <linux/u64_stats_sync.h>
>
> @@ -76,11 +77,19 @@ static netdev_tx_t mhi_ndo_xmit(struct sk_buff *skb, struct net_device *ndev)
> struct mhi_device *mdev = mhi_netdev->mdev;
> int err;
>
> + err = pm_runtime_get(&mdev->dev);
> + if (err < 0 && err != -EINPROGRESS) {
> + dev_err(&mdev->dev, "pm_runtime_get failed %d\n", err);
> + pm_runtime_put_noidle(&mdev->dev);
> + goto exit_drop;
> + }
> +
I am wondering what the value is in pushing this PM responsibility to
each individual MHI client driver and requiring every MHI operation to
be bracketed with runtime PM handling.
What does the client driver know here that the MHI core itself cannot
handle centrally? It feels like ensuring the controller is
runtime-active during transfer could be handled generically in the
framework instead of duplicating the same logic in every client.
> err = mhi_queue_skb(mdev, DMA_TO_DEVICE, skb, skb->len, MHI_EOT);
> if (unlikely(err)) {
> net_err_ratelimited("%s: Failed to queue TX buf (%d)\n",
> ndev->name, err);
> dev_kfree_skb_any(skb);
> + pm_runtime_put(&mdev->dev);
> goto exit_drop;
> }
>
> @@ -251,6 +260,7 @@ static void mhi_net_ul_callback(struct mhi_device *mhi_dev,
> /* MHI layer stopping/resetting the UL channel */
> if (mhi_res->transaction_status == -ENOTCONN) {
> u64_stats_update_end(&mhi_netdev->stats.tx_syncp);
> + pm_runtime_put(&mdev->dev);
> return;
> }
>
> @@ -261,6 +271,7 @@ static void mhi_net_ul_callback(struct mhi_device *mhi_dev,
> }
> u64_stats_update_end(&mhi_netdev->stats.tx_syncp);
>
> + pm_runtime_put(&mdev->dev);
> if (netif_queue_stopped(ndev) && !mhi_queue_is_full(mdev, DMA_TO_DEVICE))
> netif_wake_queue(ndev);
> }
> @@ -277,6 +288,12 @@ static void mhi_net_rx_refill_work(struct work_struct *work)
>
> size = mhi_netdev->mru ? mhi_netdev->mru : READ_ONCE(ndev->mtu);
>
> + err = pm_runtime_resume_and_get(&mdev->dev);
> + if (err) {
> + dev_err(&mdev->dev, "pm_runtime_resume_and_get failed %d\n", err);
> + return;
> + }
> +
> while (!mhi_queue_is_full(mdev, DMA_FROM_DEVICE)) {
> skb = netdev_alloc_skb(ndev, size);
> if (unlikely(!skb))
> @@ -296,6 +313,7 @@ static void mhi_net_rx_refill_work(struct work_struct *work)
> cond_resched();
> }
>
> + pm_runtime_put(&mdev->dev);
> /* If we're still starved of rx buffers, reschedule later */
> if (mhi_get_free_desc_count(mdev, DMA_FROM_DEVICE) == mhi_netdev->rx_queue_sz)
> schedule_delayed_work(&mhi_netdev->rx_refill, HZ / 2);
> @@ -362,20 +380,41 @@ static int mhi_net_probe(struct mhi_device *mhi_dev,
>
> SET_NETDEV_DEV(ndev, &mhi_dev->dev);
>
> + pm_runtime_no_callbacks(&mhi_dev->dev);
> + err = devm_pm_runtime_set_active_enabled(&mhi_dev->dev);
> + if (err)
> + return err;
> +
> + err = pm_runtime_resume_and_get(&mhi_dev->dev);
> + if (err) {
> + dev_err(&mhi_dev->dev, "pm_runtime_resume_and_get failed %d\n", err);
> + return err;
> + }
> +
> err = mhi_net_newlink(mhi_dev, ndev);
> if (err) {
> free_netdev(ndev);
> + pm_runtime_put(&mhi_dev->dev);
> return err;
> }
>
> + pm_runtime_put(&mhi_dev->dev);
> return 0;
> }
>
> static void mhi_net_remove(struct mhi_device *mhi_dev)
> {
> struct mhi_net_dev *mhi_netdev = dev_get_drvdata(&mhi_dev->dev);
> + int err;
> +
> + err = pm_runtime_resume_and_get(&mhi_dev->dev);
> + if (err)
> + dev_err(&mhi_dev->dev, "pm_runtime_resume_and_get failed %d\n", err);
>
> mhi_net_dellink(mhi_dev, mhi_netdev->ndev);
> +
> + if (!err)
> + pm_runtime_put(&mhi_dev->dev);
> }
>
> static const struct mhi_device_info mhi_hwip0 = {
>
> --
> 2.34.1
>
^ permalink raw reply
* b43-fwcutter release 020
From: Michael Büsch @ 2026-05-22 17:26 UTC (permalink / raw)
To: b43-dev, linux-wireless
[-- Attachment #1: Type: text/plain, Size: 377 bytes --]
b43-fwcutter - Firmware extraction tool for b43 wireless
It's been quite a while since the last release and a couple of changes have piled up.
The release consists mainly of some new extraction lists (thanks to all contributors!)
and compiler warning fixes.
https://github.com/mbuesch/b43-tools/releases/tag/b43-fwcutter-020
--
Michael Büsch
https://bues.ch/
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH 02/10] [v3] input: gpio-keys: make legacy gpiolib optional
From: Matti Vaittinen @ 2026-05-22 12:45 UTC (permalink / raw)
To: Arnd Bergmann, Arnd Bergmann, open list:GPIO SUBSYSTEM
Cc: linux-kernel, Christian Lamparter, Johannes Berg, Aaro Koskinen,
Andreas Kemnade, Kevin Hilman, Roger Quadros, Tony Lindgren,
Thomas Bogendoerfer, John Paul Adrian Glaubitz, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Linus Walleij, Bartosz Golaszewski, Dmitry Torokhov, Lee Jones,
Pavel Machek, Florian Fainelli, Jonas Gorski, Andrew Lunn,
Vladimir Oltean, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, linux-wireless, Linux-OMAP, linux-arm-kernel,
linux-mips, linux-sh, linux-input, linux-leds, Netdev
In-Reply-To: <681f328c-bc8a-4410-b876-f8c5f116325d@app.fastmail.com>
On 22/05/2026 11:28, Arnd Bergmann wrote:
> On Fri, May 22, 2026, at 06:55, Matti Vaittinen wrote:
>> On 20/05/2026 21:38, Arnd Bergmann wrote:
>>> From: Arnd Bergmann <arnd@arndb.de>
>>>
>>> The two Rohm PMIC drivers use a gpio-keys device without an actual GPIO,
>>> passing an IRQ number instead. In order to keep this working both with
>>> and with CONFIG_GPIOLIB_LEGACY, change the gpio-keys driver to ignore
>>> the gpio number if an IRQ is passed.
>>>
>>
>> I am (still) all fine with this, even though I like Dmitry's set. I
>> suppose you already have a plan for merging this, but I still have to
>> ask - why the MFD changes aren't in own patch? I feel it would have
>> simplified merging, backporting, reviewing and reverting if needed.
>
> Splitting it out would break bisection: The gpio-leds change without
> the mfd change causes a build failure when assigning the .gpio
> field, and the reverse causes a runtime failure when .gpio=0 is
> a valid line.
Ah, yes. Thanks for explanation. (I feel a bit [a lot] stupid, as I
somehow missed the problem of .gpio = 0 being valid. That even though I
had it explicitly set to -1 myself :rolleyes: ).
No further questions ;)
Yours,
-- Matti
--
---
Matti Vaittinen
Linux kernel developer at ROHM Semiconductors
Oulu Finland
~~ When things go utterly wrong vim users can always type :help! ~~
^ permalink raw reply
* [PATCH v7 15/15] MAINTAINERS: Add maintainer entry for Qualcomm PAS TZ service
From: Sumit Garg @ 2026-05-22 11:59 UTC (permalink / raw)
To: andersson
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, konradybcio,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg
In-Reply-To: <20260522115936.201208-1-sumit.garg@kernel.org>
From: Sumit Garg <sumit.garg@oss.qualcomm.com>
Add Sumit Garg as the maintainer for the Qualcomm generic Peripheral
Authentication Service (PAS) as well as the PAS TEE backend driver.
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
MAINTAINERS | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 2fb1c75afd16..6d3fc5145f0a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22007,6 +22007,15 @@ F: Documentation/devicetree/bindings/media/*qcom*
F: drivers/media/platform/qcom
F: include/dt-bindings/media/*qcom*
+QUALCOMM PAS TZ SERVICE
+M: Sumit Garg <sumit.garg@oss.qualcomm.com>
+L: linux-arm-msm@vger.kernel.org
+S: Maintained
+F: drivers/firmware/qcom/qcom_pas.c
+F: drivers/firmware/qcom/qcom_pas.h
+F: drivers/firmware/qcom/qcom_pas_tee.c
+F: include/linux/firmware/qcom/qcom_pas.h
+
QUALCOMM SMB CHARGER DRIVER
M: Casey Connolly <casey.connolly@linaro.org>
L: linux-arm-msm@vger.kernel.org
--
2.51.0
^ permalink raw reply related
* [PATCH v7 14/15] firmware: qcom_scm: Remove SCM PAS wrappers
From: Sumit Garg @ 2026-05-22 11:59 UTC (permalink / raw)
To: andersson
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, konradybcio,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg
In-Reply-To: <20260522115936.201208-1-sumit.garg@kernel.org>
From: Sumit Garg <sumit.garg@oss.qualcomm.com>
Now since all the Qcom SCM client drivers have been migrated over to
generic PAS TZ service, let's drop the exported SCM PAS wrappers.
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
drivers/firmware/qcom/qcom_scm.c | 143 +++++--------------------
include/linux/firmware/qcom/qcom_scm.h | 29 -----
2 files changed, 29 insertions(+), 143 deletions(-)
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index 7933e55803dc..1deee6aea387 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -553,26 +553,6 @@ static void qcom_scm_set_download_mode(u32 dload_mode)
dev_err(__scm->dev, "failed to set download mode: %d\n", ret);
}
-struct qcom_scm_pas_context *devm_qcom_scm_pas_context_alloc(struct device *dev,
- u32 pas_id,
- phys_addr_t mem_phys,
- size_t mem_size)
-{
- struct qcom_pas_context *ctx;
-
- ctx = devm_kzalloc(dev, sizeof(*ctx), GFP_KERNEL);
- if (!ctx)
- return ERR_PTR(-ENOMEM);
-
- ctx->dev = dev;
- ctx->pas_id = pas_id;
- ctx->mem_phys = mem_phys;
- ctx->mem_size = mem_size;
-
- return (struct qcom_scm_pas_context *)ctx;
-}
-EXPORT_SYMBOL_GPL(devm_qcom_scm_pas_context_alloc);
-
static int __qcom_scm_pas_init_image(struct device *dev, u32 pas_id,
dma_addr_t mdata_phys,
struct qcom_scm_res *res)
@@ -630,9 +610,9 @@ static int qcom_scm_pas_prep_and_init_image(struct device *dev,
return ret ? : res.result[0];
}
-static int __qcom_scm_pas_init_image2(struct device *dev, u32 pas_id,
- const void *metadata, size_t size,
- struct qcom_pas_context *ctx)
+static int qcom_scm_pas_init_image(struct device *dev, u32 pas_id,
+ const void *metadata, size_t size,
+ struct qcom_pas_context *ctx)
{
struct qcom_scm_res res;
dma_addr_t mdata_phys;
@@ -672,16 +652,8 @@ static int __qcom_scm_pas_init_image2(struct device *dev, u32 pas_id,
return ret ? : res.result[0];
}
-int qcom_scm_pas_init_image(u32 pas_id, const void *metadata, size_t size,
- struct qcom_scm_pas_context *ctx)
-{
- return __qcom_scm_pas_init_image2(__scm->dev, pas_id, metadata, size,
- (struct qcom_pas_context *)ctx);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_init_image);
-
-static void __qcom_scm_pas_metadata_release(struct device *dev,
- struct qcom_pas_context *ctx)
+static void qcom_scm_pas_metadata_release(struct device *dev,
+ struct qcom_pas_context *ctx)
{
if (ctx->use_tzmem)
qcom_tzmem_free(ctx->ptr);
@@ -691,15 +663,8 @@ static void __qcom_scm_pas_metadata_release(struct device *dev,
ctx->ptr = NULL;
}
-void qcom_scm_pas_metadata_release(struct qcom_scm_pas_context *ctx)
-{
- __qcom_scm_pas_metadata_release(__scm->dev,
- (struct qcom_pas_context *)ctx);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_metadata_release);
-
-static int __qcom_scm_pas_mem_setup(struct device *dev, u32 pas_id,
- phys_addr_t addr, phys_addr_t size)
+static int qcom_scm_pas_mem_setup(struct device *dev, u32 pas_id,
+ phys_addr_t addr, phys_addr_t size)
{
int ret;
struct qcom_scm_desc desc = {
@@ -730,12 +695,6 @@ static int __qcom_scm_pas_mem_setup(struct device *dev, u32 pas_id,
return ret ? : res.result[0];
}
-int qcom_scm_pas_mem_setup(u32 pas_id, phys_addr_t addr, phys_addr_t size)
-{
- return __qcom_scm_pas_mem_setup(__scm->dev, pas_id, addr, size);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_mem_setup);
-
static void *__qcom_scm_pas_get_rsc_table(struct device *dev, u32 pas_id,
void *input_rt_tzm,
size_t input_rt_size,
@@ -789,11 +748,10 @@ static void *__qcom_scm_pas_get_rsc_table(struct device *dev, u32 pas_id,
return ret ? ERR_PTR(ret) : output_rt_tzm;
}
-static void *__qcom_scm_pas_get_rsc_table2(struct device *dev,
- struct qcom_pas_context *ctx,
- void *input_rt,
- size_t input_rt_size,
- size_t *output_rt_size)
+static void *qcom_scm_pas_get_rsc_table(struct device *dev,
+ struct qcom_pas_context *ctx,
+ void *input_rt, size_t input_rt_size,
+ size_t *output_rt_size)
{
struct resource_table empty_rsc = {};
size_t size = SZ_16K;
@@ -864,19 +822,7 @@ static void *__qcom_scm_pas_get_rsc_table2(struct device *dev,
return ret ? ERR_PTR(ret) : tbl_ptr;
}
-struct resource_table *qcom_scm_pas_get_rsc_table(struct qcom_scm_pas_context *ctx,
- void *input_rt,
- size_t input_rt_size,
- size_t *output_rt_size)
-{
- return __qcom_scm_pas_get_rsc_table2(__scm->dev,
- (struct qcom_pas_context *)ctx,
- input_rt, input_rt_size,
- output_rt_size);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_get_rsc_table);
-
-static int __qcom_scm_pas_auth_and_reset(struct device *dev, u32 pas_id)
+static int qcom_scm_pas_auth_and_reset(struct device *dev, u32 pas_id)
{
int ret;
struct qcom_scm_desc desc = {
@@ -905,14 +851,8 @@ static int __qcom_scm_pas_auth_and_reset(struct device *dev, u32 pas_id)
return ret ? : res.result[0];
}
-int qcom_scm_pas_auth_and_reset(u32 pas_id)
-{
- return __qcom_scm_pas_auth_and_reset(__scm->dev, pas_id);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_auth_and_reset);
-
-static int __qcom_scm_pas_prepare_and_auth_reset(struct device *dev,
- struct qcom_pas_context *ctx)
+static int qcom_scm_pas_prepare_and_auth_reset(struct device *dev,
+ struct qcom_pas_context *ctx)
{
u64 handle;
int ret;
@@ -923,7 +863,7 @@ static int __qcom_scm_pas_prepare_and_auth_reset(struct device *dev,
* memory region and then invokes a call to TrustZone to authenticate.
*/
if (!ctx->use_tzmem)
- return __qcom_scm_pas_auth_and_reset(dev, ctx->pas_id);
+ return qcom_scm_pas_auth_and_reset(dev, ctx->pas_id);
/*
* When Linux runs @ EL2 Linux must create the shmbridge itself and then
@@ -933,21 +873,14 @@ static int __qcom_scm_pas_prepare_and_auth_reset(struct device *dev,
if (ret)
return ret;
- ret = __qcom_scm_pas_auth_and_reset(dev, ctx->pas_id);
+ ret = qcom_scm_pas_auth_and_reset(dev, ctx->pas_id);
qcom_tzmem_shm_bridge_delete(handle);
return ret;
}
-int qcom_scm_pas_prepare_and_auth_reset(struct qcom_scm_pas_context *ctx)
-{
- return __qcom_scm_pas_prepare_and_auth_reset(__scm->dev,
- (struct qcom_pas_context *)ctx);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_prepare_and_auth_reset);
-
-static int __qcom_scm_pas_set_remote_state(struct device *dev, u32 state,
- u32 pas_id)
+static int qcom_scm_pas_set_remote_state(struct device *dev, u32 state,
+ u32 pas_id)
{
struct qcom_scm_desc desc = {
.svc = QCOM_SCM_SVC_BOOT,
@@ -965,13 +898,7 @@ static int __qcom_scm_pas_set_remote_state(struct device *dev, u32 state,
return ret ? : res.result[0];
}
-int qcom_scm_set_remote_state(u32 state, u32 id)
-{
- return __qcom_scm_pas_set_remote_state(__scm->dev, state, id);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_set_remote_state);
-
-static int __qcom_scm_pas_shutdown(struct device *dev, u32 pas_id)
+static int qcom_scm_pas_shutdown(struct device *dev, u32 pas_id)
{
int ret;
struct qcom_scm_desc desc = {
@@ -1000,13 +927,7 @@ static int __qcom_scm_pas_shutdown(struct device *dev, u32 pas_id)
return ret ? : res.result[0];
}
-int qcom_scm_pas_shutdown(u32 pas_id)
-{
- return __qcom_scm_pas_shutdown(__scm->dev, pas_id);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_shutdown);
-
-static bool __qcom_scm_pas_supported(struct device *dev, u32 pas_id)
+static bool qcom_scm_pas_supported(struct device *dev, u32 pas_id)
{
int ret;
struct qcom_scm_desc desc = {
@@ -1027,23 +948,17 @@ static bool __qcom_scm_pas_supported(struct device *dev, u32 pas_id)
return ret ? false : !!res.result[0];
}
-bool qcom_scm_pas_supported(u32 pas_id)
-{
- return __qcom_scm_pas_supported(__scm->dev, pas_id);
-}
-EXPORT_SYMBOL_GPL(qcom_scm_pas_supported);
-
static struct qcom_pas_ops qcom_pas_ops_scm = {
.drv_name = "qcom_scm",
- .supported = __qcom_scm_pas_supported,
- .init_image = __qcom_scm_pas_init_image2,
- .mem_setup = __qcom_scm_pas_mem_setup,
- .get_rsc_table = __qcom_scm_pas_get_rsc_table2,
- .auth_and_reset = __qcom_scm_pas_auth_and_reset,
- .prepare_and_auth_reset = __qcom_scm_pas_prepare_and_auth_reset,
- .set_remote_state = __qcom_scm_pas_set_remote_state,
- .shutdown = __qcom_scm_pas_shutdown,
- .metadata_release = __qcom_scm_pas_metadata_release,
+ .supported = qcom_scm_pas_supported,
+ .init_image = qcom_scm_pas_init_image,
+ .mem_setup = qcom_scm_pas_mem_setup,
+ .get_rsc_table = qcom_scm_pas_get_rsc_table,
+ .auth_and_reset = qcom_scm_pas_auth_and_reset,
+ .prepare_and_auth_reset = qcom_scm_pas_prepare_and_auth_reset,
+ .set_remote_state = qcom_scm_pas_set_remote_state,
+ .shutdown = qcom_scm_pas_shutdown,
+ .metadata_release = qcom_scm_pas_metadata_release,
};
/**
diff --git a/include/linux/firmware/qcom/qcom_scm.h b/include/linux/firmware/qcom/qcom_scm.h
index 5747bd191bf1..a0a6bc0229c4 100644
--- a/include/linux/firmware/qcom/qcom_scm.h
+++ b/include/linux/firmware/qcom/qcom_scm.h
@@ -64,35 +64,6 @@ bool qcom_scm_is_available(void);
int qcom_scm_set_cold_boot_addr(void *entry);
int qcom_scm_set_warm_boot_addr(void *entry);
void qcom_scm_cpu_power_down(u32 flags);
-int qcom_scm_set_remote_state(u32 state, u32 id);
-
-struct qcom_scm_pas_context {
- struct device *dev;
- u32 pas_id;
- phys_addr_t mem_phys;
- size_t mem_size;
- void *ptr;
- dma_addr_t phys;
- ssize_t size;
- bool use_tzmem;
-};
-
-struct qcom_scm_pas_context *devm_qcom_scm_pas_context_alloc(struct device *dev,
- u32 pas_id,
- phys_addr_t mem_phys,
- size_t mem_size);
-int qcom_scm_pas_init_image(u32 pas_id, const void *metadata, size_t size,
- struct qcom_scm_pas_context *ctx);
-void qcom_scm_pas_metadata_release(struct qcom_scm_pas_context *ctx);
-int qcom_scm_pas_mem_setup(u32 pas_id, phys_addr_t addr, phys_addr_t size);
-int qcom_scm_pas_auth_and_reset(u32 pas_id);
-int qcom_scm_pas_shutdown(u32 pas_id);
-bool qcom_scm_pas_supported(u32 pas_id);
-struct resource_table *qcom_scm_pas_get_rsc_table(struct qcom_scm_pas_context *ctx,
- void *input_rt, size_t input_rt_size,
- size_t *output_rt_size);
-
-int qcom_scm_pas_prepare_and_auth_reset(struct qcom_scm_pas_context *ctx);
int qcom_scm_io_readl(phys_addr_t addr, unsigned int *val);
int qcom_scm_io_writel(phys_addr_t addr, unsigned int val);
--
2.51.0
^ permalink raw reply related
* [PATCH v7 13/15] wifi: ath12k: Switch to generic PAS TZ APIs
From: Sumit Garg @ 2026-05-22 11:59 UTC (permalink / raw)
To: andersson
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, konradybcio,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg
In-Reply-To: <20260522115936.201208-1-sumit.garg@kernel.org>
From: Sumit Garg <sumit.garg@oss.qualcomm.com>
Switch ath12k client driver over to generic PAS TZ APIs. Generic PAS TZ
service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.
Acked-by: Jeff Johnson <jjohnson@kernel.org>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/Kconfig | 2 +-
drivers/net/wireless/ath/ath12k/ahb.c | 10 +++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/Kconfig b/drivers/net/wireless/ath/ath12k/Kconfig
index d39c075758bd..2b8b87931330 100644
--- a/drivers/net/wireless/ath/ath12k/Kconfig
+++ b/drivers/net/wireless/ath/ath12k/Kconfig
@@ -18,7 +18,7 @@ config ATH12K_AHB
bool "QTI ath12k AHB support"
depends on ATH12K && REMOTEPROC
select QCOM_MDT_LOADER
- select QCOM_SCM
+ select QCOM_PAS
help
Enable support for Ath12k AHB bus chipsets, example IPQ5332.
diff --git a/drivers/net/wireless/ath/ath12k/ahb.c b/drivers/net/wireless/ath/ath12k/ahb.c
index 2dcf0a52e4c1..dff7fa7027c5 100644
--- a/drivers/net/wireless/ath/ath12k/ahb.c
+++ b/drivers/net/wireless/ath/ath12k/ahb.c
@@ -5,7 +5,7 @@
*/
#include <linux/dma-mapping.h>
-#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_pas.h>
#include <linux/of.h>
#include <linux/of_device.h>
#include <linux/platform_device.h>
@@ -420,7 +420,7 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)
if (ab_ahb->scm_auth_enabled) {
/* Authenticate FW image using peripheral ID */
- ret = qcom_scm_pas_auth_and_reset(pasid);
+ ret = qcom_pas_auth_and_reset(pasid);
if (ret) {
ath12k_err(ab, "failed to boot the remote processor %d\n", ret);
goto err_fw2;
@@ -485,10 +485,10 @@ static void ath12k_ahb_power_down(struct ath12k_base *ab, bool is_suspend)
pasid = (u32_encode_bits(ab_ahb->userpd_id, ATH12K_USERPD_ID_MASK)) |
ATH12K_AHB_UPD_SWID;
/* Release the firmware */
- ret = qcom_scm_pas_shutdown(pasid);
+ ret = qcom_pas_shutdown(pasid);
if (ret)
- ath12k_err(ab, "scm pas shutdown failed for userPD%d\n",
- ab_ahb->userpd_id);
+ ath12k_err(ab, "pas shutdown failed for userPD%d: %d\n",
+ ab_ahb->userpd_id, ret);
}
}
--
2.51.0
^ permalink raw reply related
* [PATCH v7 12/15] net: ipa: Switch to generic PAS TZ APIs
From: Sumit Garg @ 2026-05-22 11:59 UTC (permalink / raw)
To: andersson
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, konradybcio,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg, Alex Elder
In-Reply-To: <20260522115936.201208-1-sumit.garg@kernel.org>
From: Sumit Garg <sumit.garg@oss.qualcomm.com>
Switch ipa client driver over to generic PAS TZ APIs. Generic PAS TZ
service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.
Reviewed-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
drivers/net/ipa/Kconfig | 2 +-
drivers/net/ipa/ipa_main.c | 13 ++++++++-----
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ipa/Kconfig b/drivers/net/ipa/Kconfig
index 01d219d3760c..a9aff1b7977d 100644
--- a/drivers/net/ipa/Kconfig
+++ b/drivers/net/ipa/Kconfig
@@ -6,7 +6,7 @@ config QCOM_IPA
depends on QCOM_RPROC_COMMON || (QCOM_RPROC_COMMON=n && COMPILE_TEST)
depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n
select QCOM_MDT_LOADER
- select QCOM_SCM
+ select QCOM_PAS
select QCOM_QMI_HELPERS
help
Choose Y or M here to include support for the Qualcomm
diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
index 788dd99af2a4..3cd9e44680e9 100644
--- a/drivers/net/ipa/ipa_main.c
+++ b/drivers/net/ipa/ipa_main.c
@@ -14,7 +14,7 @@
#include <linux/pm_runtime.h>
#include <linux/types.h>
-#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/firmware/qcom/qcom_pas.h>
#include <linux/soc/qcom/mdt_loader.h>
#include "ipa.h"
@@ -624,10 +624,13 @@ static int ipa_firmware_load(struct device *dev)
}
ret = qcom_mdt_load(dev, fw, path, IPA_PAS_ID, virt, phys, size, NULL);
- if (ret)
+ if (ret) {
dev_err(dev, "error %d loading \"%s\"\n", ret, path);
- else if ((ret = qcom_scm_pas_auth_and_reset(IPA_PAS_ID)))
- dev_err(dev, "error %d authenticating \"%s\"\n", ret, path);
+ } else {
+ ret = qcom_pas_auth_and_reset(IPA_PAS_ID);
+ if (ret)
+ dev_err(dev, "error %d authenticating \"%s\"\n", ret, path);
+ }
memunmap(virt);
out_release_firmware:
@@ -758,7 +761,7 @@ static enum ipa_firmware_loader ipa_firmware_loader(struct device *dev)
return IPA_LOADER_INVALID;
out_self:
/* We need Trust Zone to load firmware; make sure it's available */
- if (qcom_scm_is_available())
+ if (qcom_pas_is_available())
return IPA_LOADER_SELF;
return IPA_LOADER_DEFER;
--
2.51.0
^ permalink raw reply related
* [PATCH v7 11/15] media: qcom: Pass proper PAS ID to set_remote_state API
From: Sumit Garg @ 2026-05-22 11:59 UTC (permalink / raw)
To: andersson
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, konradybcio,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg
In-Reply-To: <20260522115936.201208-1-sumit.garg@kernel.org>
From: Sumit Garg <sumit.garg@oss.qualcomm.com>
As per testing the SCM backend just ignores it while OP-TEE makes
use of it to for proper book keeping purpose.
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_firmware.c | 2 +-
drivers/media/platform/qcom/venus/firmware.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
index b3c5281aea91..856fa6a79064 100644
--- a/drivers/media/platform/qcom/iris/iris_firmware.c
+++ b/drivers/media/platform/qcom/iris/iris_firmware.c
@@ -109,5 +109,5 @@ int iris_fw_unload(struct iris_core *core)
int iris_set_hw_state(struct iris_core *core, bool resume)
{
- return qcom_pas_set_remote_state(resume, 0);
+ return qcom_pas_set_remote_state(resume, core->iris_platform_data->pas_id);
}
diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c
index 3a38ff985822..3c0727ea137d 100644
--- a/drivers/media/platform/qcom/venus/firmware.c
+++ b/drivers/media/platform/qcom/venus/firmware.c
@@ -59,7 +59,7 @@ int venus_set_hw_state(struct venus_core *core, bool resume)
int ret;
if (core->use_tz) {
- ret = qcom_pas_set_remote_state(resume, 0);
+ ret = qcom_pas_set_remote_state(resume, VENUS_PAS_ID);
if (resume && ret == -EINVAL)
ret = 0;
return ret;
--
2.51.0
^ permalink raw reply related
* [PATCH v7 10/15] media: qcom: Switch to generic PAS TZ APIs
From: Sumit Garg @ 2026-05-22 11:59 UTC (permalink / raw)
To: andersson
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, konradybcio,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg
In-Reply-To: <20260522115936.201208-1-sumit.garg@kernel.org>
From: Sumit Garg <sumit.garg@oss.qualcomm.com>
Switch qcom media client drivers over to generic PAS TZ APIs. Generic PAS
TZ service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/Kconfig | 25 ++++++++++---------
.../media/platform/qcom/iris/iris_firmware.c | 9 ++++---
drivers/media/platform/qcom/venus/Kconfig | 1 +
drivers/media/platform/qcom/venus/firmware.c | 11 ++++----
4 files changed, 25 insertions(+), 21 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/Kconfig b/drivers/media/platform/qcom/iris/Kconfig
index 3c803a05305a..f54b759c18aa 100644
--- a/drivers/media/platform/qcom/iris/Kconfig
+++ b/drivers/media/platform/qcom/iris/Kconfig
@@ -1,13 +1,14 @@
config VIDEO_QCOM_IRIS
- tristate "Qualcomm iris V4L2 decoder driver"
- depends on VIDEO_DEV
- depends on ARCH_QCOM || COMPILE_TEST
- select V4L2_MEM2MEM_DEV
- select QCOM_MDT_LOADER if ARCH_QCOM
- select QCOM_SCM
- select VIDEOBUF2_DMA_CONTIG
- help
- This is a V4L2 driver for Qualcomm iris video accelerator
- hardware. It accelerates decoding operations on various
- Qualcomm SoCs.
- To compile this driver as a module choose m here.
+ tristate "Qualcomm iris V4L2 decoder driver"
+ depends on VIDEO_DEV
+ depends on ARCH_QCOM || COMPILE_TEST
+ select V4L2_MEM2MEM_DEV
+ select QCOM_MDT_LOADER if ARCH_QCOM
+ select QCOM_SCM
+ select QCOM_PAS
+ select VIDEOBUF2_DMA_CONTIG
+ help
+ This is a V4L2 driver for Qualcomm iris video accelerator
+ hardware. It accelerates decoding operations on various
+ Qualcomm SoCs.
+ To compile this driver as a module choose m here.
diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
index 5f408024e967..b3c5281aea91 100644
--- a/drivers/media/platform/qcom/iris/iris_firmware.c
+++ b/drivers/media/platform/qcom/iris/iris_firmware.c
@@ -4,6 +4,7 @@
*/
#include <linux/firmware.h>
+#include <linux/firmware/qcom/qcom_pas.h>
#include <linux/firmware/qcom/qcom_scm.h>
#include <linux/of_address.h>
#include <linux/of_reserved_mem.h>
@@ -79,7 +80,7 @@ int iris_fw_load(struct iris_core *core)
return -ENOMEM;
}
- ret = qcom_scm_pas_auth_and_reset(core->iris_platform_data->pas_id);
+ ret = qcom_pas_auth_and_reset(core->iris_platform_data->pas_id);
if (ret) {
dev_err(core->dev, "auth and reset failed: %d\n", ret);
return ret;
@@ -93,7 +94,7 @@ int iris_fw_load(struct iris_core *core)
cp_config->cp_nonpixel_size);
if (ret) {
dev_err(core->dev, "qcom_scm_mem_protect_video_var failed: %d\n", ret);
- qcom_scm_pas_shutdown(core->iris_platform_data->pas_id);
+ qcom_pas_shutdown(core->iris_platform_data->pas_id);
return ret;
}
}
@@ -103,10 +104,10 @@ int iris_fw_load(struct iris_core *core)
int iris_fw_unload(struct iris_core *core)
{
- return qcom_scm_pas_shutdown(core->iris_platform_data->pas_id);
+ return qcom_pas_shutdown(core->iris_platform_data->pas_id);
}
int iris_set_hw_state(struct iris_core *core, bool resume)
{
- return qcom_scm_set_remote_state(resume, 0);
+ return qcom_pas_set_remote_state(resume, 0);
}
diff --git a/drivers/media/platform/qcom/venus/Kconfig b/drivers/media/platform/qcom/venus/Kconfig
index ffb731ecd48c..574172724e8f 100644
--- a/drivers/media/platform/qcom/venus/Kconfig
+++ b/drivers/media/platform/qcom/venus/Kconfig
@@ -6,6 +6,7 @@ config VIDEO_QCOM_VENUS
select OF_DYNAMIC if ARCH_QCOM
select QCOM_MDT_LOADER if ARCH_QCOM
select QCOM_SCM
+ select QCOM_PAS
select VIDEOBUF2_DMA_CONTIG
select V4L2_MEM2MEM_DEV
help
diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c
index 1de7436713ed..3a38ff985822 100644
--- a/drivers/media/platform/qcom/venus/firmware.c
+++ b/drivers/media/platform/qcom/venus/firmware.c
@@ -12,6 +12,7 @@
#include <linux/of_reserved_mem.h>
#include <linux/platform_device.h>
#include <linux/of_device.h>
+#include <linux/firmware/qcom/qcom_pas.h>
#include <linux/firmware/qcom/qcom_scm.h>
#include <linux/sizes.h>
#include <linux/soc/qcom/mdt_loader.h>
@@ -58,7 +59,7 @@ int venus_set_hw_state(struct venus_core *core, bool resume)
int ret;
if (core->use_tz) {
- ret = qcom_scm_set_remote_state(resume, 0);
+ ret = qcom_pas_set_remote_state(resume, 0);
if (resume && ret == -EINVAL)
ret = 0;
return ret;
@@ -218,7 +219,7 @@ int venus_boot(struct venus_core *core)
int ret;
if (!IS_ENABLED(CONFIG_QCOM_MDT_LOADER) ||
- (core->use_tz && !qcom_scm_is_available()))
+ (core->use_tz && !qcom_pas_is_available()))
return -EPROBE_DEFER;
ret = of_property_read_string_index(dev->of_node, "firmware-name", 0,
@@ -236,7 +237,7 @@ int venus_boot(struct venus_core *core)
core->fw.mem_phys = mem_phys;
if (core->use_tz)
- ret = qcom_scm_pas_auth_and_reset(VENUS_PAS_ID);
+ ret = qcom_pas_auth_and_reset(VENUS_PAS_ID);
else
ret = venus_boot_no_tz(core, mem_phys, mem_size);
@@ -259,7 +260,7 @@ int venus_boot(struct venus_core *core)
res->cp_nonpixel_start,
res->cp_nonpixel_size);
if (ret) {
- qcom_scm_pas_shutdown(VENUS_PAS_ID);
+ qcom_pas_shutdown(VENUS_PAS_ID);
dev_err(dev, "set virtual address ranges fail (%d)\n",
ret);
return ret;
@@ -274,7 +275,7 @@ int venus_shutdown(struct venus_core *core)
int ret;
if (core->use_tz)
- ret = qcom_scm_pas_shutdown(VENUS_PAS_ID);
+ ret = qcom_pas_shutdown(VENUS_PAS_ID);
else
ret = venus_shutdown_no_tz(core);
--
2.51.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox