* Re: [PATCH v8 3/6] wifi: mac80211: Use struct instead of macro for PERR frame
From: Johannes Berg @ 2026-05-28 8:00 UTC (permalink / raw)
To: Masashi Honma, linux-wireless
In-Reply-To: <20260521225842.31815-3-masashi.honma@gmail.com>
Hi,
So I was just about to apply this set, but now I'm thinking about this:
> +struct ieee80211_mesh_hwmp_perr_dst {
> + u8 flags;
> + u8 addr[ETH_ALEN];
> + __le32 sn;
> + /* optional Destination External Address */
> + u8 variable[];
> +} __packed;
This has a variable member, and the presence of the address in
'variable' depends on the flags (AE_F set there.)
> +struct ieee80211_mesh_hwmp_perr {
> + u8 ttl;
> + u8 number_of_dst;
> + struct ieee80211_mesh_hwmp_perr_dst dsts[];
> +} __packed;
However this declares an array of these, and that doesn't really seem
right. It effectively puts non-variable fields (e.g. dsts[1].ttl) after
the variable field dsts[0].variable. I _think_ some compilers (versions)
will also (rightfully) complain about this.
It seems like this should just be
struct ... {
u8 ttl;
u8 number_of_dst;
/* list of variably sized struct ieee80211_mesh_hwmp_perr_dst
*/
u8 dsts[];
} __packed;
> +static inline u16
> +ieee80211_mesh_hwmp_perr_get_rcode(const u8 *ie, u8 dst_idx)
> +{
> + struct ieee80211_mesh_hwmp_perr *perr_ie = (void *)ie;
> + struct ieee80211_mesh_hwmp_perr_dst *dst =
> + &perr_ie->dsts[dst_idx];
And especially this indexing doesn't seem like it could work - you have
to walk through all of them to see if each has the AE_F set and skip
sizeof() + optional ETH_ALEN.
> +
> + return get_unaligned_le16(&dst->variable[
> + (dst->flags & AE_F) ? ETH_ALEN : 0]);
This looks like the comment above should be
/* optional Destination External Address, rcode */
u8 variable[];
or so?
> + target_rcode = ieee80211_mesh_hwmp_perr_get_rcode(perr_elem, 0);
but evidently, this doesn't really matter right now if only one
destination entry is ever read.
Still, please fix that, if only to avoid the compiler warnings I'm
imagining will happen.
johannes
^ permalink raw reply
* Re: [PATCH v8 4/6] wifi: mac80211: Fix overread in PREQ frame processing
From: Johannes Berg @ 2026-05-28 8:04 UTC (permalink / raw)
To: Masashi Honma, linux-wireless
In-Reply-To: <20260521225842.31815-4-masashi.honma@gmail.com>
On Fri, 2026-05-22 at 07:58 +0900, Masashi Honma wrote:
>
> +/* IEEE Std 802.11-2016 9.4.2.113 PREQ element */
> +static inline bool ieee80211_mesh_preq_size_ok(const u8 *pos, u8 elen)
> +{
> + struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
> + ieee80211_mesh_hwmp_preq_get_bottom(pos);
> + u8 target_count;
> + u8 needed;
> +
> + /* Check if the element contains flags */
> + if (elen < 1)
> + return false;
> +
> + /* Check if the element contains target_count */
> + needed = sizeof(struct ieee80211_mesh_hwmp_preq_top) +
> + (ieee80211_mesh_preq_prep_ae_enabled(pos) ? ETH_ALEN : 0)
> + /* Originator External Address */ +
> + sizeof(struct ieee80211_mesh_hwmp_preq_bottom);
> + if (elen < needed)
> + return false;
> +
> + target_count = preq_elem_bottom->target_count;
> + if (target_count < 1 || target_count > 20)
> + return false;
While this is correct now, I think it's perhaps too tricky ...
The reason it's correct is that needed starts out with at most
sizeof(top) + ETH_ALEN + sizeof(bottom) == 17 + 6 + 9 == 32, target
sizeof is 11, so 20*11+32 == 252 and cannot overflow.
But I think it'd be far simpler to declare "needed" simply as 'int',
then even with target_count == 255 and whatever else happened before
cannot overflow, the elen==needed check will promote to int and refuse a
bad target_count implicitly instead of needing to do so explicitly to
avoid the integer overflow.
johannes
^ permalink raw reply
* Re: [PATCH v8 6/6] wifi: mac80211: Fix PERR frame processing
From: Johannes Berg @ 2026-05-28 8:12 UTC (permalink / raw)
To: Masashi Honma, linux-wireless
In-Reply-To: <20260521225842.31815-6-masashi.honma@gmail.com>
On Fri, 2026-05-22 at 07:58 +0900, Masashi Honma wrote:
>
> +/* IEEE Std 802.11-2016 9.4.2.115 PERR element */
> +static inline bool ieee80211_mesh_perr_size_ok(const u8 *pos, u8 elen)
> +{
> + struct ieee80211_mesh_hwmp_perr *perr_elem = (void *)pos;
> + u8 number_of_dst;
> + u8 needed;
> + const u8 *start;
> + int i;
> +
> + start = pos;
> + needed = sizeof(struct ieee80211_mesh_hwmp_perr);
> + pos += sizeof(struct ieee80211_mesh_hwmp_perr);
> +
> + /* Check if the element contains number of dst */
> + if (elen < needed)
> + return false;
> +
> + number_of_dst = perr_elem->number_of_dst;
> + if (number_of_dst < 1 || number_of_dst > 19)
> + return false;
Same here, though I didn't double-check this one; if we just go to 'int'
or 'unsigned int' for 'needed', it's not necessary to even have this.
> +
> + for (i = 0; i < number_of_dst; i++) {
> + struct ieee80211_mesh_hwmp_perr_dst *perr_dst =
> + &perr_elem->dsts[i];
> + u8 dst_len;
> +
> + /* Check if the element contains flags */
> + if (elen < pos - start + 1)
> + return false;
that comment seems a bit misleading. I figured out what you mean, but
IMHO it'd be more obvious if you wrote it as
for (...) {
struct _perr_dst *perr_dst;
u8 dst_len;
if (elen < pos - start + sizeof(*perr_dst))
return false;
> + dst_len = sizeof(struct ieee80211_mesh_hwmp_perr_dst) +
> + ((perr_dst->flags & AE_F) ? ETH_ALEN : 0)
> + /* Destination External Address */ +
> + 2 /* Reason Code */;
> + needed += dst_len;
> + pos += dst_len;
and technically that pos+= could be UB, so it should be
if (elen < pos - start + dst_len)
return false;
pos += dst_len;
> + /* Right now we do not support AE (Address Extension) */
> + for (i = 0; i < perr_elem->number_of_dst; i++)
> + if (perr_elem->dsts[i].flags & AE_F)
> + goto free;
This code will need to change based on what I commented on patch 3 wrt.
the variable members, although we only really use [0] and allow for a
single entry anyway ...
Probably should have an inline that returns struct
ieee80211_mesh_hwmp_perr_dst based on the index, and then have
ieee80211_mesh_hwmp_perr_get_rcode() work on that pointer instead of the
element and index.
Thanks for sticking with this, it already looks really nice!
johannes
^ permalink raw reply
* Re: [PATCH v3 1/7] b43: add firmware mappings and remove comments wondering about rev22 initvals
From: Alessio Ferri @ 2026-05-28 8:22 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, b43-dev, linux-kernel
In-Reply-To: <5e8cdb04c12490dca37777975e921eb1842b6b4c.camel@sipsolutions.net>
On Thu, 28 May 2026 09:43:58 +0200
Johannes Berg <johannes@sipsolutions.net> wrote:
> On Sun, 2026-05-24 at 23:56 +0200, Alessio Ferri wrote:
> > Assisted-by: Claude:claude-4.7-opus
> > Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
>
> Please don't squeeze the entire commit message into the subject and
> then omit the real one.
>
> johannes
I see, i'll resend later a v4 with the correct split between
subject/message.
By the way there is anything else i need to correct?
^ permalink raw reply
* Re: [PATCH] wifi: cfg80211: fix leak if split 6 GHz scanning fails
From: Johannes Berg @ 2026-05-28 8:42 UTC (permalink / raw)
To: Fedor Pchelkin, linux-wireless; +Cc: Tova Mussai, linux-kernel, lvc-project
In-Reply-To: <20260524165320.62089-1-pchelkin@ispras.ru>
On Sun, 2026-05-24 at 19:53 +0300, Fedor Pchelkin wrote:
>
> @@ -1101,7 +1102,12 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev)
> rdev_req->req.scan_6ghz = false;
> rdev_req->req.first_part = true;
> rdev->int_scan_req = request;
> - return rdev_scan(rdev, request);
> + err = rdev_scan(rdev, request);
> + if (err) {
> + kfree(rdev->int_scan_req);
> + rdev->int_scan_req = NULL;
> + }
> + return err;
Given that rdev isn't accessible to the driver call in rdev_scan(), I
think it'd be nicer to do kfree(request) and defer the int_scan_req
assignment to after the rdev_scan() call?
johannes
^ permalink raw reply
* [PATCH wireless] wifi: mac80211: report assoc_link_id in station info for non-MLD STAs on MLD AP
From: Felix Fietkau @ 2026-05-28 10:50 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes
When a non-MLD station associates with an MLD AP, it does so on a
specific link. However, sta_set_sinfo() never sets mlo_params_valid,
so nl80211 never emits NL80211_ATTR_MLO_LINK_ID in get_station /
dump_station responses. Userspace has no way to determine which link
a non-MLD STA is associated on.
Set mlo_params_valid to 1 and assoc_link_id to sta->deflink.link_id,
when valid_links is set.
Also set the mld_addr copy only for MLD STAs, so that non-MLD STAs
get a zeroed mld_addr as documented.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
net/mac80211/sta_info.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 6cace7fdc571..60d0d0a43418 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -3307,7 +3307,10 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
u32 est_thr = 0;
int link_id;
- ether_addr_copy(sinfo->mld_addr, sta->addr);
+ sinfo->mlo_params_valid = true;
+ sinfo->assoc_link_id = sta->deflink.link_id;
+ if (sta->sta.mlo)
+ ether_addr_copy(sinfo->mld_addr, sta->addr);
/* assign valid links first for iteration */
sinfo->valid_links = sta->sta.valid_links;
--
2.51.0
^ permalink raw reply related
* [PATCH] wifi: mt76: mt7915: add thermal zone device registration
From: Ryan Leung @ 2026-05-28 11:07 UTC (permalink / raw)
To: linux-wireless
Cc: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, Ryan Leung
Register the mt7915 phy as a thermal zone sensor using
devm_thermal_of_zone_register() so that device tree thermal-zones
nodes can reference the Wi-Fi chip as a temperature source. This
allows the kernel thermal governor to control external cooling
devices such as PWM fans based on Wi-Fi chip temperature.
Registration is non-fatal: -ENODEV is returned when no
thermal-sensors DT property references this device, which is the
expected case on platforms without a thermal zone configured.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
---
.../net/wireless/mediatek/mt76/mt7915/init.c | 29 +++++++++++++++++++
.../wireless/mediatek/mt76/mt7915/mt7915.h | 1 +
2 files changed, 30 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
index 250c2d2479b0..817a9045e326 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -177,6 +177,25 @@ static const struct thermal_cooling_device_ops mt7915_thermal_ops = {
.set_cur_state = mt7915_thermal_set_cur_throttle_state,
};
+static int mt7915_thermal_get_temp(struct thermal_zone_device *tz, int *temp)
+{
+ struct mt7915_phy *phy = thermal_zone_device_priv(tz);
+ int val;
+
+ mutex_lock(&phy->dev->mt76.mutex);
+ val = mt7915_mcu_get_temperature(phy);
+ mutex_unlock(&phy->dev->mt76.mutex);
+ if (val < 0)
+ return val;
+
+ *temp = val * 1000;
+ return 0;
+}
+
+static const struct thermal_zone_device_ops mt7915_tz_ops = {
+ .get_temp = mt7915_thermal_get_temp,
+};
+
static void mt7915_unregister_thermal(struct mt7915_phy *phy)
{
struct wiphy *wiphy = phy->mt76->hw->wiphy;
@@ -213,6 +232,16 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = MT7915_CRIT_TEMP;
phy->throttle_temp[MT7915_MAX_TEMP_IDX] = MT7915_MAX_TEMP;
+ phy->tzone = devm_thermal_of_zone_register(phy->dev->mt76.dev, 0, phy,
+ &mt7915_tz_ops);
+ if (IS_ERR(phy->tzone)) {
+ if (PTR_ERR(phy->tzone) != -ENODEV)
+ dev_warn(phy->dev->mt76.dev,
+ "failed to register thermal zone: %ld\n",
+ PTR_ERR(phy->tzone));
+ phy->tzone = NULL;
+ }
+
if (!IS_REACHABLE(CONFIG_HWMON))
return 0;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
index bf1d915a3ca2..92e0f9f0169c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h
@@ -205,6 +205,7 @@ struct mt7915_phy {
struct ieee80211_vif *monitor_vif;
+ struct thermal_zone_device *tzone;
struct thermal_cooling_device *cdev;
u8 cdev_state;
u8 throttle_state;
--
2.43.0
^ permalink raw reply related
* [PATCH wireless v2 4/4] wifi: mac80211: add ieee80211_txq_aql_pending()
From: Felix Fietkau @ 2026-05-28 11:17 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes
In-Reply-To: <20260528111756.848243-1-nbd@nbd.name>
Add a function to allow drivers to query the pending AQL airtime
for a given txq, for both unicast and broadcast.
This will be used for mt76 to limit buffering in AP mode for power-save
stations.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
v2: reorder txq->tid check
include/net/mac80211.h | 11 +++++++++++
net/mac80211/tx.c | 18 ++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 77409e4e28e8..a97d800c2e1f 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -6871,6 +6871,17 @@ void ieee80211_sta_register_airtime(struct ieee80211_sta *pubsta, u8 tid,
bool
ieee80211_txq_airtime_check(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
+/**
+ * ieee80211_txq_aql_pending - get pending AQL airtime for a txq
+ *
+ * @hw: pointer obtained from ieee80211_alloc_hw()
+ * @txq: pointer obtained from station or virtual interface
+ *
+ * Return: pending airtime (in usec) for the given txq.
+ */
+u32 ieee80211_txq_aql_pending(struct ieee80211_hw *hw,
+ struct ieee80211_txq *txq);
+
/**
* ieee80211_iter_keys - iterate keys programmed into the device
* @hw: pointer obtained from ieee80211_alloc_hw()
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d1c8398584af..f28419a79da6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4225,6 +4225,24 @@ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
}
EXPORT_SYMBOL(ieee80211_txq_airtime_check);
+u32 ieee80211_txq_aql_pending(struct ieee80211_hw *hw,
+ struct ieee80211_txq *txq)
+{
+ struct ieee80211_local *local = hw_to_local(hw);
+ struct sta_info *sta;
+
+ if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
+ return 0;
+
+ if (!txq->sta)
+ return atomic_read(&local->aql_bc_pending_airtime);
+
+ sta = container_of(txq->sta, struct sta_info, sta);
+
+ return atomic_read(&sta->airtime[txq->ac].aql_tx_pending);
+}
+EXPORT_SYMBOL(ieee80211_txq_aql_pending);
+
static bool
ieee80211_txq_schedule_airtime_check(struct ieee80211_local *local, u8 ac)
{
--
2.51.0
^ permalink raw reply related
* [PATCH wireless v2 1/4] wifi: mac80211: factor out part of ieee80211_calc_expected_tx_airtime
From: Felix Fietkau @ 2026-05-28 11:17 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes
Create ieee80211_rate_expected_tx_airtime helper function, which returns
the expected tx airtime for a given rate and packet length in units of
1/1024 usec, for more accuracy.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
net/mac80211/airtime.c | 87 ++++++++++++++++++++++----------------
net/mac80211/ieee80211_i.h | 5 +++
2 files changed, 56 insertions(+), 36 deletions(-)
diff --git a/net/mac80211/airtime.c b/net/mac80211/airtime.c
index c61df637232a..0c54cdbd753c 100644
--- a/net/mac80211/airtime.c
+++ b/net/mac80211/airtime.c
@@ -685,7 +685,7 @@ static int ieee80211_fill_rx_status(struct ieee80211_rx_status *stat,
if (ieee80211_fill_rate_info(hw, stat, band, ri))
return 0;
- if (!ieee80211_rate_valid(rate))
+ if (!rate || !ieee80211_rate_valid(rate))
return -1;
if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
@@ -753,6 +753,53 @@ u32 ieee80211_calc_tx_airtime(struct ieee80211_hw *hw,
}
EXPORT_SYMBOL_GPL(ieee80211_calc_tx_airtime);
+u32 ieee80211_rate_expected_tx_airtime(struct ieee80211_hw *hw,
+ struct ieee80211_tx_rate *tx_rate,
+ struct rate_info *ri,
+ enum nl80211_band band,
+ bool ampdu, int len)
+{
+ struct ieee80211_rx_status stat;
+ u32 duration, overhead;
+ u8 agg_shift;
+
+ if (ieee80211_fill_rx_status(&stat, hw, tx_rate, ri, band, len))
+ return 0;
+
+ if (stat.encoding == RX_ENC_LEGACY || !ampdu)
+ return ieee80211_calc_rx_airtime(hw, &stat, len) * 1024;
+
+ duration = ieee80211_get_rate_duration(hw, &stat, &overhead);
+
+ /*
+ * Assume that HT/VHT transmission on any AC except VO will
+ * use aggregation. Since we don't have reliable reporting
+ * of aggregation length, assume an average size based on the
+ * tx rate.
+ * This will not be very accurate, but much better than simply
+ * assuming un-aggregated tx in all cases.
+ */
+ if (duration > 400 * 1024) /* <= VHT20 MCS2 1S */
+ agg_shift = 1;
+ else if (duration > 250 * 1024) /* <= VHT20 MCS3 1S or MCS1 2S */
+ agg_shift = 2;
+ else if (duration > 150 * 1024) /* <= VHT20 MCS5 1S or MCS2 2S */
+ agg_shift = 3;
+ else if (duration > 70 * 1024) /* <= VHT20 MCS5 2S */
+ agg_shift = 4;
+ else if (stat.encoding != RX_ENC_HE ||
+ duration > 20 * 1024) /* <= HE40 MCS6 2S */
+ agg_shift = 5;
+ else
+ agg_shift = 6;
+
+ duration *= len;
+ duration /= AVG_PKT_SIZE;
+ duration += (overhead * 1024 >> agg_shift);
+
+ return duration;
+}
+
u32 ieee80211_calc_expected_tx_airtime(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
struct ieee80211_sta *pubsta,
@@ -775,45 +822,13 @@ u32 ieee80211_calc_expected_tx_airtime(struct ieee80211_hw *hw,
if (pubsta) {
struct sta_info *sta = container_of(pubsta, struct sta_info,
sta);
- struct ieee80211_rx_status stat;
struct ieee80211_tx_rate *tx_rate = &sta->deflink.tx_stats.last_rate;
struct rate_info *ri = &sta->deflink.tx_stats.last_rate_info;
- u32 duration, overhead;
- u8 agg_shift;
+ u32 duration;
- if (ieee80211_fill_rx_status(&stat, hw, tx_rate, ri, band, len))
- return 0;
-
- if (stat.encoding == RX_ENC_LEGACY || !ampdu)
- return ieee80211_calc_rx_airtime(hw, &stat, len);
-
- duration = ieee80211_get_rate_duration(hw, &stat, &overhead);
- /*
- * Assume that HT/VHT transmission on any AC except VO will
- * use aggregation. Since we don't have reliable reporting
- * of aggregation length, assume an average size based on the
- * tx rate.
- * This will not be very accurate, but much better than simply
- * assuming un-aggregated tx in all cases.
- */
- if (duration > 400 * 1024) /* <= VHT20 MCS2 1S */
- agg_shift = 1;
- else if (duration > 250 * 1024) /* <= VHT20 MCS3 1S or MCS1 2S */
- agg_shift = 2;
- else if (duration > 150 * 1024) /* <= VHT20 MCS5 1S or MCS2 2S */
- agg_shift = 3;
- else if (duration > 70 * 1024) /* <= VHT20 MCS5 2S */
- agg_shift = 4;
- else if (stat.encoding != RX_ENC_HE ||
- duration > 20 * 1024) /* <= HE40 MCS6 2S */
- agg_shift = 5;
- else
- agg_shift = 6;
-
- duration *= len;
- duration /= AVG_PKT_SIZE;
+ duration = ieee80211_rate_expected_tx_airtime(hw, tx_rate, ri,
+ band, true, len);
duration /= 1024;
- duration += (overhead >> agg_shift);
return max_t(u32, duration, 4);
}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index fc4424b125c1..b8908a22ae17 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2867,6 +2867,11 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
extern const struct ethtool_ops ieee80211_ethtool_ops;
+u32 ieee80211_rate_expected_tx_airtime(struct ieee80211_hw *hw,
+ struct ieee80211_tx_rate *tx_rate,
+ struct rate_info *ri,
+ enum nl80211_band band,
+ bool ampdu, int len);
u32 ieee80211_calc_expected_tx_airtime(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
struct ieee80211_sta *pubsta,
--
2.51.0
^ permalink raw reply related
* [PATCH wireless v2 2/4] wifi: mac80211: estimate expected throughput if not provided by driver/rc
From: Felix Fietkau @ 2026-05-28 11:17 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes
In-Reply-To: <20260528111756.848243-1-nbd@nbd.name>
Estimate the tx throughput based on the expected per-packet tx time.
This is useful for mesh implementations that rely on expected throughput,
e.g. 802.11s or batman-adv.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
net/mac80211/sta_info.c | 48 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 45 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 4c86a3793804..2bc5cab76261 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2769,6 +2769,27 @@ void sta_set_accumulated_removed_links_sinfo(struct sta_info *sta,
}
}
+static u32 sta_estimate_expected_throughput(struct sta_info *sta,
+ struct rate_info *ri,
+ struct ieee80211_bss_conf *bss_conf)
+{
+ struct ieee80211_hw *hw = &sta->sdata->local->hw;
+ struct ieee80211_chanctx_conf *conf;
+ u32 duration;
+ u8 band = 0;
+
+ conf = rcu_dereference(bss_conf->chanctx_conf);
+ if (conf)
+ band = conf->def.chan->band;
+
+ duration = ieee80211_rate_expected_tx_airtime(hw, NULL, ri, band, true, 1024);
+ duration += duration >> 4; /* add assumed packet error rate of ~6% */
+ if (!duration)
+ return 0;
+
+ return ((1024 * USEC_PER_SEC) / duration) * 8;
+}
+
static void sta_set_link_sinfo(struct sta_info *sta,
struct link_station_info *link_sinfo,
struct ieee80211_link_data *link,
@@ -2983,6 +3004,10 @@ static void sta_set_link_sinfo(struct sta_info *sta,
link_sinfo->bss_param.beacon_interval = link->conf->beacon_int;
thr = sta_get_expected_throughput(sta);
+ if (!thr && (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)))
+ thr = sta_estimate_expected_throughput(sta,
+ &link_sinfo->txrate,
+ link->conf);
if (thr != 0) {
link_sinfo->filled |=
@@ -3236,6 +3261,14 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
if (thr != 0) {
sinfo->filled |= BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
sinfo->expected_throughput = thr;
+ } else if (!sta->sta.valid_links &&
+ (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE))) {
+ thr = sta_estimate_expected_throughput(sta, &sinfo->txrate,
+ &sdata->vif.bss_conf);
+ if (thr) {
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
+ sinfo->expected_throughput = thr;
+ }
}
if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_ACK_SIGNAL)) &&
@@ -3256,6 +3289,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
if (sta->sta.valid_links) {
struct ieee80211_link_data *link;
struct link_sta_info *link_sta;
+ u32 est_thr = 0;
int link_id;
sinfo->mlo_params_valid = true;
@@ -3267,17 +3301,25 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
sinfo->valid_links = sta->sta.valid_links;
for_each_valid_link(sinfo, link_id) {
+ struct link_station_info *lsi = sinfo->links[link_id];
+
link_sta = wiphy_dereference(sta->local->hw.wiphy,
sta->link[link_id]);
link = wiphy_dereference(sdata->local->hw.wiphy,
sdata->link[link_id]);
- if (!link_sta || !sinfo->links[link_id] || !link) {
+ if (!link_sta || !lsi || !link) {
sinfo->valid_links &= ~BIT(link_id);
continue;
}
- sta_set_link_sinfo(sta, sinfo->links[link_id],
- link, tidstats);
+ sta_set_link_sinfo(sta, lsi, link, tidstats);
+ if (!thr &&
+ (lsi->filled & BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT)))
+ est_thr += lsi->expected_throughput;
+ }
+ if (est_thr) {
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
+ sinfo->expected_throughput = est_thr;
}
}
}
--
2.51.0
^ permalink raw reply related
* [PATCH wireless v2 3/4] wifi: mac80211: add AQL support for multicast packets
From: Felix Fietkau @ 2026-05-28 11:17 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes
In-Reply-To: <20260528111756.848243-1-nbd@nbd.name>
Excessive multicast traffic with little competing unicast traffic can easily
flood hardware queues, leading to throughput issues. Additionally, filling
the hardware queues with too many packets breaks FQ for multicast data.
Fix this by enabling AQL for multicast packets.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
v2: fix broadcast/multicast inconsistency
include/net/cfg80211.h | 1 +
include/net/mac80211.h | 2 +-
net/mac80211/debugfs.c | 13 ++++++++--
net/mac80211/ieee80211_i.h | 2 ++
net/mac80211/main.c | 1 +
net/mac80211/sta_info.c | 17 ++++++++++++-
net/mac80211/sta_info.h | 3 ++-
net/mac80211/status.c | 5 ++--
net/mac80211/tx.c | 52 ++++++++++++++++++++------------------
9 files changed, 65 insertions(+), 31 deletions(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 69dc9a978861..69414934c7fa 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3722,6 +3722,7 @@ enum wiphy_params_flags {
/* The per TXQ device queue limit in airtime */
#define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L 5000
#define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H 12000
+#define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_MC 50000
/* The per interface airtime threshold to switch to lower queue limit */
#define IEEE80211_AQL_THRESHOLD 24000
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 4fb579805e0f..77409e4e28e8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1354,8 +1354,8 @@ struct ieee80211_tx_info {
status_data_idr:1,
status_data:13,
hw_queue:4,
+ tx_time_mc:1,
tx_time_est:10;
- /* 1 free bit */
union {
struct {
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index a4d5461f6480..8ebf5bcf3c0e 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -210,11 +210,13 @@ static ssize_t aql_pending_read(struct file *file,
"VI %u us\n"
"BE %u us\n"
"BK %u us\n"
+ "MC %u us\n"
"total %u us\n",
atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VO]),
atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_VI]),
atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BE]),
atomic_read(&local->aql_ac_pending_airtime[IEEE80211_AC_BK]),
+ atomic_read(&local->aql_mc_pending_airtime),
atomic_read(&local->aql_total_pending_airtime));
return simple_read_from_buffer(user_buf, count, ppos,
buf, len);
@@ -239,7 +241,8 @@ static ssize_t aql_txq_limit_read(struct file *file,
"VO %u %u\n"
"VI %u %u\n"
"BE %u %u\n"
- "BK %u %u\n",
+ "BK %u %u\n"
+ "MC %u\n",
local->aql_txq_limit_low[IEEE80211_AC_VO],
local->aql_txq_limit_high[IEEE80211_AC_VO],
local->aql_txq_limit_low[IEEE80211_AC_VI],
@@ -247,7 +250,8 @@ static ssize_t aql_txq_limit_read(struct file *file,
local->aql_txq_limit_low[IEEE80211_AC_BE],
local->aql_txq_limit_high[IEEE80211_AC_BE],
local->aql_txq_limit_low[IEEE80211_AC_BK],
- local->aql_txq_limit_high[IEEE80211_AC_BK]);
+ local->aql_txq_limit_high[IEEE80211_AC_BK],
+ local->aql_txq_limit_mc);
return simple_read_from_buffer(user_buf, count, ppos,
buf, len);
}
@@ -273,6 +277,11 @@ static ssize_t aql_txq_limit_write(struct file *file,
else
buf[count] = '\0';
+ if (sscanf(buf, "mcast %u", &q_limit_low) == 1) {
+ local->aql_txq_limit_mc = q_limit_low;
+ return count;
+ }
+
if (sscanf(buf, "%u %u %u", &ac, &q_limit_low, &q_limit_high) != 3)
return -EINVAL;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b8908a22ae17..5899b9d6bc75 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1452,10 +1452,12 @@ struct ieee80211_local {
spinlock_t handle_wake_tx_queue_lock;
u16 airtime_flags;
+ u32 aql_txq_limit_mc;
u32 aql_txq_limit_low[IEEE80211_NUM_ACS];
u32 aql_txq_limit_high[IEEE80211_NUM_ACS];
u32 aql_threshold;
atomic_t aql_total_pending_airtime;
+ atomic_t aql_mc_pending_airtime;
atomic_t aql_ac_pending_airtime[IEEE80211_NUM_ACS];
const struct ieee80211_ops *ops;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 90d295cc364f..3adb941f407f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -988,6 +988,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
spin_lock_init(&local->rx_path_lock);
spin_lock_init(&local->queue_stop_reason_lock);
+ local->aql_txq_limit_mc = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_MC;
for (i = 0; i < IEEE80211_NUM_ACS; i++) {
INIT_LIST_HEAD(&local->active_txqs[i]);
spin_lock_init(&local->active_txq_lock[i]);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 2bc5cab76261..b4abe1230cc2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2470,13 +2470,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggregates);
void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
struct sta_info *sta, u8 ac,
- u16 tx_airtime, bool tx_completed)
+ u16 tx_airtime, bool tx_completed,
+ bool mcast)
{
int tx_pending;
if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
return;
+ if (mcast) {
+ if (!tx_completed) {
+ atomic_add(tx_airtime, &local->aql_mc_pending_airtime);
+ return;
+ }
+
+ tx_pending = atomic_sub_return(tx_airtime,
+ &local->aql_mc_pending_airtime);
+ if (tx_pending < 0)
+ atomic_cmpxchg(&local->aql_mc_pending_airtime,
+ tx_pending, 0);
+ return;
+ }
+
if (!tx_completed) {
if (sta)
atomic_add(tx_airtime,
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 39608a0abbb5..6ad0586c68c7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -147,7 +147,8 @@ struct airtime_info {
void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
struct sta_info *sta, u8 ac,
- u16 tx_airtime, bool tx_completed);
+ u16 tx_airtime, bool tx_completed,
+ bool mcast);
struct sta_info;
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 8716eda8317d..f0acd8196468 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -752,7 +752,7 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
ieee80211_sta_update_pending_airtime(local, sta,
skb_get_queue_mapping(skb),
tx_time_est,
- true);
+ true, info->tx_time_mc);
rcu_read_unlock();
}
@@ -1161,10 +1161,11 @@ void ieee80211_tx_status_ext(struct ieee80211_hw *hw,
/* Do this here to avoid the expensive lookup of the sta
* in ieee80211_report_used_skb().
*/
+ bool mcast = IEEE80211_SKB_CB(skb)->tx_time_mc;
ieee80211_sta_update_pending_airtime(local, sta,
skb_get_queue_mapping(skb),
tx_time_est,
- true);
+ true, mcast);
ieee80211_info_set_tx_time_est(IEEE80211_SKB_CB(skb), 0);
}
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 933c86ca21c3..d1c8398584af 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4027,20 +4027,20 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
encap_out:
info->control.vif = vif;
- if (tx.sta &&
- wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
- bool ampdu = txq->ac != IEEE80211_AC_VO;
+ if (wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
+ bool ampdu = txq->sta && txq->ac != IEEE80211_AC_VO;
u32 airtime;
airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
skb->len, ampdu);
- if (airtime) {
- airtime = ieee80211_info_set_tx_time_est(info, airtime);
- ieee80211_sta_update_pending_airtime(local, tx.sta,
- txq->ac,
- airtime,
- false);
- }
+ if (!airtime)
+ return skb;
+
+ airtime = ieee80211_info_set_tx_time_est(info, airtime);
+ info->tx_time_mc = !tx.sta;
+ ieee80211_sta_update_pending_airtime(local, tx.sta, txq->ac,
+ airtime, false,
+ info->tx_time_mc);
}
return skb;
@@ -4092,6 +4092,7 @@ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
struct ieee80211_txq *ret = NULL;
struct txq_info *txqi = NULL, *head = NULL;
bool found_eligible_txq = false;
+ bool aql_check;
spin_lock_bh(&local->active_txq_lock[ac]);
@@ -4115,26 +4116,28 @@ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
if (!head)
head = txqi;
+ aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
+ if (aql_check)
+ found_eligible_txq = true;
+
if (txqi->txq.sta) {
struct sta_info *sta = container_of(txqi->txq.sta,
struct sta_info, sta);
- bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
- s32 deficit = ieee80211_sta_deficit(sta, txqi->txq.ac);
- if (aql_check)
- found_eligible_txq = true;
-
- if (deficit < 0)
+ if (ieee80211_sta_deficit(sta, txqi->txq.ac) < 0) {
sta->airtime[txqi->txq.ac].deficit +=
sta->airtime_weight;
- if (deficit < 0 || !aql_check) {
- list_move_tail(&txqi->schedule_order,
- &local->active_txqs[txqi->txq.ac]);
- goto begin;
+ aql_check = false;
}
}
+ if (!aql_check) {
+ list_move_tail(&txqi->schedule_order,
+ &local->active_txqs[txqi->txq.ac]);
+ goto begin;
+ }
+
if (txqi->schedule_round == local->schedule_round[ac])
goto out;
@@ -4201,7 +4204,8 @@ bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
return true;
if (!txq->sta)
- return true;
+ return atomic_read(&local->aql_mc_pending_airtime) <
+ local->aql_txq_limit_mc;
if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
return true;
@@ -4250,15 +4254,15 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
spin_lock_bh(&local->active_txq_lock[ac]);
- if (!txqi->txq.sta)
- goto out;
-
if (list_empty(&txqi->schedule_order))
goto out;
if (!ieee80211_txq_schedule_airtime_check(local, ac))
goto out;
+ if (!txqi->txq.sta)
+ goto out;
+
list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
schedule_order) {
if (iter == txqi)
--
2.51.0
^ permalink raw reply related
* [GIT PULL] wireless-next-2026-05-28
From: Johannes Berg @ 2026-05-28 12:37 UTC (permalink / raw)
To: netdev; +Cc: linux-wireless
Hi,
Here's a new set of changes, mostly ath and iwlwifi
drivers this time.
I have a few more things pending, and I expect a few
more drivers will have pull requests later too.
Please pull and let us know if there's any problem.
And this time that might be more likely because my
nipa server was accidentally destroyed on Monday...
Thanks,
johannes
The following changes since commit 1a1f055318d82e64485a6ff8420e5f70b4267998:
Merge tag 'wireless-next-2026-05-21' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next (2026-05-21 16:00:06 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git tags/wireless-next-2026-05-28
for you to fetch changes up to 6f5dc19f46f4bd0e104c9a4da2f0a912cdf3bd86:
Merge tag 'ath-next-20260526' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath (2026-05-28 10:23:15 +0200)
----------------------------------------------------------------
Mostly driver updates:
- iwlwifi
- more UHR support
- NAN (multicast, schedule improvements, multi-station)
- cleanups, etc.
- ath12k
- thermal throttling/cooling device support
- 6 GHz incumbent interference detection
- channel 177 in 5 GHz
- hwsim: S1G fixes
- mac80211: NAN channel handling improvements
----------------------------------------------------------------
Aaron Katzin (1):
wifi: iwlwifi: pcie: add debug print for resume flow if powered off
Aishwarya R (2):
wifi: ath12k: Add support for handling incumbent signal interference in 6 GHz
wifi: ath12k: Add debugfs support to simulate incumbent signal interference
Arnd Bergmann (1):
wifi: ath10k: drop gpio_led reference
Avinash Bhatt (9):
wifi: iwlwifi: fix buffer overflow when firmware reports no channels
wifi: iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3
wifi: iwlwifi: mld: add chan-load hysteresis for MLO scan triggers
wifi: iwlwifi: mld: add duplicated beacon RSSI adjustment
wifi: iwlwifi: mld: Add KUnit tests for channel-load thresholds
wifi: iwlwifi: mld: implement PSD/EIRP RSSI adjustment
wifi: iwlwifi: mld: update link grading tables per bandwidth
wifi: iwlwifi: mld: skip MLO scan trigger when AP has no QBSS Load IE
wifi: iwlwifi: mld: keep healthy link on EMLSR missed beacon exit
Avraham Stern (5):
wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only
wifi: iwlwifi: mld: add support for nan schedule config command version 2
wifi: iwlwifi: mld: add handler for NAN ULW attribute notification
wifi: iwlwifi: mld: nan: add availability attribute to schedule config
wifi: iwlwifi: mld: add support for deferred nan schedule config
Dan Carpenter (1):
wifi: mwifiex: remove an unnecessary check
Daniel Gabay (4):
wifi: iwlwifi: mld: fix NAN DW end notification handler
wifi: iwlwifi: mld: add NULL check for channel in DW end handler
wifi: iwlwifi: mld: validate aux sta before flush in stop_nan
wifi: iwlwifi: print UHR rate type
Daniel Lezcano (2):
wifi: ath: Use the unified QMI service ID instead of defining it locally
wifi: ath: Fix the license marking
Dongyang Jin (1):
wifi: iwlwifi: mld: fix indentation in iwl_mld_fill_supp_rates()
Emmanuel Grumbach (15):
wifi: iwlwifi: fix the access to CNVR TOP registers
wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED
wifi: iwlwifi: mld: move iwl_mld_link_info_changed_ap_ibss to ap.c
wifi: iwlwifi: rename iwl_system_statistics_notif_oper
wifi: iwlwifi: introduce iwl_system_statistics_notif_oper version 4
wifi: iwlwifi: mld: support the new statistics APIs
wifi: iwlwifi: remove nvm_ver for devices that don't need it
wifi: iwlwifi: implement the new RSC notification
wifi: iwlwifi: led_compensation is needed for iwldvm only
wifi: iwlwifi: shadow_ram_support is needed for iwldvm only.
wifi: iwlwifi: max_event_log_size is needed for iwldvm only
wifi: iwlwifi: smem_offset smem_len are not needed from 22000 and up
wifi: iwlwifi: reduce the log level of firmware debug buffer size mismatch
wifi: iwlwifi: move pcie content to pcie internal transport
wifi: iwlwifi: move iwl_trans_activate_nic to iwl-trans.c
Ilan Peer (7):
wifi: iwlwifi: mld: Fix number of antennas in NAN capabilities
wifi: iwlwifi: mld: Do not declare support for NDPE
wifi: iwlwifi: mld: Do not declare NAN support for Extended Key ID
wifi: iwlwifi: mld: Add support for multiple NAN Management stations
wifi: iwlwifi: mld: Replace static declarations of IWL_MLD_ALLOC_FN
wifi: iwlwifi: mld: Add support for NAN multicast data
wifi: iwlwifi: mld: Disallow using a per-STA GTK for Tx
Israel Kozitz (1):
wifi: iwlwifi: mld: fix NAN max channel switch time unit
Jay Ng (1):
wifi: iwlwifi: remove unused header inclusions
Johannes Berg (41):
wifi: iwlwifi: mld: tlc: separate from link STA
wifi: iwlwifi: mld: disable queue hang detection for NAN data
wifi: iwlwifi: mld: support NAN and NAN_DATA interfaces
wifi: iwlwifi: mld: add NAN link management
wifi: iwlwifi: add NAN schedule command support
wifi: iwlwifi: mld: implement NAN peer station management
wifi: iwlwifi: mld: add peer schedule support
wifi: iwlwifi: mld: clean up station handling in key APIs
wifi: iwlwifi: mld: add TLC support for NAN stations
wifi: iwlwifi: mld: track TX/RX IGTKs separately
wifi: iwlwifi: mld: don't report bad STA ID in EHT TB sniffer
wifi: iwlwifi: api: RX: define UHR RX PHY flags
wifi: iwlwifi: fw: api: fix UHR U-SIG whitespace
wifi: iwlwifi: fw: api: add/fix some UHR sniffer definitions
wifi: iwlwifi: pcie: fix ACPI DSM check
wifi: iwlwifi: advertise UHR capabilities for such devices
wifi: iwlwifi: print FSEQ sha1 in addition to version
wifi: iwlwifi: tighten flags in debugfs command sending
wifi: iwlwifi: define new FSEQ TLV with MAC ID
wifi: iwlwifi: set state to NO_FW on reset
wifi: iwlwifi: mld: support NPCA capability for UHR devices
wifi: iwlwifi: mld: implement UHR DPS
wifi: iwlwifi: mld: give link STA debugfs files a namespace
wifi: iwlwifi: mld: set correct key mask for NAN
wifi: iwlwifi: mld: add UHR DUO support
wifi: iwlwifi: mld: implement UHR multi-link PM
wifi: iwlwifi: mld: rename LINK_DEBUGFS_WRITE_FILE_OPS
wifi: iwlwifi: mld: add link and link station FW IDs to debugfs
wifi: iwlwifi: api: remove NAN_GROUP
wifi: iwlwifi: api: clean up/fix some kernel-doc references
wifi: iwlwifi: pcie: add two LNL PCI IDs
wifi: iwlwifi: clean up location format/BW encoding
wifi: iwlwifi: fw: move struct iwl_fw_ini_dump_entry to dbg.c
wifi: iwlwifi: fw: separate ini dump allocation
wifi: iwlwifi: fw: dbg: always use non-tracing PRPH access
wifi: iwlwifi: fw: separate out old-style dump code
wifi: iwlwifi: dbg: remove unused 'range_len' arg from dump
wifi: iwlwifi: transport: add memory read under NIC access
wifi: mac80211_hwsim: add debug messages for link changes
Merge tag 'iwlwifi-next-2026-05-26' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
Merge tag 'ath-next-20260526' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
Jose Ignacio Tornos Martinez (1):
wifi: ath11k: fix warning when unbinding
Junjie Cao (2):
wifi: iwlwifi: mld: fix race condition in PTP removal
wifi: iwlwifi: mvm: fix race condition in PTP removal
Junrui Luo (1):
wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
Kexin Sun (1):
wifi: ath10k: update outdated comment for renamed ieee80211_tx_status()
Krzysztof Kozlowski (1):
wifi: ath: Unify user-visible "Qualcomm" name
Lachlan Hodges (2):
wifi: mac80211_hwsim: don't run RC update on new STA on S1G vif
wifi: mac80211_hwsim: modernise S1G channel list
Maharaja Kennadyrajan (5):
wifi: ath12k: handle thermal throttle stats WMI event
wifi: ath12k: configure firmware thermal throttling via WMI
wifi: ath12k: refactor per-radio thermal hwmon setup and cleanup
wifi: ath12k: reorder group start/stop for safe thermal sysfs cleanup
wifi: ath12k: add thermal cooling device support
Maoyi Xie (1):
wifi: nl80211: re-check wiphy netns in testmode and vendor dump continuations
Michael Bommarito (1):
wifi: mac80211: add KUnit coverage for negotiated TTLM parser
Miri Korenblit (22):
wifi: iwlwifi: mld: set NAN phy capabilities
wifi: iwlwifi: mld: use host rate for NAN management frames
wifi: iwlwifi: mld: extract NAN capabilities setting to a function
wifi: iwlwifi: mld: don't allow softAP with NAN
wifi: iwlwifi: bump core version for BZ/SC/DR to 103
wifi: iwlwifi: mld: allow NAN data
wifi: iwlwifi: support a TLV indicating num of mgmt mcast keys
wifi: iwlwifi: mark that we support iwl_rx_mpdu_desc version 7 and 8
wifi: iwlwifi: stop supporting cores 97 to 100
wifi: iwlwifi: mld: stop supporting iwl_compressed_ba_notif version 5 and 6
wifi: iwlwifi: mld: stop supporting MAC_PM_POWER_TABLE version 1
wifi: iwlwifi: mld: stop supporting TLC_MNG_UPDATE_NTFY_API_S_VER_3
wifi: iwlwifi: mld: stop supporting rate_n_flags version 2
wifi: iwlwifi: bump core version for BZ/SC/DR to 104
wifi: iwlwifi: define MODULE_FIRMWARE with the correct API
wifi: iwlwifi: mld: evacuate NAN channels on link switch
wifi: iwlwifi: mld: don't flush async_handlers_wk when canceling notifications
wifi: iwlwifi: mld: purge async notifications upon nic error
wifi: iwlwifi: bump maximum core version for BZ/SC/DR to 105
wifi: mac80211: add an option to filter out a channel in combinations check
wifi: mac80211: refactor ieee80211_nan_try_evacuate
wifi: mac80211: fix channel evacuation logic
Nicolas Escande (1):
wifi: ath12k: unify error handling in some ath12k_wmi_xxx() functions
Pagadala Yesu Anjaneyulu (3):
wifi: iwlwifi: add RF name handling for PE chip type for debugfs
wifi: iwlwifi: add XIAOMI to PPAG approved list
wifi: iwlwifi: mld: disallow puncturing in US/CA for WH
Ripan Deuri (1):
wifi: ath12k: fix error unwind on arch_init() failure in PCI probe
Rosen Penev (4):
wifi: ath9k: use non devm for nvmem_cell_get
wifi: ath9k: owl: move name into owl_nvmem_probe
wifi: ath9k: use kmemdup and kcalloc
wifi: ath12k: use kzalloc_flex
Shahar Tzarfati (2):
wifi: iwlwifi: mld: expose beacon avg signal
wifi: iwlwifi: Add names for Killer BE1735x and BE1730x
Tamizh Chelvam Raja (1):
wifi: ath12k: Handle DP_RX_DECAP_TYPE_8023 type in Rx path
Thorsten Blum (1):
wifi: cfg80211: use strscpy in cfg80211_wext_giwname
Tristan Madani (1):
wifi: ath9k: fix OOB access from firmware tx status queue ID
Wei Zhang (1):
wifi: ath11k: cancel SSR work items during PCI shutdown
Yingying Tang (1):
wifi: ath12k: add channel 177 to the 5 GHz channel list
pengdonglin (1):
wifi: ath9k: Remove redundant rcu_read_lock/unlock() in spin_lock
drivers/net/wireless/ath/ath10k/core.h | 1 -
drivers/net/wireless/ath/ath10k/htt_tx.c | 2 +-
drivers/net/wireless/ath/ath10k/leds.c | 8 +-
drivers/net/wireless/ath/ath10k/qmi.c | 4 +-
drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h | 1 -
drivers/net/wireless/ath/ath11k/Kconfig | 2 +-
drivers/net/wireless/ath/ath11k/dp.c | 1 +
drivers/net/wireless/ath/ath11k/mhi.c | 4 +-
drivers/net/wireless/ath/ath11k/pci.c | 8 +
drivers/net/wireless/ath/ath11k/qmi.c | 3 +-
drivers/net/wireless/ath/ath11k/qmi.h | 1 -
drivers/net/wireless/ath/ath12k/Kconfig | 6 +-
drivers/net/wireless/ath/ath12k/core.c | 50 +-
drivers/net/wireless/ath/ath12k/core.h | 12 +-
drivers/net/wireless/ath/ath12k/debugfs.c | 46 +
drivers/net/wireless/ath/ath12k/dp_rx.c | 68 +-
drivers/net/wireless/ath/ath12k/mac.c | 110 +-
drivers/net/wireless/ath/ath12k/pci.c | 2 +-
drivers/net/wireless/ath/ath12k/qmi.c | 2 +-
drivers/net/wireless/ath/ath12k/qmi.h | 1 -
drivers/net/wireless/ath/ath12k/thermal.c | 252 +++-
drivers/net/wireless/ath/ath12k/thermal.h | 35 +
drivers/net/wireless/ath/ath12k/wmi.c | 565 ++++++++-
drivers/net/wireless/ath/ath12k/wmi.h | 125 +-
drivers/net/wireless/ath/ath9k/ar9002_hw.c | 6 +-
.../net/wireless/ath/ath9k/ath9k_pci_owl_loader.c | 31 +-
drivers/net/wireless/ath/ath9k/common-init.c | 8 +-
drivers/net/wireless/ath/ath9k/init.c | 11 +-
drivers/net/wireless/ath/ath9k/recv.c | 4 +-
drivers/net/wireless/ath/ath9k/xmit.c | 7 +-
drivers/net/wireless/intel/iwlwifi/Makefile | 2 +-
drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 23 +-
drivers/net/wireless/intel/iwlwifi/cfg/7000.c | 5 +-
drivers/net/wireless/intel/iwlwifi/cfg/8000.c | 5 +-
drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 5 +-
drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 38 +-
drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 19 +-
drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 19 +-
drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c | 8 +-
drivers/net/wireless/intel/iwlwifi/cfg/rf-gf.c | 17 -
drivers/net/wireless/intel/iwlwifi/cfg/rf-hr.c | 30 +-
drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c | 22 +-
drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c | 8 +-
drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 22 +-
.../net/wireless/intel/iwlwifi/fw/api/commands.h | 13 +-
.../net/wireless/intel/iwlwifi/fw/api/datapath.h | 9 +-
.../net/wireless/intel/iwlwifi/fw/api/location.h | 107 +-
.../net/wireless/intel/iwlwifi/fw/api/mac-cfg.h | 184 ++-
drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 48 +-
drivers/net/wireless/intel/iwlwifi/fw/api/rx.h | 40 +-
drivers/net/wireless/intel/iwlwifi/fw/api/sta.h | 3 +-
drivers/net/wireless/intel/iwlwifi/fw/api/stats.h | 90 +-
drivers/net/wireless/intel/iwlwifi/fw/dbg-old.c | 1022 +++++++++++++++
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 1298 +++-----------------
drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 7 +-
drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 15 +-
drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 14 +-
drivers/net/wireless/intel/iwlwifi/fw/file.h | 10 +-
drivers/net/wireless/intel/iwlwifi/fw/img.h | 3 +-
drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 7 +-
drivers/net/wireless/intel/iwlwifi/fw/rs.c | 5 +-
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 9 +-
drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 3 +-
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 14 +-
drivers/net/wireless/intel/iwlwifi/iwl-io.c | 25 +-
drivers/net/wireless/intel/iwlwifi/iwl-io.h | 6 +-
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 150 ++-
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 2 +
drivers/net/wireless/intel/iwlwifi/iwl-nvm-utils.h | 9 +-
drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 7 +-
drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 17 +-
drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 123 +-
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 +
drivers/net/wireless/intel/iwlwifi/mld/ap.c | 58 +-
drivers/net/wireless/intel/iwlwifi/mld/ap.h | 8 +-
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 166 ++-
drivers/net/wireless/intel/iwlwifi/mld/d3.h | 6 +-
drivers/net/wireless/intel/iwlwifi/mld/debugfs.c | 74 +-
.../net/wireless/intel/iwlwifi/mld/ftm-initiator.c | 30 +-
drivers/net/wireless/intel/iwlwifi/mld/iface.c | 187 ++-
drivers/net/wireless/intel/iwlwifi/mld/iface.h | 62 +-
drivers/net/wireless/intel/iwlwifi/mld/key.c | 168 ++-
drivers/net/wireless/intel/iwlwifi/mld/link.c | 569 ++++++++-
drivers/net/wireless/intel/iwlwifi/mld/link.h | 37 +-
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 362 ++++--
drivers/net/wireless/intel/iwlwifi/mld/mcc.c | 13 +-
drivers/net/wireless/intel/iwlwifi/mld/mld.c | 20 +-
drivers/net/wireless/intel/iwlwifi/mld/mld.h | 16 +-
drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 36 +-
drivers/net/wireless/intel/iwlwifi/mld/nan.c | 748 ++++++++++-
drivers/net/wireless/intel/iwlwifi/mld/nan.h | 41 +-
drivers/net/wireless/intel/iwlwifi/mld/notif.c | 35 +-
drivers/net/wireless/intel/iwlwifi/mld/phy.c | 24 +-
drivers/net/wireless/intel/iwlwifi/mld/power.c | 210 +++-
drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mld/rx.c | 44 +-
drivers/net/wireless/intel/iwlwifi/mld/rx.h | 7 +-
drivers/net/wireless/intel/iwlwifi/mld/sta.c | 247 +++-
drivers/net/wireless/intel/iwlwifi/mld/sta.h | 32 +-
drivers/net/wireless/intel/iwlwifi/mld/stats.c | 108 +-
.../net/wireless/intel/iwlwifi/mld/tests/Makefile | 1 +
.../intel/iwlwifi/mld/tests/chan_load_thresh.c | 139 +++
.../intel/iwlwifi/mld/tests/link-selection.c | 6 +-
.../net/wireless/intel/iwlwifi/mld/tests/utils.c | 8 +-
drivers/net/wireless/intel/iwlwifi/mld/tlc.c | 410 ++++---
drivers/net/wireless/intel/iwlwifi/mld/tx.c | 51 +-
.../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 30 +-
.../net/wireless/intel/iwlwifi/mvm/ftm-responder.c | 32 +-
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 4 +-
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +-
drivers/net/wireless/intel/iwlwifi/mvm/power.c | 14 +-
drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 9 +-
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 14 +-
.../wireless/intel/iwlwifi/pcie/gen1_2/internal.h | 107 +-
.../intel/iwlwifi/pcie/gen1_2/trans-gen2.c | 9 +-
.../net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | 93 +-
drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 37 +-
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 70 +-
net/mac80211/chan.c | 78 +-
net/mac80211/ieee80211_i.h | 71 +-
net/mac80211/mlme.c | 3 +-
net/mac80211/nan.c | 55 +-
net/mac80211/tests/.kunitconfig | 4 +
net/mac80211/tests/Makefile | 2 +-
net/mac80211/tests/ttlm.c | 175 +++
net/mac80211/util.c | 34 +-
net/wireless/nl80211.c | 19 +
net/wireless/wext-compat.c | 3 +-
129 files changed, 7083 insertions(+), 2559 deletions(-)
create mode 100644 drivers/net/wireless/intel/iwlwifi/fw/dbg-old.c
create mode 100644 drivers/net/wireless/intel/iwlwifi/mld/tests/chan_load_thresh.c
create mode 100644 net/mac80211/tests/.kunitconfig
create mode 100644 net/mac80211/tests/ttlm.c
^ permalink raw reply
* Re: [PATCH v7 02/15] firmware: qcom: Add a generic PAS service
From: Sumit Garg @ 2026-05-28 13:11 UTC (permalink / raw)
To: Amirreza Zarrabi
Cc: andersson, linux-arm-msm, devicetree, dri-devel, freedreno,
linux-media, netdev, linux-wireless, ath12k, linux-remoteproc,
konradybcio, robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo,
lumag, abhinav.kumar, jesszhan0024, marijn.suijten, airlied,
simona, vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
jens.wiklander, op-tee, apurupa, skare, linux-kernel, Sumit Garg,
Harshal Dev
In-Reply-To: <37fb075c-3f48-4a7c-b05d-090b0b09e04a@oss.qualcomm.com>
Hi Amir,
On Thu, May 28, 2026 at 10:45:32AM +1000, Amirreza Zarrabi wrote:
> Hi Sumit,
>
> On 5/22/2026 9:59 PM, Sumit Garg wrote:
> > From: Sumit Garg <sumit.garg@oss.qualcomm.com>
> >
> > Qcom platforms has the legacy of using non-standard SCM calls
> > splintered over the various kernel drivers. These SCM calls aren't
> > compliant with the standard SMC calling conventions which is a
> > prerequisite to enable migration to the FF-A specifications from Arm.
> >
> > OP-TEE as an alternative trusted OS to Qualcomm TEE (QTEE) can't
> > support these non-standard SCM calls. And even for newer architectures
> > using S-EL2 with Hafnium support, QTEE won't be able to support SCM
> > calls either with FF-A requirements coming in. And with both OP-TEE
> > and QTEE drivers well integrated in the TEE subsystem, it makes further
> > sense to reuse the TEE bus client drivers infrastructure.
> >
> > The added benefit of TEE bus infrastructure is that there is support
> > for discoverable/enumerable services. With that client drivers don't
> > have to manually invoke a special SCM call to know the service status.
> >
> > So enable the generic Peripheral Authentication Service (PAS) provided
> > by the firmware. It acts as the common layer with different TZ
> > backends plugged in whether it's an SCM implementation or a proper
> > TEE bus based PAS service implementation.
> >
> > Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> > Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
> > Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
> > Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650
> > Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > ---
> > drivers/firmware/qcom/Kconfig | 8 +
> > drivers/firmware/qcom/Makefile | 1 +
> > drivers/firmware/qcom/qcom_pas.c | 291 +++++++++++++++++++++++++
> > drivers/firmware/qcom/qcom_pas.h | 50 +++++
> > include/linux/firmware/qcom/qcom_pas.h | 43 ++++
> > 5 files changed, 393 insertions(+)
> > create mode 100644 drivers/firmware/qcom/qcom_pas.c
> > create mode 100644 drivers/firmware/qcom/qcom_pas.h
> > create mode 100644 include/linux/firmware/qcom/qcom_pas.h
> >
> > diff --git a/drivers/firmware/qcom/Kconfig b/drivers/firmware/qcom/Kconfig
> > index b477d54b495a..9f66cc774508 100644
> > --- a/drivers/firmware/qcom/Kconfig
> > +++ b/drivers/firmware/qcom/Kconfig
> > @@ -6,6 +6,14 @@
> >
> > menu "Qualcomm firmware drivers"
> >
> > +config QCOM_PAS
> > + tristate "Qualcomm generic PAS interface driver"
> > + help
> > + Enable the generic Peripheral Authentication Service (PAS) provided
> > + by the firmware. It acts as the common layer with different TZ
> > + backends plugged in whether it's an SCM implementation or a proper
> > + TEE bus based PAS service implementation.
> > +
> > config QCOM_SCM
> > select QCOM_TZMEM
> > tristate
> > diff --git a/drivers/firmware/qcom/Makefile b/drivers/firmware/qcom/Makefile
> > index 0be40a1abc13..dc5ab45f906a 100644
> > --- a/drivers/firmware/qcom/Makefile
> > +++ b/drivers/firmware/qcom/Makefile
> > @@ -8,3 +8,4 @@ qcom-scm-objs += qcom_scm.o qcom_scm-smc.o qcom_scm-legacy.o
> > obj-$(CONFIG_QCOM_TZMEM) += qcom_tzmem.o
> > obj-$(CONFIG_QCOM_QSEECOM) += qcom_qseecom.o
> > obj-$(CONFIG_QCOM_QSEECOM_UEFISECAPP) += qcom_qseecom_uefisecapp.o
> > +obj-$(CONFIG_QCOM_PAS) += qcom_pas.o
<snip>
> > diff --git a/include/linux/firmware/qcom/qcom_pas.h b/include/linux/firmware/qcom/qcom_pas.h
> > new file mode 100644
> > index 000000000000..65b1c9564458
> > --- /dev/null
> > +++ b/include/linux/firmware/qcom/qcom_pas.h
> > @@ -0,0 +1,43 @@
> > +/* SPDX-License-Identifier: GPL-2.0-only */
> > +/*
> > + * Copyright (c) 2010-2015, 2018-2019 The Linux Foundation. All rights reserved.
> > + * Copyright (C) 2015 Linaro Ltd.
> > + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
> > + */
> > +
> > +#ifndef __QCOM_PAS_H
> > +#define __QCOM_PAS_H
> > +
> > +#include <linux/err.h>
> > +#include <linux/types.h>
> > +
> > +struct qcom_pas_context {
> > + struct device *dev;
> > + u32 pas_id;
> > + phys_addr_t mem_phys;
> > + size_t mem_size;
> > + void *ptr;
> > + dma_addr_t phys;
> > + ssize_t size;
> > + bool use_tzmem;
> > +};
> > +
> > +bool qcom_pas_is_available(void);
> > +struct qcom_pas_context *devm_qcom_pas_context_alloc(struct device *dev,
> > + u32 pas_id,
> > + phys_addr_t mem_phys,
> > + size_t mem_size);
> > +int qcom_pas_init_image(u32 pas_id, const void *metadata, size_t size,
> > + struct qcom_pas_context *ctx);
> > +struct resource_table *qcom_pas_get_rsc_table(struct qcom_pas_context *ctx,
> > + void *input_rt, size_t input_rt_size,
> > + size_t *output_rt_size);
> > +int qcom_pas_mem_setup(u32 pas_id, phys_addr_t addr, phys_addr_t size);
> > +int qcom_pas_auth_and_reset(u32 pas_id);
> > +int qcom_pas_prepare_and_auth_reset(struct qcom_pas_context *ctx);
> > +int qcom_pas_set_remote_state(u32 state, u32 pas_id);
> > +int qcom_pas_shutdown(u32 pas_id);
> > +bool qcom_pas_supported(u32 pas_id);
> > +void qcom_pas_metadata_release(struct qcom_pas_context *ctx);
> > +
> > +#endif /* __QCOM_PAS_H */
>
> I have a question about the shape of the generic PAS abstraction.
>
> Looking at the current interface, it seems that pas_id is still treated as
> the primary identity for most PAS operations, while struct qcom_pas_context
> is used as optional extended state for the operations that need it. I can see
> how this maps well to the existing SCM PAS interface and keeps the transition
> simple.
>
> However, I wonder if this makes the abstraction less generic in the long term.
> Some callbacks in struct qcom_pas_ops receive only pas_id, while others
> receive struct qcom_pas_context *ctx. This works as long as pas_id is
> sufficient for those operations. But if a backend needs per-peripheral
> private state for operations such as auth_and_reset,
> shutdown, or set_remote_state, it would need to reconstruct that state from
> pas_id or maintain a separate pas_id to backend-context mapping.
>
> Would it be cleaner to make struct qcom_pas_context the common
> per-peripheral object and pass it consistently to all per-peripheral callbacks?
> Existing backends could still use ctx->pas_id, but future backends would not
> need to perform a separate lookup only because the callback was passed a raw
> pas_id.
The common evolution for a generic abstraction comes when it's needed.
So once the client driver or the backend comes up with certain
requirements then the generic PAS layer can be extended as needed. It
should be possible for more APIs to migrate to using PAS context but
there should be corresponding use-case requirements.
>
> I also wonder whether struct qcom_pas_context is exposing some
> implementation-specific state. Fields such as ptr, phys, size, and
> use_tzmem seem to describe how the current SCM/QTEE implementations manage
> metadata memory, rather than generic PAS state. For another backend, the
> per-operation state might be a tee_shm, an FF-A memory handle, shared or lent
> memory state, or something else transport-specific.
>
> Would it make sense to keep only the common PAS fields in
> struct qcom_pas_context, such as dev, pas_id, and possibly the firmware
> memory address/size if those are truly generic, and add a backend-private
> pointer for implementation-specific state?
Currently, the 2 backends can re-use parts of the PAS context but I
agree more abstraction can be done as needed for future backends.
>
> I may be missing a reason why the pas_id-only callbacks are preferred, but if
> this is intended to be the long-term generic PAS layer rather than mainly a
> shim over the existing SCM API shape, using the context consistently and keeping
> backend-specific state private seems easier to extend.
As I mentioned above, the generic PAS layer isn't fixed but it will
surely go through evolution as needed. Current abstraction handles the
existing client driver and backend requirments.
Moreover the subsystem maintainers are already complaining about this
series being too large for the merge to happen.
-Sumit
^ permalink raw reply
* Re: [patch 24/24] ptp: Switch to ktime_get_snapshot_id() for pre/post timestamps
From: Thomas Gleixner @ 2026-05-28 13:55 UTC (permalink / raw)
To: Jakub Kicinski
Cc: LKML, David Woodhouse, Miroslav Lichvar, John Stultz,
Stephen Boyd, Anna-Maria Behnsen, Frederic Weisbecker,
thomas.weissschuh, Arthur Kiyanovski, Rodolfo Giometti,
Vincent Donnefort, Marc Zyngier, Oliver Upton, kvmarm,
Oliver Upton, Richard Cochran, netdev, Takashi Iwai,
Miri Korenblit, Johannes Berg, Jacob Keller, Tony Nguyen,
Saeed Mahameed, Peter Hilber, Michael S. Tsirkin, virtualization,
linux-wireless, linux-sound
In-Reply-To: <20260527165621.0ddad586@kernel.org>
On Wed, May 27 2026 at 16:56, Jakub Kicinski wrote:
> On Tue, 26 May 2026 19:15:27 +0200 Thomas Gleixner wrote:
>> - if (sts && bp->ts_window_adjust) {
>> - s64 ns = timespec64_to_ns(&sts->post_ts);
>> -
>> - sts->post_ts = ns_to_timespec64(ns - bp->ts_window_adjust);
>> - }
>> + if (sts && bp->ts_window_adjust)
>> + sts->post_ts.sys -= bp->ts_window_adjust;
>
> FWIW build says:
>
> drivers/ptp/ptp_ocp.c:1495:8: error: no member named 'post_ts' in 'struct ptp_system_timestamp'
> 1495 | sts->post_ts.sys -= bp->ts_window_adjust;
> | ~~~ ^
Noticed too and fixed locally already.
^ permalink raw reply
* [PATCH v4 1/7] b43: add firmware mappings for rev22
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
add the specific firmware mappings for rev22, and drop comments wondering about rev22 initvals
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/main.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index b0e6aeb0b..37c5d9928 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -2344,6 +2344,10 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
if (phy->type == B43_PHYTYPE_N)
filename = "ucode16_mimo";
break;
+ case 22:
+ if (phy->type == B43_PHYTYPE_N)
+ filename = "ucode22_mimo";
+ break;
case 16 ... 19:
if (phy->type == B43_PHYTYPE_N)
filename = "ucode16_mimo";
@@ -2405,7 +2409,9 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
else if (rev == 24)
filename = "n0initvals24";
else if (rev == 23)
- filename = "n0initvals16"; /* What about n0initvals22? */
+ filename = "n0initvals16";
+ else if (rev == 22)
+ filename = "n0initvals22";
else if (rev >= 16 && rev <= 18)
filename = "n0initvals16";
else if (rev >= 11 && rev <= 12)
@@ -2465,7 +2471,9 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
else if (rev == 24)
filename = "n0bsinitvals24";
else if (rev == 23)
- filename = "n0bsinitvals16"; /* What about n0bsinitvals22? */
+ filename = "n0bsinitvals16";
+ else if (rev == 22)
+ filename = "n0bsinitvals22";
else if (rev >= 16 && rev <= 18)
filename = "n0bsinitvals16";
else if (rev >= 11 && rev <= 12)
--
2.54.0
^ permalink raw reply related
* [PATCH v4 3/7] b43: route d11 corerev 22 to 24-bit indirect radio access
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
Rev 22 backports the older 802.11 core but pairs it with a radio
in the 2057 family, which requires the 24-bit indirect path. With
the current dispatch, corerev 22 falls into the legacy 4-wire branch,
reads garbage for radio_id, and bails out with -EOPNOTSUPP at the
"FOUND UNSUPPORTED RADIO" branch below.
brcmsmac handles the same silicon family with the equivalent
dispatch in drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/
phy_cmn.c read_radio_reg() and write_radio_reg():
if ((D11REV_GE(pi->sh->corerev, 24)) ||
(D11REV_IS(pi->sh->corerev, 22)
&& (pi->pubpi.phy_type != PHY_TYPE_SSN))) {
/* radioregaddr / radioregdata (indirect) */
} else {
/* phy4waddr / phy4wdatalo (legacy) */
}
b43 does not support SSN/SSLPN PHYs - they are rejected earlier in
b43_phy_versioning() at the "unsupported PHY type" switch - so just
adding the check corerev == 22 will do.
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index 85ea8fdd9..783af26cb 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -4563,7 +4563,11 @@ static int b43_phy_versioning(struct b43_wldev *dev)
radio_id = b43_read16(dev, B43_MMIO_RADIO24_DATA);
radio_ver = 0; /* Is there version somewhere? */
- } else if (core_rev >= 24) {
+ } else if (core_rev >= 24 || core_rev == 22) {
+ /*
+ * D11 corerev 22 pairs an older 802.11 core with a 2057
+ * radio that requires the 24-bit indirect access path.
+ */
u16 radio24[3];
for (tmp = 0; tmp < 3; tmp++) {
--
2.54.0
^ permalink raw reply related
* [PATCH v4 5/7] b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
Add the 2.4 GHz IPA TX gain table for N-PHY rev 8 paired with radio
2057 rev 8 and wire it to the existing dispatcher.
b43_nphy_get_ipa_gain_table() in tables_nphy.c currently handles
case 8 only for radio_rev == 5; radio_rev == 8 falls through and
the function logs:
b43-phyX ERROR: No 2GHz IPA gain table available for this device
b43-phyX ERROR: PHY init: Channel switch to default failed
leaving b43_phy_init() to return an error and core_init to abort
before the MAC is enabled.
The high byte of every entry differs from the rev 5 sibling (0x40
vs 0x30): different PAD-gain code prefix for the rev 8 front-end.
The low 24 bits coincide with rev 5 across the whole table - the
gain step amplitudes are the same, only the PAD-gain selector
prefix changes.
Values extracted from an MMIO dump of the proprietary Broadcom wl
driver running on BCM6362 silicon (wl driver 6.30.102.7).
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/tables_nphy.c | 39 +++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/drivers/net/wireless/broadcom/b43/tables_nphy.c b/drivers/net/wireless/broadcom/b43/tables_nphy.c
index 41a25d909..84e8d718d 100644
--- a/drivers/net/wireless/broadcom/b43/tables_nphy.c
+++ b/drivers/net/wireless/broadcom/b43/tables_nphy.c
@@ -2715,6 +2715,43 @@ static const u32 b43_ntab_tx_gain_ipa_2057_rev5_2g[] = {
0x300f0715, 0x300f0715, 0x300f0715, 0x300f0715,
};
+/* Extracted from MMIO dump of 6.30.102.7 */
+static const u32 b43_ntab_tx_gain_ipa_2057_rev8_2g[] = {
+ 0x40ff0031, 0x40e70031, 0x40e7002e, 0x40cf002e,
+ 0x40bf002e, 0x40af002e, 0x409f002f, 0x407f0033,
+ 0x407f0031, 0x407f002e, 0x4077002e, 0x406f002e,
+ 0x4067002e, 0x405f002f, 0x40570030, 0x4057002d,
+ 0x404f002e, 0x40470031, 0x4047002e, 0x4047002c,
+ 0x40470029, 0x403f002c, 0x403f0029, 0x4037002d,
+ 0x4037002a, 0x40370028, 0x402f002c, 0x402f002a,
+ 0x402f0028, 0x402f0026, 0x4027002c, 0x40270029,
+ 0x40270027, 0x40270025, 0x40270023, 0x401f002c,
+ 0x401f002a, 0x401f0028, 0x401f0025, 0x401f0024,
+ 0x401f0022, 0x401f001f, 0x4017002d, 0x4017002b,
+ 0x40170028, 0x40170026, 0x40170024, 0x40170022,
+ 0x40170020, 0x4017001e, 0x4017001d, 0x4017001b,
+ 0x4017001a, 0x40170018, 0x40170017, 0x40170015,
+ 0x400f002c, 0x400f0029, 0x400f0027, 0x400f0024,
+ 0x400f0022, 0x400f0021, 0x400f001f, 0x400f001d,
+ 0x400f001b, 0x400f001a, 0x400f0018, 0x400f0017,
+ 0x400f0016, 0x400f0015, 0x400f0115, 0x400f0215,
+ 0x400f0315, 0x400f0415, 0x400f0515, 0x400f0615,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+ 0x400f0715, 0x400f0715, 0x400f0715, 0x400f0715,
+};
+
+
/* Extracted from MMIO dump of 6.30.223.141 */
static const u32 b43_ntab_tx_gain_ipa_2057_rev9_2g[] = {
0x60ff0031, 0x60e7002c, 0x60cf002a, 0x60c70029,
@@ -3651,6 +3688,8 @@ static const u32 *b43_nphy_get_ipa_gain_table(struct b43_wldev *dev)
case 8:
if (phy->radio_rev == 5)
return b43_ntab_tx_gain_ipa_2057_rev5_2g;
+ if (phy->radio_rev == 8)
+ return b43_ntab_tx_gain_ipa_2057_rev8_2g;
break;
case 6:
if (dev->dev->chip_id == BCMA_CHIP_ID_BCM47162)
--
2.54.0
^ permalink raw reply related
* [PATCH v4 2/7] b43: add d11 core revision 0x16 to id table
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
Add d11 core revision 0x16 (= 22) to the b43 bcma device id table.
The b43 bcma id table covers d11 revisions 0x11, 0x15, 0x17, 0x18,
0x1C, 0x1D, 0x1E, 0x28 and 0x2A. Revision 0x16 belongs to the same
N-PHY family as revisions 0x17 and 0x18 (radio 2057) and needs no
new PHY or radio code beyond the radio_rev 8 dispatcher entries
added later in this series - only the device id entry is missing.
Without it bcma scan enumerates the 802.11 core but no driver binds.
The revision is used by the Broadcom BCM6362 single-die integrated
2.4 GHz wireless block found in xDSL SoCs.
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index 37c5d9928..85ea8fdd9 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -117,6 +117,7 @@ MODULE_PARM_DESC(allhwsupport, "Enable support for all hardware (even it if over
static const struct bcma_device_id b43_bcma_tbl[] = {
BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x11, BCMA_ANY_CLASS),
BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x15, BCMA_ANY_CLASS),
+ BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x16, BCMA_ANY_CLASS),
BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1C, BCMA_ANY_CLASS),
--
2.54.0
^ permalink raw reply related
* [PATCH v4 4/7] b43: support radio 2057 rev 8
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
Add support for radio 2057 revision 8, paired with N-PHY rev 8 on
the Broadcom BCM6362 single-die integrated 2.4 GHz wireless block.
Three correlated changes are needed for the same chip:
- main.c: the radio_rev allow-list under B43_PHYTYPE_N currently
accepts radio 2057 revisions 9 and 14 only; extend to include
rev 8.
- radio_2057.c: the existing r2057_rev8_init[] is a 54-entry stub
declared inside a TODO comment block and never referenced
from r2057_upload_inittabs().
Replace it with the full 412-entry register set actually
programmed by the proprietary Broadcom wl driver on this radio.
I couldn't find the origin of the original 54-entry stub - 8
of its entries do not appear at all in the rev 8 register set
and 7 more carry different values.
Loading it instead of using the real table leaves the radio
hanging producing a "Microcode not responding" timeout.
- radio_2057.c: r2057_upload_inittabs() case 8 handles radio_rev
5 and 7 only; add the radio_rev == 8 branch pointing at the
new table.
The init table is extracted from an MMIO dump of the radio
register set programmed during proprietary driver initialisation
on BCM6362 silicon (Broadcom wl driver 6.30.102.7).
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/main.c | 3 +-
drivers/net/wireless/broadcom/b43/radio_2057.c | 124 +++++++++++++++++++++----
2 files changed, 110 insertions(+), 17 deletions(-)
diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
index 783af26cb..817448e58 100644
--- a/drivers/net/wireless/broadcom/b43/main.c
+++ b/drivers/net/wireless/broadcom/b43/main.c
@@ -4617,7 +4617,8 @@ static int b43_phy_versioning(struct b43_wldev *dev)
radio_id != 0x2057)
unsupported = 1;
if (radio_id == 0x2057 &&
- !(radio_rev == 9 || radio_rev == 14))
+ !(radio_rev == 8 || radio_rev == 9 ||
+ radio_rev == 14))
unsupported = 1;
break;
case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/broadcom/b43/radio_2057.c b/drivers/net/wireless/broadcom/b43/radio_2057.c
index bd7dafb56..9f693d92b 100644
--- a/drivers/net/wireless/broadcom/b43/radio_2057.c
+++ b/drivers/net/wireless/broadcom/b43/radio_2057.c
@@ -73,24 +73,112 @@ static u16 r2057_rev7_init[][2] = {
{ 0x1B7, 0x05 }, { 0x1C2, 0xa0 },
};
-/* TODO: Which devices should use it?
+/* Extracted from MMIO dump of 6.30.102.7 */
static u16 r2057_rev8_init[][2] = {
- { 0x00, 0x08 }, { 0x01, 0x57 }, { 0x02, 0x20 }, { 0x31, 0x00 },
- { 0x32, 0x00 }, { 0x33, 0x00 }, { 0x51, 0x70 }, { 0x59, 0x88 },
- { 0x5C, 0x20 }, { 0x62, 0x33 }, { 0x63, 0x0f }, { 0x64, 0x0f },
- { 0x6E, 0x58 }, { 0x75, 0x13 }, { 0x7B, 0x13 }, { 0x7C, 0x0f },
- { 0x7D, 0xee }, { 0x81, 0x01 }, { 0x91, 0x3f }, { 0x92, 0x36 },
- { 0xA1, 0x20 }, { 0xC9, 0x01 }, { 0xD6, 0x70 }, { 0xDE, 0x88 },
- { 0xE1, 0x20 }, { 0xE8, 0x0f }, { 0xE9, 0x0f }, { 0xF3, 0x58 },
- { 0xFA, 0x13 }, { 0x100, 0x13 }, { 0x101, 0x0f }, { 0x102, 0xee },
- { 0x106, 0x01 }, { 0x116, 0x3f }, { 0x117, 0x36 }, { 0x126, 0x20 },
- { 0x14E, 0x01 }, { 0x15E, 0x00 }, { 0x15F, 0x00 }, { 0x160, 0x00 },
- { 0x161, 0x00 }, { 0x162, 0x00 }, { 0x163, 0x00 }, { 0x16A, 0x00 },
- { 0x16B, 0x00 }, { 0x16C, 0x00 }, { 0x1A4, 0x00 }, { 0x1A5, 0x00 },
- { 0x1A6, 0x00 }, { 0x1AA, 0x00 }, { 0x1AB, 0x00 }, { 0x1AC, 0x00 },
- { 0x1B7, 0x05 }, { 0x1C2, 0xa0 },
+ { 0x0000, 0x0008 }, { 0x0001, 0x0057 }, { 0x0002, 0x0020 }, { 0x0003, 0x001f },
+ { 0x0004, 0x0004 }, { 0x0005, 0x0002 }, { 0x0006, 0x0001 }, { 0x0007, 0x0001 },
+ { 0x0008, 0x0001 }, { 0x0009, 0x0069 }, { 0x000a, 0x0066 }, { 0x000b, 0x0006 },
+ { 0x000c, 0x0018 }, { 0x000d, 0x0003 }, { 0x000e, 0x0020 }, { 0x000f, 0x0020 },
+ { 0x0010, 0x0000 }, { 0x0011, 0x007c }, { 0x0012, 0x0042 }, { 0x0013, 0x00bd },
+ { 0x0014, 0x0007 }, { 0x0015, 0x0087 }, { 0x0016, 0x0008 }, { 0x0017, 0x0017 },
+ { 0x0018, 0x0007 }, { 0x0019, 0x0000 }, { 0x001a, 0x0002 }, { 0x001b, 0x0013 },
+ { 0x001c, 0x003e }, { 0x001d, 0x003e }, { 0x001e, 0x0096 }, { 0x001f, 0x0004 },
+ { 0x0020, 0x0000 }, { 0x0021, 0x0000 }, { 0x0022, 0x0017 }, { 0x0023, 0x0006 },
+ { 0x0024, 0x0001 }, { 0x0025, 0x0006 }, { 0x0026, 0x0004 }, { 0x0027, 0x000d },
+ { 0x0028, 0x000d }, { 0x0029, 0x0030 }, { 0x002a, 0x0032 }, { 0x002b, 0x0008 },
+ { 0x002c, 0x001c }, { 0x002d, 0x0002 }, { 0x002e, 0x0004 }, { 0x002f, 0x007f },
+ { 0x0030, 0x0027 }, { 0x0031, 0x0000 }, { 0x0032, 0x0000 }, { 0x0033, 0x0000 },
+ { 0x0034, 0x0000 }, { 0x0035, 0x0020 }, { 0x0036, 0x0018 }, { 0x0037, 0x0007 },
+ { 0x0038, 0x0066 }, { 0x0039, 0x0066 }, { 0x003a, 0x0066 }, { 0x003b, 0x0066 },
+ { 0x003c, 0x00ff }, { 0x003d, 0x00ff }, { 0x003e, 0x00ff }, { 0x003f, 0x00ff },
+ { 0x0040, 0x0016 }, { 0x0041, 0x0007 }, { 0x0042, 0x0029 }, { 0x0043, 0x0007 },
+ { 0x0044, 0x0006 }, { 0x0045, 0x0003 }, { 0x0046, 0x0001 }, { 0x0047, 0x0007 },
+ { 0x0048, 0x0088 }, { 0x0049, 0x0005 }, { 0x004a, 0x0077 }, { 0x004b, 0x0066 },
+ { 0x004c, 0x0066 }, { 0x004d, 0x0000 }, { 0x004e, 0x0004 }, { 0x004f, 0x000c },
+ { 0x0050, 0x0000 }, { 0x0051, 0x0070 }, { 0x0056, 0x0007 }, { 0x0057, 0x0000 },
+ { 0x0058, 0x0000 }, { 0x0059, 0x0088 }, { 0x005a, 0x0000 }, { 0x005b, 0x001f },
+ { 0x005c, 0x0020 }, { 0x005d, 0x0001 }, { 0x005e, 0x0030 }, { 0x005f, 0x0070 },
+ { 0x0060, 0x0000 }, { 0x0061, 0x0000 }, { 0x0062, 0x0033 }, { 0x0063, 0x000f },
+ { 0x0064, 0x0013 }, { 0x0065, 0x0000 }, { 0x0066, 0x00ee }, { 0x0069, 0x0000 },
+ { 0x006a, 0x007e }, { 0x006b, 0x003f }, { 0x006c, 0x007f }, { 0x006d, 0x0078 },
+ { 0x006e, 0x0058 }, { 0x006f, 0x0088 }, { 0x0070, 0x0008 }, { 0x0071, 0x000f },
+ { 0x0072, 0x00bc }, { 0x0073, 0x0008 }, { 0x0074, 0x0060 }, { 0x0075, 0x001a },
+ { 0x0076, 0x0070 }, { 0x0077, 0x0000 }, { 0x0078, 0x0000 }, { 0x0079, 0x0000 },
+ { 0x007a, 0x0033 }, { 0x007b, 0x001a }, { 0x007c, 0x0014 }, { 0x007d, 0x00ee },
+ { 0x0080, 0x003c }, { 0x0081, 0x0001 }, { 0x0082, 0x000a }, { 0x0083, 0x009d },
+ { 0x0084, 0x000a }, { 0x0085, 0x0000 }, { 0x0086, 0x0040 }, { 0x0087, 0x0040 },
+ { 0x0088, 0x0088 }, { 0x0089, 0x0010 }, { 0x008a, 0x00f0 }, { 0x008b, 0x0010 },
+ { 0x008c, 0x00f0 }, { 0x008d, 0x0000 }, { 0x008e, 0x0000 }, { 0x008f, 0x0010 },
+ { 0x0090, 0x0055 }, { 0x0091, 0x003f }, { 0x0092, 0x0036 }, { 0x0093, 0x0000 },
+ { 0x0094, 0x0000 }, { 0x0095, 0x0000 }, { 0x0096, 0x0087 }, { 0x0097, 0x0011 },
+ { 0x0098, 0x0000 }, { 0x0099, 0x0033 }, { 0x009a, 0x0088 }, { 0x009b, 0x0000 },
+ { 0x009c, 0x0087 }, { 0x009d, 0x0011 }, { 0x009e, 0x0000 }, { 0x009f, 0x0033 },
+ { 0x00a0, 0x0088 }, { 0x00a1, 0x0020 }, { 0x00a2, 0x003f }, { 0x00a3, 0x0044 },
+ { 0x00a4, 0x008c }, { 0x00a5, 0x006c }, { 0x00a6, 0x0022 }, { 0x00a7, 0x00be },
+ { 0x00a8, 0x0055 }, { 0x00aa, 0x000c }, { 0x00ab, 0x00aa }, { 0x00ac, 0x0002 },
+ { 0x00ad, 0x0000 }, { 0x00ae, 0x0010 }, { 0x00af, 0x0001 }, { 0x00b0, 0x0000 },
+ { 0x00b1, 0x0000 }, { 0x00b2, 0x0080 }, { 0x00b3, 0x0060 }, { 0x00b4, 0x0044 },
+ { 0x00b5, 0x0055 }, { 0x00b6, 0x0001 }, { 0x00b7, 0x0055 }, { 0x00b8, 0x0001 },
+ { 0x00b9, 0x0005 }, { 0x00ba, 0x0055 }, { 0x00bb, 0x0055 }, { 0x00c1, 0x0000 },
+ { 0x00c2, 0x0000 }, { 0x00c3, 0x0000 }, { 0x00c4, 0x0000 }, { 0x00c5, 0x0000 },
+ { 0x00c6, 0x0000 }, { 0x00c7, 0x0000 }, { 0x00c8, 0x0000 }, { 0x00c9, 0x0001 },
+ { 0x00ca, 0x0000 }, { 0x00cb, 0x0000 }, { 0x00cc, 0x0000 }, { 0x00cd, 0x0000 },
+ { 0x00ce, 0x005e }, { 0x00cf, 0x000c }, { 0x00d0, 0x000c }, { 0x00d1, 0x000c },
+ { 0x00d2, 0x0000 }, { 0x00d3, 0x002b }, { 0x00d4, 0x000c }, { 0x00d5, 0x0000 },
+ { 0x00d6, 0x0070 }, { 0x00db, 0x0007 }, { 0x00dc, 0x0000 }, { 0x00dd, 0x0000 },
+ { 0x00de, 0x0088 }, { 0x00df, 0x0000 }, { 0x00e0, 0x001f }, { 0x00e1, 0x0020 },
+ { 0x00e2, 0x0001 }, { 0x00e3, 0x0030 }, { 0x00e4, 0x0070 }, { 0x00e5, 0x0000 },
+ { 0x00e6, 0x0000 }, { 0x00e7, 0x0033 }, { 0x00e8, 0x000f }, { 0x00e9, 0x0013 },
+ { 0x00ea, 0x0000 }, { 0x00eb, 0x00ee }, { 0x00ee, 0x0000 }, { 0x00ef, 0x007e },
+ { 0x00f0, 0x003f }, { 0x00f1, 0x007f }, { 0x00f2, 0x0078 }, { 0x00f3, 0x0058 },
+ { 0x00f4, 0x0088 }, { 0x00f5, 0x0008 }, { 0x00f6, 0x000f }, { 0x00f7, 0x00bc },
+ { 0x00f8, 0x0008 }, { 0x00f9, 0x0060 }, { 0x00fa, 0x001a }, { 0x00fb, 0x0070 },
+ { 0x00fc, 0x0000 }, { 0x00fd, 0x0000 }, { 0x00fe, 0x0000 }, { 0x00ff, 0x0033 },
+ { 0x0100, 0x001a }, { 0x0101, 0x0014 }, { 0x0102, 0x00ee }, { 0x0105, 0x003c },
+ { 0x0106, 0x0001 }, { 0x0107, 0x000a }, { 0x0108, 0x009d }, { 0x0109, 0x000a },
+ { 0x010a, 0x0000 }, { 0x010b, 0x0040 }, { 0x010c, 0x0040 }, { 0x010d, 0x0088 },
+ { 0x010e, 0x0010 }, { 0x010f, 0x00f0 }, { 0x0110, 0x0010 }, { 0x0111, 0x00f0 },
+ { 0x0112, 0x0000 }, { 0x0113, 0x0000 }, { 0x0114, 0x0010 }, { 0x0115, 0x0055 },
+ { 0x0116, 0x003f }, { 0x0117, 0x0036 }, { 0x0118, 0x0000 }, { 0x0119, 0x0000 },
+ { 0x011a, 0x0000 }, { 0x011b, 0x0087 }, { 0x011c, 0x0011 }, { 0x011d, 0x0000 },
+ { 0x011e, 0x0033 }, { 0x011f, 0x0088 }, { 0x0120, 0x0000 }, { 0x0121, 0x0087 },
+ { 0x0122, 0x0011 }, { 0x0123, 0x0000 }, { 0x0124, 0x0033 }, { 0x0125, 0x0088 },
+ { 0x0126, 0x0020 }, { 0x0127, 0x003f }, { 0x0128, 0x0044 }, { 0x0129, 0x008c },
+ { 0x012a, 0x006c }, { 0x012b, 0x0022 }, { 0x012c, 0x00be }, { 0x012d, 0x0055 },
+ { 0x012f, 0x000c }, { 0x0130, 0x00aa }, { 0x0131, 0x0002 }, { 0x0132, 0x0000 },
+ { 0x0133, 0x0010 }, { 0x0134, 0x0001 }, { 0x0135, 0x0000 }, { 0x0136, 0x0000 },
+ { 0x0137, 0x0080 }, { 0x0138, 0x0060 }, { 0x0139, 0x0044 }, { 0x013a, 0x0055 },
+ { 0x013b, 0x0001 }, { 0x013c, 0x0055 }, { 0x013d, 0x0001 }, { 0x013e, 0x0005 },
+ { 0x013f, 0x0055 }, { 0x0140, 0x0055 }, { 0x0146, 0x0000 }, { 0x0147, 0x0000 },
+ { 0x0148, 0x0000 }, { 0x0149, 0x0000 }, { 0x014a, 0x0000 }, { 0x014b, 0x0000 },
+ { 0x014c, 0x0000 }, { 0x014d, 0x0000 }, { 0x014e, 0x0001 }, { 0x014f, 0x0000 },
+ { 0x0150, 0x0000 }, { 0x0151, 0x0000 }, { 0x0154, 0x000c }, { 0x0155, 0x000c },
+ { 0x0156, 0x000c }, { 0x0157, 0x0000 }, { 0x0158, 0x002b }, { 0x0159, 0x0084 },
+ { 0x015a, 0x0015 }, { 0x015b, 0x000f }, { 0x015c, 0x0000 }, { 0x015d, 0x0000 },
+ { 0x015e, 0x0000 }, { 0x015f, 0x0000 }, { 0x0160, 0x0000 }, { 0x0161, 0x0000 },
+ { 0x0162, 0x0000 }, { 0x0163, 0x0000 }, { 0x0164, 0x0000 }, { 0x0165, 0x0000 },
+ { 0x0166, 0x0000 }, { 0x0167, 0x0000 }, { 0x0168, 0x0000 }, { 0x0169, 0x0000 },
+ { 0x016a, 0x0000 }, { 0x016b, 0x0000 }, { 0x016c, 0x0000 }, { 0x016d, 0x0000 },
+ { 0x0170, 0x0000 }, { 0x0171, 0x0077 }, { 0x0172, 0x0077 }, { 0x0173, 0x0077 },
+ { 0x0174, 0x0077 }, { 0x0175, 0x0000 }, { 0x0176, 0x0003 }, { 0x0177, 0x0037 },
+ { 0x0178, 0x0003 }, { 0x0179, 0x0000 }, { 0x017a, 0x0021 }, { 0x017b, 0x0002 },
+ { 0x017c, 0x0000 }, { 0x017d, 0x00aa }, { 0x017e, 0x0000 }, { 0x017f, 0x00aa },
+ { 0x0180, 0x0000 }, { 0x0190, 0x0000 }, { 0x0191, 0x0077 }, { 0x0192, 0x0077 },
+ { 0x0193, 0x0077 }, { 0x0194, 0x0077 }, { 0x0195, 0x0000 }, { 0x0196, 0x0003 },
+ { 0x0197, 0x0037 }, { 0x0198, 0x0003 }, { 0x0199, 0x0000 }, { 0x019a, 0x0021 },
+ { 0x019b, 0x0002 }, { 0x019c, 0x0000 }, { 0x019d, 0x00aa }, { 0x019e, 0x0000 },
+ { 0x019f, 0x00aa }, { 0x01a0, 0x0000 }, { 0x01a1, 0x0002 }, { 0x01a2, 0x000f },
+ { 0x01a3, 0x000f }, { 0x01a4, 0x0000 }, { 0x01a5, 0x0000 }, { 0x01a6, 0x0000 },
+ { 0x01a7, 0x0002 }, { 0x01a8, 0x000f }, { 0x01a9, 0x000f }, { 0x01aa, 0x0000 },
+ { 0x01ab, 0x0000 }, { 0x01ac, 0x0000 }, { 0x01ad, 0x0084 }, { 0x01ae, 0x0060 },
+ { 0x01af, 0x0047 }, { 0x01b0, 0x0047 }, { 0x01b1, 0x0000 }, { 0x01b2, 0x0000 },
+ { 0x01b3, 0x0000 }, { 0x01b4, 0x0000 }, { 0x01b5, 0x0000 }, { 0x01b6, 0x0000 },
+ { 0x01b7, 0x0005 }, { 0x01b8, 0x0000 }, { 0x01b9, 0x0000 }, { 0x01ba, 0x0000 },
+ { 0x01bb, 0x0000 }, { 0x01bc, 0x0000 }, { 0x01bd, 0x0000 }, { 0x01be, 0x0000 },
+ { 0x01bf, 0x0000 }, { 0x01c0, 0x0000 }, { 0x01c1, 0x0000 }, { 0x01c2, 0x00a0 },
+ { 0x01c3, 0x0000 }, { 0x01c4, 0x0000 }, { 0x01c5, 0x0000 }, { 0x01c6, 0x0000 },
+ { 0x01c7, 0x0000 }, { 0x01c8, 0x0000 }, { 0x01c9, 0x0000 }, { 0x01ca, 0x0000 },
};
-*/
/* Extracted from MMIO dump of 6.30.223.141 */
static u16 r2057_rev9_init[][2] = {
@@ -539,6 +627,10 @@ void r2057_upload_inittabs(struct b43_wldev *dev)
} else if (phy->radio_rev == 7) {
table = r2057_rev7_init[0];
size = ARRAY_SIZE(r2057_rev7_init);
+ } else if (phy->radio_rev == 8) {
+ /* BCM6362 single-die 2.4 GHz. */
+ table = r2057_rev8_init[0];
+ size = ARRAY_SIZE(r2057_rev8_init);
}
break;
case 9:
--
2.54.0
^ permalink raw reply related
* [PATCH v4 0/7] b43: complete N-PHY rev 8 + radio 2057 rev 8 support
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
This series completes b43 support for the Broadcom N-PHY revision 8
paired with radio 2057 revision 8. b43 already supports the surrounding
PHY family - N-PHY rev 8 with radio 2057 rev 5 and rev 7 are handled,
and rev 16 with radio 2057 rev 9 is handled - but the rev 8 + rev 8
combination falls through four dispatcher gaps:
- radio_2057.c, r2057_upload_inittabs(), case 8 lists radio_rev 5
and 7 only;
- radio_2057.c, r2057_get_chantabent_rev7(), case 8 lists radio_rev
5 only;
- tables_nphy.c, b43_nphy_get_ipa_gain_table(), case 8 lists
radio_rev 5 only;
- radio_2057.c carries r2057_rev8_init[] as a 54-entry stub commented
out with "TODO: Which devices should use it?".
Two further pieces of plumbing are needed to reach those dispatchers
in the first place: d11 core revision 0x16 is missing from the b43
bcma id table, firmware name, and the corerev 22 / radio 2057 combination
needs the 24-bit indirect radio access path that brcmsmac uses for
the same silicon generation (see brcmsmac/phy/phy_cmn.c
read_radio_reg() / write_radio_reg()).
The series:
1/7 b43: add firmware and initvals names for rev22
2/7 b43: add d11 core revision 0x16 to id table
3/7 b43: route d11 corerev 22 to 24-bit indirect radio access
4/7 b43: support radio 2057 rev 8
5/7 b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8
6/7 b43: add channel info table for N-PHY r8 + radio 2057 r8
7/7 b43: add RF power offset for N-PHY r8 + radio 2057 r8
Patches almost reveal the bringup, the first two are swapped, as
applying 2/7 without 1/7 generate an immediate kernel panic caused
by a null deref.
From the third, each one fixes the next visible failure
in bring-up: 3/7 lets phy versioning read coherent radio identifiers,
4/7 unblocks the boot-time radio calibration that otherwise stalls,
and 5/7-7/7 fill the remaining 2.4 GHz dispatcher entries so
b43_nphy_set_channel completes to the default channel and core_init
proceeds past PHY init.
Tested on a D-Link DSL-3580L (Broadcom BCM6362 SoC, single-die 2.4 GHz
N-PHY rev 8 + radio 2057 rev 8 in 2.4 GHz IPA mode).
b43 is currently Orphan in MAINTAINERS. These patches do not add a
new chip family or PHY infrastructure; they fill four explicit
dispatcher gaps for a combination of an already-supported PHY and
an already-supported radio.
CHANGELOG:
v4: reword patch 1/7 commit
v3: no changes, fighting with b4
v2:
- Recovered the first patch of the series, so numbering is now /7
- Added Assisted-By header
v1: https://lore.kernel.org/linux-wireless/8c0a07d2-9ec9-43d6-bdf7-f625bbb4a38a@mythread.it/
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
---
Alessio Ferri (7):
b43: add firmware mappings for rev22
b43: add d11 core revision 0x16 to id table
b43: route d11 corerev 22 to 24-bit indirect radio access
b43: support radio 2057 rev 8
b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8
b43: add channel info table for N-PHY r8 + radio 2057 r8
b43: add RF power offset for N-PHY r8 + radio 2057 r8
drivers/net/wireless/broadcom/b43/main.c | 22 ++-
drivers/net/wireless/broadcom/b43/radio_2057.c | 230 ++++++++++++++++++++++--
drivers/net/wireless/broadcom/b43/tables_nphy.c | 58 ++++++
3 files changed, 290 insertions(+), 20 deletions(-)
---
base-commit: 8bc67e4db64aa72732c474b44ea8622062c903f0
change-id: 20260521-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-a3125f06e21e
Best regards,
--
Alessio Ferri <alessio.ferri.3012@gmail.com>
^ permalink raw reply
* [PATCH v4 6/7] b43: add channel info table for N-PHY r8 + radio 2057 r8
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
Add the 2.4 GHz channel info table for N-PHY rev 8 paired with
radio 2057 rev 8 and wire it to the existing dispatcher in
r2057_get_chantabent_rev7().
The dispatcher's case 8 currently handles radio_rev == 5 only.
For radio_rev == 8 both output pointers stay NULL,
b43_nphy_set_channel() returns an error and channel switch to
the default channel fails.
The new b43_nphy_chantab_phy_rev8_radio_rev8[] is 14 entries
covering the standard 2.4 GHz channel set (2412..2472 in 5 MHz
steps, plus 2484 for channel 14).
Values extracted from an MMIO dump of the proprietary Broadcom wl
driver running on BCM6362 silicon (wl driver 6.30.102.7).
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/radio_2057.c | 106 +++++++++++++++++++++++++
1 file changed, 106 insertions(+)
diff --git a/drivers/net/wireless/broadcom/b43/radio_2057.c b/drivers/net/wireless/broadcom/b43/radio_2057.c
index 9f693d92b..e761f899b 100644
--- a/drivers/net/wireless/broadcom/b43/radio_2057.c
+++ b/drivers/net/wireless/broadcom/b43/radio_2057.c
@@ -445,6 +445,109 @@ static const struct b43_nphy_chantabent_rev7_2g b43_nphy_chantab_phy_rev17_radio
},
};
+/* Extracted from MMIO dump of 6.30.102.7 */
+static const struct b43_nphy_chantabent_rev7_2g b43_nphy_chantab_phy_rev8_radio_rev8[] = {
+ {
+ .freq = 2412,
+ RADIOREGS7_2G(0x48, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x6c,
+ 0x09, 0x0f, 0x09, 0x07, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03c9, 0x03c5, 0x03c1, 0x043a, 0x043f, 0x0443),
+ },
+ {
+ .freq = 2417,
+ RADIOREGS7_2G(0x4b, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x71,
+ 0x09, 0x0f, 0x09, 0x07, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03cb, 0x03c7, 0x03c3, 0x0438, 0x043d, 0x0441),
+ },
+ {
+ .freq = 2422,
+ RADIOREGS7_2G(0x4e, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x76,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03cd, 0x03c9, 0x03c5, 0x0436, 0x043a, 0x043f),
+ },
+ {
+ .freq = 2427,
+ RADIOREGS7_2G(0x52, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x7b,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03cf, 0x03cb, 0x03c7, 0x0434, 0x0438, 0x043d),
+ },
+ {
+ .freq = 2432,
+ RADIOREGS7_2G(0x55, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x80,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d1, 0x03cd, 0x03c9, 0x0431, 0x0436, 0x043a),
+ },
+ {
+ .freq = 2437,
+ RADIOREGS7_2G(0x58, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x85,
+ 0x09, 0x0f, 0x09, 0x06, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d3, 0x03cf, 0x03cb, 0x042f, 0x0434, 0x0438),
+ },
+ {
+ .freq = 2442,
+ RADIOREGS7_2G(0x5c, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x8a,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d5, 0x03d1, 0x03cd, 0x042d, 0x0431, 0x0436),
+ },
+ {
+ .freq = 2447,
+ RADIOREGS7_2G(0x5f, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x8f,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d7, 0x03d3, 0x03cf, 0x042b, 0x042f, 0x0434),
+ },
+ {
+ .freq = 2452,
+ RADIOREGS7_2G(0x62, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x94,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03d9, 0x03d5, 0x03d1, 0x0429, 0x042d, 0x0431),
+ },
+ {
+ .freq = 2457,
+ RADIOREGS7_2G(0x66, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x99,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03db, 0x03d7, 0x03d3, 0x0427, 0x042b, 0x042f),
+ },
+ {
+ .freq = 2462,
+ RADIOREGS7_2G(0x69, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0x9e,
+ 0x09, 0x0f, 0x08, 0x05, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03dd, 0x03d9, 0x03d5, 0x0424, 0x0429, 0x042d),
+ },
+ {
+ .freq = 2467,
+ RADIOREGS7_2G(0x6c, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0xa3,
+ 0x09, 0x0f, 0x07, 0x04, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03df, 0x03db, 0x03d7, 0x0422, 0x0427, 0x042b),
+ },
+ {
+ .freq = 2472,
+ RADIOREGS7_2G(0x70, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0xa8,
+ 0x09, 0x0f, 0x07, 0x04, 0x61, 0x73, 0xf0, 0x61,
+ 0x73, 0xf0),
+ PHYREGS(0x03e1, 0x03dd, 0x03d9, 0x0420, 0x0424, 0x0429),
+ },
+ {
+ .freq = 2484,
+ RADIOREGS7_2G(0x78, 0x16, 0x30, 0x1b, 0x0a, 0x0a, 0x30, 0xb4,
+ 0x09, 0x0f, 0x07, 0x04, 0x61, 0x73, 0xe0, 0x61,
+ 0x73, 0xe0),
+ PHYREGS(0x03e6, 0x03e2, 0x03de, 0x041b, 0x041f, 0x0424),
+ }
+};
+
+
/* Extracted from MMIO dump of 6.30.223.141 */
static const struct b43_nphy_chantabent_rev7 b43_nphy_chantab_phy_rev16_radio_rev9[] = {
{
@@ -678,6 +781,9 @@ void r2057_get_chantabent_rev7(struct b43_wldev *dev, u16 freq,
if (phy->radio_rev == 5) {
e_r7_2g = b43_nphy_chantab_phy_rev8_radio_rev5;
len = ARRAY_SIZE(b43_nphy_chantab_phy_rev8_radio_rev5);
+ } else if (phy->radio_rev == 8) {
+ e_r7_2g = b43_nphy_chantab_phy_rev8_radio_rev8;
+ len = ARRAY_SIZE(b43_nphy_chantab_phy_rev8_radio_rev8);
}
break;
case 16:
--
2.54.0
^ permalink raw reply related
* [PATCH v4 7/7] b43: add RF power offset for N-PHY r8 + radio 2057 r8
From: Alessio Ferri @ 2026-05-28 17:31 UTC (permalink / raw)
To: linux-wireless, b43-dev, linux-kernel, Alessio Ferri
In-Reply-To: <20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-0-464566194d47@gmail.com>
Add the 2.4 GHz RF power offset table for N-PHY rev 8 paired with
radio 2057 rev 8 and wire it to the existing dispatcher.
b43_ntab_get_rf_pwr_offset_table() currently dispatches on phy->rev
== 17 (radio_rev 14) and phy->rev == 16 (radio_rev 9) for 2.4 GHz.
phy->rev == 8 falls through and the function logs:
b43-phyX ERROR: No 2GHz RF power table available for this device
Add a phy->rev == 8 / radio_rev == 8 case returning the new table.
The values are sourced from the proprietary Broadcom wl driver's
nphy_papd_padgain_dlt_2g_2057rev5 array. Reusing the rev 5 values
is structurally appropriate: the IPA TX gain table added by the
preceding patch in this series shares the low 24 bits of every
entry with rev 5 - same gain step amplitudes, only the PAD-gain
selector byte differs. b43's pad_gain extraction in
b43_nphy_tx_pwr_ctl_init() reads bits 19..23 of the gain entry,
which sit in the shared low-24-bit range; the same gain index
therefore maps to the same physical PAD gain code on both
revisions and warrants the same per-index dB offset.
Note that b43_nphy_tx_gain_table_upload() currently has a "TODO:
Enable this once we have gains configured" early-return for
phy->rev >= 7. With that early-return in place, this table is
fetched (silencing the b43err that would otherwise abort PHY
init) but its values are not yet written to MMIO. Resolving the
TODO is a future, separate task.
Assisted-by: Claude:claude-4.7-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/net/wireless/broadcom/b43/tables_nphy.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/net/wireless/broadcom/b43/tables_nphy.c b/drivers/net/wireless/broadcom/b43/tables_nphy.c
index 84e8d718d..ecd660b9c 100644
--- a/drivers/net/wireless/broadcom/b43/tables_nphy.c
+++ b/drivers/net/wireless/broadcom/b43/tables_nphy.c
@@ -2923,6 +2923,21 @@ static const s16 b43_ntab_rf_pwr_offset_2057_rev9_5g[] = {
0,
};
+/* Sourced from the rev 5 sibling: the rev 8 IPA TX gain table
+ * shares the low 24 bits of every entry with rev 5 (only the
+ * PAD-gain selector byte differs), so the same gain index maps to
+ * the same physical PAD gain code on both revisions.
+ */
+static const s16 b43_ntab_rf_pwr_offset_2057_rev8_2g[] = {
+ -109, -109, -82, -68, -58,
+ -50, -44, -39, -35, -31,
+ -28, -26, -23, -21, -19,
+ -17, -16, -14, -13, -11,
+ -10, -9, -8, -7, -5,
+ -5, -4, -3, -2, -1,
+ -1, 0,
+};
+
/* Extracted from MMIO dump of 6.30.223.248
* Entries: 0, 26, 28, 29, 30, 31 were guessed
*/
@@ -3782,6 +3797,10 @@ const s16 *b43_ntab_get_rf_pwr_offset_table(struct b43_wldev *dev)
if (phy->radio_rev == 9)
return b43_ntab_rf_pwr_offset_2057_rev9_2g;
break;
+ case 8:
+ if (phy->radio_rev == 8)
+ return b43_ntab_rf_pwr_offset_2057_rev8_2g;
+ break;
}
b43err(dev->wl,
--
2.54.0
^ permalink raw reply related
* [PATCH] rtw88: tx: increase TX report timeout for USB devices
From: VolcomIlluminated @ 2026-05-28 19:51 UTC (permalink / raw)
To: Pkshih; +Cc: Linux Wireless
[-- Attachment #1.1: Type: text/plain, Size: 15 bytes --]
patch attached!
[-- Attachment #1.2: Type: text/html, Size: 162 bytes --]
[-- Attachment #2: 0001-rtw88-tx-increase-USB-TX-report-timeout.txt --]
[-- Type: text/plain, Size: 1742 bytes --]
USB devices have higher latency than PCIe devices. The current 500ms
timeout for TX report purging causes "failed to get tx report from
firmware" errors on boot with USB WiFi adapters.
Introduce RTW_TX_PROBE_TIMEOUT_USB at 1000ms and select it based on
the HCI type. PCIe devices retain the original 500ms timeout.
Tested on RTL8822BU (Edimax EW-7822ULC) with zero TX report errors
across 24+ hour operation and 17,706 packets with zero drops.
Signed-off-by: VolcomIlluminated <volcomilluminated@tuta.com>
---
--- /tmp/linux-6.18/drivers/net/wireless/realtek/rtw88/tx.c 2025-11-30 17:42:10.000000000 -0500
+++ /home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/realtek/rtw88/tx.c 2026-05-24 16:28:06.013490121 -0400
@@ -197,6 +197,7 @@
{
struct rtw_tx_report *tx_report = &rtwdev->tx_report;
unsigned long flags;
+ unsigned long timeout;
u8 *drv_data;
/* pass sn to tx report handler through driver data */
@@ -207,7 +208,9 @@
__skb_queue_tail(&tx_report->queue, skb);
spin_unlock_irqrestore(&tx_report->q_lock, flags);
- mod_timer(&tx_report->purge_timer, jiffies + RTW_TX_PROBE_TIMEOUT);
+ timeout = rtwdev->hci.type == RTW_HCI_TYPE_USB ?
+ RTW_TX_PROBE_TIMEOUT_USB : RTW_TX_PROBE_TIMEOUT;
+ mod_timer(&tx_report->purge_timer, jiffies + timeout);
}
EXPORT_SYMBOL(rtw_tx_report_enqueue);
--- /tmp/linux-6.18/drivers/net/wireless/realtek/rtw88/tx.h 2025-11-30 17:42:10.000000000 -0500
+++ /home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/realtek/rtw88/tx.h 2026-05-24 16:23:26.012668469 -0400
@@ -8,6 +8,7 @@
#define RTK_TX_MAX_AGG_NUM_MASK 0x1f
#define RTW_TX_PROBE_TIMEOUT msecs_to_jiffies(500)
+#define RTW_TX_PROBE_TIMEOUT_USB msecs_to_jiffies(1000)
struct rtw_tx_desc {
__le32 w0;
^ permalink raw reply
* [PATCH] rtw88: usb: retry control message on -EPROTO error
From: VolcomIlluminated @ 2026-05-28 20:02 UTC (permalink / raw)
To: Pkshih; +Cc: Linux Wireless
[-- Attachment #1.1: Type: text/plain, Size: 75 bytes --]
Patch Attached!
--
Secured with Tuta Mail:
https://tuta.com/free-email
[-- Attachment #1.2: Type: text/html, Size: 406 bytes --]
[-- Attachment #2: 0002-rtw88-usb-retry-on-EPROTO-error.patch --]
[-- Type: application/octet-stream, Size: 1462 bytes --]
From: VolcomIlluminated <volcomilluminated@tuta.com>
Date: Wed, 28 May 2026 00:00:00 +0000
Subject: [PATCH] rtw88: usb: retry control message on -EPROTO error
USB control messages can transiently fail with -EPROTO (-71) during
device probe on some USB host controllers. This manifests as repeated
"write register failed with -71" errors during driver initialization.
Add a retry loop of up to 3 attempts with 10ms delay when -EPROTO is
returned from usb_control_msg. This recovers the transient error and
allows the driver to initialize cleanly.
Tested on RTL8822BU (Edimax EW-7822ULC) with clean boot and zero
probe errors.
Signed-off-by: VolcomIlluminated <volcomilluminated@tuta.com>
---
--- /tmp/linux-6.18/drivers/net/wireless/realtek/rtw88/usb.c 2025-11-30 17:42:10.000000000 -0500
+++ /home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/realtek/rtw88/usb.c 2026-05-24 20:06:27.798337237 -0400
@@ -140,6 +140,16 @@
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
addr, 0, data, len, 500);
+ if (ret == -EPROTO) {
+ int retry;
+
+ for (retry = 0; retry < 3 && ret == -EPROTO; retry++) {
+ msleep(10);
+ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
+ addr, 0, data, len, 500);
+ }
+ }
if (ret < 0 && ret != -ENODEV && count++ < 4)
rtw_err(rtwdev, "write register 0x%x failed with %d\n",
addr, ret);
^ permalink raw reply
* [PATCH] mt76: mt76x02: fix SKB memory leak on error path in USB MCU
From: VolcomIlluminated @ 2026-05-28 20:15 UTC (permalink / raw)
To: Nbd; +Cc: Lorenzo, Linux Wireless
[-- Attachment #1.1: Type: text/plain, Size: 75 bytes --]
Patch Attached!
--
Secured with Tuta Mail:
https://tuta.com/free-email
[-- Attachment #1.2: Type: text/html, Size: 406 bytes --]
[-- Attachment #2: 0005-mt76-mt76x02-fix-SKB-memory-leak-on-error-path.patch --]
[-- Type: application/octet-stream, Size: 1088 bytes --]
From: VolcomIlluminated <volcomilluminated@tuta.com>
Date: Wed, 28 May 2026 00:00:00 +0000
Subject: [PATCH] mt76: mt76x02: fix SKB memory leak on error path in USB MCU
When mt76x02u_skb_dma_info() fails, the function returns immediately
without calling consume_skb(), leaking the SKB allocation.
Replace the early return with a goto to the existing out label which
calls consume_skb() unconditionally.
This addresses CVE-2022-50172.
Tested on Netgear A6210 (MT76x2U) with 1,640 packets and zero drops
over 2+ hours of continuous operation.
Signed-off-by: VolcomIlluminated <volcomilluminated@tuta.com>
---
--- /tmp/linux-6.18/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c 2025-11-30 17:42:10.000000000 -0500
+++ /home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c 2026-05-25 21:22:15.200610401 -0400
@@ -90,7 +90,7 @@
MT_MCU_MSG_TYPE_CMD;
ret = mt76x02u_skb_dma_info(skb, CPU_TX_PORT, info);
if (ret)
- return ret;
+ goto out;
ret = mt76u_bulk_msg(dev, skb->data, skb->len, NULL, 500,
MT_EP_OUT_INBAND_CMD);
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox