* [PATCH wireless-next 2/2] wifi: mac80211: remove 5/10 MHz channel code
From: Johannes Berg @ 2026-05-29 6:40 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260529064502.37422-4-johannes@sipsolutions.net>
From: Johannes Berg <johannes.berg@intel.com>
Now that cfg80211 refuses all attempts to use 5/10 MHz
channels, all of this code is unreachable; remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
net/mac80211/cfg.c | 2 --
net/mac80211/chan.c | 4 +---
net/mac80211/ibss.c | 31 ++-----------------------------
net/mac80211/mesh.c | 36 +++++++++---------------------------
net/mac80211/mesh_plink.c | 2 --
net/mac80211/mlme.c | 6 ++----
net/mac80211/offchannel.c | 4 +---
net/mac80211/rate.c | 8 +-------
net/mac80211/spectmgmt.c | 10 ----------
net/mac80211/util.c | 7 -------
10 files changed, 16 insertions(+), 94 deletions(-)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index fb4c1c298159..1554e31f0029 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -4591,8 +4591,6 @@ static int ieee80211_set_csa_beacon(struct ieee80211_link_data *link_data,
cfg80211_get_chandef_type(&sdata->u.ibss.chandef))
return -EINVAL;
break;
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
case NL80211_CHAN_WIDTH_20_NOHT:
case NL80211_CHAN_WIDTH_20:
break;
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 23d46cd57137..5152b84a3357 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -642,9 +642,7 @@ __ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
lockdep_assert_wiphy(local->hw.wiphy);
/* don't optimize non-20MHz based and radar_enabled confs */
- if (ctx->conf.def.width == NL80211_CHAN_WIDTH_5 ||
- ctx->conf.def.width == NL80211_CHAN_WIDTH_10 ||
- ctx->conf.def.width == NL80211_CHAN_WIDTH_1 ||
+ if (ctx->conf.def.width == NL80211_CHAN_WIDTH_1 ||
ctx->conf.def.width == NL80211_CHAN_WIDTH_2 ||
ctx->conf.def.width == NL80211_CHAN_WIDTH_4 ||
ctx->conf.def.width == NL80211_CHAN_WIDTH_8 ||
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 08690342cfaa..d0fd6054f182 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -167,8 +167,6 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
/* add HT capability and information IEs */
if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
- chandef->width != NL80211_CHAN_WIDTH_5 &&
- chandef->width != NL80211_CHAN_WIDTH_10 &&
sband->ht_cap.ht_supported) {
struct ieee80211_sta_ht_cap ht_cap;
@@ -259,9 +257,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
chan = chanreq.oper.chan;
if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chanreq.oper,
NL80211_IFTYPE_ADHOC)) {
- if (chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- chanreq.oper.width == NL80211_CHAN_WIDTH_10 ||
- chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
+ if (chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
chanreq.oper.width == NL80211_CHAN_WIDTH_20) {
sdata_info(sdata,
"Failed to join IBSS, beacons forbidden\n");
@@ -405,12 +401,6 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
break;
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
- cfg80211_chandef_create(&chandef, cbss->channel,
- NL80211_CHAN_NO_HT);
- chandef.width = sdata->u.ibss.chandef.width;
- break;
case NL80211_CHAN_WIDTH_80:
case NL80211_CHAN_WIDTH_80P80:
case NL80211_CHAN_WIDTH_160:
@@ -762,8 +752,6 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
lockdep_assert_wiphy(sdata->local->hw.wiphy);
switch (ifibss->chandef.width) {
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
case NL80211_CHAN_WIDTH_20_NOHT:
conn.mode = IEEE80211_CONN_MODE_LEGACY;
fallthrough;
@@ -811,19 +799,6 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
cfg80211_chandef_create(¶ms.chandef, params.chandef.chan,
ch_type);
break;
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
- if (params.chandef.width != ifibss->chandef.width) {
- sdata_info(sdata,
- "IBSS %pM received channel switch from incompatible channel width (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
- ifibss->bssid,
- params.chandef.chan->center_freq,
- params.chandef.width,
- params.chandef.center_freq1,
- params.chandef.center_freq2);
- goto disconnect;
- }
- break;
default:
/* should not happen, conn_flags should prevent VHT modes. */
WARN_ON(1);
@@ -1005,9 +980,7 @@ static void ieee80211_update_sta_info(struct ieee80211_sub_if_data *sdata,
}
if (sta && elems->ht_operation && elems->ht_cap_elem &&
- sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
- sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_5 &&
- sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_10) {
+ sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
/* we both use HT */
struct ieee80211_ht_cap htcap_ie;
struct cfg80211_chan_def chandef;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 04578447df9b..d4507e4e6ec1 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -439,9 +439,7 @@ int mesh_add_ht_cap_ie(struct ieee80211_sub_if_data *sdata,
return 0;
if (!sband->ht_cap.ht_supported ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
@@ -480,9 +478,7 @@ int mesh_add_ht_oper_ie(struct ieee80211_sub_if_data *sdata,
return 0;
if (!ht_cap->ht_supported ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_operation))
@@ -511,9 +507,7 @@ int mesh_add_vht_cap_ie(struct ieee80211_sub_if_data *sdata,
return 0;
if (!sband->vht_cap.vht_supported ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_vht_cap))
@@ -552,9 +546,7 @@ int mesh_add_vht_oper_ie(struct ieee80211_sub_if_data *sdata,
return 0;
if (!vht_cap->vht_supported ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_vht_operation))
@@ -576,9 +568,7 @@ int mesh_add_he_cap_ie(struct ieee80211_sub_if_data *sdata,
if (!sband)
return -EINVAL;
- if (sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ if (sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
return ieee80211_put_he_cap(skb, sdata, sband, NULL);
@@ -598,9 +588,7 @@ int mesh_add_he_oper_ie(struct ieee80211_sub_if_data *sdata,
he_cap = ieee80211_get_he_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT);
if (!he_cap ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
len = 2 + 1 + sizeof(struct ieee80211_he_operation);
@@ -648,9 +636,7 @@ int mesh_add_eht_cap_ie(struct ieee80211_sub_if_data *sdata,
if (!sband)
return -EINVAL;
- if (sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ if (sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
return ieee80211_put_eht_cap(skb, sdata, sband, NULL);
@@ -669,9 +655,7 @@ int mesh_add_eht_oper_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *sk
eht_cap = ieee80211_get_eht_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT);
if (!eht_cap ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return 0;
len = 2 + 1 + offsetof(struct ieee80211_eht_operation, optional) +
@@ -729,9 +713,7 @@ ieee80211_mesh_update_bss_params(struct ieee80211_sub_if_data *sdata,
return;
if (!ieee80211_get_he_iftype_cap(sband, NL80211_IFTYPE_MESH_POINT) ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_10)
+ sdata->vif.bss_conf.chanreq.oper.width == NL80211_CHAN_WIDTH_20_NOHT)
return;
sdata->vif.bss_conf.he_support = true;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 37adb053213e..268857467f29 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -165,8 +165,6 @@ static u64 mesh_set_ht_prot_mode(struct ieee80211_sub_if_data *sdata)
switch (sdata->vif.bss_conf.chanreq.oper.width) {
case NL80211_CHAN_WIDTH_20_NOHT:
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
return 0;
default:
break;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e8d6f6a95c0a..cfb5bc4eac69 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -6376,10 +6376,8 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
ret = ieee80211_link_use_channel(link, &chanreq,
IEEE80211_CHANCTX_SHARED);
- /* don't downgrade for 5/10/S1G MHz channels, though. */
- if (chanreq.oper.width == NL80211_CHAN_WIDTH_5 ||
- chanreq.oper.width == NL80211_CHAN_WIDTH_10 ||
- cfg80211_chandef_is_s1g(&chanreq.oper))
+ /* don't downgrade for S1G channels, though. */
+ if (cfg80211_chandef_is_s1g(&chanreq.oper))
return ret;
while (ret && chanreq.oper.width != NL80211_CHAN_WIDTH_20_NOHT) {
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 8bec39b099a0..2bceb73717c6 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -355,9 +355,7 @@ static void _ieee80211_start_next_roc(struct ieee80211_local *local)
* Note: scan can't run, tmp_channel is what we use, so this
* must be the currently active channel.
*/
- roc->on_channel = roc->chan == local->hw.conf.chandef.chan &&
- local->hw.conf.chandef.width != NL80211_CHAN_WIDTH_5 &&
- local->hw.conf.chandef.width != NL80211_CHAN_WIDTH_10;
+ roc->on_channel = roc->chan == local->hw.conf.chandef.chan;
/* start this ROC */
ieee80211_recalc_idle(local);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index ba1a3aa3f5d4..64768abb0a5f 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -601,14 +601,8 @@ static void rate_idx_match_mask(s8 *rate_idx, u16 *rate_flags,
return;
/* if HT BSS, and we handle a data frame, also try HT rates */
- switch (chan_width) {
- case NL80211_CHAN_WIDTH_20_NOHT:
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
+ if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
return;
- default:
- break;
- }
*rate_idx = 0;
/* keep protection flags */
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index e2eaf8d8d7ff..ec622750e1c9 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -329,16 +329,6 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
case -1:
cfg80211_chandef_create(&csa_ie->chanreq.oper, new_chan,
NL80211_CHAN_NO_HT);
- /* keep width for 5/10 MHz channels */
- switch (sdata->vif.bss_conf.chanreq.oper.width) {
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
- csa_ie->chanreq.oper.width =
- sdata->vif.bss_conf.chanreq.oper.width;
- break;
- default:
- break;
- }
break;
}
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 2a7ab269687a..f6d4ae4127c8 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3816,13 +3816,6 @@ void ieee80211_chandef_downgrade(struct cfg80211_chan_def *c,
conn->mode = IEEE80211_CONN_MODE_S1G;
conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
break;
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
- WARN_ON_ONCE(1);
- /* keep c->width */
- conn->mode = IEEE80211_CONN_MODE_LEGACY;
- conn->bw_limit = IEEE80211_CONN_BW_LIMIT_20;
- break;
}
if (new_primary_width != NL80211_CHAN_WIDTH_20_NOHT) {
--
2.53.0
^ permalink raw reply related
* [PATCH wireless-next 1/2] wifi: cfg80211: remove 5/10 MHz channel support
From: Johannes Berg @ 2026-05-29 6:40 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260529064502.37422-4-johannes@sipsolutions.net>
From: Johannes Berg <johannes.berg@intel.com>
Remove WIPHY_FLAG_SUPPORTS_5_10_MHZ and 5/10 MHz channel
width support. We contemplated this back in early 2023
and didn't do it yet, but nobody stepped up to maintain
it.
It's already _mostly_ dead code since it can really only
be used for AP and maybe IBSS and monitor, but not on a
client since there's no way to scan (and hasn't been in
a very long time, if ever), so the only thing that ever
could really happen with it was run syzbot and trip over
assumptions in the code.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
drivers/net/wireless/ath/ath5k/base.c | 2 --
drivers/net/wireless/ath/ath9k/init.c | 1 -
.../wireless/virtual/mac80211_hwsim_main.c | 1 -
include/net/cfg80211.h | 2 --
net/wireless/chan.c | 33 ++++---------------
net/wireless/core.c | 4 +--
net/wireless/nl80211.c | 14 ++------
net/wireless/util.c | 3 --
8 files changed, 11 insertions(+), 49 deletions(-)
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 6ca31d4ea437..610a3321b497 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2600,8 +2600,6 @@ ath5k_init_ah(struct ath5k_hw *ah, const struct ath_bus_ops *bus_ops)
/* SW support for IBSS_RSN is provided by mac80211 */
hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
- hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
-
/* both antennas can be configured as RX or TX */
hw->wiphy->available_antennas_tx = 0x3;
hw->wiphy->available_antennas_rx = 0x3;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e1a67e8ed09f..2f0c4ef86b7e 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -957,7 +957,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
- hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 6ea082157307..4926122d6648 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -5903,7 +5903,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
WIPHY_FLAG_AP_UAPSD |
- WIPHY_FLAG_SUPPORTS_5_10_MHZ |
WIPHY_FLAG_HAS_CHANNEL_SWITCH;
hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR |
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 69dc9a978861..f91a71c7f4db 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5676,7 +5676,6 @@ struct cfg80211_ops {
* responds to probe-requests in hardware.
* @WIPHY_FLAG_OFFCHAN_TX: Device supports direct off-channel TX.
* @WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL: Device supports remain-on-channel call.
- * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels.
* @WIPHY_FLAG_HAS_CHANNEL_SWITCH: Device supports channel switch in
* beaconing mode (AP, IBSS, Mesh, ...).
* @WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK: The device supports bigger kek and kck keys
@@ -5716,7 +5715,6 @@ enum wiphy_flags {
WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD = BIT(19),
WIPHY_FLAG_OFFCHAN_TX = BIT(20),
WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL = BIT(21),
- WIPHY_FLAG_SUPPORTS_5_10_MHZ = BIT(22),
WIPHY_FLAG_HAS_CHANNEL_SWITCH = BIT(23),
WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER = BIT(24),
WIPHY_FLAG_CHANNEL_CHANGE_ON_BEACON = BIT(25),
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index f0811efb5d0f..7f6af1790736 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -280,12 +280,6 @@ int nl80211_chan_width_to_mhz(enum nl80211_chan_width chan_width)
case NL80211_CHAN_WIDTH_16:
mhz = 16;
break;
- case NL80211_CHAN_WIDTH_5:
- mhz = 5;
- break;
- case NL80211_CHAN_WIDTH_10:
- mhz = 10;
- break;
case NL80211_CHAN_WIDTH_20:
case NL80211_CHAN_WIDTH_20_NOHT:
mhz = 20;
@@ -347,8 +341,6 @@ cfg80211_chandef_valid_control_freq(const struct cfg80211_chan_def *chandef,
u32 control_freq)
{
switch (chandef->width) {
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
case NL80211_CHAN_WIDTH_20:
case NL80211_CHAN_WIDTH_20_NOHT:
case NL80211_CHAN_WIDTH_1:
@@ -415,8 +407,6 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
return false;
switch (chandef->width) {
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
case NL80211_CHAN_WIDTH_20:
case NL80211_CHAN_WIDTH_20_NOHT:
if (ieee80211_chandef_to_khz(chandef) !=
@@ -803,18 +793,16 @@ _cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
return NULL;
/*
- * can't be compatible if one of them is 5/10 MHz or S1G
+ * can't be compatible if one of them is S1G
* but they don't have the same width.
*/
-#define NARROW_OR_S1G(width) ((width) == NL80211_CHAN_WIDTH_5 || \
- (width) == NL80211_CHAN_WIDTH_10 || \
- (width) == NL80211_CHAN_WIDTH_1 || \
- (width) == NL80211_CHAN_WIDTH_2 || \
- (width) == NL80211_CHAN_WIDTH_4 || \
- (width) == NL80211_CHAN_WIDTH_8 || \
- (width) == NL80211_CHAN_WIDTH_16)
+#define IS_S1G(width) ((width) == NL80211_CHAN_WIDTH_1 || \
+ (width) == NL80211_CHAN_WIDTH_2 || \
+ (width) == NL80211_CHAN_WIDTH_4 || \
+ (width) == NL80211_CHAN_WIDTH_8 || \
+ (width) == NL80211_CHAN_WIDTH_16)
- if (NARROW_OR_S1G(c1->width) || NARROW_OR_S1G(c2->width))
+ if (IS_S1G(c1->width) || IS_S1G(c2->width))
return NULL;
/*
@@ -1506,13 +1494,6 @@ bool _cfg80211_chandef_usable(struct wiphy *wiphy,
control_freq = chandef->chan->center_freq;
switch (chandef->width) {
- case NL80211_CHAN_WIDTH_5:
- width = 5;
- break;
- case NL80211_CHAN_WIDTH_10:
- prohibited_flags |= IEEE80211_CHAN_NO_10MHZ;
- width = 10;
- break;
case NL80211_CHAN_WIDTH_20:
if (!ht_cap->ht_supported &&
chandef->chan->band != NL80211_BAND_6GHZ)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 62ab5e4639be..3dcf63b04c41 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -917,9 +917,7 @@ int wiphy_register(struct wiphy *wiphy)
BIT(NL80211_CHAN_WIDTH_80) |
BIT(NL80211_CHAN_WIDTH_80P80) |
BIT(NL80211_CHAN_WIDTH_160) |
- BIT(NL80211_CHAN_WIDTH_320) |
- BIT(NL80211_CHAN_WIDTH_5) |
- BIT(NL80211_CHAN_WIDTH_10))))
+ BIT(NL80211_CHAN_WIDTH_320))))
return -EINVAL;
}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cdb5e9b77143..19244708f5c3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3450,11 +3450,6 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
if (nl80211_send_coalesce(msg, rdev))
goto nla_put_failure;
- if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
- (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
- nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
- goto nla_put_failure;
-
if (rdev->wiphy.max_ap_assoc_sta &&
nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
rdev->wiphy.max_ap_assoc_sta))
@@ -4085,10 +4080,9 @@ static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
return -EINVAL;
}
- if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
- chandef->width == NL80211_CHAN_WIDTH_10) &&
- !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
- NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
+ if (chandef->width == NL80211_CHAN_WIDTH_5 ||
+ chandef->width == NL80211_CHAN_WIDTH_10) {
+ NL_SET_ERR_MSG(extack, "5/10 MHz not supported any more");
return -EINVAL;
}
@@ -13410,8 +13404,6 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
return -EINVAL;
switch (ibss.chandef.width) {
- case NL80211_CHAN_WIDTH_5:
- case NL80211_CHAN_WIDTH_10:
case NL80211_CHAN_WIDTH_20_NOHT:
break;
case NL80211_CHAN_WIDTH_20:
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 8dd7545b9097..24527bf321b2 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -2304,9 +2304,6 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
case NL80211_CHAN_WIDTH_80P80:
vht_opclass = 130;
break;
- case NL80211_CHAN_WIDTH_10:
- case NL80211_CHAN_WIDTH_5:
- return false; /* unsupported for now */
default:
vht_opclass = 0;
break;
--
2.53.0
^ permalink raw reply related
* [PATCH wireless-next 0/2] wifi: remove 5/10 MHz channel support
From: Johannes Berg @ 2026-05-29 6:40 UTC (permalink / raw)
To: linux-wireless
We had this discussion last about three years ago and nothing changed,
nobody cares about this code and it's de-facto unusable since the AP
side exists but not client, IBSS sort of exists but can't scan for any
networks, etc. It only exists to attract syzbot attention, and with
all attention going to UHR (WiFi 8), NAN, sensing/ranging, etc. I don't
see any of this changing.
Remove it. We can always put things back if anyone _really_ needs it
(and can actually use it), but I'd expect them to help maintain it as
well then.
johannes
^ permalink raw reply
* Re: [PATCH] wifi: mac80211_hwsim: handle 5/10 MHz chanctx in rc update
From: Johannes Berg @ 2026-05-29 6:20 UTC (permalink / raw)
To: Lachlan Hodges, meihaipeng
Cc: Andrei Otcheretianski, linux-wireless, linux-kernel,
syzbot+c0472dd80bb8f668625f
In-Reply-To: <qrtsnjplvmg2pbq2cym5s3c5zxm5lrxw5dui26ks4jbbmmqhem@uwzblpmgdi5h>
On Fri, 2026-05-29 at 15:10 +1000, Lachlan Hodges wrote:
> Hi,
>
> > The STA bandwidth enum has no sub-20 MHz states, so a normal 20 MHz link
> > STA falsely trips the warning on 5/10 MHz OCB channel contexts.so
> > a normal 20 MHz link STA falsely trips the warning on 5/10 MHz OCB
> > channel contexts.
>
> There is also S1G widths :) but that doesn't really matter.
>
> > Treat sub-20 MHz channel contexts as 20 MHz for this validation and use
> > the actual channel-context width in the warning message.
> >
> > Fixes: aea9a6088ae46 ("wifi: mac80211_hwsim: do rc update per link")
> > Reported-by: syzbot+c0472dd80bb8f668625f@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=c0472dd80bb8f668625f
> > Signed-off-by: meihaipeng <meihaipeng@uniontech.com>
>
> Looking at the stack trace of this report and a few of the others,
> it comes from mac80211_hwsim_sta_add() which calls the rc_update on
> the new STA, so it would probably be better to do something similar
> to what we did for S1G [1] since I'm pretty sure the rc_update()
> path isn't reachable on 5/10MHz (just like S1G).
I don't know if it is or isn't, but a simpler change like that would
indeed seem preferable.
> Though there are also quite a few 5/10MHz syzbot reports for various
> things similar so maybe it's not worth it.. but that is up to
> Johannes :).
Yeah, I'm still going to rip it out entirely soon.
johannes
^ permalink raw reply
* [PATCH v2 wireless-fixes 3/3] wifi: iwlwifi: mvm: avoid oversized UATS command copy
From: Miri Korenblit @ 2026-05-29 5:57 UTC (permalink / raw)
To: linux-wireless; +Cc: Emmanuel Grumbach
In-Reply-To: <20260529055707.24862-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
MCC_ALLOWED_AP_TYPE_CMD exceeds the fixed copied host-command buffer
and triggers warnings in the gen2 enqueue path when command
0xc05 is sent.
Use IWL_HCMD_DFL_NOCOPY as it was done before the offending commit.
Fixes: 078df640ef05 ("wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 26 +++++++++++++++++----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index f05df3a3300e..6e507d6dcdd2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation
* Copyright (C) 2013-2015 Intel Mobile Communications GmbH
* Copyright (C) 2016-2017 Intel Deutschland GmbH
*/
@@ -459,9 +459,14 @@ static void iwl_mvm_phy_filter_init(struct iwl_mvm *mvm,
static void iwl_mvm_uats_init(struct iwl_mvm *mvm)
{
+ struct iwl_mcc_allowed_ap_type_cmd_v1 *cmd __free(kfree) = NULL;
int cmd_id = WIDE_ID(REGULATORY_AND_NVM_GROUP,
MCC_ALLOWED_AP_TYPE_CMD);
- struct iwl_mcc_allowed_ap_type_cmd_v1 cmd = {};
+ struct iwl_host_cmd hcmd = {
+ .id = cmd_id,
+ .len[0] = sizeof(*cmd),
+ .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+ };
u8 cmd_ver;
int ret;
@@ -485,14 +490,25 @@ static void iwl_mvm_uats_init(struct iwl_mvm *mvm)
if (!mvm->fwrt.ap_type_cmd_valid)
return;
+ /* Since we free the command immediately after iwl_mvm_send_cmd, we
+ * must send this command in SYNC mode.
+ */
+ lockdep_assert_held(&mvm->mutex);
+
+ cmd = kzalloc_obj(*cmd);
+ if (!cmd)
+ return;
+
BUILD_BUG_ON(sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map) !=
- sizeof(cmd.mcc_to_ap_type_map));
+ sizeof(cmd->mcc_to_ap_type_map));
- memcpy(cmd.mcc_to_ap_type_map,
+ memcpy(cmd->mcc_to_ap_type_map,
mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map,
sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map));
- ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0, sizeof(cmd), &cmd);
+ hcmd.data[0] = cmd;
+
+ ret = iwl_mvm_send_cmd(mvm, &hcmd);
if (ret < 0)
IWL_ERR(mvm, "failed to send MCC_ALLOWED_AP_TYPE_CMD (%d)\n",
ret);
--
2.34.1
^ permalink raw reply related
* [PATCH v2 wireless-fixes 2/3] wifi: iwlwifi: mld: send tx power constraints before link activation
From: Miri Korenblit @ 2026-05-29 5:57 UTC (permalink / raw)
To: linux-wireless; +Cc: Pagadala Yesu Anjaneyulu
In-Reply-To: <20260529055707.24862-1-miriam.rachel.korenblit@intel.com>
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
TX power constraints must be sent to the firmware before link
activation. If not, the firmware will use default power values.
Fix this by moving the iwl_mld_send_ap_tx_power_constraint_cmd()
call from iwl_mld_start_ap_ibss() to iwl_mld_assign_vif_chanctx(),
before iwl_mld_activate_link() for AP interfaces. Also update
the guard in the function to allow it to run before link activation
for AP interfaces.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/ap.c | 4 ----
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 7 +++++++
drivers/net/wireless/intel/iwlwifi/mld/power.c | 2 +-
3 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ap.c b/drivers/net/wireless/intel/iwlwifi/mld/ap.c
index 5c59acc8c4c5..6598d9333333 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ap.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ap.c
@@ -9,7 +9,6 @@
#include "ap.h"
#include "hcmd.h"
#include "tx.h"
-#include "power.h"
#include "key.h"
#include "phy.h"
#include "iwl-utils.h"
@@ -273,9 +272,6 @@ int iwl_mld_start_ap_ibss(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *ctx;
int ret;
- if (vif->type == NL80211_IFTYPE_AP)
- iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
-
ret = iwl_mld_update_beacon_template(mld, vif, link);
if (ret)
return ret;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index da6fd7471568..3c8daddc0bcb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -1150,6 +1150,13 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
if (iwl_mld_can_activate_link(mld, vif, link)) {
iwl_mld_tlc_update_phy(mld, vif, link);
+ /* FW requires AP_TX_POWER_CONSTRAINTS_CMD before link
+ * activation for AP and after link activation for STA,
+ * for an unknown reason.
+ */
+ if (vif->type == NL80211_IFTYPE_AP)
+ iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
+
ret = iwl_mld_activate_link(mld, link);
if (ret)
goto err;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/power.c b/drivers/net/wireless/intel/iwlwifi/mld/power.c
index 49b0d9f8f865..266fe16bb95d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/power.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/power.c
@@ -366,7 +366,7 @@ iwl_mld_send_ap_tx_power_constraint_cmd(struct iwl_mld *mld,
lockdep_assert_wiphy(mld->wiphy);
- if (!mld_link->active)
+ if (!mld_link->active && vif->type != NL80211_IFTYPE_AP)
return;
if (link->chanreq.oper.chan->band != NL80211_BAND_6GHZ)
--
2.34.1
^ permalink raw reply related
* [PATCH v2 wireless-fixes 1/3] wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
From: Miri Korenblit @ 2026-05-29 5:57 UTC (permalink / raw)
To: linux-wireless; +Cc: Emmanuel Grumbach, Johannes Berg
In-Reply-To: <20260529055707.24862-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-77.ucode doesn't contain the fixes for this flow it seems.
Don't use the firmware reset handshake even if the firmware claims
support for it.
Fixes: 906d4eb84408 ("iwlwifi: support firmware reset handshake")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220600
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index ae177477b201..384bed95835d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1416,6 +1416,12 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
fw_has_capa(&mvm->fw->ucode_capa,
IWL_UCODE_TLV_CAPA_FW_RESET_HANDSHAKE);
+ /* Those firmware versions claim to support the fw_reset_handshake
+ * but they are buggy.
+ */
+ if (IWL_UCODE_MAJOR(mvm->fw->ucode_ver) <= 77)
+ trans->conf.fw_reset_handshake = false;
+
trans->conf.queue_alloc_cmd_ver =
iwl_fw_lookup_cmd_ver(mvm->fw,
WIDE_ID(DATA_PATH_GROUP,
--
2.34.1
^ permalink raw reply related
* [PATCH v2 wireless-fixes 0/3] iwlwifi -fixes: 2026-05-29
From: Miri Korenblit @ 2026-05-29 5:57 UTC (permalink / raw)
To: linux-wireless
Hi,
Fixed from our internal tree.
Thanks,
Miri
---
Emmanuel Grumbach (2):
wifi: iwlwifi: mvm: don't support the reset handshake for old
firmwares
wifi: iwlwifi: mvm: avoid oversized UATS command copy
Pagadala Yesu Anjaneyulu (1):
wifi: iwlwifi: mld: send tx power constraints before link activation
drivers/net/wireless/intel/iwlwifi/mld/ap.c | 4 ---
.../net/wireless/intel/iwlwifi/mld/mac80211.c | 7 +++++
.../net/wireless/intel/iwlwifi/mld/power.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 26 +++++++++++++++----
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 +++++
5 files changed, 35 insertions(+), 10 deletions(-)
--
2.34.1
---
v2: removing 'res' file from "wifi: iwlwifi: mvm: avoid oversized UATS command copy"
^ permalink raw reply
* [PATCH wireless-fixes 3/3] wifi: iwlwifi: mvm: avoid oversized UATS command copy
From: Miri Korenblit @ 2026-05-29 5:46 UTC (permalink / raw)
To: linux-wireless; +Cc: Emmanuel Grumbach
In-Reply-To: <20260529054631.4039300-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
MCC_ALLOWED_AP_TYPE_CMD exceeds the fixed copied host-command buffer
and triggers warnings in the gen2 enqueue path when command
0xc05 is sent.
Use IWL_HCMD_DFL_NOCOPY as it was done before the offending commit.
Fixes: 078df640ef05 ("wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 26 +-
res | 250 ++++++++++++++++++++
2 files changed, 271 insertions(+), 5 deletions(-)
create mode 100644 res
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index f05df3a3300e..6e507d6dcdd2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation
* Copyright (C) 2013-2015 Intel Mobile Communications GmbH
* Copyright (C) 2016-2017 Intel Deutschland GmbH
*/
@@ -459,9 +459,14 @@ static void iwl_mvm_phy_filter_init(struct iwl_mvm *mvm,
static void iwl_mvm_uats_init(struct iwl_mvm *mvm)
{
+ struct iwl_mcc_allowed_ap_type_cmd_v1 *cmd __free(kfree) = NULL;
int cmd_id = WIDE_ID(REGULATORY_AND_NVM_GROUP,
MCC_ALLOWED_AP_TYPE_CMD);
- struct iwl_mcc_allowed_ap_type_cmd_v1 cmd = {};
+ struct iwl_host_cmd hcmd = {
+ .id = cmd_id,
+ .len[0] = sizeof(*cmd),
+ .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+ };
u8 cmd_ver;
int ret;
@@ -485,14 +490,25 @@ static void iwl_mvm_uats_init(struct iwl_mvm *mvm)
if (!mvm->fwrt.ap_type_cmd_valid)
return;
+ /* Since we free the command immediately after iwl_mvm_send_cmd, we
+ * must send this command in SYNC mode.
+ */
+ lockdep_assert_held(&mvm->mutex);
+
+ cmd = kzalloc_obj(*cmd);
+ if (!cmd)
+ return;
+
BUILD_BUG_ON(sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map) !=
- sizeof(cmd.mcc_to_ap_type_map));
+ sizeof(cmd->mcc_to_ap_type_map));
- memcpy(cmd.mcc_to_ap_type_map,
+ memcpy(cmd->mcc_to_ap_type_map,
mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map,
sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map));
- ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0, sizeof(cmd), &cmd);
+ hcmd.data[0] = cmd;
+
+ ret = iwl_mvm_send_cmd(mvm, &hcmd);
if (ret < 0)
IWL_ERR(mvm, "failed to send MCC_ALLOWED_AP_TYPE_CMD (%d)\n",
ret);
diff --git a/res b/res
new file mode 100644
index 000000000000..07bc81f14701
--- /dev/null
+++ b/res
@@ -0,0 +1,250 @@
+The following changes since commit 1d174fec87850e1005db9b106f84bbbb19cb59b9:
+
+ ARM: dts: omap2: add stlc4560 spi-wireless node (2026-05-20 12:05:04 +0200)
+
+are available in the Git repository at:
+
+ https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next.git/ tags/iwlwifi-next-2026-05-26
+
+for you to fetch changes up to 455fac900cf93d03a020b82f2cf2849cd2c74fd8:
+
+ wifi: iwlwifi: mld: fix indentation in iwl_mld_fill_supp_rates() (2026-05-26 15:17:13 +0300)
+
+----------------------------------------------------------------
+iwlwifi - next: 2026-05-26
+
+This contains mainly:
+UHR support (DPS, DUO, multi-link PM), NAN enhancements
+(multicast, schedule config v2, multiple stations), EMLSR fixes, new
+Killer/LNL device IDs, firmware API cleanups, and a few bugfixes
+
+----------------------------------------------------------------
+Aaron Katzin (1):
+ wifi: iwlwifi: pcie: add debug print for resume flow if powered off
+
+Avinash Bhatt (9):
+ wifi: iwlwifi: fix buffer overflow when firmware reports no channels
+ wifi: iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3
+ wifi: iwlwifi: mld: add chan-load hysteresis for MLO scan triggers
+ wifi: iwlwifi: mld: add duplicated beacon RSSI adjustment
+ wifi: iwlwifi: mld: Add KUnit tests for channel-load thresholds
+ wifi: iwlwifi: mld: implement PSD/EIRP RSSI adjustment
+ wifi: iwlwifi: mld: update link grading tables per bandwidth
+ wifi: iwlwifi: mld: skip MLO scan trigger when AP has no QBSS Load IE
+ wifi: iwlwifi: mld: keep healthy link on EMLSR missed beacon exit
+
+Avraham Stern (5):
+ wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only
+ wifi: iwlwifi: mld: add support for nan schedule config command version 2
+ wifi: iwlwifi: mld: add handler for NAN ULW attribute notification
+ wifi: iwlwifi: mld: nan: add availability attribute to schedule config
+ wifi: iwlwifi: mld: add support for deferred nan schedule config
+
+Daniel Gabay (4):
+ wifi: iwlwifi: mld: fix NAN DW end notification handler
+ wifi: iwlwifi: mld: add NULL check for channel in DW end handler
+ wifi: iwlwifi: mld: validate aux sta before flush in stop_nan
+ wifi: iwlwifi: print UHR rate type
+
+Dongyang Jin (1):
+ wifi: iwlwifi: mld: fix indentation in iwl_mld_fill_supp_rates()
+
+Emmanuel Grumbach (15):
+ wifi: iwlwifi: fix the access to CNVR TOP registers
+ wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED
+ wifi: iwlwifi: mld: move iwl_mld_link_info_changed_ap_ibss to ap.c
+ wifi: iwlwifi: rename iwl_system_statistics_notif_oper
+ wifi: iwlwifi: introduce iwl_system_statistics_notif_oper version 4
+ wifi: iwlwifi: mld: support the new statistics APIs
+ wifi: iwlwifi: remove nvm_ver for devices that don't need it
+ wifi: iwlwifi: implement the new RSC notification
+ wifi: iwlwifi: led_compensation is needed for iwldvm only
+ wifi: iwlwifi: shadow_ram_support is needed for iwldvm only.
+ wifi: iwlwifi: max_event_log_size is needed for iwldvm only
+ wifi: iwlwifi: smem_offset smem_len are not needed from 22000 and up
+ wifi: iwlwifi: reduce the log level of firmware debug buffer size mismatch
+ wifi: iwlwifi: move pcie content to pcie internal transport
+ wifi: iwlwifi: move iwl_trans_activate_nic to iwl-trans.c
+
+Ilan Peer (7):
+ wifi: iwlwifi: mld: Fix number of antennas in NAN capabilities
+ wifi: iwlwifi: mld: Do not declare support for NDPE
+ wifi: iwlwifi: mld: Do not declare NAN support for Extended Key ID
+ wifi: iwlwifi: mld: Add support for multiple NAN Management stations
+ wifi: iwlwifi: mld: Replace static declarations of IWL_MLD_ALLOC_FN
+ wifi: iwlwifi: mld: Add support for NAN multicast data
+ wifi: iwlwifi: mld: Disallow using a per-STA GTK for Tx
+
+Israel Kozitz (1):
+ wifi: iwlwifi: mld: fix NAN max channel switch time unit
+
+Jay Ng (1):
+ wifi: iwlwifi: remove unused header inclusions
+
+Johannes Berg (38):
+ wifi: iwlwifi: mld: tlc: separate from link STA
+ wifi: iwlwifi: mld: disable queue hang detection for NAN data
+ wifi: iwlwifi: mld: support NAN and NAN_DATA interfaces
+ wifi: iwlwifi: mld: add NAN link management
+ wifi: iwlwifi: add NAN schedule command support
+ wifi: iwlwifi: mld: implement NAN peer station management
+ wifi: iwlwifi: mld: add peer schedule support
+ wifi: iwlwifi: mld: clean up station handling in key APIs
+ wifi: iwlwifi: mld: add TLC support for NAN stations
+ wifi: iwlwifi: mld: track TX/RX IGTKs separately
+ wifi: iwlwifi: mld: don't report bad STA ID in EHT TB sniffer
+ wifi: iwlwifi: api: RX: define UHR RX PHY flags
+ wifi: iwlwifi: fw: api: fix UHR U-SIG whitespace
+ wifi: iwlwifi: fw: api: add/fix some UHR sniffer definitions
+ wifi: iwlwifi: pcie: fix ACPI DSM check
+ wifi: iwlwifi: advertise UHR capabilities for such devices
+ wifi: iwlwifi: print FSEQ sha1 in addition to version
+ wifi: iwlwifi: tighten flags in debugfs command sending
+ wifi: iwlwifi: define new FSEQ TLV with MAC ID
+ wifi: iwlwifi: set state to NO_FW on reset
+ wifi: iwlwifi: mld: support NPCA capability for UHR devices
+ wifi: iwlwifi: mld: implement UHR DPS
+ wifi: iwlwifi: mld: give link STA debugfs files a namespace
+ wifi: iwlwifi: mld: set correct key mask for NAN
+ wifi: iwlwifi: mld: add UHR DUO support
+ wifi: iwlwifi: mld: implement UHR multi-link PM
+ wifi: iwlwifi: mld: rename LINK_DEBUGFS_WRITE_FILE_OPS
+ wifi: iwlwifi: mld: add link and link station FW IDs to debugfs
+ wifi: iwlwifi: api: remove NAN_GROUP
+ wifi: iwlwifi: api: clean up/fix some kernel-doc references
+ wifi: iwlwifi: pcie: add two LNL PCI IDs
+ wifi: iwlwifi: clean up location format/BW encoding
+ wifi: iwlwifi: fw: move struct iwl_fw_ini_dump_entry to dbg.c
+ wifi: iwlwifi: fw: separate ini dump allocation
+ wifi: iwlwifi: fw: dbg: always use non-tracing PRPH access
+ wifi: iwlwifi: fw: separate out old-style dump code
+ wifi: iwlwifi: dbg: remove unused 'range_len' arg from dump
+ wifi: iwlwifi: transport: add memory read under NIC access
+
+Junjie Cao (2):
+ wifi: iwlwifi: mld: fix race condition in PTP removal
+ wifi: iwlwifi: mvm: fix race condition in PTP removal
+
+Junrui Luo (1):
+ wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
+
+Miri Korenblit (19):
+ wifi: iwlwifi: mld: set NAN phy capabilities
+ wifi: iwlwifi: mld: use host rate for NAN management frames
+ wifi: iwlwifi: mld: extract NAN capabilities setting to a function
+ wifi: iwlwifi: mld: don't allow softAP with NAN
+ wifi: iwlwifi: bump core version for BZ/SC/DR to 103
+ wifi: iwlwifi: mld: allow NAN data
+ wifi: iwlwifi: support a TLV indicating num of mgmt mcast keys
+ wifi: iwlwifi: mark that we support iwl_rx_mpdu_desc version 7 and 8
+ wifi: iwlwifi: stop supporting cores 97 to 100
+ wifi: iwlwifi: mld: stop supporting iwl_compressed_ba_notif version 5 and 6
+ wifi: iwlwifi: mld: stop supporting MAC_PM_POWER_TABLE version 1
+ wifi: iwlwifi: mld: stop supporting TLC_MNG_UPDATE_NTFY_API_S_VER_3
+ wifi: iwlwifi: mld: stop supporting rate_n_flags version 2
+ wifi: iwlwifi: bump core version for BZ/SC/DR to 104
+ wifi: iwlwifi: define MODULE_FIRMWARE with the correct API
+ wifi: iwlwifi: mld: evacuate NAN channels on link switch
+ wifi: iwlwifi: mld: don't flush async_handlers_wk when canceling notifications
+ wifi: iwlwifi: mld: purge async notifications upon nic error
+ wifi: iwlwifi: bump maximum core version for BZ/SC/DR to 105
+
+Pagadala Yesu Anjaneyulu (3):
+ wifi: iwlwifi: add RF name handling for PE chip type for debugfs
+ wifi: iwlwifi: add XIAOMI to PPAG approved list
+ wifi: iwlwifi: mld: disallow puncturing in US/CA for WH
+
+Shahar Tzarfati (2):
+ wifi: iwlwifi: mld: expose beacon avg signal
+ wifi: iwlwifi: Add names for Killer BE1735x and BE1730x
+
+ drivers/net/wireless/intel/iwlwifi/Makefile | 2 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 23 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/7000.c | 5 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/8000.c | 5 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 5 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/ax210.c | 38 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 19 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 19 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c | 8 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/rf-gf.c | 17 -
+ drivers/net/wireless/intel/iwlwifi/cfg/rf-hr.c | 30 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c | 22 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/rf-wh.c | 8 +-
+ drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 22 +-
+ .../net/wireless/intel/iwlwifi/fw/api/commands.h | 13 +-
+ .../net/wireless/intel/iwlwifi/fw/api/datapath.h | 9 +-
+ .../net/wireless/intel/iwlwifi/fw/api/location.h | 107 +-
+ .../net/wireless/intel/iwlwifi/fw/api/mac-cfg.h | 184 ++-
+ drivers/net/wireless/intel/iwlwifi/fw/api/power.h | 48 +-
+ drivers/net/wireless/intel/iwlwifi/fw/api/rx.h | 40 +-
+ drivers/net/wireless/intel/iwlwifi/fw/api/sta.h | 3 +-
+ drivers/net/wireless/intel/iwlwifi/fw/api/stats.h | 88 +-
+ drivers/net/wireless/intel/iwlwifi/fw/dbg-old.c | 1022 ++++++++++++++++
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 1292 +++-----------------
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 7 +-
+ drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 15 +-
+ drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 14 +-
+ drivers/net/wireless/intel/iwlwifi/fw/file.h | 10 +-
+ drivers/net/wireless/intel/iwlwifi/fw/img.h | 3 +-
+ drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 7 +-
+ drivers/net/wireless/intel/iwlwifi/fw/rs.c | 5 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 9 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 3 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 14 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-io.c | 25 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-io.h | 6 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 150 ++-
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 2 +
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-utils.h | 9 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 7 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 17 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 123 +-
+ drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 +
+ drivers/net/wireless/intel/iwlwifi/mld/ap.c | 58 +-
+ drivers/net/wireless/intel/iwlwifi/mld/ap.h | 8 +-
+ drivers/net/wireless/intel/iwlwifi/mld/d3.c | 168 ++-
+ drivers/net/wireless/intel/iwlwifi/mld/d3.h | 6 +-
+ drivers/net/wireless/intel/iwlwifi/mld/debugfs.c | 74 +-
+ .../net/wireless/intel/iwlwifi/mld/ftm-initiator.c | 30 +-
+ drivers/net/wireless/intel/iwlwifi/mld/iface.c | 187 ++-
+ drivers/net/wireless/intel/iwlwifi/mld/iface.h | 62 +-
+ drivers/net/wireless/intel/iwlwifi/mld/key.c | 166 ++-
+ drivers/net/wireless/intel/iwlwifi/mld/link.c | 569 ++++++++-
+ drivers/net/wireless/intel/iwlwifi/mld/link.h | 37 +-
+ drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 358 ++++--
+ drivers/net/wireless/intel/iwlwifi/mld/mcc.c | 13 +-
+ drivers/net/wireless/intel/iwlwifi/mld/mld.c | 20 +-
+ drivers/net/wireless/intel/iwlwifi/mld/mld.h | 16 +-
+ drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 36 +-
+ drivers/net/wireless/intel/iwlwifi/mld/nan.c | 748 +++++++++++-
+ drivers/net/wireless/intel/iwlwifi/mld/nan.h | 41 +-
+ drivers/net/wireless/intel/iwlwifi/mld/notif.c | 35 +-
+ drivers/net/wireless/intel/iwlwifi/mld/phy.c | 24 +-
+ drivers/net/wireless/intel/iwlwifi/mld/power.c | 210 +++-
+ drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +-
+ drivers/net/wireless/intel/iwlwifi/mld/rx.c | 44 +-
+ drivers/net/wireless/intel/iwlwifi/mld/rx.h | 7 +-
+ drivers/net/wireless/intel/iwlwifi/mld/sta.c | 245 +++-
+ drivers/net/wireless/intel/iwlwifi/mld/sta.h | 32 +-
+ drivers/net/wireless/intel/iwlwifi/mld/stats.c | 108 +-
+ .../net/wireless/intel/iwlwifi/mld/tests/Makefile | 1 +
+ .../intel/iwlwifi/mld/tests/chan_load_thresh.c | 139 +++
+ .../intel/iwlwifi/mld/tests/link-selection.c | 6 +-
+ .../net/wireless/intel/iwlwifi/mld/tests/utils.c | 8 +-
+ drivers/net/wireless/intel/iwlwifi/mld/tlc.c | 410 ++++---
+ drivers/net/wireless/intel/iwlwifi/mld/tx.c | 51 +-
+ .../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 30 +-
+ .../net/wireless/intel/iwlwifi/mvm/ftm-responder.c | 32 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 4 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/power.c | 14 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 9 +-
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 14 +-
+ .../wireless/intel/iwlwifi/pcie/gen1_2/internal.h | 107 +-
+ .../intel/iwlwifi/pcie/gen1_2/trans-gen2.c | 9 +-
+ .../net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | 93 +-
+ 87 files changed, 5442 insertions(+), 2259 deletions(-)
+ create mode 100644 drivers/net/wireless/intel/iwlwifi/fw/dbg-old.c
+ create mode 100644 drivers/net/wireless/intel/iwlwifi/mld/tests/chan_load_thresh.c
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-fixes 2/3] wifi: iwlwifi: mld: send tx power constraints before link activation
From: Miri Korenblit @ 2026-05-29 5:46 UTC (permalink / raw)
To: linux-wireless; +Cc: Pagadala Yesu Anjaneyulu
In-Reply-To: <20260529054631.4039300-1-miriam.rachel.korenblit@intel.com>
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
TX power constraints must be sent to the firmware before link
activation. If not, the firmware will use default power values.
Fix this by moving the iwl_mld_send_ap_tx_power_constraint_cmd()
call from iwl_mld_start_ap_ibss() to iwl_mld_assign_vif_chanctx(),
before iwl_mld_activate_link() for AP interfaces. Also update
the guard in the function to allow it to run before link activation
for AP interfaces.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/ap.c | 4 ----
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 7 +++++++
drivers/net/wireless/intel/iwlwifi/mld/power.c | 2 +-
3 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ap.c b/drivers/net/wireless/intel/iwlwifi/mld/ap.c
index 5c59acc8c4c5..6598d9333333 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ap.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ap.c
@@ -9,7 +9,6 @@
#include "ap.h"
#include "hcmd.h"
#include "tx.h"
-#include "power.h"
#include "key.h"
#include "phy.h"
#include "iwl-utils.h"
@@ -273,9 +272,6 @@ int iwl_mld_start_ap_ibss(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *ctx;
int ret;
- if (vif->type == NL80211_IFTYPE_AP)
- iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
-
ret = iwl_mld_update_beacon_template(mld, vif, link);
if (ret)
return ret;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index da6fd7471568..3c8daddc0bcb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -1150,6 +1150,13 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
if (iwl_mld_can_activate_link(mld, vif, link)) {
iwl_mld_tlc_update_phy(mld, vif, link);
+ /* FW requires AP_TX_POWER_CONSTRAINTS_CMD before link
+ * activation for AP and after link activation for STA,
+ * for an unknown reason.
+ */
+ if (vif->type == NL80211_IFTYPE_AP)
+ iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
+
ret = iwl_mld_activate_link(mld, link);
if (ret)
goto err;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/power.c b/drivers/net/wireless/intel/iwlwifi/mld/power.c
index 49b0d9f8f865..266fe16bb95d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/power.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/power.c
@@ -366,7 +366,7 @@ iwl_mld_send_ap_tx_power_constraint_cmd(struct iwl_mld *mld,
lockdep_assert_wiphy(mld->wiphy);
- if (!mld_link->active)
+ if (!mld_link->active && vif->type != NL80211_IFTYPE_AP)
return;
if (link->chanreq.oper.chan->band != NL80211_BAND_6GHZ)
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-fixes 1/3] wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
From: Miri Korenblit @ 2026-05-29 5:46 UTC (permalink / raw)
To: linux-wireless; +Cc: Emmanuel Grumbach, Johannes Berg
In-Reply-To: <20260529054631.4039300-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-77.ucode doesn't contain the fixes for this flow it seems.
Don't use the firmware reset handshake even if the firmware claims
support for it.
Fixes: 906d4eb84408 ("iwlwifi: support firmware reset handshake")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220600
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index ae177477b201..384bed95835d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1416,6 +1416,12 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
fw_has_capa(&mvm->fw->ucode_capa,
IWL_UCODE_TLV_CAPA_FW_RESET_HANDSHAKE);
+ /* Those firmware versions claim to support the fw_reset_handshake
+ * but they are buggy.
+ */
+ if (IWL_UCODE_MAJOR(mvm->fw->ucode_ver) <= 77)
+ trans->conf.fw_reset_handshake = false;
+
trans->conf.queue_alloc_cmd_ver =
iwl_fw_lookup_cmd_ver(mvm->fw,
WIDE_ID(DATA_PATH_GROUP,
--
2.34.1
^ permalink raw reply related
* [PATCH wireless-fixes 0/3] wifi: iwlwifi: fixes - 2026-05-29
From: Miri Korenblit @ 2026-05-29 5:46 UTC (permalink / raw)
To: linux-wireless
Hi,
A few fixed from our internal tree.
Thanks,
Miri
---
Emmanuel Grumbach (2):
wifi: iwlwifi: mvm: don't support the reset handshake for old
firmwares
wifi: iwlwifi: mvm: avoid oversized UATS command copy
Pagadala Yesu Anjaneyulu (1):
wifi: iwlwifi: mld: send tx power constraints before link activation
drivers/net/wireless/intel/iwlwifi/mld/ap.c | 4 -
.../net/wireless/intel/iwlwifi/mld/mac80211.c | 7 +
.../net/wireless/intel/iwlwifi/mld/power.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 26 +-
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 +
res | 250 ++++++++++++++++++
6 files changed, 285 insertions(+), 10 deletions(-)
create mode 100644 res
--
2.34.1
^ permalink raw reply
* Re: [PATCH 02/10] [v3] input: gpio-keys: make legacy gpiolib optional
From: Dmitry Torokhov @ 2026-05-29 5:37 UTC (permalink / raw)
To: Linus Walleij
Cc: Arnd Bergmann, linux-gpio, linux-kernel, Arnd Bergmann,
Christian Lamparter, Johannes Berg, Aaro Koskinen,
Andreas Kemnade, Kevin Hilman, Roger Quadros, Tony Lindgren,
Thomas Bogendoerfer, John Paul Adrian Glaubitz, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Bartosz Golaszewski, Lee Jones, Pavel Machek, Matti Vaittinen,
Florian Fainelli, Jonas Gorski, Andrew Lunn, Vladimir Oltean,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
linux-wireless, linux-omap, linux-arm-kernel, linux-mips,
linux-sh, linux-input, linux-leds, netdev
In-Reply-To: <CAD++jLnYeh3GfEfNXfCYdcdg_j2RAU63TYewwaTx3tm0tM531w@mail.gmail.com>
On Mon, May 25, 2026 at 10:57:44AM +0200, Linus Walleij wrote:
> On Wed, May 20, 2026 at 8:38 PM Arnd Bergmann <arnd@kernel.org> wrote:
>
> > From: Arnd Bergmann <arnd@arndb.de>
> >
> > Most users of gpio-keys and gpio-keys-polled use modern gpiolib
> > interfaces, but there are still number of ancient sh, arm32 and x86
> > machines that have never been converted.
> >
> > Add an #ifdef block for the parts of the driver that are only used on
> > those legacy machines.
> >
> > The two Rohm PMIC drivers use a gpio-keys device without an actual GPIO,
> > passing an IRQ number instead. In order to keep this working both with
> > and with CONFIG_GPIOLIB_LEGACY, change the gpio-keys driver to ignore
> > the gpio number if an IRQ is passed.
> >
> > Link: https://lore.kernel.org/all/b3c94552-c104-42e3-be15-7e8362e8039e@gmail.com/
> > Link: https://lore.kernel.org/all/afJXG4_rtaj3l2Dk@google.com/
> > Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>
> Reviewed-by: Linus Walleij <linusw@kernel.org>
OK, if Lee Acks MFD changes I can pick this up.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] wifi: mac80211_hwsim: handle 5/10 MHz chanctx in rc update
From: Lachlan Hodges @ 2026-05-29 5:10 UTC (permalink / raw)
To: meihaipeng
Cc: Johannes Berg, Andrei Otcheretianski, linux-wireless,
linux-kernel, syzbot+c0472dd80bb8f668625f
In-Reply-To: <20260529040923.9816-1-meihaipeng@uniontech.com>
Hi,
> The STA bandwidth enum has no sub-20 MHz states, so a normal 20 MHz link
> STA falsely trips the warning on 5/10 MHz OCB channel contexts.so
> a normal 20 MHz link STA falsely trips the warning on 5/10 MHz OCB
> channel contexts.
There is also S1G widths :) but that doesn't really matter.
> Treat sub-20 MHz channel contexts as 20 MHz for this validation and use
> the actual channel-context width in the warning message.
>
> Fixes: aea9a6088ae46 ("wifi: mac80211_hwsim: do rc update per link")
> Reported-by: syzbot+c0472dd80bb8f668625f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c0472dd80bb8f668625f
> Signed-off-by: meihaipeng <meihaipeng@uniontech.com>
Looking at the stack trace of this report and a few of the others,
it comes from mac80211_hwsim_sta_add() which calls the rc_update on
the new STA, so it would probably be better to do something similar
to what we did for S1G [1] since I'm pretty sure the rc_update()
path isn't reachable on 5/10MHz (just like S1G).
Though there are also quite a few 5/10MHz syzbot reports for various
things similar so maybe it's not worth it.. but that is up to
Johannes :).
[1] https://lore.kernel.org/linux-wireless/20260527033828.183821-2-lachlan.hodges@morsemicro.com/
lachlan
^ permalink raw reply
* [PATCH] wifi: mac80211_hwsim: handle 5/10 MHz chanctx in rc update
From: meihaipeng @ 2026-05-29 4:09 UTC (permalink / raw)
To: Johannes Berg
Cc: Andrei Otcheretianski, linux-wireless, linux-kernel, meihaipeng,
syzbot+c0472dd80bb8f668625f
mac80211_hwsim_sta_rc_update() compares ieee80211_sta_rx_bandwidth against
the current channel context width.
The STA bandwidth enum has no sub-20 MHz states, so a normal 20 MHz link
STA falsely trips the warning on 5/10 MHz OCB channel contexts.so
a normal 20 MHz link STA falsely trips the warning on 5/10 MHz OCB
channel contexts.
Treat sub-20 MHz channel contexts as 20 MHz for this validation and use
the actual channel-context width in the warning message.
Fixes: aea9a6088ae46 ("wifi: mac80211_hwsim: do rc update per link")
Reported-by: syzbot+c0472dd80bb8f668625f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0472dd80bb8f668625f
Signed-off-by: meihaipeng <meihaipeng@uniontech.com>
---
drivers/net/wireless/virtual/mac80211_hwsim.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index 1fcf5d0d2e13..3d759fb328a8 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -2793,6 +2793,7 @@ mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
for (link_id = 0;
link_id < ARRAY_SIZE(vif->link_conf);
link_id++) {
+ u32 confbw_mhz = 20;
enum nl80211_chan_width confbw = NL80211_CHAN_WIDTH_20_NOHT;
struct ieee80211_bss_conf *vif_conf;
@@ -2826,10 +2827,17 @@ mac80211_hwsim_sta_rc_update(struct ieee80211_hw *hw,
confbw = chanctx_conf->def.width;
}
- WARN(bw > hwsim_get_chanwidth(confbw),
+ /*
+ * ieee80211_sta_rx_bandwidth does not represent sub-20 MHz
+ * channels, so treat 5/10 MHz channel contexts as 20 MHz when
+ * validating the link bandwidth.
+ */
+ confbw_mhz = max_t(u32, confbw_mhz, hwsim_get_chanwidth(confbw));
+
+ WARN(bw > confbw_mhz,
"intf %pM [link=%d]: bad STA %pM bandwidth %d MHz (%d) > channel config %d MHz (%d)\n",
vif->addr, link_id, sta->addr, bw, sta->deflink.bandwidth,
- hwsim_get_chanwidth(data->bw), data->bw);
+ hwsim_get_chanwidth(confbw), confbw);
}
--
2.20.1
^ permalink raw reply related
* [syzbot] [wireless?] WARNING in drv_link_info_changed (3)
From: syzbot @ 2026-05-29 1:41 UTC (permalink / raw)
To: johannes, linux-kernel, linux-wireless, netdev, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4cbfe4502e3d Merge tag 'v7.1-rc5-ksmbd-server-fixes' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13bb6d96580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e327ee9a867dd6b9
dashboard link: https://syzkaller.appspot.com/bug?extid=c4686c3eb8b64032618f
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-4cbfe450.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ae30bc5ef3ba/vmlinux-4cbfe450.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2547601acb10/bzImage-4cbfe450.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c4686c3eb8b64032618f@syzkaller.appspotmail.com
------------[ cut here ]------------
changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED) && sdata->vif.type != NL80211_IFTYPE_AP && sdata->vif.type != NL80211_IFTYPE_ADHOC && sdata->vif.type != NL80211_IFTYPE_MESH_POINT && sdata->vif.type != NL80211_IFTYPE_OCB
WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880 net/mac80211/driver-ops.c:468, CPU#3: syz.5.1844/11254
Modules linked in:
CPU: 3 UID: 0 PID: 11254 Comm: syz.5.1844 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:drv_link_info_changed+0x583/0x880 net/mac80211/driver-ops.c:468
Code: 00 48 89 74 24 10 e8 3c 3d 0f f7 48 8d 3d 75 29 ef 05 48 8b 74 24 10 44 89 f2 67 48 0f b9 3a e9 ae fc ff ff e8 1e 3d 0f f7 90 <0f> 0b 90 e9 bf fe ff ff e8 10 3d 0f f7 90 0f 0b 90 e9 b1 fe ff ff
RSP: 0018:ffffc900065bee48 EFLAGS: 00010287
RAX: 000000000000096f RBX: ffff8880277d4e40 RCX: ffffc90007392000
RDX: 0000000000080000 RSI: ffffffff8af974c2 RDI: ffff88802aa42500
RBP: 0000000000000200 R08: 0000000000000005 R09: 000000000000000b
R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000002
R13: ffff88805f010f20 R14: 0000000000000200 R15: ffff8880277d6b78
FS: 00007fae699f66c0(0000) GS:ffff8880d666a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000044d79000 CR4: 0000000000352ef0
Call Trace:
<TASK>
ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427
ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122
ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline]
__ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882
ieee80211_scan+0x4f8/0x6e0 net/mac80211/cfg.c:3343
rdev_scan+0x148/0x370 net/wireless/rdev-ops.h:467
cfg80211_scan+0x4dd/0x5d0 net/wireless/scan.c:1077
cfg80211_conn_scan+0x70e/0xfc0 net/wireless/sme.c:134
cfg80211_sme_connect net/wireless/sme.c:629 [inline]
cfg80211_connect+0x17fe/0x1fe0 net/wireless/sme.c:1527
nl80211_connect+0x17d3/0x2260 net/wireless/nl80211.c:13745
genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg net/socket.c:802 [inline]
____sys_sendmsg+0x9e1/0xb70 net/socket.c:2698
___sys_sendmsg+0x190/0x1e0 net/socket.c:2752
__sys_sendmsg+0x170/0x220 net/socket.c:2784
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fae6b79ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fae699f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fae6ba15fa0 RCX: 00007fae6b79ce59
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
RBP: 00007fae6b832d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fae6ba16038 R14: 00007fae6ba15fa0 R15: 00007ffc87f56808
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
* RE: [PATCH] rtw88: usb: retry control message on -EPROTO error
From: Ping-Ke Shih @ 2026-05-29 1:09 UTC (permalink / raw)
To: VolcomIlluminated, Bitterblue Smith; +Cc: Linux Wireless
In-Reply-To: <Otk9l6D--F-9@tuta.com>
VolcomIlluminated <volcomilluminated@tuta.com> wrote:
> --- /tmp/linux-6.18/drivers/net/wireless/realtek/rtw88/usb.c 2025-11-30 17:42:10.000000000 -0500
> +++ /home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/realtek/rtw88/usb.c 2026-05-24 20:06:27.798337237 -0400
Your git repository looks weird.
Please clone https://github.com/pkshih/rtw.git and switch to rtw-next branch.
By the way, the subject prefix should be "[PATCH rtw-next] wifi: rtw88: ...".
> @@ -140,6 +140,16 @@
> ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
> RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
> addr, 0, data, len, 500);
> + if (ret == -EPROTO) {
> + int retry;
> +
> + for (retry = 0; retry < 3 && ret == -EPROTO; retry++) {
> + msleep(10);
> + ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
> + RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
> + addr, 0, data, len, 500);
Don't duplicate the code of identical usb_control_msg(...).
Just
for (retry = 0; retry < 3; retry++) {
ret = usb_control_msg(...);
if (ret != -EPROTO)
break;
msleep(10); /* delay before retrying */
}
Bitterblue, could you have some inputs about this retry, since I don't have
much knowledge about USB?
> + }
> + }
> if (ret < 0 && ret != -ENODEV && count++ < 4)
> rtw_err(rtwdev, "write register 0x%x failed with %d\n",
> addr, ret);
^ permalink raw reply
* RE: [PATCH] rtw88: tx: increase TX report timeout for USB devices
From: Ping-Ke Shih @ 2026-05-29 0:49 UTC (permalink / raw)
To: VolcomIlluminated; +Cc: Linux Wireless
In-Reply-To: <Otk4rgS--F-9@tuta.com>
Please use plain text mode, and send patch by 'git send-email'.
We have [1] already, but under condition of RTL8723DU. You can extend it
to involve RTL8822BU. Maybe, we can just have longer report time for
all USB devices?
[1] https://lore.kernel.org/linux-wireless/20260518142311.10328-1-luka.gejak@linux.dev/
Ping-Ke
^ permalink raw reply
* Re: [GIT PULL] wireless-next-2026-05-28
From: patchwork-bot+netdevbpf @ 2026-05-29 0:12 UTC (permalink / raw)
To: Johannes Berg; +Cc: netdev, linux-wireless
In-Reply-To: <20260528123911.284536-26-johannes@sipsolutions.net>
Hello:
This pull request was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 28 May 2026 14:37:26 +0200 you wrote:
> Hi,
>
> Here's a new set of changes, mostly ath and iwlwifi
> drivers this time.
>
> I have a few more things pending, and I expect a few
> more drivers will have pull requests later too.
>
> [...]
Here is the summary with links:
- [GIT,PULL] wireless-next-2026-05-28
https://git.kernel.org/netdev/net-next/c/e7d6bd24e883
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH 3/4] dt-bindings: bus: add brcm,bcm6362-wlan
From: Alessio Ferri @ 2026-05-29 0:06 UTC (permalink / raw)
To: Rafał Miłecki, Alessio Ferri, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
Florian Fainelli
Cc: linux-kernel, linux-wireless, devicetree
In-Reply-To: <20260529-add-bcm6362-wlan-v1-0-722242777f58@gmail.com>
Document the binding for the SHIM bridge that gates the on-chip
2.4 GHz WLAN block of the Broadcom BCM6362 SoC. The bridge owns the
SHIM peephole, a single clock for the macro, and two resets (the
SHIM macro itself and its ubus side). It is also a bus: it carries
one brcm,bus-axi child describing the bcma backplane behind the
SHIM, with a standard interrupt-map routing the d11 core's IRQ to
the SoC interrupt controller.
Assisted-by: Claude:claude-4.8-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
.../devicetree/bindings/bus/brcm,bcm6362-wlan.yaml | 106 +++++++++++++++++++++
1 file changed, 106 insertions(+)
diff --git a/Documentation/devicetree/bindings/bus/brcm,bcm6362-wlan.yaml b/Documentation/devicetree/bindings/bus/brcm,bcm6362-wlan.yaml
new file mode 100644
index 000000000000..c8d49ccdd2c1
--- /dev/null
+++ b/Documentation/devicetree/bindings/bus/brcm,bcm6362-wlan.yaml
@@ -0,0 +1,106 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/bus/brcm,bcm6362-wlan.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM6362 on-chip WLAN SHIM bridge
+
+maintainers:
+ - Alessio Ferri <alessio.ferri@mythread.it>
+
+description: |
+ The BCM6362 SoC integrates a 2.4 GHz Broadcom WLAN block whose
+ register backplane uses the Broadcom AMBA (bcma) architecture. The
+ backplane is gated by a small SHIM bridge that holds the WLAN macro
+ in reset and disables its clocks until released by software. CFE
+ does not release this block, so software bring-up is required
+ before bcma can enumerate the backplane.
+
+ This binding describes the SHIM bridge node. The SHIM driver brings
+ the macro up and then populates the brcm,bus-axi child node, which
+ describes the bcma backplane behind the SHIM and is bound by the
+ bcma-host-soc driver. The SoC-specific configuration (big-endian
+ accessors, SHIM-attached topology, SHIM Control register peephole
+ pointer) is delivered to bcma via platform_data injected at
+ populate time, so the brcm,bus-axi child stays SoC-agnostic.
+
+properties:
+ compatible:
+ const: brcm,bcm6362-wlan
+
+ reg:
+ maxItems: 1
+ description: SHIM peephole registers.
+
+ reg-names:
+ items:
+ - const: shim
+
+ clocks:
+ maxItems: 1
+
+ resets:
+ items:
+ - description: SHIM macro reset
+ - description: SHIM ubus reset
+
+ reset-names:
+ items:
+ - const: shim
+ - const: shim-ubus
+
+ '#address-cells':
+ const: 1
+
+ '#size-cells':
+ const: 1
+
+ ranges: true
+
+patternProperties:
+ "^axi@[0-9a-f]+$":
+ type: object
+ description: The bcma AXI backplane behind the SHIM.
+ $ref: /schemas/types.yaml#
+
+required:
+ - compatible
+ - reg
+ - reg-names
+ - clocks
+ - resets
+ - reset-names
+ - '#address-cells'
+ - '#size-cells'
+ - ranges
+
+additionalProperties: false
+
+examples:
+ - |
+ wlan@10007000 {
+ compatible = "brcm,bcm6362-wlan";
+ reg = <0x10007000 0x100>;
+ reg-names = "shim";
+ clocks = <&periph_clk 11>;
+ resets = <&periph_rst 7>, <&periph_rst 17>;
+ reset-names = "shim", "shim-ubus";
+
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges;
+
+ axi@10004000 {
+ compatible = "brcm,bus-axi";
+ reg = <0x10004000 0x1000>;
+ ranges = <0x00000000 0x10004000 0x00002000>;
+
+ #address-cells = <1>;
+ #size-cells = <1>;
+ #interrupt-cells = <1>;
+
+ interrupt-map-mask = <0x000fffff 0xffff>;
+ interrupt-map = <0x00005000 0 &periph_intc 0 12>;
+ };
+ };
--
2.54.0
^ permalink raw reply related
* [PATCH 0/4] bcma: support SHIM-attached big-endian SoC backplanes (BCM6362)
From: Alessio Ferri @ 2026-05-29 0:05 UTC (permalink / raw)
To: Rafał Miłecki, Alessio Ferri, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
Florian Fainelli
Cc: linux-kernel, linux-wireless, devicetree
Some BMIPS xDSL SoCs (BCM6362) integrate a Broadcom 802.11 backplane that is reachable
through bcma but differs from the BCM47xx SoCs host_soc was written for:
the AXI backplane is big-endian on a big-endian CPU, and the cores bcma must gate
(ChipCommon, the 802.11 core, the SHIM core) expose no per-core DMP wrappers — clock
and reset live in a small SoC-level SHIM Control register instead.
Rather than describe these quirks as DT properties on the bcma node, the SoC-specific
configuration is delivered to host_soc via platform_data from a parent bridge driver. The
bcma DT node stays a plain "brcm,bus-axi" and all the 6362-specific knowledge lives in the
bridge driver. The standard brcm,bus-axi path is unchanged.
The series is:
1/4 bcma: support driver specific quirks from soc pdata
2/4 bcma: allow SHIM-style mini-EROM wrapper-less cores in scan
3/4 dt-bindings: bus: add brcm,bcm6362-wlan
4/4 bus: add BCM6362 on-chip WLAN SHIM bridge driver
Patches 1-2 touch drivers/bcma (wireless tree); patch 3 is a new drivers/bus driver; patch 4 is
the binding. The patches are sent together to keep the whole context intact.
The original Broadcom driver materialized a fake PCI device, i don't think that would be allowed
in the kernel.
Tested on a D-Link DSL-3580L (BCM6362, d11 corerev 22, N-PHY):
- SHIM brings the backplane up,
- bcma enumerates ChipCommon + the 802.11 core,
- b43 binds.
b43 patches are necessary for the last point, but those has
already been sent in linux-wireless.
Assisted-by: Claude:claude-4.8-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
Alessio Ferri (4):
bcma: support driver specific quirks from soc pdata
bcma: allow SHIM-style mini-EROM wrapper-less cores in scan
dt-bindings: bus: add brcm,bcm6362-wlan
bus: add BCM6362 on-chip WLAN SHIM bridge driver
.../devicetree/bindings/bus/brcm,bcm6362-wlan.yaml | 106 +++++++++
MAINTAINERS | 7 +
drivers/bcma/host_soc.c | 224 +++++++++++++++++-
drivers/bcma/scan.c | 19 +-
drivers/bus/Kconfig | 13 ++
drivers/bus/Makefile | 1 +
drivers/bus/bcm6362-wlan-shim.c | 252 +++++++++++++++++++++
include/linux/bcma/bcma.h | 14 ++
include/linux/platform_data/bcma_host_soc.h | 31 +++
9 files changed, 654 insertions(+), 13 deletions(-)
---
base-commit: 8fde5d1d47f69db6082dfa34500c27f8485389a5
change-id: 20260529-add-bcm6362-wlan-e3e72dbdeb8a
Best regards,
--
Alessio Ferri <alessio.ferri.3012@gmail.com>
^ permalink raw reply
* [PATCH 1/4] bcma: support driver specific quirks from soc pdata
From: Alessio Ferri @ 2026-05-29 0:05 UTC (permalink / raw)
To: Rafał Miłecki, Alessio Ferri, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
Florian Fainelli
Cc: linux-kernel, linux-wireless, devicetree
In-Reply-To: <20260529-add-bcm6362-wlan-v1-0-722242777f58@gmail.com>
Some BMIPS xDSL SoCs (BCM6362, BCM63268) integrate a Broadcom 802.11
backplane that is reachable through bcma but differs from the BCM47xx
SoCs the host_soc driver was originally written for in two ways:
1. The AXI backplane sits on a big-endian peripheral bus on a
big-endian CPU. readl()/writel() perform an asymmetric byte swap
in this configuration and land each bit in the wrong position
inside the peripheral;
2. Per-core DMP wrappers (NMW/NSW != 0) do not exist for the cores
that bcma needs to gate (ChipCommon, the 802.11 core, and the
SHIM core itself). Clock and reset control instead lives in a
small SoC-level "SHIM" Control register peephole. BCMA_IOCTL and
BCMA_RESET_CTL accesses on those cores must be synthesized
against the SHIM Control register.
The brcm,bus-axi DT path is unchanged.
SoCs with those constraints instantiate bcma-host-soc programmatically
from a parent bridge driver (e.g. the BCM6362 WLAN SHIM bridge, added
in a later patch), supplying a struct bcma_host_soc_pdata that selects
big-endian accessors and provides an already-mapped pointer to the SHIM
Control register peephole.
Internal changes in this patch:
- Add include/linux/platform_data/bcma_host_soc.h carrying the new
pdata structure (big_endian, shim_attached, shim_iomem).
- Add big_endian, shim_attached and shim_iomem fields to
struct bcma_bus.
- In drivers/bcma/host_soc.c, add a parallel set of BE accessors
(read16/read32/write16/write32 and aread32/awrite32) plus a
synth path that routes BCMA_IOCTL and BCMA_RESET_CTL accesses on
wrapper-less cores through the SHIM Control register. The new
bcma_host_soc_ops_brcm_shim ops table groups them.
- bcma_host_soc_probe() now reads pdata (when present) and selects
big-endian ops + SHIM routing accordingly. bus->mmio is mapped
via devm_platform_ioremap_resource() so the same code path works
whether the platform_device came from DT (resource via reg
property) or was synthesized by a parent (resource passed in
platform_device_info::res).
- In drivers/bcma/scan.c, bcma_scan_read32() and
bcma_erom_get_ent() honour bus->big_endian.
Assisted-by: Claude:claude-4.8-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/bcma/host_soc.c | 224 ++++++++++++++++++++++++++--
drivers/bcma/scan.c | 4 +-
include/linux/bcma/bcma.h | 14 ++
include/linux/platform_data/bcma_host_soc.h | 31 ++++
4 files changed, 260 insertions(+), 13 deletions(-)
diff --git a/drivers/bcma/host_soc.c b/drivers/bcma/host_soc.c
index 20b1816c570b..f39129fb9cf2 100644
--- a/drivers/bcma/host_soc.c
+++ b/drivers/bcma/host_soc.c
@@ -10,6 +10,7 @@
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/of_address.h>
+#include <linux/platform_data/bcma_host_soc.h>
#include <linux/bcma/bcma.h>
#include <linux/bcma/bcma_soc.h>
@@ -165,6 +166,195 @@ static const struct bcma_host_ops bcma_host_soc_ops = {
.awrite32 = bcma_host_soc_awrite32,
};
+/* SHIM peephole layout, subset of the OEM "WlanShimRegs" struct: only
+ * the per-core Control registers are needed for IOCTL / RESET_CTL
+ * routing. The low 16 bits of each Control register map bit-for-bit to
+ * BCMA_IOCTL; bit 16 (SICF_WOC_CORE_RESET) is the per-core wrapper
+ * BCMA_RESET_CTL bit 0 promoted into the SHIM Control register.
+ */
+#define BCMA_SHIM_CC_CONTROL 0x08
+#define BCMA_SHIM_MAC_CONTROL 0x10
+#define SICF_WOC_CORE_RESET 0x10000
+
+/* Resolve the SHIM Control register for a given core: ChipCommon and
+ * the IEEE 802.11 core. Returns NULL for any other core, including the
+ * SHIM core itself - the SHIM has been running since boot and needs no
+ * gating from bcma_core_enable().
+ */
+static void __iomem *bcma_host_soc_shim_ctrl_reg(struct bcma_device *core)
+{
+ void __iomem *shim = core->bus->shim_iomem;
+
+ if (!shim)
+ return NULL;
+
+ switch (core->id.id) {
+ case BCMA_CORE_CHIPCOMMON:
+ return shim + BCMA_SHIM_CC_CONTROL;
+ case BCMA_CORE_80211:
+ return shim + BCMA_SHIM_MAC_CONTROL;
+ }
+ return NULL;
+}
+
+/* Synthesize wrapper-register responses for cores whose DMP wrapper
+ * space does not exist in the standard bcma layout. On SoCs that
+ * publish a SHIM-style mini-EROM (BMIPS xDSL family: BCM6362, ...)
+ * ChipCommon and the 802.11 core report NMW=NSW=0; clock and reset
+ * gating happens in the SHIM's per-core Control register, which is
+ * where this synth routes BCMA_IOCTL and BCMA_RESET_CTL accesses.
+ */
+static u32 bcma_host_soc_synth_aread32(struct bcma_device *core, u16 offset)
+{
+ void __iomem *ctrl_reg = bcma_host_soc_shim_ctrl_reg(core);
+
+ switch (offset) {
+ case BCMA_IOCTL:
+ /* Low 16 bits of the SHIM Control register map bit-for-bit
+ * to BCMA_IOCTL. Returning the live value lets
+ * bcma_core_is_enabled() observe a prior disable that
+ * cleared CLOCK_EN/FGC. For cores not in the SHIM map
+ * (e.g. the SHIM core itself) return BCMA_IOCTL_CLK so
+ * the core is treated as already-up; the SHIM has been
+ * running since boot and has nothing to enable.
+ */
+ if (ctrl_reg)
+ return ioread32be(ctrl_reg) & 0xFFFF;
+ return BCMA_IOCTL_CLK;
+
+ case BCMA_IOST:
+ /* IOST is synthesized rather than read from the SHIM
+ * Status register: while the d11 is in reset, MacStatus's
+ * SISF_CORE_BITS field is unreliable (observed: 0x1008 on
+ * a disabled d11, where the "2G_PHY" indicator bit 0 is
+ * clear, which would steer b43 down a nonexistent 5 GHz
+ * path on a 2.4 GHz-only single-die part).
+ *
+ * Synthesize a stable IOST for the 802.11 core:
+ * bit 0 (2G_PHY) = 1 single-die 2.4 GHz
+ * bit 1 (5G_PHY) = 0 no 5 GHz radio wired
+ * bit 12 (BCMA_IOST_DMA64)= 1 corerev 22 is DMA64
+ *
+ * Other cores have no defined IOST bits of interest.
+ */
+ if (core->id.id == BCMA_CORE_80211)
+ return 0x01 | BCMA_IOST_DMA64;
+ return 0;
+
+ case BCMA_RESET_CTL:
+ /* SICF_WOC_CORE_RESET is the wrapper RESET_CTL bit 0 in
+ * the SHIM Control register.
+ */
+ if (ctrl_reg)
+ return (ioread32be(ctrl_reg) & SICF_WOC_CORE_RESET) ? 1 : 0;
+ return 0;
+
+ case BCMA_RESET_ST:
+ /* No "reset pending" semantics in the SHIM Control reg. */
+ return 0;
+
+ default:
+ pr_info("bcma: synth aread32 unhandled offset 0x%03x on core idx=%u id=0x%x\n",
+ offset, core->core_index, core->id.id);
+ return 0;
+ }
+}
+
+static void bcma_host_soc_synth_awrite32(struct bcma_device *core,
+ u16 offset, u32 value)
+{
+ void __iomem *ctrl_reg = bcma_host_soc_shim_ctrl_reg(core);
+ u32 cur, new_val;
+
+ if (ctrl_reg) {
+ switch (offset) {
+ case BCMA_IOCTL:
+ /* SICF low 16 bits == BCMA_IOCTL. Preserve
+ * SICF_WOC_CORE_RESET (the RESET_CTL view) so an
+ * IOCTL write does not accidentally release reset.
+ */
+ cur = ioread32be(ctrl_reg);
+ new_val = (value & 0xFFFF) |
+ (cur & SICF_WOC_CORE_RESET);
+ iowrite32be(new_val, ctrl_reg);
+ pr_debug("bcma: synth IOCTL core=0x%x SHIM %08x->%08x (req %08x)\n",
+ core->id.id, cur, new_val, value);
+ return;
+ case BCMA_RESET_CTL:
+ cur = ioread32be(ctrl_reg);
+ if (value & 1)
+ new_val = cur | SICF_WOC_CORE_RESET;
+ else
+ new_val = cur & ~SICF_WOC_CORE_RESET;
+ iowrite32be(new_val, ctrl_reg);
+ pr_debug("bcma: synth RESET_CTL core=0x%x SHIM %08x->%08x (req %08x)\n",
+ core->id.id, cur, new_val, value);
+ return;
+ }
+ }
+
+ pr_info("bcma: synth awrite32 dropped on core idx=%u id=0x%x offset=0x%03x value=0x%08x\n",
+ core->core_index, core->id.id, offset, value);
+}
+
+/* Big-endian accessor variants for SoCs whose AXI backplane sits on a
+ * big-endian peripheral bus (BMIPS xDSL family). read8/write8 are
+ * endian-agnostic byte accesses and reuse the LE helpers above.
+ * CONFIG_BCMA_BLOCKIO block_read/write are intentionally omitted: those
+ * targets do not enable block I/O. aread32/awrite32 dispatch to the
+ * synthesizer when core->io_wrap is NULL (legitimate on SHIM-attached
+ * cores; that NULL state is allow-listed in scan.c).
+ */
+static u32 bcma_host_soc_read32_be(struct bcma_device *core, u16 offset)
+{
+ return ioread32be(core->io_addr + offset);
+}
+
+static u16 bcma_host_soc_read16_be(struct bcma_device *core, u16 offset)
+{
+ return ioread16be(core->io_addr + offset);
+}
+
+static void bcma_host_soc_write32_be(struct bcma_device *core, u16 offset,
+ u32 value)
+{
+ iowrite32be(value, core->io_addr + offset);
+}
+
+static void bcma_host_soc_write16_be(struct bcma_device *core, u16 offset,
+ u16 value)
+{
+ iowrite16be(value, core->io_addr + offset);
+}
+
+static u32 bcma_host_soc_aread32_be(struct bcma_device *core, u16 offset)
+{
+ if (likely(core->io_wrap))
+ return ioread32be(core->io_wrap + offset);
+ return bcma_host_soc_synth_aread32(core, offset);
+}
+
+static void bcma_host_soc_awrite32_be(struct bcma_device *core, u16 offset,
+ u32 value)
+{
+ if (likely(core->io_wrap)) {
+ iowrite32be(value, core->io_wrap + offset);
+ return;
+ }
+ bcma_host_soc_synth_awrite32(core, offset, value);
+}
+
+static const struct bcma_host_ops bcma_host_soc_ops_brcm_shim = {
+ .read8 = bcma_host_soc_read8,
+ .read16 = bcma_host_soc_read16_be,
+ .read32 = bcma_host_soc_read32_be,
+ .write8 = bcma_host_soc_write8,
+ .write16 = bcma_host_soc_write16_be,
+ .write32 = bcma_host_soc_write32_be,
+ .aread32 = bcma_host_soc_aread32_be,
+ .awrite32 = bcma_host_soc_awrite32_be,
+};
+
int __init bcma_host_soc_register(struct bcma_soc *soc)
{
struct bcma_bus *bus = &soc->bus;
@@ -202,8 +392,8 @@ int __init bcma_host_soc_init(struct bcma_soc *soc)
#ifdef CONFIG_OF
static int bcma_host_soc_probe(struct platform_device *pdev)
{
+ struct bcma_host_soc_pdata *pdata = dev_get_platdata(&pdev->dev);
struct device *dev = &pdev->dev;
- struct device_node *np = dev->of_node;
struct bcma_bus *bus;
int err;
@@ -214,14 +404,26 @@ static int bcma_host_soc_probe(struct platform_device *pdev)
bus->dev = dev;
- /* Map MMIO */
- bus->mmio = of_iomap(np, 0);
- if (!bus->mmio)
- return -ENOMEM;
+ /* Map MMIO. devm_platform_ioremap_resource() consumes the first
+ * IORESOURCE_MEM regardless of whether it came from a DT reg
+ * property (legacy brcm,bus-axi path) or from a synthesized
+ * platform_device_info::res (SHIM-attached path).
+ */
+ bus->mmio = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(bus->mmio))
+ return PTR_ERR(bus->mmio);
/* Host specific */
bus->hosttype = BCMA_HOSTTYPE_SOC;
- bus->ops = &bcma_host_soc_ops;
+ if (pdata) {
+ bus->big_endian = pdata->big_endian;
+ bus->shim_attached = pdata->shim_attached;
+ bus->shim_iomem = pdata->shim_iomem;
+ bus->ops = pdata->big_endian ? &bcma_host_soc_ops_brcm_shim
+ : &bcma_host_soc_ops;
+ } else {
+ bus->ops = &bcma_host_soc_ops;
+ }
/* Initialize struct, detect chip */
bcma_init_bus(bus);
@@ -229,15 +431,11 @@ static int bcma_host_soc_probe(struct platform_device *pdev)
/* Register */
err = bcma_bus_register(bus);
if (err)
- goto err_unmap_mmio;
+ return err;
platform_set_drvdata(pdev, bus);
return err;
-
-err_unmap_mmio:
- iounmap(bus->mmio);
- return err;
}
static void bcma_host_soc_remove(struct platform_device *pdev)
@@ -245,7 +443,9 @@ static void bcma_host_soc_remove(struct platform_device *pdev)
struct bcma_bus *bus = platform_get_drvdata(pdev);
bcma_bus_unregister(bus);
- iounmap(bus->mmio);
+ /* bus->mmio is devm-managed; shim_iomem is borrowed from the
+ * parent bridge driver and must not be unmapped here.
+ */
platform_set_drvdata(pdev, NULL);
}
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 84742408a59c..983a62ddeebb 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -143,6 +143,8 @@ static const char *bcma_device_name(const struct bcma_device_id *id)
static u32 bcma_scan_read32(struct bcma_bus *bus, u16 offset)
{
+ if (bus->big_endian)
+ return ioread32be(bus->mmio + offset);
return readl(bus->mmio + offset);
}
@@ -155,7 +157,7 @@ static void bcma_scan_switch_core(struct bcma_bus *bus, u32 addr)
static u32 bcma_erom_get_ent(struct bcma_bus *bus, u32 __iomem **eromptr)
{
- u32 ent = readl(*eromptr);
+ u32 ent = bus->big_endian ? ioread32be(*eromptr) : readl(*eromptr);
(*eromptr)++;
return ent;
}
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index 60b94b944e9f..aaa6c5674c2a 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -362,6 +362,20 @@ struct bcma_bus {
/* We decided to share SPROM struct with SSB as long as we do not need
* any hacks for BCMA. This simplifies drivers code. */
struct ssb_sprom sprom;
+
+ /* SoC quirks populated from struct bcma_host_soc_pdata when a
+ * SHIM-attached parent bridge driver instantiates the bcma-host-soc
+ * child platform_device. big_endian selects ioread/iowrite *be
+ * helpers on the scan and host_soc accessor paths; shim_attached
+ * tells scan.c that wrapper-less cores (NMW=NSW=0) are legitimate
+ * on this backplane; shim_iomem points at the SoC-level SHIM
+ * Control register peephole that host_soc.c routes per-core
+ * BCMA_IOCTL / BCMA_RESET_CTL accesses through. shim_iomem is
+ * borrowed from the parent and must not be unmapped here.
+ */
+ bool big_endian;
+ bool shim_attached;
+ void __iomem *shim_iomem;
};
static inline u32 bcma_read8(struct bcma_device *core, u16 offset)
diff --git a/include/linux/platform_data/bcma_host_soc.h b/include/linux/platform_data/bcma_host_soc.h
new file mode 100644
index 000000000000..e1e7c5acb574
--- /dev/null
+++ b/include/linux/platform_data/bcma_host_soc.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef _LINUX_PLATFORM_DATA_BCMA_HOST_SOC_H
+#define _LINUX_PLATFORM_DATA_BCMA_HOST_SOC_H
+
+#include <linux/types.h>
+
+/**
+ * struct bcma_host_soc_pdata - SoC-specific configuration for bcma-host-soc.
+ *
+ * Used by parent bridge drivers that instantiate bcma-host-soc as a child
+ * platform_device (e.g. the BCM6362 WLAN SHIM bridge). The legacy
+ * brcm,bus-axi DT path uses default values and does not supply this.
+ *
+ * @big_endian: Backplane registers are big-endian peripherals on a
+ * big-endian CPU. Selects ioread/iowrite *be helpers for
+ * all bcma register accesses on this bus.
+ * @shim_attached: Cores on this backplane do not publish per-core DMP
+ * wrappers (NMW=NSW=0 in the EROM); clock and reset
+ * gating instead lives in a SoC-level "SHIM" Control
+ * register peephole reached through @shim_iomem.
+ * @shim_iomem: Pre-mapped iomem pointer for the SHIM peephole.
+ * Lifetime is owned by the parent bridge driver; the
+ * bcma-host-soc driver must not iounmap it.
+ */
+struct bcma_host_soc_pdata {
+ bool big_endian;
+ bool shim_attached;
+ void __iomem *shim_iomem;
+};
+
+#endif /* _LINUX_PLATFORM_DATA_BCMA_HOST_SOC_H */
--
2.54.0
^ permalink raw reply related
* [PATCH 4/4] bus: add BCM6362 on-chip WLAN SHIM bridge driver
From: Alessio Ferri @ 2026-05-29 0:06 UTC (permalink / raw)
To: Rafał Miłecki, Alessio Ferri, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
Florian Fainelli
Cc: linux-kernel, linux-wireless, devicetree
In-Reply-To: <20260529-add-bcm6362-wlan-v1-0-722242777f58@gmail.com>
Add the bridge driver that brings up the BCM6362 on-chip WLAN SHIM
and then populates a brcm,bus-axi child whose backplane is
enumerated by drivers/bcma/host_soc.c.
Add myself as MANTAINER for this shim.
After mapping the SHIM peephole, preparing the clock, and toggling
the SHIM and ubus resets, the driver runs the macro-enable sequence
taken from the OEM BCM6362 SDK setup.c. It then constructs a struct
bcma_host_soc_pdata - with big_endian and shim_attached set, and
shim_iomem pointing at the already-mapped SHIM peephole - and hands
it to the brcm,bus-axi child by registering an of_dev_auxdata entry
keyed on the "brcm,bus-axi" compatible. of_platform_populate() then
creates the child platform_device with the pdata attached, and
bcma-host-soc consumes it during its probe.
The auxdata-based handoff was chosen over a second per-SoC
bcma-host-soc DT compatible to keep the SoC-specific knowledge in
the SHIM driver, where the SHIM register layout already lives, and
to avoid duplicating the SHIM base address between the DT and the
bcma driver. Using of_platform_populate() rather than a synthesized
platform_device preserves the DT IRQ machinery: the bcma child's
of_node carries the standard interrupt-map that bcma_of_get_irq()
walks to resolve per-core IRQs.
Assisted-by: Claude:claude-4.8-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
MAINTAINERS | 7 ++
drivers/bus/Kconfig | 13 +++
drivers/bus/Makefile | 1 +
drivers/bus/bcm6362-wlan-shim.c | 252 ++++++++++++++++++++++++++++++++++++++++
4 files changed, 273 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 461a3eed6129..4032bd6b9cfa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5109,6 +5109,13 @@ L: linux-usb@vger.kernel.org
S: Maintained
F: drivers/usb/gadget/udc/bcm63xx_udc.*
+BROADCOM BCM6362 WLAN SHIM BRIDGE DRIVER
+M: Alessio Ferri <alessio.ferri@mythread.it>
+L: linux-wireless@vger.kernel.org
+S: Maintained
+F: Documentation/devicetree/bindings/bus/brcm,bcm6362-wlan.yaml
+F: drivers/bus/bcm6362-wlan-shim.c
+
BROADCOM BCM7XXX ARM ARCHITECTURE
M: Florian Fainelli <florian.fainelli@broadcom.com>
R: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index 3181d8aa32a3..e992a34c5230 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -29,6 +29,19 @@ config ARM_INTEGRATOR_LM
Say y here to enable support for the ARM Logic Module bus
found on the ARM Integrator AP (Application Platform)
+config BCM6362_WLAN_SHIM
+ tristate "BCM6362 on-chip WLAN SHIM bridge"
+ depends on BMIPS_GENERIC || COMPILE_TEST
+ depends on OF
+ select BCMA
+ select BCMA_HOST_SOC
+ help
+ Bring-up driver for the SHIM bridge that gates the integrated
+ 2.4 GHz WLAN block of the BCM6362 SoC. The driver releases the
+ SHIM from reset, configures clocks, and then instantiates a
+ bcma-host-soc child platform device whose bcma backplane is
+ enumerated by the bcma driver.
+
config BRCMSTB_GISB_ARB
tristate "Broadcom STB GISB bus arbiter"
depends on ARCH_BRCMSTB || BMIPS_GENERIC
diff --git a/drivers/bus/Makefile b/drivers/bus/Makefile
index a01f97fef3e8..4b24ce0137fc 100644
--- a/drivers/bus/Makefile
+++ b/drivers/bus/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_ARM_CCI) += arm-cci.o
obj-$(CONFIG_ARM_INTEGRATOR_LM) += arm-integrator-lm.o
obj-$(CONFIG_HISILICON_LPC) += hisi_lpc.o
obj-$(CONFIG_BRCMSTB_GISB_ARB) += brcmstb_gisb.o
+obj-$(CONFIG_BCM6362_WLAN_SHIM) += bcm6362-wlan-shim.o
obj-$(CONFIG_MOXTET) += moxtet.o
# DPAA2 fsl-mc bus
diff --git a/drivers/bus/bcm6362-wlan-shim.c b/drivers/bus/bcm6362-wlan-shim.c
new file mode 100644
index 000000000000..a2de03cf8ff7
--- /dev/null
+++ b/drivers/bus/bcm6362-wlan-shim.c
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * BCM6362 on-chip WLAN SHIM bridge driver.
+ *
+ * The BCM6362 integrates a Broadcom 2.4 GHz WLAN block whose register
+ * backplane is a Broadcom AMBA (AXI/OCP) - what the bcma driver calls
+ * "brcm,bus-axi". The backplane sits on the SoC ubus, behind a small
+ * "SHIM" bridge that gates clocks and holds the WLAN macro in reset
+ * until released by software. CFE does not bring this block up.
+ *
+ * ubus ─┬─► WLAN SHIM ─► AXI backplane ┬─► ChipCommon
+ * │ @ 0x10007000 @ 0x10004000 ├─► d11 MAC core
+ * │ └─► (PMU, GPIO live in
+ * │ ChipCommon)
+ * └─► rest of the SoC
+ *
+ * This driver brings the SHIM up (clocks, resets, the OEM enable
+ * sequence) and then calls of_platform_populate() on its DT node. The
+ * "brcm,bus-axi" child is bound by drivers/bcma/host_soc.c, and the
+ * SoC-specific configuration that bcma needs (big-endian backplane,
+ * SHIM-attached topology, and an already-mapped pointer to the SHIM
+ * Control register peephole) is delivered to it via of_dev_auxdata
+ * platform_data injected at populate time.
+ *
+ * Bring-up sequence and SHIM register layout match the OEM source
+ * arch/mips/bcm963xx/setup.c and the WlanShimRegs struct in
+ * shared/opensource/include/bcm963xx/6362_map_part.h. The fake-PCI
+ * dance the OEM kernel does after bring-up is intentionally absent
+ * here: bcma host_soc.c speaks to the backplane natively, in
+ * big-endian, via the pdata-supplied configuration.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_data/bcma_host_soc.h>
+#include <linux/platform_device.h>
+#include <linux/reset.h>
+
+/* SHIM register layout (struct WlanShimRegs in 6362_map_part.h). */
+#define SHIM_MISC 0x00
+#define SHIM_FORCE_CLK_ON BIT(2)
+#define SHIM_MACRO_DISABLE BIT(1)
+#define SHIM_MACRO_SOFT_RESET BIT(0)
+#define SHIM_STATUS 0x04
+#define SHIM_CC_CONTROL 0x08
+#define SHIM_CC_STATUS 0x0c
+#define SHIM_MAC_CONTROL 0x10
+#define SICF_FGC BIT(1) /* force gated clock */
+#define SICF_CLOCK_EN BIT(0)
+#define SHIM_MAC_STATUS 0x14
+#define SHIM_CC_ID_A 0x18
+#define SHIM_MAC_ID_A 0x24
+
+struct bcm6362_wlan {
+ struct device *dev;
+ void __iomem *shim;
+ struct clk *clk;
+ struct reset_control *rst_shim;
+ struct reset_control *rst_shim_ubus;
+
+ /* Storage for the pdata pointer handed to bcma via of_dev_auxdata.
+ * of_platform_device_create_pdata() stores a pointer to this
+ * struct on the bcma child device's platform_data field, so it
+ * must outlive the child. devm_kzalloc on priv guarantees this:
+ * the child is depopulated in remove() before devres frees priv.
+ */
+ struct bcma_host_soc_pdata pdata;
+};
+
+static int bcm6362_wlan_bringup(struct bcm6362_wlan *priv)
+{
+ int ret;
+
+ dev_info(priv->dev, "bring-up: start\n");
+
+ ret = clk_prepare_enable(priv->clk);
+ if (ret) {
+ dev_err(priv->dev, "clk_prepare_enable failed: %d\n", ret);
+ return ret;
+ }
+ dev_info(priv->dev, "bring-up: clock enabled, rate=%lu Hz\n",
+ clk_get_rate(priv->clk));
+ mdelay(10);
+
+ /* Reset toggle (brcm,bcm6345-reset hides the active-low softResetB
+ * encoding, so assert/deassert read naturally here).
+ */
+ reset_control_assert(priv->rst_shim_ubus);
+ reset_control_assert(priv->rst_shim);
+ mdelay(1);
+ reset_control_deassert(priv->rst_shim_ubus);
+ reset_control_deassert(priv->rst_shim);
+ mdelay(1);
+ dev_info(priv->dev, "bring-up: reset toggled\n");
+
+ /* The SHIM and the AXI backplane behind it are big-endian
+ * peripherals on a big-endian MIPS CPU. The asymmetric-endian
+ * writel() in this configuration byte-swaps the value (it
+ * assumes a little-endian bus, typical for PCI), landing each
+ * bit in the wrong position. iowrite32be() is a no-op transform
+ * here (BE-to-BE) and writes the value the bring-up sequence
+ * intends. Same story for the read-back diagnostics: readl()
+ * would byte-swap on the way back.
+ *
+ * Force clocks on + hold WLAN macro in soft reset.
+ */
+ iowrite32be(SHIM_FORCE_CLK_ON | SHIM_MACRO_SOFT_RESET,
+ priv->shim + SHIM_MISC);
+ mdelay(1);
+
+ /* MAC core: force gated clock + clock enable (with reset held). */
+ iowrite32be(SICF_FGC | SICF_CLOCK_EN, priv->shim + SHIM_MAC_CONTROL);
+
+ /* Release macro soft reset, keep clocks forced. */
+ iowrite32be(SHIM_FORCE_CLK_ON, priv->shim + SHIM_MISC);
+
+ /* Drop the force, let normal gating take over. */
+ iowrite32be(0, priv->shim + SHIM_MISC);
+ iowrite32be(SICF_CLOCK_EN, priv->shim + SHIM_MAC_CONTROL);
+
+ /* Read-back diagnostics: if the backplane is alive these reflect
+ * the values we just wrote (MISC=0, MAC_CONTROL=SICF_CLOCK_EN) and
+ * the STATUS regs report sane non-zero core ids.
+ */
+ dev_info(priv->dev,
+ "bring-up: post-shim MISC=%08x STATUS=%08x CC_CTRL=%08x CC_STAT=%08x MAC_CTRL=%08x MAC_STAT=%08x\n",
+ ioread32be(priv->shim + SHIM_MISC),
+ ioread32be(priv->shim + SHIM_STATUS),
+ ioread32be(priv->shim + SHIM_CC_CONTROL),
+ ioread32be(priv->shim + SHIM_CC_STATUS),
+ ioread32be(priv->shim + SHIM_MAC_CONTROL),
+ ioread32be(priv->shim + SHIM_MAC_STATUS));
+ dev_info(priv->dev,
+ "bring-up: CcIdA=%08x MacIdA=%08x (non-zero = backplane responsive)\n",
+ ioread32be(priv->shim + SHIM_CC_ID_A),
+ ioread32be(priv->shim + SHIM_MAC_ID_A));
+
+ return 0;
+}
+
+static void bcm6362_wlan_teardown(struct bcm6362_wlan *priv)
+{
+ iowrite32be(0, priv->shim + SHIM_MAC_CONTROL);
+ iowrite32be(SHIM_MACRO_DISABLE | SHIM_MACRO_SOFT_RESET,
+ priv->shim + SHIM_MISC);
+ reset_control_assert(priv->rst_shim);
+ reset_control_assert(priv->rst_shim_ubus);
+ clk_disable_unprepare(priv->clk);
+}
+
+static int bcm6362_wlan_probe(struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+ struct of_dev_auxdata auxdata[2];
+ struct bcm6362_wlan *priv;
+ int ret;
+
+ priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+ priv->dev = dev;
+
+ priv->shim = devm_platform_ioremap_resource_byname(pdev, "shim");
+ if (IS_ERR(priv->shim))
+ return PTR_ERR(priv->shim);
+
+ priv->clk = devm_clk_get(dev, NULL);
+ if (IS_ERR(priv->clk))
+ return PTR_ERR(priv->clk);
+
+ priv->rst_shim = devm_reset_control_get_exclusive(dev, "shim");
+ if (IS_ERR(priv->rst_shim))
+ return PTR_ERR(priv->rst_shim);
+
+ priv->rst_shim_ubus = devm_reset_control_get_exclusive(dev,
+ "shim-ubus");
+ if (IS_ERR(priv->rst_shim_ubus))
+ return PTR_ERR(priv->rst_shim_ubus);
+
+ ret = bcm6362_wlan_bringup(priv);
+ if (ret) {
+ dev_err(dev, "WLAN bring-up failed: %d\n", ret);
+ return ret;
+ }
+
+ /* Configure pdata in storage owned by priv. Used by
+ * of_platform_populate() below and dereferenced by bcma at
+ * runtime via dev_get_platdata().
+ */
+ priv->pdata.big_endian = true;
+ priv->pdata.shim_attached = true;
+ priv->pdata.shim_iomem = priv->shim;
+
+ /* Inject pdata into the brcm,bus-axi child at populate time.
+ * phys_addr 0 matches by compatible only; there is exactly one
+ * brcm,bus-axi child under this node. of_platform_populate()
+ * triggers the bcma probe synchronously - if bcma is built-in
+ * (or already loaded as a module - see MODULE_SOFTDEP below)
+ * it has matched and configured itself before we return here.
+ */
+ auxdata[0] = (struct of_dev_auxdata)
+ OF_DEV_AUXDATA("brcm,bus-axi", 0, NULL, &priv->pdata);
+ memset(&auxdata[1], 0, sizeof(auxdata[1]));
+
+ ret = of_platform_populate(dev->of_node, NULL, auxdata, dev);
+ if (ret) {
+ dev_err(dev, "failed to populate bcma child: %d\n", ret);
+ bcm6362_wlan_teardown(priv);
+ return ret;
+ }
+
+ platform_set_drvdata(pdev, priv);
+ return 0;
+}
+
+static void bcm6362_wlan_remove(struct platform_device *pdev)
+{
+ struct bcm6362_wlan *priv = platform_get_drvdata(pdev);
+
+ /* Tear bcma down first: the bcma child uses priv->shim through
+ * pdata->shim_iomem and its lifetime is owned here.
+ * of_platform_depopulate() is synchronous - by the time it
+ * returns, bcma has released the SHIM mapping.
+ */
+ of_platform_depopulate(&pdev->dev);
+ bcm6362_wlan_teardown(priv);
+}
+
+static const struct of_device_id bcm6362_wlan_match[] = {
+ { .compatible = "brcm,bcm6362-wlan", },
+ { }
+};
+MODULE_DEVICE_TABLE(of, bcm6362_wlan_match);
+
+static struct platform_driver bcm6362_wlan_driver = {
+ .probe = bcm6362_wlan_probe,
+ .remove = bcm6362_wlan_remove,
+ .driver = {
+ .name = "bcm6362-wlan",
+ .of_match_table = bcm6362_wlan_match,
+ },
+};
+module_platform_driver(bcm6362_wlan_driver);
+
+MODULE_SOFTDEP("pre: bcma");
+MODULE_AUTHOR("Alessio Ferri <alessio.ferri@mythread.it>");
+MODULE_DESCRIPTION("BCM6362 on-chip WLAN SHIM bridge driver");
+MODULE_LICENSE("GPL");
--
2.54.0
^ permalink raw reply related
* [PATCH 2/4] bcma: allow SHIM-style mini-EROM wrapper-less cores in scan
From: Alessio Ferri @ 2026-05-29 0:06 UTC (permalink / raw)
To: Rafał Miłecki, Alessio Ferri, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
Florian Fainelli
Cc: linux-kernel, linux-wireless, devicetree
In-Reply-To: <20260529-add-bcm6362-wlan-v1-0-722242777f58@gmail.com>
bcma_get_next_core() rejects with -ENXIO any component whose
component_B descriptor reports NMW=NSW=0 unless its core id is in
a short allowlist (4706 MAC GBIT, NS_CHIPCOMMON_B, PMU, GCI).
On SoCs that publish a SHIM-style mini-EROM (i.e. BCM6362) the
WLAN backplane lists three components:
ChipCommon, IEEE 802.11 and BCMA_CORE_SHIM. None of the three is
in the existing allowlist, so all three are skipped silently,
bus->cores stays empty, bcma_find_core(BCMA_CORE_CHIPCOMMON)
returns NULL, and a later bcma_chipco_watchdog_register()
dereferences cc->core->bus on its first line and oopses mid-probe.
Assisted-by: Claude:claude-4.8-opus
Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it>
---
drivers/bcma/scan.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 983a62ddeebb..782fc53eb6b3 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -318,6 +318,21 @@ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
case BCMA_CORE_GCI:
/* Not used yet: case BCMA_CORE_OOB_ROUTER: */
break;
+ case BCMA_CORE_CHIPCOMMON:
+ case BCMA_CORE_80211:
+ case BCMA_CORE_SHIM:
+ /* SHIM-style mini-EROM SoCs publish CHIPCOMMON, the
+ * IEEE 802.11 core and the SHIM core itself with
+ * NMW=NSW=0 because clock and reset gating happens
+ * at the SoC level via the SHIM Control register,
+ * not via per-core DMP wrappers. host_soc.c sets
+ * bus->shim_attached on those SoCs from pdata; the
+ * strict NMW=NSW=0 rejection still applies to PCI-
+ * attached cards and to SoCs without that quirk.
+ */
+ if (bus->shim_attached)
+ break;
+ fallthrough;
default:
bcma_erom_skip_component(bus, eromptr);
return -ENXIO;
--
2.54.0
^ permalink raw reply related
* [PATCH] mt76: mt76x02: fix SKB memory leak on error path in USB MCU
From: VolcomIlluminated @ 2026-05-28 20:15 UTC (permalink / raw)
To: Nbd; +Cc: Lorenzo, Linux Wireless
[-- Attachment #1.1: Type: text/plain, Size: 75 bytes --]
Patch Attached!
--
Secured with Tuta Mail:
https://tuta.com/free-email
[-- Attachment #1.2: Type: text/html, Size: 406 bytes --]
[-- Attachment #2: 0005-mt76-mt76x02-fix-SKB-memory-leak-on-error-path.patch --]
[-- Type: application/octet-stream, Size: 1088 bytes --]
From: VolcomIlluminated <volcomilluminated@tuta.com>
Date: Wed, 28 May 2026 00:00:00 +0000
Subject: [PATCH] mt76: mt76x02: fix SKB memory leak on error path in USB MCU
When mt76x02u_skb_dma_info() fails, the function returns immediately
without calling consume_skb(), leaking the SKB allocation.
Replace the early return with a goto to the existing out label which
calls consume_skb() unconditionally.
This addresses CVE-2022-50172.
Tested on Netgear A6210 (MT76x2U) with 1,640 packets and zero drops
over 2+ hours of continuous operation.
Signed-off-by: VolcomIlluminated <volcomilluminated@tuta.com>
---
--- /tmp/linux-6.18/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c 2025-11-30 17:42:10.000000000 -0500
+++ /home/ptpx86mm1/kernelbuild/linux-6.18/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c 2026-05-25 21:22:15.200610401 -0400
@@ -90,7 +90,7 @@
MT_MCU_MSG_TYPE_CMD;
ret = mt76x02u_skb_dma_info(skb, CPU_TX_PORT, info);
if (ret)
- return ret;
+ goto out;
ret = mt76u_bulk_msg(dev, skb->data, skb->len, NULL, 500,
MT_EP_OUT_INBAND_CMD);
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox