* [PATCH rtw-next 1/2] wifi: rtw88: 8822c: Don't process RF path C in query_phy_status_page{0,1}
From: Bitterblue Smith @ 2026-06-10 13:01 UTC (permalink / raw)
To: linux-wireless@vger.kernel.org; +Cc: Ping-Ke Shih
Replace <= with < in the loops in query_phy_status_page{0,1}(). They
were processing data related to RF path C, which this chip doesn't have.
The only bad effect seems to be that the phy_info file in debugfs was
printing unexpected values for RF path C.
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
---
drivers/net/wireless/realtek/rtw88/rtw8822c.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
index 244c8026479c..80c9f0c11e5c 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
@@ -2584,7 +2584,7 @@ static void query_phy_status_page0(struct rtw_dev *rtwdev, u8 *phy_status,
pkt_stat->rx_power[RF_PATH_A] = rx_power[RF_PATH_A];
pkt_stat->rx_power[RF_PATH_B] = rx_power[RF_PATH_B];
- for (path = 0; path <= rtwdev->hal.rf_path_num; path++) {
+ for (path = 0; path < rtwdev->hal.rf_path_num; path++) {
rssi = rtw_phy_rf_power_2_rssi(&pkt_stat->rx_power[path], 1);
dm_info->rssi[path] = rssi;
}
@@ -2644,7 +2644,7 @@ static void query_phy_status_page1(struct rtw_dev *rtwdev, u8 *phy_status,
pkt_stat->cfo_tail[RF_PATH_A] = GET_PHY_STAT_P1_CFO_TAIL_A(phy_status);
pkt_stat->cfo_tail[RF_PATH_B] = GET_PHY_STAT_P1_CFO_TAIL_B(phy_status);
- for (path = 0; path <= rtwdev->hal.rf_path_num; path++) {
+ for (path = 0; path < rtwdev->hal.rf_path_num; path++) {
rssi = rtw_phy_rf_power_2_rssi(&pkt_stat->rx_power[path], 1);
dm_info->rssi[path] = rssi;
if (path == RF_PATH_A) {
--
2.54.0
^ permalink raw reply related
* Re: [PATCH v2 0/7] arm64: dts: qcom: enable WiFi/BT on SM8350 HDK
From: Konrad Dybcio @ 2026-06-10 11:56 UTC (permalink / raw)
To: Rob Herring, Dmitry Baryshkov
Cc: Manivannan Sadhasivam, Lorenzo Pieralisi,
Krzysztof Wilczyński, Bjorn Helgaas, Qiang Yu, Jeff Johnson,
Liam Girdwood, Mark Brown, Krzysztof Kozlowski, Conor Dooley,
Bartosz Golaszewski, Marcel Holtmann, Luiz Augusto von Dentz,
Balakrishna Godavarthi, Rocky Liao, Bjorn Andersson,
Konrad Dybcio, linux-arm-msm, linux-pci, linux-kernel,
linux-wireless, ath11k, devicetree, Bartosz Golaszewski,
linux-bluetooth, Bartosz Golaszewski
In-Reply-To: <20260608151835.GA2707238-robh@kernel.org>
On 6/8/26 5:18 PM, Rob Herring wrote:
> On Mon, Jun 08, 2026 at 09:59:18AM +0300, Dmitry Baryshkov wrote:
>> The SM8350 HDK has an onboard WCN6851 WiFi/BT chip, which for a long
>> time was not supported. Bring up different pieces required to enable
>> this SoC.
>>
>> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
>> ---
>> Changes in v2:
>> - Bumped num_vdevs to 4 to follow other similar devices (Jeff)
>> - Link to v1: https://patch.msgid.link/20260601-sm8350-wifi-v1-0-242917d88031@oss.qualcomm.com
>>
>> ---
>> Dmitry Baryshkov (7):
>> PCI: qcom: fix parsing of PERST# in the legacy case
>> wifi: ath11k: enable support for WCN6851
>> regulator: dt-bindings: qcom,qca6390-pmu: document WCN6851
>> dt-bindings: bluetooth: qcom,wcn6855-bt: document WCN6851
>> arm64: dts: qcom: sm8350: expand UART18 to 4 pins config
>> arm64: dts: qcom: sm8350: modernize PCIe entries
>> arm64: dts: qcom: sm8350-hdk: describe WiFi/BT chip
>
> Before adding new devices, can you (Qcom) fix the all the existing DT
> warnings related to QCom WiFi/BT:
>
> 6 (qcom,wcn6855-bt): 'vddrfa1p7-supply' is a required property
> 6 (qcom,wcn6855-bt): Unevaluated properties are not allowed ('vddrfa1p8-supply' was unexpected)
> 2 (qcom,wcn6855-bt): 'vddwlmx-supply' is a required property
> 2 (qcom,wcn6855-bt): 'vddwlcx-supply' is a required property
> 2 (qcom,wcn6855-bt): 'vddbtcmx-supply' is a required property
> 2 (qcom,wcn6855-bt): 'vddaon-supply' is a required property
> 2 (pci17cb,1103): 'vddwlmx-supply' is a required property
> 2 (pci17cb,1103): 'vddwlcx-supply' is a required property
> 2 (pci17cb,1103): 'vddrfacmn-supply' is a required property
> 2 (pci17cb,1103): 'vddrfa1p8-supply' is a required property
> 2 (pci17cb,1103): 'vddrfa1p2-supply' is a required property
> 2 (pci17cb,1103): 'vddrfa0p8-supply' is a required property
> 2 (pci17cb,1103): 'vddpcie1p8-supply' is a required property
> 2 (pci17cb,1103): 'vddpcie0p9-supply' is a required property
> 2 (pci17cb,1103): 'vddaon-supply' is a required property
Most of them will be gone with
https://lore.kernel.org/linux-arm-msm/20260522-surface-sp9-5g-for-next-v2-8-dd9d477407f5@gmail.com/
a single dt generates 2 DTBs (one overlayed) that throw almost all of
these errors.. we should be able to tackle the rest that remain shortly
Konrad
^ permalink raw reply
* [PATCH] wifi: nl80211: free RNR data on MBSSID mismatch
From: Zhao Li @ 2026-06-10 11:22 UTC (permalink / raw)
To: Johannes Berg; +Cc: Aloka Dixit, linux-wireless, linux-kernel
nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR
entries than MBSSID entries.
The rejected RNR allocation has not been attached to the beacon data yet,
so free it before returning the error.
Fixes: dbbb27e183b1 ("cfg80211: support RNR for EMA AP")
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
net/wireless/nl80211.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 76c537a6e8b52..1b4c4440d2abf 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6519,8 +6519,10 @@ static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
if (IS_ERR(rnr))
return PTR_ERR(rnr);
- if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
+ if (rnr && rnr->cnt < bcn->mbssid_ies->cnt) {
+ kfree(rnr);
return -EINVAL;
+ }
bcn->rnr_ies = rnr;
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply related
* Re: [PATCH] wifi: ath6kl: fix invalid workqueue flags in ath6kl_usb_create()
From: Tetsuo Handa @ 2026-06-10 11:00 UTC (permalink / raw)
To: wuyankun, linux-wireless
Cc: jeff.johnson, johan, kees, sumanth.gavini, linux-kernel,
syzkaller-bugs, syzbot+f80c62f371ba6a1e7d79, stable
In-Reply-To: <20260610092236.40026-1-wuyankun@uniontech.com>
On 2026/06/10 18:22, wuyankun wrote:
> ath6kl_usb_create() currently creates ath6kl_wq with flags set to 0:
>
> alloc_workqueue("ath6kl_wq", 0, 0)
>
> This triggers a runtime warning in __alloc_workqueue() because the queue is
> created with neither WQ_PERCPU nor WQ_UNBOUND set:
>
> workqueue: ath6kl_wq is using neither WQ_PERCPU or WQ_UNBOUND.
> Setting WQ_PERCPU.
>
> Set WQ_PERCPU explicitly to match the actual execution model and remove the
> warning during device probe. No functional change intended.
>
> Fixes: 62ebaf2f9261 ("ath6kl: avoid flush_scheduled_work() usage")
Please use
Fixes: 21c05ca88a54 ("workqueue: Add warnings and ensure one among WQ_PERCPU or WQ_UNBOUND is present")
for this problem because this problem is caused by
WQ subsystem is about to start requiring WQ_PERCPU unless WQ_UNBOUND,
without updating all in-tree users before start emitting WARNING: message
. Also, you don't need to send to stable, but please try to send to linux.git before
7.1-final is released (because this fix should be applied before 21c05ca88a54 is
applied in order to avoid flooding of WARNING: messages).
> Reported-by: syzbot+f80c62f371ba6a1e7d79@syzkaller.appspotmail.com
> Link: https://lore.kernel.org/all/6a289c01.39669fcc.33b062.00aa.GAE@google.com/T/
> Cc: stable@vger.kernel.org
> Signed-off-by: wuyankun <wuyankun@uniontech.com>
> ---
> drivers/net/wireless/ath/ath6kl/usb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
> index 79c18f5ee02b..945984c3dbe6 100644
> --- a/drivers/net/wireless/ath/ath6kl/usb.c
> +++ b/drivers/net/wireless/ath/ath6kl/usb.c
> @@ -636,7 +636,7 @@ static struct ath6kl_usb *ath6kl_usb_create(struct usb_interface *interface)
> ar_usb = kzalloc_obj(struct ath6kl_usb);
> if (ar_usb == NULL)
> return NULL;
> - ar_usb->wq = alloc_workqueue("ath6kl_wq", 0, 0);
> + ar_usb->wq = alloc_workqueue("ath6kl_wq", WQ_PERCPU, 0);
> if (!ar_usb->wq) {
> kfree(ar_usb);
> return NULL;
^ permalink raw reply
* Re: [PATCH wireless-next 4/5] wifi: cfg80211: Fragment per-link station stats in nl80211_dump_station()
From: Johannes Berg @ 2026-06-10 10:40 UTC (permalink / raw)
To: Praneesh P; +Cc: linux-wireless, ath12k
In-Reply-To: <19098782-24e9-4707-8207-6244371a904f@oss.qualcomm.com>
On Tue, 2026-06-09 at 00:31 +0530, Praneesh P wrote:
>
> > That seems really odd? why even bother going into the whole thing if
> > it's invalid? Also, doesn't that ENOENT get propagated all the way and
> > it aborts? I guess it does but it should never happen because of
> > valid_links? Still seems a bit odd.
> Both the link_sinfo null check and is_valid_ether_addr() check
> will be moved to the top of the function, before any header or
> nest construction. The null check for sinfo->links[link_idx] is
> already guarded upstream by the valid_links bitmask so it should
> never be NULL in practice, I'll add a WARN_ON_ONCE and skip rather
> than returning -ENOENT, which would otherwise abort the entire dump.
> Will it be okay ?
I guess? Anyway the structure will change based on our other discussion
below.
> ok, I will try to align with this suggested model. I'll refactor so the
> outer loop
> produces exactly one netlink message per iteration, with header
> construction in one place:
>
> while (true) {
> if (ctx->phase == PHASE_AGGREGATED) {
> /* fetch sinfo from driver once per station */
> memset(&ctx->sinfo, ...);
> /* allocate links[], call rdev_dump_station() */
> /* apply cfg80211_sta_set_mld_sinfo() if needed */
> }
>
> hdr = nl80211hdr_put(msg, ...);
> /* common attrs: ifindex, wdev, mac, generation */
> nla_put_u32(msg, NL80211_ATTR_IFINDEX, ...);
> nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, ...);
> nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ctx->mac_addr);
> nla_put_u32(msg, NL80211_ATTR_GENERATION, ...);
>
> switch (ctx->phase) {
> case PHASE_AGGREGATED:
> nl80211_put_sta_info_common(msg, rdev, &ctx->sinfo);
> ctx->phase = PHASE_PER_LINK;
> ctx->link_idx = first_valid_link();
> break;
> case PHASE_PER_LINK:
> nl80211_put_link_station(msg, rdev, &ctx->sinfo, ctx->link_idx);
> advance ctx->link_idx to next valid link;
> if (no more links) {
> cfg80211_sinfo_release_content(&ctx->sinfo);
> ctx->sta_idx++;
> ctx->phase = PHASE_AGGREGATED;
> }
> break;
> }
>
> genlmsg_end(msg, hdr); /* or genlmsg_cancel() on EMSGSIZE
> break-out */
> }
>
>
> This eliminates the duplicated nla_put_u32/u64/MAC header blocks
> that currently exist in both nl80211_send_accumulated_station()
> and nl80211_send_link_station(), and makes the EMSGSIZE bail-out
> uniform since we return before committing the message.
Sounds good!
> should the rdev_dump_station() / sinfo fill stay outside the
> per-message loop (as a separate if (phase == AGGREGATED) guard
> at the top), or is it preferable to fold it into the switch
> case? I've sketched the former above since fetching sinfo is
> logically per-station, not per-message. I'm also ok to adjust
> if you'd prefer it inside the switch ?
I think it has to stay above otherwise you can't unify pushing the MAC
address to the message? And then perhaps you could even unify the nest
push (i.e. NL80211_ATTR_STA_INFO nest start), but I'm not sure how that
interacts with other code and it's not really important. The header is
more important since it could change in the future.
johannes
^ permalink raw reply
* [GIT PULL] wireless-next-2026-06-10
From: Johannes Berg @ 2026-06-10 10:35 UTC (permalink / raw)
To: netdev; +Cc: linux-wireless
Hi,
This should be the last PR. Quite a few more driver things came
(see the tag message) but otherwise it feels fairly simple.
Please pull and let us know if there's any problem.
Thanks,
johannes
The following changes since commit c2c0486c56800ce276e79c40a6e576ffd672f2a9:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-06-01 13:42:12 +0200)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git tags/wireless-next-2026-06-10
for you to fetch changes up to 21352612198c83a8441482abbf3bd45e4f128dd0:
b43: add RF power offset for N-PHY r8 + radio 2057 r8 (2026-06-10 10:27:56 +0200)
----------------------------------------------------------------
Quite a few last updates, notably:
- b43: new support for an 11n device
- mt76:
- mt792x broken usb transport detection
- mt7921 regd improvements
- mt7927 support
- iwlwifi:
- more kunit tests
- FW version updates
- ath12k: WDS support
- rtw89:
- RTL8922AU support
- USB 3 mode switch for performance
- better monitor radiotap support
- RTL8922DE preparations
- cfg80211/mac80211:
- update UHR to D1.4, UHR DBE support
- finally remove 5/10 MHz support
- S1G rate reporting
- multicast encapsulation offload
----------------------------------------------------------------
Aaradhana Sahu (1):
wifi: ath12k: add hardware parameters for maximum supported clients
Aditya Kumar Singh (1):
wifi: ath12k: Prevent incorrect vif chanctx switch when handling multi-radio contexts
Alessio Ferri (7):
b43: add firmware mappings for rev22
b43: add d11 core revision 0x16 to id table
b43: route d11 corerev 22 to 24-bit indirect radio access
b43: support radio 2057 rev 8
b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8
b43: add channel info table for N-PHY r8 + radio 2057 r8
b43: add RF power offset for N-PHY r8 + radio 2057 r8
Andreas Kemnade (1):
wifi: wlcore: enable the right set of ciphers
Arjan van de Ven (1):
wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
Aviel Zohar (2):
wifi: mt76: mt7925: validate skb length in testmode query
wifi: mt76: mt7915: validate skb length in txpower SKU query
Avinash Bhatt (3):
wifi: iwlwifi: mld: add KUnit tests for duplicated beacon RSSI adjustment
wifi: iwlwifi: mld: add KUnit tests for PSD/EIRP RSSI adjustment
wifi: iwlwifi: mld: add KUnit tests for link grading
Baochen Qiang (1):
wifi: ath12k: fix EAPOL TX failure caused by stale tcl_metadata bits
Bitterblue Smith (16):
wifi: rtw89: usb: Support 2 bulk in endpoints
wifi: rtw89: Fix rtw89_usb_ops_mac_lv1_rcvy() for RTL8922AU
wifi: rtw89: Fix rtw89_usb_ops_mac_pre_init() for RTL8922AU
wifi: rtw89: Fix rtw89_usb_ops_mac_post_init() for RTL8922AU
wifi: rtw89: usb: Enable RX aggregation for RTL8922AU
wifi: rtw89: Fix rtw8922a_pwr_{on,off}_func() for USB
wifi: rtw89: Let hfc_param_ini have separate settings for USB 2/3
wifi: rtw89: Add rtw8922a_hfc_param_ini_usb{2,3}
wifi: rtw89: Add rtw8922a_dle_mem_usb{2,3}
wifi: rtw89: Add rtw8922au.c
wifi: rtw89: Enable the new rtw89_8922au module
wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
wifi: rtl8xxxu: Detect the maximum supported channel width
wifi: rtw89: Add missing TX queue mappings for RTL8922AU
wifi: rtw88: Add more validation for the RX descriptor
wifi: rtw89: usb: Support switching to USB 3 mode
Bjoern A. Zeeb (1):
wifi: mt76: fix argument to ieee80211_is_first_frag()
Bryam Vargas (1):
wifi: mac80211: bound S1G TIM PVB walk to the TIM element
Chelsy Ratnawat (1):
wifi: rtlwifi: rtl8821ae: Remove dead code in rtl8821ae_update_hal_rate_table()
Chia-Yuan Li (2):
wifi: rtw89: add IO offload support via firmware
wifi: rtw89: offload DMAC and CMAC init IO to firmware
Chih-Kang Chang (3):
wifi: rtw89: use struct to fill C2H recv ack
wifi: rtw89: check scan C2H event recv ack instead of C2H event done ack
wifi: rtw89: suspend DIG when remain-on-channel
Chin-Yen Lee (2):
wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers
wifi: rtw89: wow: send ARP reply packets instead of Null packets to keep alive
Christos Longros (1):
wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers
David Laight (1):
rfkill: Replace strcpy() with memcpy()
David Lee (1):
wifi: rtw89: usb: skip ACPI capability check for USB devices
Devin Wittmayer (2):
wifi: mt76: mt7925: add Netgear A8500 USB device ID
wifi: mt76: mt7921: assert sniffer on chanctx change
Dian-Syuan Yang (3):
wifi: rtw89: disable HTC field in AP mode
wifi: rtw89: disable CSI STBC for VHT 160MHz
wifi: rtw89: pci: enable LTR based on pcie control register
Dylan Eskew (2):
wifi: mt76: mt7996: reduce phy work in set_coverage
wifi: mt76: mt7996: limit work in set_bitrate_mask
ElXreno (2):
wifi: mt76: route TDLS-peer frames as 3-addr non-DS in HW encap
wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
Emmanuel Grumbach (2):
wifi: iwlwifi: add support for AX231
wifi: iwlwifi: bump maximum core version for BZ/SC/DR to 106
Eric Huang (2):
wifi: rtw89: phy: support static PD level setting
wifi: rtw89: use firmware offload for PHY and RF batch register writes
Felix Fietkau (3):
wifi: mac80211: report assoc_link_id in station info for non-MLD STAs on MLD AP
wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart
wifi: mt76: mt7996: add missing max_remain_on_channel_duration
Hangtian Zhu (1):
wifi: ath12k: allow peer_id 0 in dp peer lookup
Hongling Zeng (1):
wifi: mt76: mt7921: fix resource leak in probe error path
Hugo Villeneuve (1):
wifi: rtlwifi: fix typos in comments in rtl8821ae_card_disable()
Ilan Peer (2):
wifi: iwlwifi: mld: Require HT support for NAN
wifi: mac80211: Free keys associated with NAN Device
Ingyu Jang (1):
wifi: mt76: Drop unneeded mt76_register_debugfs_fops() return checks
Israel Kozitz (1):
wifi: iwlwifi: mld: support FW TLV for NAN max channel switch time
JB Tsai (5):
wifi: mt76: mt7921: refactor regulatory domain handling to regd.[ch]
wifi: mt76: mt7921: refactor CLC support check flow
wifi: mt76: mt7921: refactor regulatory notifier flow
wifi: mt76: mt7921: add auto regdomain switch support
wifi: mt76: mt7921: disable auto regd changes after user set
Javier Tia (9):
wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv
wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS
wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec
wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
wifi: mt76: mt7925: add MT7927 chip ID helpers
wifi: mt76: mt7925: add MT7927 firmware paths
wifi: mt76: mt7925: use irq_map for chip-specific interrupt handling
wifi: mt76: mt7925: disable ASPM and runtime PM for MT7927
Jeff Johnson (4):
wifi: ath12k: Update Qualcomm copyrights
wifi: ath11k: Update Qualcomm copyrights
wifi: ath10k: Update Qualcomm copyrights
wifi: ath: Update copyright in testmode_i.h
Jiajia Liu (2):
wifi: mt76: add wcid publish check in mt76_sta_add
wifi: mt76: transform aspm_conf for pci_disable_link_state
Johan Hovold (5):
wifi: mt76: drop redundant device reference
wifi: mt76x0u: drop redundant device reference
wifi: mt76x2u: drop redundant device reference
wifi: mt76: mt792xu: drop redundant device reference
wifi: mt7601u: drop redundant device reference
Johannes Berg (29):
wifi: cfg80211: remove 5/10 MHz channel support
wifi: mac80211: remove 5/10 MHz channel code
wifi: ieee80211: define some UHR link reconfiguration frame types
wifi: mac80211: unify link STA removal in vif link removal
wifi: mac80211: clean up return in ieee802_11_find_bssid_profile()
wifi: mac80211: rename "multi_link_inner" variable
wifi: mac80211: clarify beacon parsing with MBSSID/EMA
wifi: mac80211: use local ml_basic_elem in parsing
wifi: cfg80211: harden cfg80211_defragment_element()
wifi: mac80211: always expose multi-link element
wifi: mac80211: mlme: allow UHR only with MLO
wifi: mac80211: explain ieee80211_determine_chan_mode() parsing
wifi: Update UHR PHY capabilities to D1.4
wifi: Update UHR MAC capabilities to D1.4
wifi: mac80211: refactor link STA bandwidth update
wifi: mac80211: parse and apply UHR DBE channel
wifi: mac80211: AP: handle DBE for clients
wifi: mac80211_hwsim: claim DBE capability
Merge tag 'rtw-next-2026-06-03' of https://github.com/pkshih/rtw
wifi: iwlwifi: fw: cut down NIC wakeups during dump
wifi: iwlwifi: mvm: rename iwl_mvm_mac80211_idx_to_hwrate()
wifi: iwlwifi: move iwl_fw_rate_idx_to_plcp() to mvm
wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect
wifi: iwlwifi: mvm: fix P2P-Device binding handling
wifi: iwlwifi: pcie: fix write pointer move detection
Merge tag 'ath-next-20260602' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
Merge tag 'iwlwifi-next-2026-06-03' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next
Merge tag 'mt76-next-2026-06-09' of https://github.com/nbd168/wireless
Merge tag 'ath-next-20260609' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
Johnson Tsai (5):
wifi: rtw89: debug: disable hw_scan for latency-sensitive scenarios
wifi: rtw89: debug: disable inactive power save to reduce bus overhead
wifi: rtw89: 8832cu: Add ID 2c7c:8206 for RTL8832CU
wifi: rtw89: add dev_id_quirks to driver_info for per-device quirk control
wifi: rtw89: usb: add serial_number and uuid sysfs attributes for 0x28de:0x2432
Kuan-Chung Chen (7):
wifi: rtw89: mlo: rearrange MLSR link decision flow
wifi: rtw89: phy: support per PHY RX statistics
wifi: rtw89: debug: bb_info entry including TX rate count for WiFi 7 chips
wifi: rtw89: debug: add PMAC counter in bb_info
wifi: rtw89: debug: extend bb_info with TX status and PER
wifi: rtw89: debug: add RX statistics in bb_info
wifi: rtw89: debug: add BB diagnose
Kwan Lai Chee Hou (1):
wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode
Lachlan Hodges (1):
wifi: mac80211: basic S1G rx rate reporting support
Lorenzo Bianconi (5):
wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()
wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()
wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()
wifi: mt76: mt7996: fix reading zeroed info->control.flags after mt76_tx_status_skb_add()
wifi: mt76: mt7996: remove redundant pdev->bus check in probe
Louis Kotze (1):
wifi: rtw89: phy: increase RF calibration timeouts for USB transport
Luka Gejak (2):
wifi: rtw88: increase TX report timeout to fix race condition
wifi: rtw88: usb: fix memory leaks on USB write failures
Martin Kaiser (1):
wifi: rtw88: remove rtw_txq_dequeue
Masashi Honma (9):
wifi: mac80211: Use struct instead of macro for PREQ frame
wifi: mac80211: Use struct instead of macro for PREP frame
wifi: mac80211: Use struct instead of macro for PERR frame
wifi: mac80211: Fix overread in PREQ frame processing
wifi: mac80211: Fix overread in PREP frame processing
wifi: mac80211: Fix PERR frame processing
wifi: mac80211: Add KUnit test for ieee80211_mesh_preq_size_ok
wifi: mac80211: Add KUnit test for ieee80211_mesh_prep_size_ok
wifi: mac80211: Add KUnit test for ieee80211_mesh_perr_size_ok
Miaoqing Pan (3):
wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
wifi: ath11k: add MSDU length validation for TKIP MIC error
wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
Miri Korenblit (7):
wifi: iwlwifi: remove stale comment
wifi: iwlwifi: remove mvm prefix from marker command
wifi: iwlwifi: mld: fix smatch warning
wifi: iwlwifi: mld: always allow mimo in NAN
wifi: iwlwifi: fix a typo
wifi: iwlwifi: trans: export the maximum supported hcmd size
wifi: iwlwifi: mvm: remove __must_check annotation from command sending
Moriya Itzchaki (1):
wifi: iwlwifi: fix STEP_URM register address for SC devices
Myeonghun Pak (1):
wifi: mt76: mt7925: clean up DMA on probe failure
Nathan Chancellor (1):
wifi: mac80211: Fix -Wc23-extensions in hwmp_route_info_get()
Pagadala Yesu Anjaneyulu (1):
wifi: iwlwifi: mld: set fast-balance scan for active EMLSR
Panagiotis Petrakopoulos (1):
wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
Ping-Ke Shih (41):
wifi: rtl8xxxu: validate action frame size before using in rtl8xxxu_dump_action()
wifi: rtlwifi: validate action frame size in rtl_action_proc()
wifi: rtlwifi: validate action frame size before using in _rtl_pci_tx_isr()
wifi: rtw89: 8922d: fix typo rx_freq_frome_ie
wifi: rtw89: pci: no need to wait CLK ready for RTL8922DE
wifi: rtw89: add AMPDU to radiotap
wifi: rtw89: add VHT beamformed to radiotap
wifi: rtw89: SNIFFER_MODE bit along IEEE80211_CONF_MONITOR
wifi: rtw89: phy: define PHY status IE length for generations
wifi: rtw89: phy: enable IE-09/IE-10 PHY status report for monitor mode
wifi: rtw89: move HE radiotap to an individual function
wifi: rtw89: fill VHT radiotap
wifi: rtw89: fill HE-SU/HE-TB/HE-MU/HE-EXT_SU radiotap
wifi: rtw89: debug: make implementation of beacon_info entry in order
wifi: rtw89: add debugfs entry of monitor mode options to capture HE-MU packets
wifi: rtw89: phy: check length before parsing PHY status IE
wifi: rtw89: phy: skip trailing 8-byte zeros of PHY status IE for RTL8922D
wifi: rtw89: phy: support PHY status IE-09 GEN2 for RTL8922D
wifi: rtw89: check skb headroom before adding radiotap
wifi: rtw89: phy: define BB wrap data for RTL8922D variants
wifi: rtw89: phy: set BB wrap of out-of-band DPD
wifi: rtw89: phy: set BB wrap of DPD by bandwidth
wifi: rtw89: phy: set BB wrap of control options
wifi: rtw89: phy: set BB wrap of QAM threshold
wifi: rtw89: phy: set BB wrap of QAM options
wifi: rtw89: phy: set BB wrap of trigger-base partial band
wifi: rtw89: phy: set BB wrap of CIM3K
wifi: rtw89: phy: change order to align register order
wifi: rtw89: phy: configure control options of BB wrapper by RFSI band
wifi: rtw89: phy: add BB wrapper generation 3 for RTL8922D variant
wifi: rtw89: pci: not disable PCI completion timeout control for a variant of RTL8922DE
wifi: rtw89: pci: disable PCI PHY error flag 8
wifi: rtw89: clear auto K delay value before downloading firmware
wifi: rtw89: 8922d: change naming number and update values for WDE/PLE quota
wifi: rtw89: mac: add field of release report size to DLE quota
wifi: rtw89: mac: consolidate quota into a struct for variant chips
wifi: rtw89: 8922d: add quota for RTL8922DE variant
wifi: rtw89: 8922d: refactor digital power compensation to support new format
wifi: rtw89: 8922d: support new digital power compensation format
wifi: rtw89: fw: load TX compensation element by RFE type
wifi: rtw89: 8851bu: add Mercusys MA60XNB (2c4e:0128)
Po-Hao Huang (2):
wifi: rtw89: 8852a: refine power save to lower latency
wifi: rtw89: correct drop logic for malformed AMPDU frames
Rajat Gupta (1):
wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
Rosen Penev (11):
wifi: ath11k: use kzalloc_flex for struct scan_req_params
wifi: mac80211: fold tid_ampdu_rx allocations into a flexible array
wifi: wcn36xx: allocate chan_surveys with main struct
wifi: ath9k_htc: use module_usb_driver
wifi: ath9k: Clear DMA descriptors without memset
wifi: ath9k: remove TX99 power array zero init
wifi: ath9k: remove disabling of bands
wifi: ath9k_htc: allocate tx_buf and buf together
wifi: mt76: fix of_get_mac_address error handling
wifi: brcm80211: change current_bss to value
wifi: brcmfmac: flowring: simplify flow allocation
Runyu Xiao (1):
wifi: qtnfmac: topaz: defer IRQ enabling until IPC init
Ryder Lee (5):
wifi: mt76: mt7996: disable UNI_BSS_INFO_PROTECT_INFO for mt7996
wifi: mt76: mt7915: fix potential tx_retries underflow
wifi: mt76: mt7921: fix potential tx_retries underflow
wifi: mt76: mt7925: fix potential tx_retries underflow
wifi: mt76: mt7996: fix potential tx_retries underflow
Sean Wang (22):
wifi: mt76: connac: replace is_mt7925() with is_connac3()
wifi: mt76: mt7925: use link-specific removal for non-MLD STA
wifi: mt76: connac: tolerate inactive BSS deactivation
wifi: mt76: mt792x: add MT7927 WFSYS reset support
wifi: mt76: mt792x: factor out common DMA queue allocation
wifi: mt76: mt7925: switch DMA init to common mt792x queue helpers
wifi: mt76: mt792x: add MT7927-specific PCIe DMA support
wifi: mt76: mt7925: sync MT7927 BSS band assignment
wifi: mt76: mt7925: add MBMC event handling
wifi: mt76: mt792x: enable CNM ops for MT7927
wifi: mt76: mt7925: add MT7927 PCIe support
wifi: mt76: mt7925: add MT7927 USB support
wifi: mt76: mt7925: keep TX BA state in the primary WCID
wifi: mt76: mt7925: pass WCID explicitly to mt7925_mcu_sta_ba()
wifi: mt76: mt7925: program BA state on active links
wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
wifi: mt76: mt7921u: add MT7902 USB support
wifi: mt76: connac: use a helper to cache txpower_cur
wifi: mt76: connac: factor out rate power limit calculation
wifi: mt76: mt792x: report txpower for the requested vif link
wifi: mt76: mt792x: add common USB transport reset helpers
wifi: mt76: mt7921u: escalate broken USB transport to device reset
Shahar Tzarfati (4):
wifi: iwlwifi: cfg: Revert "wifi: iwlwifi: cfg: move the MODULE_FIRMWARE to the per-rf file"
wifi: iwlwifi: remove orphaned DC2DC config enum
wifi: iwlwifi: stop supporting core101
wifi: iwlwifi: mld: drop TLC config cmd v4/v5 compat code
Shin-Yi Lin (1):
wifi: rtw89: Correct data type for scan index to avoid infinite loop
Stepan Ionichev (1):
wifi: wcn36xx: fix spelling mistakes in dxe header comment
Tamizh Chelvam Raja (9):
wifi: ath12k: Set WDS vdev parameter for 4-address station interface
wifi: ath12k: Add support for 4-address mode
wifi: ath12k: Add 4-address mode support for eth offload
wifi: ath12k: Add support for 4-address NULL frame handling
wifi: ath12k: Add support for 4-address frame notification
wifi: ath12k: Handle 4-address EAPOL frames from WBM error path
wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
wifi: mac80211: Add multicast to unicast support for 802.3 path
wifi: mac80211: Add 802.3 multicast encapsulation offload support
Thiyagarajan Pandiyan (1):
wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
Tristan Madani (5):
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
wifi: rtw89: add bounds check on firmware mac_id in link lookup
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
wifi: wcn36xx: fix OOB read from short trigger BA firmware response
Wei Zhang (3):
wifi: ath11k: raise max vdevs to 4 on hardware with P2P and dual-station support
wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
wifi: ath12k: fix NULL deref in change_sta_links for unready link
Wen Gong (1):
wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is reported
Zenm Chen (1):
wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
Zong-Zhe Yang (10):
wifi: rtw89: 8852bt: configure support_noise field explicitly
wifi: rtw89: chan: introduce new helper to get entity current configuration
wifi: rtw89: 8922d: update RF calibration flow for MLD
wifi: rtw89: debug: Wi-Fi 7 show count of SER L0 simulation
wifi: rtw89: debug: Wi-Fi 7 update simulation of SER L0/L1 by halt H2C command
wifi: rtw89: fw: dump status of H2C command and C2H event for SER
wifi: rtw89: fw: load TX power track element according to AID
wifi: rtw89: Wi-Fi 7 configure TX power limit for large MRU
wifi: rtw89: debug: show large MRU in txpwr_table dbgfs
wifi: rtw89: 8922d: configure TX shape settings
傅继晗 (1):
wifi: mac80211: fix monitor mode frame capture for real chanctx drivers
.../ABI/testing/sysfs-class-ieee80211-rtw89 | 24 +
drivers/net/wireless/ath/ath10k/bmi.c | 1 -
drivers/net/wireless/ath/ath10k/ce.c | 1 -
drivers/net/wireless/ath/ath10k/coredump.c | 1 -
drivers/net/wireless/ath/ath10k/coredump.h | 2 +-
drivers/net/wireless/ath/ath10k/debug.c | 1 -
drivers/net/wireless/ath/ath10k/debugfs_sta.c | 1 -
drivers/net/wireless/ath/ath10k/htc.c | 1 -
drivers/net/wireless/ath/ath10k/htt.c | 2 +-
drivers/net/wireless/ath/ath10k/htt.h | 2 +-
drivers/net/wireless/ath/ath10k/htt_rx.c | 1 -
drivers/net/wireless/ath/ath10k/htt_tx.c | 1 -
drivers/net/wireless/ath/ath10k/hw.c | 2 +-
drivers/net/wireless/ath/ath10k/hw.h | 2 +-
drivers/net/wireless/ath/ath10k/pci.c | 1 -
drivers/net/wireless/ath/ath10k/pci.h | 2 +-
drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.c | 2 +-
drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h | 2 +-
drivers/net/wireless/ath/ath10k/rx_desc.h | 2 +-
drivers/net/wireless/ath/ath10k/sdio.c | 2 +-
drivers/net/wireless/ath/ath10k/thermal.c | 2 +-
drivers/net/wireless/ath/ath10k/usb.h | 2 +-
drivers/net/wireless/ath/ath10k/wmi-tlv.h | 2 +-
drivers/net/wireless/ath/ath10k/wow.c | 2 +-
drivers/net/wireless/ath/ath11k/ahb.c | 2 +-
drivers/net/wireless/ath/ath11k/ahb.h | 2 +-
drivers/net/wireless/ath/ath11k/ce.c | 1 -
drivers/net/wireless/ath/ath11k/ce.h | 2 +-
drivers/net/wireless/ath/ath11k/core.c | 10 +-
drivers/net/wireless/ath/ath11k/coredump.c | 1 -
drivers/net/wireless/ath/ath11k/coredump.h | 2 +-
drivers/net/wireless/ath/ath11k/debug.c | 1 -
drivers/net/wireless/ath/ath11k/debugfs.c | 1 -
drivers/net/wireless/ath/ath11k/debugfs.h | 2 +-
.../net/wireless/ath/ath11k/debugfs_htt_stats.c | 1 -
.../net/wireless/ath/ath11k/debugfs_htt_stats.h | 2 +-
drivers/net/wireless/ath/ath11k/debugfs_sta.h | 2 +-
drivers/net/wireless/ath/ath11k/dp.c | 1 -
drivers/net/wireless/ath/ath11k/dp.h | 2 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 59 +-
drivers/net/wireless/ath/ath11k/dp_rx.h | 2 +-
drivers/net/wireless/ath/ath11k/dp_tx.c | 1 -
drivers/net/wireless/ath/ath11k/dp_tx.h | 2 +-
drivers/net/wireless/ath/ath11k/fw.c | 1 -
drivers/net/wireless/ath/ath11k/fw.h | 2 +-
drivers/net/wireless/ath/ath11k/hal_desc.h | 2 +-
drivers/net/wireless/ath/ath11k/hal_rx.c | 2 +-
drivers/net/wireless/ath/ath11k/hal_rx.h | 2 +-
drivers/net/wireless/ath/ath11k/hal_tx.c | 2 +-
drivers/net/wireless/ath/ath11k/hal_tx.h | 2 +-
drivers/net/wireless/ath/ath11k/hif.h | 2 +-
drivers/net/wireless/ath/ath11k/htc.c | 2 +-
drivers/net/wireless/ath/ath11k/htc.h | 2 +-
drivers/net/wireless/ath/ath11k/hw.c | 2 +-
drivers/net/wireless/ath/ath11k/mac.c | 72 +-
drivers/net/wireless/ath/ath11k/mac.h | 2 +-
drivers/net/wireless/ath/ath11k/mhi.h | 2 +-
drivers/net/wireless/ath/ath11k/p2p.c | 2 +-
drivers/net/wireless/ath/ath11k/p2p.h | 2 +-
drivers/net/wireless/ath/ath11k/pcic.c | 1 -
drivers/net/wireless/ath/ath11k/pcic.h | 2 +-
drivers/net/wireless/ath/ath11k/peer.c | 2 +-
drivers/net/wireless/ath/ath11k/peer.h | 2 +-
drivers/net/wireless/ath/ath11k/qmi.h | 2 +-
drivers/net/wireless/ath/ath11k/reg.h | 2 +-
drivers/net/wireless/ath/ath11k/rx_desc.h | 2 +-
drivers/net/wireless/ath/ath11k/spectral.c | 1 -
drivers/net/wireless/ath/ath11k/spectral.h | 2 +-
drivers/net/wireless/ath/ath11k/testmode.c | 2 +-
drivers/net/wireless/ath/ath11k/testmode.h | 2 +-
drivers/net/wireless/ath/ath11k/thermal.c | 2 +-
drivers/net/wireless/ath/ath11k/thermal.h | 2 +-
drivers/net/wireless/ath/ath11k/trace.h | 2 +-
drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
drivers/net/wireless/ath/ath11k/wow.c | 2 +-
drivers/net/wireless/ath/ath11k/wow.h | 2 +-
drivers/net/wireless/ath/ath12k/acpi.c | 2 +-
drivers/net/wireless/ath/ath12k/acpi.h | 2 +-
drivers/net/wireless/ath/ath12k/core.h | 9 +
drivers/net/wireless/ath/ath12k/coredump.c | 2 +-
drivers/net/wireless/ath/ath12k/coredump.h | 2 +-
drivers/net/wireless/ath/ath12k/dbring.h | 2 +-
drivers/net/wireless/ath/ath12k/debug.h | 2 +-
drivers/net/wireless/ath/ath12k/debugfs.h | 2 +-
drivers/net/wireless/ath/ath12k/debugfs_sta.h | 2 +-
drivers/net/wireless/ath/ath12k/dp.c | 10 +-
drivers/net/wireless/ath/ath12k/dp_mon.c | 6 +-
drivers/net/wireless/ath/ath12k/dp_peer.c | 2 +-
drivers/net/wireless/ath/ath12k/dp_peer.h | 2 +
drivers/net/wireless/ath/ath12k/dp_rx.c | 13 +-
drivers/net/wireless/ath/ath12k/dp_rx.h | 3 +-
drivers/net/wireless/ath/ath12k/hal.h | 4 +-
drivers/net/wireless/ath/ath12k/hif.h | 2 +-
drivers/net/wireless/ath/ath12k/hw.h | 25 +-
drivers/net/wireless/ath/ath12k/mac.c | 232 ++++-
drivers/net/wireless/ath/ath12k/mac.h | 3 +
drivers/net/wireless/ath/ath12k/p2p.c | 1 -
drivers/net/wireless/ath/ath12k/p2p.h | 2 +-
drivers/net/wireless/ath/ath12k/peer.c | 11 +-
drivers/net/wireless/ath/ath12k/reg.c | 2 +-
drivers/net/wireless/ath/ath12k/reg.h | 2 +-
drivers/net/wireless/ath/ath12k/testmode.h | 2 +-
drivers/net/wireless/ath/ath12k/trace.c | 2 +-
drivers/net/wireless/ath/ath12k/trace.h | 2 +-
drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c | 3 +-
drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 95 ++-
drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | 43 +-
drivers/net/wireless/ath/ath12k/wifi7/dp_tx.h | 4 +-
.../net/wireless/ath/ath12k/wifi7/hal_qcc2072.c | 16 +
.../net/wireless/ath/ath12k/wifi7/hal_qcn9274.c | 16 +
drivers/net/wireless/ath/ath12k/wifi7/hal_tx.c | 4 +-
drivers/net/wireless/ath/ath12k/wifi7/hal_tx.h | 1 +
.../net/wireless/ath/ath12k/wifi7/hal_wcn7850.c | 16 +
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 48 +-
drivers/net/wireless/ath/ath12k/wmi.c | 47 +-
drivers/net/wireless/ath/ath12k/wmi.h | 17 +
drivers/net/wireless/ath/ath12k/wow.h | 2 +-
drivers/net/wireless/ath/ath5k/base.c | 2 -
drivers/net/wireless/ath/ath9k/ar9002_mac.c | 15 +-
drivers/net/wireless/ath/ath9k/ar9003_mac.c | 23 +-
drivers/net/wireless/ath/ath9k/ar9003_phy.c | 4 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 24 +-
drivers/net/wireless/ath/ath9k/hif_usb.h | 4 +-
drivers/net/wireless/ath/ath9k/htc_drv_init.c | 18 -
drivers/net/wireless/ath/ath9k/hw.c | 16 +-
drivers/net/wireless/ath/ath9k/hw.h | 2 -
drivers/net/wireless/ath/ath9k/init.c | 1 -
drivers/net/wireless/ath/testmode_i.h | 2 +-
drivers/net/wireless/ath/wcn36xx/dxe.c | 4 +-
drivers/net/wireless/ath/wcn36xx/main.c | 13 +-
drivers/net/wireless/ath/wcn36xx/smd.c | 13 +
drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 2 +-
drivers/net/wireless/broadcom/b43/main.c | 22 +-
drivers/net/wireless/broadcom/b43/radio_2057.c | 230 ++++-
drivers/net/wireless/broadcom/b43/tables_nphy.c | 58 ++
.../broadcom/brcm80211/brcmfmac/flowring.c | 10 +-
.../broadcom/brcm80211/brcmfmac/flowring.h | 2 +-
.../wireless/broadcom/brcm80211/brcmsmac/main.c | 40 +-
.../wireless/broadcom/brcm80211/brcmsmac/main.h | 2 +-
drivers/net/wireless/intel/iwlwifi/cfg/bz.c | 16 +-
drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 4 +-
drivers/net/wireless/intel/iwlwifi/cfg/rf-fm.c | 12 -
drivers/net/wireless/intel/iwlwifi/cfg/rf-gf.c | 3 +-
drivers/net/wireless/intel/iwlwifi/cfg/sc.c | 4 +-
.../net/wireless/intel/iwlwifi/fw/api/commands.h | 4 +-
drivers/net/wireless/intel/iwlwifi/fw/api/config.h | 11 +-
.../net/wireless/intel/iwlwifi/fw/api/datapath.h | 2 +-
drivers/net/wireless/intel/iwlwifi/fw/api/debug.h | 16 +-
drivers/net/wireless/intel/iwlwifi/fw/api/rs.h | 34 +-
drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 96 +--
drivers/net/wireless/intel/iwlwifi/fw/file.h | 1 +
drivers/net/wireless/intel/iwlwifi/fw/img.h | 1 +
drivers/net/wireless/intel/iwlwifi/fw/rs.c | 27 -
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 6 +-
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 6 +
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 10 +-
drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 3 +-
drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 5 +
drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 15 +
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 7 +-
drivers/net/wireless/intel/iwlwifi/mld/link.c | 15 +-
drivers/net/wireless/intel/iwlwifi/mld/link.h | 6 +
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 9 +-
drivers/net/wireless/intel/iwlwifi/mld/nan.c | 3 +-
drivers/net/wireless/intel/iwlwifi/mld/scan.c | 8 +-
drivers/net/wireless/intel/iwlwifi/mld/sta.c | 6 +
.../intel/iwlwifi/mld/tests/link-selection.c | 282 ++++++-
.../net/wireless/intel/iwlwifi/mld/tests/link.c | 474 ++++++++++-
.../net/wireless/intel/iwlwifi/mld/tests/utils.c | 60 ++
.../net/wireless/intel/iwlwifi/mld/tests/utils.h | 9 +-
drivers/net/wireless/intel/iwlwifi/mld/tlc.c | 78 +-
drivers/net/wireless/intel/iwlwifi/mld/tx.c | 3 +-
drivers/net/wireless/intel/iwlwifi/mvm/binding.c | 5 +-
drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 6 +-
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 12 +-
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 26 +-
.../net/wireless/intel/iwlwifi/mvm/time-event.c | 3 +-
drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 10 +-
drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 32 +-
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 3 +-
.../wireless/intel/iwlwifi/pcie/gen1_2/internal.h | 1 +
.../intel/iwlwifi/pcie/gen1_2/trans-gen2.c | 12 +-
.../net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c | 7 +-
drivers/net/wireless/mediatek/mt76/channel.c | 2 +-
drivers/net/wireless/mediatek/mt76/eeprom.c | 2 +-
drivers/net/wireless/mediatek/mt76/mac80211.c | 19 +-
drivers/net/wireless/mediatek/mt76/mt76.h | 1 +
.../net/wireless/mediatek/mt76/mt7615/debugfs.c | 2 -
drivers/net/wireless/mediatek/mt76/mt7615/init.c | 1 -
drivers/net/wireless/mediatek/mt76/mt7615/usb.c | 3 -
drivers/net/wireless/mediatek/mt76/mt76_connac.h | 21 +-
.../net/wireless/mediatek/mt76/mt76_connac_mac.c | 13 +-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 49 +-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 29 +-
drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 3 -
drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 5 +-
.../net/wireless/mediatek/mt76/mt7915/debugfs.c | 3 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt7915/main.c | 3 +
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 8 +
drivers/net/wireless/mediatek/mt76/mt7921/Makefile | 2 +-
.../net/wireless/mediatek/mt76/mt7921/debugfs.c | 2 -
drivers/net/wireless/mediatek/mt76/mt7921/init.c | 98 +--
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 29 +-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 1 -
drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 20 +-
drivers/net/wireless/mediatek/mt76/mt7921/regd.c | 206 +++++
drivers/net/wireless/mediatek/mt76/mt7921/regd.h | 19 +
drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 11 +-
.../net/wireless/mediatek/mt76/mt7925/debugfs.c | 2 -
drivers/net/wireless/mediatek/mt76/mt7925/init.c | 12 +-
drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 29 +-
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 101 ++-
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 116 ++-
drivers/net/wireless/mediatek/mt76/mt7925/mcu.h | 3 +-
drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h | 29 +-
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 151 +++-
.../net/wireless/mediatek/mt76/mt7925/pci_mac.c | 12 +-
.../net/wireless/mediatek/mt76/mt7925/testmode.c | 5 +
drivers/net/wireless/mediatek/mt76/mt7925/usb.c | 22 +-
drivers/net/wireless/mediatek/mt76/mt792x.h | 33 +
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 56 +-
drivers/net/wireless/mediatek/mt76/mt792x_dma.c | 198 ++++-
drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 23 +
drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 79 +-
.../net/wireless/mediatek/mt76/mt7996/debugfs.c | 6 +-
drivers/net/wireless/mediatek/mt76/mt7996/dma.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 51 +-
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 29 +-
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 36 +-
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 22 +-
drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
drivers/net/wireless/mediatek/mt76/pci.c | 8 +-
drivers/net/wireless/mediatek/mt76/tx.c | 2 +-
drivers/net/wireless/mediatek/mt76/usb.c | 2 +
drivers/net/wireless/mediatek/mt7601u/usb.c | 3 -
.../wireless/quantenna/qtnfmac/pcie/topaz_pcie.c | 6 +-
drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8192c.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8192e.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8192f.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8710b.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8723a.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/8723b.c | 1 +
drivers/net/wireless/realtek/rtl8xxxu/core.c | 77 +-
drivers/net/wireless/realtek/rtl8xxxu/regs.h | 2 +
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 7 +
drivers/net/wireless/realtek/rtlwifi/base.c | 17 +-
drivers/net/wireless/realtek/rtlwifi/pci.c | 7 +-
.../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 21 +-
.../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +-
drivers/net/wireless/realtek/rtw88/fw.c | 3 +
drivers/net/wireless/realtek/rtw88/pci.c | 29 +-
drivers/net/wireless/realtek/rtw88/rx.c | 31 +-
drivers/net/wireless/realtek/rtw88/rx.h | 6 +-
drivers/net/wireless/realtek/rtw88/sdio.c | 8 +-
drivers/net/wireless/realtek/rtw88/tx.c | 25 +-
drivers/net/wireless/realtek/rtw88/usb.c | 22 +-
drivers/net/wireless/realtek/rtw89/Kconfig | 12 +
drivers/net/wireless/realtek/rtw89/Makefile | 3 +
drivers/net/wireless/realtek/rtw89/chan.c | 92 +-
drivers/net/wireless/realtek/rtw89/chan.h | 21 +-
drivers/net/wireless/realtek/rtw89/core.c | 815 ++++++++++++++++--
drivers/net/wireless/realtek/rtw89/core.h | 347 +++++++-
drivers/net/wireless/realtek/rtw89/debug.c | 940 +++++++++++++++++----
drivers/net/wireless/realtek/rtw89/fw.c | 500 ++++++++++-
drivers/net/wireless/realtek/rtw89/fw.h | 115 ++-
drivers/net/wireless/realtek/rtw89/mac.c | 153 +++-
drivers/net/wireless/realtek/rtw89/mac.h | 52 +-
drivers/net/wireless/realtek/rtw89/mac80211.c | 29 +-
drivers/net/wireless/realtek/rtw89/mac_be.c | 68 +-
drivers/net/wireless/realtek/rtw89/pci.c | 41 +-
drivers/net/wireless/realtek/rtw89/pci.h | 6 +-
drivers/net/wireless/realtek/rtw89/pci_be.c | 15 +
drivers/net/wireless/realtek/rtw89/phy.c | 622 +++++++++++++-
drivers/net/wireless/realtek/rtw89/phy.h | 164 +++-
drivers/net/wireless/realtek/rtw89/phy_be.c | 724 ++++++++++++----
drivers/net/wireless/realtek/rtw89/ps.c | 6 +
drivers/net/wireless/realtek/rtw89/reg.h | 289 +++++++
drivers/net/wireless/realtek/rtw89/regd.c | 24 +
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 58 +-
drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8851bu.c | 4 +
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 63 +-
drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852au.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 58 +-
drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852bt.c | 58 +-
drivers/net/wireless/realtek/rtw89/rtw8852bt_rfk.c | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8852bte.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 68 +-
drivers/net/wireless/realtek/rtw89/rtw8852c.h | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852cu.c | 13 +
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 335 +++++++-
drivers/net/wireless/realtek/rtw89/rtw8922a_rfk.c | 22 +-
drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 2 +
drivers/net/wireless/realtek/rtw89/rtw8922au.c | 86 ++
drivers/net/wireless/realtek/rtw89/rtw8922d.c | 445 +++++++++-
drivers/net/wireless/realtek/rtw89/rtw8922d_rfk.c | 92 +-
drivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h | 1 +
drivers/net/wireless/realtek/rtw89/rtw8922de.c | 2 +
drivers/net/wireless/realtek/rtw89/sar.c | 4 +
drivers/net/wireless/realtek/rtw89/txrx.h | 110 +++
drivers/net/wireless/realtek/rtw89/usb.c | 199 ++++-
drivers/net/wireless/realtek/rtw89/usb.h | 11 +-
drivers/net/wireless/ti/wlcore/main.c | 23 +-
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 30 +-
include/linux/ieee80211-eht.h | 34 +-
include/linux/ieee80211-mesh.h | 212 +++++
include/linux/ieee80211-s1g.h | 2 +-
include/linux/ieee80211-uhr.h | 201 ++++-
include/linux/ieee80211.h | 17 +
include/net/cfg80211.h | 4 +-
include/net/mac80211.h | 5 +
net/mac80211/agg-rx.c | 22 +-
net/mac80211/ap.c | 146 ++++
net/mac80211/cfg.c | 37 +-
net/mac80211/chan.c | 4 +-
net/mac80211/he.c | 25 +-
net/mac80211/ht.c | 24 +-
net/mac80211/ibss.c | 31 +-
net/mac80211/ieee80211_i.h | 26 +-
net/mac80211/iface.c | 6 +
net/mac80211/link.c | 30 +
net/mac80211/mesh.c | 36 +-
net/mac80211/mesh_hwmp.c | 176 ++--
net/mac80211/mesh_plink.c | 2 -
net/mac80211/mlme.c | 567 +++++++++++--
net/mac80211/offchannel.c | 4 +-
net/mac80211/parse.c | 68 +-
net/mac80211/rate.c | 8 +-
net/mac80211/rx.c | 45 +-
net/mac80211/spectmgmt.c | 10 -
net/mac80211/sta_info.c | 61 +-
net/mac80211/sta_info.h | 35 +-
net/mac80211/status.c | 25 +
net/mac80211/tests/chan-mode.c | 4 +-
net/mac80211/tests/elems.c | 282 +++++++
net/mac80211/tx.c | 111 ++-
net/mac80211/util.c | 7 -
net/rfkill/core.c | 6 +-
net/wireless/chan.c | 33 +-
net/wireless/core.c | 4 +-
net/wireless/nl80211.c | 16 +-
net/wireless/scan.c | 6 +-
net/wireless/util.c | 3 -
353 files changed, 11533 insertions(+), 2253 deletions(-)
create mode 100644 Documentation/ABI/testing/sysfs-class-ieee80211-rtw89
create mode 100644 drivers/net/wireless/mediatek/mt76/mt7921/regd.c
create mode 100644 drivers/net/wireless/mediatek/mt76/mt7921/regd.h
create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8922au.c
^ permalink raw reply
* Re: [PATCH v8 2/3] PCI: Add device-specific reset for Qualcomm devices
From: Jose Ignacio Tornos Martinez @ 2026-06-10 10:00 UTC (permalink / raw)
To: alex
Cc: ath11k, ath12k, bhelgaas, jjohnson, jtornosm, linux-kernel,
linux-pci, linux-wireless, mani, mhi
In-Reply-To: <20260609115352.32acb6fe@shazbot.org>
Hi Alex,
> My only complaint is that this is positioned a bit generically...
Ok, I'll make the comment of the function more specific for these Qualcomm
devices.
> Has each of these devices been tested on a platform where D3cold is
> actually achieved through this method?
No, I don't have access to platforms with _PR3 support. All testing was on
M.2 adapters (D3hot fallback only). Since D3hot works reliably and D3cold
is a stronger reset mechanism, the approach should work - but I cannot
confirm the D3cold path through testing.
I'll send v9 with the updated comment.
Thanks,
Jose Ignacio
^ permalink raw reply
* [PATCH] wifi: ath6kl: fix invalid workqueue flags in ath6kl_usb_create()
From: wuyankun @ 2026-06-10 9:22 UTC (permalink / raw)
To: linux-wireless
Cc: jeff.johnson, johan, kees, wuyankun, sumanth.gavini, linux-kernel,
syzkaller-bugs, syzbot+f80c62f371ba6a1e7d79, stable
ath6kl_usb_create() currently creates ath6kl_wq with flags set to 0:
alloc_workqueue("ath6kl_wq", 0, 0)
This triggers a runtime warning in __alloc_workqueue() because the queue is
created with neither WQ_PERCPU nor WQ_UNBOUND set:
workqueue: ath6kl_wq is using neither WQ_PERCPU or WQ_UNBOUND.
Setting WQ_PERCPU.
Set WQ_PERCPU explicitly to match the actual execution model and remove the
warning during device probe. No functional change intended.
Fixes: 62ebaf2f9261 ("ath6kl: avoid flush_scheduled_work() usage")
Reported-by: syzbot+f80c62f371ba6a1e7d79@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a289c01.39669fcc.33b062.00aa.GAE@google.com/T/
Cc: stable@vger.kernel.org
Signed-off-by: wuyankun <wuyankun@uniontech.com>
---
drivers/net/wireless/ath/ath6kl/usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 79c18f5ee02b..945984c3dbe6 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -636,7 +636,7 @@ static struct ath6kl_usb *ath6kl_usb_create(struct usb_interface *interface)
ar_usb = kzalloc_obj(struct ath6kl_usb);
if (ar_usb == NULL)
return NULL;
- ar_usb->wq = alloc_workqueue("ath6kl_wq", 0, 0);
+ ar_usb->wq = alloc_workqueue("ath6kl_wq", WQ_PERCPU, 0);
if (!ar_usb->wq) {
kfree(ar_usb);
return NULL;
--
2.20.1
^ permalink raw reply related
* [stable request] mt7921e: backport two mt76 fixes to 6.12.y
From: Ajrat Makhmutov @ 2026-06-10 8:09 UTC (permalink / raw)
To: stable
Cc: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Shayne Chen,
Sean Wang, linux-wireless
Hi,
Please consider backporting the following two upstream commits to the
6.12.y stable tree. Both are in Linus' tree and both cherry-pick cleanly
onto 6.12.y:
2425dc7beaadc ("wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain")
5ed54896b6bd4 ("wifi: mt76: mt7921: fix a potential scan no APs")
Together they fix a hard-to-reproduce MT7921e (MT7921 PCIe) lockup we have
been tracking on ALT Linux: after a disconnect (signal loss / AP deauth) or
repeated reconnects the chip ends up in a wrong firmware state and stops
scanning/associating to any network, recoverable only by a chip reset or a
module reload. The symptom is reproducible on 6.12.y and gone on 7.1. We
could not bisect the symptom to a single upstream commit, but these two are
the relevant fixes on the mt7921e path:
- 5ed54896b6bd4 aborts the granted ROC channel before station removal, so
the firmware is not left in a wrong state that makes subsequent scans
return no APs.
- 2425dc7beaadc stops a connected AP's country IE from re-triggering
regulatory/CLC reprogramming once the user has already set a regdomain,
which we observed leaving the firmware power/regulatory tables in a bad
state.
Neither commit carries a Cc: stable tag, which is why they were not picked
up automatically.
Both have been tested on real MT7921e hardware (Acer Aspire 5 A517-52,
ASUS VivoBook S14, Lenovo IdeaPad Slim 5 14AHP9) running the 6.12 kernel.
BugLink: https://bugzilla.altlinux.org/54853
Thanks,
Ajrat Makhmutov
^ permalink raw reply
* Re: [PATCH v2 4/7] dt-bindings: bluetooth: qcom,wcn6855-bt: document WCN6851
From: Krzysztof Kozlowski @ 2026-06-10 7:41 UTC (permalink / raw)
To: Dmitry Baryshkov
Cc: Manivannan Sadhasivam, Lorenzo Pieralisi,
Krzysztof Wilczyński, Rob Herring, Bjorn Helgaas,
Konrad Dybcio, Qiang Yu, Jeff Johnson, Liam Girdwood, Mark Brown,
Krzysztof Kozlowski, Conor Dooley, Bartosz Golaszewski,
Marcel Holtmann, Luiz Augusto von Dentz, Balakrishna Godavarthi,
Rocky Liao, Bjorn Andersson, Konrad Dybcio, linux-arm-msm,
linux-pci, linux-kernel, linux-wireless, ath11k, devicetree,
Bartosz Golaszewski, linux-bluetooth, Bartosz Golaszewski
In-Reply-To: <20260608-sm8350-wifi-v2-4-efb68f1ff04c@oss.qualcomm.com>
On Mon, Jun 08, 2026 at 09:59:22AM +0300, Dmitry Baryshkov wrote:
> WCN6851 is an earlier version of WCN6855 WiFi/BT chip, compatible with
> it. Add a device-specific compat string with the fallback to WCN6855
> one.
>
> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> ---
> .../devicetree/bindings/net/bluetooth/qcom,wcn6855-bt.yaml | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH v4 2/8] dt-bindings: net: wireless: qcom,ath10k: Document NVMEM cells
From: Krzysztof Kozlowski @ 2026-06-10 7:16 UTC (permalink / raw)
To: Loic Poulain
Cc: Ulf Hansson, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, Jens Axboe, Johannes Berg,
Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Srinivas Kandagatla, Andrew Lunn, Heiner Kallweit,
Russell King, Saravana Kannan, linux-mmc, devicetree,
linux-kernel, linux-arm-msm, linux-block, linux-wireless, ath10k,
linux-bluetooth, netdev, daniel, Bartosz Golaszewski
In-Reply-To: <20260609-block-as-nvmem-v4-2-45712e6b22c6@oss.qualcomm.com>
On Tue, Jun 09, 2026 at 09:52:27AM +0200, Loic Poulain wrote:
> Document the NVMEM cells supported by the ath10k driver, the
> mac-address, pre-calibration data, and calibration data.
>
> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
> .../devicetree/bindings/net/wireless/qcom,ath10k.yaml | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml
> index c21d66c7cd558ab792524be9afec8b79272d1c87..7391df5e7071e626af4c64b9919d48c41ac09f1e 100644
> --- a/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml
> +++ b/Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml
> @@ -92,6 +92,22 @@ properties:
>
> ieee80211-freq-limit: true
>
> + nvmem-cells:
> + minItems: 1
> + maxItems: 3
> + description: |
If there is going to be resend:
Do not need '|' unless you need to preserve formatting.
> + References to nvmem cells for MAC address and/or calibration data.
> + Supported cell names are mac-address, calibration, and pre-calibration.
> +
> + nvmem-cell-names:
> + minItems: 1
> + maxItems: 3
> + items:
> + enum:
> + - mac-address
> + - calibration
> + - pre-calibration
This means you expect random order with variable number of items. Is
that intentional? If yes, please provide short explanation in the commit
msg.
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH wireless-next v4 3/4] wifi: mac80211: implement STA-mode peer probing
From: Johannes Berg @ 2026-06-10 6:57 UTC (permalink / raw)
To: Priyansha Tiwari; +Cc: linux-wireless, quic_drohan, veerendranath.jakkam
In-Reply-To: <20260608090727.2389161-4-pritiwa@qti.qualcomm.com>
Hi,
> + const u8 *peer_addr;
That seems vaguely confusing when we already have "peer", maybe you
should call this dst_addr to go with src_addr.
> /* the lock is needed to assign the cookie later */
> lockdep_assert_wiphy(local->hw.wiphy);
>
> - rcu_read_lock();
> - sta = sta_info_get_bss(sdata, peer);
> - if (!sta) {
> - ret = -ENOLINK;
> - goto unlock;
> - }
> -
> - qos = sta->sta.wme;
> -
> - if (ieee80211_vif_is_mld(&sdata->vif)) {
> - if (sta->sta.mlo) {
> - link_id = IEEE80211_LINK_UNSPECIFIED;
> - } else {
> - /*
> - * For non-MLO clients connected to an AP MLD, band
> - * information is not used; instead, sta->deflink is
> - * used to send packets.
> - */
> - link_id = sta->deflink.link_id;
> + switch (sdata->vif.type) {
> + case NL80211_IFTYPE_AP:
> + case NL80211_IFTYPE_P2P_GO:
> + sta = sta_info_get_bss(sdata, peer);
> + if (!sta)
> + return -ENOLINK;
I don't really understand why you move a bunch of the per-STA handling
into the switch?
> + qos = sta->sta.wme;
This is definitely in all the branches, and must be there. Why not pull
it out?
> + fromds = true;
> + break;
> +
> + case NL80211_IFTYPE_STATION:
(nit: spurious blank line)
> + case NL80211_IFTYPE_P2P_CLIENT:
Both of the P2P cases aren't needed here and are just confusing.
> + link_id = IEEE80211_LINK_UNSPECIFIED;
> + peer_addr = sdata->vif.cfg.ap_addr;
> + src_addr = sdata->vif.addr;
> + if (!ieee80211_vif_is_mld(&sdata->vif)) {
> + chanctx_conf = wiphy_dereference(local->hw.wiphy,
> + sdata->vif.bss_conf.chanctx_conf);
> + if (WARN_ON(!chanctx_conf))
> + return -EINVAL;
(that WARN_ON could perhaps be triggered since you didn't check for the
STA first?)
> + band = chanctx_conf->def.chan->band;
> + } else {
> + band = 0;
> }
> - band = chanctx_conf->def.chan->band;
> - link_id = 0;
> + sta = sta_info_get(sdata, peer_addr);
> + if (!sta)
> + return -ENOLINK;
> + qos = sta->sta.wme;
At the very least you could pull out 'qos = sta->sta.wme', but I wonder
if you could pull out more of the sta lookup too by just saying
if (vif.type == NL80211_IFTYPE_STATION)
peer = sdata->vif.cfg.ap_addr;
and then leaving more of the current behaviour intact. Even the MLO link
thing could be left since it won't actually be able to be used since the
AP will be MLO/non-MLO with the vif, unlike in AP mode.
IOW, it feels like with that you should get away with far less
difference between AP and client, perhaps no other than this and the DS
bits.
johannes
^ permalink raw reply
* Re: [PATCH wireless-next v2 06/31] wifi: mm81x: add core.h
From: Johannes Berg @ 2026-06-10 6:22 UTC (permalink / raw)
To: Lachlan Hodges
Cc: Dan Callaghan, Arien Judge, ayman.grais, linux-wireless,
linux-kernel
In-Reply-To: <iqcuzdgftpv2zymapftokqycuvqoelef6zbhm2eufki3345mqw@rut3iurehpet>
On Wed, 2026-06-10 at 15:06 +1000, Lachlan Hodges wrote:
> On Thu, Jun 04, 2026 at 01:40:09PM +0200, Johannes Berg wrote:
> > On Thu, 2026-04-30 at 14:55 +1000, Lachlan Hodges wrote:
> > >
> > > +#define KHZ_TO_HZ(x) ((x) * 1000)
> > > +#define KHZ100_TO_MHZ(x) ((x) / 10)
> > > +#define KHZ100_TO_KHZ(freq) ((freq) * 100)
> > > +#define KHZ100_TO_HZ(freq) ((freq) * 100000)
> >
> > Maybe not right now, but at least the first one seems fairly generic and
> > could be elsewhere.
>
> There is a function:
>
> static int mm81x_tx_h_get_prim_bw(struct cfg80211_chan_def *chandef)
> {
> return chandef->s1g_primary_2mhz ? 2 : 1;
> }
>
> which should definitely be in the cfg80211 since its a generic chandef
> helper and will probably be needed at somepoint in mac/cfg in the future.
> I can probably just have it as a patch prior similar to the SDIO id
> as part of v3. Then I guess I can also do the same for the helpers above
> and place them alongside:
>
> /* convert frequencies */
> #define MHZ_TO_KHZ(freq) ((freq) * 1000)
> #define KHZ_TO_MHZ(freq) ((freq) / 1000)
> #define PR_KHZ(f) KHZ_TO_MHZ(f), f % 1000
> #define KHZ_F "%d.%03d"
>
> Unless you have some other preference :)
>
That seems reasonable.
I guess eventually a case could be made for moving a bunch of things to
units.h, but it seems to just define the numbers not macros to convert.
Or maybe that means we should open-code, instead of MHZ_TO_KHZ(v) we
could have "v * KHZ_PER_MHZ", which is really just one character longer
anyway (though might need extra parentheses)?
Anyway no strong feelings about any of that, not really even in the
driver though that seems a bit odd (hence my comment.)
johannes
^ permalink raw reply
* Re: [ath-current] wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
From: Baochen Qiang @ 2026-06-10 6:12 UTC (permalink / raw)
To: Gaole Zhang, ath11k, linux-wireless; +Cc: miaoqing.pan, hangtian.zhu
In-Reply-To: <20260609090609.4041009-1-gaole.zhang@oss.qualcomm.com>
On 6/9/2026 5:06 PM, Gaole Zhang wrote:
> In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set
> unconditionally even when ath11k_core_qmi_firmware_ready() fails.
> This leaves the driver in an inconsistent state where
> initialization is considered complete although the firmware ready
> handling did not finish successfully. During the subsequent SSR,
> the driver enters the restart path based on this incorrect state
> and dereferences uninitialized srng members, resulting in a NULL
> pointer dereference.
>
> Call trace:
> ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P)
> ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k]
> ath11k_core_restart+0x40/0x168 [ath11k]
>
> Fix this by:
> - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set
> - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds
> - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling
> on error
>
> Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
>
> Fixes: 6fe62a8cec51c ("wifi: ath11k: Add cold boot calibration support on WCN6750")
> Signed-off-by: Gaole Zhang <gaole.zhang@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply
* Re: [ath-current] wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
From: Rameshkumar Sundaram @ 2026-06-10 5:46 UTC (permalink / raw)
To: Gaole Zhang, ath11k, linux-wireless; +Cc: miaoqing.pan, hangtian.zhu
In-Reply-To: <20260609090609.4041009-1-gaole.zhang@oss.qualcomm.com>
On 6/9/2026 2:36 PM, Gaole Zhang wrote:
> In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set
> unconditionally even when ath11k_core_qmi_firmware_ready() fails.
> This leaves the driver in an inconsistent state where
> initialization is considered complete although the firmware ready
> handling did not finish successfully. During the subsequent SSR,
> the driver enters the restart path based on this incorrect state
> and dereferences uninitialized srng members, resulting in a NULL
> pointer dereference.
>
> Call trace:
> ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P)
> ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k]
> ath11k_core_restart+0x40/0x168 [ath11k]
>
> Fix this by:
> - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set
> - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds
> - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling
> on error
>
> Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
>
> Fixes: 6fe62a8cec51c ("wifi: ath11k: Add cold boot calibration support on WCN6750")
> Signed-off-by: Gaole Zhang <gaole.zhang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
^ permalink raw reply
* [PATCH ath-current] wifi: ath12k: Fix low MLO RX throughput on WCN7850
From: Yingying Tang @ 2026-06-10 5:33 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, yintang, yingying.tang
Commit [1] introduced a regression causing severely degraded MLO RX
throughput on WCN7850.
On WCN7850, there is only a single ar instance, but MLO uses two
link IDs. ath12k_dp_peer->hw_links[] is indexed using ar->hw_link_id,
which causes both MLO link IDs to be stored at the same index.
As a result, an incorrect link ID is assigned to MSDUs in
ath12k_dp_rx_deliver_msdu(), leading to severe MLO RX throughput loss.
Different chipsets identify the per-MSDU link differently:
- On QCN9274 / IPQ5332, the host owns multiple ar instances and the
per-MSDU hw_link_id from the RX descriptor maps cleanly through
dp_peer->hw_links[hw_link_id] to the IEEE link_id.
- On single-ar chipsets like WCN7850 / QCC2072, there is only one ar
instance for both MLO links, so dp_peer->hw_links[] has just one
valid slot and cannot be used to distinguish the two links. To
resolve the link, walk dp_peer->link_peers[] and match by
rxcb->peer_id, which on the link_peer side identifies the link
peer for the MSDU.
Add a new hw_op set_rx_link_id() so each chipset resolves the link
on the RX fast path using whatever signal it actually has, and let
the op itself decide whether to populate rx_status::link_valid and
rx_status::link_id:
QCN9274 / IPQ5332 : always derive link_id from
dp_peer->hw_links[rxcb->hw_link_id] and set
link_valid.
WCN7850 / QCC2072 : walk the link_peers[] of dp_peer to find the
link_peer whose peer_id matches rxcb->peer_id,
and set link_valid only when a match is found.
Otherwise leave link_valid clear so that
mac80211 can fall back to its own link
resolution path (via addr2 / deflink).
For WCN7850 / QCC2072, walking dp_peer->link_peers[] is bounded by
the number of links actually populated, so introduce a link_peers_map
bitmap (unsigned long) in struct ath12k_dp_peer that tracks populated
slots and use for_each_set_bit() to iterate. Non-MLO clients hit one
slot, current MLO clients hit two; the full ATH12K_NUM_MAX_LINKS
array is never scanned. The bitmap is maintained with WRITE_ONCE() on
the write side (under dp_hw->peer_lock) paired with READ_ONCE() on
both the lockless RX read side and the write-side RMW for KCSAN
correctness.
Also guard the dp_peer dereference in ath12k_mac_peer_cleanup_all()
with a NULL check, since peer->dp_peer can be NULL for self-peers or
peers not yet fully assigned, the pre-existing rcu_assign_pointer()
call there had the same latent issue.
This restores the correct link ID on WCN7850 without changing the
QCN9274 / IPQ5332 data path, which keeps its O(1) hw_links[]
indexing.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Fixes: 11157e0910fd ("wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths") # [1]
Signed-off-by: Yingying Tang <yingying.tang@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp_peer.c | 4 +++
drivers/net/wireless/ath/ath12k/dp_peer.h | 1 +
drivers/net/wireless/ath/ath12k/dp_rx.c | 7 ++--
drivers/net/wireless/ath/ath12k/hw.h | 16 +++++++++
drivers/net/wireless/ath/ath12k/mac.c | 10 ++++--
drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c | 33 +++++++++++++++++++
drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h | 6 ++++
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 3 ++
8 files changed, 73 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_peer.c b/drivers/net/wireless/ath/ath12k/dp_peer.c
index a1100782d45e..f57f1483c3e4 100644
--- a/drivers/net/wireless/ath/ath12k/dp_peer.c
+++ b/drivers/net/wireless/ath/ath12k/dp_peer.c
@@ -570,6 +570,8 @@ int ath12k_dp_link_peer_assign(struct ath12k_dp *dp, struct ath12k_dp_hw *dp_hw,
peerid_index = ath12k_dp_peer_get_peerid_index(dp, peer->peer_id);
rcu_assign_pointer(dp_peer->link_peers[peer->link_id], peer);
+ WRITE_ONCE(dp_peer->link_peers_map,
+ READ_ONCE(dp_peer->link_peers_map) | BIT(peer->link_id));
rcu_assign_pointer(dp_hw->dp_peers[peerid_index], dp_peer);
@@ -632,6 +634,8 @@ void ath12k_dp_link_peer_unassign(struct ath12k_dp *dp, struct ath12k_dp_hw *dp_
peerid_index = ath12k_dp_peer_get_peerid_index(dp, peer->peer_id);
rcu_assign_pointer(dp_peer->link_peers[peer->link_id], NULL);
+ WRITE_ONCE(dp_peer->link_peers_map,
+ READ_ONCE(dp_peer->link_peers_map) & ~BIT(peer->link_id));
rcu_assign_pointer(dp_hw->dp_peers[peerid_index], NULL);
diff --git a/drivers/net/wireless/ath/ath12k/dp_peer.h b/drivers/net/wireless/ath/ath12k/dp_peer.h
index 113b8040010f..d4d2ff16e836 100644
--- a/drivers/net/wireless/ath/ath12k/dp_peer.h
+++ b/drivers/net/wireless/ath/ath12k/dp_peer.h
@@ -140,6 +140,7 @@ struct ath12k_dp_peer {
/* Info used in MMIC verification of * RX fragments */
struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
+ unsigned long link_peers_map;
struct ath12k_dp_link_peer __rcu *link_peers[ATH12K_NUM_MAX_LINKS];
struct ath12k_reoq_buf reoq_bufs[IEEE80211_NUM_TIDS + 1];
struct ath12k_dp_rx_tid rx_tid[IEEE80211_NUM_TIDS + 1];
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index b108ccd0f637..b5dba7c0155f 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -1344,10 +1344,9 @@ void ath12k_dp_rx_deliver_msdu(struct ath12k_pdev_dp *dp_pdev, struct napi_struc
pubsta = peer ? peer->sta : NULL;
- if (pubsta && pubsta->valid_links) {
- status->link_valid = 1;
- status->link_id = peer->hw_links[rxcb->hw_link_id];
- }
+ status->link_valid = 0;
+ if (pubsta && pubsta->valid_links)
+ ath12k_hw_set_rx_link_id(dp->hw_params, peer, rxcb, status);
ath12k_dbg(dp->ab, ATH12K_DBG_DATA,
"rx skb %p len %u peer %pM %d %s sn %u %s%s%s%s%s%s%s%s%s%s rate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n",
diff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h
index a9888e0521a1..da75d19ae1a0 100644
--- a/drivers/net/wireless/ath/ath12k/hw.h
+++ b/drivers/net/wireless/ath/ath12k/hw.h
@@ -13,6 +13,10 @@
#include "wmi.h"
#include "hal.h"
+struct ath12k_dp_peer;
+struct ath12k_skb_rxcb;
+struct ieee80211_rx_status;
+
/* Target configuration defines */
/* Num VDEVS per radio */
@@ -224,6 +228,9 @@ struct ath12k_hw_ops {
bool (*dp_srng_is_tx_comp_ring)(int ring_num);
bool (*is_frame_link_agnostic)(struct ath12k_link_vif *arvif,
struct ieee80211_mgmt *mgmt);
+ void (*set_rx_link_id)(struct ath12k_dp_peer *dp_peer,
+ struct ath12k_skb_rxcb *rxcb,
+ struct ieee80211_rx_status *status);
};
static inline
@@ -254,6 +261,15 @@ static inline int ath12k_hw_mac_id_to_srng_id(const struct ath12k_hw_params *hw,
return 0;
}
+static inline void ath12k_hw_set_rx_link_id(const struct ath12k_hw_params *hw,
+ struct ath12k_dp_peer *dp_peer,
+ struct ath12k_skb_rxcb *rxcb,
+ struct ieee80211_rx_status *status)
+{
+ if (hw->hw_ops->set_rx_link_id)
+ hw->hw_ops->set_rx_link_id(dp_peer, rxcb, status);
+}
+
struct ath12k_fw_ie {
__le32 id;
__le32 len;
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index df2334f3bad6..a7377bc7308b 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -1234,9 +1234,13 @@ void ath12k_mac_peer_cleanup_all(struct ath12k *ar)
/* cleanup dp peer */
spin_lock_bh(&dp_hw->peer_lock);
dp_peer = peer->dp_peer;
- peerid_index = ath12k_dp_peer_get_peerid_index(dp, peer->peer_id);
- rcu_assign_pointer(dp_peer->link_peers[peer->link_id], NULL);
- rcu_assign_pointer(dp_hw->dp_peers[peerid_index], NULL);
+ if (dp_peer) {
+ peerid_index = ath12k_dp_peer_get_peerid_index(dp, peer->peer_id);
+ rcu_assign_pointer(dp_peer->link_peers[peer->link_id], NULL);
+ WRITE_ONCE(dp_peer->link_peers_map,
+ READ_ONCE(dp_peer->link_peers_map) & ~BIT(peer->link_id));
+ rcu_assign_pointer(dp_hw->dp_peers[peerid_index], NULL);
+ }
spin_unlock_bh(&dp_hw->peer_lock);
ath12k_dp_link_peer_rhash_delete(dp, peer);
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
index 945680b3ebdf..2801a38cd1e7 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c
@@ -5,6 +5,7 @@
*/
#include "dp_rx.h"
+#include "../dp_peer.h"
#include "../dp_tx.h"
#include "../peer.h"
#include "hal_qcn9274.h"
@@ -2240,3 +2241,35 @@ ath12k_wifi7_dp_rxdesc_mpdu_valid(struct ath12k_base *ab,
return tlv_tag == HAL_RX_MPDU_START;
}
+
+void
+ath12k_wifi7_dp_rx_set_link_id_qcn9274(struct ath12k_dp_peer *dp_peer,
+ struct ath12k_skb_rxcb *rxcb,
+ struct ieee80211_rx_status *status)
+{
+ status->link_valid = 1;
+ status->link_id = dp_peer->hw_links[rxcb->hw_link_id];
+}
+
+void
+ath12k_wifi7_dp_rx_set_link_id_wcn7850(struct ath12k_dp_peer *dp_peer,
+ struct ath12k_skb_rxcb *rxcb,
+ struct ieee80211_rx_status *status)
+{
+ struct ath12k_dp_link_peer *link_peer;
+ unsigned long links_map;
+ int i;
+
+ RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
+ "ath12k set rx link id called without rcu lock");
+
+ links_map = READ_ONCE(dp_peer->link_peers_map);
+ for_each_set_bit(i, &links_map, ATH12K_NUM_MAX_LINKS) {
+ link_peer = rcu_dereference(dp_peer->link_peers[i]);
+ if (link_peer && link_peer->peer_id == rxcb->peer_id) {
+ status->link_valid = 1;
+ status->link_id = link_peer->link_id;
+ return;
+ }
+ }
+}
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h
index 8aa79faf567f..1d3a4788a2dd 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h
+++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h
@@ -57,4 +57,10 @@ ath12k_wifi7_dp_rxdesc_mpdu_valid(struct ath12k_base *ab,
struct hal_rx_desc *rx_desc);
int ath12k_wifi7_dp_rx_tid_delete_handler(struct ath12k_base *ab,
struct ath12k_dp_rx_tid_rxq *rx_tid);
+void ath12k_wifi7_dp_rx_set_link_id_qcn9274(struct ath12k_dp_peer *dp_peer,
+ struct ath12k_skb_rxcb *rxcb,
+ struct ieee80211_rx_status *status);
+void ath12k_wifi7_dp_rx_set_link_id_wcn7850(struct ath12k_dp_peer *dp_peer,
+ struct ath12k_skb_rxcb *rxcb,
+ struct ieee80211_rx_status *status);
#endif
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index cb3185850439..f687eb69ea8d 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -158,6 +158,7 @@ static const struct ath12k_hw_ops qcn9274_ops = {
.get_ring_selector = ath12k_wifi7_hw_get_ring_selector_qcn9274,
.dp_srng_is_tx_comp_ring = ath12k_wifi7_dp_srng_is_comp_ring_qcn9274,
.is_frame_link_agnostic = ath12k_wifi7_is_frame_link_agnostic_qcn9274,
+ .set_rx_link_id = ath12k_wifi7_dp_rx_set_link_id_qcn9274,
};
static const struct ath12k_hw_ops wcn7850_ops = {
@@ -168,6 +169,7 @@ static const struct ath12k_hw_ops wcn7850_ops = {
.get_ring_selector = ath12k_wifi7_hw_get_ring_selector_wcn7850,
.dp_srng_is_tx_comp_ring = ath12k_wifi7_dp_srng_is_comp_ring_wcn7850,
.is_frame_link_agnostic = ath12k_wifi7_is_frame_link_agnostic_wcn7850,
+ .set_rx_link_id = ath12k_wifi7_dp_rx_set_link_id_wcn7850,
};
static const struct ath12k_hw_ops qcc2072_ops = {
@@ -178,6 +180,7 @@ static const struct ath12k_hw_ops qcc2072_ops = {
.get_ring_selector = ath12k_wifi7_hw_get_ring_selector_wcn7850,
.dp_srng_is_tx_comp_ring = ath12k_wifi7_dp_srng_is_comp_ring_wcn7850,
.is_frame_link_agnostic = ath12k_wifi7_is_frame_link_agnostic_wcn7850,
+ .set_rx_link_id = ath12k_wifi7_dp_rx_set_link_id_wcn7850,
};
#define ATH12K_TX_RING_MASK_0 0x1
--
base-commit: 54a5b38e4396530e5b2f12b54d3844e860ab6784
^ permalink raw reply related
* Re: wlwifi: Aggressive LAR forces country 00 and disables 6GHz band on Intel chips
From: Владимир Пантелеев @ 2026-06-10 5:16 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <CAN6W26t_nEmWCyk-Mzp-1iHZ0P7HdV4VtSB51Bkn-JKFQkeuWw@mail.gmail.com>
[-- Attachment #1.1: Type: text/plain, Size: 3133 bytes --]
Hello,
Adding a visual layout bug I just found in the UI.
The system is deeply confused about the Wi-Fi 7 MLO connection state: it
displays the SSID name as "TP-Link_6G" but incorrectly reports the
frequency as 2.417 GHz (Channel 2).
This screenshot visually proves that the current Linux wireless stack is
completely misinterpreting the operational parameters of aggregated
MLO/6GHz states.
ср, 10 июн. 2026 г. в 10:13, Владимир Пантелеев <vovik181083@gmail.com>:
> Bug Report: Intel iwlwifi 6GHz (Wi-Fi 6E/7) regression under Linux (LAR &
> Aggressive Powersave issue)
>
> Environment:
> - OS: Arch Linux (Kernel 6.x / rolling)
> - Wireless Card: Intel Wi-Fi 6E/7 (iwlwifi driver)
> - Wireless Backend: NetworkManager with default wpa_supplicant / iwd
> - Router Setup: ASUS ROG GT-AX6000 (Main) + TP-Link Archer BE800 (AP Mode,
> Wi-Fi 7 MLO enabled on 6GHz)
>
> Description of the Issue:
> There is a severe performance and functionality regression when using
> Intel Wi-Fi cards on the 6GHz band under Linux, which does not occur on the
> exact same hardware under Windows 11. The problem consists of two distinct
> bugs:
>
> Bug 1: Aggressive LAR (Location Aware Regulatory) drops 6GHz band entirely
> By default, the iwlwifi driver locks the regulatory domain to country 00:
> DFS-UNSET, even in jurisdictions where the 6GHz band is officially
> permitted (e.g., Kazakhstan, KZ). The driver self-manages and forces the
> global 00 domain based on passive scans of legacy ambient access points.
> This completely filters out and blinds the system to any 6GHz (Wi-Fi 6E)
> and Multi-Link Operation (Wi-Fi 7 MLO) beacons, throwing Connection refused
> or hidden SSIDs. Switching the NM backend to iwd and manually forcing
> Country=KZ in /etc/iwd/main.conf partially restores the visibility, but it
> shouldn't require manual hacks.
>
> Bug 2: NetworkManager wifi.powersave chokes throughput over 6GHz HTTP
> streams
> When a connection to a 6GHz / MLO network is finally established, local
> network benchmarks over HTTP/WebSockets suffer from extreme performance
> degradation. Download speeds drop to an abysmal 15-21 Mbps, while Link
> Speed explicitly reports 1.729 Gbps. At the same time, Upload speed remains
> relatively high (~338 Mbps). The default NetworkManager power-saving
> mechanism (wifi.powersave = 3) fails to recognize high-throughput incoming
> aggregate traffic over 6GHz bands when initiated via browser engines.
> Forcing wifi.powersave = 2 inside NetworkManager config immediately fixes
> the issue, boosting the throughput back to a stable 600+ Mbps.
>
> Expected Behavior:
> The iwlwifi driver should natively honor local regulatory frameworks
> without falling back to a restrictive 00 profile that truncates 6GHz
> frequencies. NetworkManager's default power management must be optimized
> for the higher-frequency aggregation states of Wi-Fi 6E and Wi-Fi 7 to
> prevent false-positive low-power state transitions during active downloads.
>
> Attached is the full system debug log (network_bug_report.txt).
>
[-- Attachment #1.2: Type: text/html, Size: 3414 bytes --]
[-- Attachment #2: IMG_20260610_092056.jpg --]
[-- Type: image/jpeg, Size: 9075827 bytes --]
^ permalink raw reply
* wlwifi: Aggressive LAR forces country 00 and disables 6GHz band on Intel chips
From: Владимир Пантелеев @ 2026-06-10 5:13 UTC (permalink / raw)
To: linux-wireless
[-- Attachment #1.1: Type: text/plain, Size: 2487 bytes --]
Bug Report: Intel iwlwifi 6GHz (Wi-Fi 6E/7) regression under Linux (LAR &
Aggressive Powersave issue)
Environment:
- OS: Arch Linux (Kernel 6.x / rolling)
- Wireless Card: Intel Wi-Fi 6E/7 (iwlwifi driver)
- Wireless Backend: NetworkManager with default wpa_supplicant / iwd
- Router Setup: ASUS ROG GT-AX6000 (Main) + TP-Link Archer BE800 (AP Mode,
Wi-Fi 7 MLO enabled on 6GHz)
Description of the Issue:
There is a severe performance and functionality regression when using Intel
Wi-Fi cards on the 6GHz band under Linux, which does not occur on the exact
same hardware under Windows 11. The problem consists of two distinct bugs:
Bug 1: Aggressive LAR (Location Aware Regulatory) drops 6GHz band entirely
By default, the iwlwifi driver locks the regulatory domain to country 00:
DFS-UNSET, even in jurisdictions where the 6GHz band is officially
permitted (e.g., Kazakhstan, KZ). The driver self-manages and forces the
global 00 domain based on passive scans of legacy ambient access points.
This completely filters out and blinds the system to any 6GHz (Wi-Fi 6E)
and Multi-Link Operation (Wi-Fi 7 MLO) beacons, throwing Connection refused
or hidden SSIDs. Switching the NM backend to iwd and manually forcing
Country=KZ in /etc/iwd/main.conf partially restores the visibility, but it
shouldn't require manual hacks.
Bug 2: NetworkManager wifi.powersave chokes throughput over 6GHz HTTP
streams
When a connection to a 6GHz / MLO network is finally established, local
network benchmarks over HTTP/WebSockets suffer from extreme performance
degradation. Download speeds drop to an abysmal 15-21 Mbps, while Link
Speed explicitly reports 1.729 Gbps. At the same time, Upload speed remains
relatively high (~338 Mbps). The default NetworkManager power-saving
mechanism (wifi.powersave = 3) fails to recognize high-throughput incoming
aggregate traffic over 6GHz bands when initiated via browser engines.
Forcing wifi.powersave = 2 inside NetworkManager config immediately fixes
the issue, boosting the throughput back to a stable 600+ Mbps.
Expected Behavior:
The iwlwifi driver should natively honor local regulatory frameworks
without falling back to a restrictive 00 profile that truncates 6GHz
frequencies. NetworkManager's default power management must be optimized
for the higher-frequency aggregation states of Wi-Fi 6E and Wi-Fi 7 to
prevent false-positive low-power state transitions during active downloads.
Attached is the full system debug log (network_bug_report.txt).
[-- Attachment #1.2: Type: text/html, Size: 2585 bytes --]
[-- Attachment #2: network_bug_report.txt --]
[-- Type: text/plain, Size: 4484 bytes --]
=== IW REG GET ===
global
country KZ: DFS-ETSI
(2400 - 2483 @ 40), (N/A, 20), (N/A)
(5150 - 5250 @ 80), (N/A, 23), (N/A), NO-OUTDOOR, AUTO-BW
(5250 - 5350 @ 80), (N/A, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW
(5470 - 5725 @ 160), (N/A, 20), (0 ms), NO-OUTDOOR, DFS
(5725 - 5850 @ 80), (N/A, 20), (N/A), NO-OUTDOOR
(5925 - 6425 @ 320), (N/A, 23), (N/A), NO-OUTDOOR
(57000 - 66000 @ 2160), (N/A, 40), (N/A)
phy#0 (self-managed)
country GB: DFS-UNSET
(2402 - 2437 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-80MHZ, NO-160MHZ
(2422 - 2462 @ 40), (6, 22), (N/A), AUTO-BW, NO-80MHZ, NO-160MHZ
(2447 - 2482 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-80MHZ, NO-160MHZ
(5170 - 5190 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5190 - 5210 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5210 - 5230 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5230 - 5250 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5250 - 5270 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5270 - 5290 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5290 - 5310 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5310 - 5330 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5490 - 5510 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5510 - 5530 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5530 - 5550 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5550 - 5570 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5570 - 5590 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5590 - 5610 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5610 - 5630 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5630 - 5650 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5650 - 5670 @ 80), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ, PASSIVE-SCAN
(5670 - 5690 @ 80), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-160MHZ, NO-320MHZ, PASSIVE-SCAN
(5690 - 5710 @ 80), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ, PASSIVE-SCAN
(5735 - 5755 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ
(5755 - 5775 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-160MHZ, NO-320MHZ
(5775 - 5795 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ
(5795 - 5815 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-160MHZ, NO-320MHZ
(5815 - 5835 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-80MHZ, NO-160MHZ, NO-320MHZ
(5835 - 5855 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-80MHZ, NO-160MHZ, NO-320MHZ
(5855 - 5875 @ 20), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-HT40PLUS, NO-80MHZ, NO-160MHZ, NO-320MHZ
(5945 - 6425 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-320MHZ, PASSIVE-SCAN
=== DMESG IWLWIFI ===
[ 3.332866] iwlwifi 0000:09:00.0: enabling device (0000 -> 0002)
[ 3.334459] iwlwifi 0000:09:00.0: Detected crf-id 0x400410, cnv-id 0x400410 wfpm id 0x80000000
[ 3.334466] iwlwifi 0000:09:00.0: PCI dev 2725/0024, rev=0x420, rfid=0x10d000
[ 3.334470] iwlwifi 0000:09:00.0: Detected Intel(R) Wi-Fi 6E AX210 160MHz
[ 3.358942] iwlwifi 0000:09:00.0: loaded firmware version 89.735b75a4.0 ty-a0-gf-a0-89.ucode op_mode iwlmvm
[ 3.673010] iwlwifi 0000:09:00.0: WFPM_UMAC_PD_NOTIFICATION: 0x20
[ 3.673023] iwlwifi 0000:09:00.0: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
[ 3.673039] iwlwifi 0000:09:00.0: WFPM_AUTH_KEY_0: 0x90
[ 3.673052] iwlwifi 0000:09:00.0: CNVI_SCU_SEQ_DATA_DW9: 0x0
[ 3.673060] iwlwifi 0000:09:00.0: Detected RF GF, rfid=0x10d000
[ 3.757064] iwlwifi 0000:09:00.0: base HW address: 84:5c:f3:f6:6d:aa
[ 5.729022] iwlwifi 0000:09:00.0: WFPM_UMAC_PD_NOTIFICATION: 0x20
[ 5.729036] iwlwifi 0000:09:00.0: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
[ 5.729052] iwlwifi 0000:09:00.0: WFPM_AUTH_KEY_0: 0x90
[ 5.729063] iwlwifi 0000:09:00.0: CNVI_SCU_SEQ_DATA_DW9: 0x0
=== NETWORKMANAGER CONFIG ===
# Configuration file for NetworkManager.
# See "man 5 NetworkManager.conf" for details.
[device]
wifi.backend=iwd
^ permalink raw reply
* Re: [PATCH wireless-next v2 06/31] wifi: mm81x: add core.h
From: Lachlan Hodges @ 2026-06-10 5:06 UTC (permalink / raw)
To: Johannes Berg
Cc: Dan Callaghan, Arien Judge, ayman.grais, linux-wireless,
linux-kernel
In-Reply-To: <f6dbd068437564e18695b1ef263ebba27ad7fab0.camel@sipsolutions.net>
On Thu, Jun 04, 2026 at 01:40:09PM +0200, Johannes Berg wrote:
> On Thu, 2026-04-30 at 14:55 +1000, Lachlan Hodges wrote:
> >
> > +#define KHZ_TO_HZ(x) ((x) * 1000)
> > +#define KHZ100_TO_MHZ(x) ((x) / 10)
> > +#define KHZ100_TO_KHZ(freq) ((freq) * 100)
> > +#define KHZ100_TO_HZ(freq) ((freq) * 100000)
>
> Maybe not right now, but at least the first one seems fairly generic and
> could be elsewhere.
There is a function:
static int mm81x_tx_h_get_prim_bw(struct cfg80211_chan_def *chandef)
{
return chandef->s1g_primary_2mhz ? 2 : 1;
}
which should definitely be in the cfg80211 since its a generic chandef
helper and will probably be needed at somepoint in mac/cfg in the future.
I can probably just have it as a patch prior similar to the SDIO id
as part of v3. Then I guess I can also do the same for the helpers above
and place them alongside:
/* convert frequencies */
#define MHZ_TO_KHZ(freq) ((freq) * 1000)
#define KHZ_TO_MHZ(freq) ((freq) / 1000)
#define PR_KHZ(f) KHZ_TO_MHZ(f), f % 1000
#define KHZ_F "%d.%03d"
Unless you have some other preference :)
lachlan
^ permalink raw reply
* Re: iwlwifi: Aggressive LAR forces country 00 and disables 6GHz band on Intel chips
From: Владимир Пантелеев @ 2026-06-10 4:33 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <CAN6W26sm-xsy3tQ+RGcjYxpfe8+HcD7E8Q36MeT9m0u=2KGn2A@mail.gmail.com>
[-- Attachment #1.1: Type: text/plain, Size: 3133 bytes --]
Hello,
Adding a visual layout bug I just found in the UI.
The system is deeply confused about the Wi-Fi 7 MLO connection state: it
displays the SSID name as "TP-Link_6G" but incorrectly reports the
frequency as 2.417 GHz (Channel 2).
This screenshot visually proves that the current Linux wireless stack is
completely misinterpreting the operational parameters of aggregated
MLO/6GHz states.
ср, 10 июн. 2026 г. в 09:27, Владимир Пантелеев <vovik181083@gmail.com>:
> Bug Report: Intel iwlwifi 6GHz (Wi-Fi 6E/7) regression under Linux (LAR &
> Aggressive Powersave issue)
>
> Environment:
> - OS: Arch Linux (Kernel 6.x / rolling)
> - Wireless Card: Intel Wi-Fi 6E/7 (iwlwifi driver)
> - Wireless Backend: NetworkManager with default wpa_supplicant / iwd
> - Router Setup: ASUS ROG GT-AX6000 (Main) + TP-Link Archer BE800 (AP Mode,
> Wi-Fi 7 MLO enabled on 6GHz)
>
> Description of the Issue:
> There is a severe performance and functionality regression when using
> Intel Wi-Fi cards on the 6GHz band under Linux, which does not occur on the
> exact same hardware under Windows 11. The problem consists of two distinct
> bugs:
>
> Bug 1: Aggressive LAR (Location Aware Regulatory) drops 6GHz band entirely
> By default, the iwlwifi driver locks the regulatory domain to country 00:
> DFS-UNSET, even in jurisdictions where the 6GHz band is officially
> permitted (e.g., Kazakhstan, KZ). The driver self-manages and forces the
> global 00 domain based on passive scans of legacy ambient access points.
> This completely filters out and blinds the system to any 6GHz (Wi-Fi 6E)
> and Multi-Link Operation (Wi-Fi 7 MLO) beacons, throwing Connection refused
> or hidden SSIDs. Switching the NM backend to iwd and manually forcing
> Country=KZ in /etc/iwd/main.conf partially restores the visibility, but it
> shouldn't require manual hacks.
>
> Bug 2: NetworkManager wifi.powersave chokes throughput over 6GHz HTTP
> streams
> When a connection to a 6GHz / MLO network is finally established, local
> network benchmarks over HTTP/WebSockets suffer from extreme performance
> degradation. Download speeds drop to an abysmal 15-21 Mbps, while Link
> Speed explicitly reports 1.729 Gbps. At the same time, Upload speed remains
> relatively high (~338 Mbps). The default NetworkManager power-saving
> mechanism (wifi.powersave = 3) fails to recognize high-throughput incoming
> aggregate traffic over 6GHz bands when initiated via browser engines.
> Forcing wifi.powersave = 2 inside NetworkManager config immediately fixes
> the issue, boosting the throughput back to a stable 600+ Mbps.
>
> Expected Behavior:
> The iwlwifi driver should natively honor local regulatory frameworks
> without falling back to a restrictive 00 profile that truncates 6GHz
> frequencies. NetworkManager's default power management must be optimized
> for the higher-frequency aggregation states of Wi-Fi 6E and Wi-Fi 7 to
> prevent false-positive low-power state transitions during active downloads.
>
> Attached is the full system debug log (network_bug_report.txt).
>
[-- Attachment #1.2: Type: text/html, Size: 3414 bytes --]
[-- Attachment #2: IMG_20260610_092056.jpg --]
[-- Type: image/jpeg, Size: 9075827 bytes --]
^ permalink raw reply
* iwlwifi: Aggressive LAR forces country 00 and disables 6GHz band on Intel chips
From: Владимир Пантелеев @ 2026-06-10 4:27 UTC (permalink / raw)
To: linux-wireless
[-- Attachment #1.1: Type: text/plain, Size: 2487 bytes --]
Bug Report: Intel iwlwifi 6GHz (Wi-Fi 6E/7) regression under Linux (LAR &
Aggressive Powersave issue)
Environment:
- OS: Arch Linux (Kernel 6.x / rolling)
- Wireless Card: Intel Wi-Fi 6E/7 (iwlwifi driver)
- Wireless Backend: NetworkManager with default wpa_supplicant / iwd
- Router Setup: ASUS ROG GT-AX6000 (Main) + TP-Link Archer BE800 (AP Mode,
Wi-Fi 7 MLO enabled on 6GHz)
Description of the Issue:
There is a severe performance and functionality regression when using Intel
Wi-Fi cards on the 6GHz band under Linux, which does not occur on the exact
same hardware under Windows 11. The problem consists of two distinct bugs:
Bug 1: Aggressive LAR (Location Aware Regulatory) drops 6GHz band entirely
By default, the iwlwifi driver locks the regulatory domain to country 00:
DFS-UNSET, even in jurisdictions where the 6GHz band is officially
permitted (e.g., Kazakhstan, KZ). The driver self-manages and forces the
global 00 domain based on passive scans of legacy ambient access points.
This completely filters out and blinds the system to any 6GHz (Wi-Fi 6E)
and Multi-Link Operation (Wi-Fi 7 MLO) beacons, throwing Connection refused
or hidden SSIDs. Switching the NM backend to iwd and manually forcing
Country=KZ in /etc/iwd/main.conf partially restores the visibility, but it
shouldn't require manual hacks.
Bug 2: NetworkManager wifi.powersave chokes throughput over 6GHz HTTP
streams
When a connection to a 6GHz / MLO network is finally established, local
network benchmarks over HTTP/WebSockets suffer from extreme performance
degradation. Download speeds drop to an abysmal 15-21 Mbps, while Link
Speed explicitly reports 1.729 Gbps. At the same time, Upload speed remains
relatively high (~338 Mbps). The default NetworkManager power-saving
mechanism (wifi.powersave = 3) fails to recognize high-throughput incoming
aggregate traffic over 6GHz bands when initiated via browser engines.
Forcing wifi.powersave = 2 inside NetworkManager config immediately fixes
the issue, boosting the throughput back to a stable 600+ Mbps.
Expected Behavior:
The iwlwifi driver should natively honor local regulatory frameworks
without falling back to a restrictive 00 profile that truncates 6GHz
frequencies. NetworkManager's default power management must be optimized
for the higher-frequency aggregation states of Wi-Fi 6E and Wi-Fi 7 to
prevent false-positive low-power state transitions during active downloads.
Attached is the full system debug log (network_bug_report.txt).
[-- Attachment #1.2: Type: text/html, Size: 2585 bytes --]
[-- Attachment #2: network_bug_report.txt --]
[-- Type: text/plain, Size: 4484 bytes --]
=== IW REG GET ===
global
country KZ: DFS-ETSI
(2400 - 2483 @ 40), (N/A, 20), (N/A)
(5150 - 5250 @ 80), (N/A, 23), (N/A), NO-OUTDOOR, AUTO-BW
(5250 - 5350 @ 80), (N/A, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW
(5470 - 5725 @ 160), (N/A, 20), (0 ms), NO-OUTDOOR, DFS
(5725 - 5850 @ 80), (N/A, 20), (N/A), NO-OUTDOOR
(5925 - 6425 @ 320), (N/A, 23), (N/A), NO-OUTDOOR
(57000 - 66000 @ 2160), (N/A, 40), (N/A)
phy#0 (self-managed)
country GB: DFS-UNSET
(2402 - 2437 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-80MHZ, NO-160MHZ
(2422 - 2462 @ 40), (6, 22), (N/A), AUTO-BW, NO-80MHZ, NO-160MHZ
(2447 - 2482 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-80MHZ, NO-160MHZ
(5170 - 5190 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5190 - 5210 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5210 - 5230 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5230 - 5250 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5250 - 5270 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5270 - 5290 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5290 - 5310 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5310 - 5330 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5490 - 5510 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5510 - 5530 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5530 - 5550 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5550 - 5570 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5570 - 5590 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5590 - 5610 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5610 - 5630 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-320MHZ, PASSIVE-SCAN
(5630 - 5650 @ 160), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-320MHZ, PASSIVE-SCAN
(5650 - 5670 @ 80), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ, PASSIVE-SCAN
(5670 - 5690 @ 80), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40PLUS, NO-160MHZ, NO-320MHZ, PASSIVE-SCAN
(5690 - 5710 @ 80), (6, 22), (0 ms), DFS, AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ, PASSIVE-SCAN
(5735 - 5755 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ
(5755 - 5775 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-160MHZ, NO-320MHZ
(5775 - 5795 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-160MHZ, NO-320MHZ
(5795 - 5815 @ 80), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-160MHZ, NO-320MHZ
(5815 - 5835 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-80MHZ, NO-160MHZ, NO-320MHZ
(5835 - 5855 @ 40), (6, 22), (N/A), AUTO-BW, NO-HT40PLUS, NO-80MHZ, NO-160MHZ, NO-320MHZ
(5855 - 5875 @ 20), (6, 22), (N/A), AUTO-BW, NO-HT40MINUS, NO-HT40PLUS, NO-80MHZ, NO-160MHZ, NO-320MHZ
(5945 - 6425 @ 160), (6, 22), (N/A), NO-OUTDOOR, AUTO-BW, IR-CONCURRENT, NO-320MHZ, PASSIVE-SCAN
=== DMESG IWLWIFI ===
[ 3.332866] iwlwifi 0000:09:00.0: enabling device (0000 -> 0002)
[ 3.334459] iwlwifi 0000:09:00.0: Detected crf-id 0x400410, cnv-id 0x400410 wfpm id 0x80000000
[ 3.334466] iwlwifi 0000:09:00.0: PCI dev 2725/0024, rev=0x420, rfid=0x10d000
[ 3.334470] iwlwifi 0000:09:00.0: Detected Intel(R) Wi-Fi 6E AX210 160MHz
[ 3.358942] iwlwifi 0000:09:00.0: loaded firmware version 89.735b75a4.0 ty-a0-gf-a0-89.ucode op_mode iwlmvm
[ 3.673010] iwlwifi 0000:09:00.0: WFPM_UMAC_PD_NOTIFICATION: 0x20
[ 3.673023] iwlwifi 0000:09:00.0: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
[ 3.673039] iwlwifi 0000:09:00.0: WFPM_AUTH_KEY_0: 0x90
[ 3.673052] iwlwifi 0000:09:00.0: CNVI_SCU_SEQ_DATA_DW9: 0x0
[ 3.673060] iwlwifi 0000:09:00.0: Detected RF GF, rfid=0x10d000
[ 3.757064] iwlwifi 0000:09:00.0: base HW address: 84:5c:f3:f6:6d:aa
[ 5.729022] iwlwifi 0000:09:00.0: WFPM_UMAC_PD_NOTIFICATION: 0x20
[ 5.729036] iwlwifi 0000:09:00.0: WFPM_LMAC2_PD_NOTIFICATION: 0x1f
[ 5.729052] iwlwifi 0000:09:00.0: WFPM_AUTH_KEY_0: 0x90
[ 5.729063] iwlwifi 0000:09:00.0: CNVI_SCU_SEQ_DATA_DW9: 0x0
=== NETWORKMANAGER CONFIG ===
# Configuration file for NetworkManager.
# See "man 5 NetworkManager.conf" for details.
[device]
wifi.backend=iwd
^ permalink raw reply
* [PATCH] wifi: mt76: mt7925: remove code guarded by nonexistent config option
From: Ethan Nelson-Moore @ 2026-06-10 4:24 UTC (permalink / raw)
To: linux-wireless
Cc: Ethan Nelson-Moore, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Matthias Brugger,
AngeloGioacchino Del Regno, Ming Yen Hsieh
A small piece of code in mt7925/regs.h depends on CONFIG_MT76_DEV, which
has never been defined in the kernel. Remove this dead code.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/regs.h | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/regs.h b/drivers/net/wireless/mediatek/mt76/mt7925/regs.h
index 24985bba1b90..ea04e477a67c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/regs.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/regs.h
@@ -74,11 +74,7 @@
#define MT_HIF_REMAP_BASE_L1 0x130000
#define MT_HIF_REMAP_L2 0x0120
-#if IS_ENABLED(CONFIG_MT76_DEV)
-#define MT_HIF_REMAP_BASE_L2 (0x7c500000 - (0x7c000000 - 0x18000000))
-#else
#define MT_HIF_REMAP_BASE_L2 0x18500000
-#endif
#define MT_WFSYS_SW_RST_B 0x7c000140
--
2.43.0
^ permalink raw reply related
* [PATCH] wifi: mt76: mt7996: remove code guarded by nonexistent config option
From: Ethan Nelson-Moore @ 2026-06-10 4:10 UTC (permalink / raw)
To: linux-wireless
Cc: Ethan Nelson-Moore, Felix Fietkau, Lorenzo Bianconi, Ryder Lee,
Shayne Chen, Sean Wang, Matthias Brugger,
AngeloGioacchino Del Regno, Rex Lu
A small piece of code in mt7996.h depends on CONFIG_MTK_DEBUG, which
has never been defined in the kernel. Remove this dead code.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index bdcf72457954..39c525a40412 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -921,10 +921,6 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
bool hif2, int *irq);
u32 mt7996_wed_init_buf(void *ptr, dma_addr_t phys, int token_id);
-#ifdef CONFIG_MTK_DEBUG
-int mt7996_mtk_init_debugfs(struct mt7996_phy *phy, struct dentry *dir);
-#endif
-
int mt7996_dma_rro_init(struct mt7996_dev *dev);
void mt7996_dma_rro_start(struct mt7996_dev *dev);
--
2.43.0
^ permalink raw reply related
* [PATCH ath-next] wifi: ath12k: change MAC buffer ring size to 4096
From: Yingying Tang @ 2026-06-10 3:13 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, yintang, yingying.tang
For WCN7850, MAC buffer ring size is updated to 2048 in
955df16f2a4c3 ("wifi: ath12k: change MAC buffer ring size to 2048")
to increase peak throughput.
But during the RX process, a phenomenon can still be observed where
the throughput drops by about 30% from its peak value and then recovers,
and this behavior repeats during RX.
After increasing MAC buffer ring size to 4096, the data rate drop has
gone.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Signed-off-by: Yingying Tang <yingying.tang@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
index f8cfc7bb29dd..6596089d4168 100644
--- a/drivers/net/wireless/ath/ath12k/dp.h
+++ b/drivers/net/wireless/ath/ath12k/dp.h
@@ -205,7 +205,7 @@ struct ath12k_pdev_dp {
#define DP_REO_CMD_RING_SIZE 256
#define DP_REO_STATUS_RING_SIZE 2048
#define DP_RXDMA_BUF_RING_SIZE 4096
-#define DP_RX_MAC_BUF_RING_SIZE 2048
+#define DP_RX_MAC_BUF_RING_SIZE 4096
#define DP_RXDMA_REFILL_RING_SIZE 2048
#define DP_RXDMA_ERR_DST_RING_SIZE 1024
#define DP_RXDMA_MON_STATUS_RING_SIZE 1024
--
base-commit: ff49eba595df500e4ddccc593088c8a4ab5f2c27
^ permalink raw reply related
* [syzbot] [btrfs?] WARNING in __alloc_workqueue (2)
From: syzbot @ 2026-06-09 23:04 UTC (permalink / raw)
To: clm, dsterba, linux-btrfs, linux-kernel, linux-wireless,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: a87737435cfa Add linux-next specific files for 20260608
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=178a7f2e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=da47745f686dc823
dashboard link: https://syzkaller.appspot.com/bug?extid=f80c62f371ba6a1e7d79
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=170260ae580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124f11b6580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/85d19fe6bb4e/disk-a8773743.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/30c683ce26e1/vmlinux-a8773743.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4db5027513d2/bzImage-a8773743.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f80c62f371ba6a1e7d79@syzkaller.appspotmail.com
usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping
usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: config 0 descriptor??
------------[ cut here ]------------
workqueue: ath6kl_wq is using neither WQ_PERCPU or WQ_UNBOUND. Setting WQ_PERCPU.
WARNING: kernel/workqueue.c:5856 at __alloc_workqueue+0x1d02/0x2070 kernel/workqueue.c:5855, CPU#0: kworker/0:3/5630
Modules linked in:
CPU: 0 UID: 0 PID: 5630 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: usb_hub_wq hub_event
RIP: 0010:__alloc_workqueue+0x1d07/0x2070 kernel/workqueue.c:5855
Code: e9 36 f9 ff ff e8 e9 89 37 00 e9 05 fb ff ff e8 df 89 37 00 e9 92 fb ff ff e8 d5 89 37 00 48 8d 3d 1e b7 43 0e 48 8b 74 24 20 <67> 48 0f b9 3a 81 cd 00 01 00 00 e9 88 e5 ff ff e8 b4 89 37 00 48
RSP: 0018:ffffc90004606bc8 EFLAGS: 00010293
RAX: ffffffff818e312b RBX: 0000000000000000 RCX: ffff8880342dbe00
RDX: 0000000000000000 RSI: ffff8880448f3d68 RDI: ffffffff8fd1e850
RBP: 0000000000000000 R08: ffff8880342dbe00 R09: 0000000000000002
R10: 0000000000000100 R11: 0000000000000102 R12: dffffc0000000000
R13: ffff8880448f3c00 R14: ffffc90004606ce0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888125a76000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdb09f620f5 CR3: 0000000028f60000 CR4: 00000000003526f0
Call Trace:
<TASK>
alloc_workqueue_va kernel/workqueue.c:5950 [inline]
alloc_workqueue_noprof+0xe3/0x210 kernel/workqueue.c:5966
ath6kl_usb_create drivers/net/wireless/ath/ath6kl/usb.c:639 [inline]
ath6kl_usb_probe+0xaa/0x1580 drivers/net/wireless/ath/ath6kl/usb.c:1143
usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:706
__driver_probe_device+0x1e2/0x350 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7ec/0xb90 drivers/base/core.c:3772
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:706
__driver_probe_device+0x1e2/0x350 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7ec/0xb90 drivers/base/core.c:3772
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work+0x98b/0x1630 kernel/workqueue.c:3326
process_scheduled_works kernel/workqueue.c:3409 [inline]
worker_thread+0xb49/0x1140 kernel/workqueue.c:3490
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------------
Code disassembly (best guess):
0: e9 36 f9 ff ff jmp 0xfffff93b
5: e8 e9 89 37 00 call 0x3789f3
a: e9 05 fb ff ff jmp 0xfffffb14
f: e8 df 89 37 00 call 0x3789f3
14: e9 92 fb ff ff jmp 0xfffffbab
19: e8 d5 89 37 00 call 0x3789f3
1e: 48 8d 3d 1e b7 43 0e lea 0xe43b71e(%rip),%rdi # 0xe43b743
25: 48 8b 74 24 20 mov 0x20(%rsp),%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 81 cd 00 01 00 00 or $0x100,%ebp
35: e9 88 e5 ff ff jmp 0xffffe5c2
3a: e8 b4 89 37 00 call 0x3789f3
3f: 48 rex.W
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox