Ziyi Guo [Sun, 25 Jan 2026 19:40:39 +0000 (19:40 +0000)]
wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
that callers must hold this lock.
All other callers of il_set_tx_power() properly acquire the mutex:
- il_bg_scan_completed() acquires mutex at common.c:1683
- il_mac_config() acquires mutex at common.c:5006
- il3945_commit_rxon() and il4965_commit_rxon() are called via work
queues that hold the mutex (like il4965_bg_alive_start)
Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
the sysfs store function to fix the missing lock protection.
Ziyi Guo [Sun, 25 Jan 2026 19:30:05 +0000 (19:30 +0000)]
wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
il3945_store_measurement() calls il3945_get_measurement() which internally
calls il_send_cmd_sync() without holding il->mutex. However,
il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
callers must hold this lock.
Other sysfs store functions in the same file properly acquire the mutex:
- il3945_store_flags() acquires mutex at 3945-mac.c:3110
- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
in the sysfs store function to fix the missing lock protection.
Zilin Guan [Thu, 22 Jan 2026 08:59:45 +0000 (08:59 +0000)]
wifi: p54: Fix memory leak in p54_beacon_update()
In p54_beacon_update(), beacon is allocated via ieee80211_beacon_get().
If p54_beacon_format_ie_tim() fails, the function returns immediately
without freeing the allocated beacon skb, which would lead to a memory
leak.
Since no other references to this memory exist, it must be freed locally
before returning the error. Fix this by freeing the buffer using
dev_kfree_skb_any() in the error path.
Note that this error path is unreachable in practice because mac80211
guarantees a minimum TIM length of 4 bytes for non-S1G devices. This
change primarily serves to silence static analysis warnings and keep
the error handling logic complete.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode
Although value 4 (INDOOR_SP_AP_OLD) is deprecated in IEEE standards,
existing APs may still use this control value. Since this value is
based on the old specification, we cannot trust such APs implement
proper power controls.
Therefore, move IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD case
from SP_AP to LPI_AP power type handling to prevent potential
power limit violations.
Uwe Kleine-König [Mon, 12 Jan 2026 15:46:57 +0000 (16:46 +0100)]
sdio: Provide a bustype shutdown function
To prepare sdio drivers to migrate away from struct device_driver::shutdown
(and then eventually remove that callback) create a serdev driver shutdown
callback and migration code to keep the existing behaviour. Note this
introduces a warning for each driver that isn't converted yet to that
callback at register time.
Avraham Stern [Sun, 11 Jan 2026 17:03:51 +0000 (19:03 +0200)]
wifi: nl80211/cfg80211: support operating as RSTA in PMSR FTM request
Add an option to operate as the RSTA in an FTM measurement request.
When requested, the device will dwell on the requested channel until
the peer starts the FTM negotiation. This option is only valid for
trigger-based/non trigger-based measurement with LMR feedback which
will allow the RSTA to receive the results of the measurement.
Avraham Stern [Sun, 11 Jan 2026 17:03:50 +0000 (19:03 +0200)]
wifi: nl80211/cfg80211: add negotiated burst period to FTM result
The FTM result includes some of the periodic measurement negotiated
parameters (like the burst duration and number of bursts), but it
doesn't include the burst period. Add it to the FTM result
notification.
Avraham Stern [Sun, 11 Jan 2026 17:03:49 +0000 (19:03 +0200)]
wifi: nl80211/cfg80211: clarify periodic FTM parameters for non-EDCA based ranging
Periodic FTM request attributes are defined based on the periodic
parameters used in EDCA-based ranging negotiation. However, non-EDCA
based ranging (trigger-based/non-trigger-based) does not include
periodic parameters in the negotiation protocol, even though upper
layers may still request periodic measurements.
Clarify the semantics of periodic ranging attributes when used with
non-EDCA based ranging.
Avraham Stern [Sun, 11 Jan 2026 17:03:48 +0000 (19:03 +0200)]
wifi: nl80211/cfg80211: add new FTM capabilities
Add new capabilities to the PMSR FTM capabilities list. The new
capabilities include 6 GHz support, supported number of spatial streams
and supported number of LTF repetitions.
This was poorly named, probably a copy paste mistake.
The real meaning of this field is a map of the MCCs to describe the AP
type allowed for each country.
Nidhish A N [Sun, 11 Jan 2026 17:39:25 +0000 (19:39 +0200)]
wifi: iwlwifi: mvm: Remove link_id from time_events
As part of removal of EMLSR support from mvm, remove
link_id parameter from time_events. Additionally,
remove link_id parameter from iwl_mvm_protect_assoc
as we can now directly use deflink.
Benjamin Berg [Sun, 11 Jan 2026 17:39:24 +0000 (19:39 +0200)]
wifi: iwlwifi: mld: change cluster_id type to u8 array
While the cluster_id is two bytes long, it is just the last two bytes of
the cluster ID MAC address. This does not really map to a big or little
endian data type. Switch it to use an array to avoid confusion and
adjust all users so that they do the right thing independent of
endianness.
wifi: iwlwifi: support V13 of iwl_lari_config_change_cmd
This command is getting a new field for UNII-9 and ieee80211bn
enablement.
We must read the relevant DSM values and pass them to the firmware,
Remember whether we have ACPI or UEFI available in the firmware runtime
object and remember the DSM function revision.
Instead of reading the DSM functions on demand, just read them all
when the first DSM function is called and cache the values for all
the other DSM functions. This simplifies the flow.
Since the same will be done for UEFI in the next patch, remove the
ifdef CONFIG_ACPI around the relevant variables.
Once UEFI's cache will be implemented, we'll be able to change
iwl_bios_get_dsm to access the cache directly.
wifi: iwlwifi: move lari helper functions to the op_mode
iwlmvm is the only op_mode that uses the lari helper functions. iwlmld
has its own version to avoid introducing regressions.
Move all those functions to iwlmvm, as they are more related to the
op_mode.
iwl_get_lari_config_bitmap will move in the next patch.
Miri Korenblit [Sun, 11 Jan 2026 17:39:15 +0000 (19:39 +0200)]
wifi: iwlwifi: mld: add an helper to update an EMLSR blocker
Add an helper function that iterates over all (relevant) interfaces and
sets/unsets a given EMLSR blocker.
For now use it only for IWL_MLD_EMLSR_BLOCKED_NON_BSS.
Nidhish A N [Sun, 11 Jan 2026 17:39:14 +0000 (19:39 +0200)]
wifi: iwlwifi: mld: Fix primary link selection logic
When assigning emlsr.primary with emlsr.selected_primary
we are checking if BIT(mld_vif->emlsr.selected_links) are
a part of vif->active_links. This is incorrect as
emlsr.selected_links is a bitmap of possibly two selected links.
Therefore, performing the BIT() operation on it does not
yield any meaningful result and almost always leads to
incorrect primary link selection.
Additionally, we cannot rely on vif->active_links at this
stage of the link switch flow because it contains both the
removed links and also the newly added links.
For example, if we had selected links in the past (0x11)
and we now select links because of TTLM/debugfs (0x100),
vif->active_links will now be (0x111) and primary link
will be 0, while 0 is not even an active link. Thus,
we create our own bitmap of final active links.
Miri Korenblit [Sun, 11 Jan 2026 17:39:12 +0000 (19:39 +0200)]
wifi: iwlwifi: mld: fix chandef start calculation
A link pair in which both links are in 5 GHz can be used for EMLSR only
if they are separated enough.
To check this condition we calculate the start and the end of the
chandefs of both links in the pair and do some checks.
But the calculation of the start/end of the chandef is currently done
by subtracting/adding half the bandwidth from/to the control channel's
center frequency, when it should really be subtracted/added from/to the
center frequency of the entire chandef.
Johannes Berg [Mon, 10 Nov 2025 13:02:24 +0000 (15:02 +0200)]
wifi: iwlwifi: mld: fix HE SIG-B MCS/DCM/compression
These values should be taken from SIG-A, indicating how SIG-B
is encoded. The values taken from SIG-B (the corresponding
register) indicate how the data portion (for that user) is
encoded. For the SIG-B compression value the correct mask was
applied to the wrong value.
Johannes Berg [Mon, 10 Nov 2025 13:02:23 +0000 (15:02 +0200)]
wifi: iwlwifi: fw: api: add UHR data definitions
Add the necessary data definitions for the sniffer-related fields
reported for the various UHR frame formats by the firmware/hardware
to be able to later add the necessary sniffer code.
wifi: iwlwifi: mld: refactor AP power type setting
Fix unsafe power type mapping for iwl_txpower_constraints_cmd
that breaks if enum values change. Replace "power_type - 1" with
explicit case handling for each power type.
While on it, Add debug logging to show configured power type.
Johannes Berg [Mon, 10 Nov 2025 13:02:19 +0000 (15:02 +0200)]
wifi: iwlwifi: fix 22000 series SMEM parsing
If the firmware were to report three LMACs (which doesn't
exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is
an overrun of the array. Reject such and use IWL_FW_CHECK
instead of WARN_ON in this function.
Miri Korenblit [Mon, 10 Nov 2025 13:02:18 +0000 (15:02 +0200)]
wifi: iwlwifi: mld: support TLC command version 6
In version 6, a phy id is added to the tlc command and the sta_id
becomes a sta_mask.
This change is required for NAN:
- in NAN we can have 2 logical stations of the same physical
station and with the same channel/band (2 NDIs with the same peer) -
hence the sta_mask.
- In NAN we can have more than one TLC configuration for a single
station (for example if it operates on more than one channel) - so the
FW needs to be able to find the right TLC context, based on the phy id.
Populate the new version (for now with a single station id only. The
other ones will be added later when NAN is implemented).
In case the FW has a lower version than that - convert it to the FW
version.
Note that there is some code duplicantion in the conversions to v5
and to v4, but this is intentional since v5 will be removed as soon as
v6 is supported.
wifi: iwlwifi: mld: trigger a dump upon notification if needed
The firmware can request us to trigger a dump upon specific
notifications. In order for that flow to work, we need to call the
firmware debug infra when we get a notification from the firmware.
Miri Korenblit [Mon, 10 Nov 2025 13:02:15 +0000 (15:02 +0200)]
wifi: iwlwifi: mvm: check the validity of noa_len
Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using
its value to determine the noa_len, which is later used for the NoA
attribute.
- iwl_mvm_scan_umac_chan_flags_v2() computes channel params flags
that are only relevant for 2.4/5 GHz scan, explicitly clear
the flags for 6 GHz scan.
- n_aps_override[0] and n_aps_override[1] are not relevant for
6 GHz scan, remove them.
Daniel Gabay [Mon, 10 Nov 2025 13:02:13 +0000 (15:02 +0200)]
wifi: iwlwifi: mld: Remove wrong channel flags in scan cmd
Erroneously, the channel flags in the scan command for 6 GHz scan
were mistakenly set using iwl_mld_scan_get_cmd_gen_flags, which
actually calculates a different field (the general flags) in the
command.
However, these flags are not relevant for 6 GHz scan part, except for
IWL_SCAN_CHANNEL_FLAG_6G_PSC_NO_FILTER, which is already set
correctly. Since the incorrect flags are only applied in the
6 GHz scan part and are ignored by the firmware, this has no
adverse effect. Therefore, we can simply remove this helper
function call and explicitly clear the flags.
Ilan Peer [Mon, 10 Nov 2025 16:08:50 +0000 (18:08 +0200)]
wifi: iwlwifi: mld: Advertise support for multicast RX registration
While this is not needed for configuring Rx filters, without setting
it some multicast action frame registrations from user space would
fail, specifically, NAN multicast action frame registration (SDFs).
Ilan Peer [Mon, 10 Nov 2025 16:08:45 +0000 (18:08 +0200)]
wifi: iwlwifi: mld: Add support for NAN
- Add firmware API definitions related to NAN.
- Indicate support for NAN Device interface operation, if supported
by the firmware.
- Add support for starting and stopping NAN cluster functionality.
The NAN cluster operation is offloaded to the FW, which notifies
the driver on:
- cluster events: Start/Join cluster.
- Discovery Window (DW) end, which allows the driver to flush the
HW queues and update the higher layers
Johannes Berg [Fri, 16 Jan 2026 08:20:25 +0000 (09:20 +0100)]
wifi: mac80211: remove RX_DROP
Since it's hard to figure out what RX_DROP means when looking
at traces that drop packets in mac80211, add more specific drop
reasons and remove RX_DROP entirely.
Miri Korenblit [Wed, 7 Jan 2026 12:22:54 +0000 (14:22 +0200)]
wifi: nl80211: ignore cluster id after NAN started
After NAN was started, cluster id updates from the user space should not
happen, since the device already started a cluster with the
previousely provided id.
Since NL80211_CMD_CHANGE_NAN_CONFIG requires to set the full NAN
configuration, we can't require that NL80211_NAN_CONF_CLUSTER_ID won't
be included in this command, and keeping the last confgiured value just
to be able to compare it against the new one seems a bit overkill.
Therefore, just ignore cluster id in this command and clarify the
documentation.
Miri Korenblit [Wed, 7 Jan 2026 12:15:56 +0000 (14:15 +0200)]
wifi: cfg80211: limit NAN func management APIs to offloaded DE
A driver that declared that it has userspace DE should not call NAN func
related APIs such as cfg80211_nan_match and cfg80211_nan_func_terminated
Check and warn in such a case, as this indicates a driver bug.
Miri Korenblit [Wed, 7 Jan 2026 12:04:51 +0000 (14:04 +0200)]
wifi: cfg80211: stop NAN and P2P in cfg80211_leave
Seems that there is an assumption that this function should be called
only for netdev interfaces, but it can also be called in suspend, or
from nl80211_netlink_notify (indirectly).
Note that the documentation of NL80211_ATTR_SOCKET_OWNER explicitly
says that NAN interfaces would be destroyed as well in the
nl80211_netlink_notify case.
Miri Korenblit [Wed, 7 Jan 2026 11:51:57 +0000 (13:51 +0200)]
wifi: cfg80211: allow only one NAN interface, also in multi radio
According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can
have one NAN management interface. This applies also to multi radio
devices.
The current code allows a driver to support more than one NAN interface,
if those are not in the same radio.
Peter Åstrand [Fri, 16 Jan 2026 17:58:58 +0000 (18:58 +0100)]
wifi: wlcore: Add support for IGTK key
This change re-applies commit 2b7aadd3b9e1 ("wlcore: Adding suppoprt for IGTK key in
wlcore driver") (sic), but only enables WLAN_CIPHER_SUITE_AES_CMAC with modern
firmware. This patch is required to support WPA3 connections.
Johannes Berg [Mon, 19 Jan 2026 09:15:00 +0000 (10:15 +0100)]
Merge tag 'rtw-next-2026-01-15' of https://github.com/pkshih/rtw
Ping-Ke Shih says:
==================
rtw-next patches for -next release.
Main changes are to prepare to support RTL8922DE, including refactor/add
register settings in common flow, and add newly firmware command/event
handlers.
Others are some random fixes and improvements across all drivers.
==================
Baochen Qiang [Mon, 12 Jan 2026 07:36:38 +0000 (15:36 +0800)]
wifi: ath12k: enable QCC2072 support
QCC2072 is a PCI based device that is very much like WCN7850, the major
difference is that QCC2072 has only one phy hence does not support DBS.
With previous patches handling such similarity and difference, it is now
ready to finally enable supporting this device.
Add QCC2072's ID to the PCI device ID table, to allow it getting probed
hence enable support. Also populate some necessary parameters when probing.
Miaoqing Pan [Mon, 12 Jan 2026 07:36:37 +0000 (15:36 +0800)]
wifi: ath12k: fix PCIE_LOCAL_REG_QRTR_NODE_ID definition for QCC2072
The definition of PCIE_LOCAL_REG_QRTR_NODE_ID in QCC2072 is
incorrect, which causes the QMI connection to fail when
ATH12K_FW_FEATURE_MULTI_QRTR_ID is enabled. To resolve this
issue, move it to the hardware register table.
Note IPQ5332 is not affected as it is not PCIe based device.
Baochen Qiang [Mon, 12 Jan 2026 07:36:35 +0000 (15:36 +0800)]
wifi: ath12k: limit number of channels per WMI command
Currently the number of channels can be sent in a single WMI command is
calculated based on the maximum message length of the target, this results
in WMI exchange hang for QCC2072 as its firmware can not support those
many channels in a single command.
Baochen Qiang [Mon, 12 Jan 2026 07:36:33 +0000 (15:36 +0800)]
wifi: ath12k: handle REO CMD ring for QCC2072
As far as REO CMD ring is concerned, there are two differences between
QCC2072 and the existing chips:
For the first, the TLV header of ring descriptor for QCC2072 is 32 bits
while 64 bits for existing chips.
For the second, QCC2072 has different hal_reo_get_queue_stats,
hal_reo_flush_cache and hal_reo_update_rx_queue structures. Take
hal_reo_get_queue_stats as an example:
Note there is no tlv64_pad at the end for QCC2072, but all other
former fields share the same layout.
These make different ring entry size, so that parameter has to be updated
with respect to existing chips. This is done in the newly introduced
ath12k_hal_srng_create_config_qcc2072() function, which first creates all
ring configs by utilizing ath12k_hal_srng_create_config_wcn7850() and then
updates the individual field.
Besides, the REO command TLV encoding also need to be corrected because of
the different TLV bits. This is done by introducing a 32 bit variant for
each of the existing 64 bit callback.
Note the hal_reo_get_queue_stats_qcc2072 structure is introduced for the
purpose of calculating ring entry size. Existing hal_reo_get_queue_stats
structure gets used elsewhere even for QCC2072. This is working because
the only difference is the tlv64_pad field that is located at the end and
not getting used, hence can be ignored.
Baochen Qiang [Mon, 12 Jan 2026 07:36:32 +0000 (15:36 +0800)]
wifi: ath12k: add hardware ops support for QCC2072
Due to HAL descriptors, QCC2027 has different offsets of MPDU start tag
and MSDU end tag, compared with other chips. Hence add new hardware
ops structure for QCC2072. All ops are directly taken from WCN7850, with
the exception to rxdma_ring_sel_config, which needs a new function
ath12k_dp_rxdma_ring_sel_config_qcc2072() to handle the difference
mentioned above.
Baochen Qiang [Mon, 12 Jan 2026 07:36:28 +0000 (15:36 +0800)]
wifi: ath12k: add hardware parameters for QCC2072
Add hardware parameters for QCC2072, these parameters are directly taken
from WCN7850, with exceptions to hardware name, revision, firmware
directory, iova_mask and RFKILL parameter set.
Compared to WCN7850, QCC2072 doesn't require aligned IOVA when
transmitting packets, hence iova_mask is set to zero.
Besides, WCN7850 has a dedicated GPIO for RFKILL purpose, however QCC2072
has it coupled with WLAN_EN pin. For QCC2072, host is not allowed to send
any RFKILL configuration info to firmware, or firmware crashes. Hence
those parameters are all cleared to skip configuring command.
Baochen Qiang [Mon, 12 Jan 2026 07:36:27 +0000 (15:36 +0800)]
wifi: ath12k: add hardware registers for QCC2072
Add hardware registers and populate hw_regs field in
ath12k_wifi7_hw_ver_map for QCC2072. Note for some registers not
defined and not used by QCC2072, a magic value is assigned.
Also populate other fields to be the same with WCN7850. Among them,
however, QCC2072 requires different HAL ops and descriptor size, both
will be updated in upcoming patches.
Baochen Qiang [Mon, 12 Jan 2026 07:36:26 +0000 (15:36 +0800)]
wifi: ath12k: fix mac phy capability parsing
Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band
supported in each phy, hence it skips 5 GHz band if 2 GHz band support
is detected. This does not work for device which gets only one phy but
has both bands supported, such as QCC2072.
Change to check each band individually to fix this issue.
Baochen Qiang [Mon, 12 Jan 2026 07:36:25 +0000 (15:36 +0800)]
wifi: ath12k: refactor 320 MHz bandwidth support parsing
For single pdev device, 320 MHz bandwidth support is reported only in
capability of WMI_HOST_HW_MODE_SINGLE mode, hence commit d4e244c85e45
("wifi: ath12k: enable 320 MHz bandwidth for 6 GHz band in EHT PHY
capability for WCN7850") relaxed the condition check in
ath12k_wmi_tlv_mac_phy_caps_ext() to allow SINGLE mode getting parsed in
ath12k_wmi_tlv_mac_phy_caps_ext_parse(). Since SINGLE mode is not assumed
to be preferred, the function returns unconditionally after parsing 320
MHz support.
This works for WCN7850 because it prefers another mode indeed, while it
breaks QCC2072 since it prefers SINGLE mode. Due to the unconditional
return, the subsequent EHT parsing is skipped. Consequently EHT related
features are disabled.
Refactor it by moving 320 MHz parsing to ath12k_wmi_tlv_mac_phy_caps_ext(),
before the mode checking. This makes the code more straightforward, and
work for both WCN7850 and QCC2072.
For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
supported modes to host, each mode is compared with the initial one
and if the priority of the new mode is higher, update the parameter
and store mode capability.
For WCN7850, this does not result in issue, as one of the supported
mode indeed has a higher priority. However the only available mode of
QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
comparison, hence mode capability is not stored. Subsequently driver
initialization fails.
Fix it by accepting a mode with the same priority.
However this is not the case for QCC2072 of which the TLV is 32 bit.
Refactor above functions to prepare for QCC2072 support, this is done by
removing TLV length assumption and offloading TLV decoding work to a newly
added callback _reo_status_dec_tlv_hdr. This way each chip can register
its own handler hence can do the work accordingly.
However this is not the case for QCC2072 of which the TLV is 32 bit,
meaning above functions don't work for it.
Rename/refactor above functions to prepare for QCC2072 support:
Rename the first one to ath12k_wifi7_hal_reo_init_cmd_ring_tlv64() to
better reflect what it is doing. There will be a 32 bit variant when
QCC2072 support is in place.
For the last ones, remove TLV length assumption and offload TLV encoding
work to a newly added callback _reo_cmd_enc_tlv_hdr. This way each chip
can register its own handler hence can do the work accordingly.
Baochen Qiang [Mon, 12 Jan 2026 07:36:21 +0000 (15:36 +0800)]
wifi: ath12k: refactor PCI window register access
Currently offset of PCI window register address is defined as 0x310c which
is same across existing chips. However QCC2072 has a different offset
0x3278.
In order to make the window selection logic work for QCC2072 as well,
change to initialize this parameter per device at the probe time.
wifi: ath11k: move .max_tx_ring to struct ath11k_hw_hal_params
".max_tx_ring" is an upper bounds to indexing ".tcl2wbm_rbm_map". It
is initialized in, core.c, a different file than the array. This
spaghetti-like relation is fragile and not obvious. Accidentally
setting ".max_tx_ring" too high leads to a hard to track out-of-
bounds access and memory corruption.
There is a small ambiguity on the meaning of "max_tx_ring":
- The highest ring, max=3 implies there are 4 rings (0, 1, 2, 3)
- The highest number to use for array indexing (there are 3 rings)
Clarify this dependency by moving ".max_tx_ring" adjacent to the array
".tcl2wbm_rbm_map", and name it "num_tx_rings". Use ARRAY_SIZE()
instead of #defines to initialize the length field.
The intent is to make the code easier to understand rather than fix
an existing bug.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251228151408.2116108-1-mr.nuke.me@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: Register handler for CFR capture event
Firmware sends CFR meta data through the WMI event
WMI_PEER_CFR_CAPTURE_EVENT. Parse the meta data coming from the firmware
and invoke correlate_and_relay function to correlate the CFR meta data
with the CFR payload coming from the other WMI event
WMI_PDEV_DMA_RING_BUF_RELEASE_EVENT.
Release the buffer to user space once correlate and relay return
success.
wifi: ath11k: Register relayfs entries for CFR dump
Provide a relayfs interface to collect the CFR dump from the user space.
'/sys/kernel/debug/ieee80211/phyX/ath11k/cfr_capture' is exposed to user
space to get CFR data.
CFR format to user space:
___________________________________________
| CFR header | CFR payload | CFR tail data |
|____________|_____________|_______________|
CFR header contains the following fields,
* Start magic number 0xDEADBEAF - 4 bytes
* vendor id - 4 bytes
* cfr metadata version - 1 byte
* cfr data version - 1 byte
* device type - 1 byte
* platform type - 1 byte
* CFR metadata length - 4 bytes
* metadata - 92 bytes
peer mac - 6 bytes
capture status - 1 byte (1 for success 0 for failure)
capture_bw - 1 byte
channel_bw - 1 byte
phy_mode - 1 byte
prim20_chan - 2 bytes
center_freq1 - 2 bytes
center_freq2 - 2 bytes
capture_mode - 1 byte
capture_type - 1 byte
sts_count - 1 byte
num_rx_chain - 1 byte
timestamp - 4 bytes
length - 4 bytes
chain_rssi - 32 bytes (4 bytes for each chain)
chain_phase - 16 bytes (2 bytes for each chain)
cfo_measurement - 4 bytes
agc_gain - 8 bytes (1 bytes for each chain)
rx_start_ts - 4 bytes
CFR payload:
CFR payload contains 8bytes of ucode header followed by the tone
information. Tone order is positive tones, followed by PHY memory
garbage, followed by negative tones. Dummy tones are uploaded to make
number of tones always integer number of 64. Number of tones is not
preamble type dependent.
Each CFR tone has 14-bit I component and 14-bit Q component and is sign
extended to 16-bit I/Q. Two tones are packed into one 64-bit unit as:
Mac address: mac address of the client.
Val: 0 - start CFR capture
1 - stop CFR capture
Periodicity: Periodicity at which hardware is expected to collect CFR
dump.
0 - single shot capture.
non zero - for Periodic captures (value must be multiple of 10 ms)
val: 0 - stop CFR capture
1 - start CFR capture
bw: CFR capture bandwidth
0 - 20MHZ
1 - 40MHZ
2 - 80MHZ
Periodicity: Periodicity at which hardware is expected to collect CFR
dump.
0 - single shot capture.
non zero - for Periodic captures (value must be multiple of 10 ms)
method: Method used by hardware to collect the CFR dump.
0 - from the ACKs of QOS NULL packets.
Also, send the required WMI commands to the firmware based on the CFR
configurations.
wifi: ath11k: Add initialization and deinitialization sequence for CFR module
Channel Frequency Response (CFR) module will be initialized only when
the following criteria passes:
* Enabled CFR support for the hardware through the hardware param
'cfr_support'
* WMI service enabled for the CFR support
'WMI_TLV_SERVICE_CFR_CAPTURE_SUPPORT'
Also, provide a configuration option CONFIG_ATH11K_CFR to enable CFR
feature support during the compilation time.
CFR module initialization includes Direct Buffer(DB) ring initialization
where hardware uses the DB ring buffers to copy CFR data to host.
Number of buffers and buffer size of the ring is based on the DB ring
capabilities advertised by the firmware through WMI service ready.
Also ring configurations are sent to firmware through
ath11k_dbring_wmi_cfg_setup().
Predefine ath11k_cfr_dma_hdr, ath11k_look_up_table, and ath11k_cfr
structs and fields for subsequent patches.
Fixes: 32f7b19668bd ("wifi: ath12k: support MLO as well if single_chip_mlo_support flag is set") Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251103-ath12-primary-link-wow-v1-1-3cf523dc09f0@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
pci_set_drvdata() is called twice in ath12k_pci_probe() with the
same pointer. Remove the earlier call so drvdata is set after
ath12k_base and ath12k_pci initialization is complete.
Having two calls might suggest that drvdata needs to be set early for
some reason, even though it is not used until after the 'ab' struct
ath12k_base is fully populated. Even though exact placement is
not critical, keeping a single pci_set_drvdata() at the end of
the initialization makes it clearer that drvdata points to a
fully initialized structure and avoids confusion for future changes.
Tested on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Chien Wong [Thu, 30 Oct 2025 14:30:41 +0000 (22:30 +0800)]
wifi: ath11k: fix comment typo in monitor mode handling
Correct a typo in the monitor mode comment where "it make" was mistakenly
used instead of "it doesn't make". The comment explains that the brief
period where monitor mode appears enabled before being removed is harmless
in practice.
Also, use more common phrase "in practice" instead of "in practise".
Qian Zhang [Thu, 8 Jan 2026 03:46:07 +0000 (11:46 +0800)]
wifi: ath11k: Fix failure to connect to a 6 GHz AP
STA fails to connect to a 6 GHz AP with the following errors:
ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1
wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING)
ath11k_reg_handle_chan_list() treats the update as redundant and
returns -EINVAL. That causes the connection attempt to fail.
Avoid unnecessary validation during association. Apply the regulatory
redundant check only when the power type is IEEE80211_REG_UNSET_AP,
which only occurs during core initialization.
Ross Vandegrift [Sun, 4 Jan 2026 01:00:34 +0000 (17:00 -0800)]
wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
to the appropriate quirk list. I've tested this patch on top of 6.18.2,
it fixes the issue for me on 21D4
Mark Pearson provided the other product IDs covering the second Z16 Gen1
and both Z13 Gen1 identifiers. They share the same firmware, and folks
in the bugzilla report do indeed see the problem on Z13.
Signed-off-by: Ross Vandegrift <ross@kallisti.us> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Randy Dunlap [Mon, 17 Nov 2025 02:02:13 +0000 (18:02 -0800)]
wifi: wil6210: fix a bunch of kernel-doc warnings
scripts/kernel-doc.py reports 51 kernel-doc warnings in wil6210.h.
Fix all kernel-doc warnings reported in wil6210.h.
Several comments are changed from "/**" to "/*" since it appears that
"/**" was used for many non-kernel-doc comments.
- add kernel-doc for missing function parameters
- add one function "Returns:"
- correct kernel-doc struct name to match actual struct name in 2 places
Randy Dunlap [Mon, 17 Nov 2025 02:02:50 +0000 (18:02 -0800)]
wifi: ath9k: fix kernel-doc warnings in common-debug.h
Modify kernel-doc comments in common-debug.h to avoid warnings:
Warning: drivers/net/wireless/ath/ath9k/common-debug.h:21 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:23 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:26 bad line:
decryption process completed
Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:28 bad line:
encountered an error
Fixes: 99c15bf575b1 ("ath9k: Report total tx/rx bytes and packets in debugfs.") Fixes: 1395d3f00a41 ("ath9k: Add debugfs file for RX errors") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20251117020251.447692-1-rdunlap@infradead.org Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Randy Dunlap [Mon, 17 Nov 2025 02:03:03 +0000 (18:03 -0800)]
wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats
Repair "bad line" warnings by starting each line with " *".
Add or correct kernel-doc entries for missing struct members in
struct ath_tx_stats.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:144 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:146 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:156 bad line:
Valid only for:
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:157 bad line:
- non-aggregate condition.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:158 bad line:
- first packet of aggregate.
Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
'xretries' not described in 'ath_tx_stats'
Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
'data_underrun' not described in 'ath_tx_stats'
Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
'delim_underrun' not described in 'ath_tx_stats'
Fixes: 99c15bf575b1 ("ath9k: Report total tx/rx bytes and packets in debugfs.") Fixes: fec247c0d5bf ("ath9k: Add debug counters for TX") Fixes: 5a6f78afdabe ("ath9k: show excessive-retry MPDUs in debugfs") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20251117020304.448687-1-rdunlap@infradead.org Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Add a description for ATH5K_DEBUG_ANI and delete the descriptions for
3 undefined enum descriptions to prevent these warnings:
Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Enum value
'ATH5K_DEBUG_ANI' not described in enum 'ath5k_debug_level'
Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Excess enum value
'%ATH5K_DEBUG_DUMP_RX' description in 'ath5k_debug_level'
Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Excess enum value
'%ATH5K_DEBUG_DUMP_TX' description in 'ath5k_debug_level'
Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Excess enum value
'%ATH5K_DEBUG_TRACE' description in 'ath5k_debug_level'
Ping-Ke Shih [Sat, 10 Jan 2026 02:20:18 +0000 (10:20 +0800)]
wifi: rtw89: mac: consider RTL8922D in MAC common flow
The MAC settings are different from RTL8922A to RTL8922D, including
scheduler, DLE, DCPU, MLO, NAV, TMAC, TX/RX protocol, RMAC, IMR, host RPT,
AMSDU. Update them accordingly.
projects / thirdparty / kernel / linux.git / log
