Thomas Gleixner [Sun, 17 May 2026 20:02:44 +0000 (22:02 +0200)]
genirq/proc: Runtime size the chip name
The chip name column in the /proc/interrupt output is 8 characters and
right aligned, which causes visual clutter due to the fixed length and the
alignment. Many interrupt chips, e.g. PCI/MSI[X] have way longer names.
Update the length when a chip is assigned to an interrupt and utilize this
information for the output. Align it left so all chip names start at the
begin of the column.
Update the GDB script as well and disentangle the header maze so it
actually works with all .config combinations.
Thomas Gleixner [Sun, 17 May 2026 20:02:29 +0000 (22:02 +0200)]
genirq/proc: Increase default interrupt number precision to four
Quite some architectures have four character wide acronyms for architecture
specific interrupts like IPI, NMI, etc.
The default precision of printing the Linux device interrupt numbers is
three, which causes quite some code to play games with adding or omitting
space after the acronym and the colon in order to keep the per CPU numbers
properly aligned.
Increase the default number precision to four in the core code and get rid
of the space games all over the place. At the same time align all
architecture specific descriptor texts left so that they show up in the
same column as the interrupt chip names, which makes the output more
uniform accross architectures. Fix up the GDB script to this new scheme as
well.
Thomas Gleixner [Sun, 17 May 2026 20:02:24 +0000 (22:02 +0200)]
genirq: Calculate precision only when required
Calculating the precision of the interrupt number column on every initial
show_interrupt() invocation is a pointless exercise as the underlying
maximum number of interrupts rarely changes.
Calculate it only when that number is modified and let show_interrupts()
use the cached value.
Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com> Reviewed-by: Radu Rendec <radu@rendec.net> Link: https://patch.msgid.link/20260517194931.760664517@kernel.org
Thomas Gleixner [Sun, 17 May 2026 20:02:14 +0000 (22:02 +0200)]
genirq/manage: Make NMI cleanup RT safe
Eventually blocking functions cannot be invoked with interrupts disabled
and a raw spin lock held. Restructure the code so this happens outside of
the descriptor lock held region.
Thomas Gleixner [Sun, 17 May 2026 20:02:04 +0000 (22:02 +0200)]
scripts/gdb: Update x86 interrupts to the array based storage
x86 changed the interrupt statistics from a struct with individual members
to an counter array. It also provides a corresponding info array with the
strings for prefix and description and an indicator to skip the entry.
Update the already out of sync GDB script to use the counter and the info
array, which keeps the GDB script in sync automatically.
Thomas Gleixner [Sun, 17 May 2026 20:01:59 +0000 (22:01 +0200)]
x86/irq: Move IOAPIC misrouted and PIC/APIC error counts into irq_stats
The special treatment of these counts is just adding extra code for no real
value. The irq_stats mechanism allows to suppress output of counters, which
should never happen by default and provides a mechanism to enable them for
the rare case that they occur.
Move the IOAPIC misrouted and the PIC/APIC error counts into irq_stats,
mark them suppressed by default and update the sites which increment them.
This changes the output format of 'ERR' and 'MIS' in case there are events
to the regular per CPU display format and otherwise suppresses them
completely.
As a side effect this removes the arch_cpu_stat() mechanism from proc/stat
which was only there to account for the error interrupts on x86 and missed
to take the misrouted ones into account.
Thomas Gleixner [Sun, 17 May 2026 20:01:54 +0000 (22:01 +0200)]
x86/irq: Suppress unlikely interrupt stats by default
Unlikely interrupt counters like the spurious vector and the synthetic APIC
ICR read retry show up in /proc/interrupts with all counts 0 most of the
time.
As these are events which should never happen, suppress them by default and
enable them for output when they actually happen.
This requires a seperate bitmap as the description array is marked
__ro_after_init. With that bitmap in place it becomes RO data.
Thomas Gleixner [Sun, 17 May 2026 20:01:48 +0000 (22:01 +0200)]
x86/irq: Make irqstats array based
Having the x86 specific interrupt statistics as a data structure with
individual members instead of an array is just stupid as it requires
endless copy and paste in arch_show_interrupts() and arch_irq_stat_cpu(),
where the latter does not even take the latest interrupt additions into
account. The resulting #ifdef orgy is just disgusting.
Convert it to an array of counters, which does not make a difference in the
actual interrupt hotpath increment as the array index is constant and
therefore not any different than the member based access.
But in arch_show_interrupts() and arch_irq_stat_cpu() this just turns into
a loop, which reduces the text size by ~2k (~12%):
text data bss dec hex filename
19643 15250 904 35797 8bd5 ../build/arch/x86/kernel/irq.o
17355 15250 904 33509 82e5 ../build/arch/x86/kernel/irq.o
Adding a new vector or software counter only requires to update the table
and everything just works. Using the core provided emit function which
speeds up 0 outputs makes it significantly faster.
Thomas Gleixner [Sun, 17 May 2026 20:01:43 +0000 (22:01 +0200)]
genirq/proc: Utilize irq_desc::tot_count to avoid evaluation
Interrupts which are not marked per CPU increment not only the per CPU
statistics, but also the accumulation counter irq_desc::tot_count.
Change the counter to type unsigned long so it does not produce sporadic
zeros due to wrap arounds on 64-bit machines and do a quick check for non
per CPU interrupts. If the counter is zero, then simply emit a full set of
zero strings. That spares the evaluation of the per CPU counters completely
for interrupts with zero events.
Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com> Reviewed-by: Radu Rendec <radu@rendec.net> Link: https://patch.msgid.link/20260517194931.115522199@kernel.org
Thomas Gleixner [Sun, 17 May 2026 20:01:38 +0000 (22:01 +0200)]
genirq/proc: Avoid formatting zero counts in /proc/interrupts
A large portion of interrupt count entries are zero. There is no point in
formatting the zero value as it is way cheeper to just emit a constant
string.
Collect the number of consecutive zero counts and emit them in one go
before a non-zero count and at the end of the line.
Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com> Reviewed-by: Radu Rendec <radu@rendec.net> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20260517194931.034728540@kernel.org
Dmitry Ilvokhin [Sun, 17 May 2026 20:01:33 +0000 (22:01 +0200)]
x86/irq: Optimize interrupts decimals printing
Monitoring tools periodically scan /proc/interrupts to export metrics as a
timeseries for future analysis and investigation.
In large fleets, /proc/interrupts is polled (often every few seconds) on
every machine. The cumulative overhead adds up quickly across thousands
of nodes, so reducing the cost of generating these stats does have a
measurable operational impact. With the ongoing trend toward higher core
counts per machine, this cost becomes even more noticeable over time,
since interrupt counters are per-CPU. In Meta's fleet, we have observed
this overhead at scale.
Although a binary /proc interface would be a better long-term solution
due to lower formatting (kernel side) and parsing (userspace side)
overhead, the text interface will remain in use for some time, even if
better solutions will be available. Optimizing the /proc/interrupts
printing code is therefore still beneficial.
Function seq_printf() supports rich format string for decimals printing,
but it doesn't required for printing /proc/interrupts per CPU counters,
seq_put_decimal_ull_width() function can be used instead to print per
CPU counters, because very limited formatting is required for this case.
Similar optimization idea is already used in show_interrupts().
As a side effect this aligns the x86 decriptions with the generic
interrupts event descriptions.
Performance counter stats (truncated) for 'sh -c cat /proc/interrupts
Arnd Bergmann [Tue, 26 May 2026 10:19:37 +0000 (12:19 +0200)]
regulator: mt6363: select CONFIG_IRQ_DOMAIN
When build-testing this driver without CONFIG_IRQ_DOMAIN causes
a compile-time error:
drivers/regulator/mt6363-regulator.c: In function 'mt6363_regulator_probe':
drivers/regulator/mt6363-regulator.c:884:18: error: implicit declaration of function 'irq_find_host' [-Wimplicit-function-declaration]
884 | domain = irq_find_host(interrupt_parent);
| ^~~~~~~~~~~~~
drivers/regulator/mt6363-regulator.c:884:16: error: assignment to 'struct irq_domain *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
884 | domain = irq_find_host(interrupt_parent);
| ^
drivers/regulator/mt6363-regulator.c:896:30: error: implicit declaration of function 'irq_create_fwspec_mapping'; did you mean 'irq_create_of_mapping'? [-Wimplicit-function-declaration]
896 | info->virq = irq_create_fwspec_mapping(&fwspec);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
| irq_create_of_mapping
This is rather hard to trigger because so many other drivers
enable IRQ_DOMAIN already, but I ran into this on an s390
randconfig build.
Ensure this is always enabled using a Kconfig 'select IRQ_DOMAIN'
entry, as we do for all other users of this.
Fixes: 3c36965df808 ("regulator: Add support for MediaTek MT6363 SPMI PMIC Regulators") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260526102003.2527570-1-arnd@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
Dongyang Jin [Thu, 21 May 2026 09:45:45 +0000 (17:45 +0800)]
drm/panel: fix kernel-doc warning for devm_drm_panel_add()
Use the correct kernel-doc notation for struct members to eliminate
kernel-doc warnings:
Warning: drivers/gpu/drm/drm_panel.c:119 function parameter 'dev'
not described in 'devm_drm_panel_add'
Warning: drivers/gpu/drm/drm_panel.c:119 function parameter 'dev'
not described in 'devm_drm_panel_add'
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605210648.RI4ufD66-lkp@intel.com/ Signed-off-by: Dongyang Jin <jindongyang@kylinos.cn> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260521094545.3039207-1-jindongyang@kylinos.cn
s390/ism: Drop superfluous zeros in pci_device_id array
The .driver_data member of the struct pci_device_id array were
initialized by a list expressions to zero without making use of that
value. In this case it's better to not specify a value at all and let
the compiler fill in the zeros. Same for the list terminator that can
better be completely empty.
This patch doesn't introduce changes to the compiled array.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Breno Leitao <leitao@debian.org> Acked-by: Alexandra Winter <wintera@linux.ibm.com> Link: https://patch.msgid.link/20260522153010.777081-2-u.kleine-koenig@baylibre.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Rosen Penev [Sun, 10 May 2026 21:39:48 +0000 (14:39 -0700)]
PM: hibernate: Use flexible array for CRC uncompressed buffers
The CRC uncompressed buffer pointer array has the same lifetime as
struct crc_data, but it is currently allocated separately. That adds
another allocation failure path and a matching cleanup branch without
providing any extra flexibility.
Store the pointer array as a flexible array member and allocate it
together with the crc_data using kzalloc_flex(). The array remains
zero-initialized, while the allocation and error handling become
simpler.
Trevor Gamblin [Wed, 20 May 2026 13:06:23 +0000 (15:06 +0200)]
riscv: dts: spacemit: k1-musepi-pro: add SD card support with UHS modes
Update the Muse Pi Pro devicetree with SD card support to match what
was done for the OrangePi RV2 in [1]. More precisely:
- Enable sdhci0 controller with 4-bit bus width
- Configure card detect GPIO with internal pull-up support
- Connect vmmc-supply to buck4 for 3.3V card power
- Connect vqmmc-supply to aldo1 for 1.8V/3.3V I/O switching
- Add dual pinctrl states for voltage-dependent pin configuration
- Support UHS-I SDR25, SDR50, and SDR104 modes
- Add stable MMC device aliases (mmc0 = eMMC, mmc1 = SD card)
Björn Töpel [Fri, 22 May 2026 12:06:40 +0000 (14:06 +0200)]
net: Avoid checksumming unreadable skb tail on trim
pskb_trim_rcsum_slow() keeps CHECKSUM_COMPLETE valid by subtracting
the checksum of the bytes removed from the skb tail. That assumes the
removed bytes can be read.
io_uring zcrx skbs may contain unreadable net_iov frags. With fbnic
header/data split, small TCP/IPv4 packets can carry Ethernet padding
in such a frag. ip_rcv_core() trims the skb to iph->tot_len before TCP
sees it, and the CHECKSUM_COMPLETE adjustment then calls
skb_checksum() on the padding.
This is exposed by IPv4 because small TCP/IPv4 frames can be shorter
than the Ethernet minimum payload. TCP/IPv6 frames are large enough in
the normal zcrx path, so they do not hit the same padding trim.
Keep the existing checksum adjustment for readable skbs. If the
remaining packet is fully linear, drop CHECKSUM_COMPLETE and let the
stack validate the packet after trimming. If unreadable payload would
remain, fail the trim; the checksum cannot be adjusted without reading
the trimmed tail.
Also clear skb->unreadable when trimming removes all frags.
Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Signed-off-by: Björn Töpel <bjorn@kernel.org> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260522120643.242974-1-bjorn@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Jani Nikula [Sat, 16 May 2026 10:18:52 +0000 (13:18 +0300)]
drm/i915: relocate intel_hpd_cancel_work() call
The i915 and xe calls to display, in particular for
probe/cleanup/suspend/resume, need to be unified. It does not help to
have the related calls scattered around. As a small step forward,
relocate the intel_hpd_cancel_work() call from intel_irq_uninstall() to
i915_driver_remove().
Note that the other intel_irq_uninstall() call sites don't need the
call, as they're on error paths where hotplug hasn't been enabled yet.
thunderbolt: Limit XDomain response copy to actual frame size
tb_xdomain_copy() copies req->response_size bytes from the received
packet buffer regardless of the actual frame size. When a short
response arrives, this reads past the valid frame data in the DMA
pool buffer into stale contents from previous transactions.
Use the minimum of frame size and expected response size for the
copy length.
Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Validate XDomain request packet size before type cast
tb_xdp_handle_request() casts the received packet buffer to
protocol-specific structs without verifying that the allocation
is large enough for the target type. A peer can send a minimal
XDomain packet that passes the generic header length check but is
shorter than the struct accessed after the cast, causing out-of-
bounds reads from the kmemdup allocation.
Plumb the packet length through xdomain_request_work and validate
it against the expected struct size before each cast.
Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding") Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Clamp XDomain response data copy to allocation size
tb_xdp_properties_request() derives the per-packet copy length from
the response header without checking that it fits in the previously
allocated data buffer. A malicious peer can set its length field
larger than the declared data_length, causing memcpy to write past
the kcalloc allocation.
Clamp the per-packet copy length so that the cumulative offset
never exceeds data_len.
Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Bound root directory content to block size
__tb_property_parse_dir() does not check that content_offset +
content_len fits within block_len for the root directory case.
When rootdir->length equals or exceeds block_len - 2, the entry
loop reads past the allocated property block.
Add a bounds check after computing content_offset and content_len
to reject directories whose content extends past the block.
Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Reject zero-length property entries in validator
tb_property_entry_valid() accepts entries with length == 0 for
DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes
validation but causes an underflow in the null-termination logic:
When property->length is 0 this writes to offset -1 relative to
the allocation.
Reject zero-length entries early in the validator since they have no
valid representation in the XDomain property protocol.
Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Jason Gunthorpe [Tue, 26 May 2026 01:22:40 +0000 (22:22 -0300)]
RDMA/core: Make a new module for the uverbs components needed by drivers
To maintain the split where ib_uverbs.ko should not be depended on by
drivers, add a new module ib_uverbs_support.ko which contains the driver
called functions that are too large or too rare to be placed in
ib_uverbs_core.ko
Start by moving most of rdma_core.c into this module, making some
adjustments to split it from the actual uverbs FD code.
This was not done originally because we lacked EXPORT_SYMBOL_NS and I had
a fear that drivers would abuse this interface surface.
Jason Gunthorpe [Tue, 26 May 2026 01:22:39 +0000 (22:22 -0300)]
RDMA/core: Remove uverbs_async_event_release()
Instead of having an alternative fops release always use the standard
uverbs_uobject_fd_release() and route the special async behavior back up
through uverbs_obj_fd_type ops pointer.
This removes a dependency where the technically lower level rdma_core.c is
referring to a symbol from uverbs_std_types_async_fd.c.
Jason Gunthorpe [Tue, 26 May 2026 01:22:37 +0000 (22:22 -0300)]
RDMA/core: Do not compile ib_core_uverbs without USER_ACCESS
Remove the entire ib_core_uverbs.c from the build if
CONFIG_INFINIBAND_USER_ACCESS is not set. These functions are only used to
support uverbs and are never callable even if they happen to get linked
in.
Provide inlines for the missing ones to return errors to further push code
elimination in drivers.
Sumeet Pawnikar [Fri, 15 May 2026 18:26:16 +0000 (23:56 +0530)]
powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()
When topology_physical_package_id()/topology_logical_die_id() returns
a negative value, rapl_add_package_cpuslocked() returns ERR_PTR(-EINVAL)
directly without freeing the rapl_package structure that was just
allocated by kzalloc_obj(), leaking memory on every failed package
addition.
Use the existing err_free_package label so that the allocation is
released on the error path.
Johannes Berg [Sun, 17 May 2026 07:59:59 +0000 (10:59 +0300)]
wifi: iwlwifi: transport: add memory read under NIC access
Add functions to be able to do memory read under NIC access,
in order to use them later during firmware dump. These may
drop and re-acquire the spinlock, but will not acquire and
release the NIC access.
Johannes Berg [Sun, 17 May 2026 07:59:58 +0000 (10:59 +0300)]
wifi: iwlwifi: dbg: remove unused 'range_len' arg from dump
None of the functions use this, and it's not really passed the
length of the specific range anyway, but rather the entire
remaining size. Remove the unused argument.
Johannes Berg [Sun, 17 May 2026 07:59:57 +0000 (10:59 +0300)]
wifi: iwlwifi: fw: separate out old-style dump code
There are two dump paths: new "ini" style, and the old,
more driver-centric, way. Separate out the code for the
old way into a separate dbg-old.c file, to simplify.
Johannes Berg [Sun, 17 May 2026 07:59:56 +0000 (10:59 +0300)]
wifi: iwlwifi: fw: dbg: always use non-tracing PRPH access
The iwl_{read,write}_prph_no_grab() functions will trace each
access, but in debug dump a lot of accesses already use the
transport versions of these functions directly. Since the data
(register addresses and their content) is going into the dump
file, tracing isn't really needed. Use the transport functions
in all places.
Johannes Berg [Sun, 17 May 2026 07:59:53 +0000 (10:59 +0300)]
wifi: iwlwifi: clean up location format/BW encoding
This is all fairly manual, with the shifts etc., and
the documentation has to call out the specific bits
(which also isn't usable for our tracing data). Add
an enum that directly declares the bit masks for it
and then use the more modern u8_encode_bits().
wifi: iwlwifi: move iwl_trans_activate_nic to iwl-trans.c
This function reaches the transport eventually so move it to
iwl-trans.c. Now we can remove the include to the pcie transport's
internal header from iwl-io.c
wifi: iwlwifi: move pcie content to pcie internal transport
The iwl_txq, iwl_pcie_first_tb_buf and iwl_pcie_txq_entry don't need to
be exported to the op_mode in iwl-trans.h. Declare those in the
transport's internal header file to avoid pollution.
iwl_trans_pcie_send_hcmd can also be moved to the internal header file.
Avinash Bhatt [Sun, 17 May 2026 07:59:49 +0000 (10:59 +0300)]
wifi: iwlwifi: mld: keep healthy link on EMLSR missed beacon exit
When EMLSR exits due to beacon loss on the current link, the driver
should keep the link that is still receiving beacons. The previous
code always called get_primary_link(), keeping the primary link
regardless of which link is actually losing beacons. If the primary
link is the one losing beacons, the driver exits EMLSR onto the
degraded link and the connection is lost eventually.
When both links lose beacons, keep the primary link. When only the
current link loses beacons -- whether due to signal loss or a BSS
parameter change -- keep the other link.
Avinash Bhatt [Sun, 17 May 2026 07:59:48 +0000 (10:59 +0300)]
wifi: iwlwifi: mld: skip MLO scan trigger when AP has no QBSS Load IE
When FW PHY statistics report high channel load (MCLM), the driver
triggers an internal MLO scan to find a better link. However, link grade
computation uses the QBSS Load IE from AP beacons, not MCLM data. If
the AP does not broadcast a QBSS Load IE, the scan produces no benefit
as the grade falls back to static band defaults regardless, and the same
bad link will be selected anyway as the active link.
Skip the MLO scan trigger when the AP does not advertise a QBSS Load IE.
Miri Korenblit [Sun, 17 May 2026 07:59:46 +0000 (10:59 +0300)]
wifi: iwlwifi: mld: purge async notifications upon nic error
This fixes a kernel panic in reconfig failure:
1. we have a BSS connection
2. we have a NAN connection
3. FW error occurs
4. reconfig restores the BSS connection
5. however, restoring the NAN connection fails due to a FW error.
6. erroneously, ieee80211_handle_reconfig_failure is called and marks all
interfaces as not-in-driver (will be fixed in a different patch).
7. mac80211 frees the links of the BSS connection but doesn't tell the
driver about that, as it thinks that this vif is not in the driver.
8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed
(erroneously?)
9. Therefore, async_handlers_wk is being executed, processing the
statistics notification that was received after we restored the BSS
connection.
10. the notification handler dereferences fw_id_to_bss_conf[id], which is
now a dangling pointer, as mac80211 already freed this link in (7).
11. On the first access to one of the links fields, we panic.
While this can and should be fixed by removing the call to
ieee80211_handle_reconfig_failure in (6), it is also not a good idea to
carry and maybe handle notifications from a dead FW.
We do purge the notifications when we stop the FW, but in reconfig
failure we stop the FW too late, after the notifications are processed.
In addition, async_handlers_wk can always be scheduled before the
reconfig work.
Purge the notifications immediately when transport notifies about a nic
error.
Miri Korenblit [Sun, 17 May 2026 07:59:45 +0000 (10:59 +0300)]
wifi: iwlwifi: mld: don't flush async_handlers_wk when canceling notifications
iwl_mld_cancel_async_notifications does 2 things: it purges the list of
notifications and flushes the async_handlers_wk.
We call iwl_mld_cancel_async_notifications after we stopped or suspended
the fw. So in that stage we don't expect any new notification coming,
and if erroneously there are new notifications coming, the work will be
queued again anyway, so the flush is pretty much pointless.
iwl_mld_cancel_async_notifications will need to be called in a context
w/o the wiphy lock held, and the only reason why this function requires
the lock being held is for flushing the work.
wifi: iwlwifi: mld: disallow puncturing in US/CA for WH
FM continues to follow the BIOS/MCC policy, while WH sets
DISALLOW_PUNCTURING for US/CA and clears it for other MCC values.
Update the MCC handling accordingly.
Johannes Berg [Fri, 15 May 2026 12:09:43 +0000 (15:09 +0300)]
wifi: iwlwifi: mld: add link and link station FW IDs to debugfs
Add the link and link station FW IDs to debugfs to aid debug
and testing, since assignments can't be known ahead of time,
especially with ID randomisation turned on.
Ilan Peer [Fri, 15 May 2026 12:09:41 +0000 (15:09 +0300)]
wifi: iwlwifi: mld: Disallow using a per-STA GTK for Tx
When a GTK is configured for a station, it can only be used for Rx
and never for Tx. In such a case, set the IWL_SEC_KEY_FLAG_NO_TX
flag when the key is installed, so the FW will not use it for Tx.
Specifically, this is needed for per-station GTK installed on NAN
NDI stations associated with NAN Data interfaces.
Miri Korenblit [Fri, 15 May 2026 12:09:38 +0000 (15:09 +0300)]
wifi: iwlwifi: mld: evacuate NAN channels on link switch
The FW API doesn't allow a station (of certain types, including
STATION_TYPE_PEER) to not be correlated to any link. Therefore,
when switching links, mac80211 first adds the new link and then
removes the old one.
In case we have a NAN interface that operates on 3 links and a
BSS interface that operates on the 4th link, there won't be any
room to perform a link switch that temporarily needs two links
for the BSS interface, but the firmware only has four total.
To mitigate this, try to evacuate a NAN channel in this scenario:
First try to evacuate a NAN channel using the same phy as the BSS
link being deactivated, since we expect NAN to follow the BSS
channel configuration. If that doesn't work, try to evacuate any
NAN channel.
Avraham Stern [Fri, 15 May 2026 12:09:34 +0000 (15:09 +0300)]
wifi: iwlwifi: mld: nan: add availability attribute to schedule config
Add the availability attribute to the schedule config command. The
firmware needs to add this attribute to schedule update frames
(e.g. when ULW changed or the local schedule changed).
Johannes Berg [Wed, 13 May 2026 05:44:02 +0000 (08:44 +0300)]
wifi: iwlwifi: mld: set correct key mask for NAN
For NAN data, the supplicant may derive and install GTKs to
transmit with. As multicast data encryption is supported only
with firmware versions that support adding NAN multicast
data station, allow GTK installation only with such FW
versions. Otherwise, do not install the GTK to the device.
For NAN management, there are no GTKs, but there are IGTKs
and BIGTKs, which need to be installed for the NAN broadcast
and NAN management stations. This is supported only with
firmware versions that allow adding NAN broadcast station
and NAN management station.
Handle both of these cases by adjusting the station mask
appropriately, returning a zero station mask for the GTK
and allowing that to not be an error/warning message.
Ilan Peer [Wed, 13 May 2026 05:44:01 +0000 (08:44 +0300)]
wifi: iwlwifi: mld: Add support for NAN multicast data
The FW added a new station type to allow NAN multicast
data to be transmitted. The queue of the station is
opened by the firmware when all the NAN Peer NDI stations
associated with the NDI are scheduled at the same time.
Add the corresponding support in iwlmld:
- When a NAN data interface is added, add a NAN multicast
data station and allocate a queue to it.
- When a NAN data interface is removed, remove the NAN
multicast station.
- On the Tx path, when a multicast data frame is received
on a NAN data interface, direct it to the NAN multicast
data queue.
Miri Korenblit [Wed, 13 May 2026 05:43:59 +0000 (08:43 +0300)]
wifi: iwlwifi: define MODULE_FIRMWARE with the correct API
A firmware API of a mix and match (MAC + RF) is the lower one of the
two. But the MODULE_FIRMWARE of QU/QUZ/SO/MA/TY with GF/HR, was defined
using the max API of GF/HR, which is 100, instead of the max API of
QU/QUZ/SO/MA/TY, which are API 77/89.
Therefore, the wrong firmware files were published in the modinfo,
leading to missing firmware files.
Fix this by using the right API when declaring MODULE_FIRMWARE.
While at it, add a IWL_FW_AND_PNVM entry for SO and GF4, that was
missing.
Avinash Bhatt [Wed, 13 May 2026 05:43:57 +0000 (08:43 +0300)]
wifi: iwlwifi: mld: update link grading tables per bandwidth
Replace single RSSI-to-grade table with separate tables for each
operational bandwidth. Grade selection now depends on both RSSI and
the link's operational bandwidth.
Improve puncturing penalty calculation to apply proportional reduction
based on unusable spectrum percentage rather than absolute channel count.
Update existing KUnit tests with RSSI values for new grading tables.
Johannes Berg [Wed, 13 May 2026 05:43:55 +0000 (08:43 +0300)]
wifi: iwlwifi: mld: give link STA debugfs files a namespace
The generated data structures and function names used are
just the debugfs filename, which is a shared namespace and
could lead to confusion. Prefix these with "link_sta_" to
disambiguate.
Johannes Berg [Wed, 13 May 2026 05:43:54 +0000 (08:43 +0300)]
wifi: iwlwifi: mld: implement UHR DPS
For UHR, implement dynamic power save (DPS). Since the firmware
handles most of it, simply advertise DPS capability and set the
corresponding link flag when the AP has advertised that it is a
DPS assisting AP.
wifi: iwlwifi: max_event_log_size is needed for iwldvm only
This is used to set init_evtlog_size and inst_evtlog_size in case those
are not advertised by the firmware's TLVs.
Those two fields are used only in iwldvm.
Avinash Bhatt [Tue, 12 May 2026 19:34:41 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: Add KUnit tests for channel-load thresholds
Add a KUnit test suite for iwl_mld_chan_load_requires_scan,
covering level-up, level-down, and no-change transitions.
The test directly sets channel-load values, validating
scan-trigger decisions and updated load levels
Ilan Peer [Tue, 12 May 2026 19:34:40 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: Add support for multiple NAN Management stations
The following limitations arise from the current FW support for NAN:
- While NAN synchronization and discovery beacons are sent
internally by the firmware, the BIGTK is configured to the
auxiliary station associated with the NAN operation. Thus,
the beacons are transmitted unprotected.
- The auxiliary station cannot be configured with support for
management frame protection as this is not supported by the
firmware. Thus, there is no way to protect the SDFs and the
NAFs.
To overcome the above limitations the firmware introduced the
following new station types:
- NAN broadcast station: Used for NAN synchronization and
discovery. i.e., used for beacon transmissions. A BIGTK
can be configured to this station and thus beacons can
be transmitted with protection.
- NAN management station: Used for sending SDFs and NAFs.
This station can be configured with support for management
frame protection etc.
Modify the iwlmld logic to support the older and the newer
firmware designs. As no Tx queue is needed for the NAN
broadcast station, modify the internal station support
to allow adding/removing a station without a queue. In
addition, since no links are associated with these stations,
modify the internal station support to allow adding a station
without a link mask.
Avraham Stern [Tue, 12 May 2026 19:34:39 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: add support for nan schedule config command version 2
Version 2 of the NAN schedule config command adds support for deferred
schedule update and passing the availability attribute blob to
firmware.
Add support for the new command version. Currently the new
functionality is not supported.
For 6 GHz duplicated beacons, the RSSI is measured only on the 20 MHz
primary channel while the actual beacon energy spans the full
operational bandwidth. This leads to underestimated link quality.
Detect duplicated beacons and apply bandwidth-based RSSI adjustments.
Add support for a new RSC notification that arrives on DATA queues.
The same RSC handling previously done in the WOWLAN flow is now done
through this notification, with backward compatibility maintained.
Avinash Bhatt [Tue, 12 May 2026 19:34:36 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: add chan-load hysteresis for MLO scan triggers
Introduce a three-level, table-driven hysteresis mechanism for
deciding when to trigger internal MLO scans based on MCLM Chan
Load. Prevents repeated triggers under fluctuating load conditions.
Daniel Gabay [Tue, 12 May 2026 19:34:35 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: validate aux sta before flush in stop_nan
iwl_mld_stop_nan() calls iwl_mld_flush_link_sta_txqs() without checking
that aux_sta.sta_id is valid. The DW end handler correctly guards this
with a WARN_ON check. Add the same defensive check to stop_nan for
consistency and to avoid sending a flush command with an invalid sta_id.
Daniel Gabay [Tue, 12 May 2026 19:34:34 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: add NULL check for channel in DW end handler
ieee80211_get_channel() can return NULL if the frequency is not
registered in the wiphy (e.g. due to regulatory domain restrictions).
The returned channel pointer is passed directly to
cfg80211_next_nan_dw_notif() which dereferences it unconditionally
in both the tracepoint and the netlink message, causing a NULL
pointer dereference.
Add a NULL check before using the channel pointer.
Daniel Gabay [Tue, 12 May 2026 19:34:33 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: fix NAN DW end notification handler
Use IWL_DEBUG_INFO instead of IWL_INFO for logging the DW end
notification, as this is a recurring event during NAN operation
and should not spam the kernel log.
Also fix a coding style issue - missing space after 'if'.
Avinash Bhatt [Tue, 12 May 2026 19:34:32 +0000 (22:34 +0300)]
wifi: iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3
uAPSD is transitioning to a certification-only feature. The new
firmware API version 3 removes advanced uAPSD fields, keeping only
basic parameters needed for certification testing.
Support the new VER_3 API in the MLD driver while maintaining
backward compatibility with VER_1/2. The MVM driver continues
using VER_2 only. Remove the obsolete PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION
notification from the MLD driver
Avraham Stern [Tue, 12 May 2026 19:34:31 +0000 (22:34 +0300)]
wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only
The driver supports intalling IGTK on a NAN device interface. When
the IGTK is removed, iwl_mld_free_ap_early_key() is called which
results in a warning since no links are attached to this interface.
The iwl_mld_free_ap_early_key() function should be called for AP or
IBSS interfaces only. Check the interface type before calling it.
Johannes Berg [Tue, 12 May 2026 19:34:30 +0000 (22:34 +0300)]
wifi: iwlwifi: set state to NO_FW on reset
On debugfs reset, set the transport FW state to NO_FW
so that the restart won't attempt to send commands,
which of course fails because the FW was killed during
the error dump.
Use iwl_trans_fw_error() now since that's effectively
the same as the old code plus setting the state.
Johannes Berg [Tue, 12 May 2026 19:34:29 +0000 (22:34 +0300)]
wifi: iwlwifi: define new FSEQ TLV with MAC ID
Some firmware files can be used for different MACs, for example
for sc2/sc2f, yet might have different FSEQ versions. The files
will then contain multiple bigger FSEQ TLVs indicating the MAC
ID in addition to the version.
For now, since we don't parse this, define only the new format.
Johannes Berg [Tue, 12 May 2026 19:34:28 +0000 (22:34 +0300)]
wifi: iwlwifi: tighten flags in debugfs command sending
The only flags that could reasonably be used here are
CMD_WANT_SKB and CMD_ASYNC, CMD_SEND_IN_RFKILL doesn't
really make sense and CMD_BLOCK_TXQS just triggers a
warning, as does CMD_WANT_SKB | CMD_ASYNC.
Clear CMD_WANT_SKB since the response SKB isn't used
anyway, and refuse flags other than CMD_ASYNC to avoid
the warnings or other issues.
projects / thirdparty / kernel / linux.git / log
