summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-28pinctrl: qcom: Unify user-visible "Qualcomm" nameKrzysztof Kozlowski
Various names for Qualcomm as a company are used in user-visible config options: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified "Qualcomm" so it will be easier for users to identify the options when for example running menuconfig. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> [linusw@kernel.org: Also fix the new IPQ9650] Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: pinconf-generic: fix properties bitmap leak in parse_fw_cfg()Felix Gu
In parse_fw_cfg(), if fwnode_property_match_property_string() fails with -ENOENT, the code returns directly and leaks the bitmap. Use __free(bitmap) for automatic cleanup to fix the leak. Fixes: 9c105255108b ("pinctrl: pinconf-generic: perform basic checks on pincfg properties") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: qcom: eliza: Split QUP1_SE4 lanesAlexander Koskovich
QUP1_SE4 shares GPIO_36 & GPIO_37 for both L0/L1 and L3/L2 so the function name cannot be the same or the alternate function cannot be selected. Split them up into individual lane functions so boards can specify. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: qcom: eliza: Split QUP lane mirror alternatesAlexander Koskovich
Several QUP lanes have MIRA/MIRB mirror routings which are collapsed under a single function name (e.g. qup1_se6). This is an issue because it means there are multiple functions defined for a given pin that share the same name: [42] = PINGROUP(42, qup1_se6, qup1_se2, qup1_se6... So when you select pin 42 and request function qup1_se6, it will select the first instance of it in this group, which just happens to be QUP1_SE6_L2, making the second instance (QUP1_SE6_L1_MIRA) effectively unreachable. Split each of these lanes that has an alternative GPIO into their own function so they can actually be selected, following the pattern seen in pinctrl-sm8550.c. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28dt-bindings: pinctrl: qcom,eliza-tlmm: Split QUP1_SE4 lanesAlexander Koskovich
QUP1_SE4 shares GPIO_36 & GPIO_37 for both L0/L1 and L3/L2 so the function name cannot be the same or the alternate function cannot be selected. Split them up into individual lane functions so boards can specify. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28dt-bindings: pinctrl: qcom,eliza-tlmm: Split QUP lane mirror alternatesAlexander Koskovich
Several QUP lanes have MIRA/MIRB mirror routings that let the same lane be muxed out on alternative GPIOs. On Eliza these were all collapsed under the base function name (e.g. qup1_se6), which prevented boards from selecting the mirror variants. Add explicit function names for each mirror lane, matching the pattern already established by qcom,sm8550-tlmm and related bindings. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup namesAlexander Koskovich
Fix a few typos for these in their respective pingroups, the groups already exist they just weren't referenced. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Fixes: 6f26989e15fb ("pinctrl: qcom: Add Eliza pinctrl driver") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: pinconf-generic: Use kmemdup_array() over kmemdup()Yash Suthar
using kmemdup_array instead of kmemdup ,as it is more readable and matches the intent of the api. tested with w=1, no new warnings introduced. Signed-off-by: Yash Suthar <yashsuthar983@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: qcom: Introduce IPQ9650 TLMM driverKathiravan Thirumoorthy
Qualcomm's IPQ9650 comes with a TLMM block, like all other platforms, so add a driver for it. Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28dt-bindings: pinctrl: qcom: add IPQ9650 pinctrlKathiravan Thirumoorthy
Add device tree bindings for IPQ9650 TLMM block. Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnelsAndrea Mayer
seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() unconditionally. On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can release the underlying pcpu_rt between the lookup and the caching through a concurrent FIB lookup on a shared nexthop. Simplified race sequence: ksoftirqd/X higher-prio task (same CPU X) ----------- -------------------------------- seg6_input_core(,skb)/rpl_input(skb) dst_cache_get() -> miss ip6_route_input(skb) -> ip6_pol_route(,skb,flags) [RT6_LOOKUP_F_DST_NOREF in flags] -> FIB lookup resolves fib6_nh [nhid=N route] -> rt6_make_pcpu_route() [creates pcpu_rt, refcount=1] pcpu_rt->sernum = fib6_sernum [fib6_sernum=W] -> cmpxchg(fib6_nh.rt6i_pcpu, NULL, pcpu_rt) [slot was empty, store succeeds] -> skb_dst_set_noref(skb, dst) [dst is pcpu_rt, refcount still 1] rt_genid_bump_ipv6() -> bumps fib6_sernum [fib6_sernum from W to Z] ip6_route_output() -> ip6_pol_route() -> FIB lookup resolves fib6_nh [nhid=N] -> rt6_get_pcpu_route() pcpu_rt->sernum != fib6_sernum [W <> Z, stale] -> prev = xchg(rt6i_pcpu, NULL) -> dst_release(prev) [prev is pcpu_rt, refcount 1->0, dead] dst = skb_dst(skb) [dst is the dead pcpu_rt] dst_cache_set_ip6(dst) -> dst_hold() on dead dst -> WARN / use-after-free For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release the pcpu_rt. Shared nexthop objects provide such a path, as two routes pointing to the same nhid share the same fib6_nh and its rt6i_pcpu entry. Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after ip6_route_input() to force the NOREF dst into a refcounted one before caching. The output path is not affected as ip6_route_output() already returns a refcounted dst. Fixes: af4a2209b134 ("ipv6: sr: use dst_cache in seg6_input") Fixes: a7a29f9c361f ("net: ipv6: add rpl sr tunnel") Cc: stable@vger.kernel.org Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Justin Iurman <justin.iurman@gmail.com> Link: https://patch.msgid.link/20260421094735.20997-1-andrea.mayer@uniroma2.it Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-28dt-bindings: pinctrl: nvidia,tegra234: Correctly use additionalPropertiesKrzysztof Kozlowski
The binding does not reference any other schema, thus should use "additionalProperties: false" to disallow any undocumented properties. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28dt-bindings: pinctrl: nvidia,tegra234: Add missing required blockKrzysztof Kozlowski
Binding should require 'reg' property, because address space cannot be missing in the hardware and is already needed by the Linux drivers. Require also 'compatible' by convention, although it is not strictly necessary. Fixes: 857982138b79 ("dt-bindings: pinctrl: Document Tegra234 pin controllers") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: vt8500: Enable compile testingKrzysztof Kozlowski
Enable compile testing for Realtek pin controller drivers for increased build and static checkers coverage. PINCTRL_WMT uses gpiochip_get_data(), thus needs GPIOLIB. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: aspeed: Enable compile testing outside of ARCH_ASPEEDKrzysztof Kozlowski
Since inception in commit 4d3d0e4272d8 ("pinctrl: Add core support for Aspeed SoCs"), the Aspeed pin controller drivers cannot be compile tested, unless ARCH_ASPEED is selected. . That partially defeats the purpose of compile testing, since ARCH_ASPEED is pulled when building platform kernels. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: realtek: Enable compile testingKrzysztof Kozlowski
Enable compile testing for Realtek pin controller drivers for increased build and static checkers coverage. PINCTRL_RTD uses pinconf_generic_dt_node_to_map(), thus needs OF. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28pinctrl: tegra: Enable easier compile testingKrzysztof Kozlowski
Currently NVIDIA Tegra pin controller drivers cannot be compile tested, unless ARCH_TEGRA is selected. That partially defeats the purpose of compile testing, since ARCH_TEGRA is pulled when building platform kernels. Solve it and allow compile testing independently of ARCH_TEGRA choice which requires few less usual changes: 1. Descent in Makefile in to drivers/pinctrl/tegra/ unconditionally, because there is no menu option. 2. Depend on COMMON_CLK for PINCTRL_TEGRA20, because it uses clk_register_mux(). Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-04-28drm/udl: Increase GET_URB_TIMEOUTShixiong Ou
[WHY] A situation has occurred where udl_handle_damage() executed successfully and the kernel log appears normal, but the display fails to show any output. This is because the call to udl_get_urb() in udl_crtc_helper_atomic_enable() failed without generating any error message. [HOW] 1. Increase timeout of getting urb. 2. Add error messages when calling udl_get_urb() failed in udl_crtc_helper_atomic_enable(). Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)") Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Cc: <stable@vger.kernel.org> # v3.4+ Link: https://patch.msgid.link/20260424124427.657-1-oushixiong1025@163.com
2026-04-28ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control errorCássio Gabriel
If byt_wm5102_prepare_and_enable_pll1() fails in the SND_SOC_DAPM_EVENT_ON() path, platform_clock_control() returns after clk_prepare_enable(priv->mclk) without disabling the clock again. This leaks an MCLK enable reference on failed power-up attempts. Add the missing clk_disable_unprepare() on the error path, matching the unwind used by the other Intel platform_clock_control() implementations. Fixes: 9a87fc1e0619 ("ASoC: Intel: bytcr_wm5102: Add machine driver for BYT/WM5102") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260427-bytcr-wm5102-mclk-leak-v1-1-02b96d08e99c@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-28wifi: brcmsmac: phy_lcn: Remove dead code in ↵Chelsy Ratnawat
wlc_lcnphy_radio_2064_channel_tune_4313() The variable rfpll_doubler is initialized to 0 and then unconditionally set to 1 on the very next line, making the subsequent check for !rfpll_doubler always evaluate to false. This results in logically dead code that has never been executed. Remove the unused variable, the unreachable conditional branch, and simplify the fpfd calculation to directly use the PLL doubler values. Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260403193324.141753-1-chelsyratnawat2001@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28Merge tag 'ath-next-20260427' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.2 (PR #1) For ath9k: - improve the GPIO interface. For ath12k: - replace dynamic memory allocation in WMI rx path - avoid buffer overread when configuring IRQs - code housekeeping ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28dt-bindings: clock: amlogic: t7: Add missing mpll3 parent clockJian Hu
The mpll3 clock is one parent clock of the sd_emmc and mipi_isp clocks on the Amlogic T7 SoC, but was missing from t7-peripherals-clkc.yaml bindings. Add the mpll3 clock source to the T7 peripherals clock controller input clock list, so that sd_emmc and mipi_isp can use it. For logical consistency, place the required mpll3 entry before the optional entry. This change breaks the ABI, but while the amlogic,t7-peripherals-clkc bindings have been merged upstream, the corresponding DT has not been merged yet. Thus, no real users or systems are affected. Fixes: b4156204e0f5 ("dt-bindings: clock: add Amlogic T7 peripherals clock controller") Signed-off-by: Jian Hu <jian.hu@amlogic.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260326092645.1053261-3-jian.hu@amlogic.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2026-04-28dt-bindings: clock: amlogic: Fix redundant hyphen in "amlogic,t7-gp1--pll" ↵Jian Hu
string. Fix redundant hyphen in "amlogic,t7-gp1--pll" string. Fixes: 5437753728ac ("dt-bindings: clock: add Amlogic T7 PLL clock controller") Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr> Signed-off-by: Jian Hu <jian.hu@amlogic.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260326092645.1053261-2-jian.hu@amlogic.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2026-04-28Merge tag 'ath-current-20260427' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.1-rc2 Fix an ath10k build dependency issue along with a few ath12k bugs. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: rsi: fix kthread lifetime race between self-exit and external-stopJeongjun Park
RSI driver use both self-exit(kthread_complete_and_exit) and external-stop (kthread_stop) when killing a kthread. Generally, kthread_stop() is called first, and in this case, no particular issues occur. However, in rare instances where kthread_complete_and_exit() is called first and then kthread_stop() is called, a UAF occurs because the kthread object, which has already exited and been freed, is accessed again. Therefore, to prevent this with minimal modification, you must remove kthread_stop() and change the code to wait until the self-exit operation is completed. Cc: <stable@vger.kernel.org> Reported-by: syzbot+5de83f57cd8531f55596@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e5d03b.a00a0220.1bd0ca.0064.GAE@google.com/ Fixes: 4c62764d0fc2 ("rsi: improve kernel thread handling to fix kernel panic") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Link: https://patch.msgid.link/20260422173846.37640-1-aha310510@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28arm64: tegra: Add aspm-l1-entry-delay-ns to PCIe nodesManikanta Maddireddy
Add the aspm-l1-entry-delay-ns device tree property to all PCIe Root Port and PCIe Endpoint nodes in tegra194.dtsi and tegra234.dtsi so that ASPM L1 entrance latency is configured from device tree. - Tegra194: 4000 ns (4 us) for both Root Port and Endpoint. - Tegra234: 8000 ns (8 us) for Root Port, 16000 ns (16 us) for Endpoint. Signed-off-by: Manikanta Maddireddy <mmaddireddy@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-04-28arm64: tegra: Fix Tegra234 MGBE PTP clockJon Hunter
The Tegra MGBE PTP clock is incorrectly named as 'ptp-ref' and not 'ptp_ref' and this causing the initialisation of the PTP clock to fail. The device-tree binding doc for the device and the Tegra MGBE driver have been updated to use the correct name and so update the device-tree for Tegra234 as well. Fixes: 610cdf3186bc ("arm64: tegra: Add MGBE nodes on Tegra234") Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-04-28gpio: ixp4xx: switch to dynamic GPIO baseMohamed Ayman
Most IXP4xx platforms are Device Tree-based, and GPIO consumers use phandle-based descriptors rather than legacy integer GPIO numbers. Audit of the IXP4xx platform shows: - No gpio_request(), gpio_get_value(), or gpio_set_value() users in arch/arm/mach-ixp4xx/ - No platform data using fixed GPIO numbers This switches the gpiochip to dynamic base allocation, aligning with modern gpiolib expectations where GPIO numbers are not globally fixed and may be assigned dynamically. Set gpiochip.base = -1 to allow gpiolib to assign the GPIO base dynamically, avoiding global GPIO number space conflicts. Signed-off-by: Mohamed Ayman <mohamedaymanworkspace@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260427214311.331996-1-mohamedaymanworkspace@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-04-28Merge tag 'asoc-wsa881x-gpiolib-of' of ↵Bartosz Golaszewski
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into gpio/for-next ASoC: wsa881x: Move custom workaround to gpiolib-of Move a workaround for misdescribed GPIOs from the wsa881x to use a generic implementation in gpiolib-of.
2026-04-28wifi: mac80211: always allow transmitting null-data on TXQsJohannes Berg
Jouni reported that certain sequences of tests caused some WDS tests to fail after applying the upcoming hwsim changes for NAN. I bisected that down to converting hwsim to TXQs, and after a long debug session found that the 4-addr NDP was getting dropped, because it goes out via a (management) TXQ and is a data frame. It's unclear to me now why this only happens in some test sequences (e.g. "sigma_dut_sae_h2e_ap_loop ap_wds_sta" and "sigma_dut_eap_ttls_all_akm_suites ap_wds_sta_open"), maybe that affects timing and the frame is otherwise delayed in some way. Correct the check to only drop frames that actually carry data, not NDPs. Reported-by: Jouni Malinen <j@w1.fi> Link: https://patch.msgid.link/20260417141601.851ddf4adb59.I3d668c0e1bdca9cd98f2fc46f84a066e68cc7a62@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: use kstrtobool_from_user() in debugfs callbacksDmitry Antipov
Prefer 'kstrtobool_from_user()' over an ad-hoc quirks in 'aql_enable_write()' and 'force_tx_status_write()' callbacks. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Link: https://patch.msgid.link/20260417105556.2886928-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: cfg80211: validate cipher suite for NAN Data keysDaniel Gabay
Per Wi-Fi Aware v4.0 section 7.1.2, NAN Data interfaces shall only use CCMP-128 or GCMP-256 for frame protection. Enforce this in cfg80211_validate_key_settings() by passing the wdev down to it. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Reviewed-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415183550.14a422ac52fd.I486ae7188bc60e44503ecccc99af6ae3a31d16b8@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: nl80211: check link is beaconing for color changeJohannes Berg
When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415145348.beb59ea5fbf7.I128a956a3e610bb6a5c9cad941d7d5b59b735a5e@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: clarify an 802.11 VHT spec referenceJohannes Berg
Just saying "Table 9-250" isn't useful, without the version of the spec. Fix the number according to the latest released version (-2020) and add the table name. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415145157.c85df460fc98.I350b4c290fb90977f62ed59ac0246afbacee1ebc@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: fix per-station PHY capability bandwidthJohannes Berg
When a (link) station connected to an AP interface is not capable of EHT, it's possible that the AP interface is in 160 MHz but the HE channel is narrower, e.g. when EHT has puncturing. In this case, the code doesn't correctly set the STAs bandwidth, the station might be capable of using 160 MHz, but it can't use EHT 160 MHz with puncturing, so it must be set to narrower. Track the AP's 'he_and_lower_bw' bandwidth, use that when calculating the maximum bandwidth to transmit to/from any station not capable of EHT, and update all stations and the chanctx min_def when it changes. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.d41efd67876c.I29ef615e6ab049a56c20f3226b5e953859f890b0@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: clarify per-STA bandwidth handlingJohannes Berg
The per-STA bandwidth handling is completely confusing, given the function names etc. Move everything to sta_info.c and rename the functions to accurately reflect what they return: - ieee80211_sta_bw_capability() - ieee80211_sta_current_bw() can return the appropriate bandwidth in the desired direction (a new enum) At any given time, the bandwidth with which we expect to receive frames from a station may differ from the bandwidth with which we may transmit frames to the station; this will happen either during RX OMI negotiation, or for a long time if the station used an HT Notify Channel Width frame. We also implement the (VHT) Operating Mode Notification as an asymmetric setting, even if the spec would seem to imply it could be symmetric. Also rename the 'cur_max_bandwidth' value to 'op_mode_bw' which matches the 'op_mode_nss', indicating more clearly what it _is_ rather than how it's _used_. It's not quite precise (NSS is) since it's also HT chanwidth notification, but that seems OK. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.09ae71b74d5c.Ib59c2ac82e030559d1f7d462f06ba3488a090946@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: nl80211: always validate AP operation/PHY regulatoryJohannes Berg
Instead of validating the AP operation elements and PHY regulatory individually in each caller, which missed CSA and color change, pass the channel to the beacon parsing function and validate the parameters there. This adds it to the missing places. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.2a334f0bc247.I2e0b12ce5eddd422a553d10ba2ed7dcd0fbb1871@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: cfg80211: provide HT/VHT operation for AP beaconJohannes Berg
In addition to providing HE/EHT/UHR operation, also check and provide HT/VHT operation, so that drivers have it and can use it, e.g. to correctly calculate station bandwidth. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.32ad98454543.Ia9692671b699164edcc0bdaf4fdbdbefc50b18f8@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: nl80211: reject too short HT/VHT/HE/EHT capability/operationJohannes Berg
If any of these are present, the code only assigns pointers when they're also long enough. Instead of ignoring them in that case, reject the configuration instead. Also add error messages to existing error paths. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.40c24d7ee2df.Ib1368e4d8e33a396f332a38a6ba6708fd188f143@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: cfg80211: move AP HT/VHT/... operation to beacon infoJohannes Berg
The HT/VHT/HE/EHT/UHR operation can change, and might thus be updated on each beacon update. Move them to the beacon struct and parse them out of the beacon also on updates, not just on starting the AP. This also fixes checks in two ways: - Regulatory checks in nl80211_validate_ap_phy_operation() are now done also on updates, disallowing enabling HE/EHT/UHR on channels that don't allow that after start. This checks only operation now, but clients can't use it without operation. - NL80211_ATTR_UHR_OPERATION is now required whenever UHR is present in the beacon, and rejected otherwise. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.f70758a46904.I0d21120b41eed661eefc61d5417dadaae7145845@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: nl80211: reject beacons with bad HE operationJohannes Berg
The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.6217f5974fb5.Iff7ff6bcb159584e756d0f825c65860cdd53c6ea@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: cfg80211: remove HE/SAE H2E required fieldsJohannes Berg
These are not used by any drivers, even the HT/VHT ones are only used by the qtnfmac driver. Remove the fields. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.a4a3ebb0f95a.Ifadd953e13133e7a45ee3318fb04b2ff9dde62e4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: remove ieee80211_sta_cur_vht_bw()Johannes Berg
We can now easily always call _ieee80211_sta_cur_vht_bw() with a valid chandef, so do that, remove ieee80211_sta_cur_vht_bw() and drop the underscore prefix. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.73659adc198f.Ic8fc88a7e016e62d00dca380ffbf47a54ef3daef@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: clean up ieee80211_sta_cap_rx_bw()Johannes Berg
There are three versions of this function, but now there's no caller to ieee80211_sta_cap_rx_bw() and the chandef is always given. Rename the functions to have one underscore less and rely on the chandef being passed. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.62f48003f11c.Ib84ab7aeab8b278ab46d85b142a66bf330909eb6@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: clean up initial STA NSS/bandwidth handlingJohannes Berg
Currently, the initial STA bandwidth is set during each parsing of HT/VHT/... elements to the station capabilities, multiple times, in a confusing way that's not very good in the case of NAN stations either. For now, keep the NULL chandef pointer and all that, but clean up the initial handling of NSS/BW capabilities and then apply the VHT operation mode on top of that. This clarifies the code and the client code now also handles the bandwidth change from Operating Mode Notification in association response. The HT code is completely unnecessary now, since the VHT (soon to be renamed) function will be called and handles HT as well. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.a4d88eb27a8d.Id7a316e75e7e3dce2023d987e6939060f5286378@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: clean up STA NSS handlingJohannes Berg
Move ieee80211_sta_init_nss() from VHT code to station code, and disentangle it from rate control. This way, it becomes clearer when 'rx_nss' is set up. While doing this, fix the client side code to set up link_sta->op_mode_nss instead of link_sta->pub->rx_nss for the opmode element in association response, and remove the (now wrong) comment about handling that in the function. type=cleanup ticket=none Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/273695 Tested-by: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM> tested: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM> Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.bef3d07beeb6.I97fb93ccc1b366110ab23de58fcd73676cdd85d6@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: simplify ieee80211_sta_rx_bw_to_chan_width()Johannes Berg
This function is only called for at least HT capable stations, so doesn't need to differentiate 20/20_NOHT. Also, the check for VHT 160 MHz support is wrong, since a station could have support for both and the AP is using 80+80, but nothing cares anyway, so we don't need that. Simplify the function and move it to util.c since it now no longer is related to VHT, and also doesn't need a station. Also use the new function in ieee80211_get_sta_bw() for the chandef calculations, it just needs to handle the 20/20-noht separately; while at it fix that to handle HE stations. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.7b0be1059436.I573add4e3ed68b15f8b45122d053ac523afe4025@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: nl80211: document channel opmode change channel widthJohannes Berg
The opmode change notification is entirely unused by existing userspace except for printing out the values. As such, there's no need to keep it perfectly accurate, and the implementation in mac80211 doesn't report it correctly today. Add a note in the documentation that it may not differentiate 80+80 and 160. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.87d5b1ce688f.Ia9a0769d52dcfe56f7b0dff903ed14db3ef04920@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: remove ieee80211_sta_cap_chan_bw()Johannes Berg
This function is only used by TDLS, but is more or less equivalent to ieee80211_sta_cap_rx_bw() (which takes OMI into account, but that won't be used in TDLS), except it tries to differentiate 80+80 and 160, but then caller doesn't care about that. Remove the function. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.138728393e2b.I4ea9221cafcfd034dda430e76de82eec59ab1e71@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-28wifi: mac80211: use chandef in TDLS chanctx handlingJohannes Berg
When getting the station's bandwidth for TDLS chanctx updates, pass the chandef so that the band can be used in _ieee80211_sta_cap_rx_bw(), instead of this using ieee80211_sta_cap_rx_bw() which looks it up from the link. This removes the last user of ieee80211_sta_cap_rx_bw(). Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260415144514.cc7c1590e953.Id2381d2b5a9d1ded170501976240d4fca23ee35c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-13 07:07:49 +0000