Pmic hlos rpmh nord changes#1533
Open
drajpura269 wants to merge 861 commits into
Open
Conversation
sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain. Fixes: c71420d ("wifi: mac80211: RCU-ify link STA pointers") Link: https://lore.kernel.org/r/20260626080158.3589711-1-maoyixie.tju@gmail.com Suggested-by: Johannes Berg <johannes@sipsolutions.net> Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg> Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Link: https://patch.msgid.link/20260627083028.3826810-1-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a5 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes. A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap: BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ> The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380) Check that the slice fits in the skb before copying. Fixes: 7cb7707 ("p54: move eeprom code into common library") Reported-by: Weiming Shi <bestswngs@gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5@asu.edu> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/20260628000510.4152481-1-xmei5@asu.edu Signed-off-by: Johannes Berg <johannes.berg@intel.com>
rsi_hal_load_key() copies tx_mic_key and rx_mic_key from data[16] and data[24] whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys used by other ciphers, such as CCMP, do not provide those bytes, so the unconditional copies can read past the supplied key buffer. Only copy the MIC keys for TKIP, and reject malformed TKIP keys that are shorter than the expected 32-byte layout. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260701053414.34015-1-pengpeng@iscas.ac.cn [drop useless length check] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211_mle_type_ok(). Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211_inform_bss_frame_data() stores the copied IE buffer. cfg80211_parse_mbssid_data() builds the nontransmitted BSS IE. cfg80211_gen_new_ie() sees the EHT MLE in the parent frame. ieee80211_mle_get_mld_id() then reads past the IE boundary. Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed. Cc: stable@vger.kernel.org Fixes: 61dcfa8 ("wifi: cfg80211: copy multi-link element from the multi-link probe request's frame body to the generated elements") Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn> Link: https://patch.msgid.link/20260701093327.2680709-1-lihaofeng@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
When a netlink socket that owns a PMSR session is closed, cfg80211_release_pmsr() clears the request's nl_portid and queues pmsr_free_wk to call cfg80211_pmsr_process_abort() asynchronously. If the interface tears down concurrently, cfg80211_pmsr_wdev_down() is called under wiphy_lock and calls cancel_work_sync(&pmsr_free_wk) to wait for any running work. The work function acquires wiphy_lock via guard(wiphy) before calling process_abort. This is a deadlock: wdev_down holds wiphy_lock and blocks inside cancel_work_sync(); pmsr_free_wk blocks trying to acquire that same wiphy_lock. Neither thread can proceed. The same deadlock is reachable from cfg80211_leave_locked(), which calls cfg80211_pmsr_wdev_down() for all interface types under wiphy_lock. Fix this by converting pmsr_free_wk from a plain work_struct to a wiphy_work. The wiphy_work dispatcher holds wiphy_lock when running work items, so the explicit guard(wiphy) in the work function is no longer needed. wiphy_work_cancel() can be called safely while holding wiphy_lock - since wiphy_lock prevents the work from running concurrently, wiphy_work_cancel() never blocks, eliminating the deadlock. Remove the cancel_work_sync() for pmsr_free_wk from the NETDEV_GOING_DOWN handler. cfg80211_leave(), called unconditionally just before it, already cancels any pending work under wiphy_lock via wiphy_work_cancel() inside cfg80211_pmsr_wdev_down(). Fixes: 6dccbc9 ("wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down") Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com> Link: https://patch.msgid.link/20260703082523.2629324-1-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
I have an hostapd setup with a 01:00.0 Network controller: Ralink corp. RT2790 Wireless 802.11n 1T/2R PCIe The setup work fine on 6.18.26-gentoo It breaks on 6.18.33-gentoo (and still broken on 6.18.37) I found an hint in dmesg: On 6.18.26-gentoo I see: May 31 15:48:45 trash01 kernel: ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0003 detected On 6.18.33-gentoo I see: May 31 15:22:57 trash01 kernel: ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0006 detected The RF chipset seems badly detected. The problem was the EEPROM which was badly initialized. Probably the origin was in some PCI change but unfortunately I couldn't play to bisect/reboot often the board with this card to do it. Signed-off-by: Corentin Labbe <clabbe@baylibre.com> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> Link: https://patch.msgid.link/20260703134932.3786771-1-clabbe@baylibre.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704011140.37639-1-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
rsi_send_bgscan_probe_req() allocates room for struct rsi_bgscan_probe plus MAX_BGSCAN_PROBE_REQ_LEN bytes, but copies the entire mac80211-generated probe request skb after the fixed header. The probe request length depends on scan IEs and is not checked against the fixed firmware buffer. Reject generated probe requests that do not fit the firmware command buffer before copying them into the skb. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704011231.45593-1-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3. Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260705083519.23567-1-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller than MAX_MGMT_PKT_SIZE after alignment. Validate the beacon length against the actual tailroom before the copy and skb_put(). Leave ownership of the management skb with the caller on error, matching the existing rsi_send_beacon() cleanup path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260705084824.68105-1-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it before returning the error. Fixes: dbbb27e ("cfg80211: support RNR for EMA AP") Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260610112208.1308-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740c ("mac80211: receive and process S1G beacons") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
cfg80211_inform_bss_frame_data() parses S1G beacons with the extension frame layout, but still reads the TSF from the regular probe response layout after the S1G branch. For S1G beacons that reads bytes at the regular management-frame timestamp offset instead of the S1G timestamp. Use the 32-bit S1G beacon timestamp and the S1G Beacon Compatibility element's TSF completion field when informing an S1G BSS. Keep the regular management-frame timestamp read in the non-S1G branch. Fixes: 9eaffe5 ("cfg80211: convert S1G beacon to scan results") Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Tested-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Reviewed-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260611161943.91069-6-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs. Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length. Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged. Fixes: 0f48b8b ("wifi: ieee80211: add definitions for multi-link element") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260611173506.36838-2-enderaoelyther@gmail.com [remove now misleading comment] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Validate each nested NL80211_ATTR_MBSSID_ELEMS entry as a well-formed information-element stream before storing it for beacon construction. RNR parsing already validates each nested blob with validate_ie_attr() before storing it. Apply the same syntactic IE validation to MBSSID entries before counting and copying their data and length pointers. Fixes: dc1e3cb ("nl80211: MBSSID and EMA support in AP mode") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612131854.43575-3-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
MBSSID transmitted-profile link IDs are valid only in the range 0..IEEE80211_MLD_MAX_NUM_LINKS - 1. Constrain the nl80211 policy to reject out-of-range values during attribute validation. Fixes: 37523c3 ("wifi: nl80211: add link id of transmitted profile for MLO MBSSID") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612131854.43575-4-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
PMSR request parsing accepts missing or duplicated measurement type entries in NL80211_PMSR_REQ_ATTR_DATA. Track whether one measurement type was already provided, reject a second one immediately, and return an error if the request data block contains no measurement type at all. Fixes: 9bb7e0f ("cfg80211: add peer measurement with FTM initiator API") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612133656.92900-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using the policy. Fixes: 9bb7e0f ("cfg80211: add peer measurement with FTM initiator API") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612133703.93274-2-enderaoelyther@gmail.com [drop unnecessary check] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
PMSR FTM location request flags are syntactically valid, but they must be rejected when the device capability does not advertise support for them. Return an error immediately after rejecting unsupported LCI or civic location request bits so the request cannot reach the driver. Fixes: 9bb7e0f ("cfg80211: add peer measurement with FTM initiator API") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612133710.93544-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
A PMSR request with an empty peers array is not a useful request and weakens the cfg80211-to-driver contract by allowing start_pmsr() with no target peer. Reject empty peer lists before allocating the request object or calling into the driver. Fixes: 9bb7e0f ("cfg80211: add peer measurement with FTM initiator API") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612133717.93783-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
When assoc_data->s1g is set and no AID Response element is present, falling back to mgmt->u.assoc_resp.aid reads the non-S1G association-response layout. Keep the fallback for non-S1G only. If a successful S1G association response omits the AID Response element, abandon the association instead of proceeding with AID 0. Initialize aid to 0 for other S1G responses so the later mask and logging flow keeps a defined value without reading the non-S1G layout. Fixes: 2a8a6b7 ("wifi: mac80211: handle station association response with S1G") Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612152440.25955-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code. Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260612185042.66260-6-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Jeff Chen says: =============== wifi: nxp: patches for wireless-next =============== The series contains an MMC commit to add the NXP IW61 ID and a quirk, and another commit to add the new driver. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
…on() Remove the link level statistics handling from nl80211_send_station() and drop the unused link_stats parameter from its signature and callers. The removed code iterated over each MLO link and attempted to send link specific station data through NL80211_ATTR_MLO_LINKS, but this logic was never used because link_stats was always false. This logic was introduced during early work on link level station statistics with the intention of reporting information for each link. Due to message size concerns when a station has multiple links, the feature was disabled behind the link_stats flag and remained unused. The link level reporting block in nl80211_send_station() is dead code and cannot support larger messages, so remove it. This cleanup also prepares for proper link level statistics reporting in nl80211_dump_station() in a later patch, where fragmentation allows safe transmission of multi link data. Also fix label indentation: the nla_put_failure label had an erroneous leading space. Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260614051739.3979947-2-praneesh.p@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Add a helper function nl80211_put_sta_info_common() to pack the station-level (aggregated) STA information into a netlink message. This prepares the code for future enhancements such as supporting fragmented link statistics in nl80211_dump_station. Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260614051739.3979947-3-praneesh.p@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
…nk stats Currently, nl80211_dump_station() relies on the netlink callback's generic args array (cb->args[2]) to track the station index during dumps. It also processes the entire sinfo structure and transmits it to userspace immediately in a single pass. This approach creates a bottleneck for MLO. When an MLD station has multiple active links, the aggregated station information, combined with the individual per-link statistics, can easily exceed the maximum netlink message size limits. The current monolithic dump iteration cannot pause and resume mid-station to fragment these large per-link statistics across multiple netlink messages. Introduce a stateful context structure (struct nl80211_dump_station_ctx) allocated during the dump to track the iteration state. Store the context pointer directly at cb->args[2], following the same pattern as nl80211_dump_wiphy which stores its state pointer at cb->args[0]. Move the station index (sta_idx) tracking and the sinfo payload into this context. The per-station netlink message is built inline in the loop: common header attributes are assembled directly, then nl80211_put_sta_info_common() adds the STA_INFO payload. Furthermore, move the NL80211_CMD_GET_STATION command definition from genl_small_ops to genl_ops to natively support the .done callback. Implement nl80211_dump_station_done() to ensure the newly allocated state context and its deeply allocated sinfo payload are safely freed when the dump concludes or is aborted prematurely by userspace. Note that the previous dump path used nl80211_send_station(), which included NL80211_ATTR_IE and NL80211_ATTR_RESP_IE. These attributes are not carried forward in this implementation. As documented, association response IEs (assoc_resp_ies) are only relevant at station creation time (e.g. via cfg80211_new_sta()) to notify userspace about association details, and are not expected to be part of get_station()/dump_station() callbacks. Aligning with this expectation, these IEs are intentionally omitted here. This refactoring maintains the existing netlink batching performance while laying the stateful foundation required for per-link statistics fragmentation in subsequent patches. At out_err_release, cfg80211_sinfo_release_content() frees any dynamically allocated sub-fields inside ctx->sinfo (including per-link pointers in sinfo.links[]). Without the subsequent memset, those pointers remain non-NULL in the embedded sinfo. When the dump concludes or is aborted, nl80211_dump_station_done() calls cfg80211_sinfo_release_content() a second time on the same ctx->sinfo, which would free the already-released link memory. The memset(&ctx->sinfo, 0, sizeof(ctx->sinfo)) zeroes all pointers so the second release call hits kfree(NULL), which is a harmless no-op. Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260614051739.3979947-4-praneesh.p@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
…on() In MLO scenarios, stations may have multiple links, each with distinct statistics. When userspace tools like iw or hostapd request station dumps, attempting to pack all per-link stats into a single netlink message can easily exceed the default 4KB buffer limit, especially when more than two links are active. This results in -EMSGSIZE errors and incomplete data delivery. To address this, fragment per-link station statistics across multiple netlink messages to ensure reliable delivery of complete MLO station information. Extend the stateful context with a two-phase dump mechanism: phase 0 (AGGREGATED) sends combined MLO-level statistics and phase 1 (PER_LINK) sends individual per-link statistics for each active link. The dump loop is structured to produce exactly one netlink message per iteration, with a common header (ifindex, wdev, mac, generation) built once and phase-specific payload added via a switch statement. This keeps header construction in one place and makes the EMSGSIZE bail-out uniform. Add a new request flag attribute, NL80211_ATTR_STA_DUMP_LINK_STATS (NLA_FLAG), for NL80211_CMD_GET_STATION dump. Userspace can set this flag to request per-link station statistics for MLO stations. Extract this flag during the first dump invocation by passing an attrbuf to nl80211_prepare_wdev_dump(); use __free(kfree) to avoid scattered manual kfree() calls. Cache the boolean in the dump context to avoid repeated parsing on subsequent invocations. Per-link messages carry a single NL80211_ATTR_MLO_LINKS nest with the link ID, link-specific MAC, and per-link NL80211_ATTR_STA_INFO payload. The link-specific validity (is_valid_ether_addr) and null pointer guard are checked in nl80211_put_link_station_payload() before any message construction begins. Also fix all nla_nest_start_noflag() calls in nl80211_fill_link_station() for nested attribute types (STA_INFO, BSS_PARAM, TID_STATS, per-tid) to use nla_nest_start() so the NLA_F_NESTED flag is set correctly. Propagate the actual return value from nl80211_put_sta_info_common() in the AGGREGATED phase rather than returning skb->len. Returning skb->len signals netlink to re-invoke the dump with the same sta_idx, causing an infinite loop when the aggregated payload is too large to fit; returning the real error code (-EMSGSIZE or otherwise) terminates the dump cleanly. Backward compatibility is seamlessly preserved for non-MLO stations. Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260614051739.3979947-5-praneesh.p@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
…k stats Currently, when userspace requests station information with link statistics using NL80211_CMD_GET_STATION with the NL80211_ATTR_STA_DUMP_LINK_STATS flag, the kernel uses the .doit callback (nl80211_get_station) which sends a single netlink message. For MLO stations with multiple links, the link statistics can be large and may exceed the maximum netlink message size, causing the operation to fail with -EMSGSIZE. The .dumpit callback (nl80211_dump_station) already supports fragmentation across multiple netlink messages, making it suitable for handling large link statistics. However, it currently iterates over all stations on the interface, which is inefficient when userspace only wants information about a specific station. Add support for MAC address filtering in nl80211_dump_station to allow userspace to request fragmented link statistics for a specific station. When NL80211_ATTR_MAC is present in a dump request, cache the MAC address in the dump context and use rdev_get_station() to retrieve information for only that station, instead of iterating over all stations with rdev_dump_station(). This allows userspace tools (like iw) to use NL80211_CMD_GET_STATION with NLM_F_DUMP flag to retrieve complete link statistics for a specific station across multiple netlink messages, avoiding the message size limitation. Signed-off-by: P Praneesh <praneesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260614051739.3979947-6-praneesh.p@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
kvfree() safely handles NULL pointers, so the explicit NULL checks before calling kvfree() are unnecessary. This issue was reported by ifnullfree.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Use kmemdup() instead of a separate kmalloc() and memcpy() pair, simplifying the code while preserving the existing behavior. This issue was reported by memdup.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Document Inline Crypto Engine (ICE) on Qualcomm Nord SoC. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Harshal Dev <harshal.dev@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260704004408.2303468-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Add compatible for Nord SA8797P QUP GENI I2C controller, which is compatible with SA8255P controller. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260707095708.3801043-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Add base device tree include (nord.dtsi) for the Nord SoC series describing the core hardware components: - 18 Oryon (qcom,oryon-1-5) cores in three clusters, with PSCI-based power management and CPU/cluster idle states - ARM GICv3 interrupt controller with ITS - TLMM GPIO/pinctrl controller - 8 TSENS thermal sensors with thermal zones - 3 APPS SMMU-500 instances - 3 QUPv3 GENI SE QUP blocks - PDP SCMI channel and mailbox - Watchdog, Crypto, TRNG and TCSR - Reserved memory, CMD-DB and firmware SCM - PSCI and architected timers Co-developed-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com> Signed-off-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com> Co-developed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709132013.4096850-2-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Add SoC-level device tree include for Nord GearVM variant, where a VM controls platform resources (clocks, regulators, powerdomains, etc.) as SCMI server. It currently covers: - 64 SCMI shared memory regions reserved at 0xd7600000-0xd763f000 for SMC-based firmware communication channels - Three QUPV3 GENI SE QUP blocks (qupv3_0/1/2) with I2C/SPI/UART controllers using SCMI power and performance domains via scmi11 - UFS host controller with SCMI power domain via scmi3 Signed-off-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709132013.4096850-3-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
The Nord is a new generation of SoC series from Qualcomm, and SA8797P is the automotive variant of Nord. SA8797P Ride is the automotive‑grade development board built on SA8797P SoC. Document the board with a fallback on Nord compatible. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709132013.4096850-4-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Add initial device tree for the Qualcomm SA8797P Ride reference board, which is built on Nord GearVM variant. - Configure UART15 as the primary console and UART4 as the secondary serial port - Enable UFS storage support - Define thermal zones for PMIC dies, UFS, and two SDRAM sensors, all sourced from SCMI sensor protocol on channel 23 Signed-off-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709132013.4096850-5-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Unlike the GearVM variant, Nord Embedded variant has platform resources (clocks, regulators, powerdomains, pins, etc.) directly controlled by Linux. Add a separate dtsi file extending the existing top-level nord.dtsi with nodes representing these peripherals as well as describing how they are wired up with the already defined components. Co-developed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709132013.4096850-6-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Qualcomm Dragonwing IQ10 Robotics Reference Design (RRD) board is built on Nord Embedded variant. Document the board. Link: https://lore.kernel.org/r/20260709132013.4096850-7-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Add initial device tree for the Qualcomm IQ10 RRD board, which is built on Nord Embedded variant. Enable the debug UART, UFS storage, PMICs, I2C and SPI. Co-developed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709132013.4096850-8-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Document Inter-Processor Communication Controller on Qualcomm Nord SoC. Signed-off-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709080848.4070338-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Add compatible for Qualcomm Nord FastRPC which is compatible with Kaanapali FastRPC. Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709082040.4070711-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Document Always-on Subsystem side channel on Qualcomm Nord SoC. Link: https://lore.kernel.org/r/20260709085149.4072181-2-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Document ADSP (HPASS DSP) for Nord SoC. The Nord ADSP use CX and MX power domains, so add a new conditional block to enforce the correct power-domain-names for it. It also uses IPCC-based GLINK signalling (shared with Glymur, Kaanapali and SM8750), so add it to the existing IPCC interrupt-names constraint. Link: https://lore.kernel.org/r/20260709085149.4072181-3-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
The ADSP (HPASS DSP) on Nord SoC is pre-booted by XBL before Linux starts. Add ADSP resource descriptor, and set early_boot flag for attach path rather than a cold boot sequence. Link: https://lore.kernel.org/r/20260709085149.4072181-4-shengchao.guo@oss.qualcomm.com Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Enable the two clock drivers we currently support on Nord platforms. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Enable the Qualcomm Nord interconnect driver in arm64 defconfig. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Add compatible string for Nord video clock controller and the bindings for Nord Qualcomm SoC. Link: https://lore.kernel.org/r/20260706-nord_videocc_camcc-v1-1-bae3be9e9770@oss.qualcomm.com Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
… Nord Update the compatible and the bindings for CAMCC support on Nord SoC. Link: https://lore.kernel.org/r/20260706-nord_videocc_camcc-v1-2-bae3be9e9770@oss.qualcomm.com Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Add support for the video clock controller for video clients to be able to request for videocc clocks on Nord platform. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260706-nord_videocc_camcc-v1-3-bae3be9e9770@oss.qualcomm.com Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Add support for the Camera Clock Controller (CAMCC) on the Nord platform for camera SW drivers to request for these clocks. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260706-nord_videocc_camcc-v1-4-bae3be9e9770@oss.qualcomm.com Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Add the GPU, camera, video, and display clock controller nodes for the Qualcomm Nord SoC, along with their required dt-bindings includes. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Remove the RPMHPD driver changes for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
Remove the RPMh regulator changes for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com
Remove RPMHPD DT changes for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
Remove RPMH regulator DT changes for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
Add RPMHPD driver support for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
Add RPMH Regulator driver changes for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
Add RPMHPD DT change for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
Add RPMh regulator DT changes for Nord. Signed-off-by: Dhruvin Rajpura <drajpura@qti.qualcomm.com>
shawngsc
force-pushed
the
early/hwe/nord-next
branch
from
July 22, 2026 06:49
3a46c22 to
5a23dba
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.