<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/net/wireless, branch master</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Merge tag 'wireless-2026-11-02' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless</title>
<updated>2026-11-04T14:00:50+00:00</updated>
<author>
<name>Paolo Abeni</name>
<email>pabeni@redhat.com</email>
</author>
<published>2026-11-04T14:00:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c4328134f3f7c2ce141121a8f82a5ec0cc8a709c'/>
<id>c4328134f3f7c2ce141121a8f82a5ec0cc8a709c</id>
<content type='text'>
Johannes Berg says:

====================
A few fixes to start with:
 - wext: fix notifier netns interaction
 - rsi: avoid TID OOB access
 - mac80211: reload pointer, fix A-MPDU flags
 - brcmfmac: fix DMA regression
 - cfg80211: fix regdb validation

* tag 'wireless-2026-11-02' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: reinstate IEEE80211_TX_CTL_AMPDU flag in ieee80211_tx_prep_agg()
  wifi: cfg80211: fix out-of-bounds read in valid_rule()
  wifi: rsi: Skip TX aggregation setup for non-QoS frames
  wifi: wext: Limit notifier event flushes to the device's netns
  wifi: brcmfmac: map msgbuf RX packet IDs bidirectional
  wifi: mac80211: reload TDLS header pointer after skb_linearize()
====================

Link: https://patch.msgid.link/20261102104649.727621-3-johannes@sipsolutions.net
Signed-off-by: Paolo Abeni &lt;pabeni@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Johannes Berg says:

====================
A few fixes to start with:
 - wext: fix notifier netns interaction
 - rsi: avoid TID OOB access
 - mac80211: reload pointer, fix A-MPDU flags
 - brcmfmac: fix DMA regression
 - cfg80211: fix regdb validation

* tag 'wireless-2026-11-02' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: reinstate IEEE80211_TX_CTL_AMPDU flag in ieee80211_tx_prep_agg()
  wifi: cfg80211: fix out-of-bounds read in valid_rule()
  wifi: rsi: Skip TX aggregation setup for non-QoS frames
  wifi: wext: Limit notifier event flushes to the device's netns
  wifi: brcmfmac: map msgbuf RX packet IDs bidirectional
  wifi: mac80211: reload TDLS header pointer after skb_linearize()
====================

Link: https://patch.msgid.link/20261102104649.727621-3-johannes@sipsolutions.net
Signed-off-by: Paolo Abeni &lt;pabeni@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next</title>
<updated>2026-10-23T01:58:00+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-10-23T01:58:00+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=734bef548a96e8774d6eef5dfa2026c6edc4e80b'/>
<id>734bef548a96e8774d6eef5dfa2026c6edc4e80b</id>
<content type='text'>
Pull networking updates from Paolo Abeni:
 "This includes a significant number of low-priority fixes - especially
  in the NIC drivers area - that we deferred from the last few RCs in
  the previous cycle, which can't be easily outlined in the synopsis
  below.

  Core &amp; protocols:

   - Continue the work on removing rtnl_lock dependencies:
      - per-netns ARP and ND neighbour tables, with the default settings
        now configurable per netns (inheritance from init_net is
        controlled by the new net.core.neigh_inherit_init_net sysctl)
      - RCU-protected configuration and rtnl_lock-less fill_info() for
        hsr, netkit, sit, vlan and vxlan devices
      - per-netns device unregistration for ip tunnel and gre devices
      - use the netdev instance lock instead of rtnl_lock when reading
        speed and duplex via sysfs
      - batch the flushing of uncached routes at device unregistration
        time, relieving rtnl_lock contention on netns dismantle.

   - Add hardware pacing offload support, admin-controlled via a new
     rtnetlink attribute, with sch_fq integration (implemented in idpf).

   - Re-segment BIG TCP GSO packets into GSO packets fitting the egress
     device limits instead of plain MSS-sized segments, improving
     throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.

   - Generate RSS keys that spread flows over all the RX queues; the
     previous random keys could leave some queues unused.

   - Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
     fdb entries and consider only VLAN members when flooding, for ~10%
     more Mpps in the fdb forwarding path.

   - A few TCP/IP performance improvements aimed at efficient cache
     usage and reducing contention.

   - Add the TCP ROCCET congestion control, a CUBIC variant aimed at
     avoiding bufferbloat in cellular networks.

   - Continue the conversion of getsockopt callbacks to sockopt_t.

   - Add an ethtool command to list the front-facing ports of an
     interface, including SFP cages and modules, using the phy_port
     representation.

   - Enable BIG TCP support for bareudp tunnels.

   - Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
     transitions (listen() + shutdown() + connect() and connect() +
     connect(AF_UNSPEC) + listen()).

   - Remove most BUG_ON()s from core packet processing, replacing them
     with error paths.

  Wireless:

   - Latency improvements, including lockless station get/dump and
     beacon updates, plus RTNL reduction and locking cleanups.

   - Infrastructure for non-station TX/RX with MLO.

   - NAN (Wi-Fi Aware) Instant Communication support and other NAN
     improvements.

   - Control frame Integrity Protocol (CIP) and protected TWT support.

   - Improvements for AP regulatory checks.

  Netfilter:

   - Disable br_netfilter in user namespaces and schedule it for removal
     in 2027.

   - Restrict the raw table in nft_compat to the specific family, hook
     and priority.

   - Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
     versa).

   - Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
     integration with memcg.

   - Allow discovering conntrack zone filtering support in ctnetlink
     dumps, and fix nfnetlink_hook handling of large dumps.

  Deletions:

   - Move the LLC type 2 sockets out of tree. There are no known users
     and the code attracts a never-ending stream of LLM-driven fixes.

  Device drivers:

   - New drivers:
      - Meta Platforms NIC (mpnic), the second-generation NIC from Meta
      - initial skeleton of the Nebula-matrix NICs driver (nbl)
      - X-Powers AC200/AC300 Fast Ethernet PHYs

   - Ethernet high-speed NICs:
      - Intel:
         - i40e: XDP metadata support for RX hash and VLAN tag
         - ice: expose the E825 TSPLL state via the DPLL subsystem
      - nVidia/Mellanox:
         - move the data direct infrastructure from IB to core, in
           preparation for netdev support.
         - reduce the memory used per offloaded TC rule
      - Meta (fbnic):
         - support large io_uring zero-copy RX buffers
      - Microsoft vNIC (mana):
         - add BQL support

   - Ethernet NICs consumer, and embedded:
      - Airoha:
         - LRO offload support
      - Cadence (macb):
         - context swapping for ringparam and MTU changes, avoiding
           buffer loss under memory pressure
      - Mucse (rnpgbe):
         - TX/RX and link status support
      - NXP (enetc):
         - SR-IOV improvements and VF support for ENETC v4
      - Qualcomm (ppe):
         - IPQ5424 support
      - Realtek PCI (r8169):
         - phylink support
         - RSS support for RTL8127
      - Renesas (ravb):
         - gPTP support for R-Car Gen4
      - Synopsys (stmmac):
         - XDP multi-buffer support on the TX side
         - tc mqprio hw queue priority offload
         - support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
           DP1000 and Qualcomm sa8255p

   - Ethernet switches:
      - Mediatek (mt7530):
         - fast age and change conduit support
      - Microchip (ksz):
         - support for KSZ8995XA/KS8995XA
      - Microchip (lan966x):
         - PCIe FDMA support, ~20x throughput increase in PCIe endpoint
      - Microchip (sparx5):
         - Time Aware Shaper (taprio) offload
      - Motorcomm (yt921x):
         - LED and SerDes PCS support
      - Realtek (rtl8365mb):
         - EEE support

   - Ethernet PHYs:
      - Broadcom:
         - enable jumbo frames on BCM54xx
      - Realtek:
         - support for RTL8261CE_CG and RTL8261D_VM
         - MDIO support for RTL838x and RTL839x

   - WiFi drivers:
      - Broadcom (brcmfmac):
         - FT/OKC roaming offload
      - Intel (iwlwifi):
         - UHR sniffer support
         - support for newer UEFI/BIOS tables
      - MediaTek (mt76):
         - mt7925 NAN improvements
         - offchannel/scan improvements and MLO fixes
      - Morse Micro (mm81x):
         - monitor mode support
      - Qualcomm (ath12k):
         - IPQ5332 platform infrastructure
      - Realtek (rtw88):
         - RTL8723BS support
         - SDIO TX performance improvements
      - Realtek (rtw89):
         - P2P_DEVICE support
         - BT-coex updates for RTL8922D

   - Bluetooth:
      - move H:4 reassembly into the Bluetooth core
      - add generic support for vendor packets
      - MGMT: add security level changed event

   - Bluetooth drivers:
      - btusb: support Bulk Serialization Mode
      - Intel: support Draco and Titan Lake, allow unsigned firmware
      - Mediatek: MT7928 support
      - Qualcomm: QCC2072 support
      - Broadcom: Synaptics 4384 support"

* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
  Bluetooth: btusb: disable by default Qualcomm multi-subsystem
  tipc: fix broadcast sender hang on last acker departure
  tipc: fix use-after-free of broadcast reception link at node release
  r8169: clear TX LPI on RTL8168h at link up after phylink conversion
  tun: Require CAP_NET_ADMIN to attach to an ownerless device
  net/sched/sch_cake: drop dead nla_nest_end() error check
  net/sched/sch_cake: widen buffer_used to u64
  net/sched/sch_cake: reduce parent backlog when clearing a tin
  net/sched/sch_cake: serialize reconfiguration with the datapath
  tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
  net/mlx5e: Stop asserting for RTNL when closing channels
  net: shrink the payload-only part of skb dataref to one bit
  net: wwan: iosm: validate msg_head before indexing msg_ring
  net: bgmac: rate limit RX error messages
  selftests: net: veth: test XDP_TX to a peer with GRO enabled
  veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
  pppoe: delete session hash entries by pointer match
  net: lan969x: don't disable hardirqs in fdma tx clear
  net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
  net: lan969x: fix DSM calendar for empty taxis
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull networking updates from Paolo Abeni:
 "This includes a significant number of low-priority fixes - especially
  in the NIC drivers area - that we deferred from the last few RCs in
  the previous cycle, which can't be easily outlined in the synopsis
  below.

  Core &amp; protocols:

   - Continue the work on removing rtnl_lock dependencies:
      - per-netns ARP and ND neighbour tables, with the default settings
        now configurable per netns (inheritance from init_net is
        controlled by the new net.core.neigh_inherit_init_net sysctl)
      - RCU-protected configuration and rtnl_lock-less fill_info() for
        hsr, netkit, sit, vlan and vxlan devices
      - per-netns device unregistration for ip tunnel and gre devices
      - use the netdev instance lock instead of rtnl_lock when reading
        speed and duplex via sysfs
      - batch the flushing of uncached routes at device unregistration
        time, relieving rtnl_lock contention on netns dismantle.

   - Add hardware pacing offload support, admin-controlled via a new
     rtnetlink attribute, with sch_fq integration (implemented in idpf).

   - Re-segment BIG TCP GSO packets into GSO packets fitting the egress
     device limits instead of plain MSS-sized segments, improving
     throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.

   - Generate RSS keys that spread flows over all the RX queues; the
     previous random keys could leave some queues unused.

   - Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
     fdb entries and consider only VLAN members when flooding, for ~10%
     more Mpps in the fdb forwarding path.

   - A few TCP/IP performance improvements aimed at efficient cache
     usage and reducing contention.

   - Add the TCP ROCCET congestion control, a CUBIC variant aimed at
     avoiding bufferbloat in cellular networks.

   - Continue the conversion of getsockopt callbacks to sockopt_t.

   - Add an ethtool command to list the front-facing ports of an
     interface, including SFP cages and modules, using the phy_port
     representation.

   - Enable BIG TCP support for bareudp tunnels.

   - Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
     transitions (listen() + shutdown() + connect() and connect() +
     connect(AF_UNSPEC) + listen()).

   - Remove most BUG_ON()s from core packet processing, replacing them
     with error paths.

  Wireless:

   - Latency improvements, including lockless station get/dump and
     beacon updates, plus RTNL reduction and locking cleanups.

   - Infrastructure for non-station TX/RX with MLO.

   - NAN (Wi-Fi Aware) Instant Communication support and other NAN
     improvements.

   - Control frame Integrity Protocol (CIP) and protected TWT support.

   - Improvements for AP regulatory checks.

  Netfilter:

   - Disable br_netfilter in user namespaces and schedule it for removal
     in 2027.

   - Restrict the raw table in nft_compat to the specific family, hook
     and priority.

   - Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
     versa).

   - Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
     integration with memcg.

   - Allow discovering conntrack zone filtering support in ctnetlink
     dumps, and fix nfnetlink_hook handling of large dumps.

  Deletions:

   - Move the LLC type 2 sockets out of tree. There are no known users
     and the code attracts a never-ending stream of LLM-driven fixes.

  Device drivers:

   - New drivers:
      - Meta Platforms NIC (mpnic), the second-generation NIC from Meta
      - initial skeleton of the Nebula-matrix NICs driver (nbl)
      - X-Powers AC200/AC300 Fast Ethernet PHYs

   - Ethernet high-speed NICs:
      - Intel:
         - i40e: XDP metadata support for RX hash and VLAN tag
         - ice: expose the E825 TSPLL state via the DPLL subsystem
      - nVidia/Mellanox:
         - move the data direct infrastructure from IB to core, in
           preparation for netdev support.
         - reduce the memory used per offloaded TC rule
      - Meta (fbnic):
         - support large io_uring zero-copy RX buffers
      - Microsoft vNIC (mana):
         - add BQL support

   - Ethernet NICs consumer, and embedded:
      - Airoha:
         - LRO offload support
      - Cadence (macb):
         - context swapping for ringparam and MTU changes, avoiding
           buffer loss under memory pressure
      - Mucse (rnpgbe):
         - TX/RX and link status support
      - NXP (enetc):
         - SR-IOV improvements and VF support for ENETC v4
      - Qualcomm (ppe):
         - IPQ5424 support
      - Realtek PCI (r8169):
         - phylink support
         - RSS support for RTL8127
      - Renesas (ravb):
         - gPTP support for R-Car Gen4
      - Synopsys (stmmac):
         - XDP multi-buffer support on the TX side
         - tc mqprio hw queue priority offload
         - support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
           DP1000 and Qualcomm sa8255p

   - Ethernet switches:
      - Mediatek (mt7530):
         - fast age and change conduit support
      - Microchip (ksz):
         - support for KSZ8995XA/KS8995XA
      - Microchip (lan966x):
         - PCIe FDMA support, ~20x throughput increase in PCIe endpoint
      - Microchip (sparx5):
         - Time Aware Shaper (taprio) offload
      - Motorcomm (yt921x):
         - LED and SerDes PCS support
      - Realtek (rtl8365mb):
         - EEE support

   - Ethernet PHYs:
      - Broadcom:
         - enable jumbo frames on BCM54xx
      - Realtek:
         - support for RTL8261CE_CG and RTL8261D_VM
         - MDIO support for RTL838x and RTL839x

   - WiFi drivers:
      - Broadcom (brcmfmac):
         - FT/OKC roaming offload
      - Intel (iwlwifi):
         - UHR sniffer support
         - support for newer UEFI/BIOS tables
      - MediaTek (mt76):
         - mt7925 NAN improvements
         - offchannel/scan improvements and MLO fixes
      - Morse Micro (mm81x):
         - monitor mode support
      - Qualcomm (ath12k):
         - IPQ5332 platform infrastructure
      - Realtek (rtw88):
         - RTL8723BS support
         - SDIO TX performance improvements
      - Realtek (rtw89):
         - P2P_DEVICE support
         - BT-coex updates for RTL8922D

   - Bluetooth:
      - move H:4 reassembly into the Bluetooth core
      - add generic support for vendor packets
      - MGMT: add security level changed event

   - Bluetooth drivers:
      - btusb: support Bulk Serialization Mode
      - Intel: support Draco and Titan Lake, allow unsigned firmware
      - Mediatek: MT7928 support
      - Qualcomm: QCC2072 support
      - Broadcom: Synaptics 4384 support"

* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
  Bluetooth: btusb: disable by default Qualcomm multi-subsystem
  tipc: fix broadcast sender hang on last acker departure
  tipc: fix use-after-free of broadcast reception link at node release
  r8169: clear TX LPI on RTL8168h at link up after phylink conversion
  tun: Require CAP_NET_ADMIN to attach to an ownerless device
  net/sched/sch_cake: drop dead nla_nest_end() error check
  net/sched/sch_cake: widen buffer_used to u64
  net/sched/sch_cake: reduce parent backlog when clearing a tin
  net/sched/sch_cake: serialize reconfiguration with the datapath
  tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
  net/mlx5e: Stop asserting for RTNL when closing channels
  net: shrink the payload-only part of skb dataref to one bit
  net: wwan: iosm: validate msg_head before indexing msg_ring
  net: bgmac: rate limit RX error messages
  selftests: net: veth: test XDP_TX to a peer with GRO enabled
  veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
  pppoe: delete session hash entries by pointer match
  net: lan969x: don't disable hardirqs in fdma tx clear
  net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
  net: lan969x: fix DSM calendar for empty taxis
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rsi: Skip TX aggregation setup for non-QoS frames</title>
<updated>2026-10-22T10:04:02+00:00</updated>
<author>
<name>Alex Kazinsky</name>
<email>a.kazinsky@ideco.ru</email>
</author>
<published>2026-10-15T07:20:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=71f756a4c064b0312f46617c20893ecc17c332e4'/>
<id>71f756a4c064b0312f46617c20893ecc17c332e4</id>
<content type='text'>
When transmitting a non-QoS unicast frame to a station in AP mode,
rsi_core_xmit() assigns IEEE80211_NONQOS_TID (16) to tid. The station
lookup succeeds, allowing tid to index start_tx_aggr[], which has only
IEEE80211_NUM_TIDS (16) elements. This causes an out-of-bounds read and,
if the value read is zero, an out-of-bounds write.

Only access the aggregation state for tids below IEEE80211_NUM_TIDS,
excluding the non-QoS sentinel from TX aggregation setup.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 19844c0a9a19 ("rsi: data and managemet path changes for AP mode")
Cc: stable@vger.kernel.org
Signed-off-by: Alex Kazinsky &lt;a.kazinsky@ideco.ru&gt;
Link: https://patch.msgid.link/20261015072010.742369-1-a.kazinsky@ideco.ru
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When transmitting a non-QoS unicast frame to a station in AP mode,
rsi_core_xmit() assigns IEEE80211_NONQOS_TID (16) to tid. The station
lookup succeeds, allowing tid to index start_tx_aggr[], which has only
IEEE80211_NUM_TIDS (16) elements. This causes an out-of-bounds read and,
if the value read is zero, an out-of-bounds write.

Only access the aggregation state for tids below IEEE80211_NUM_TIDS,
excluding the non-QoS sentinel from TX aggregation setup.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 19844c0a9a19 ("rsi: data and managemet path changes for AP mode")
Cc: stable@vger.kernel.org
Signed-off-by: Alex Kazinsky &lt;a.kazinsky@ideco.ru&gt;
Link: https://patch.msgid.link/20261015072010.742369-1-a.kazinsky@ideco.ru
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: brcmfmac: map msgbuf RX packet IDs bidirectional</title>
<updated>2026-10-22T09:59:42+00:00</updated>
<author>
<name>Jason Perlow</name>
<email>jperlow@gmail.com</email>
</author>
<published>2026-10-21T17:22:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7ed5dce55fa8393972b1bf2bf5af1c818c5e7dc2'/>
<id>7ed5dce55fa8393972b1bf2bf5af1c818c5e7dc2</id>
<content type='text'>
Commit f0ba5fd51ff2 ("wifi: brcmfmac: Set DMA direction for msgbuf
packet IDs") maps the RX packet ID buffers DMA_FROM_DEVICE. The
BCM4364 firmware also reads posted RX buffers, so with VT-d
translation enabled every such read faults ("PTE Read access is not
set") and the firmware crashes and resets in a loop.

Map the RX pool DMA_BIDIRECTIONAL again, as before that commit. TX
keeps DMA_TO_DEVICE.

Fixes: f0ba5fd51ff2 ("wifi: brcmfmac: Set DMA direction for msgbuf packet IDs")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Perlow &lt;jperlow@gmail.com&gt;
Signed-off-by: Aditya Garg &lt;aditya.garg@linux.dev&gt;
Acked-by: Arend van Spriel &lt;arend.vanspriel@broadcom.com&gt;
Link: https://patch.msgid.link/20261021172238.10004-1-aditya.garg@linux.dev
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit f0ba5fd51ff2 ("wifi: brcmfmac: Set DMA direction for msgbuf
packet IDs") maps the RX packet ID buffers DMA_FROM_DEVICE. The
BCM4364 firmware also reads posted RX buffers, so with VT-d
translation enabled every such read faults ("PTE Read access is not
set") and the firmware crashes and resets in a loop.

Map the RX pool DMA_BIDIRECTIONAL again, as before that commit. TX
keeps DMA_TO_DEVICE.

Fixes: f0ba5fd51ff2 ("wifi: brcmfmac: Set DMA direction for msgbuf packet IDs")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Perlow &lt;jperlow@gmail.com&gt;
Signed-off-by: Aditya Garg &lt;aditya.garg@linux.dev&gt;
Acked-by: Arend van Spriel &lt;arend.vanspriel@broadcom.com&gt;
Link: https://patch.msgid.link/20261021172238.10004-1-aditya.garg@linux.dev
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: change netdev_hw_addr_list count through helpers</title>
<updated>2026-10-21T08:51:26+00:00</updated>
<author>
<name>Yuyang Huang</name>
<email>sigefriedhyy@gmail.com</email>
</author>
<published>2026-10-12T01:17:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=778a262a6c690621a5c37d2a1cebc88e4585a870'/>
<id>778a262a6c690621a5c37d2a1cebc88e4585a870</id>
<content type='text'>
The count of a netdev_hw_addr_list is changed in several places of
dev_addr_lists.c and a few drivers read it directly. The next patch
needs to account every change of the count of dev-&gt;mc.

Add __hw_addr_count_add(), __hw_addr_count_inc(), __hw_addr_count_dec()
and __hw_addr_count_reset(), use them for every change of the count
and rename the field to _count so that a direct write stands out.
Readers keep using netdev_hw_addr_list_count() and the netdev_uc_count()
and netdev_mc_count() helpers, the few that read the field directly
are converted. No functional change.

Signed-off-by: Yuyang Huang &lt;sigefriedhyy@gmail.com&gt;
Reviewed-by: Nicolas Dichtel &lt;nicolas.dichtel@6wind.com&gt;
Link: https://patch.msgid.link/20261012011707.3378-3-sigefriedhyy@gmail.com
Signed-off-by: Paolo Abeni &lt;pabeni@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The count of a netdev_hw_addr_list is changed in several places of
dev_addr_lists.c and a few drivers read it directly. The next patch
needs to account every change of the count of dev-&gt;mc.

Add __hw_addr_count_add(), __hw_addr_count_inc(), __hw_addr_count_dec()
and __hw_addr_count_reset(), use them for every change of the count
and rename the field to _count so that a direct write stands out.
Readers keep using netdev_hw_addr_list_count() and the netdev_uc_count()
and netdev_mc_count() helpers, the few that read the field directly
are converted. No functional change.

Signed-off-by: Yuyang Huang &lt;sigefriedhyy@gmail.com&gt;
Reviewed-by: Nicolas Dichtel &lt;nicolas.dichtel@6wind.com&gt;
Link: https://patch.msgid.link/20261012011707.3378-3-sigefriedhyy@gmail.com
Signed-off-by: Paolo Abeni &lt;pabeni@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"</title>
<updated>2026-10-16T11:46:43+00:00</updated>
<author>
<name>Toke Høiland-Jørgensen</name>
<email>toke@toke.dk</email>
</author>
<published>2026-10-16T08:50:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=90201351a862182bdabfc1ad1c97b1e1b6ed5931'/>
<id>90201351a862182bdabfc1ad1c97b1e1b6ed5931</id>
<content type='text'>
This reverts commit 93ce8ea70451e800601bc9444aa33043de15d67b.

Mehmet reported that the offending commit breaks his AR9271 USB adapter
which uses zero-length replies to commands that don't return a value.
Revert the whole thing to restore the functionality.

Cc: stable@vger.kernel.org # the offending commit is in 6.12.113
Reported-by: Mehmet Fide &lt;mehmet.fide@gmail.com&gt;
Signed-off-by: Toke Høiland-Jørgensen &lt;toke@toke.dk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This reverts commit 93ce8ea70451e800601bc9444aa33043de15d67b.

Mehmet reported that the offending commit breaks his AR9271 USB adapter
which uses zero-length replies to commands that don't return a value.
Revert the whole thing to restore the functionality.

Cc: stable@vger.kernel.org # the offending commit is in 6.12.113
Reported-by: Mehmet Fide &lt;mehmet.fide@gmail.com&gt;
Signed-off-by: Toke Høiland-Jørgensen &lt;toke@toke.dk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'iwlwifi-next-2026-10-14' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next</title>
<updated>2026-10-14T10:16:42+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2026-10-14T10:16:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=313f802d6fac7e8a59782800c7c6c563689bd462'/>
<id>313f802d6fac7e8a59782800c7c6c563689bd462</id>
<content type='text'>
Miri Korenblit says:
====================
wifi: iwlwifi: updates - 2026-10-14

This contains our usual development commits, notably:
- UHR sniffer support
- Transport refactor: avoid indirection, bring virtualization back
- A UEFI lock for UEFI tables security
- New BIOS tables support
====================

Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Miri Korenblit says:
====================
wifi: iwlwifi: updates - 2026-10-14

This contains our usual development commits, notably:
- UHR sniffer support
- Transport refactor: avoid indirection, bring virtualization back
- A UEFI lock for UEFI tables security
- New BIOS tables support
====================

Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: iwlwifi: mld: include VI packets in low latency detection</title>
<updated>2026-10-14T08:56:40+00:00</updated>
<author>
<name>Endrik Einberg</name>
<email>git@endrik.dev</email>
</author>
<published>2026-10-05T14:42:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3627924ed81fd7783394fb2555ea179c6606a231'/>
<id>3627924ed81fd7783394fb2555ea179c6606a231</id>
<content type='text'>
iwl_mld_is_vo_vi_pkt() checks whether the mapped access category
is less than IEEE80211_AC_VI.
Since mac80211 defines IEEE80211_AC_VO as 0 and IEEE80211_AC_VI as 1,
this only matches voice traffic and excludes video traffic.

Synthetic video-priority UDP traffic does not automatically
activate low-latency mode, whereas voice-priority traffic does

Include IEEE80211_AC_VI as intended.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Signed-off-by: Endrik Einberg &lt;git@endrik.dev&gt;
Link: https://patch.msgid.link/20261005144225.170280-1-git@endrik.dev
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
iwl_mld_is_vo_vi_pkt() checks whether the mapped access category
is less than IEEE80211_AC_VI.
Since mac80211 defines IEEE80211_AC_VO as 0 and IEEE80211_AC_VI as 1,
this only matches voice traffic and excludes video traffic.

Synthetic video-priority UDP traffic does not automatically
activate low-latency mode, whereas voice-priority traffic does

Include IEEE80211_AC_VI as intended.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Signed-off-by: Endrik Einberg &lt;git@endrik.dev&gt;
Link: https://patch.msgid.link/20261005144225.170280-1-git@endrik.dev
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: iwlwifi: trans: remove the unused write8 operation</title>
<updated>2026-10-14T08:56:40+00:00</updated>
<author>
<name>Miri Korenblit</name>
<email>miriam.rachel.korenblit@intel.com</email>
</author>
<published>2026-10-11T11:07:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=afbb3c6bd7010fa47844626540ce84c85dd65656'/>
<id>afbb3c6bd7010fa47844626540ce84c85dd65656</id>
<content type='text'>
Unlike the other bus operations, write8 has no generic wrapper and is
never dispatched through trans-&gt;ops: all the callers are in the pcie
code and call iwl_trans_pcie_write8() directly. Remove it.

Assisted-by: LLM
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
Link: https://patch.msgid.link/20261011140453.fecac6ba37d1.Icf8e741c8ccc6eff1abd046223b575c07f69aff5@changeid
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Unlike the other bus operations, write8 has no generic wrapper and is
never dispatched through trans-&gt;ops: all the callers are in the pcie
code and call iwl_trans_pcie_write8() directly. Remove it.

Assisted-by: LLM
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
Link: https://patch.msgid.link/20261011140453.fecac6ba37d1.Icf8e741c8ccc6eff1abd046223b575c07f69aff5@changeid
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: iwlwifi: support SCD_QUEUE_CONFIG_CMD version 4</title>
<updated>2026-10-14T08:56:39+00:00</updated>
<author>
<name>Johannes Berg</name>
<email>johannes.berg@intel.com</email>
</author>
<published>2026-10-11T11:07:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b359cbb421490e1221710665859bebe70fc614ad'/>
<id>b359cbb421490e1221710665859bebe70fc614ad</id>
<content type='text'>
This version has a new flags field that must be set to
indicate which other fields are valid, in preparation
for moving queue pointers during SMD transition.

Only set the IWL_SCD_QUEUE_MODIFY_FLAG_STA_MSK flag on
the existing users of the command for now.

Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
Link: https://patch.msgid.link/20261011140453.534cc32f2ac6.I394c38c58ad6619e3e52b52c3bc686acbbd2e4f1@changeid
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This version has a new flags field that must be set to
indicate which other fields are valid, in preparation
for moving queue pointers during SMD transition.

Only set the IWL_SCD_QUEUE_MODIFY_FLAG_STA_MSK flag on
the existing users of the command for now.

Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
Link: https://patch.msgid.link/20261011140453.534cc32f2ac6.I394c38c58ad6619e3e52b52c3bc686acbbd2e4f1@changeid
Signed-off-by: Miri Korenblit &lt;miriam.rachel.korenblit@intel.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
