linux-next.git/net/wireless, branch master

wifi: nl80211: add support to configure 6 GHz non-HT duplicate transmission

2026-09-04T10:24:10+00:00

As per IEEE Std 802.11-2024, subclause 26.17.2.2, a 6 GHz AP can transmit a Beacon frame using a non-HT duplicate PPDU, so that stations scanning only PSC channels can discover it. Currently, there is no mechanism to request the driver to transmit non-HT duplicate Beacon frames. In [1], changes were made to parse the Beacon from user-space to set the non-HT duplicate flag in the kernel. However, it was suggested that non-HT transmission be part of the Beacon TX rate settings. Hence, add NL80211_TXRATE_6GHZ_NON_HT_DUP as a flag attribute under NL80211_ATTR_TX_RATES to let user-space request the driver to transmit non-HT duplicate Beacons. Also add validation to reject the Beacon if non-HT duplicate Beacon transmission is enabled when legacy rates are not configured. [1] https://lore.kernel.org/all/1644914581-21682-1-git-send-email-quic_ramess@quicinc.com/ Signed-off-by: Manish Dharanenthiran Link: https://patch.msgid.link/20260805-dup-beacon-v1-1-68574869c896@oss.qualcomm.com Signed-off-by: Johannes Berg

wifi: nl80211: don't export nl80211_mlo_reconf_add_done()

2026-09-04T08:31:12+00:00

This function is only used and only usable by cfg80211 itself, so don't export it. Link: https://patch.msgid.link/20260802210800.1733352-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg

wifi: update UHR to Draft_P802.11bn D1.5

2026-09-04T08:30:16+00:00

Update various definitions and in particular NPCA parsing to D1.5. Link: https://patch.msgid.link/20260731140351.0798bb37908d.I13592341f7f53f7566f9eeb74f0a0b85e73c1fef@changeid Signed-off-by: Johannes Berg

Merge tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2026-08-06T19:39:11+00:00

Johannes Berg says: ==================== Quite a bunch more work, of note: - iwlwifi: new FW version support - mt76: - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - rtw89: - LED support - RTL8922DE support - dual-BT coex for RTL8922D - ath12k: AHB platform MultiPD support - cfg80211: pre-assign cookies for operations - mac80211: AQL support for multicast * tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits) wifi: nxpwifi: bound uAP association event IEs to the event buffer wifi: nxpwifi: detach sync command buffer on interrupted wait wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rsi: Fix types to appease CFI wifi: mac80211: skip default WMM setup for AP_VLAN links wifi: nxpwifi: fix multiple static analysis errors and warnings wifi: morsemicro: MM81X should be invisible and selected by its users wifi: nxp: NXPWIFI should be invisible and selected by its users wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: mac80211: disconnect on CSA to channel 0 wifi: brcmfmac: fix P2P action frame handling without device vif wifi: brcmfmac: Set DMA direction for msgbuf packet IDs wifi: brcmfmac: validate msgbuf flowring IDs before use wifi: mac80211: fix RCU usage in peer probing wifi: mac80211: fix RCU dereference in throughput estimate wifi: wilc1000: validate monitor transmit frame headers wifi: mac80211: skip unused probe response countdown offsets wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: nl80211: clean up color-change beacon data on errors wifi: mac80211: send TWT teardown to peer after setup TX failure ... ==================== Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski

wifi: cfg80211: stop PMSR before P2P and NAN teardown

2026-08-02T17:06:33+00:00

PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not. Those helpers are also called directly by nl80211, rfkill shutdown, and wireless_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result. Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers. Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260731071103.73563-1-enderaoelyther@gmail.com Signed-off-by: Johannes Berg

wifi: nl80211: clean up color-change beacon data on errors

2026-08-02T16:23:27+00:00

nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error. Allocate the nested attribute table before parsing beacon_next. Its allocation failure can then return before beacon data exists, while a later parsing failure uses out: to release the parsed data. Fixes: dc1e3cb8da8b ("nl80211: MBSSID and EMA support in AP mode") Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Assisted-by: Kimi:K3 Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260731120244.82628-1-enderaoelyther@gmail.com Signed-off-by: Johannes Berg

wifi: nl80211: send frame tx status event only for non-zero cookie

2026-08-02T15:40:08+00:00

The cookie value assigned by cfg80211_assign_cookie() is guaranteed to be non-zero. So the zero cookie value has special use in tx_control_port where userspace can indicate dont_wait_for_ack, ie. not interested in status. The wil6210 driver also uses the zero cookie when wil_cfg80211_mgmt_tx() is invoked from debugfs api the driver provides so the event is also redundant in that scenario. Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-14-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

wifi: cfg80211: convert tx_control_port cookie to input parameter

2026-08-02T15:40:08+00:00

The tx_control_port op was excluded from the previous commit because a NULL cookie was affecting different behavior, ie. signalling that no TX status is wanted. Since cfg80211_assign_cookie() guarantees a non-zero value, cookie value 0 can be used instead. So pass 0 when dont_wait_for_ack is set, otherwise pass value returned from cfg80211_assign_cookie() call. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-13-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

wifi: cfg80211: convert cookie output to input parameter

2026-08-02T15:40:08+00:00

The remain_on_channel, mgmt_tx, and probe_peer ops previously used a u64 *cookie output parameter. Now that cfg80211 pre-assigns the cookie value before invoking drivers, the parameter conveys a value from caller to driver, not the other way around. Convert it to a plain u64 input parameter across the ops struct (cfg80211.h), rdev-ops.h wrappers, nl80211.c/mlme.c call sites, mac80211, and all driver implementations. The tx_control_port op is excluded: its cookie pointer is nullable (passed as NULL when dont_wait_for_ack is set), so the nullable pointer semantics are still required. Internal mac80211 helpers ieee80211_start_roc_work() and ieee80211_attach_ack_skb() still take u64 *cookie because they assign to the pointee; their callers now pass &cookie to take the address of the local value parameter. wil6210's internal wil_p2p_listen() is also updated to take u64 cookie since it is called directly from the remain_on_channel callback. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-12-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

wifi: cfg80211: pre-assign cookie for driver callbacks

2026-08-02T15:40:06+00:00

Having a single place for cookie assignment and keeping that responsibility in the cfg80211 subsystem is a logical choice as it handles the userspace nl80211 API. add_nan_func already does this: cfg80211 calls cfg80211_assign_cookie() before invoking the driver. Apply the same pattern to remain_on_channel, mgmt_tx, probe_peer and tx_control_port by pre-assigning the cookie in the nl80211 command handlers before the rdev_* call. For tx_control_port the cookie is only pre-assigned when the caller requests an ack (cookie pointer non-NULL). Drivers may still overwrite the value for now; subsequent patches will remove per-driver cookie generation. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-2-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg