From: Jiale Yao <yaojiale02@163.com>
To: Felix Fietkau <nbd@nbd.name>,
Lorenzo Bianconi <lorenzo@kernel.org>,
Ryder Lee <ryder.lee@mediatek.com>,
Shayne Chen <shayne.chen@mediatek.com>,
Sean Wang <sean.wang@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
MeiChia Chiu <meichia.chiu@mediatek.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Cc: Jiale Yao <yaojiale02@163.com>
Subject: [PATCH 2/2] wifi: mt76: mt7996: clamp EHT beamforming NSS
Date: Mon, 19 Oct 2026 18:10:42 +0800 [thread overview]
Message-ID: <20261019101043.1922205-3-yaojiale02@163.com> (raw)
In-Reply-To: <20261019101043.1922205-1-yaojiale02@163.com>
An EHT peer can advertise zero receive spatial streams for an MCS
range. The beamforming setup decrements that value, causing an
underflow and sending an invalid column count to firmware.
Clamp the converted NSS value to zero for 80, 160, and 320 MHz
beamforming configurations.
Fixes: ba01944adee9 ("wifi: mt76: mt7996: add EHT beamforming support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index e6243dd33c31..29b67248fad7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -1969,7 +1969,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
struct ieee80211_eht_cap_elem_fixed *pe = &pc->eht_cap_elem;
struct ieee80211_eht_mcs_nss_supp *eht_nss = &pc->eht_mcs_nss_supp;
u8 nss_mcs = u8_get_bits(eht_nss->bw._80.rx_tx_mcs9_max_nss,
- IEEE80211_EHT_MCS_NSS_RX) - 1;
+ IEEE80211_EHT_MCS_NSS_RX);
const struct ieee80211_eht_cap_elem_fixed *ve;
const struct ieee80211_sta_eht_cap *vc;
u8 snd_dim, sts;
@@ -1988,6 +1988,7 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_80MHZ_MASK, ve->phy_cap_info[2]);
sts = EHT_PHY(CAP0_BEAMFORMEE_SS_80MHZ_MASK, pe->phy_cap_info[0]) +
(EHT_PHY(CAP1_BEAMFORMEE_SS_80MHZ_MASK, pe->phy_cap_info[1]) << 1);
+ nss_mcs = nss_mcs ? nss_mcs - 1 : 0;
bf->nrow = min_t(u8, snd_dim, sts);
bf->ncol = min_t(u8, nss_mcs, bf->nrow);
bf->ibf_ncol = explicit ? min_t(u8, MT7996_IBF_MAX_NC, bf->ncol) :
@@ -2001,7 +2002,8 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
snd_dim = EHT_PHY(CAP2_SOUNDING_DIM_160MHZ_MASK, ve->phy_cap_info[2]);
sts = EHT_PHY(CAP1_BEAMFORMEE_SS_160MHZ_MASK, pe->phy_cap_info[1]);
nss_mcs = u8_get_bits(eht_nss->bw._160.rx_tx_mcs9_max_nss,
- IEEE80211_EHT_MCS_NSS_RX) - 1;
+ IEEE80211_EHT_MCS_NSS_RX);
+ nss_mcs = nss_mcs ? nss_mcs - 1 : 0;
bf->nrow_gt_bw80 = min_t(u8, snd_dim, sts);
bf->ncol_gt_bw80 = nss_mcs;
@@ -2012,7 +2014,8 @@ mt7996_mcu_sta_bfer_eht(struct ieee80211_link_sta *link_sta,
ve->phy_cap_info[3]) << 1);
sts = EHT_PHY(CAP1_BEAMFORMEE_SS_320MHZ_MASK, pe->phy_cap_info[1]);
nss_mcs = u8_get_bits(eht_nss->bw._320.rx_tx_mcs9_max_nss,
- IEEE80211_EHT_MCS_NSS_RX) - 1;
+ IEEE80211_EHT_MCS_NSS_RX);
+ nss_mcs = nss_mcs ? nss_mcs - 1 : 0;
bf->nrow_gt_bw80 = min_t(u8, snd_dim, sts) << 4;
bf->ncol_gt_bw80 = nss_mcs << 4;
--
2.34.1
next prev parent reply other threads:[~2026-10-19 10:11 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 10:10 [PATCH 0/2] wifi: mt76: mt7996: clamp " Jiale Yao
2026-10-19 10:10 ` [PATCH 1/2] wifi: mt76: mt7996: clamp VHT/HE " Jiale Yao
2026-10-19 10:10 ` Jiale Yao [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-10-19 9:33 [PATCH 0/2] wifi: mt76: mt7996: clamp " Jiale Yao
2026-10-19 9:33 ` [PATCH 2/2] wifi: mt76: mt7996: clamp EHT " Jiale Yao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261019101043.1922205-3-yaojiale02@163.com \
--to=yaojiale02@163.com \
--cc=angelogioacchino.delregno@collabora.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=meichia.chiu@mediatek.com \
--cc=nbd@nbd.name \
--cc=ryder.lee@mediatek.com \
--cc=sean.wang@mediatek.com \
--cc=shayne.chen@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®