Commit 2248db6d authored by Johannes Berg's avatar Johannes Berg
Browse files

Merge tag 'iwlwifi-fixes-2026-05-16' of... 

Merge tag 'iwlwifi-fixes-2026-05-16' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next



Miri Korenblit says:
====================
wifi: iwlwifi: fixes - 2026-05-16

Contains:
wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
wifi: iwlwifi: mld: stop TX during firmware restart
wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o BSS vif
wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx
wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
wifi: iwlwifi: use correct function to read STEP_URM register
====================

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parents a6e6ccd5 734a4e05

drivers/net/wireless/intel/iwlwifi/mld/constants.h

+2 −2
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */

/*

 * Copyright (C) 2024-2025 Intel Corporation

 * Copyright (C) 2024-2026 Intel Corporation

 */

#ifndef __iwl_mld_constants_h__

#define __iwl_mld_constants_h__



#define IWL_MLD_MISSED_BEACONS_SINCE_RX_THOLD			4

#define IWL_MLD_MISSED_BEACONS_SINCE_RX_THOLD			6

#define IWL_MLD_MISSED_BEACONS_THRESHOLD			8

#define IWL_MLD_MISSED_BEACONS_THRESHOLD_LONG			19

#define IWL_MLD_BCN_LOSS_EXIT_ESR_THRESH_2_LINKS		5

drivers/net/wireless/intel/iwlwifi/mld/d3.c

+3 −3
Original line number Diff line number Diff line
@@ -1930,12 +1930,12 @@ int iwl_mld_wowlan_suspend(struct iwl_mld *mld, struct cfg80211_wowlan *wowlan) 
	if (WARN_ON(!wowlan))

		return 1;



	IWL_DEBUG_WOWLAN(mld, "Starting the wowlan suspend flow\n");



	bss_vif = iwl_mld_get_bss_vif(mld);

	if (WARN_ON(!bss_vif))

	if (!bss_vif)

		return 1;



	IWL_DEBUG_WOWLAN(mld, "Starting the wowlan suspend flow\n");



	if (!bss_vif->cfg.assoc) {

		int ret;

		/* If we're not associated, this must be netdetect */

drivers/net/wireless/intel/iwlwifi/mld/link.c

+6 −7
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause

/*

 * Copyright (C) 2024-2025 Intel Corporation

 * Copyright (C) 2024-2026 Intel Corporation

 */



#include "constants.h"
@@ -504,7 +504,6 @@ void iwl_mld_remove_link(struct iwl_mld *mld, 
	struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(bss_conf->vif);

	struct iwl_mld_link *link = iwl_mld_link_from_mac80211(bss_conf);

	bool is_deflink = link == &mld_vif->deflink;

	u8 fw_id = link->fw_id;



	if (WARN_ON(!link || link->active))

		return;
@@ -512,15 +511,15 @@ void iwl_mld_remove_link(struct iwl_mld *mld, 
	iwl_mld_rm_link_from_fw(mld, bss_conf);

	/* Continue cleanup on failure */



	if (!is_deflink)

		kfree_rcu(link, rcu_head);



	RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);



	if (WARN_ON(fw_id >= mld->fw->ucode_capa.num_links))

	if (WARN_ON(link->fw_id >= mld->fw->ucode_capa.num_links))

		return;



	RCU_INIT_POINTER(mld->fw_id_to_bss_conf[fw_id], NULL);

	RCU_INIT_POINTER(mld->fw_id_to_bss_conf[link->fw_id], NULL);



	if (!is_deflink)

		kfree_rcu(link, rcu_head);

}



void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,

drivers/net/wireless/intel/iwlwifi/mld/tx.c

+14 −1
Original line number Diff line number Diff line
@@ -834,7 +834,7 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, 
		return -EINVAL;



	max_tid_amsdu_len = sta->cur->max_tid_amsdu_len[tid];

	if (!max_tid_amsdu_len)

	if (!max_tid_amsdu_len || max_tid_amsdu_len == 1)

		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs);



	/* Sub frame header + SNAP + IP header + TCP header + MSS */
@@ -846,6 +846,9 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, 
	 */

	num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad);



	if (WARN_ON_ONCE(!num_subframes))

		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs);



	if (sta->max_amsdu_subframes &&

	    num_subframes > sta->max_amsdu_subframes)

		num_subframes = sta->max_amsdu_subframes;
@@ -970,6 +973,16 @@ void iwl_mld_tx_from_txq(struct iwl_mld *mld, struct ieee80211_txq *txq) 
	struct sk_buff *skb = NULL;

	u8 zero_addr[ETH_ALEN] = {};



	/*

	 * Don't transmit during firmware restart. The firmware is dead,

	 * so iwl_trans_tx() would return -EIO for each frame. Avoid the

	 * overhead of dequeuing from mac80211 only to immediately free

	 * the skbs, and the potential memory pressure from rapid skb

	 * allocation churn during high-throughput restart scenarios.

	 */

	if (unlikely(mld->fw_status.in_hw_restart))

		return;



	/*

	 * No need for threads to be pending here, they can leave the first

	 * taker all the work.

drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c

+18 −9
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause

/*

 * Copyright (C) 2012-2014, 2018-2025 Intel Corporation

 * Copyright (C) 2012-2014, 2018-2026 Intel Corporation

 * Copyright (C) 2013-2014 Intel Mobile Communications GmbH

 * Copyright (C) 2015-2017 Intel Deutschland GmbH

 */
@@ -927,13 +927,18 @@ u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct iwl_mvm *mvm, 


u16 iwl_mvm_mac_ctxt_get_beacon_flags(const struct iwl_fw *fw, u8 rate_idx)

{

	u16 flags = iwl_mvm_mac80211_idx_to_hwrate(fw, rate_idx);

	bool is_new_rate = iwl_fw_lookup_cmd_ver(fw, BEACON_TEMPLATE_CMD, 0) > 10;

	u16 flags = 0;



	if (rate_idx <= IWL_LAST_CCK_RATE)

		flags |= is_new_rate ? IWL_MAC_BEACON_CCK

			  : IWL_MAC_BEACON_CCK_V1;



	if (iwl_fw_lookup_cmd_ver(fw, TX_CMD, 0) > 8)

		flags |= iwl_mvm_mac80211_idx_to_hwrate(fw, rate_idx);

	else

		flags |= iwl_fw_rate_idx_to_plcp(rate_idx);



	return flags;

}
@@ -962,6 +967,7 @@ static void iwl_mvm_mac_ctxt_set_tx(struct iwl_mvm *mvm, 
{

	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);

	struct ieee80211_tx_info *info;

	u32 rate_n_flags = 0;

	u8 rate;

	u32 tx_flags;
@@ -981,18 +987,21 @@ static void iwl_mvm_mac_ctxt_set_tx(struct iwl_mvm *mvm, 
			 IWL_UCODE_TLV_CAPA_BEACON_ANT_SELECTION)) {

		iwl_mvm_toggle_tx_ant(mvm, &mvm->mgmt_last_antenna_idx);



		tx_params->rate_n_flags =

			cpu_to_le32(BIT(mvm->mgmt_last_antenna_idx) <<

				    RATE_MCS_ANT_POS);

		rate_n_flags |= BIT(mvm->mgmt_last_antenna_idx) <<

					RATE_MCS_ANT_POS;

	}



	rate = iwl_mvm_mac_ctxt_get_beacon_rate(mvm, info, vif);



	tx_params->rate_n_flags |=

		cpu_to_le32(iwl_mvm_mac80211_idx_to_hwrate(mvm->fw, rate));

	if (rate == IWL_FIRST_CCK_RATE)

		tx_params->rate_n_flags |= cpu_to_le32(RATE_MCS_CCK_MSK_V1);

	if (rate < IWL_FIRST_OFDM_RATE)

		rate_n_flags |= RATE_MCS_MOD_TYPE_CCK;

	else

		rate_n_flags |= RATE_MCS_MOD_TYPE_LEGACY_OFDM;



	rate_n_flags |= iwl_mvm_mac80211_idx_to_hwrate(mvm->fw, rate);



	tx_params->rate_n_flags = iwl_mvm_v3_rate_to_fw(rate_n_flags,

							mvm->fw_rates_ver);

}



int iwl_mvm_mac_ctxt_send_beacon_cmd(struct iwl_mvm *mvm,