Commit 629840e2 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2025-08-28' of... 

Merge tag 'wireless-2025-08-28' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Some fixes for the current cycle:
 - mt76: MLO regressions, offchannel handling, list corruption
 - mac80211: scan allocation size, no 40 MHz EHT, signed type
 - rt2x00: (randconfig) build
 - cfg80211: use-after-free
 - iwlwifi: config/old devices, BIOS compatibility
 - mwifiex: vmalloc content leak

* tag 'wireless-2025-08-28' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (29 commits)
  wifi: iwlwifi: cfg: add back more lost PCI IDs
  wifi: iwlwifi: fix byte count table for old devices
  wifi: iwlwifi: cfg: restore some 1000 series configs
  wifi: mwifiex: Initialize the chan_stats array to zero
  wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz
  wifi: iwlwifi: uefi: check DSM item validity
  wifi: iwlwifi: acpi: check DSM func validity
  wifi: iwlwifi: if scratch is ~0U, consider it a failure
  wifi: mt76: fix linked list corruption
  wifi: mt76: free pending offchannel tx frames on wcid cleanup
  wifi: mt76: mt7915: fix list corruption after hardware restart
  wifi: mt76: mt7996: add missing check for rx wcid entries
  wifi: mt76: do not add non-sta wcid entries to the poll list
  wifi: mt76: mt7996: fix crash on some tx status reports
  wifi: mt76: mt7996: use the correct vif link for scanning/roc
  wifi: mt76: mt7996: disable beacons when going offchannel
  wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
  wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state for sta_cmd
  wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
  wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
  ...
====================

Link: https://patch.msgid.link/20250828122654.1167754-8-johannes@sipsolutions.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 9c736ace 2c72c8d3

drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c

+2 −4
Original line number Diff line number Diff line
@@ -393,10 +393,8 @@ void brcmf_btcoex_detach(struct brcmf_cfg80211_info *cfg) 
	if (!cfg->btcoex)

		return;



	if (cfg->btcoex->timer_on) {

		cfg->btcoex->timer_on = false;

	timer_shutdown_sync(&cfg->btcoex->timer);

	}

	cfg->btcoex->timer_on = false;



	cancel_work_sync(&cfg->btcoex->work);

drivers/net/wireless/intel/iwlwifi/fw/acpi.c

+24 −1
Original line number Diff line number Diff line
@@ -169,7 +169,7 @@ int iwl_acpi_get_dsm(struct iwl_fw_runtime *fwrt, 


	BUILD_BUG_ON(ARRAY_SIZE(acpi_dsm_size) != DSM_FUNC_NUM_FUNCS);



	if (WARN_ON(func >= ARRAY_SIZE(acpi_dsm_size)))

	if (WARN_ON(func >= ARRAY_SIZE(acpi_dsm_size) || !func))

		return -EINVAL;



	expected_size = acpi_dsm_size[func];
@@ -178,6 +178,29 @@ int iwl_acpi_get_dsm(struct iwl_fw_runtime *fwrt, 
	if (expected_size != sizeof(u8) && expected_size != sizeof(u32))

		return -EOPNOTSUPP;



	if (!fwrt->acpi_dsm_funcs_valid) {

		ret = iwl_acpi_get_dsm_integer(fwrt->dev, ACPI_DSM_REV,

					       DSM_FUNC_QUERY,

					       &iwl_guid, &tmp,

					       acpi_dsm_size[DSM_FUNC_QUERY]);

		if (ret) {

			/* always indicate BIT(0) to avoid re-reading */

			fwrt->acpi_dsm_funcs_valid = BIT(0);

			return ret;

		}



		IWL_DEBUG_RADIO(fwrt, "ACPI DSM validity bitmap 0x%x\n",

				(u32)tmp);

		/* always indicate BIT(0) to avoid re-reading */

		fwrt->acpi_dsm_funcs_valid = tmp | BIT(0);

	}



	if (!(fwrt->acpi_dsm_funcs_valid & BIT(func))) {

		IWL_DEBUG_RADIO(fwrt, "ACPI DSM %d not indicated as valid\n",

				func);

		return -ENODATA;

	}



	ret = iwl_acpi_get_dsm_integer(fwrt->dev, ACPI_DSM_REV, func,

				       &iwl_guid, &tmp, expected_size);

	if (ret)

drivers/net/wireless/intel/iwlwifi/fw/runtime.h

+8 −0
Original line number Diff line number Diff line
@@ -113,6 +113,10 @@ struct iwl_txf_iter_data { 
 * @phy_filters: specific phy filters as read from WPFC BIOS table

 * @ppag_bios_rev: PPAG BIOS revision

 * @ppag_bios_source: see &enum bios_source

 * @acpi_dsm_funcs_valid: bitmap indicating which DSM values are valid,

 *	zero (default initialization) means it hasn't been read yet,

 *	and BIT(0) is set when it has since function 0 also has this

 *	bitmap and is always supported

 */

struct iwl_fw_runtime {

	struct iwl_trans *trans;
@@ -189,6 +193,10 @@ struct iwl_fw_runtime { 
	bool uats_valid;

	u8 uefi_tables_lock_status;

	struct iwl_phy_specific_cfg phy_filters;



#ifdef CONFIG_ACPI

	u32 acpi_dsm_funcs_valid;

#endif

};



void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,

drivers/net/wireless/intel/iwlwifi/fw/uefi.c

+6 −0
Original line number Diff line number Diff line
@@ -747,6 +747,12 @@ int iwl_uefi_get_dsm(struct iwl_fw_runtime *fwrt, enum iwl_dsm_funcs func, 
		goto out;

	}



	if (!(data->functions[DSM_FUNC_QUERY] & BIT(func))) {

		IWL_DEBUG_RADIO(fwrt, "DSM func %d not in 0x%x\n",

				func, data->functions[DSM_FUNC_QUERY]);

		goto out;

	}



	*value = data->functions[func];



	IWL_DEBUG_RADIO(fwrt,

drivers/net/wireless/intel/iwlwifi/pcie/drv.c

+17 −5
Original line number Diff line number Diff line
@@ -673,6 +673,8 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = { 


	IWL_DEV_INFO(iwl6005_n_cfg, iwl6005_2agn_sff_name,

		     DEVICE(0x0082), SUBDEV_MASKED(0xC000, 0xF000)),

	IWL_DEV_INFO(iwl6005_n_cfg, iwl6005_2agn_sff_name,

		     DEVICE(0x0085), SUBDEV_MASKED(0xC000, 0xF000)),

	IWL_DEV_INFO(iwl6005_n_cfg, iwl6005_2agn_d_name,

		     DEVICE(0x0082), SUBDEV(0x4820)),

	IWL_DEV_INFO(iwl6005_n_cfg, iwl6005_2agn_mow1_name,
@@ -729,10 +731,10 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = { 
		     DEVICE(0x0083), SUBDEV_MASKED(0x5, 0xF)),

	IWL_DEV_INFO(iwl1000_bg_cfg, iwl1000_bg_name,

		     DEVICE(0x0083), SUBDEV_MASKED(0x6, 0xF)),

	IWL_DEV_INFO(iwl1000_bgn_cfg, iwl1000_bgn_name,

		     DEVICE(0x0084), SUBDEV_MASKED(0x5, 0xF)),

	IWL_DEV_INFO(iwl1000_bg_cfg, iwl1000_bg_name,

		     DEVICE(0x0084), SUBDEV(0x1216)),

	IWL_DEV_INFO(iwl1000_bg_cfg, iwl1000_bg_name,

		     DEVICE(0x0084), SUBDEV(0x1316)),

		     DEVICE(0x0084), SUBDEV_MASKED(0x6, 0xF)),



/* 100 Series WiFi */

	IWL_DEV_INFO(iwl100_bgn_cfg, iwl100_bgn_name,
@@ -964,6 +966,12 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = { 
		     DEVICE(0x24F3), SUBDEV(0x0004)),

	IWL_DEV_INFO(iwl8260_cfg, iwl8260_2n_name,

		     DEVICE(0x24F3), SUBDEV(0x0044)),

	IWL_DEV_INFO(iwl8260_cfg, iwl8260_2ac_name,

		     DEVICE(0x24F4)),

	IWL_DEV_INFO(iwl8260_cfg, iwl4165_2ac_name,

		     DEVICE(0x24F5)),

	IWL_DEV_INFO(iwl8260_cfg, iwl4165_2ac_name,

		     DEVICE(0x24F6)),

	IWL_DEV_INFO(iwl8265_cfg, iwl8265_2ac_name,

		     DEVICE(0x24FD)),

	IWL_DEV_INFO(iwl8265_cfg, iwl8275_2ac_name,
@@ -1222,11 +1230,15 @@ static int _iwl_pci_resume(struct device *device, bool restore) 
	 * Note: MAC (bits 0:7) will be cleared upon suspend even with wowlan,

	 * but not bits [15:8]. So if we have bits set in lower word, assume

	 * the device is alive.

	 * Alternatively, if the scratch value is 0xFFFFFFFF, then we no longer

	 * have access to the device and consider it powered off.

	 * For older devices, just try silently to grab the NIC.

	 */

	if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) {

		if (!(iwl_read32(trans, CSR_FUNC_SCRATCH) &

		      CSR_FUNC_SCRATCH_POWER_OFF_MASK))

		u32 scratch = iwl_read32(trans, CSR_FUNC_SCRATCH);



		if (!(scratch & CSR_FUNC_SCRATCH_POWER_OFF_MASK) ||

		    scratch == ~0U)

			device_was_powered_off = true;

	} else {

		/*