[PATCH AUTOSEL 6.18] wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED

[Sasha Levin <sashal@kernel.org>]

From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

[ Upstream commit a342c99cb70dde344723f6c802efd24e614f4fda ]

We should stick to mac80211's flow to start / stop beaconing. This
allows to stop beaconing before we remove the BIGTK.

Note that the start and stop beaconing flows are not exactly symmetric.
When we start beaconing, we just update the beacon template. We assume
that mac80211 won't update the beacons, if we're not supposed to be
sending it.

Also note that we now send the beacon template after the broadcast
station was added to the firmware: the broadcast station is added in
the start_ap() flow, while the beacon template is now added in the
link_changed() flow which happens later. This is not what we did
before this patch, but this sequence is supported by the firmware as
well.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260511203428.cf10e5754171.I8022517c6c5aedb4b56fba30a5545de8f62dddbe@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `wifi: iwlwifi: mld: honor
BSS_CHANGED_BEACON_ENABLED`

**Local tree:** Linux **6.18.44** (`git describe HEAD` → `v6.18.44`,
`make kernelversion` → `6.18.44`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

**Step 1.1 – Subject line**
Record: `[wifi: iwlwifi: mld]` `[honor]` — Implement proper handling of
mac80211 `BSS_CHANGED_BEACON_ENABLED` in the Intel MLD (WiFi 7) driver.

**Step 1.2 – Tags**
Record:
- `Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>`
  (author)
- `Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>`
  (series submitter)
- `Link: https://patch.msgid.link/20260511203428...` (patch submission)
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Tested-
  by:`, or `Reviewed-by:` tags

**Step 1.3 – Body analysis**
Record:
- **Bug:** Driver does not follow mac80211’s beacon start/stop flow;
  beaconing is not stopped when mac80211 disables it.
- **Symptom:** On AP teardown, firmware may continue beaconing while
  keys (specifically BIGTK) are removed.
- **Root cause:** Missing `BSS_CHANGED_BEACON_ENABLED` handler; beacon
  template was sent too early in `start_ap()` instead of via
  `link_info_changed`.
- **Version info:** None stated.

**Step 1.4 – Hidden bug fix?**
Record: **Yes.** Although the subject says “honor,” this is a
driver/mac80211 contract bug: beaconing must stop before key removal on
AP stop.

---

## PHASE 2: DIFF ANALYSIS

**Step 2.1 – Inventory**
Record:
- `drivers/net/wireless/intel/iwlwifi/mld/ap.c` (+25/−4): new
  `iwl_mld_stop_beacon()`, remove early beacon update from `start_ap`
- `drivers/net/wireless/intel/iwlwifi/mld/ap.h` (+4): declare
  `iwl_mld_stop_beacon()`
- `drivers/net/wireless/intel/iwlwifi/mld/mac80211.c` (+6/−2): handle
  `BSS_CHANGED_BEACON_ENABLED`, add `WARN_ON(!link->enable_beacon)` for
  `BSS_CHANGED_BEACON`
- **Functions:** `iwl_mld_stop_beacon()` (new),
  `iwl_mld_start_ap_ibss()`, `iwl_mld_link_info_changed_ap_ibss()`
- **Scope:** Single-subsystem, surgical (~32 lines)

**Step 2.2 – Code flow changes**
Record:
- **Hunk 1 (`iwl_mld_stop_beacon`):** Sends `BEACON_TEMPLATE_CMD` with
  `byte_cnt = 0` and valid `link_id` → tells firmware to stop beaconing.
  Only if `BEACON_TEMPLATE_CMD` version ≥ 15.
- **Hunk 2 (`start_ap`):** Removes `iwl_mld_update_beacon_template()`
  call; beacon setup deferred to `link_info_changed`.
- **Hunk 3 (`link_info_changed`):** On `BSS_CHANGED_BEACON`, only update
  if `enable_beacon` is true (with `WARN_ON`). On
  `BSS_CHANGED_BEACON_ENABLED` with `!enable_beacon`, call
  `iwl_mld_stop_beacon()`.

**Step 2.3 – Bug mechanism**
Record: **Logic / correctness fix** — missing mac80211 callback
handling. mac80211 notifies drivers to stop beaconing
(`BSS_CHANGED_BEACON_ENABLED`) **before** removing keys; iwl_mld ignored
this, so firmware could keep transmitting beacons while BIGTK/GTK keys
were torn down.

**Step 2.4 – Fix quality**
Record: Fix is minimal and matches patterns used by ath10k, ath11k,
mt76, rtw88, etc. Low regression risk. Minor concern: `cmd_ver < 15`
silently skips stop (partial coverage on older firmware).

---

## PHASE 3: GIT HISTORY INVESTIGATION

**Step 3.1 – Blame**
Record: This stable tree has shallow per-file history (single unrelated
commit on blame). iwl_mld code is present as part of the 6.18.44 import.
Buggy pattern (`BSS_CHANGED_BEACON` only, no
`BSS_CHANGED_BEACON_ENABLED`) is present in the checked-out tree.

**Step 3.2 – Fixes: tag**
Record: N/A — no `Fixes:` tag.

**Step 3.3 – Related file history**
Record: Part of Intel iwlwifi update series `[PATCH 0/15] wifi: iwlwifi:
updates - 2026-05-11` (patch 4/15). Patch 5/15 only moves the function
to `ap.c` (refactor, not a functional prerequisite).

**Step 3.4 – Author context**
Record: Emmanuel Grumbach is a long-time iwlwifi maintainer. Miri
Korenblit submits Intel iwlwifi series regularly.

**Step 3.5 – Dependencies**
Record: **Standalone.** No prerequisite commits required; patch 5/15 is
optional cleanup.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

**Step 4.1 – Original discussion**
Record: `b4 dig` failed (commit not in this tree). Patch content
verified from local mbox
`20260511_miriam_rachel_korenblit_wifi_iwlwifi_updates_2026_05_11.mbx`.
Lore URL blocked by bot protection.

**Step 4.2 – Reviewers**
Record: Not verified from lore (fetch blocked). Series cover letter
lists Intel iwlwifi maintainers as authors.

**Step 4.3 – Bug report**
Record: No external bug report or syzbot link. Internal Intel finding.

**Step 4.4 – Series context**
Record: Patch 4/15 in a 15-patch iwlwifi series. Functionally
independent of other patches.

**Step 4.5 – Stable list discussion**
Record: Not searched/found. No stable nomination in commit message
(expected for manual review).

---

## PHASE 5: CODE SEMANTIC ANALYSIS

**Step 5.1 – Key functions**
Record: `iwl_mld_link_info_changed_ap_ibss()`,
`iwl_mld_start_ap_ibss()`, `iwl_mld_stop_beacon()` (new),
`iwl_mld_set_key_remove()`

**Step 5.2 – Callers**
Record:
- `iwl_mld_link_info_changed_ap_ibss()` ←
  `iwl_mld_mac80211_link_info_changed()` ← mac80211
  `drv_link_info_changed()`
- `iwl_mld_start_ap_ibss()` ← `.start_ap` / `.join_ibss` ops
- Key removal ← `iwl_mld_set_key_remove()` ← `.set_key(DISABLE_KEY)`

**Step 5.3 – Callees**
Record: `iwl_mld_send_cmd_pdu(BEACON_TEMPLATE_CMD)`,
`iwl_mld_update_beacon_template()`, `iwl_fw_lookup_cmd_ver()`

**Step 5.4 – Call chain / reachability**
Record:
```
ieee80211_stop_ap()
  → enable_beacon = false
  → ieee80211_link_info_change_notify(BSS_CHANGED_BEACON_ENABLED)
[driver should stop beacon]
  → ieee80211_remove_link_keys()
[BIGTK/GTK removed]
  → drv_stop_ap() → iwl_mld_stop_ap_ibss()
```
Userspace triggers this via `nl80211` AP stop (hostapd, wpa_supplicant
P2P GO, etc.). **Reachable from normal AP operation.**

**Step 5.5 – Similar patterns**
Record: **Every major mac80211 driver** handles
`BSS_CHANGED_BEACON_ENABLED` (ath10k, ath11k, ath12k, mt76, rtw88,
iwllegacy, etc.). iwl_mld is the outlier.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE (6.18.44)

**Step 6.1 – Buggy code exists?**
Record: **Yes.** Current tree at
`drivers/net/wireless/intel/iwlwifi/mld/mac80211.c:1157-1158` only
handles `BSS_CHANGED_BEACON`. `ap.c:279` still calls
`iwl_mld_update_beacon_template()` inside `start_ap`. iwl_mld subsystem
fully present (`CONFIG_IWLMLD`, 31 source files).

**Step 6.2 – Backport complications**
Record: **Clean apply expected.** File structure matches the patch
context (`index 5c59acc8c4c5` etc.). No conflicting changes detected.

**Step 6.3 – Related fixes already present?**
Record: **No.** `grep BSS_CHANGED_BEACON_ENABLED` under `iwlwifi/mld/`
returns zero matches.

---

## PHASE 7: SUBSYSTEM CONTEXT

**Step 7.1 – Subsystem / criticality**
Record: `drivers/net/wireless/intel/iwlwifi/mld` — **IMPORTANT** (Intel
WiFi 7 MLD hardware driver; AP/P2P GO/IBSS modes).

**Step 7.2 – Activity**
Record: Active new driver (Copyright 2024–2025, MLD opmode `iwlmld`).
Targets BZ/SC/DR chip families.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

**Step 8.1 – Who is affected**
Record: Users of Intel MLD-capable hardware (`CONFIG_IWLMLD`) running
AP, P2P GO, or IBSS — especially WPA3 setups using BIGTK (key indices
6/7).

**Step 8.2 – Trigger conditions**
Record: **Common** — every AP stop/teardown. Requires AP/IBSS mode with
iwl_mld driver loaded. Not userspace-exploitable as a security
primitive, but normal admin operations trigger it.

**Step 8.3 – Failure mode severity**
Record: Firmware may continue beaconing after BIGTK removal → potential
**firmware assert, hang, or corrupted teardown**. Related iwl_mvm code
documents firmware asserts (0x2b00) from incorrect beacon/key teardown
ordering. Severity: **HIGH** (stability during normal operation).

**Step 8.4 – Risk vs benefit**
Record:
- **Benefit:** HIGH for affected hardware — fixes real teardown ordering
  bug
- **Risk:** LOW — ~30 lines, follows mac80211 contract, maintainer-
  authored
- **Ratio:** Strongly favors backport

---

## PHASE 9: FINAL SYNTHESIS

**Evidence FOR:**
- Real mac80211 contract violation (only iwl_mld driver missing this
  among peers)
- mac80211 explicitly stops beaconing before key removal
  (`cfg.c:1879-1887`)
- BIGTK removal while beaconing continues is a concrete failure scenario
- Small, surgical, maintainer fix
- Code and bug both exist in Linux 6.18.44
- Clean apply expected

**Evidence AGAINST:**
- No external crash report or syzbot finding
- `cmd_ver < 15` path leaves bug unfixed on older firmware (mitigated:
  MLD firmware likely always ≥ v15)
- iwl_mld is newer hardware with smaller install base than iwl_mvm
- Part of larger series (but this patch is standalone)

**Stable rules checklist:**
1. Obviously correct and tested? **PASS** — matches mac80211 design and
   peer drivers; no Tested-by but logic is clear
2. Fixes a real bug? **PASS** — missing beacon-stop on AP teardown
3. Important issue? **PASS** — teardown stability / potential firmware
   crash
4. Small and contained? **PASS** — 3 files, ~32 lines
5. No new features/APIs? **PASS** — implements existing mac80211
   callback semantics
6. Can apply to local tree? **PASS** — iwl_mld code present, patch
   applies cleanly

**Exception category:** Standard driver bug fix (not device
ID/quirk/DT/docs).

---

## Problem Summary for Stable Users

When an AP on Intel MLD WiFi hardware is stopped, mac80211 tells the
driver to disable beaconing **before** removing encryption keys
(including BIGTK for WPA3 broadcast integrity). The iwl_mld driver
ignored `BSS_CHANGED_BEACON_ENABLED`, so the firmware could keep
transmitting beacons while keys were removed — violating the teardown
order mac80211 and every other major WiFi driver follow. This can cause
firmware instability during normal AP shutdown (hostapd, P2P GO, etc.).

The fix adds `iwl_mld_stop_beacon()` (empty beacon template to
firmware), handles `BSS_CHANGED_BEACON_ENABLED`, and moves beacon
template installation to the correct point in the mac80211 flow (after
broadcast STA is added).

---

## Verification

- [Phase 1] Parsed subject, tags, body from provided commit message and
  local mbox
- [Phase 2] Diff analysis: 3 files, `iwl_mld_stop_beacon()` +
  `link_info_changed` + `start_ap` reorder
- [Phase 3] `git describe HEAD` → v6.18.44; shallow mld git history (1
  entry); series context from mbox cover letter
- [Phase 4] `b4 dig` failed (commit not in tree); patch verified from `2
  0260511_miriam_rachel_korenblit_wifi_iwlwifi_updates_2026_05_11.mbx`;
  lore fetch blocked
- [Phase 5] `grep BSS_CHANGED_BEACON_ENABLED` across
  `drivers/net/wireless` — iwl_mld is only Intel driver missing it;
  traced `ieee80211_stop_ap()` ordering in `cfg.c:1879-1901`
- [Phase 6] Confirmed buggy code at `mac80211.c:1157-1158` and
  `ap.c:279`; `grep` shows no existing fix; `CONFIG_IWLMLD` present
- [Phase 7] iwl_mld subsystem confirmed (31 `.c` files, Kconfig entry)
- [Phase 8] Failure mode: beaconing continues during key teardown;
  severity HIGH for AP stop path
- [Phase 8] mac80211 key removal after beacon-disable notification
  verified at `cfg.c:1884-1887`
- [Phase 8] BIGTK handling in `mac80211.c:2141-2142` (`keyidx == 6 ||
  keyidx == 7`)
- [Phase 8] Peer driver pattern verified in `ath10k/mac.c:6212` and
  `ath11k/mac.c:3611`

**YES**The analysis is done for **Linux 6.18.44**.

**Verdict: YES** — backport this commit.

The iwl_mld driver in this tree ignores `BSS_CHANGED_BEACON_ENABLED`, so
on AP/P2P GO/IBSS teardown the firmware can keep beaconing while
mac80211 removes keys (including BIGTK). mac80211 expects beaconing to
stop first; other WiFi drivers already do this. The fix is small (~32
lines), self-contained, and should apply cleanly here.

The background `b4 dig` run didn’t find a lore match because it was
pointed at an unrelated commit in this tree; the patch itself was
verified from the local iwlwifi mbox instead.

 drivers/net/wireless/intel/iwlwifi/mld/ap.c   | 25 +++++++++++++++----
 drivers/net/wireless/intel/iwlwifi/mld/ap.h   |  6 ++++-
 .../net/wireless/intel/iwlwifi/mld/mac80211.c |  8 +++++-
 3 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ap.c b/drivers/net/wireless/intel/iwlwifi/mld/ap.c
index 5c59acc8c4c5a..c29e4a77be058 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ap.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ap.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2024 Intel Corporation
+ * Copyright (C) 2024, 2026 Intel Corporation
  */
 #include <linux/crc32.h>
 
@@ -239,6 +239,25 @@ int iwl_mld_store_ap_early_key(struct iwl_mld *mld,
 	return -ENOSPC;
 }
 
+void iwl_mld_stop_beacon(struct iwl_mld *mld, struct ieee80211_vif *vif,
+			 struct ieee80211_bss_conf *link)
+{
+	struct iwl_mld_link *mld_link = iwl_mld_link_from_mac80211(link);
+	struct iwl_mac_beacon_cmd cmd = {};
+	int cmd_ver = iwl_fw_lookup_cmd_ver(mld->fw, BEACON_TEMPLATE_CMD, 14);
+
+	if (WARN_ON(!mld_link))
+		return;
+
+	if (cmd_ver < 15)
+		return;
+
+	/* leave byte_cnt 0 */
+	cmd.link_id = cpu_to_le32(mld_link->fw_id);
+
+	iwl_mld_send_cmd_pdu(mld, BEACON_TEMPLATE_CMD, &cmd);
+}
+
 static int iwl_mld_send_ap_early_keys(struct iwl_mld *mld,
 				      struct ieee80211_vif *vif,
 				      struct ieee80211_bss_conf *link)
@@ -276,10 +295,6 @@ int iwl_mld_start_ap_ibss(struct ieee80211_hw *hw,
 	if (vif->type == NL80211_IFTYPE_AP)
 		iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
 
-	ret = iwl_mld_update_beacon_template(mld, vif, link);
-	if (ret)
-		return ret;
-
 	/* the link should be already activated when assigning chan context,
 	 * and LINK_CONTEXT_MODIFY_EHT_PARAMS is deprecated
 	 */
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/ap.h b/drivers/net/wireless/intel/iwlwifi/mld/ap.h
index 4a6f52b9552d7..a3b6bed814adf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/ap.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/ap.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
- * Copyright (C) 2024 Intel Corporation
+ * Copyright (C) 2024, 2026 Intel Corporation
  */
 #ifndef __iwl_ap_h__
 #define __iwl_ap_h__
@@ -14,6 +14,10 @@ int iwl_mld_update_beacon_template(struct iwl_mld *mld,
 				   struct ieee80211_vif *vif,
 				   struct ieee80211_bss_conf *link_conf);
 
+void iwl_mld_stop_beacon(struct iwl_mld *mld,
+			 struct ieee80211_vif *vif,
+			 struct ieee80211_bss_conf *link_conf);
+
 int iwl_mld_start_ap_ibss(struct ieee80211_hw *hw,
 			  struct ieee80211_vif *vif,
 			  struct ieee80211_bss_conf *link);
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 67b61765adf39..322669d78b193 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -1154,8 +1154,14 @@ iwl_mld_link_info_changed_ap_ibss(struct iwl_mld *mld,
 	if (link_changes)
 		iwl_mld_change_link_in_fw(mld, link, link_changes);
 
-	if (changes & BSS_CHANGED_BEACON)
+	if (changes & BSS_CHANGED_BEACON) {
+		WARN_ON(!link->enable_beacon);
 		iwl_mld_update_beacon_template(mld, vif, link);
+	}
+
+	/* Enabling beacons was already covered above */
+	if ((changes & BSS_CHANGED_BEACON_ENABLED) && !link->enable_beacon)
+		iwl_mld_stop_beacon(mld, vif, link);
 }
 
 static
-- 
2.53.0