* [PATCH iwlwifi-fixes 4/5] wifi: iwlwifi: uefi: bound PPAG revision bitmap shift
From: Miri Korenblit @ 2026-07-17 14:33 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143340.2321964-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Validate revision is below 32 before BIT(revision) in PPAG parsing.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
index 2ef0a7a920ad..014f22c42f41 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
@@ -700,7 +700,7 @@ int iwl_uefi_get_ppag_table(struct iwl_fw_runtime *fwrt)
return -EINVAL;
parse_table:
- if (!(BIT(data->revision) & valid_rev)) {
+ if (data->revision >= 32 || !(BIT(data->revision) & valid_rev)) {
ret = -EINVAL;
IWL_DEBUG_RADIO(fwrt,
"Unsupported UEFI PPAG revision:%d\n",
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-fixes 3/5] wifi: iwlwifi: acpi: validate WGDS table revision index
From: Miri Korenblit @ 2026-07-17 14:33 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143340.2321964-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when
firmware reports an invalid revision value.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index bf0f851a9075..430a7642e01a 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -865,6 +865,11 @@ int iwl_acpi_get_wgds_table(struct iwl_fw_runtime *fwrt)
min_size, max_size,
&tbl_rev);
if (!IS_ERR(wifi_pkg)) {
+ if (tbl_rev < 0 ||
+ tbl_rev >= BITS_PER_BYTE *
+ sizeof(rev_data[idx].revisions))
+ continue;
+
if (!(BIT(tbl_rev) & rev_data[idx].revisions))
continue;
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-fixes 2/5] wifi: iwlwifi: dbg-tlv: bound aligned TLV walk length
From: Miri Korenblit @ 2026-07-17 14:33 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143340.2321964-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Validate ALIGN(tlv_len, 4) before advancing through external debug
TLVs to prevent parser length underflow.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index d021b24d04d6..b1a55909f0d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -475,6 +475,7 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data,
{
const struct iwl_ucode_tlv *tlv;
u32 tlv_len;
+ size_t aligned_tlv_len;
while (len >= sizeof(*tlv)) {
len -= sizeof(*tlv);
@@ -487,8 +488,16 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data,
len, tlv_len);
return -EINVAL;
}
- len -= ALIGN(tlv_len, 4);
- data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+
+ aligned_tlv_len = ALIGN(tlv_len, 4);
+ if (len < aligned_tlv_len) {
+ IWL_ERR(trans, "invalid aligned TLV len: %zd/%zu\n",
+ len, aligned_tlv_len);
+ return -EINVAL;
+ }
+
+ len -= aligned_tlv_len;
+ data += sizeof(*tlv) + aligned_tlv_len;
iwl_dbg_tlv_alloc(trans, tlv, true);
}
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-fixes 1/5] wifi: iwlwifi: bound aligned TLV advance in FW parser
From: Miri Korenblit @ 2026-07-17 14:33 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143340.2321964-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Validate ALIGN(tlv_len, 4) against remaining parser length before
consuming bytes from the firmware image.
This avoids length underflow on malformed TLVs.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 842586d4fc5c..001895f4f4bd 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -804,6 +804,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
u32 build, paging_mem_size;
int num_of_cpus;
bool usniffer_req = false;
+ size_t aligned_tlv_len;
if (len < sizeof(*ucode)) {
IWL_ERR(drv, "uCode has invalid length: %zd\n", len);
@@ -852,8 +853,16 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
len, tlv_len);
return -EINVAL;
}
- len -= ALIGN(tlv_len, 4);
- data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+
+ aligned_tlv_len = ALIGN(tlv_len, 4);
+ if (len < aligned_tlv_len) {
+ IWL_ERR(drv, "invalid aligned TLV len: %zd/%zu\n",
+ len, aligned_tlv_len);
+ return -EINVAL;
+ }
+
+ len -= aligned_tlv_len;
+ data += sizeof(*tlv) + aligned_tlv_len;
switch (tlv_type) {
case IWL_UCODE_TLV_INST:
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-fixes 0/5] wifi: iwlwifi: fixes - 07-17-2026
From: Miri Korenblit @ 2026-07-17 14:33 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless
Hi,
A few fixes from our internal tree.
Miri
---
Emmanuel Grumbach (5):
wifi: iwlwifi: bound aligned TLV advance in FW parser
wifi: iwlwifi: dbg-tlv: bound aligned TLV walk length
wifi: iwlwifi: acpi: validate WGDS table revision index
wifi: iwlwifi: uefi: bound PPAG revision bitmap shift
wifi: iwlwifi: validate SEC_RT TLV minimum size
drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++
drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 2 +-
.../net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 13 +++++++++++--
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 18 +++++++++++++++---
4 files changed, 32 insertions(+), 6 deletions(-)
--
2.34.1
^ permalink raw reply
* [PATCH iwlwifi-next 8/8] wifi: iwlwifi: mld: move BIOS reading code to where it belongs
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
We have a dedicated function to fetch all the BIOS tables when the opmode
starts, and yet we read a couple of tables directly from
iwl_op_mode_mld_start, which is already a large function that does
multiple things.
Move the reading of the sgom, puncturing, and RFI enablement to the
dedicated iwl_mld_get_bios_tables.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mld.c | 2 --
drivers/net/wireless/intel/iwlwifi/mld/regulatory.c | 3 +++
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mld.c b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
index 7c49d0441fdf..6e991fb99ff3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mld.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mld.c
@@ -419,8 +419,6 @@ iwl_op_mode_mld_start(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
iwl_mld_construct_fw_runtime(mld, trans, fw, dbgfs_dir);
iwl_mld_get_bios_tables(mld);
- iwl_uefi_get_sgom_table(trans, &mld->fwrt);
- iwl_uefi_get_puncturing(&mld->fwrt);
iwl_mld_hw_set_regulatory(mld);
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c b/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c
index be311f6c3d9f..ad899ce5c64a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c
@@ -84,6 +84,9 @@ void iwl_mld_get_bios_tables(struct iwl_mld *mld)
iwl_uefi_get_uneb_table(mld->trans, &mld->fwrt);
iwl_bios_get_phy_filters(&mld->fwrt);
+
+ iwl_uefi_get_sgom_table(mld->trans, &mld->fwrt);
+ iwl_uefi_get_puncturing(&mld->fwrt);
}
static int iwl_mld_geo_sar_init(struct iwl_mld *mld)
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 7/8] wifi: iwlwifi: mld: add debug log after AP type command
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Pagadala Yesu Anjaneyulu
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Add a radio debug trace when MCC_ALLOWED_AP_TYPE_CMD is sent
successfully during AP type table initialization.
This improves bring-up visibility without changing runtime behavior.
Failures are still reported through the existing error log path.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/regulatory.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c b/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c
index 4a93ccbef495..be311f6c3d9f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/regulatory.c
@@ -524,6 +524,8 @@ void iwl_mld_init_ap_type_tables(struct iwl_mld *mld)
if (ret)
IWL_ERR(mld, "failed to send MCC_ALLOWED_AP_TYPE_CMD (%d)\n",
ret);
+ else
+ IWL_DEBUG_RADIO(mld, "MCC_ALLOWED_AP_TYPE_CMD sent to FW\n");
}
void iwl_mld_init_tas(struct iwl_mld *mld)
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 6/8] wifi: iwlwifi: mld: support update_mcc notification v2
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Pagadala Yesu Anjaneyulu
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
New firmware will support version 2 of the update_mcc notification. The
extra field is used for a new feature, but we does not support it.
Keep the existing payload definition compatible with both versions and
register version 2 in the MLD notification version table so the driver
accepts the newer notification without changing the behavior.
This preserves version 1 support and adds compatibility with firmware
that sends version 2.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h | 5 ++++-
drivers/net/wireless/intel/iwlwifi/mld/notif.c | 3 ++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
index 360b626a9572..9fbdb45e88db 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
@@ -411,7 +411,10 @@ struct iwl_mcc_chub_notif {
__le16 mcc;
u8 source_id;
u8 reserved1;
-} __packed; /* LAR_MCC_NOTIFY_S */
+} __packed;
+/* LAR_MCC_NOTIFY_S_VER_1
+ * LAR_MCC_NOTIFY_S_VER_2
+ */
enum iwl_mcc_update_status {
MCC_RESP_NEW_CHAN_PROFILE,
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/notif.c b/drivers/net/wireless/intel/iwlwifi/mld/notif.c
index b3a899828db9..90733bbaf733 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/notif.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/notif.c
@@ -298,7 +298,8 @@ CMD_VERSIONS(channel_survey_notif,
CMD_VERSIONS(mfuart_notif,
CMD_VER_ENTRY(2, iwl_mfuart_load_notif))
CMD_VERSIONS(update_mcc,
- CMD_VER_ENTRY(1, iwl_mcc_chub_notif))
+ CMD_VER_ENTRY(1, iwl_mcc_chub_notif)
+ CMD_VER_ENTRY(2, iwl_mcc_chub_notif))
CMD_VERSIONS(session_prot_notif,
CMD_VER_ENTRY(3, iwl_session_prot_notif))
CMD_VERSIONS(missed_beacon_notif,
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 5/8] wifi: iwlwifi: fw: move SAR defines from acpi.h to regulatory.h
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Avinash Bhatt
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Avinash Bhatt <avinash.bhatt@intel.com>
IWL_SAR_ENABLE_MSK and IWL_REDUCE_POWER_FLAGS_POS describe the layout
of the shared WRDS/SAR table format. They are not ACPI-specific: the
same bit positions are used regardless of whether the data originates
from ACPI, UEFI, or another BIOS source.
IWL_SAR_ENABLE_MSK was already duplicated in regulatory.h; remove it
from acpi.h to eliminate the duplication.
Move IWL_REDUCE_POWER_FLAGS_POS to regulatory.h alongside
IWL_SAR_ENABLE_MSK so that both SAR field descriptors live in the
shared regulatory header, accessible to all BIOS configuration sources.
No functional change.
Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 5 +----
drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 3 ++-
2 files changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index 51a57e57de7a..45eb35ffb637 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -1,7 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
/*
* Copyright (C) 2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2023, 2025 Intel Corporation
+ * Copyright (C) 2018-2023, 2025-2026 Intel Corporation
*/
#ifndef __iwl_fw_acpi__
#define __iwl_fw_acpi__
@@ -111,9 +111,6 @@
#define ACPI_PPAG_WIFI_DATA_SIZE_V3 ((ACPI_PPAG_NUM_CHAINS * \
ACPI_PPAG_NUM_BANDS_V3) + 2)
-#define IWL_SAR_ENABLE_MSK BIT(0)
-#define IWL_REDUCE_POWER_FLAGS_POS 1
-
/* The Inidcator whether UEFI WIFI GUID tables are locked is read from ACPI */
#define UEFI_WIFI_GUID_UNLOCKED 0
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
index 6fffc032efd3..22c97c75b83c 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
/*
- * Copyright (C) 2023-2025 Intel Corporation
+ * Copyright (C) 2023-2026 Intel Corporation
*/
#ifndef __fw_regulatory_h__
@@ -30,6 +30,7 @@
#define BIOS_GEO_MIN_PROFILE_NUM 3
#define IWL_SAR_ENABLE_MSK BIT(0)
+#define IWL_REDUCE_POWER_FLAGS_POS 1
/* PPAG gain value bounds in 1/8 dBm */
#define IWL_PPAG_MIN_LB -16
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 4/8] wifi: iwlwifi: mld: drop connection on D3 resume failure
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Ayala Beker, Emmanuel Grumbach
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Ayala Beker <ayala.beker@intel.com>
When FW crashes on D3 exit, iwl_mld_nic_error() sets
STATUS_RESET_PENDING and queues restart wk, but mac80211's resume
callback synchronously calls iwl_trans_stop_device() which clears
the flag. As a result restart wk skips sw_reset, and the FW error
recovery buffer is never read.
The new FW boots with empty BA state and initial sequence numbers,
while the AP still holds its A-MPDU RX reorder window.
This causes MPDUs to be dropped as IWL_RX_MPDU_REORDER_BA_OLD_SN until
ADDBA is renegotiated.
We don't know how long the firmware has been in an error state
or whether the AP still considers us associated, so keeping the
connection alive is not worth it.
Call ieee80211_resume_disconnect() when iwl_mld_wait_d3_notif() fails,
and let userspace reassociate.
Signed-off-by: Ayala Beker <ayala.beker@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
index 301983428a63..55f9b809e764 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
@@ -2219,6 +2219,9 @@ int iwl_mld_wowlan_resume(struct iwl_mld *mld)
ret = iwl_mld_wait_d3_notif(mld, &resume_data, true);
if (ret) {
IWL_ERR(mld, "Couldn't get the d3 notifs %d\n", ret);
+
+ if (bss_vif->cfg.assoc)
+ ieee80211_resume_disconnect(bss_vif);
goto err;
}
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 3/8] wifi: iwlwifi: mvm: ignore sync frames when sync is disabled
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Gate time-sync frame interception on the active flag so frames are not
queued after time-sync teardown.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
index 2cfd0fb5e781..7bdbacb64078 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.h
@@ -1,6 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
/*
* Copyright (C) 2022 Intel Corporation
+ * Copyright (C) 2026 Intel Corporation
*/
#ifndef __TIME_SYNC_H__
#define __TIME_SYNC_H__
@@ -19,6 +20,9 @@ int iwl_mvm_time_sync_config(struct iwl_mvm *mvm, const u8 *addr,
static inline
bool iwl_mvm_time_sync_frame(struct iwl_mvm *mvm, struct sk_buff *skb, u8 *addr)
{
+ if (!mvm->time_sync.active)
+ return false;
+
if (ether_addr_equal(mvm->time_sync.peer_addr, addr) &&
(ieee80211_is_timing_measurement(skb) || ieee80211_is_ftm(skb))) {
skb_queue_tail(&mvm->time_sync.frame_list, skb);
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 2/8] wifi: iwlwifi: mld: initialize scan-abort status
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Initialize abort status before issuing the abort command so debug
logging never reads an uninitialized value on error paths.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/scan.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/scan.c b/drivers/net/wireless/intel/iwlwifi/mld/scan.c
index d80a1cfc2ed5..0faca402bc14 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/scan.c
@@ -1681,7 +1681,8 @@ iwl_mld_scan_send_abort_cmd_status(struct iwl_mld *mld, int uid, u32 *status)
static int
iwl_mld_scan_abort(struct iwl_mld *mld, int type, int uid, bool *wait)
{
- enum iwl_umac_scan_abort_status status;
+ enum iwl_umac_scan_abort_status status =
+ IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND;
int ret;
*wait = true;
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 1/8] wifi: iwlwifi: mld: validate wake packet crypto overhead
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Emmanuel Grumbach
In-Reply-To: <20260717143112.2314116-1-miriam.rachel.korenblit@intel.com>
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Wake packet parsing only accounted for FCS and missed per-key
IV/ICV overhead for protected data frames.
Prevent size underflow and bad packet trimming when
notifications are malformed or truncated.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 63 +++++++++++++++++++--
1 file changed, 57 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
index 3b785c53948f..301983428a63 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
@@ -59,6 +59,30 @@ struct iwl_mld_suspend_key_iter_data {
__le32 bigtk_cipher;
};
+struct iwl_mld_wake_pkt_iter_data {
+ bool multicast;
+ u32 ivlen;
+ u32 icvlen;
+};
+
+static void
+iwl_mld_wake_pkt_key_iter(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct ieee80211_key_conf *key, void *_data)
+{
+ struct iwl_mld_wake_pkt_iter_data *data = _data;
+ bool is_group_key = !sta;
+
+ /* ignore anything that is not a PTK / GTK */
+ if (key->keyidx > 3)
+ return;
+ if (is_group_key != data->multicast)
+ return;
+
+ data->ivlen = key->iv_len;
+ data->icvlen = key->icv_len;
+}
+
struct iwl_mld_mcast_key_data {
u8 key[WOWLAN_KEY_MAX_SIZE];
u8 len;
@@ -743,11 +767,17 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
struct cfg80211_wowlan_wakeup *wakeup,
struct sk_buff **_pkt)
{
- int pkt_bufsize = wowlan_status->wake_packet_bufsize;
- int expected_pktlen = wowlan_status->wake_packet_length;
+ u32 pkt_bufsize = wowlan_status->wake_packet_bufsize;
+ u32 expected_pktlen = wowlan_status->wake_packet_length;
const u8 *pktdata = wowlan_status->wake_packet;
const struct ieee80211_hdr *hdr = (const void *)pktdata;
- int truncated = expected_pktlen - pkt_bufsize;
+ u32 truncated;
+
+ if (IWL_FW_CHECK(mld, pkt_bufsize < sizeof(*hdr),
+ "pkt_bufsize is too short: %u\n", pkt_bufsize))
+ return;
+
+ truncated = expected_pktlen - pkt_bufsize;
if (ieee80211_is_data(hdr->frame_control)) {
int hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -758,9 +788,18 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
if (!pkt)
return;
- skb_put_data(pkt, pktdata, hdrlen);
- pktdata += hdrlen;
- pkt_bufsize -= hdrlen;
+ if (ieee80211_has_protected(hdr->frame_control)) {
+ struct iwl_mld_wake_pkt_iter_data iter_data = {
+ .multicast =
+ is_multicast_ether_addr(hdr->addr1),
+ };
+
+ ieee80211_iter_keys(mld->hw, vif,
+ iwl_mld_wake_pkt_key_iter,
+ &iter_data);
+ ivlen = iter_data.ivlen;
+ icvlen += iter_data.icvlen;
+ }
/* if truncated, FCS/ICV is (partially) gone */
if (truncated >= icvlen) {
@@ -771,6 +810,13 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
truncated = 0;
}
+ if (IWL_FW_CHECK(mld, pkt_bufsize <= hdrlen + ivlen + icvlen,
+ "pkt_bufsize is too small %u\n", pkt_bufsize))
+ return;
+
+ skb_put_data(pkt, pktdata, hdrlen);
+ pktdata += hdrlen;
+ pkt_bufsize -= hdrlen;
pkt_bufsize -= ivlen + icvlen;
pktdata += ivlen;
@@ -792,6 +838,11 @@ iwl_mld_set_wake_packet(struct iwl_mld *mld,
fcslen -= truncated;
truncated = 0;
}
+
+ if (IWL_FW_CHECK(mld, pkt_bufsize <= fcslen,
+ "pkt_bufsize is too small %u\n", pkt_bufsize))
+ return;
+
pkt_bufsize -= fcslen;
wakeup->packet = wowlan_status->wake_packet;
wakeup->packet_present_len = pkt_bufsize;
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 0/8] wifi: iwlwifi: updates - 07-17-2026
From: Miri Korenblit @ 2026-07-17 14:31 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless
Hi,
A couple of fixes, features and cleanups.
Miri
Avinash Bhatt (1):
wifi: iwlwifi: fw: move SAR defines from acpi.h to regulatory.h
Ayala Beker (1):
wifi: iwlwifi: mld: drop connection on D3 resume failure
Emmanuel Grumbach (3):
wifi: iwlwifi: mld: validate wake packet crypto overhead
wifi: iwlwifi: mld: initialize scan-abort status
wifi: iwlwifi: mvm: ignore sync frames when sync is disabled
Miri Korenblit (1):
wifi: iwlwifi: mld: move BIOS reading code to where it belongs
Pagadala Yesu Anjaneyulu (2):
wifi: iwlwifi: mld: support update_mcc notification v2
wifi: iwlwifi: mld: add debug log after AP type command
drivers/net/wireless/intel/iwlwifi/fw/acpi.h | 5 +-
.../wireless/intel/iwlwifi/fw/api/nvm-reg.h | 5 +-
.../wireless/intel/iwlwifi/fw/regulatory.h | 3 +-
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 66 +++++++++++++++++--
drivers/net/wireless/intel/iwlwifi/mld/mld.c | 2 -
.../net/wireless/intel/iwlwifi/mld/notif.c | 3 +-
.../wireless/intel/iwlwifi/mld/regulatory.c | 5 ++
drivers/net/wireless/intel/iwlwifi/mld/scan.c | 3 +-
.../wireless/intel/iwlwifi/mvm/time-sync.h | 4 ++
9 files changed, 80 insertions(+), 16 deletions(-)
--
2.34.1
^ permalink raw reply
* Re: [PATCH] wifi: mwifiex: validate HT/VHT element length before storing beacon IE pointers
From: Francesco Dolcini @ 2026-07-17 14:31 UTC (permalink / raw)
To: Christopher Kleiner
Cc: briannorris, linux-wireless, francesco, netdev, linux-kernel
In-Reply-To: <20260717000017.61415-1-chris@kleiner.pro>
On Thu, Jul 16, 2026 at 08:00:17PM -0400, Christopher Kleiner wrote:
> mwifiex_update_bss_desc_with_ie() stores raw pointers into the beacon
> buffer for the HT Capability, HT Operation, VHT Capability and VHT
> Operation elements without checking that the element is long enough to
> hold the corresponding fixed-size structure. The generic IE loop only
> guarantees that the declared element length fits inside the beacon
> buffer (bytes_left >= total_ie_len); it does not guarantee that
> element_len is large enough for the struct that later consumers copy.
>
> beacon_buf is a tight kmemdup() of the over-the-air IEs. When the
> association command is built, mwifiex_cmd_append_11n_tlv() /
> mwifiex_cmd_append_11ac_tlv() copy a fixed number of bytes from the
> stored pointers (sizeof(struct ieee80211_ht_cap) and friends). A
> malicious AP that emits a beacon or probe response ending in a
> truncated (e.g. zero-length) HT Capability element leaves bcn_ht_cap
> pointing near the end of the slab, and the subsequent copy reads out of
> bounds. The leaked bytes are placed into the association request
> transmitted back to the AP, disclosing adjacent slab memory; on
> CONFIG_KASAN / panic_on_oops kernels it is an out-of-bounds oops.
>
> Commit 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor
> element") added such length checks for the FH/DS/CF/IBSS parameter sets
> and a few other elements, but did not cover the HT/VHT capability and
> operation elements. Validate element_len against the size of the
> structure that will be consumed, mirroring those existing checks.
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christopher Kleiner <chris@kleiner.pro>
Duplicate? We already have this in review https://lore.kernel.org/all/20260709100800.7026-1-doruk@0sec.ai/
^ permalink raw reply
* [PATCH wireless-next] wifi: mac80211: notify driver before destroying assoc link
From: Miri Korenblit @ 2026-07-17 14:10 UTC (permalink / raw)
To: johannes; +Cc: linux-wireless, Pagadala Yesu Anjaneyulu, Johannes Berg
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
During association completion, mac80211 must notify the driver before
destroying the association link context. Previously, the driver callback
drv_mgd_complete_tx() was invoked after ieee80211_destroy_assoc_data(),
which left the driver with no link context to perform per-link resource
cleanup operations.
Move drv_mgd_complete_tx() invocation into ieee80211_destroy_assoc_data(),
before link destruction. This ensures the driver has access to link context
when needed for cleanup.
Similar for ieee80211_destroy_auth_data().
On failed associations, the driver now has the link available to safely
cancel any active sessions.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Assisted-by: GitHubCopilot:gpt-5.3-codex
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
net/mac80211/mlme.c | 75 ++++++++++++++++++++++++---------------------
1 file changed, 40 insertions(+), 35 deletions(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9e92337bb6f9..267dcb6948bf 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -5259,7 +5259,8 @@ void ieee80211_disconnect(struct ieee80211_vif *vif, bool reconnect)
EXPORT_SYMBOL(ieee80211_disconnect);
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
- bool assoc)
+ bool assoc,
+ struct ieee80211_prep_tx_info *info)
{
struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
@@ -5267,6 +5268,9 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
sdata->u.mgd.auth_data = NULL;
+ if (info)
+ drv_mgd_complete_tx(sdata->local, sdata, info);
+
if (!assoc) {
/*
* we are not authenticated yet, the only timer that could be
@@ -5298,7 +5302,8 @@ enum assoc_status {
};
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
- enum assoc_status status)
+ enum assoc_status status,
+ struct ieee80211_prep_tx_info *info)
{
struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
@@ -5306,6 +5311,9 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
sdata->u.mgd.assoc_data = NULL;
+ if (info)
+ drv_mgd_complete_tx(sdata->local, sdata, info);
+
if (status != ASSOC_SUCCESS) {
/*
* we are not associated yet, the only timer that could be
@@ -5497,11 +5505,11 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
sdata_info(sdata, "%pM denied authentication (status %d)\n",
mgmt->sa, status_code);
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, &info);
event.u.mlme.status = MLME_DENIED;
event.u.mlme.reason = status_code;
drv_event_callback(sdata->local, sdata, &event);
- goto notify_driver;
+ return;
}
switch (ifmgd->auth_data->algorithm) {
@@ -5673,7 +5681,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
ifmgd->assoc_data->ap_addr, reason_code,
ieee80211_get_reason_code_string(reason_code));
- ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+ ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON, NULL);
cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
return;
@@ -7138,6 +7146,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
{
struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
+ enum assoc_status assoc_status = ASSOC_ABANDON;
u16 capab_info, status_code, aid;
struct ieee80211_elems_parse_params parse_params = {
.bss = NULL,
@@ -7145,7 +7154,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
.from_ap = true,
.type = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_TYPE,
};
- struct ieee802_11_elems *elems;
struct sta_info *sta;
int ac;
const u8 *elem_start;
@@ -7211,7 +7219,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
elem_len = len - (elem_start - (u8 *)mgmt);
parse_params.start = elem_start;
parse_params.len = elem_len;
- elems = ieee802_11_parse_elems_full(&parse_params);
+ struct ieee802_11_elems *elems __free(kfree) =
+ ieee802_11_parse_elems_full(&parse_params);
if (!elems)
goto notify_driver;
@@ -7277,7 +7286,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
sdata_info(sdata,
"MLO association with %pM but no (basic) multi-link element in response!\n",
assoc_data->ap_addr);
- goto abandon_assoc;
+ goto destroy_assoc_data;
}
common = (void *)elems->ml_basic->variable;
@@ -7288,7 +7297,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
"AP MLD MAC address mismatch: got %pM expected %pM\n",
common->mld_mac_addr,
assoc_data->ap_addr);
- goto abandon_assoc;
+ goto destroy_assoc_data;
}
sdata->vif.cfg.eml_cap =
@@ -7305,8 +7314,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
if (!ieee80211_assoc_success(sdata, mgmt, elems,
elem_start, elem_len)) {
/* oops -- internal error -- send timeout for now */
- ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
- goto notify_driver;
+ assoc_status = ASSOC_TIMEOUT;
+ goto destroy_assoc_data;
}
event.u.mlme.status = MLME_SUCCESS;
drv_event_callback(sdata->local, sdata, &event);
@@ -7350,23 +7359,19 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
sta = sta_info_get_bss(sdata, sdata->vif.cfg.ap_addr);
resp.assoc_encrypted = sta && sta->sta.epp_peer;
- ieee80211_destroy_assoc_data(sdata,
- status_code == WLAN_STATUS_SUCCESS ?
- ASSOC_SUCCESS :
- ASSOC_REJECTED);
-
resp.buf = (u8 *)mgmt;
resp.len = len;
resp.req_ies = ifmgd->assoc_req_ies;
resp.req_ies_len = ifmgd->assoc_req_ies_len;
cfg80211_rx_assoc_resp(sdata->dev, &resp);
+ assoc_status = status_code == WLAN_STATUS_SUCCESS ? ASSOC_SUCCESS :
+ ASSOC_REJECTED;
+destroy_assoc_data:
+ ieee80211_destroy_assoc_data(sdata, assoc_status, &info);
+ return;
+
notify_driver:
drv_mgd_complete_tx(sdata->local, sdata, &info);
- kfree(elems);
- return;
-abandon_assoc:
- ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
- goto notify_driver;
}
static void ieee80211_rx_bss_info(struct ieee80211_link_data *link,
@@ -9099,7 +9104,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
* ok ... we waited for assoc or continuation but
* userspace didn't do it, so kill the auth data
*/
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, NULL);
} else if (ieee80211_auth(sdata)) {
u8 ap_addr[ETH_ALEN];
struct ieee80211_event event = {
@@ -9110,7 +9115,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
memcpy(ap_addr, ifmgd->auth_data->ap_addr, ETH_ALEN);
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, NULL);
cfg80211_auth_timeout(sdata->dev, ap_addr);
drv_event_callback(sdata->local, sdata, &event);
@@ -9129,7 +9134,8 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
.u.mlme.status = MLME_TIMEOUT,
};
- ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
+ ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT,
+ NULL);
drv_event_callback(sdata->local, sdata, &event);
}
} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
@@ -9342,9 +9348,10 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
WLAN_REASON_DEAUTH_LEAVING,
false, frame_buf);
if (ifmgd->assoc_data)
- ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+ ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON,
+ NULL);
if (ifmgd->auth_data)
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, NULL);
cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
IEEE80211_DEAUTH_FRAME_LEN,
false);
@@ -9961,7 +9968,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
auth_data->peer_confirmed =
ifmgd->auth_data->peer_confirmed;
}
- ieee80211_destroy_auth_data(sdata, cont_auth);
+ ieee80211_destroy_auth_data(sdata, cont_auth, NULL);
}
/* prep auth_data so we don't go into idle on disassoc */
@@ -10495,7 +10502,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
/* Cleanup is delayed if auth_data matches */
if (ifmgd->auth_data && !match_auth)
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, NULL);
if (req->ie && req->ie_len) {
memcpy(assoc_data->ie, req->ie, req->ie_len);
@@ -10645,7 +10652,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
/* We are associating, clean up auth_data */
if (ifmgd->auth_data)
- ieee80211_destroy_auth_data(sdata, true);
+ ieee80211_destroy_auth_data(sdata, true, NULL);
return 0;
err_clear:
@@ -10683,11 +10690,10 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
IEEE80211_STYPE_DEAUTH,
req->reason_code, tx,
frame_buf);
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, &info);
ieee80211_report_disconnect(sdata, frame_buf,
sizeof(frame_buf), true,
req->reason_code, false);
- drv_mgd_complete_tx(sdata->local, sdata, &info);
return 0;
}
@@ -10704,11 +10710,10 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
IEEE80211_STYPE_DEAUTH,
req->reason_code, tx,
frame_buf);
- ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON);
+ ieee80211_destroy_assoc_data(sdata, ASSOC_ABANDON, &info);
ieee80211_report_disconnect(sdata, frame_buf,
sizeof(frame_buf), true,
req->reason_code, false);
- drv_mgd_complete_tx(sdata->local, sdata, &info);
return 0;
}
@@ -10785,9 +10790,9 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
&ifmgd->uhr_omp.status_work);
if (ifmgd->assoc_data)
- ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT);
+ ieee80211_destroy_assoc_data(sdata, ASSOC_TIMEOUT, NULL);
if (ifmgd->auth_data)
- ieee80211_destroy_auth_data(sdata, false);
+ ieee80211_destroy_auth_data(sdata, false, NULL);
spin_lock_bh(&ifmgd->teardown_lock);
if (ifmgd->teardown_skb) {
kfree_skb(ifmgd->teardown_skb);
--
2.34.1
^ permalink raw reply related
* [PATCH] wifi: ath12k: restore country code during resume
From: Stian Knudsen @ 2026-07-17 13:02 UTC (permalink / raw)
To: Jeff Johnson, ath12k; +Cc: linux-wireless, Baochen Qiang, Stian Knudsen
The country code configured before suspend is lost after resume:
the device is powered down in suspend_late and powered back up in
resume_early, so firmware reboots with its default regulatory
settings and the previously set country code is no longer applied.
On WCN7850 the firmware comes back in the world regulatory domain
(country 00) and takes ~7 seconds to rediscover the country code
from AP beacons, part of a ~16 second total delay before wifi
reconnects after resume.
Restore it by resending WMI_SET_CURRENT_COUNTRY_CMDID during resume
if a country code was set before suspend, i.e. when ar->alpha2 is
valid. This follows the same approach as ath11k commit 7f0343b7b871
("wifi: ath11k: restore country code during resume").
Note that only single_pdev_only devices support suspend/resume (see
ath12k_core_continue_suspend_resume()), so handling the first and
only pdev is sufficient.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Suggested-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/-_iDJ_M5RrqACWB0qmtleg@pokerfj.es
Signed-off-by: Stian Knudsen <stian@pokerfj.es>
---
drivers/net/wireless/ath/ath12k/core.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
@@ -197,6 +197,7 @@ EXPORT_SYMBOL(ath12k_core_resume_early);
int ath12k_core_resume(struct ath12k_base *ab)
{
+ struct ath12k *ar;
long time_left;
int ret;
@@ -211,6 +212,26 @@ int ath12k_core_resume(struct ath12k_base *ab)
return -ETIMEDOUT;
}
+ /* So far only single_pdev_only devices can reach here,
+ * so it is valid to handle the first, and the only, pdev.
+ */
+ ar = ab->pdevs[0].ar;
+ if (ab->hw_params->current_cc_support &&
+ ar->alpha2[0] != 0 && ar->alpha2[1] != 0) {
+ struct wmi_set_current_country_arg arg = {};
+
+ memcpy(&arg.alpha2, ar->alpha2, 2);
+
+ reinit_completion(&ar->regd_update_completed);
+
+ ret = ath12k_wmi_send_set_current_country_cmd(ar, &arg);
+ if (ret) {
+ ath12k_warn(ab, "failed to set country code during resume: %d\n",
+ ret);
+ return ret;
+ }
+ }
+
return 0;
}
EXPORT_SYMBOL(ath12k_core_resume);
--
2.50.0
^ permalink raw reply
* Re: [PATCH 0/4] wifi: rtw89: advertise WFA-certified EHT capabilities for 8922a
From: Louis Kotze @ 2026-07-17 11:33 UTC (permalink / raw)
To: pkshih; +Cc: linux-wireless, linux-kernel, loukot
In-Reply-To: <b998ea41f3c8493faea09203be3275c6@realtek.com>
Ping-Ke Shih <pkshih@realtek.com> wrote:
> With this declaration, it will handshake two links in protocol point
> of view, so you can see two links in debugfs, but actually it operates
> on one of the links since driver isn't implemented to configure
> hardware and firmware.
>
> So, I'd defer this patch. Internally, we are still cooking to enable
> this feature.
Understood, and that makes sense. Advertising the capability without the
hardware and firmware configuration behind it would be misleading to the
peer, and my A/B only established that the links are set up at the
protocol level, which is exactly the part you are granting. I did not
measure per-link radio activity, so I have nothing that speaks to whether
EMLSR actually runs.
Dropping the patch, and I will not resend it.
When the EMLSR enablement is ready, I am happy to test it. I have an
RTL8922AU (USB) associated to a Wi-Fi 7 AP MLD with an A/B capture rig
already set up, so I can report on real multi-link behaviour rather than
just the association state. Please Cc me if that would be useful.
Thanks for taking the time on the series.
Louis
(Resent as plain text; the original copy was rejected by the list for
containing an HTML part. Apologies for the duplicate, Ping-Ke.)
^ permalink raw reply
* Re: [PATCH v2 0/3] MIPS: BCM47XX: convert buttons to software nodes
From: Thomas Bogendoerfer @ 2026-07-17 11:00 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Rafał Miłecki, Michael Buesch, Hauke Mehrtens,
Bartosz Golaszewski, Arnd Bergmann, linux-wireless, linux-kernel,
linux-mips, Bartosz Golaszewski
In-Reply-To: <20260713-b4-bcm47xx-swnode-v2-0-2b879f0c193c@gmail.com>
On Mon, Jul 13, 2026 at 02:58:21PM -0700, Dmitry Torokhov wrote:
> This series converts the legacy gpio-keys platform device on BCM47XX
> boards to use software nodes and static properties.
>
> To do this properly without relying on legacy name-based matching
> (which is being removed from gpiolib), we introduce and register
> software nodes for the underlying GPIO controllers (BCMA and SSB)
> and reference them in the button properties.
>
> The first two patches add the software nodes to bcma-gpio and
> ssb-gpio respectively. The third patch performs the conversion
> for the BCM47XX buttons.
>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
> As Johannes mentioned on v1 this best should go through MIPS tree.
>
> Changes in v2:
> - Restrict software node registration to host SoC devices in both ssb
> and bcma drivers to avoid conflicts when secondary buses (e.g. PCI
> wireless cards) are present
> - Fix dangling pointer panic in buttons driver by allocating software
> node references on the heap instead of stack
> - Link to v1: https://patch.msgid.link/20260704-b4-bcm47xx-swnode-v1-0-730d59340237@gmail.com
>
> ---
> Dmitry Torokhov (3):
> bcma: gpio: Add and register software node for GPIO controller
> ssb: gpio: Add and register software node for GPIO controller
> MIPS: BCM47XX: Convert buttons to software nodes
>
> arch/mips/bcm47xx/buttons.c | 442 +++++++++++++++++++++++++-------------------
series applied to mips-next
Thomas.
--
Crap can work. Given enough thrust pigs will fly, but it's not necessarily a
good idea. [ RFC1925, 2.3 ]
^ permalink raw reply
* [PATCH v2] wifi: ar5523: validate rxlen against descriptor size and usblen in ar5523_data_rx_cb()
From: pip-izony @ 2026-07-17 11:02 UTC (permalink / raw)
To: Jeff Johnson, Kees Cook
Cc: Seungjin Bae, Kyungtae Kim, Pontus Fuchs, John W . Linville,
linux-wireless, linux-kernel
In-Reply-To: <7bd71d11-d6f2-473d-b5ae-f5fbc972ef40@oss.qualcomm.com>
From: Seungjin Bae <eeodqql09@gmail.com>
In ar5523_data_rx_cb(), the `rxlen` variable is derived from desc->len,
which is provided by the USB device.
The function checks for an upper bound (rxlen > ar->rxbufsz) and for a
zero value (!rxlen), but it fails to check for a proper lower bound
against the size of the descriptor.
If a malicious device provides an `rxlen` value that is positive
but smaller than sizeof(struct ar5523_rx_desc), the subtraction in
the call to skb_put() will result in an integer underflow.
This passes a very large unsigned value to skb_put(), which then
triggers a kernel panic upon detecting the potential buffer overflow.
Fix this by adding a check to ensure `rxlen` is at least
sizeof(struct ar5523_rx_desc) before performing the subtraction.
Additionally, `rxlen` is not cross-checked against usblen (the number
of bytes actually received). Since the frame layout is
[ar5523_chunk][802.11 payload][ar5523_rx_desc] and `usblen` covers the
whole buffer, a valid rxlen cannot exceed `usblen - sizeof(chunk)`. A
device reporting a larger `rxlen` would cause skb_put() to expose
descriptor trailer bytes or uninitialized skb tail data as 802.11
payload to ieee80211_rx_irqsafe().
Add a check to reject such frames.
Fixes: b7d572e1871df ("ar5523: Add new driver")
Suggested-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
---
v1 -> v2: cross-check rxlen against usblen to prevent overreading past the received payload
drivers/net/wireless/ath/ar5523/ar5523.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 66ac396858a5..3ee4b020f416 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -589,6 +589,18 @@ static void ar5523_data_rx_cb(struct urb *urb)
goto skip;
}
+ if (rxlen < sizeof(struct ar5523_rx_desc)) {
+ ar5523_dbg(ar, "RX: Bad descriptor (len=%u is too small)\n",
+ rxlen);
+ goto skip;
+ }
+
+ if (rxlen > usblen - sizeof(struct ar5523_chunk)) {
+ ar5523_dbg(ar, "RX: rxlen too large (rxlen=%u usblen=%d)\n",
+ rxlen, usblen);
+ goto skip;
+ }
+
skb_reserve(data->skb, sizeof(*chunk));
skb_put(data->skb, rxlen - sizeof(struct ar5523_rx_desc));
--
2.43.0
^ permalink raw reply related
* [PATCH 2/2] wifi: mt76: skip NAPI deletion for WED RRO queues
From: Goliath Zhu @ 2026-07-17 11:00 UTC (permalink / raw)
To: linux-wireless
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, matthias.bgg,
angelogioacchino.delregno, linux-kernel, linux-arm-kernel,
linux-mediatek, goliath.zhu, stable
In-Reply-To: <20260717105748.1194693-1-goliath.zhu@clipsneko.cc>
Commit 6b470f36616e ("wifi: mt76: Fix memory leak destroying device")
made mt76_dma_cleanup() visit WED RRO queues so that their page pools
are destroyed during device removal.
When WED is active, mt76 does not register NAPI for these queues.
Calling netif_napi_del() on their uninitialized napi_struct can
dereference a NULL napi->dev.
Keep cleaning the RX queue and destroying its page pool, only call
netif_napi_del() for queues which have an mt76 NAPI instance.
Fixes: 6b470f36616e ("wifi: mt76: Fix memory leak destroying device")
Cc: stable@vger.kernel.org
Signed-off-by: Goliath Zhu <goliath.zhu@clipsneko.cc>
---
drivers/net/wireless/mediatek/mt76/dma.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index f8c2fe5f2..ddcfb9e46 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -1189,7 +1189,9 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
mt76_for_each_q_rx(dev, i) {
struct mt76_queue *q = &dev->q_rx[i];
- netif_napi_del(&dev->napi[i]);
+ if (!mtk_wed_device_active(&dev->mmio.wed) ||
+ !mt76_queue_is_wed_rro(q))
+ netif_napi_del(&dev->napi[i]);
mt76_dma_rx_cleanup(dev, q);
page_pool_destroy(q->page_pool);
--
2.55.0
^ permalink raw reply related
* [PATCH 1/2] wifi: mt76: mt7996: disable RX NAPI on driver removal
From: Goliath Zhu @ 2026-07-17 11:00 UTC (permalink / raw)
To: linux-wireless
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, matthias.bgg,
angelogioacchino.delregno, linux-kernel, linux-arm-kernel,
linux-mediatek, goliath.zhu, stable
In-Reply-To: <20260717105748.1194693-1-goliath.zhu@clipsneko.cc>
Commit 9dd05df8403b ("net: warn if NAPI instance wasn't shut down")
made the NAPI teardown ordering explicit. An instance must be disabled
first, then netif_napi_del() removes it.
mt7996_unregister_device() leaves the RX NAPI instances enabled and
eventually calls mt76_dma_cleanup(), which deletes them. This triggers
the warning in __netif_napi_del_locked() during device removal.
Disable every RX NAPI instance owned by mt76 after unregistering the
device and before releasing the DMA resources. Skip WED RRO queues
because WED owns them and mt76 never registers NAPI for those queues.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Goliath Zhu <goliath.zhu@clipsneko.cc>
---
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index d6f9aa1ab..73559c60f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -1797,6 +1797,8 @@ error:
void mt7996_unregister_device(struct mt7996_dev *dev)
{
+ int i;
+
cancel_work_sync(&dev->dump_work);
cancel_work_sync(&dev->wed_rro.work);
mt7996_unregister_phy(mt7996_phy3(dev));
@@ -1804,6 +1806,15 @@ void mt7996_unregister_device(struct mt7996_dev *dev)
mt7996_unregister_thermal(&dev->phy);
mt7996_coredump_unregister(dev);
mt76_unregister_device(&dev->mt76);
+ mt76_for_each_q_rx(&dev->mt76, i) {
+ struct mt76_queue *q = &dev->mt76.q_rx[i];
+
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+ mt76_queue_is_wed_rro(q))
+ continue;
+
+ napi_disable(&dev->mt76.napi[i]);
+ }
mt7996_wed_rro_free(dev);
mt7996_mcu_exit(dev);
mt7996_tx_token_put(dev);
--
2.55.0
^ permalink raw reply related
* [PATCH 0/2] wifi: mt76: fix RX NAPI teardown on mt7996 removal
From: Goliath Zhu @ 2026-07-17 11:00 UTC (permalink / raw)
To: linux-wireless
Cc: nbd, lorenzo, ryder.lee, shayne.chen, sean.wang, matthias.bgg,
angelogioacchino.delregno, linux-kernel, linux-arm-kernel,
linux-mediatek, goliath.zhu
Fix two RX NAPI teardown issues in the mt7996 removal path.
The first patch disables the RX NAPI instances before the common DMA
cleanup deletes them. This is the RX counterpart of commit 78ab4be54953
("wifi: mt76: disable napi on driver removal"), which fixed the same
warning for TX NAPI.
The second patch fixes a regression introduced by commit 6b470f36616e
("wifi: mt76: Fix memory leak destroying device"). Keep visiting WED RRO
queues to release their page pools, but do not delete NAPI instances
which were never registered while WED is active.
Build-tested with CONFIG_MT7996E=m, CONFIG_NET_MEDIATEK_SOC_WED=y and
W=1.
Goliath Zhu (2):
wifi: mt76: mt7996: disable RX NAPI on driver removal
wifi: mt76: skip NAPI deletion for WED RRO queues
drivers/net/wireless/mediatek/mt76/dma.c | 4 +++-
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 11 +++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
base-commit: 58717b2a1365d06c8c64b72aa948541b53fe31eb
--
2.55.0
^ permalink raw reply
* [PATCH mt76] wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
From: Shayne Chen @ 2026-07-17 10:54 UTC (permalink / raw)
To: Felix Fietkau
Cc: linux-wireless, Lorenzo Bianconi, Ryder Lee, Evelyn Tsai,
Money Wang, linux-mediatek, Shayne Chen, Rex Lu
When performing channel switches on different radios within a short
timeframe, channel contexts with different bands can be carried for
each struct ieee80211_vif_chanctx_switch.
Rework mt76_switch_vif_chanctx() to properly handle this scenario.
Fixes: 82334623af0c ("wifi: mt76: add chanctx functions for multi-channel phy support")
Co-developed-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/channel.c | 93 ++++++++++----------
1 file changed, 48 insertions(+), 45 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/channel.c b/drivers/net/wireless/mediatek/mt76/channel.c
index 6edcb3b8f279..37894b78fd08 100644
--- a/drivers/net/wireless/mediatek/mt76/channel.c
+++ b/drivers/net/wireless/mediatek/mt76/channel.c
@@ -186,68 +186,71 @@ int mt76_switch_vif_chanctx(struct ieee80211_hw *hw,
int n_vifs,
enum ieee80211_chanctx_switch_mode mode)
{
- struct mt76_chanctx *old_ctx = (struct mt76_chanctx *)vifs->old_ctx->drv_priv;
- struct mt76_chanctx *new_ctx = (struct mt76_chanctx *)vifs->new_ctx->drv_priv;
- struct ieee80211_chanctx_conf *conf = vifs->new_ctx;
- struct mt76_phy *old_phy = old_ctx->phy;
- struct mt76_phy *phy = hw->priv;
+ struct ieee80211_vif_chanctx_switch *v;
+ struct mt76_chanctx *old_ctx, *new_ctx;
+ struct mt76_phy *old_phy, *phy = hw->priv;
struct mt76_dev *dev = phy->dev;
struct mt76_vif_link *mlink;
- bool update_chan;
+ bool need_update[__MT_MAX_BAND] = {};
int i, ret = 0;
- if (mode == CHANCTX_SWMODE_SWAP_CONTEXTS)
- phy = new_ctx->phy = dev->band_phys[conf->def.chan->band];
- else
- phy = new_ctx->phy;
- if (!phy)
- return -EINVAL;
-
- update_chan = phy->chanctx != new_ctx;
- if (update_chan) {
- if (dev->scan.phy == phy)
- mt76_abort_scan(dev);
-
- cancel_delayed_work_sync(&phy->mac_work);
+ for (i = 0; i < n_vifs; i++) {
+ v = &vifs[i];
+ new_ctx = (struct mt76_chanctx *)v->new_ctx->drv_priv;
+ if (mode == CHANCTX_SWMODE_SWAP_CONTEXTS)
+ phy = new_ctx->phy = dev->band_phys[v->new_ctx->def.chan->band];
+ else
+ phy = new_ctx->phy;
+
+ if (!phy)
+ return -EINVAL;
+
+ if (phy->chanctx != new_ctx) {
+ if (dev->scan.phy == phy)
+ mt76_abort_scan(dev);
+
+ cancel_delayed_work_sync(&phy->mac_work);
+ need_update[phy->band_idx] = true;
+ }
}
mutex_lock(&dev->mutex);
- if (mode == CHANCTX_SWMODE_SWAP_CONTEXTS &&
- phy != old_phy && old_phy->chanctx == old_ctx)
- old_phy->chanctx = NULL;
+ for (i = 0; i < n_vifs; i++) {
+ v = &vifs[i];
+ old_ctx = (struct mt76_chanctx *)v->old_ctx->drv_priv;
+ old_phy = old_ctx->phy;
- if (update_chan)
- ret = mt76_phy_update_channel(phy, vifs->new_ctx);
+ new_ctx = (struct mt76_chanctx *)v->new_ctx->drv_priv;
+ phy = new_ctx->phy;
- if (ret)
- goto out;
+ if (mode == CHANCTX_SWMODE_SWAP_CONTEXTS && old_phy->chanctx &&
+ old_phy->chanctx == old_ctx && phy != old_phy)
+ old_phy->chanctx = NULL;
- if (old_phy == phy)
- goto skip_link_replace;
+ if (need_update[phy->band_idx]) {
+ ret = mt76_phy_update_channel(phy, v->new_ctx);
+ if (ret)
+ goto out;
- for (i = 0; i < n_vifs; i++) {
- mlink = mt76_vif_conf_link(dev, vifs[i].vif, vifs[i].link_conf);
+ need_update[phy->band_idx] = false;
+ }
+
+ mlink = mt76_vif_conf_link(dev, v->vif, v->link_conf);
if (!mlink)
continue;
- dev->drv->vif_link_remove(old_phy, vifs[i].vif,
- vifs[i].link_conf, mlink);
+ if (old_phy != phy) {
+ dev->drv->vif_link_remove(old_phy, v->vif, v->link_conf,
+ mlink);
- ret = dev->drv->vif_link_add(phy, vifs[i].vif,
- vifs[i].link_conf, mlink);
- if (ret)
- goto out;
-
- }
-
-skip_link_replace:
- for (i = 0; i < n_vifs; i++) {
- mlink = mt76_vif_conf_link(dev, vifs[i].vif, vifs[i].link_conf);
- if (!mlink)
- continue;
+ ret = dev->drv->vif_link_add(phy, v->vif, v->link_conf,
+ mlink);
+ if (ret)
+ goto out;
+ }
- mlink->ctx = vifs->new_ctx;
+ mlink->ctx = v->new_ctx;
if (mlink->beacon_mon_interval)
WRITE_ONCE(mlink->beacon_mon_last, jiffies);
}
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v8 4/9] nvmem: layouts: Support fixed-layout as the nvmem device node itself
From: Bartosz Golaszewski @ 2026-07-17 8:29 UTC (permalink / raw)
To: Bartosz Golaszewski
Cc: linux-mmc, devicetree, linux-kernel, linux-arm-msm, linux-block,
linux-wireless, ath10k, linux-bluetooth, netdev, daniel,
Loic Poulain, Ulf Hansson, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Jens Axboe,
Johannes Berg, Jeff Johnson, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Srinivas Kandagatla, Andrew Lunn, Heiner Kallweit,
Russell King, Saravana Kannan, Christian Marangi
In-Reply-To: <CAMRc=MdNehSRQT3MUs+QtbZsHcUCS8YjyZchTgHCVv-HaLQkeA@mail.gmail.com>
On Wed, 15 Jul 2026 14:07:24 +0200, Bartosz Golaszewski <brgl@kernel.org> said:
> On Fri, 3 Jul 2026 15:45:17 +0200, Loic Poulain <loic.poulain@oss.qualcomm.com> said:
>> of_nvmem_layout_get_container() only looks for a child node named
>> "nvmem-layout" to locate the cell definitions. This does not cover
>> providers whose device tree node is itself the fixed-layout container,
>> such as an eMMC boot partition block device whose fwnode points directly
>> at a "fixed-layout" compatible partitions node.
>>
>> When no "nvmem-layout" child is present, fall back to returning the nvmem
>> device node itself if it is compatible with "fixed-layout", so that its
>> cells are parsed by nvmem_add_cells_from_fixed_layout().
>>
>> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
>> ---
>> drivers/nvmem/layouts.c | 13 ++++++++++++-
>> 1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/nvmem/layouts.c b/drivers/nvmem/layouts.c
>> index b90584e1b99eab4217cbe7ec48373e18a7caf0dc..efa631ce7283bdd6c8ecda75915911b5e3a33c99 100644
>> --- a/drivers/nvmem/layouts.c
>> +++ b/drivers/nvmem/layouts.c
>> @@ -167,7 +167,18 @@ static int nvmem_layout_bus_populate(struct nvmem_device *nvmem,
>>
>> struct device_node *of_nvmem_layout_get_container(struct nvmem_device *nvmem)
>> {
>> - return of_get_child_by_name(nvmem->dev.of_node, "nvmem-layout");
>> + struct device_node *np;
>> +
>> + /* Search for nvmem-layout child */
>> + np = of_get_child_by_name(nvmem->dev.of_node, "nvmem-layout");
>> + if (np)
>> + return np;
>> +
>> + /* The nvmem of_node is itself a fixed-layout node */
>> + if (of_device_is_compatible(nvmem->dev.of_node, "fixed-layout"))
>> + return of_node_get(nvmem->dev.of_node);
>> +
>> + return NULL;
>> }
>> EXPORT_SYMBOL_GPL(of_nvmem_layout_get_container);
>>
>>
>> --
>> 2.34.1
>>
>>
>
> I have it on my TODO list to convert nvmem layouts to be fwnode-agnostic. While
> I'm not sure when I'll have the time to look into it, I think it makes sense
> to not introduce any new OF-specific interfaces. Can you make it into:
>
> struct fwnode_handle *nvmem_layout_get_container_node(struct nvmem_device *nvmem);
>
> by replacing of_get_child_by_name() with fwnode_get_name_child_node() and
> of_device_is_compatible() with device_is_compatible()? That would mean less
> churn in the future.
>
> Other than that, it looks good.
>
> Bart
>
Scratch that, I didn't realize this isn't a new function but a rework of an
existing one.
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Bart
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox