kernel/git/next/linux-next.git/drivers/net/wireless/broadcom, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git

2026-09-17T15:03:59+00:00

# Conflicts: # drivers/net/wireless/virtual/mac80211_hwsim_main.c # include/net/mac80211.h # net/mac80211/iface.c # net/mac80211/tx.c

wifi: brcmfmac: log the firmware status when a connect fails

2026-09-15T13:07:07+00:00

brcmf_bss_connect_done() receives the firmware event in @e but discards it on the failure path. Every failed connect is reported to cfg80211 as WLAN_STATUS_AUTH_TIMEOUT (16), whatever the firmware actually said, so userspace only ever sees: wlan0: CTRL-EVENT-ASSOC-REJECT bssid=00:00:00:00:00:00 status_code=16 The all-zero BSSID comes from the same place: conn_params is memset to zero and profile->bssid has not been filled in when the station never associated. status_code=16 therefore carries no information about the cause. It is not an AP response and it does not mean "authentication timed out" - it is the only failure value this driver can produce. This is a recurring source of confusion: [1] has been open since 2023 with more than twenty follow-ups and no explanation of the code, and covers BCM4345/6, BCM43430 and CYW43455 across several kernel versions. It supersedes [2], filed against the firmware repository a day earlier and closed in favour of it. The firmware's own status (BRCMF_E_STATUS_*) is more specific - FAIL, TIMEOUT, NO_NETWORKS, ABORT and so on - and it is already in hand. Log it so the cause can be narrowed down without rebuilding the kernel. bphy_err() is used rather than brcmf_dbg() or brcmf_info(): it is the form the rest of this file uses, and of the three it is the only one that is both visible in a distribution kernel and bounded. brcmf_dbg(CONN) expands to no_printk() unless CONFIG_BRCMDBG is set, which is what makes the reports in [1] and [2] impossible to act on - the people hitting this run stock kernels. brcmf_info() expands to a plain pr_info() in a non-debug build and is not rate limited, and wpa_supplicant retries the association every few seconds, so it would flood the log. bphy_err() is guarded by net_ratelimit() there, so a station retrying against an unreachable AP prints at most a few lines per second. All three fields are printed because only some of them are meaningful on each path into the failure branch. brcmf_is_nonetwork() keys off @status, so that is the useful field for a join that never associated - the case in [1]. brcmf_is_linkdown() keys off @event_code and @flags and does not look at @status at all, so @status can read 0 there; on those events it is @reason which carries the 802.11 reason code, as the mapping in brcmf_map_fw_linkdown_reason() shows. Printing the three together lets the reader tell which path was taken instead of guessing from one number. The status reported to cfg80211 is left alone; changing it would alter what userspace sees. [1] https://github.com/RPi-Distro/firmware-nonfree/issues/38 [2] https://github.com/raspberrypi/firmware/issues/1829 Assisted-by: Claude:claude-opus-5 Signed-off-by: Ryohei Hashimoto Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260913165526.4426-1-laurel.medalist12@gmail.com Signed-off-by: Johannes Berg

wifi: brcmfmac: advertise firmware fast roam offload support

2026-09-15T13:03:51+00:00

Advertise NL80211_EXT_FEATURE_FAST_ROAM_OFFLOAD only when firmware reports FBT or OKC support. That lets userspace provide PMK material for firmware fast roaming without enabling the path on devices that cannot complete the offloaded roam. Assisted-by: GitHub-Copilot-CLI:gpt-5.5 Signed-off-by: Carella Chen Signed-off-by: Jason Huang Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260911065656.1269623-6-Jason.Huang2@infineon.com Signed-off-by: Johannes Berg

wifi: brcmfmac: report port authorization after offloaded roaming

2026-09-15T13:03:51+00:00

Firmware can complete FT or OKC roaming before the driver reports the connect or roam event to cfg80211. Detect those successful offloaded cases when the profile uses firmware 1X or roaming offload and the association request carries PMK cache state, FT is in use, or OKC is enabled. After reporting the connect or roam event, call cfg80211_port_authorized() so nl80211 emits the dedicated NL80211_CMD_PORT_AUTHORIZED event instead of reusing the reserved NL80211_ATTR_PORT_AUTHORIZED flag in CONNECT/ROAM notifications. Assisted-by: GitHub-Copilot-CLI:gpt-5.5 Signed-off-by: Darren Li Signed-off-by: Chung-Hsien Hsu Signed-off-by: Chi-hsien Lin Signed-off-by: Carella Chen Signed-off-by: Jason Huang Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260911065656.1269623-5-Jason.Huang2@infineon.com Signed-off-by: Johannes Berg

wifi: brcmfmac: add PMK programming for firmware roaming offload

2026-09-15T13:03:50+00:00

FT and OKC roaming offload need PMK material in firmware even when the initial 802.1X exchange is handled by userspace. Add a roaming firmware-supplicant profile state for those connections and allow PMK configuration while firmware FT or OKC state is active. Program the OKC PMK through the okc_info_pmk iovar before setting the regular PMK when firmware reports OKC state. Only select the roaming firmware-supplicant state when firmware advertises FBT or OKC support; devices without those capabilities keep the profile in the userspace supplicant state and do not issue roaming-offload specific iovars on every connect. For FT-PSK with firmware supplicant support, keep the profile in the PSK firmware-supplicant state. Assisted-by: GitHub-Copilot-CLI:gpt-5.5 Signed-off-by: Darren Li Signed-off-by: Chung-Hsien Hsu Signed-off-by: Chi-hsien Lin Co-developed-by: Carella Chen Signed-off-by: Carella Chen Co-developed-by: Shelley Yang Signed-off-by: Shelley Yang Signed-off-by: Jason Huang Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260911065656.1269623-4-Jason.Huang2@infineon.com Signed-off-by: Johannes Berg

wifi: brcmfmac: detect firmware FBT and OKC support

2026-09-15T13:03:50+00:00

Some firmware advertises Fast BSS Transition and Opportunistic Key Caching support through the firmware capability string. Track those capabilities so later roaming offload handling can be enabled only when firmware reports support. Assisted-by: GitHub-Copilot-CLI:gpt-5.5 Signed-off-by: Carella Chen Signed-off-by: Jason Huang Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260911065656.1269623-3-Jason.Huang2@infineon.com Signed-off-by: Johannes Berg

wifi: brcmsmac: fix UAF in brcms_free_timer()

2026-09-15T09:52:56+00:00

brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If the work callback (_brcms_timer) is already running, cancel_delayed_work() returns false without waiting, and brcms_free_timer() proceeds to kfree(t) while the callback still accesses t through container_of(). Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to guarantee that any in-flight callback has completed before the timer structure is freed. Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") Cc: stable@vger.kernel.org Signed-off-by: Jiangshan Yi Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260815121043.938414-1-yijiangshan@kylinos.cn Signed-off-by: Johannes Berg

wifi: brcmfmac: fix lost 802.1x TX completion wakeup

2026-09-15T09:52:24+00:00

brcmf_txfinalize() decrements pend_8021x_cnt before a lockless waitqueue_active() check. atomic_dec() does not order the decrement against the check. The waiter can therefore observe a nonzero count while the waker observes an empty queue, losing the final wakeup and delaying key installation until the 950 ms timeout. Add smp_mb__after_atomic() to order the decrement before the queue check. wait_event_timeout() provides the matching barrier. LKMM confirms that this forbids the lost-wakeup outcome. Fixes: 21fff75d2fb6 ("brcmfmac: use wait_event_timeout for 8021x pending count") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260811082702.44521-1-kmehltretter@gmail.com Signed-off-by: Johannes Berg

wifi: b43legacy: Use flexible array for DMA metadata

2026-09-04T08:11:57+00:00

Store the per-descriptor metadata in the DMA ring allocation instead of allocating it separately. This ties the metadata lifetime directly to the ring, removes a separate allocation failure path, and keeps the descriptor count available for __counted_by() bounds checking. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260511041934.378209-1-rosenp@gmail.com Signed-off-by: Johannes Berg

wifi: brcmfmac: cyw: pass PMKID to firmware if present

2026-09-04T08:09:41+00:00

Zero out auth_status on initialization. Otherwise, garbage will leak from the stack to the firmware (when ssid is less than 32 bytes and/or when params->pmkid is set). Then, pass the params->pmkid to the firmware (without it, the firmware caches a garbage PMKID on successful authentication and denies a subsequent association request that includes the PMKID). Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") Signed-off-by: Bogdan Nicolae Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260807163418.487508-1-bogdan.nicolae@gmail.com Signed-off-by: Johannes Berg