From: Mehmet Fide <mehmet.fide@gmail.com>
To: Ping-Ke Shih <pkshih@realtek.com>,
Bitterblue Smith <rtl8821cerfe2@gmail.com>,
linux-wireless@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Subject: [PATCH rtw-next v3] wifi: rtw88: usb: do not log transfers lost to a mode switch
Date: Thu, 13 Aug 2026 08:40:48 +0200 [thread overview]
Message-ID: <20260813064048.198903-1-mehmet.fide@gmail.com> (raw)
In-Reply-To: <72ff0d793d61415eb9fd1c513abdcc5a@realtek.com>
An RTL8822BU or RTL8822CU is asked to come back as a USB 3 device by
rtw_usb_switch_mode_new(). The chip powers off its MAC and leaves the bus
while the last control transfers of that sequence are still in flight, so
they complete with -EPROTO and the driver reports them as errors:
rtw_8822bu 1-1:1.0: Firmware version 27.2.0, H2C version 13
rtw_8822bu 1-1:1.0: write register 0xc4 failed with -71
usb 1-1: USB disconnect, device number 2
usbcore: registered new interface driver rtw_8822bu
rtw_8822bu 1-1:1.0: Firmware version 27.2.0, H2C version 13
Register 0xc4 is REG_PAD_CTRL2 and the access losing the race is the
rtw_write32_set() that ends the switch sequence, a few milliseconds before
the disconnect. Which transfer gets caught varies from boot to boot: 0xc4
is in the "always on" section, so every write to it is followed by a second
one from rtw_usb_reg_sec(), and sometimes that is the one that fails:
rtw_8822bu 1-1:1.0: rtw_usb_reg_sec: reg 0x4e0, usb write 1 fail, status: -71
Nothing is wrong here. The device re-enumerates, probes again and registers
normally, which is why rtw_usb_probe() already treats a non-zero return
from rtw_usb_switch_mode() as "Not a fail". On a USB 2 only port the
switch can never succeed, so the message returns on every boot and
everyone using such a port has to work out that it is harmless.
Mark the window in which the chip is expected to leave the bus and skip the
error reports for transfers that fall into it. The mark is set in
rtw_usb_switch_mode(), so it covers both the new and the old switch
sequence, and it is dropped again unless a switch was really started. It is
never cleared after that because the switch always ends in a re-probe with
a fresh struct rtw_usb.
Tested with an RTL8822BU (0x7392:0xb822) on a USB 2 root port of a TI AM62,
where the message appears exactly once per boot. With the patch both lines
are gone while the disconnect, the re-enumeration and the second firmware
load are unchanged.
Signed-off-by: Mehmet Fide <mehmet.fide@gmail.com>
---
v3:
- set the mark in rtw_usb_switch_mode() instead of in the two switch
helpers, and keep it only when the return value is 1 (Ping-Ke Shih)
I did not go for WARN_ONCE(): it would still fire once on every boot, which
is exactly the message this patch is about, and it would add a backtrace to
something the driver causes on purpose and already treats as "Not a fail".
One note on where the mark is set. The transfers that lose the race are the
last ones inside the switch helper, before it returns, so setting the mark
only after the call would come too late. Setting it in the caller before the
call and dropping it again unless the helper returns 1 keeps it in one place
and still covers the window. The small cost is that the couple of register
reads at the start of the helper are covered too.
v2:
- regenerated with git format-patch on top of rtw-next, as asked
- also cover the old switch sequence, used by RTL8812AU and RTL8814AU
drivers/net/wireless/realtek/rtw88/usb.c | 23 ++++++++++++++++++-----
drivers/net/wireless/realtek/rtw88/usb.h | 3 +++
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 64e1c3420..7a4de4995 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -64,7 +64,7 @@ static void rtw_usb_reg_sec(struct rtw_dev *rtwdev, u32 addr, __le32 *data)
RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
t_reg, 0, data, t_len, 500);
- if (status != t_len && status != -ENODEV)
+ if (status != t_len && status != -ENODEV && !rtwusb->switching_mode)
rtw_err(rtwdev, "%s: reg 0x%x, usb write %u fail, status: %d\n",
__func__, t_reg, t_len, status);
}
@@ -90,7 +90,7 @@ static u32 rtw_usb_read(struct rtw_dev *rtwdev, u32 addr, u16 len)
ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTW_USB_CMD_REQ, RTW_USB_CMD_READ, addr,
RTW_USB_VENQT_CMD_IDX, data, len, 1000);
- if (ret < 0 && ret != -ENODEV && count++ < 4)
+ if (ret < 0 && ret != -ENODEV && !rtwusb->switching_mode && count++ < 4)
rtw_err(rtwdev, "read register 0x%x failed with %d\n",
addr, ret);
@@ -140,7 +140,7 @@ static void rtw_usb_write(struct rtw_dev *rtwdev, u32 addr, u32 val, int len)
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
addr, 0, data, len, 500);
- if (ret < 0 && ret != -ENODEV && count++ < 4)
+ if (ret < 0 && ret != -ENODEV && !rtwusb->switching_mode && count++ < 4)
rtw_err(rtwdev, "write register 0x%x failed with %d\n",
addr, ret);
@@ -1172,7 +1172,9 @@ static bool rtw_usb3_chip_new(u8 chip_id)
static int rtw_usb_switch_mode(struct rtw_dev *rtwdev)
{
+ struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
u8 id = rtwdev->chip->id;
+ int ret;
if (!rtw_usb3_chip_new(id) && !rtw_usb3_chip_old(id))
return 0;
@@ -1189,10 +1191,21 @@ static int rtw_usb_switch_mode(struct rtw_dev *rtwdev)
return 0;
}
+ /* From here the chip may power off its MAC and re-enumerate, so it can
+ * leave the bus while a control transfer is still in flight. Keep the
+ * mark only if a switch was really started.
+ */
+ rtwusb->switching_mode = true;
+
if (rtw_usb3_chip_old(id))
- return rtw_usb_switch_mode_old(rtwdev);
+ ret = rtw_usb_switch_mode_old(rtwdev);
else
- return rtw_usb_switch_mode_new(rtwdev);
+ ret = rtw_usb_switch_mode_new(rtwdev);
+
+ if (ret != 1)
+ rtwusb->switching_mode = false;
+
+ return ret;
}
#define USB_REG_PAGE 0xf4
diff --git a/drivers/net/wireless/realtek/rtw88/usb.h b/drivers/net/wireless/realtek/rtw88/usb.h
index 9b695b688..9d2825368 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.h
+++ b/drivers/net/wireless/realtek/rtw88/usb.h
@@ -85,6 +85,9 @@ struct rtw_usb {
struct sk_buff_head rx_free_queue;
struct work_struct rx_work;
struct work_struct rx_urb_work;
+
+ /* the chip is re-enumerating, control transfers are expected to fail */
+ bool switching_mode;
};
static inline struct rtw_usb_tx_data *rtw_usb_get_tx_data(struct sk_buff *skb)
--
2.54.0
prev parent reply other threads:[~2026-08-13 6:40 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 12:28 [PATCH wireless-next] wifi: rtw88: usb: do not log transfers lost to a mode switch Mehmet Fide
2026-08-12 17:01 ` Bitterblue Smith
2026-08-12 17:32 ` [PATCH rtw-next v2] " Mehmet Fide
2026-08-13 0:41 ` Ping-Ke Shih
2026-08-13 6:40 ` Mehmet Fide [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260813064048.198903-1-mehmet.fide@gmail.com \
--to=mehmet.fide@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=pkshih@realtek.com \
--cc=rtl8821cerfe2@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox