[PATCH rtw-next 00/15] wifi: rtw89: correct MLO behavior, fix Coverity issues, and update hardware settings

[PATCH rtw-next 00/15] wifi: rtw89: correct MLO behavior, fix Coverity issues, and update hardware settings

[Ping-Ke Shih]

The first patch is to consider AMSDU off as a factor to lower latency.

Patches 2/15 - 4/15 are to correct MLO behavior.

Patches 5/15 - 8/15 are to fix Coverity issues.

Others are to update firmware format and hardware settings according to
firmware development and update from internal driver.

Dian-Syuan Yang (1):
  wifi: rtw89: 8922d: update BA cam format to G7

Eric Huang (2):
  wifi: rtw89: 8922d: add extra data to PS H2C
  wifi: rtw89: phy: correct PHY-1 EDCCA report register access

Ping-Ke Shih (5):
  wifi: rtw89: consider sta maximum AMSDU subframes number to decide TX
    work waiting
  wifi: rtw89: mac: change beamformee CSI direct forward to CMAC_TXDMA
  wifi: rtw89: fw: extend ch_info format of hw_scan to v2
  wifi: rtw89: 8851b: rfk: set DCK start and delay time
  wifi: rtw89: 8852b: update default value for ANA SWR

Po-Hao Huang (3):
  wifi: rtw89: mlo: update link id to FW upon connection
  Revert "wifi: rtw89: fix unable to receive probe responses under MLO
    connection"
  wifi: rtw89: modify active scan rule for 6GHz band

Zong-Zhe Yang (4):
  wifi: rtw89: fix ctrl_sco_cck for Wi-Fi 7
  wifi: rtw89: 8852a: prevent potential OOB in ctrl_sco_cck
  wifi: rtw89: fw: cmd_ofld_flush always reset counter
  wifi: rtw89: explicitly declare TX queue flags by DECLARE_BITMAP()

 drivers/net/wireless/realtek/rtw89/core.c     |  36 ++--
 drivers/net/wireless/realtek/rtw89/core.h     |   8 +-
 drivers/net/wireless/realtek/rtw89/fw.c       | 173 ++++++++++++++++--
 drivers/net/wireless/realtek/rtw89/fw.h       |  49 ++++-
 drivers/net/wireless/realtek/rtw89/mac.c      |   3 +-
 drivers/net/wireless/realtek/rtw89/mac80211.c |   4 +-
 drivers/net/wireless/realtek/rtw89/mac_be.c   |   3 +
 drivers/net/wireless/realtek/rtw89/phy.c      |  25 ++-
 drivers/net/wireless/realtek/rtw89/reg.h      |  22 ++-
 .../realtek/rtw89/rtw8851b_rfk_table.c        |   3 +-
 drivers/net/wireless/realtek/rtw89/rtw8852a.c |   8 +
 drivers/net/wireless/realtek/rtw89/rtw8852b.c |   5 +-
 drivers/net/wireless/realtek/rtw89/rtw8922a.c |   2 +-
 drivers/net/wireless/realtek/rtw89/rtw8922d.c |   8 +-
 14 files changed, 284 insertions(+), 65 deletions(-)


base-commit: f71dd599a98182d6bc34dce39977f928068ecd64
-- 
2.25.1

[PATCH rtw-next 01/15] wifi: rtw89: consider sta maximum AMSDU subframes number to decide TX work waiting

[Ping-Ke Shih]

Consider the sta maximum AMSDU subframes as a factor to set agg_wait to 0
to avoid TX work waiting to yield better latency if real-time application
lets AMSDU off by

   iw dev wlan0 set tidconf tids 0xff amsdu off

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/phy.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
index 501923d97971..c33b888bc0e3 100644
--- a/drivers/net/wireless/realtek/rtw89/phy.c
+++ b/drivers/net/wireless/realtek/rtw89/phy.c
@@ -3221,6 +3221,17 @@ static void rtw89_phy_set_txpwr_limit_ru_ax(struct rtw89_dev *rtwdev,
 	}
 }
 
+static int get_max_agg_wait(struct ieee80211_link_sta *link_sta, u16 amsdu_len)
+{
+	struct ieee80211_sta *sta = link_sta->sta;
+	int max_agg_wait = amsdu_len / 1500 - 1;
+
+	if (sta->max_amsdu_subframes)
+		max_agg_wait = min(max_agg_wait, sta->max_amsdu_subframes - 1);
+
+	return max_agg_wait;
+}
+
 struct rtw89_phy_iter_ra_data {
 	struct rtw89_dev *rtwdev;
 	struct sk_buff *c2h;
@@ -3345,7 +3356,7 @@ static void __rtw89_phy_c2h_ra_rpt_iter(struct rtw89_sta_link *rtwsta_link,
 		*changed = true;
 	}
 
-	rtwsta_link->max_agg_wait = link_sta->agg.max_rc_amsdu_len / 1500 - 1;
+	rtwsta_link->max_agg_wait = get_max_agg_wait(link_sta, amsdu_len);
 }
 
 static void rtw89_phy_c2h_ra_rpt_iter(void *data, struct ieee80211_sta *sta)
-- 
2.25.1

[PATCH rtw-next 02/15] wifi: rtw89: mlo: update link id to FW upon connection

[Ping-Ke Shih]

From: Po-Hao Huang <phhuang@realtek.com>

Update link id to firmware so correct information can be referenced.
This is required for the new power save firmware feature.
Without this FW could try to maintain power state of a not existing
link and leads to unexpected errors.

Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 6 +++---
 drivers/net/wireless/realtek/rtw89/fw.h | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 6760e0053665..86db025afd7f 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -5193,10 +5193,10 @@ int rtw89_fw_h2c_join_info(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwv
 				      RTW89_H2C_JOININFO_W1_EMLSR_PADDING) |
 		     le32_encode_bits(IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_256US,
 				      RTW89_H2C_JOININFO_W1_EMLSR_TRANS_DELAY) |
-		     le32_encode_bits(0, RTW89_H2C_JOININFO_W2_MACID_EXT) |
-		     le32_encode_bits(0, RTW89_H2C_JOININFO_W2_MAIN_MACID_EXT);
+		     le32_encode_bits(rtwvif_link->link_id, RTW89_H2C_JOININFO_W1_LINK_ID);
 
-	h2c_v1->w2 = 0;
+	h2c_v1->w2 = le32_encode_bits(0, RTW89_H2C_JOININFO_W2_MACID_EXT) |
+		     le32_encode_bits(0, RTW89_H2C_JOININFO_W2_MAIN_MACID_EXT);
 
 done:
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index f7d017d3ced0..6cb1f6dfb650 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -1858,6 +1858,11 @@ struct rtw89_h2c_join_v1 {
 #define RTW89_H2C_JOININFO_W1_INIT_PWR_STATE BIT(15)
 #define RTW89_H2C_JOININFO_W1_EMLSR_PADDING GENMASK(18, 16)
 #define RTW89_H2C_JOININFO_W1_EMLSR_TRANS_DELAY GENMASK(21, 19)
+#define RTW89_H2C_JOININFO_W1_IS_MLD_EXT BIT(22)
+#define RTW89_H2C_JOININFO_W1_SUPPORT_3LINKS BIT(23)
+#define RTW89_H2C_JOININFO_W1_IS_3RD_LINK BIT(24)
+#define RTW89_H2C_JOININFO_W1_LINK_ID GENMASK(28, 25)
+#define RTW89_H2C_JOININFO_W1_UPDATE_MODE GENMASK(31, 29)
 #define RTW89_H2C_JOININFO_W2_MACID_EXT GENMASK(7, 0)
 #define RTW89_H2C_JOININFO_W2_MAIN_MACID_EXT GENMASK(15, 8)
 
-- 
2.25.1

[PATCH rtw-next 03/15] Revert "wifi: rtw89: fix unable to receive probe responses under MLO connection"

[Ping-Ke Shih]

From: Po-Hao Huang <phhuang@realtek.com>

This reverts commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223.

We no longer require this change after commit 0b0ff976af94
("wifi: mac80211: accept probe response on link address as well")
Previously, the encryption and decryption of MLD connections are not
working properly during scan, this could lead to timeout on some
applications.

Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 86db025afd7f..a16127b2c317 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -10445,7 +10445,6 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
 	struct cfg80211_scan_request *req = &scan_req->req;
 	const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
 						       rtwvif_link->chanctx_idx);
-	struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
 	struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
 	struct rtw89_chanctx_pause_parm pause_parm = {
 		.rsn = RTW89_CHANCTX_PAUSE_REASON_HW_SCAN,
@@ -10478,8 +10477,6 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
 	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
 		get_random_mask_addr(mac_addr, req->mac_addr,
 				     req->mac_addr_mask);
-	else if (ieee80211_vif_is_mld(vif))
-		ether_addr_copy(mac_addr, vif->addr);
 	else
 		ether_addr_copy(mac_addr, rtwvif_link->mac_addr);
 
-- 
2.25.1

[PATCH rtw-next 04/15] wifi: rtw89: modify active scan rule for 6GHz band

[Ping-Ke Shih]

From: Po-Hao Huang <phhuang@realtek.com>

Remove the cancellation of active scan with specific SSID when receiving
beacons/probe responses of that SSID. Per IEEE Std 802.11ax 26.17.2.3.3,
only active scan of direct BSSID should be cancelled. Previously the
cancellation causes hidden AP under same ESS couldn't be found.

Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/core.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 572d9c65a2dd..8ab15ee1b155 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -2579,7 +2579,6 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 	struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
 	struct rtw89_pktofld_info *info;
-	const u8 *ies = mgmt->u.beacon.variable, *ssid_ie;
 	bool queue_work = false;
 
 	if (rx_status->band != NL80211_BAND_6GHZ)
@@ -2590,21 +2589,10 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
 		return;
 	}
 
-	ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
-
 	list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
 		if (ether_addr_equal(info->bssid, mgmt->bssid)) {
 			info->cancel = true;
 			queue_work = true;
-			continue;
-		}
-
-		if (!ssid_ie || ssid_ie[1] != info->ssid_len || info->ssid_len == 0)
-			continue;
-
-		if (memcmp(&ssid_ie[2], info->ssid, info->ssid_len) == 0) {
-			info->cancel = true;
-			queue_work = true;
 		}
 	}
 
-- 
2.25.1

[PATCH rtw-next 05/15] wifi: rtw89: fix ctrl_sco_cck for Wi-Fi 7

[Ping-Ke Shih]

From: Zong-Zhe Yang <kevin_yang@realtek.com>

Wi-Fi 7 chips have function to control SCO (Symbol Carrier Offset) for
CCK. The corresponding valid primary channels are from 1 to 14, i.e.
array index is from 0 to 13. So, fix the condition.

Resolve INTEGER_OVERFLOW (Overflowed array index read) reported by
Coverity.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/rtw8922a.c | 2 +-
 drivers/net/wireless/realtek/rtw89/rtw8922d.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
index 2d225e009b28..6402bd4f06aa 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
@@ -1152,7 +1152,7 @@ static int rtw8922a_ctrl_sco_cck(struct rtw89_dev *rtwdev,
 {
 	u8 ch_element;
 
-	if (primary_ch >= 14)
+	if (primary_ch > 14 || unlikely(primary_ch == 0))
 		return -EINVAL;
 
 	ch_element = primary_ch - 1;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
index 75297b39c4d7..89c1f58d0dc0 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
@@ -1320,7 +1320,7 @@ static int rtw8922d_ctrl_sco_cck(struct rtw89_dev *rtwdev,
 {
 	u8 ch_element;
 
-	if (primary_ch >= 14)
+	if (primary_ch > 14 || unlikely(primary_ch == 0))
 		return -EINVAL;
 
 	ch_element = primary_ch - 1;
-- 
2.25.1

[PATCH rtw-next 06/15] wifi: rtw89: 8852a: prevent potential OOB in ctrl_sco_cck

[Ping-Ke Shih]

From: Zong-Zhe Yang <kevin_yang@realtek.com>

The array size is 14. Add a check to avoid out-of-bound access.
Although it doesn't seem to happen if everything follows spec.,
it might have potential problem in pure logic.

Resolve OVERRUN (Out-of-bounds access) reported by Coverity.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/rtw8852a.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
index 5d7b5d1a24b1..4b364f039464 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
@@ -945,6 +945,14 @@ static int rtw8852a_ctrl_sco_cck(struct rtw89_dev *rtwdev, u8 central_ch,
 		rtw89_warn(rtwdev, "Invalid BW:%d for CCK\n", bw);
 		return -EINVAL;
 	}
+
+	if (unlikely(ch_element >= 14)) {
+		rtw89_warn(rtwdev,
+			   "Invalid ch_element:%u where central_ch %u primary_ch %u\n",
+			   ch_element, central_ch, primary_ch);
+		return -EINVAL;
+	}
+
 	rtw89_phy_write32_mask(rtwdev, R_RXSCOBC, B_RXSCOBC_TH,
 			       rtw8852a_sco_barker_threshold[ch_element]);
 	rtw89_phy_write32_mask(rtwdev, R_RXSCOCCK, B_RXSCOCCK_TH,
-- 
2.25.1

[PATCH rtw-next 07/15] wifi: rtw89: fw: cmd_ofld_flush always reset counter

[Ping-Ke Shih]

From: Zong-Zhe Yang <kevin_yang@realtek.com>

Callers expect cmd offload counter is reset after flushing, and then
use counter++ with array index. Previously, it might cause OOB since
cmd_ofld_flush gets an error, e.g out of memory, and does not reset
the cmd offload counter. Fix cmd_ofld_flush to always reset it.

Resolve OVERRUN (Out-of-bounds write) reported by Coverity.
Pass info to cmd_ofld_flush to make Coverity aware the changes on
cmd offload counter.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/fw.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index a16127b2c317..dcbdf4b5e4b2 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -12643,9 +12643,9 @@ static int rtw89_fw_cmd_ofld_pack(struct rtw89_dev *rtwdev)
 	return 0;
 }
 
-static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev)
+static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev,
+				    struct rtw89_fw_cmd_ofld_info *info)
 {
-	struct rtw89_fw_cmd_ofld_info *info = rtwdev->fw_cmd_ofld_info;
 	struct sk_buff *skb;
 	int ret;
 	u32 len;
@@ -12654,7 +12654,7 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev)
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "alloc skb fail\n");
-		return;
+		goto out;
 	}
 
 	skb_put_data(skb, info->cmds, len);
@@ -12669,12 +12669,13 @@ static void rtw89_fw_cmd_ofld_flush(struct rtw89_dev *rtwdev)
 	if (ret) {
 		rtw89_err(rtwdev, "failed to send cmd ofld\n");
 		dev_kfree_skb_any(skb);
-		return;
+		goto out;
 	}
 
 	if (info->accu_delay)
 		fsleep(info->accu_delay);
 
+out:
 	info->cnt = 0;
 	info->accu_delay = 0;
 }
@@ -12694,7 +12695,7 @@ static int rtw89_fw_cmd_ofld_unpack(struct rtw89_dev *rtwdev)
 	if (info->cnt == 0)
 		return 0;
 
-	rtw89_fw_cmd_ofld_flush(rtwdev);
+	rtw89_fw_cmd_ofld_flush(rtwdev, info);
 
 	return 0;
 }
@@ -12721,7 +12722,7 @@ static int rtw89_fw_cmd_ofld_enqueue(struct rtw89_dev *rtwdev,
 		return -EFAULT;
 
 	if (info->cnt >= ARRAY_SIZE(info->cmds))
-		rtw89_fw_cmd_ofld_flush(rtwdev);
+		rtw89_fw_cmd_ofld_flush(rtwdev, info);
 
 	h2c = &info->cmds[info->cnt++];
 
-- 
2.25.1

[PATCH rtw-next 08/15] wifi: rtw89: explicitly declare TX queue flags by DECLARE_BITMAP()

[Ping-Ke Shih]

From: Zong-Zhe Yang <kevin_yang@realtek.com>

Originally, TX queue flags was declared by pure unsigned long but was
used with bitops, e.g. test_bit. Although for now, there are not much
cases in enum rtw89_txq_flags to be over than bits that one long can
deal with, it indeed missed logical boundary check. Refine it to be
declared by DECLARE_BITMAP().

Resolve ARRAY_VS_SINGLETON (Out-of-bounds access) reported by Coverity.

(doesn't change logic)

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/core.c     | 24 +++++++++----------
 drivers/net/wireless/realtek/rtw89/core.h     |  5 +++-
 drivers/net/wireless/realtek/rtw89/mac80211.c |  4 ++--
 3 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 8ab15ee1b155..b074b3677c43 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -4625,7 +4625,7 @@ static void rtw89_core_ba_work(struct work_struct *work)
 				    "failed to setup BA session for %pM:%2d: %d\n",
 				    sta->addr, tid, ret);
 			if (ret == -EINVAL)
-				set_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags);
+				set_bit(RTW89_TXQ_F_BLOCK_BA, rtwtxq->flags);
 		}
 skip_ba_work:
 		list_del_init(&rtwtxq->list);
@@ -4658,7 +4658,7 @@ void rtw89_core_free_sta_pending_forbid_ba(struct rtw89_dev *rtwdev,
 		struct ieee80211_txq *txq = rtw89_txq_to_txq(rtwtxq);
 
 		if (sta == txq->sta) {
-			clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+			clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
 			list_del_init(&rtwtxq->list);
 		}
 	}
@@ -4685,12 +4685,12 @@ static void rtw89_core_stop_tx_ba_session(struct rtw89_dev *rtwdev,
 	if (unlikely(!rtwsta) || unlikely(rtwsta->disassoc))
 		return;
 
-	if (!test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags) ||
-	    test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+	if (!test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags) ||
+	    test_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
 		return;
 
 	spin_lock_bh(&rtwdev->ba_lock);
-	if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+	if (!test_and_set_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
 		list_add_tail(&rtwtxq->list, &rtwdev->forbid_ba_list);
 	spin_unlock_bh(&rtwdev->ba_lock);
 
@@ -4709,7 +4709,7 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
 	struct ieee80211_sta *sta = txq->sta;
 	struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta);
 
-	if (test_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags))
+	if (test_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags))
 		return;
 
 	if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
@@ -4720,10 +4720,10 @@ static void rtw89_core_txq_check_agg(struct rtw89_dev *rtwdev,
 	if (unlikely(!sta))
 		return;
 
-	if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, &rtwtxq->flags)))
+	if (unlikely(test_bit(RTW89_TXQ_F_BLOCK_BA, rtwtxq->flags)))
 		return;
 
-	if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags)) {
+	if (test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags)) {
 		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_AMPDU;
 		return;
 	}
@@ -4901,7 +4901,7 @@ static void rtw89_forbid_ba_work(struct work_struct *w)
 
 	spin_lock_bh(&rtwdev->ba_lock);
 	list_for_each_entry_safe(rtwtxq, tmp, &rtwdev->forbid_ba_list, list) {
-		clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+		clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
 		list_del_init(&rtwtxq->list);
 	}
 	spin_unlock_bh(&rtwdev->ba_lock);
@@ -6036,13 +6036,13 @@ static void _rtw89_core_set_tid_config(struct rtw89_dev *rtwdev,
 
 		if (mask & BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL)) {
 			if (tid_conf->ampdu == NL80211_TID_CONFIG_ENABLE) {
-				clear_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+				clear_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
 			} else {
-				if (test_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags))
+				if (test_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags))
 					ieee80211_stop_tx_ba_session(sta, txq->tid);
 				spin_lock_bh(&rtwdev->ba_lock);
 				list_del_init(&rtwtxq->list);
-				set_bit(RTW89_TXQ_F_FORBID_BA, &rtwtxq->flags);
+				set_bit(RTW89_TXQ_F_FORBID_BA, rtwtxq->flags);
 				spin_unlock_bh(&rtwdev->ba_lock);
 			}
 		}
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index c300d15581fc..d725124b39bf 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -244,6 +244,8 @@ enum rtw89_txq_flags {
 	RTW89_TXQ_F_AMPDU		= 0,
 	RTW89_TXQ_F_BLOCK_BA		= 1,
 	RTW89_TXQ_F_FORBID_BA		= 2,
+
+	NUM_OF_RTW89_TXQ_FLAGS,
 };
 
 enum rtw89_net_type {
@@ -1313,8 +1315,9 @@ struct rtw89_core_tx_request {
 
 struct rtw89_txq {
 	struct list_head list;
-	unsigned long flags;
 	int wait_cnt;
+
+	DECLARE_BITMAP(flags, NUM_OF_RTW89_TXQ_FLAGS);
 };
 
 struct rtw89_mac_ax_gnt {
diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index c1be69a3c192..cf356a54d91c 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -1043,7 +1043,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,
 	case IEEE80211_AMPDU_TX_STOP_CONT:
 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
-		clear_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags);
+		clear_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags);
 		clear_bit(tid, rtwsta->ampdu_map);
 		rtw89_chip_h2c_ampdu_cmac_tbl(rtwdev, rtwvif, rtwsta);
 		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
@@ -1051,7 +1051,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,
 		rtw89_phy_ra_recalc_agg_limit(rtwdev);
 		break;
 	case IEEE80211_AMPDU_TX_OPERATIONAL:
-		set_bit(RTW89_TXQ_F_AMPDU, &rtwtxq->flags);
+		set_bit(RTW89_TXQ_F_AMPDU, rtwtxq->flags);
 		rtwsta->ampdu_params[tid].agg_num = params->buf_size;
 		rtwsta->ampdu_params[tid].amsdu = params->amsdu;
 		set_bit(tid, rtwsta->ampdu_map);
-- 
2.25.1

[PATCH rtw-next 09/15] wifi: rtw89: 8922d: add extra data to PS H2C

[Ping-Ke Shih]

From: Eric Huang <echuang@realtek.com>

Append 2GHz regulatory mode and per-link BSS color to LPS
multi-link H2C to assist firmware backup and restore the
settings.

Signed-off-by: Eric Huang <echuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/core.h |  1 +
 drivers/net/wireless/realtek/rtw89/fw.c   | 44 +++++++++++++++++++++--
 drivers/net/wireless/realtek/rtw89/fw.h   | 17 +++++++++
 3 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index d725124b39bf..e88942c469e4 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -6023,6 +6023,7 @@ enum rtw89_fw_feature {
 	RTW89_FW_FEATURE_SER_L1_BY_EVENT,
 	RTW89_FW_FEATURE_SIM_SER_L0L1_BY_HALT_H2C,
 	RTW89_FW_FEATURE_LPS_ML_INFO_V1,
+	RTW89_FW_FEATURE_LPS_ML_INFO_V1_EXTRA,
 	RTW89_FW_FEATURE_SER_POST_RECOVER_DMAC,
 	RTW89_FW_FEATURE_TX_HISTORY_V1,
 
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index dcbdf4b5e4b2..300686ed0f6e 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -983,6 +983,7 @@ static const struct __fw_feat_cfg fw_feat_tbl[] = {
 	__CFG_FW_FEAT(RTL8922D, lt, 0, 35, 109, 1, SCAN_OFFLOAD_BE_V1),
 	__CFG_FW_FEAT(RTL8922D, lt, 0, 35, 113, 0, RFK_TXIQK_V0),
 	__CFG_FW_FEAT(RTL8922D, lt, 0, 35, 113, 2, SCAN_OFFLOAD_BE_V2),
+	__CFG_FW_FEAT(RTL8922D, ge, 0, 35, 119, 0, LPS_ML_INFO_V1_EXTRA),
 };
 
 static void rtw89_fw_iterate_feature_cfg(struct rtw89_fw_info *fw,
@@ -3486,26 +3487,59 @@ void rtw89_bb_lps_cmn_info_rx_gain_fill(struct rtw89_dev *rtwdev,
 	}
 }
 
+static void
+rtw89_fw_h2c_lps_ml_cmn_info_v1_extra_fill(struct rtw89_dev *rtwdev,
+					   struct rtw89_vif *rtwvif,
+					   struct rtw89_h2c_lps_ml_cmn_info_v1_extra *h2c)
+{
+	u8 regd = rtw89_regd_get(rtwdev, RTW89_BAND_2G);
+	struct ieee80211_bss_conf *bss_conf;
+	struct rtw89_vif_link *rtwvif_link;
+	unsigned int link_id;
+
+	static_assert(sizeof(*h2c) % 4 == 0);
+
+	h2c->regu_mode_on_24g = regd == RTW89_FCC ? RTW89_BB_REGULATION_FCC :
+						    RTW89_BB_REGULATION_CE;
+
+	rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) {
+		u8 phy_idx = rtwvif_link->phy_idx;
+
+		rcu_read_lock();
+		bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
+		h2c->bss_color[phy_idx] = bss_conf->he_bss_color.color;
+		rcu_read_unlock();
+	}
+}
+
 int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev *rtwdev,
 				    struct rtw89_vif *rtwvif)
 {
 	static const u8 bcn_bw_ofst[] = {0, 0, 0, 3, 6, 9, 0, 12};
+	struct rtw89_h2c_lps_ml_cmn_info_v1_extra *h2c_extra;
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	struct rtw89_efuse *efuse = &rtwdev->efuse;
 	struct rtw89_h2c_lps_ml_cmn_info_v1 *h2c;
 	struct rtw89_vif_link *rtwvif_link;
 	const struct rtw89_chan *chan;
 	struct rtw89_bb_ctx *bb;
-	u32 len = sizeof(*h2c);
 	unsigned int link_id;
 	struct sk_buff *skb;
 	u8 beacon_bw_ofst;
+	bool has_extra;
 	u32 done;
+	u32 len;
 	int ret;
 
 	if (chip->chip_gen != RTW89_CHIP_BE)
 		return 0;
 
+	has_extra = RTW89_CHK_FW_FEATURE(LPS_ML_INFO_V1_EXTRA, &rtwdev->fw);
+	if (has_extra)
+		len = sizeof(*h2c_extra);
+	else
+		len = sizeof(*h2c);
+
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c lps_ml_cmn_info_v1\n");
@@ -3514,7 +3548,13 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev *rtwdev,
 	skb_put(skb, len);
 	h2c = (struct rtw89_h2c_lps_ml_cmn_info_v1 *)skb->data;
 
-	h2c->fmt_id = 0x20;
+	if (has_extra) {
+		h2c_extra = container_of(h2c, typeof(*h2c_extra), v1);
+		h2c->fmt_id = RTW89_H2C_LPS_ML_CMN_INFO_FMT_ID_V1_EXTRA;
+		rtw89_fw_h2c_lps_ml_cmn_info_v1_extra_fill(rtwdev, rtwvif, h2c_extra);
+	} else {
+		h2c->fmt_id = RTW89_H2C_LPS_ML_CMN_INFO_FMT_ID_V1;
+	}
 
 	h2c->mlo_dbcc_mode = cpu_to_le32(rtwdev->mlo_dbcc_mode);
 	h2c->rfe_type = efuse->rfe_type;
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index 6cb1f6dfb650..d1bd82788376 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -2091,6 +2091,16 @@ struct rtw89_bb_link_info_rx_gain {
 	u8 wb_g_elna[RTW89_BB_PS_LINK_RX_GAIN_TAB_MAX][BB_GT2_G_ELNA_NUM];
 } __packed;
 
+enum rtw89_bb_regulation_mode {
+	RTW89_BB_REGULATION_FCC = 0,
+	RTW89_BB_REGULATION_CE = 1,
+};
+
+enum rtw89_h2c_lps_ml_cmn_info_fmt_id {
+	RTW89_H2C_LPS_ML_CMN_INFO_FMT_ID_V1 = 0x20,
+	RTW89_H2C_LPS_ML_CMN_INFO_FMT_ID_V1_EXTRA = 0x21,
+};
+
 struct rtw89_h2c_lps_ml_cmn_info_v1 {
 	u8 fmt_id;
 	u8 rfe_type;
@@ -2106,6 +2116,13 @@ struct rtw89_h2c_lps_ml_cmn_info_v1 {
 	struct rtw89_bb_link_info_rx_gain rx_gain[RTW89_BB_PS_LINK_BUF_MAX];
 } __packed;
 
+struct rtw89_h2c_lps_ml_cmn_info_v1_extra {
+	struct rtw89_h2c_lps_ml_cmn_info_v1 v1;
+	u8 regu_mode_on_24g;
+	u8 bss_color[RTW89_BB_PS_LINK_BUF_MAX];
+	u8 rsvd[2];
+} __packed;
+
 struct rtw89_h2c_phy_rfe_type {
 	u8 rfe_type;
 	u8 rsvd[3];
-- 
2.25.1

[PATCH rtw-next 10/15] wifi: rtw89: mac: change beamformee CSI direct forward to CMAC_TXDMA

[Ping-Ke Shih]

Set R_BE_RESP_MODE register when initializing beamformee to makes CSI
RX state machine enter initial state, and enables received beamformee CSI
to be directly forwarded to CMAC_TXDMA via hardware shortcut path.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/mac_be.c |  3 +++
 drivers/net/wireless/realtek/rtw89/reg.h    | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
index c8f343c8d545..fa35cafd7074 100644
--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
+++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
@@ -2786,6 +2786,9 @@ static int rtw89_mac_init_bfee_be(struct rtw89_dev *rtwdev, u8 mac_idx)
 				       B_BE_CSIPRT_HESU_AID_EN |
 				       B_BE_CSIPRT_EHTSU_AID_EN);
 
+	reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_MODE, mac_idx);
+	rtw89_write32_set(rtwdev, reg, B_BE_INIT_CLEAR_RX_STATE | B_BE_SHORT_CUT_MODE);
+
 	reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_TRXPTCL_RESP_CSI_RRSC, mac_idx);
 	rtw89_write32(rtwdev, reg, CSI_RRSC_BMAP_BE);
 
diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h
index 4291e8115f10..e85af8713777 100644
--- a/drivers/net/wireless/realtek/rtw89/reg.h
+++ b/drivers/net/wireless/realtek/rtw89/reg.h
@@ -8373,6 +8373,26 @@
 #define B_BE_CSI_RESERVED_PAGE_NUM_MASK GENMASK(27, 16)
 #define B_BE_CSI_RESERVED_START_PAGE_MASK GENMASK(11, 0)
 
+#define R_BE_RESP_MODE 0x11814
+#define R_BE_RESP_MODE_C1 0x15814
+#define B_BE_LMR_MASK_PRE_ENQ BIT(27)
+#define B_BE_LMR_INIT_CLEAR_RX_STATE BIT(26)
+#define B_BE_LMR_SHORT_CUT_MODE BIT(25)
+#define B_BE_LMR_IMMED_ENQ_MODE BIT(24)
+#define B_BE_CLEAR_SMR_SEG_TBL BIT(19)
+#define B_BE_CLEAR_FTM_SEG_TBL BIT(18)
+#define B_BE_CLEAR_CSI_SEG_TBL BIT(17)
+#define B_BE_CLEAR_CSI_RESP_TBL BIT(16)
+#define B_BE_SMR_MASK_PRE_ENQ BIT(12)
+#define B_BE_SMR_DELAY_IMMED_ENQ_MODE BIT(11)
+#define B_BE_SMR_INIT_CLEAR_RX_STATE BIT(10)
+#define B_BE_SMR_SHORT_CUT_MODE BIT(9)
+#define B_BE_SMR_IMMED_ENQ_MODE BIT(8)
+#define B_BE_CSI_MASK_PRE_ENQ BIT(3)
+#define B_BE_INIT_CLEAR_RX_STATE BIT(2)
+#define B_BE_SHORT_CUT_MODE BIT(1)
+#define B_BE_IMMED_ENQ_MODE BIT(0)
+
 #define R_BE_RESP_IMR1 0x11878
 #define R_BE_RESP_IMR1_C1 0x15878
 #define B_BE_RESP_IMR_1_MASK GENMASK(31, 9)
-- 
2.25.1

[PATCH rtw-next 11/15] wifi: rtw89: fw: extend ch_info format of hw_scan to v2

[Ping-Ke Shih]

The new format of ch_info is extended from 8 words to 9 words to have
additional control probe delay on 6GHz band, but not implement these
fields for now.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/core.h |  1 +
 drivers/net/wireless/realtek/rtw89/fw.c   | 27 +++++++++++++++++++----
 drivers/net/wireless/realtek/rtw89/fw.h   |  6 ++++-
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index e88942c469e4..3caef61b21d3 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -6011,6 +6011,7 @@ enum rtw89_fw_feature {
 	RTW89_FW_FEATURE_NO_WOW_CPU_IO_RX,
 	RTW89_FW_FEATURE_NOTIFY_AP_INFO,
 	RTW89_FW_FEATURE_CH_INFO_BE_V0,
+	RTW89_FW_FEATURE_CH_INFO_BE_V1,
 	RTW89_FW_FEATURE_LPS_CH_INFO,
 	RTW89_FW_FEATURE_NO_PHYCAP_P1,
 	RTW89_FW_FEATURE_NO_POWER_DIFFERENCE,
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 300686ed0f6e..9eaace2d57c4 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -967,6 +967,7 @@ static const struct __fw_feat_cfg fw_feat_tbl[] = {
 	__CFG_FW_FEAT(RTL8922A, ge, 0, 35, 108, 0, SIM_SER_L0L1_BY_HALT_H2C),
 	__CFG_FW_FEAT(RTL8922A, lt, 0, 35, 109, 1, SCAN_OFFLOAD_BE_V1),
 	__CFG_FW_FEAT(RTL8922A, lt, 0, 35, 113, 2, SCAN_OFFLOAD_BE_V2),
+	__CFG_FW_FEAT(RTL8922A, lt, 0, 35, 119, 0, CH_INFO_BE_V1),
 	__CFG_FW_FEAT(RTL8922D, ge, 0, 0, 0, 0, MACID_PAUSE_SLEEP),
 	__CFG_FW_FEAT(RTL8922D, ge, 0, 35, 75, 2, SCAN_OFFLOAD),
 	__CFG_FW_FEAT(RTL8922D, ge, 0, 35, 75, 2, BEACON_FILTER),
@@ -984,6 +985,7 @@ static const struct __fw_feat_cfg fw_feat_tbl[] = {
 	__CFG_FW_FEAT(RTL8922D, lt, 0, 35, 113, 0, RFK_TXIQK_V0),
 	__CFG_FW_FEAT(RTL8922D, lt, 0, 35, 113, 2, SCAN_OFFLOAD_BE_V2),
 	__CFG_FW_FEAT(RTL8922D, ge, 0, 35, 119, 0, LPS_ML_INFO_V1_EXTRA),
+	__CFG_FW_FEAT(RTL8922D, lt, 0, 35, 119, 0, CH_INFO_BE_V1),
 };
 
 static void rtw89_fw_iterate_feature_cfg(struct rtw89_fw_info *fw,
@@ -7615,24 +7617,34 @@ int rtw89_fw_h2c_scan_list_offload_be(struct rtw89_dev *rtwdev, int ch_num,
 	struct rtw89_h2c_chinfo_elem_be *elem;
 	struct rtw89_mac_chinfo_be *ch_info;
 	struct rtw89_h2c_chinfo_be *h2c;
+	u8 elem_size = sizeof(*elem);
 	bool wildcard_by_drv;
 	struct sk_buff *skb;
 	unsigned int cond;
 	u8 ver = U8_MAX;
+	int used_len;
 	int skb_len;
 	int ret;
 
 	static_assert(sizeof(*elem) == RTW89_MAC_CHINFO_SIZE_BE);
 
 	skb_len = struct_size(h2c, elem, ch_num);
+	used_len = skb_len;
 	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, skb_len);
 	if (!skb) {
 		rtw89_err(rtwdev, "failed to alloc skb for h2c scan list\n");
 		return -ENOMEM;
 	}
 
-	if (RTW89_CHK_FW_FEATURE(CH_INFO_BE_V0, &rtwdev->fw))
+	if (RTW89_CHK_FW_FEATURE(CH_INFO_BE_V0, &rtwdev->fw)) {
 		ver = 0;
+		elem_size = offsetofend(typeof(*elem), w7);
+		used_len = sizeof(*h2c) + elem_size * ch_num;
+	} else if (RTW89_CHK_FW_FEATURE(CH_INFO_BE_V1, &rtwdev->fw)) {
+		ver = 1;
+		elem_size = offsetofend(typeof(*elem), w7);
+		used_len = sizeof(*h2c) + elem_size * ch_num;
+	}
 
 	wildcard_by_drv = !(RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD_BE_V0, &rtwdev->fw) ||
 			    RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD_BE_V1, &rtwdev->fw) ||
@@ -7642,14 +7654,14 @@ int rtw89_fw_h2c_scan_list_offload_be(struct rtw89_dev *rtwdev, int ch_num,
 	h2c = (struct rtw89_h2c_chinfo_be *)skb->data;
 
 	h2c->ch_num = ch_num;
-	h2c->elem_size = sizeof(*elem) / 4; /* in unit of 4 bytes */
+	h2c->elem_size = elem_size / 4; /* in unit of 4 bytes */
 	h2c->arg = u8_encode_bits(rtwvif_link->mac_idx,
 				  RTW89_H2C_CHINFO_ARG_MAC_IDX_MASK);
 
 	list_for_each_entry(ch_info, chan_list, list) {
 		bool with_probe_id = ch_info->probe_id != RTW89_SCANOFLD_PKT_NONE;
 
-		elem = (struct rtw89_h2c_chinfo_elem_be *)skb_put(skb, sizeof(*elem));
+		elem = (struct rtw89_h2c_chinfo_elem_be *)skb_put(skb, elem_size);
 
 		elem->w0 = le32_encode_bits(ch_info->dwell_time, RTW89_H2C_CHINFO_BE_W0_DWELL) |
 			   le32_encode_bits(ch_info->central_ch,
@@ -7704,11 +7716,16 @@ int rtw89_fw_h2c_scan_list_offload_be(struct rtw89_dev *rtwdev, int ch_num,
 		else
 			elem->w7 = le32_encode_bits(ch_info->period,
 						    RTW89_H2C_CHINFO_BE_W7_PERIOD_V1);
+
+		if (ver < 2)
+			continue;
+
+		elem->w8 = 0;
 	}
 
 	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
 			      H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,
-			      H2C_FUNC_ADD_SCANOFLD_CH, 1, 1, skb_len);
+			      H2C_FUNC_ADD_SCANOFLD_CH, 1, 1, used_len);
 
 	cond = RTW89_SCANOFLD_WAIT_COND_ADD_CH;
 
@@ -7929,6 +7946,8 @@ int rtw89_fw_h2c_scan_offload_be(struct rtw89_dev *rtwdev,
 
 	if (RTW89_CHK_FW_FEATURE(CH_INFO_BE_V0, &rtwdev->fw))
 		ver = 0;
+	else if (RTW89_CHK_FW_FEATURE(CH_INFO_BE_V1, &rtwdev->fw))
+		ver = 1;
 
 	h2c->w0 = le32_encode_bits(option->operation, RTW89_H2C_SCANOFLD_BE_W0_OP) |
 		  le32_encode_bits(option->scan_mode,
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index d1bd82788376..d64435ffbf78 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -342,7 +342,7 @@ struct rtw89_fw_macid_pause_sleep_grp {
 #define RTW89_SCANOFLD_DEBUG_MASK 0x1F
 #define RTW89_CHAN_INVALID 0xFF
 #define RTW89_MAC_CHINFO_SIZE 28
-#define RTW89_MAC_CHINFO_SIZE_BE 32
+#define RTW89_MAC_CHINFO_SIZE_BE 36
 #define RTW89_SCAN_LIST_GUARD 4
 #define RTW89_SCAN_LIST_LIMIT(size) \
 		((RTW89_H2C_MAX_SIZE / (size)) - RTW89_SCAN_LIST_GUARD)
@@ -3009,6 +3009,7 @@ struct rtw89_h2c_chinfo_elem_be {
 	__le32 w5;
 	__le32 w6;
 	__le32 w7;
+	__le32 w8; /* after CH_INFO_BE_V1 */
 } __packed;
 
 #define RTW89_H2C_CHINFO_BE_W0_PERIOD GENMASK(7, 0)
@@ -3041,6 +3042,9 @@ struct rtw89_h2c_chinfo_elem_be {
 #define RTW89_H2C_CHINFO_BE_W6_FW_PROBE0_SHORTSSIDS GENMASK(15, 0)
 #define RTW89_H2C_CHINFO_BE_W6_FW_PROBE0_BSSIDS GENMASK(31, 16)
 #define RTW89_H2C_CHINFO_BE_W7_PERIOD_V1 GENMASK(15, 0)
+#define RTW89_H2C_CHINFO_BE_W7_SSIDS_IGN_DELAY_V2 GENMASK(31, 16)
+#define RTW89_H2C_CHINFO_BE_W8_SHORTSSIDS_IGN_DELAY_V2 GENMASK(15, 0)
+#define RTW89_H2C_CHINFO_BE_W8_BSSIDS_IGN_DELAY_V2 GENMASK(31, 16)
 
 struct rtw89_h2c_chinfo {
 	u8 ch_num;
-- 
2.25.1

[PATCH rtw-next 12/15] wifi: rtw89: 8922d: update BA cam format to G7

[Ping-Ke Shih]

From: Dian-Syuan Yang <dian_syuan0116@realtek.com>

Initially, Wi-Fi 7 chips utilized the V1 format, but the 8922DE
is expected to use the G7 format. This format differs from V1 into
that STD_ENTRY_EN, BAND_SEL, and MLD_EN are moved into W0, and MACID
is widened to 10-bit and relocated to W1.

Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/core.h     |  1 +
 drivers/net/wireless/realtek/rtw89/fw.c       | 80 +++++++++++++++++++
 drivers/net/wireless/realtek/rtw89/fw.h       | 21 +++++
 drivers/net/wireless/realtek/rtw89/mac.c      |  3 +-
 drivers/net/wireless/realtek/rtw89/rtw8922d.c |  4 +-
 5 files changed, 106 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index 3caef61b21d3..2e6d1be3a751 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -212,6 +212,7 @@ enum rtw89_cv {
 enum rtw89_bacam_ver {
 	RTW89_BACAM_V0,
 	RTW89_BACAM_V1,
+	RTW89_BACAM_G7,
 
 	RTW89_BACAM_V0_EXT = 99,
 };
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 9eaace2d57c4..63dd918b0989 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -2820,6 +2820,86 @@ int rtw89_fw_h2c_ba_cam_v1(struct rtw89_dev *rtwdev,
 }
 EXPORT_SYMBOL(rtw89_fw_h2c_ba_cam_v1);
 
+int rtw89_fw_h2c_ba_cam_g7(struct rtw89_dev *rtwdev,
+			   struct rtw89_vif_link *rtwvif_link,
+			   struct rtw89_sta_link *rtwsta_link,
+			   bool valid, struct ieee80211_ampdu_params *params)
+{
+	const struct rtw89_chip_info *chip = rtwdev->chip;
+	struct rtw89_h2c_ba_cam_g7 *h2c;
+	u16 macid = rtwsta_link->mac_id;
+	u32 len = sizeof(*h2c);
+	struct sk_buff *skb;
+	u8 entry_idx;
+	u8 bmap_size;
+	int ret;
+
+	ret = valid ?
+	      rtw89_core_acquire_sta_ba_entry(rtwdev, rtwsta_link, params->tid,
+					      &entry_idx) :
+	      rtw89_core_release_sta_ba_entry(rtwdev, rtwsta_link, params->tid,
+					      &entry_idx);
+	if (ret) {
+		/*
+		 * it still works even if we don't have static BA CAM, because
+		 * hardware can create dynamic BA CAM automatically.
+		 */
+		rtw89_debug(rtwdev, RTW89_DBG_TXRX,
+			    "failed to %s entry tid=%d for h2c ba cam\n",
+			    valid ? "alloc" : "free", params->tid);
+		return 0;
+	}
+
+	skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
+	if (!skb) {
+		rtw89_err(rtwdev, "failed to alloc skb for h2c ba cam\n");
+		return -ENOMEM;
+	}
+	skb_put(skb, len);
+	h2c = (struct rtw89_h2c_ba_cam_g7 *)skb->data;
+
+	if (params->buf_size > 512)
+		bmap_size = 10;
+	else if (params->buf_size > 256)
+		bmap_size = 8;
+	else if (params->buf_size > 64)
+		bmap_size = 4;
+	else
+		bmap_size = 0;
+
+	h2c->w0 = le32_encode_bits(valid, RTW89_H2C_BA_CAM_G7_W0_VALID) |
+		  le32_encode_bits(1, RTW89_H2C_BA_CAM_G7_W0_INIT_REQ) |
+		  le32_encode_bits(params->tid, RTW89_H2C_BA_CAM_G7_W0_TID_MASK) |
+		  le32_encode_bits(1, RTW89_H2C_BA_CAM_G7_W0_STD_ENTRY_EN) |
+		  le32_encode_bits(!!rtwvif_link->mac_idx,
+				   RTW89_H2C_BA_CAM_G7_W0_BAND_SEL) |
+		  le32_encode_bits(bmap_size, RTW89_H2C_BA_CAM_G7_W0_BMAP_SIZE_MASK) |
+		  le32_encode_bits(params->ssn, RTW89_H2C_BA_CAM_G7_W0_SSN_MASK);
+
+	entry_idx += chip->bacam_dynamic_num; /* std entry right after dynamic ones */
+	h2c->w1 = le32_encode_bits(macid, RTW89_H2C_BA_CAM_G7_W1_MACID_MASK) |
+		  le32_encode_bits(entry_idx, RTW89_H2C_BA_CAM_G7_W1_ENTRY_IDX_MASK);
+
+	rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
+			      H2C_CAT_MAC,
+			      H2C_CL_BA_CAM,
+			      H2C_FUNC_MAC_BA_CAM_V1, 0, 1,
+			      len);
+
+	ret = rtw89_h2c_tx(rtwdev, skb, false);
+	if (ret) {
+		rtw89_err(rtwdev, "failed to send h2c\n");
+		goto fail;
+	}
+
+	return 0;
+fail:
+	dev_kfree_skb_any(skb);
+
+	return ret;
+}
+EXPORT_SYMBOL(rtw89_fw_h2c_ba_cam_g7);
+
 int rtw89_fw_h2c_init_ba_cam_users(struct rtw89_dev *rtwdev, u8 users,
 				   u8 offset, u8 mac_idx)
 {
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index d64435ffbf78..a15a5967cabc 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -1956,6 +1956,23 @@ struct rtw89_h2c_ba_cam_v1 {
 #define RTW89_H2C_BA_CAM_V1_W1_MLD_EN BIT(10)
 #define RTW89_H2C_BA_CAM_V1_W1_ENTRY_IDX_MASK GENMASK(31, 24)
 
+struct rtw89_h2c_ba_cam_g7 {
+	__le32 w0;
+	__le32 w1;
+} __packed;
+
+#define RTW89_H2C_BA_CAM_G7_W0_VALID BIT(0)
+#define RTW89_H2C_BA_CAM_G7_W0_INIT_REQ	BIT(1)
+#define RTW89_H2C_BA_CAM_G7_W0_TID_MASK	GENMASK(7, 4)
+#define RTW89_H2C_BA_CAM_G7_W0_STD_ENTRY_EN BIT(8)
+#define RTW89_H2C_BA_CAM_G7_W0_BAND_SEL	BIT(9)
+#define RTW89_H2C_BA_CAM_G7_W0_MLD_EN BIT(10)
+#define RTW89_H2C_BA_CAM_G7_W0_BMAP_SIZE_MASK GENMASK(19, 16)
+#define RTW89_H2C_BA_CAM_G7_W0_SSN_MASK	GENMASK(31, 20)
+#define RTW89_H2C_BA_CAM_G7_W1_UID_VALUE_MASK GENMASK(7, 0)
+#define RTW89_H2C_BA_CAM_G7_W1_MACID_MASK GENMASK(17, 8)
+#define RTW89_H2C_BA_CAM_G7_W1_ENTRY_IDX_MASK GENMASK(31, 24)
+
 struct rtw89_h2c_ba_cam_init {
 	__le32 w0;
 } __packed;
@@ -5584,6 +5601,10 @@ int rtw89_fw_h2c_ba_cam_v1(struct rtw89_dev *rtwdev,
 			   struct rtw89_vif_link *rtwvif_link,
 			   struct rtw89_sta_link *rtwsta_link,
 			   bool valid, struct ieee80211_ampdu_params *params);
+int rtw89_fw_h2c_ba_cam_g7(struct rtw89_dev *rtwdev,
+			   struct rtw89_vif_link *rtwvif_link,
+			   struct rtw89_sta_link *rtwsta_link,
+			   bool valid, struct ieee80211_ampdu_params *params);
 void rtw89_fw_h2c_init_dynamic_ba_cam_v0_ext(struct rtw89_dev *rtwdev);
 int rtw89_fw_h2c_init_ba_cam_users(struct rtw89_dev *rtwdev, u8 users,
 				   u8 offset, u8 mac_idx);
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index df396fbfca26..093291e8854d 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -4087,7 +4087,8 @@ static int rtw89_mac_feat_init(struct rtw89_dev *rtwdev)
 	const struct rtw89_chip_info *chip = rtwdev->chip;
 	u8 users, offset;
 
-	if (chip->bacam_ver != RTW89_BACAM_V1)
+	if (!(chip->bacam_ver == RTW89_BACAM_V1 ||
+	      chip->bacam_ver == RTW89_BACAM_G7))
 		return 0;
 
 	offset = 0;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
index 89c1f58d0dc0..2325e646c487 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
@@ -3712,7 +3712,7 @@ static const struct rtw89_chip_ops rtw8922d_chip_ops = {
 	.h2c_punctured_cmac_tbl	= rtw89_fw_h2c_punctured_cmac_tbl_be,
 	.h2c_default_dmac_tbl	= rtw89_fw_h2c_default_dmac_tbl_v3,
 	.h2c_update_beacon	= rtw89_fw_h2c_update_beacon_be,
-	.h2c_ba_cam		= rtw89_fw_h2c_ba_cam_v1,
+	.h2c_ba_cam		= rtw89_fw_h2c_ba_cam_g7,
 	.h2c_wow_cam_update	= rtw89_fw_h2c_wow_cam_update_v1,
 
 	.btc_set_rfe		= rtw8922d_btc_set_rfe,
@@ -3807,7 +3807,7 @@ const struct rtw89_chip_info rtw8922d_chip_info = {
 	.scam_num		= 32,
 	.bacam_num		= 24,
 	.bacam_dynamic_num	= 8,
-	.bacam_ver		= RTW89_BACAM_V1,
+	.bacam_ver		= RTW89_BACAM_G7,
 	.addrcam_ver		= 1,
 	.ppdu_max_usr		= 16,
 	.sec_ctrl_efuse_size	= 4,
-- 
2.25.1

[PATCH rtw-next 13/15] wifi: rtw89: 8851b: rfk: set DCK start and delay time

[Ping-Ke Shih]

Modify the DCK delay time and add the TSSI TX start time to bring more
accurate TSSI detection, which helps thermal tracking to compensate output
power correctly.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/rtw8851b_rfk_table.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk_table.c b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk_table.c
index c5f70c045692..beae5749d07d 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk_table.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk_table.c
@@ -272,7 +272,8 @@ static const struct rtw89_reg5_def rtw8851b_tssi_dck_defs_a[] = {
 	RTW89_DECL_RFK_WM(0x5814, 0x00002000, 0x1),
 	RTW89_DECL_RFK_WM(0x5814, 0x00004000, 0x1),
 	RTW89_DECL_RFK_WM(0x5814, 0x00038000, 0x3),
-	RTW89_DECL_RFK_WM(0x5814, 0x003c0000, 0x5),
+	RTW89_DECL_RFK_WM(0x0620, 0x00003f00, 0x17),
+	RTW89_DECL_RFK_WM(0x5814, 0x003c0000, 0x7),
 	RTW89_DECL_RFK_WM(0x5814, 0x18000000, 0x0),
 };
 
-- 
2.25.1

[PATCH rtw-next 14/15] wifi: rtw89: 8852b: update default value for ANA SWR

[Ping-Ke Shih]

The RTL8852BE randomly card drops on certain platforms. Adjust ANA_SWR
behavior by compensation parameters to stabilize the switching regulator
output to prevent unwanted drop.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/reg.h      | 2 +-
 drivers/net/wireless/realtek/rtw89/rtw8852b.c | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h
index e85af8713777..11b30be8f880 100644
--- a/drivers/net/wireless/realtek/rtw89/reg.h
+++ b/drivers/net/wireless/realtek/rtw89/reg.h
@@ -265,7 +265,7 @@
 #define R_AX_SPSANA_ON_CTRL1 0x0224
 
 #define R_AX_SPS_ANA_ON_CTRL2 0x0228
-#define RTL8852B_RFE_05_SPS_ANA 0x4A82
+#define RTL8852B_DEFAULT_SPS_ANA 0x4F42
 
 #define R_AX_WLAN_XTAL_SI_CTRL 0x0270
 #define B_AX_WL_XTAL_SI_CMD_POLL BIT(31)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b.c b/drivers/net/wireless/realtek/rtw89/rtw8852b.c
index 356623341f65..c3c53a6b8119 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852b.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852b.c
@@ -355,10 +355,7 @@ static const u8 rtw89_btc_8852b_bt_rssi_thres[BTC_BT_RSSI_THMAX] = {50, 40, 30,
 
 static void rtw8852b_pwr_sps_ana(struct rtw89_dev *rtwdev)
 {
-	struct rtw89_efuse *efuse = &rtwdev->efuse;
-
-	if (efuse->rfe_type == 0x5)
-		rtw89_write16(rtwdev, R_AX_SPS_ANA_ON_CTRL2, RTL8852B_RFE_05_SPS_ANA);
+	rtw89_write16(rtwdev, R_AX_SPS_ANA_ON_CTRL2, RTL8852B_DEFAULT_SPS_ANA);
 }
 
 static void rtw8852b_pwr_sps_dig_off(struct rtw89_dev *rtwdev)
-- 
2.25.1

[PATCH rtw-next 15/15] wifi: rtw89: phy: correct PHY-1 EDCCA report register access

[Ping-Ke Shih]

From: Eric Huang <echuang@realtek.com>

RTL8922D fills the PHY-1 rpt_b entry with the address of rpt_a.

The report select of RTL8922A and RTL8922D has a per-PHY instance, but it
was written without the PHY index, so PHY-1 read its report registers
through the select of PHY-0. Write it with rtw89_phy_write32_idx() instead.

Signed-off-by: Eric Huang <echuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/phy.c      | 12 ++++++------
 drivers/net/wireless/realtek/rtw89/rtw8922d.c |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
index c33b888bc0e3..074865665b16 100644
--- a/drivers/net/wireless/realtek/rtw89/phy.c
+++ b/drivers/net/wireless/realtek/rtw89/phy.c
@@ -8712,8 +8712,8 @@ static void rtw89_phy_edcca_log(struct rtw89_dev *rtwdev, struct rtw89_bb_ctx *b
 	rtw89_phy_write32_mask(rtwdev, edcca_p_regs->rpt_sel,
 			       edcca_p_regs->rpt_sel_mask, 0);
 	if (rtwdev->chip->chip_id == RTL8922A || rtwdev->chip->chip_id == RTL8922D) {
-		rtw89_phy_write32_mask(rtwdev, edcca_regs->rpt_sel_be,
-				       edcca_regs->rpt_sel_be_mask, 0);
+		rtw89_phy_write32_idx(rtwdev, edcca_regs->rpt_sel_be,
+				      edcca_regs->rpt_sel_be_mask, 0, bb->phy_idx);
 		per20_bitmap = rtw89_phy_read32_mask(rtwdev, edcca_p_regs->rpt_a,
 						     MASKBYTE0);
 	}
@@ -8738,16 +8738,16 @@ static void rtw89_phy_edcca_log(struct rtw89_dev *rtwdev, struct rtw89_bb_ctx *b
 	pwdb_s40 = u32_get_bits(tmp, MASKBYTE2);
 
 	if (rtwdev->chip->chip_id == RTL8922A || rtwdev->chip->chip_id == RTL8922D) {
-		rtw89_phy_write32_mask(rtwdev, edcca_regs->rpt_sel_be,
-				       edcca_regs->rpt_sel_be_mask, 4);
+		rtw89_phy_write32_idx(rtwdev, edcca_regs->rpt_sel_be,
+				      edcca_regs->rpt_sel_be_mask, 4, bb->phy_idx);
 		tmp = rtw89_phy_read32(rtwdev, edcca_p_regs->rpt_b);
 		pwdb[0] = u32_get_bits(tmp, MASKBYTE3);
 		pwdb[1] = u32_get_bits(tmp, MASKBYTE2);
 		pwdb[2] = u32_get_bits(tmp, MASKBYTE1);
 		pwdb[3] = u32_get_bits(tmp, MASKBYTE0);
 
-		rtw89_phy_write32_mask(rtwdev, edcca_regs->rpt_sel_be,
-				       edcca_regs->rpt_sel_be_mask, 5);
+		rtw89_phy_write32_idx(rtwdev, edcca_regs->rpt_sel_be,
+				      edcca_regs->rpt_sel_be_mask, 5, bb->phy_idx);
 		tmp = rtw89_phy_read32(rtwdev, edcca_p_regs->rpt_b);
 		pwdb[4] = u32_get_bits(tmp, MASKBYTE3);
 		pwdb[5] = u32_get_bits(tmp, MASKBYTE2);
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
index 2325e646c487..41e2aa1c8f78 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
@@ -271,7 +271,7 @@ static const struct rtw89_edcca_regs rtw8922d_edcca_regs = {
 		.rpt_sel_mask		= B_EDCCA_RPT_SEL_BE4_MSK,
 	}, {
 		.rpt_a			= R_EDCCA_RPT_A_BE4_C1,
-		.rpt_b			= R_EDCCA_RPT_A_BE4_C1,
+		.rpt_b			= R_EDCCA_RPT_B_BE4_C1,
 		.rpt_sel		= R_EDCCA_RPT_SEL_BE4_C1,
 		.rpt_sel_mask		= B_EDCCA_RPT_SEL_BE4_MSK,
 	}},
-- 
2.25.1