[RFC PATCH v3 0/4] wifi: rtl8xxxu: implement AP mode for 8188EU

[RFC PATCH v3 0/4] wifi: rtl8xxxu: implement AP mode for 8188EU

[Georg Müller]

This series tries to implement AP mode for Realtek RTL8188EU chips.

This is not final. I still have issues connecting to the AP, searching for some
input on what may be the reason or how to further debug issues.

Patch 1 could be picked independently as it shouldn't change anything for the
non-AP mode.

---
Changes in v3:
- fix compile errors caused by testing on machine with older kernel
Changes in v2:
- add patch to move dynamic_tx_rpt_timing_counter from ra_info to priv
- convert ra_info to a dynamic array
- update max report mac id after station add/remove

---
Georg Müller (4):
  wifi: rtl8xxxu: move dynamic_tx_rpt_timing_counter from ra_info to
    priv
  wifi: rtl8xxxu: handle rate control for 8188e a per mac_id
  wifi: rtl8xxxu: update max report mac id on station add / remove for
    8188e chips
  wifi: rtl8xxxu: Enable AP mode for RTL8188EU

 drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 22 +++++-----
 drivers/net/wireless/realtek/rtl8xxxu/core.c  | 41 ++++++++++++++++---
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h  |  5 ++-
 3 files changed, 50 insertions(+), 18 deletions(-)

-- 
2.53.0

[RFC PATCH v3 1/4] wifi: rtl8xxxu: move dynamic_tx_rpt_timing_counter from ra_info to priv

[Georg Müller]

dynamic_tx_rpt_timing_counter is not per mac_id, but used across all
mac_ids.
---
 drivers/net/wireless/realtek/rtl8xxxu/8188e.c    | 8 ++++----
 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
index 766a7a7c7d28..de2837a91bbe 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
@@ -1550,14 +1550,14 @@ static void rtl8188e_rate_decision(struct rtl8xxxu_ra_info *ra)
 	}
 
 	if (ra->decision_rate == ra->pre_rate)
-		ra->dynamic_tx_rpt_timing_counter++;
+		priv->dynamic_tx_rpt_timing_counter++;
 	else
-		ra->dynamic_tx_rpt_timing_counter = 0;
+		priv->dynamic_tx_rpt_timing_counter = 0;
 
-	if (ra->dynamic_tx_rpt_timing_counter >= 4) {
+	if (priv->dynamic_tx_rpt_timing_counter >= 4) {
 		/* Rate didn't change 4 times, extend RPT timing */
 		rtl8188e_set_tx_rpt_timing(ra, INCREASE_TIMING);
-		ra->dynamic_tx_rpt_timing_counter = 0;
+		priv->dynamic_tx_rpt_timing_counter = 0;
 	}
 
 	ra->pre_rate = ra->decision_rate;
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index 9fb2583ffffc..4a744b5c1aec 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -1756,7 +1756,6 @@ struct rtl8xxxu_ra_info {
 	u16 drop;
 	u16 rpt_time;
 	u16 pre_min_rpt_time;
-	u8 dynamic_tx_rpt_timing_counter;
 	u8 ra_waiting_counter;
 	u8 ra_pending_counter;
 	u8 ra_drop_after_down;
@@ -1917,6 +1916,7 @@ struct rtl8xxxu_priv {
 	struct rtl8xxxu_ra_report ra_report;
 	struct rtl8xxxu_cfo_tracking cfo_tracking;
 	struct rtl8xxxu_ra_info ra_info;
+	u8 dynamic_tx_rpt_timing_counter; // 8188e specific
 
 	bool led_registered;
 	char led_name[32];
-- 
2.53.0

[RFC PATCH v3 2/4] wifi: rtl8xxxu: handle rate control for 8188e a per mac_id

[Georg Müller]

convert member ra_info to an array with one entry per mac id. This
allows having different rate control settings per connected station
in ap mode.

The max_macid_num is conservative. The old driver used 32 [1], some
other sources said 64 [2]. I have not enough adapters to test any of the
higher values. Given the usage of this chipset in nano dongles, I think
the 16 might be high enough.

[1] https://github.com/lwfinger/rtl8188eu/blob/f5d1c8df2e2d8b217ea0113bf2cf3e37df8cb716/include/sta_info.h#L28
[2] https://lore.kernel.org/linux-wireless/27e83382-4c84-1841-c428-d1e5143ea20c@gmail.com/

Signed-off-by: Georg Müller <georgmueller@gmx.net>
---
 drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 12 ++++++------
 drivers/net/wireless/realtek/rtl8xxxu/core.c  | 19 ++++++++++++++-----
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h  |  3 ++-
 3 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
index de2837a91bbe..607ca62194fc 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
@@ -1468,9 +1468,8 @@ static void rtl8188e_reset_ra_counter(struct rtl8xxxu_ra_info *ra)
 	ra->nsc_down = (n_threshold_high[rate_id] + n_threshold_low[rate_id]) >> 1;
 }
 
-static void rtl8188e_rate_decision(struct rtl8xxxu_ra_info *ra)
+static void rtl8188e_rate_decision(struct rtl8xxxu_priv *priv, struct rtl8xxxu_ra_info *ra)
 {
-	struct rtl8xxxu_priv *priv = container_of(ra, struct rtl8xxxu_priv, ra_info);
 	const u8 *retry_penalty_idx_0;
 	const u8 *retry_penalty_idx_1;
 	const u8 *retry_penalty_up_idx;
@@ -1669,7 +1668,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv *priv, struct sk_buff *s
 	u32 *_rx_desc = (u32 *)(skb->data - sizeof(struct rtl8xxxu_rxdesc16));
 	struct rtl8xxxu_rxdesc16 *rx_desc = (struct rtl8xxxu_rxdesc16 *)_rx_desc;
 	struct device *dev = &priv->udev->dev;
-	struct rtl8xxxu_ra_info *ra = &priv->ra_info;
+	struct rtl8xxxu_ra_info *ra;
 	u32 tx_rpt_len = rx_desc->pktlen & 0x3ff;
 	u32 items = tx_rpt_len / TX_RPT2_ITEM_SIZE;
 	u64 macid_valid = ((u64)_rx_desc[5] << 32) | _rx_desc[4];
@@ -1688,6 +1687,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv *priv, struct sk_buff *s
 
 	for (macid = 0; macid < items; macid++) {
 		valid = false;
+		ra = &priv->ra_info[macid];
 
 		if (macid < 64)
 			valid = macid_valid & BIT(macid);
@@ -1704,7 +1704,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv *priv, struct sk_buff *s
 
 			if (ra->total > 0) {
 				if (ra->ra_stage < 5)
-					rtl8188e_rate_decision(ra);
+					rtl8188e_rate_decision(priv, ra);
 				else if (ra->ra_stage == 5)
 					rtl8188e_power_training_try_state(ra);
 				else /* ra->ra_stage == 6 */
@@ -1781,7 +1781,7 @@ rtl8188e_update_rate_mask(struct rtl8xxxu_priv *priv,
 			  u32 ramask, u8 rateid, int sgi, int txbw_40mhz,
 			  u8 macid)
 {
-	struct rtl8xxxu_ra_info *ra = &priv->ra_info;
+	struct rtl8xxxu_ra_info *ra = &priv->ra_info[macid];
 
 	ra->rate_id = rateid;
 	ra->rate_mask = ramask;
@@ -1792,7 +1792,7 @@ rtl8188e_update_rate_mask(struct rtl8xxxu_priv *priv,
 
 static void rtl8188e_ra_set_rssi(struct rtl8xxxu_priv *priv, u8 macid, u8 rssi)
 {
-	priv->ra_info.rssi_sta_ra = rssi;
+	priv->ra_info[macid].rssi_sta_ra = rssi;
 }
 
 void rtl8188e_ra_info_init_all(struct rtl8xxxu_ra_info *ra)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wireless/realtek/rtl8xxxu/core.c
index 794187d28caa..5ad23c5c9305 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
@@ -3921,6 +3921,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
 	struct device *dev = &priv->udev->dev;
 	struct rtl8xxxu_fileops *fops = priv->fops;
 	bool macpower;
+	u16 mac_id;
 	int ret;
 	u8 val8;
 	u16 val16;
@@ -4393,9 +4394,16 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
 		priv->cfo_tracking.crystal_cap = priv->default_crystal_cap;
 	}
 
-	if (priv->rtl_chip == RTL8188E)
-		rtl8188e_ra_info_init_all(&priv->ra_info);
-
+	if (priv->rtl_chip == RTL8188E)	{
+		priv->ra_info = kmalloc_array(RTL8188E_MAX_MAC_ID_NUM, sizeof(*priv->ra_info), GFP_KERNEL);
+		if (!priv->ra_info) {
+			ret = -ENOMEM;
+			goto exit;
+		}
+		for (mac_id = 0; mac_id < RTL8188E_MAX_MAC_ID_NUM; mac_id++) {
+			rtl8188e_ra_info_init_all(&priv->ra_info[mac_id]);
+		}
+	}
 	set_bit(RTL8XXXU_BC_MC_MACID, priv->mac_id_map);
 	set_bit(RTL8XXXU_BC_MC_MACID1, priv->mac_id_map);
 
@@ -5338,7 +5346,7 @@ rtl8xxxu_fill_txdesc_v3(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
 {
 	struct rtl8xxxu_priv *priv = hw->priv;
 	struct device *dev = &priv->udev->dev;
-	struct rtl8xxxu_ra_info *ra = &priv->ra_info;
+	struct rtl8xxxu_ra_info *ra = &priv->ra_info[macid];
 	u8 *qc = ieee80211_get_qos_ctl(hdr);
 	u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
 	u32 rate = 0;
@@ -7895,6 +7903,7 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
 err_set_intfdata:
 	usb_set_intfdata(interface, NULL);
 
+	kfree(priv->ra_info);
 	kfree(priv->fw_data);
 	mutex_destroy(&priv->usb_buf_mutex);
 	mutex_destroy(&priv->syson_indirect_access_mutex);
@@ -7924,7 +7933,7 @@ static void rtl8xxxu_disconnect(struct usb_interface *interface)
 	usb_set_intfdata(interface, NULL);
 
 	dev_info(&priv->udev->dev, "disconnecting\n");
-
+	kfree(priv->ra_info);
 	kfree(priv->fw_data);
 	mutex_destroy(&priv->usb_buf_mutex);
 	mutex_destroy(&priv->syson_indirect_access_mutex);
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index 4a744b5c1aec..9ce820ff4793 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -76,6 +76,7 @@
 #define RTL_FW_PAGE_SIZE		4096
 #define RTL8XXXU_FIRMWARE_POLL_MAX	1000
 
+#define RTL8188E_MAX_MAC_ID_NUM		16
 #define RTL8723A_CHANNEL_GROUPS		3
 #define RTL8723A_MAX_RF_PATHS		2
 #define RTL8723B_CHANNEL_GROUPS		6
@@ -1915,7 +1916,7 @@ struct rtl8xxxu_priv {
 	struct rtl8xxxu_btcoex bt_coex;
 	struct rtl8xxxu_ra_report ra_report;
 	struct rtl8xxxu_cfo_tracking cfo_tracking;
-	struct rtl8xxxu_ra_info ra_info;
+	struct rtl8xxxu_ra_info *ra_info;
 	u8 dynamic_tx_rpt_timing_counter; // 8188e specific
 
 	bool led_registered;
-- 
2.53.0

[RFC PATCH v3 3/4] wifi: rtl8xxxu: update max report mac id on station add / remove for 8188e chips

[Georg Müller]

---
 drivers/net/wireless/realtek/rtl8xxxu/core.c | 23 +++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wireless/realtek/rtl8xxxu/core.c
index 5ad23c5c9305..15fc4843edb2 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
@@ -3884,6 +3884,15 @@ void rtl8xxxu_init_burst(struct rtl8xxxu_priv *priv)
 	rtl8xxxu_write8(priv, REG_RSV_CTRL, val8);
 }
 
+static u8 rtl8xxxu_max_acquired_macid(struct rtl8xxxu_priv *priv)
+{
+	u8 macid;
+
+	macid = find_last_bit(priv->mac_id_map, RTL8XXXU_MAX_MAC_ID_NUM);
+
+	return macid;
+}
+
 static u8 rtl8xxxu_acquire_macid(struct rtl8xxxu_priv *priv)
 {
 	u8 macid;
@@ -7499,6 +7508,7 @@ static int rtl8xxxu_sta_add(struct ieee80211_hw *hw,
 	struct rtl8xxxu_sta_info *sta_info = (struct rtl8xxxu_sta_info *)sta->drv_priv;
 	struct rtl8xxxu_vif *rtlvif = (struct rtl8xxxu_vif *)vif->drv_priv;
 	struct rtl8xxxu_priv *priv = hw->priv;
+	u8 max_mac_id;
 
 	mutex_lock(&priv->sta_mutex);
 	ewma_rssi_init(&sta_info->avg_rssi);
@@ -7510,6 +7520,11 @@ static int rtl8xxxu_sta_add(struct ieee80211_hw *hw,
 			return -ENOSPC;
 		}
 
+		if (priv->rtl_chip == RTL8188E) {
+			max_mac_id = rtl8xxxu_max_acquired_macid(priv);
+			rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL + 1, max_mac_id + 1);
+		}
+
 		rtl8xxxu_refresh_rate_mask(priv, 0, sta, true);
 		priv->fops->report_connect(priv, sta_info->macid, H2C_MACID_ROLE_STA, true);
 	} else {
@@ -7535,10 +7550,16 @@ static int rtl8xxxu_sta_remove(struct ieee80211_hw *hw,
 {
 	struct rtl8xxxu_sta_info *sta_info = (struct rtl8xxxu_sta_info *)sta->drv_priv;
 	struct rtl8xxxu_priv *priv = hw->priv;
+	u8 max_mac_id;
 
 	mutex_lock(&priv->sta_mutex);
-	if (vif->type == NL80211_IFTYPE_AP)
+	if (vif->type == NL80211_IFTYPE_AP) {
 		rtl8xxxu_release_macid(priv, sta_info->macid);
+		if (priv->rtl_chip == RTL8188E) {
+			max_mac_id = rtl8xxxu_max_acquired_macid(priv);
+			rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL + 1, max_mac_id + 1);
+		}
+	}
 	mutex_unlock(&priv->sta_mutex);
 
 	return 0;
-- 
2.53.0

[RFC PATCH v3 4/4] wifi: rtl8xxxu: Enable AP mode for RTL8188EU

[Georg Müller]

Allow devices with this driver to be used as a wireless access point.

Signed-off-by: Georg Müller <georgmueller@gmx.net>
---
 drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
index 607ca62194fc..67fd77944d67 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
@@ -1867,6 +1867,8 @@ struct rtl8xxxu_fileops rtl8188eu_fops = {
 	.init_reg_pkt_life_time = 1,
 	.gen2_thermal_meter = 1,
 	.max_sec_cam_num = 32,
+	.supports_ap = 1,
+	.max_macid_num = RTL8188E_MAX_MAC_ID_NUM,
 	.adda_1t_init = 0x0b1b25a0,
 	.adda_1t_path_on = 0x0bdb25a0,
 	/*
-- 
2.53.0

Re: [RFC PATCH v3 0/4] wifi: rtl8xxxu: implement AP mode for 8188EU

[Bitterblue Smith]

On 13/03/2026 15:53, Georg Müller wrote:
> This series tries to implement AP mode for Realtek RTL8188EU chips.
> 
> This is not final. I still have issues connecting to the AP, searching for some
> input on what may be the reason or how to further debug issues.
> 

What are the issues? Were they happening with your original patch
which only added supports_ap and max_macid_num?

Another thing still missing is the macid in the TX descriptor
(rtl8xxxu_fill_txdesc_v3).

> Patch 1 could be picked independently as it shouldn't change anything for the
> non-AP mode.
> 
> ---
> Changes in v3:
> - fix compile errors caused by testing on machine with older kernel
> Changes in v2:
> - add patch to move dynamic_tx_rpt_timing_counter from ra_info to priv
> - convert ra_info to a dynamic array
> - update max report mac id after station add/remove
> 
> ---
> Georg Müller (4):
>   wifi: rtl8xxxu: move dynamic_tx_rpt_timing_counter from ra_info to
>     priv
>   wifi: rtl8xxxu: handle rate control for 8188e a per mac_id
>   wifi: rtl8xxxu: update max report mac id on station add / remove for
>     8188e chips
>   wifi: rtl8xxxu: Enable AP mode for RTL8188EU
> 
>  drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 22 +++++-----
>  drivers/net/wireless/realtek/rtl8xxxu/core.c  | 41 ++++++++++++++++---
>  .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h  |  5 ++-
>  3 files changed, 50 insertions(+), 18 deletions(-)
> 

RE: [RFC PATCH v3 1/4] wifi: rtl8xxxu: move dynamic_tx_rpt_timing_counter from ra_info to priv

[Ping-Ke Shih]

Georg Müller <georgmueller@gmx.net> wrote:
> dynamic_tx_rpt_timing_counter is not per mac_id, but used across all
> mac_ids.

I don't know the purpose of dynamic_tx_rpt_timing_counter. Could you
share your study?

Ping-Ke

RE: [RFC PATCH v3 2/4] wifi: rtl8xxxu: handle rate control for 8188e a per mac_id

[Ping-Ke Shih]

Georg Müller <georgmueller@gmx.net> wrote:
> convert member ra_info to an array with one entry per mac id. This
> allows having different rate control settings per connected station
> in ap mode.
> 
> The max_macid_num is conservative. The old driver used 32 [1], some
> other sources said 64 [2]. I have not enough adapters to test any of the
> higher values. Given the usage of this chipset in nano dongles, I think
> the 16 might be high enough.
> 
> [1]
> https://github.com/lwfinger/rtl8188eu/blob/f5d1c8df2e2d8b217ea0113bf2cf3e37d
> f8cb716/include/sta_info.h#L28
> [2]
> https://lore.kernel.org/linux-wireless/27e83382-4c84-1841-c428-d1e5143ea20c@
> gmail.com/
> 
> Signed-off-by: Georg Müller <georgmueller@gmx.net>
> ---
>  drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 12 ++++++------
>  drivers/net/wireless/realtek/rtl8xxxu/core.c  | 19 ++++++++++++++-----
>  .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h  |  3 ++-
>  3 files changed, 22 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
> b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
> index de2837a91bbe..607ca62194fc 100644
> --- a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
> +++ b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
> @@ -1468,9 +1468,8 @@ static void rtl8188e_reset_ra_counter(struct
> rtl8xxxu_ra_info *ra)
>         ra->nsc_down = (n_threshold_high[rate_id] + n_threshold_low[rate_id])
> >> 1;
>  }
> 
> -static void rtl8188e_rate_decision(struct rtl8xxxu_ra_info *ra)
> +static void rtl8188e_rate_decision(struct rtl8xxxu_priv *priv, struct
> rtl8xxxu_ra_info *ra)
>  {
> -       struct rtl8xxxu_priv *priv = container_of(ra, struct rtl8xxxu_priv,
> ra_info);
>         const u8 *retry_penalty_idx_0;
>         const u8 *retry_penalty_idx_1;
>         const u8 *retry_penalty_up_idx;
> @@ -1669,7 +1668,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv
> *priv, struct sk_buff *s
>         u32 *_rx_desc = (u32 *)(skb->data - sizeof(struct rtl8xxxu_rxdesc16));
>         struct rtl8xxxu_rxdesc16 *rx_desc = (struct rtl8xxxu_rxdesc16
> *)_rx_desc;
>         struct device *dev = &priv->udev->dev;
> -       struct rtl8xxxu_ra_info *ra = &priv->ra_info;
> +       struct rtl8xxxu_ra_info *ra;
>         u32 tx_rpt_len = rx_desc->pktlen & 0x3ff;
>         u32 items = tx_rpt_len / TX_RPT2_ITEM_SIZE;

The 'items' should be smaller or equal to RTL8188E_MAX_MAC_ID_NUM.

>         u64 macid_valid = ((u64)_rx_desc[5] << 32) | _rx_desc[4];
> @@ -1688,6 +1687,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv
> *priv, struct sk_buff *s
> 
>         for (macid = 0; macid < items; macid++) {
>                 valid = false;
> +               ra = &priv->ra_info[macid];
> 
>                 if (macid < 64)
>                         valid = macid_valid & BIT(macid);
> @@ -1704,7 +1704,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv
> *priv, struct sk_buff *s
> 
>                         if (ra->total > 0) {
>                                 if (ra->ra_stage < 5)
> -                                       rtl8188e_rate_decision(ra);
> +                                       rtl8188e_rate_decision(priv, ra);
>                                 else if (ra->ra_stage == 5)
> 
> rtl8188e_power_training_try_state(ra);
>                                 else /* ra->ra_stage == 6 */
> @@ -1781,7 +1781,7 @@ rtl8188e_update_rate_mask(struct rtl8xxxu_priv *priv,
>                           u32 ramask, u8 rateid, int sgi, int txbw_40mhz,
>                           u8 macid)
>  {
> -       struct rtl8xxxu_ra_info *ra = &priv->ra_info;
> +       struct rtl8xxxu_ra_info *ra = &priv->ra_info[macid];
> 
>         ra->rate_id = rateid;
>         ra->rate_mask = ramask;
> @@ -1792,7 +1792,7 @@ rtl8188e_update_rate_mask(struct rtl8xxxu_priv *priv,
> 
>  static void rtl8188e_ra_set_rssi(struct rtl8xxxu_priv *priv, u8 macid, u8 rssi)
>  {
> -       priv->ra_info.rssi_sta_ra = rssi;
> +       priv->ra_info[macid].rssi_sta_ra = rssi;
>  }
> 
>  void rtl8188e_ra_info_init_all(struct rtl8xxxu_ra_info *ra)
> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c
> b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> index 794187d28caa..5ad23c5c9305 100644
> --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
> +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> @@ -3921,6 +3921,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
>         struct device *dev = &priv->udev->dev;
>         struct rtl8xxxu_fileops *fops = priv->fops;
>         bool macpower;
> +       u16 mac_id;
>         int ret;
>         u8 val8;
>         u16 val16;
> @@ -4393,9 +4394,16 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
>                 priv->cfo_tracking.crystal_cap = priv->default_crystal_cap;
>         }
> 
> -       if (priv->rtl_chip == RTL8188E)
> -               rtl8188e_ra_info_init_all(&priv->ra_info);
> -
> +       if (priv->rtl_chip == RTL8188E) {
> +               priv->ra_info = kmalloc_array(RTL8188E_MAX_MAC_ID_NUM,
> sizeof(*priv->ra_info), GFP_KERNEL);

How about devm_ series? Then, no need to free on error path or disconnection.

> +               if (!priv->ra_info) {
> +                       ret = -ENOMEM;
> +                       goto exit;
> +               }
> +               for (mac_id = 0; mac_id < RTL8188E_MAX_MAC_ID_NUM; mac_id++) {
> +                       rtl8188e_ra_info_init_all(&priv->ra_info[mac_id]);
> +               }

no need brace for single line statement. 

> +       }
>         set_bit(RTL8XXXU_BC_MC_MACID, priv->mac_id_map);
>         set_bit(RTL8XXXU_BC_MC_MACID1, priv->mac_id_map);
> 
> @@ -5338,7 +5346,7 @@ rtl8xxxu_fill_txdesc_v3(struct ieee80211_hw *hw, struct
> ieee80211_hdr *hdr,
>  {
>         struct rtl8xxxu_priv *priv = hw->priv;
>         struct device *dev = &priv->udev->dev;
> -       struct rtl8xxxu_ra_info *ra = &priv->ra_info;
> +       struct rtl8xxxu_ra_info *ra = &priv->ra_info[macid];
>         u8 *qc = ieee80211_get_qos_ctl(hdr);
>         u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
>         u32 rate = 0;
> @@ -7895,6 +7903,7 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
>  err_set_intfdata:
>         usb_set_intfdata(interface, NULL);
> 
> +       kfree(priv->ra_info);
>         kfree(priv->fw_data);
>         mutex_destroy(&priv->usb_buf_mutex);
>         mutex_destroy(&priv->syson_indirect_access_mutex);
> @@ -7924,7 +7933,7 @@ static void rtl8xxxu_disconnect(struct usb_interface
> *interface)
>         usb_set_intfdata(interface, NULL);
> 
>         dev_info(&priv->udev->dev, "disconnecting\n");
> -
> +       kfree(priv->ra_info);
>         kfree(priv->fw_data);
>         mutex_destroy(&priv->usb_buf_mutex);
>         mutex_destroy(&priv->syson_indirect_access_mutex);
> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> index 4a744b5c1aec..9ce820ff4793 100644
> --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> @@ -76,6 +76,7 @@
>  #define RTL_FW_PAGE_SIZE               4096
>  #define RTL8XXXU_FIRMWARE_POLL_MAX     1000
> 
> +#define RTL8188E_MAX_MAC_ID_NUM                16
>  #define RTL8723A_CHANNEL_GROUPS                3
>  #define RTL8723A_MAX_RF_PATHS          2
>  #define RTL8723B_CHANNEL_GROUPS                6
> @@ -1915,7 +1916,7 @@ struct rtl8xxxu_priv {
>         struct rtl8xxxu_btcoex bt_coex;
>         struct rtl8xxxu_ra_report ra_report;
>         struct rtl8xxxu_cfo_tracking cfo_tracking;
> -       struct rtl8xxxu_ra_info ra_info;
> +       struct rtl8xxxu_ra_info *ra_info;

It looks like this is also 8188e specific. Could you add comment by the way?
(but please /**/ style)

>         u8 dynamic_tx_rpt_timing_counter; // 8188e specific
> 
>         bool led_registered;
> --
> 2.53.0
> 

RE: [RFC PATCH v3 3/4] wifi: rtl8xxxu: update max report mac id on station add / remove for 8188e chips

[Ping-Ke Shih]

Georg Müller <georgmueller@gmx.net> wrote:

remember to add commit messages when you send formal patch.

> 
> ---
>  drivers/net/wireless/realtek/rtl8xxxu/core.c | 23 +++++++++++++++++++-
>  1 file changed, 22 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c
> b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> index 5ad23c5c9305..15fc4843edb2 100644
> --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
> +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> @@ -3884,6 +3884,15 @@ void rtl8xxxu_init_burst(struct rtl8xxxu_priv *priv)
>         rtl8xxxu_write8(priv, REG_RSV_CTRL, val8);
>  }
> 
> +static u8 rtl8xxxu_max_acquired_macid(struct rtl8xxxu_priv *priv)
> +{
> +       u8 macid;
> +
> +       macid = find_last_bit(priv->mac_id_map, RTL8XXXU_MAX_MAC_ID_NUM);
> +
> +       return macid;
> +}
> +
>  static u8 rtl8xxxu_acquire_macid(struct rtl8xxxu_priv *priv)
>  {
>         u8 macid;
> @@ -7499,6 +7508,7 @@ static int rtl8xxxu_sta_add(struct ieee80211_hw *hw,
>         struct rtl8xxxu_sta_info *sta_info = (struct rtl8xxxu_sta_info
> *)sta->drv_priv;
>         struct rtl8xxxu_vif *rtlvif = (struct rtl8xxxu_vif *)vif->drv_priv;
>         struct rtl8xxxu_priv *priv = hw->priv;
> +       u8 max_mac_id;
> 
>         mutex_lock(&priv->sta_mutex);
>         ewma_rssi_init(&sta_info->avg_rssi);
> @@ -7510,6 +7520,11 @@ static int rtl8xxxu_sta_add(struct ieee80211_hw *hw,
>                         return -ENOSPC;
>                 }
> 
> +               if (priv->rtl_chip == RTL8188E) {
> +                       max_mac_id = rtl8xxxu_max_acquired_macid(priv);
> +                       rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL + 1,
> max_mac_id + 1);
> +               }
> +
>                 rtl8xxxu_refresh_rate_mask(priv, 0, sta, true);
>                 priv->fops->report_connect(priv, sta_info->macid,
> H2C_MACID_ROLE_STA, true);
>         } else {
> @@ -7535,10 +7550,16 @@ static int rtl8xxxu_sta_remove(struct ieee80211_hw *hw,
>  {
>         struct rtl8xxxu_sta_info *sta_info = (struct rtl8xxxu_sta_info
> *)sta->drv_priv;
>         struct rtl8xxxu_priv *priv = hw->priv;
> +       u8 max_mac_id;
> 
>         mutex_lock(&priv->sta_mutex);
> -       if (vif->type == NL80211_IFTYPE_AP)
> +       if (vif->type == NL80211_IFTYPE_AP) {
>                 rtl8xxxu_release_macid(priv, sta_info->macid);
> +               if (priv->rtl_chip == RTL8188E) {
> +                       max_mac_id = rtl8xxxu_max_acquired_macid(priv);
> +                       rtl8xxxu_write8(priv, REG_TX_REPORT_CTRL + 1,
> max_mac_id + 1);
> +               }
> +       }

At first glance, I'd say should we consider STA+AP concurrent case? 
Because days ago, we talked about that in another thread. 

It looks like MAC ID is another problem for concurrent case, because
rtl8xxxu_max_acquired_macid() returns MAC ID starting from 0.

But special MAC IDs are defined for non-AP vif:

#define RTL8XXXU_BC_MC_MACID	0
#define RTL8XXXU_BC_MC_MACID1	1

(But this is not scope of this patch.)

>         mutex_unlock(&priv->sta_mutex);
> 
>         return 0;
> --
> 2.53.0
> 

Re: [RFC PATCH v3 1/4] wifi: rtl8xxxu: move dynamic_tx_rpt_timing_counter from ra_info to priv

[Georg Müller]

Am 16.03.26 um 07:17 schrieb Ping-Ke Shih:
> 
> Georg Müller <georgmueller@gmx.net> wrote:
>> dynamic_tx_rpt_timing_counter is not per mac_id, but used across all
>> mac_ids.
> 
> I don't know the purpose of dynamic_tx_rpt_timing_counter. Could you
> share your study?
> 
It is used globally (not per mac) like this in the vendor driver as well [1][2].
Bitterblue Smith gave the hint that this should not be per macid [3], so it should move
out of struct ra_info.

[1] https://github.com/lwfinger/rtl8188eu/blob/master/hal/Hal8188ERateAdaptive.c#L248
[2] https://github.com/lwfinger/rtl8188eu/blob/v5.2.2.4/hal8188erateadaptive.c#L285
[3] https://lore.kernel.org/linux-wireless/938ae608-a865-4056-06de-c230d74e1847@gmail.com/

Re: [RFC PATCH v3 2/4] wifi: rtl8xxxu: handle rate control for 8188e a per mac_id

[Georg Müller]

Am 16.03.26 um 07:35 schrieb Ping-Ke Shih:
> Georg Müller <georgmueller@gmx.net> wrote:
>> convert member ra_info to an array with one entry per mac id. This
>> allows having different rate control settings per connected station
>> in ap mode.
>>
>> The max_macid_num is conservative. The old driver used 32 [1], some
>> other sources said 64 [2]. I have not enough adapters to test any of the
>> higher values. Given the usage of this chipset in nano dongles, I think
>> the 16 might be high enough.
>>
>> [1]
>> https://github.com/lwfinger/rtl8188eu/blob/f5d1c8df2e2d8b217ea0113bf2cf3e37d
>> f8cb716/include/sta_info.h#L28
>> [2]
>> https://lore.kernel.org/linux-wireless/27e83382-4c84-1841-c428-d1e5143ea20c@
>> gmail.com/
>>
>> Signed-off-by: Georg Müller <georgmueller@gmx.net>
>> ---
>>   drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 12 ++++++------
>>   drivers/net/wireless/realtek/rtl8xxxu/core.c  | 19 ++++++++++++++-----
>>   .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h  |  3 ++-
>>   3 files changed, 22 insertions(+), 12 deletions(-)
>>
>> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
>> b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
>> index de2837a91bbe..607ca62194fc 100644
>> --- a/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
>> +++ b/drivers/net/wireless/realtek/rtl8xxxu/8188e.c
>> @@ -1468,9 +1468,8 @@ static void rtl8188e_reset_ra_counter(struct
>> rtl8xxxu_ra_info *ra)
>>          ra->nsc_down = (n_threshold_high[rate_id] + n_threshold_low[rate_id])
>>>> 1;
>>   }
>>
>> -static void rtl8188e_rate_decision(struct rtl8xxxu_ra_info *ra)
>> +static void rtl8188e_rate_decision(struct rtl8xxxu_priv *priv, struct
>> rtl8xxxu_ra_info *ra)
>>   {
>> -       struct rtl8xxxu_priv *priv = container_of(ra, struct rtl8xxxu_priv,
>> ra_info);
>>          const u8 *retry_penalty_idx_0;
>>          const u8 *retry_penalty_idx_1;
>>          const u8 *retry_penalty_up_idx;
>> @@ -1669,7 +1668,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv
>> *priv, struct sk_buff *s
>>          u32 *_rx_desc = (u32 *)(skb->data - sizeof(struct rtl8xxxu_rxdesc16));
>>          struct rtl8xxxu_rxdesc16 *rx_desc = (struct rtl8xxxu_rxdesc16
>> *)_rx_desc;
>>          struct device *dev = &priv->udev->dev;
>> -       struct rtl8xxxu_ra_info *ra = &priv->ra_info;
>> +       struct rtl8xxxu_ra_info *ra;
>>          u32 tx_rpt_len = rx_desc->pktlen & 0x3ff;
>>          u32 items = tx_rpt_len / TX_RPT2_ITEM_SIZE;
> 
> The 'items' should be smaller or equal to RTL8188E_MAX_MAC_ID_NUM.

I will add a check.

>>          u64 macid_valid = ((u64)_rx_desc[5] << 32) | _rx_desc[4];
>> @@ -1688,6 +1687,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv
>> *priv, struct sk_buff *s
>>
>>          for (macid = 0; macid < items; macid++) {
>>                  valid = false;
>> +               ra = &priv->ra_info[macid];
>>
>>                  if (macid < 64)
>>                          valid = macid_valid & BIT(macid);
>> @@ -1704,7 +1704,7 @@ void rtl8188e_handle_ra_tx_report2(struct rtl8xxxu_priv
>> *priv, struct sk_buff *s
>>
>>                          if (ra->total > 0) {
>>                                  if (ra->ra_stage < 5)
>> -                                       rtl8188e_rate_decision(ra);
>> +                                       rtl8188e_rate_decision(priv, ra);
>>                                  else if (ra->ra_stage == 5)
>>
>> rtl8188e_power_training_try_state(ra);
>>                                  else /* ra->ra_stage == 6 */
>> @@ -1781,7 +1781,7 @@ rtl8188e_update_rate_mask(struct rtl8xxxu_priv *priv,
>>                            u32 ramask, u8 rateid, int sgi, int txbw_40mhz,
>>                            u8 macid)
>>   {
>> -       struct rtl8xxxu_ra_info *ra = &priv->ra_info;
>> +       struct rtl8xxxu_ra_info *ra = &priv->ra_info[macid];
>>
>>          ra->rate_id = rateid;
>>          ra->rate_mask = ramask;
>> @@ -1792,7 +1792,7 @@ rtl8188e_update_rate_mask(struct rtl8xxxu_priv *priv,
>>
>>   static void rtl8188e_ra_set_rssi(struct rtl8xxxu_priv *priv, u8 macid, u8 rssi)
>>   {
>> -       priv->ra_info.rssi_sta_ra = rssi;
>> +       priv->ra_info[macid].rssi_sta_ra = rssi;
>>   }
>>
>>   void rtl8188e_ra_info_init_all(struct rtl8xxxu_ra_info *ra)
>> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c
>> b/drivers/net/wireless/realtek/rtl8xxxu/core.c
>> index 794187d28caa..5ad23c5c9305 100644
>> --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
>> +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
>> @@ -3921,6 +3921,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
>>          struct device *dev = &priv->udev->dev;
>>          struct rtl8xxxu_fileops *fops = priv->fops;
>>          bool macpower;
>> +       u16 mac_id;
>>          int ret;
>>          u8 val8;
>>          u16 val16;
>> @@ -4393,9 +4394,16 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
>>                  priv->cfo_tracking.crystal_cap = priv->default_crystal_cap;
>>          }
>>
>> -       if (priv->rtl_chip == RTL8188E)
>> -               rtl8188e_ra_info_init_all(&priv->ra_info);
>> -
>> +       if (priv->rtl_chip == RTL8188E) {
>> +               priv->ra_info = kmalloc_array(RTL8188E_MAX_MAC_ID_NUM,
>> sizeof(*priv->ra_info), GFP_KERNEL);
> 
> How about devm_ series? Then, no need to free on error path or disconnection.

I didn't know about these and will change it in the next version.

>> +               if (!priv->ra_info) {
>> +                       ret = -ENOMEM;
>> +                       goto exit;
>> +               }
>> +               for (mac_id = 0; mac_id < RTL8188E_MAX_MAC_ID_NUM; mac_id++) {
>> +                       rtl8188e_ra_info_init_all(&priv->ra_info[mac_id]);
>> +               }
> 
> no need brace for single line statement.

I will change it in the next version.

>> +       }
>>          set_bit(RTL8XXXU_BC_MC_MACID, priv->mac_id_map);
>>          set_bit(RTL8XXXU_BC_MC_MACID1, priv->mac_id_map);
>>
>> @@ -5338,7 +5346,7 @@ rtl8xxxu_fill_txdesc_v3(struct ieee80211_hw *hw, struct
>> ieee80211_hdr *hdr,
>>   {
>>          struct rtl8xxxu_priv *priv = hw->priv;
>>          struct device *dev = &priv->udev->dev;
>> -       struct rtl8xxxu_ra_info *ra = &priv->ra_info;
>> +       struct rtl8xxxu_ra_info *ra = &priv->ra_info[macid];
>>          u8 *qc = ieee80211_get_qos_ctl(hdr);
>>          u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
>>          u32 rate = 0;
>> @@ -7895,6 +7903,7 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
>>   err_set_intfdata:
>>          usb_set_intfdata(interface, NULL);
>>
>> +       kfree(priv->ra_info);
>>          kfree(priv->fw_data);
>>          mutex_destroy(&priv->usb_buf_mutex);
>>          mutex_destroy(&priv->syson_indirect_access_mutex);
>> @@ -7924,7 +7933,7 @@ static void rtl8xxxu_disconnect(struct usb_interface
>> *interface)
>>          usb_set_intfdata(interface, NULL);
>>
>>          dev_info(&priv->udev->dev, "disconnecting\n");
>> -
>> +       kfree(priv->ra_info);
>>          kfree(priv->fw_data);
>>          mutex_destroy(&priv->usb_buf_mutex);
>>          mutex_destroy(&priv->syson_indirect_access_mutex);
>> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
>> b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
>> index 4a744b5c1aec..9ce820ff4793 100644
>> --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
>> +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
>> @@ -76,6 +76,7 @@
>>   #define RTL_FW_PAGE_SIZE               4096
>>   #define RTL8XXXU_FIRMWARE_POLL_MAX     1000
>>
>> +#define RTL8188E_MAX_MAC_ID_NUM                16
>>   #define RTL8723A_CHANNEL_GROUPS                3
>>   #define RTL8723A_MAX_RF_PATHS          2
>>   #define RTL8723B_CHANNEL_GROUPS                6
>> @@ -1915,7 +1916,7 @@ struct rtl8xxxu_priv {
>>          struct rtl8xxxu_btcoex bt_coex;
>>          struct rtl8xxxu_ra_report ra_report;
>>          struct rtl8xxxu_cfo_tracking cfo_tracking;
>> -       struct rtl8xxxu_ra_info ra_info;
>> +       struct rtl8xxxu_ra_info *ra_info;
> 
> It looks like this is also 8188e specific. Could you add comment by the way?
> (but please /**/ style)

ok

>>          u8 dynamic_tx_rpt_timing_counter; // 8188e specific
>>
>>          bool led_registered;
>> --
>> 2.53.0
>>
> 

RE: [RFC PATCH v3 1/4] wifi: rtl8xxxu: move dynamic_tx_rpt_timing_counter from ra_info to priv

[Ping-Ke Shih]

Georg Müller <georgmueller@gmx.net> wrote:
> Am 16.03.26 um 07:17 schrieb Ping-Ke Shih:
> >
> > Georg Müller <georgmueller@gmx.net> wrote:
> >> dynamic_tx_rpt_timing_counter is not per mac_id, but used across all
> >> mac_ids.
> >
> > I don't know the purpose of dynamic_tx_rpt_timing_counter. Could you
> > share your study?
> >
> It is used globally (not per mac) like this in the vendor driver as well [1][2].
> Bitterblue Smith gave the hint that this should not be per macid [3], so it should
> move
> out of struct ra_info.
> 
> [1]
> https://github.com/lwfinger/rtl8188eu/blob/master/hal/Hal8188ERateAdaptive.c
> #L248
> [2]
> https://github.com/lwfinger/rtl8188eu/blob/v5.2.2.4/hal8188erateadaptive.c#L
> 285
> [3]
> https://lore.kernel.org/linux-wireless/938ae608-a865-4056-06de-c230d74e1847@
> gmail.com/
> 

Thanks for the info. I can't find the log internally, so let's keep it 
as github does.

Ping-Ke