Re: [PATCH v4 4/7] wifi: rtw88: fw: handle the RTL8723BS management TX reports

[Bitterblue Smith <rtl8821cerfe2@gmail.com>]

On 11/08/2026 12:12, luka.gejak@linux.dev wrote:
> From: Luka Gejak <luka.gejak@linux.dev>
> 
> The vendor firmware used by the RTL8723BS does not report management
> frame transmission through C2H_CCX_TX_RPT. It uses event 0x12, and
> reuses 0x32 for scan probe reports, which rtw88 otherwise treats as a
> WLAN_RFON event and completes the LPS leave check with.
> 
> Route both events to the existing TX report handler for this chip, and
> defer 0x32 to the worker instead of consuming it in the interrupt path,
> so the reports are decoded and the LPS handshake is left alone. The
> payload layout is the same as C2H_CCX_TX_RPT, so no separate decode is
> needed.
> 
> Without this, testers on ARM SDIO boards see "failed to get tx report
> from firmware" and "firmware failed to leave lps state" once power save
> engages under load.
> 

Please see your reply from July 30 regarding this subject:

https://lore.kernel.org/linux-wireless/20260730060903.30187-2-luka.gejak@linux.dev/

> Reported-by: Peter Robinson <pbrobinson@gmail.com>
> Closes: https://lore.kernel.org/all/CALeDE9PgQmpMfDt1DgfLD4tBFGH0MZ7GncV6RUEOHhHbKF+TdQ@mail.gmail.com/
> Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
> ---
>  drivers/net/wireless/realtek/rtw88/fw.c | 20 ++++++++++++++++++++
>  drivers/net/wireless/realtek/rtw88/fw.h |  5 +++++
>  2 files changed, 25 insertions(+)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
> index 945fedcd375b..c85c0e3e60a9 100644
> --- a/drivers/net/wireless/realtek/rtw88/fw.c
> +++ b/drivers/net/wireless/realtek/rtw88/fw.c
> @@ -317,6 +317,15 @@ void rtw_fw_c2h_cmd_handle(struct rtw_dev *rtwdev, struct sk_buff *skb)
>  	case C2H_CCX_TX_RPT:
>  		rtw_tx_report_handle(rtwdev, skb, C2H_CCX_TX_RPT);
>  		break;
> +	case C2H_VENDOR_TX_RPT:
> +	case C2H_WLAN_RFON:
> +		/*
> +		 * The RTL8723BS firmware reports management TX through these
> +		 * two events instead, using the same payload layout.
> +		 */
> +		if (rtw_is_8723bs(rtwdev))
> +			rtw_tx_report_handle(rtwdev, skb, C2H_CCX_TX_RPT);
> +		break;
>  	case C2H_BT_INFO:
>  		rtw_coex_bt_info_notify(rtwdev, c2h->payload, len);
>  		break;
> @@ -365,6 +374,17 @@ void rtw_fw_c2h_cmd_rx_irqsafe(struct rtw_dev *rtwdev, u32 pkt_offset,
>  		rtw_coex_info_response(rtwdev, skb);
>  		break;
>  	case C2H_WLAN_RFON:
> +		/*
> +		 * On 8723BS SDIO with v41 firmware, C2H 0x32 carries a scan TX
> +		 * report, not a WLAN_RFON event: defer it to
> +		 * rtw_fw_c2h_cmd_handle().
> +		 */
> +		if (rtw_is_8723bs(rtwdev)) {
> +			*((u32 *)skb->cb) = pkt_offset;
> +			skb_queue_tail(&rtwdev->c2h_queue, skb);
> +			ieee80211_queue_work(rtwdev->hw, &rtwdev->c2h_work);
> +			break;
> +		}
>  		complete(&rtwdev->lps_leave_check);
>  		dev_kfree_skb_any(skb);
>  		break;
> diff --git a/drivers/net/wireless/realtek/rtw88/fw.h b/drivers/net/wireless/realtek/rtw88/fw.h
> index 48ad9ceab6ea..bdda78dc6462 100644
> --- a/drivers/net/wireless/realtek/rtw88/fw.h
> +++ b/drivers/net/wireless/realtek/rtw88/fw.h
> @@ -54,6 +54,11 @@ enum rtw_c2h_cmd_id {
>  	C2H_BT_MP_INFO = 0x0b,
>  	C2H_BT_HID_INFO = 0x45,
>  	C2H_RA_RPT = 0x0c,
> +	/*
> +	 * 8723BS SDIO vendor v41 firmware management TX report (0x32 is
> +	 * reported as C2H_WLAN_RFON, handled per-chip in the C2H dispatch).
> +	 */
> +	C2H_VENDOR_TX_RPT = 0x12,
>  	C2H_HW_FEATURE_REPORT = 0x19,
>  	C2H_WLAN_INFO = 0x27,
>  	C2H_WLAN_RFON = 0x32,