Re: [PATCH rtw-next 1/3] wifi: rtw88: free the reserved pages of an interface on firmware recovery

[Luka Gejak <luka.gejak@linux.dev>]

Hi Mehmet,

Thanks for sending these. One comment below.

On November 11, 2026 10:32:37 PM GMT+01:00, Mehmet Fide
<mehmet.fide@gmail.com> wrote:

> diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
> index f7708ad17b6f..adc54b063382 100644
> --- a/drivers/net/wireless/realtek/rtw88/main.c
> +++ b/drivers/net/wireless/realtek/rtw88/main.c
> @@ -627,6 +627,7 @@ static void rtw_reset_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
>       rtw_bf_disassoc(rtwdev, vif, NULL);
>       rtw_vif_assoc_changed(rtwvif, NULL);
>       rtw_txq_cleanup(rtwdev, vif->txq);
> +     rtw_remove_rsvd_page(rtwdev, rtwvif);

As far as I can see, update_beacon_work can still run after this reset
and before ieee80211_reconfig() adds the interfaces again.
rtw_core_stop() cancels it from rtw_enter_ips(), but rtw_ops_set_tim()
can queue it again right after, for example when a frame for a dozing
station gets buffered. ieee80211_restart_work() then flushes
local->workqueue before it calls ieee80211_reconfig().

So if I read it right, with an AP interface (ap_active stays set) the
work now finds every per vif list empty and runs into this in
__rtw_build_rsvd_page_from_vifs():

        rsvd_pkt = list_first_entry_or_null(&rtwdev->rsvd_page_list,
                                            struct rtw_rsvd_page, build_list);
        if (!rsvd_pkt) {
                WARN(1, "Should not have an empty reserved page\n");
                return -EINVAL;
        }

Before this patch it built the page from the stale entries and did not
warn. Maybe rtw_fw_update_beacon_work() could skip the download while
RTW_FLAG_RESTARTING is set? The reconfig downloads the beacon again for
BSS_CHANGED_BEACON anyway.

Best regards,
Luka Gejak