* Re: [PATCH 6/6] net: Warn when processes listen on AF_INET sockets
From: Jakub Kicinski @ 2026-04-02 0:20 UTC (permalink / raw)
To: Stephen Hemminger
Cc: David Woodhouse, Eric Dumazet, Saeed Mahameed, Leon Romanovsky,
Tariq Toukan, Mark Bloch, Andrew Lunn, David S. Miller,
Paolo Abeni, Simon Horman, Nikolay Aleksandrov, Ido Schimmel,
Martin KaFai Lau, Daniel Borkmann, John Fastabend,
Stanislav Fomichev, Alexei Starovoitov, Andrii Nakryiko,
Eduard Zingerman, Song Liu, Yonghong Song, KP Singh, Hao Luo,
Jiri Olsa, Kuniyuki Iwashima, Willem de Bruijn, David Ahern,
Neal Cardwell, Johannes Berg, Pablo Neira Ayuso, Florian Westphal,
Phil Sutter, Guillaume Nault, Kees Cook, Alexei Lazar,
Gal Pressman, Paul Moore, netdev, linux-rdma, linux-kernel,
oss-drivers, bridge, bpf, linux-wireless, netfilter-devel,
coreteam, torvalds
In-Reply-To: <20260401080657.70cd9bd1@phoenix.local>
On Wed, 1 Apr 2026 08:06:57 -0700 Stephen Hemminger wrote:
> On Wed, 01 Apr 2026 10:28:23 +0100
> David Woodhouse <dwmw2@infradead.org> wrote:
>
> > > Some kernels are built without CONFIG_IPV6, so this warning would be
> > > quite misleading.
> >
> > Maybe on this date next year, we could make it not possible to build
> > the kernel *without* IPv6... ?
>
> There are some government agencies that used to require that IPV6 was disabled
> for security reasons. Yes they had broken old firewalls
Which is why we sadly have to keep the ipv6_mod_enabled()
sillilitude around. But that's a runtime thing.
^ permalink raw reply
* Re: [PATCH 0/6] Deprecate Legacy IP
From: patchwork-bot+netdevbpf @ 2026-04-02 0:24 UTC (permalink / raw)
To: David Woodhouse
Cc: Saeed Mahameed, Leon Romanovsky, Tariq Toukan, Mark Bloch,
Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Nikolay Aleksandrov, Ido Schimmel, Martin KaFai Lau,
Daniel Borkmann, John Fastabend, Stanislav Fomichev,
Alexei Starovoitov, Andrii Nakryiko, Eduard Zingerman, Song Liu,
Yonghong Song, KP Singh, Hao Luo, Jiri Olsa, Kuniyuki Iwashima,
Willem de Bruijn, David Ahern, Neal Cardwell, Johannes Berg,
Pablo Neira Ayuso, Florian Westphal, Phil Sutter, Guillaume Nault,
David Woodhouse, Kees Cook, Alexei Lazar, Gal Pressman,
Paul Moore, netdev, linux-rdma, linux-kernel, oss-drivers, bridge,
bpf, linux-wireless, netfilter-devel, coreteam, torvalds,
jon.maddog.hall
In-Reply-To: <20260401074509.1897527-1-dwmw2@infradead.org>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 1 Apr 2026 08:44:14 +0100 David Woodhouse wrote:
> RFC1883, the IPv6 standard, was published in the final decade of the 1900s.
> That's closer in time to the Apollo 11 moon landing than it was to today.
>
> Even our esteemed Maddog has worked with computers for longer in the IPv6
> era, than he ever did before it.
> [...]
Here is the summary with links:
- [net-next,v4,1/6] net: Simplify tautological CONFIG_INET/CONFIG_IPV6 guards
https://git.kernel.org/netdev/net-next/c/8888bf4fb980
- [net-next,v4,2/6] net: Add CONFIG_LEGACY_IP option
https://git.kernel.org/netdev/net-next/c/9b29afa11660
- [net-next,v4,3/6] net: Guard Legacy IP entry points with CONFIG_LEGACY_IP
https://git.kernel.org/netdev/net-next/c/f26d43acf12f
- [net-next,v4,4/6] net: Make IPv4-only Kconfig options depend on LEGACY_IP
https://git.kernel.org/netdev/net-next/c/ba5d4128fca8
- [net-next,v4,5/6] net: Change CONFIG_INET to CONFIG_LEGACY_IP for IPv4-only code
https://git.kernel.org/netdev/net-next/c/ff1cb3ad2abc
- [net-next,v4,6/6] net: Warn when processes listen on AF_INET sockets
https://git.kernel.org/netdev/net-next/c/7dae8ffb0987
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* RE: [PATCH rtw-next 00/12] wifi: rtw89: Add support for RTL8922AU
From: Ping-Ke Shih @ 2026-04-02 0:48 UTC (permalink / raw)
To: Bitterblue Smith, linux-wireless@vger.kernel.org
In-Reply-To: <a90f22d6-bac0-4c76-86fb-517e7e7bf441@gmail.com>
Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> On 30/03/2026 05:53, Ping-Ke Shih wrote:
> > Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> >> Often one or more of these messages appears when the chip powers on:
> >>
> >> [ +2.167037] rtw89_8922au 1-2:1.0: failed to wait RF DACK
> >>
> >> [ +2.942749] rtw89_8922au 1-2:1.0: failed to wait RF TSSI
> >>
> >> [ +0.019006] rtw89_8922au 2-4:1.0: failed to wait RF PRE_NTFY
> >>
> >> [ +5.985900] rtw89_8922au 2-4:1.0: failed to wait RF DPK
> >>
> >> It's unclear why.
> >
> > RTL8922D done RF calibrations by firmware one by one, so driver should
> > wait for previous one done, and trigger next one. However, it'd be
> > well to just do waiting at the last to wait for all calibrations.
> >
> > Try to enlarge waiting time in rtw8922a_rfk_channel().
> >
>
> I was convinced I tried that already, but no.
>
> After increasing all delays a bit the warnings are much more rare.
Turn of debug mask RTW89_DBG_RFK and set a very large timeout time, and
do connection >20 times and then check "RF %s takes %lld ms to complete"
to see the maximum value in your environment.
Please share the number for each RF calibration after your experiments.
>
> >>
> >> It seems to work well anyway.
> >>
> >
> > If you can yield the highest rate (MCS13), I'd say it is fine.
> >
> > Ping-Ke
> >
>
> Testing with RTL8832CU (Brostrend AX8) in AP mode, the RTL8912AU can
> reach 1.5 Gbps (MCS10) RX, 1 Gbps TX.
>
> I used the RTL8832CU because my router is not working well with 160
> MHz.
Since rtw89 only support beamformee (no beamformer), beamforming can't
work between two rtw89 devices. More, two antenna can't have good
beamforming performance. I think this is a point that it is hard to
yield the highest rate.
Another point may be the RF performance. If the warning messages of
RF calibration disappeared, I'd say this might not a problem.
Let's mention this in commit message of 12/12.
Ping-Ke
^ permalink raw reply
* RE: wifi: rtw89: rtw8922ae: HWSI bus lockup during RF recalibration on AP bandwidth change
From: Ping-Ke Shih @ 2026-04-02 2:36 UTC (permalink / raw)
To: Jeffrey Wälti; +Cc: linux-wireless@vger.kernel.org
In-Reply-To: <JSFJ7Do8YsCSMLsXH6KLXADJ0-z0Dh-y99PpaSCHiCwp6aikxldPnTr9mXpEAifNezf2gFyPPiHIaobekBeqiM4XVpO8hYKyXvuei4lKVc0=@waelti.dev>
Jeffrey Wälti <jeffrey@waelti.dev> wrote:
>
> Ping-Ke Shih <pkshih@realtek.com> wrote:
>
> > Jeffrey Wälti <jeffrey@waelti.dev> wrote:
> > >
> > > <pkshih@realtek.com> wrote:
> > >
> > > >
> > > > Please try to disable power save and ASPM by
> > > > 1) iw wlan0 set power_save off
>
> I'm sorry, this is my first time interacting with the mailing list and I overlooked the other instructions.
> It seems like disabling power save gets rid of the issue of Wi-Fi timeouts. I haven't been able to
> reproduce the issue with `iw wlan0 set power_save off` yet, even without any of the other fixes on kernel
> 6.19.10 and 7.0-rc6.
>
> > > > 2) reference and install
> > > https://github.com/lwfinger/rtw89/blob/main/70-rtw89.conf
> > > > and then cold reboot.
> >
> > Have you tested with these conditions?
>
> Using this patch eliminates the issue of Bluetooth devices disconnecting, when switching between
> networks.
>
> > [...]
> >
> > > >
> > > > Please help to test the latest kernel 7.0-rc with additional patch [1].
> > > >
> > > > [1]
> > > https://lore.kernel.org/linux-wireless/20260310080146.31113-4-pkshih@realtek
> > > .com/
> >
> > Have you also applied this patch?
>
> I tested kernel 7.0-rc6 with this patch applied on top for ~1 day now and haven't been able to reproduce,
> even with power save enabled. However, it is a bit difficult to reliably trigger the issue as it seems
> to trigger more on certain networks than others etc.
>
> > > >
> > > > Ping-Ke
> > > >
> > > >
> > >
> > > Thank you for coming back to me so quickly, I just encountered the same thing
> > > with kernel 7.0-rc5.
> > >
> >
> > Please confirm my questions above.
> >
> > Ping-Ke
> >
> >
>
> In summary:
> - Disabling power save seems to stop the timeouts but Bluetooth issues remain
> - Disabling ASPM features fixes the Bluetooth issue
> - kernel 7.0-rc6 with the additional patch fixes Wi-Fi timeouts but not the Bluetooth disconnects
>
> I hope that answers your questions.
It looks like additional patch can fix the WiFi timeouts problem, and
disabling ASPM feature can fix Bluetooth issue. I think you can keep
(2) + (3) setting as workaround.
I'd talk with BT coexistence team internally to figure out the cause
of Bluetooth disconnection.
Ping-Ke
^ permalink raw reply
* Re: [PATCH rtw-next v2] wifi: rtw88: Fill fw_version member of struct wiphy
From: Ping-Ke Shih @ 2026-04-02 2:44 UTC (permalink / raw)
To: Bitterblue Smith, linux-wireless@vger.kernel.org; +Cc: Ping-Ke Shih
In-Reply-To: <3701cce1-42c4-4382-9120-cd21012c1b21@gmail.com>
Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> Let userspace tools like lshw show the firmware version by filling the
> fw_version member of struct wiphy.
>
> Before:
>
> configuration: broadcast=yes driver=rtw88_8814au
> driverversion=6.19.6-arch1-1 firmware=N/A link=no multicast=yes
> wireless=IEEE 802.11
>
> After:
>
> configuration: broadcast=yes driver=rtw88_8814au
> driverversion=6.19.6-arch1-1 firmware=33.6.0 link=no multicast=yes
> wireless=IEEE 802.11
>
> Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
249716daa995 wifi: rtw88: Fill fw_version member of struct wiphy
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* Re: [PATCH rtw-next v2] wifi: rtw89: Fill fw_version member of struct wiphy
From: Ping-Ke Shih @ 2026-04-02 2:54 UTC (permalink / raw)
To: Bitterblue Smith, linux-wireless@vger.kernel.org; +Cc: Ping-Ke Shih
In-Reply-To: <a46ed12c-387c-4063-849c-c6457bf97810@gmail.com>
Bitterblue Smith <rtl8821cerfe2@gmail.com> wrote:
> Let userspace tools like lshw show the firmware version by filling the
> fw_version member of struct wiphy.
>
> Before:
>
> configuration: broadcast=yes driver=rtw89_8852au
> driverversion=6.19.6-arch1-1 firmware=N/A link=no multicast=yes
> wireless=IEEE 802.11
>
> After:
>
> configuration: broadcast=yes driver=rtw89_8852au
> driverversion=6.19.6-arch1-1 firmware=0.13.36.2 link=no multicast=yes
> wireless=IEEE 802.11
>
> Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
c2ca7b9d27f8 wifi: rtw89: Fill fw_version member of struct wiphy
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* Re: [PATCH] wifi: rtw89: fix typo "frome" -> "from" in rx_freq_frome_ie
From: Ping-Ke Shih @ 2026-04-02 3:03 UTC (permalink / raw)
To: Christos Longros, Ping-Ke Shih
Cc: linux-wireless, linux-kernel, Christos Longros
In-Reply-To: <20260329074550.114787-1-chris.longros@gmail.com>
Christos Longros <chris.longros@gmail.com> wrote:
> The chip_info field rx_freq_frome_ie (RX frequency from Information
> Element) has a typo. The function that uses it is already spelled
> correctly: rtw89_core_update_rx_freq_from_ie. Rename the field to
> match.
>
> Signed-off-by: Christos Longros <chris.longros@gmail.com>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
127ea8d0b068 wifi: rtw89: fix typo "frome" -> "from" in rx_freq_frome_ie
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* Re: [PATCH v5] wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
From: Ping-Ke Shih @ 2026-04-02 3:09 UTC (permalink / raw)
To: Lucid Duck, pkshih; +Cc: linux-wireless, rtl8821cerfe2, morrownr, Lucid Duck
In-Reply-To: <20260330025959.399018-1-lucid_duck@justthetip.ca>
Lucid Duck <lucid_duck@justthetip.ca> wrote:
> rtw89_usb_ops_check_and_reclaim_tx_resource() returns a hardcoded
> placeholder value (42) instead of actual TX resource availability.
> This violates mac80211's flow control contract, preventing backpressure
> and causing uncontrolled URB accumulation under sustained TX load.
>
> Fix by adding per-channel atomic counters (tx_inflight[]) that track
> in-flight URBs. Increment before usb_submit_urb() with rollback on
> failure, decrement in the completion callback, and return the
> remaining capacity to mac80211. The firmware command channel (CH12)
> always returns 1 since it has its own flow control.
>
> The pre-increment pattern prevents a race where USB core completes the
> URB on another CPU before the submitting code increments the counter.
>
> 128 URBs per channel provides headroom for RTL8832CU at 160 MHz
> bandwidth. Tested on RTL8852AU (USB3 80 MHz) where 64 and 128 showed
> equivalent throughput, and on RTL8832AU where 128 sustained full
> throughput under 8-stream parallel load.
>
> Tested on D-Link DWA-X1850 (RTL8832AU), kernel 6.19.8, Fedora 43:
>
> Unpatched -> Patched (128 URBs)
> USB3 5GHz UL: 844 -> 837 Mbps (no regression)
> USB3 5GHz retx: 3 -> 0
> USB3 2.4GHz UL: 162 -> 164 Mbps (no regression)
> 4-stream UL: 858 -> 826 Mbps (within variance)
> 8-stream UL: 872 -> 826 Mbps (within variance)
> UDP flood: 0% loss (690K datagrams)
> 60-second soak: 855 Mbps, 0 retransmits
>
> Reported-by: morrownr <morrownr@gmail.com>
> Signed-off-by: Lucid Duck <lucid_duck@justthetip.ca>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Failed to apply patch. Please rebase onto rtw.git rtw-next branch as footnote.
Applying: wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
Using index info to reconstruct a base tree...
M drivers/net/wireless/realtek/rtw89/usb.c
M drivers/net/wireless/realtek/rtw89/usb.h
Falling back to patching base and 3-way merge...
Auto-merging drivers/net/wireless/realtek/rtw89/usb.h
CONFLICT (content): Merge conflict in drivers/net/wireless/realtek/rtw89/usb.h
Auto-merging drivers/net/wireless/realtek/rtw89/usb.c
error: Failed to merge in the changes.
Patch failed at 0001 wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
Set patchset state to Changes Requested
[v5] wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* Re: [PATCH rtw-next 1/9] wifi: rtw89: 8922d: BB hardware pre-/post-init, TX/RX path and power settings
From: Ping-Ke Shih @ 2026-04-02 3:54 UTC (permalink / raw)
To: Ping-Ke Shih, linux-wireless
In-Reply-To: <20260330065847.48946-2-pkshih@realtek.com>
Ping-Ke Shih <pkshih@realtek.com> wrote:
> More settings related to BB pre-/post-initial settings, the TX/RX path
> settings, and digital power compensation.
>
> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
9 patch(es) applied to rtw-next branch of rtw.git, thanks.
347fbc602795 wifi: rtw89: 8922d: BB hardware pre-/post-init, TX/RX path and power settings
edf9f583c05c wifi: rtw89: 8922d: add set channel with pre-/post- helpers
2ef4363f1388 wifi: rtw89: 8922d: add RF calibration ops
baa6ea4e5e03 wifi: rtw89: 8922d: add set TX power callback
2b19199952e6 wifi: rtw89: 8922d: configure TX/RX path assisting in BT coexistence
9c2f79b4d912 wifi: rtw89: 8922d: add RF ops of init hardware and get thermal
553fd44ce8ce wifi: rtw89: 8922d: add ops related to BT coexistence mechanism
0737a803bae4 wifi: rtw89: 8922d: add chip_info and chip_ops struct
a16ca7d91e4e wifi: rtw89: 8922d: add PCI ID of RTL8922DE and RTL8922DE-VS
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* [PATCH ath-next v4 0/6] wifi: ath12k: Enable IPQ5424 AHB WiFi device
From: Raj Kumar Bhagat @ 2026-04-02 3:53 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat, Saravanakumar Duraisamy,
Sowmiya Sree Elavalagan, Krzysztof Kozlowski
Add support for the new ath12k AHB device IPQ5424, as currently, Ath12k
AHB only supports IPQ5332 WiFi devices.
The IPQ5424 is an IEEE 802.11be 2 GHz WiFi device, supporting 4x4
configurations. To enable the IPQ5424 device:
- Add the necessary hardware parameters for IPQ5424.
- Modify the boot-up sequence for ath12k AHB to accommodate the
requirements of the IPQ5424 device.
---
Changes in v4:
- DT binding: dropped copyright update as per discussion in v3.
- DT binding: Used DT binding from v2 and retained Acked-by tag.
- Link to v3: https://patch.msgid.link/20260331-ath12k-ipq5424-v3-0-1455b9cae29c@oss.qualcomm.com
Changes in v3:
- DT binding: updated copyright.
- DT binding: Dropped Acked-by tag as copyright is updated.
- Rebased on latest ToT.
- Dropped ath12k_ahb_ops because qcom_mdt_load() and
qcom_mdt_load_no_init() now have different number of arguments.
- Link to v2: https://lore.kernel.org/all/20250518-ath12k-ipq5424-v2-0-ef81b833dc97@quicinc.com/
Changes in v2:
- DT binding: Removed the redundant example for IPQ5424, as it is similar
to IPQ5332.
- Added driver probe data structure to eliminate the redundant switch-case
logic in the ath12k_ahb_probe() function.
- Validation completed, hence changed from RFC to PATCH.
- Link to v1: https://lore.kernel.org/all/20250130051838.1924079-1-quic_rajkbhag@quicinc.com/
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
---
Raj Kumar Bhagat (2):
dt-bindings: net: wireless: add ath12k wifi device IPQ5424
wifi: ath12k: add ath12k_hw_version_map entry for IPQ5424
Saravanakumar Duraisamy (3):
wifi: ath12k: Add ath12k_hw_params for IPQ5424
wifi: ath12k: add ath12k_hw_regs for IPQ5424
wifi: ath12k: Add CE remap hardware parameters for IPQ5424
Sowmiya Sree Elavalagan (1):
wifi: ath12k: Enable IPQ5424 WiFi device support
.../bindings/net/wireless/qcom,ipq5332-wifi.yaml | 1 +
drivers/net/wireless/ath/ath12k/ahb.c | 36 +++++----
drivers/net/wireless/ath/ath12k/ahb.h | 1 +
drivers/net/wireless/ath/ath12k/ce.h | 13 ++-
drivers/net/wireless/ath/ath12k/core.h | 1 +
drivers/net/wireless/ath/ath12k/wifi7/ahb.c | 8 ++
drivers/net/wireless/ath/ath12k/wifi7/hal.c | 7 ++
drivers/net/wireless/ath/ath12k/wifi7/hal.h | 3 +
.../net/wireless/ath/ath12k/wifi7/hal_qcn9274.c | 88 ++++++++++++++++++++
.../net/wireless/ath/ath12k/wifi7/hal_qcn9274.h | 1 +
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 93 +++++++++++++++++++++-
11 files changed, 231 insertions(+), 21 deletions(-)
---
base-commit: 15551ababf6d4e857f2101366a0c3eaa86dd822c
change-id: 20260331-ath12k-ipq5424-cddb63a46a97
^ permalink raw reply
* [PATCH ath-next v4 1/6] dt-bindings: net: wireless: add ath12k wifi device IPQ5424
From: Raj Kumar Bhagat @ 2026-04-02 3:53 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat, Krzysztof Kozlowski
In-Reply-To: <20260402-ath12k-ipq5424-v4-0-cd1e0f0a6c88@oss.qualcomm.com>
Add the device-tree bindings for the ATH12K AHB wifi device IPQ5424.
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
---
Documentation/devicetree/bindings/net/wireless/qcom,ipq5332-wifi.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/net/wireless/qcom,ipq5332-wifi.yaml b/Documentation/devicetree/bindings/net/wireless/qcom,ipq5332-wifi.yaml
index 363a0ecb6ad9..37d8a0da7780 100644
--- a/Documentation/devicetree/bindings/net/wireless/qcom,ipq5332-wifi.yaml
+++ b/Documentation/devicetree/bindings/net/wireless/qcom,ipq5332-wifi.yaml
@@ -17,6 +17,7 @@ properties:
compatible:
enum:
- qcom,ipq5332-wifi
+ - qcom,ipq5424-wifi
reg:
maxItems: 1
--
2.34.1
^ permalink raw reply related
* [PATCH ath-next v4 2/6] wifi: ath12k: Add ath12k_hw_params for IPQ5424
From: Raj Kumar Bhagat @ 2026-04-02 3:54 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat, Saravanakumar Duraisamy
In-Reply-To: <20260402-ath12k-ipq5424-v4-0-cd1e0f0a6c88@oss.qualcomm.com>
From: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Add ath12k_hw_params for the ath12k AHB-based WiFi 7 device IPQ5424.
The WiFi device IPQ5424 is similar to IPQ5332. Most of the hardware
parameters like hw_ops, wmi_init, ring_mask, etc., are the same between
IPQ5424 and IPQ5332, hence use these same parameters for IPQ5424.
Some parameters are specific to IPQ5424; initially set these to
0 or NULL, and populate them in subsequent patches.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/core.h | 1 +
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 75 ++++++++++++++++++++++++++++++
2 files changed, 76 insertions(+)
diff --git a/drivers/net/wireless/ath/ath12k/core.h b/drivers/net/wireless/ath/ath12k/core.h
index 59c193b24764..68453594eba8 100644
--- a/drivers/net/wireless/ath/ath12k/core.h
+++ b/drivers/net/wireless/ath/ath12k/core.h
@@ -157,6 +157,7 @@ enum ath12k_hw_rev {
ATH12K_HW_WCN7850_HW20,
ATH12K_HW_IPQ5332_HW10,
ATH12K_HW_QCC2072_HW10,
+ ATH12K_HW_IPQ5424_HW10,
};
enum ath12k_firmware_mode {
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index ec6dba96640b..9b9ca06a9f45 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -753,6 +753,81 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.dp_primary_link_only = false,
},
+ {
+ .name = "ipq5424 hw1.0",
+ .hw_rev = ATH12K_HW_IPQ5424_HW10,
+ .fw = {
+ .dir = "IPQ5424/hw1.0",
+ .board_size = 256 * 1024,
+ .cal_offset = 128 * 1024,
+ .m3_loader = ath12k_m3_fw_loader_remoteproc,
+ .download_aux_ucode = false,
+ },
+ .max_radios = 1,
+ .single_pdev_only = false,
+ .qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_IPQ5332,
+ .internal_sleep_clock = false,
+
+ .hw_ops = &qcn9274_ops,
+ .ring_mask = &ath12k_wifi7_hw_ring_mask_ipq5332,
+
+ .host_ce_config = ath12k_wifi7_host_ce_config_ipq5332,
+ .ce_count = 12,
+ .target_ce_config = ath12k_wifi7_target_ce_config_wlan_ipq5332,
+ .target_ce_count = 12,
+ .svc_to_ce_map =
+ ath12k_wifi7_target_service_to_ce_map_wlan_ipq5332,
+ .svc_to_ce_map_len = 18,
+
+ .rxdma1_enable = true,
+ .num_rxdma_per_pdev = 1,
+ .num_rxdma_dst_ring = 0,
+ .rx_mac_buf_ring = false,
+ .vdev_start_delay = false,
+
+ .interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ BIT(NL80211_IFTYPE_AP) |
+ BIT(NL80211_IFTYPE_MESH_POINT),
+ .supports_monitor = true,
+
+ .idle_ps = false,
+ .download_calib = true,
+ .supports_suspend = false,
+ .tcl_ring_retry = true,
+ .reoq_lut_support = false,
+ .supports_shadow_regs = false,
+
+ .num_tcl_banks = 48,
+ .max_tx_ring = 4,
+
+ .wmi_init = &ath12k_wifi7_wmi_init_qcn9274,
+
+ .qmi_cnss_feature_bitmap = BIT(CNSS_QDSS_CFG_MISS_V01),
+
+ .rfkill_pin = 0,
+ .rfkill_cfg = 0,
+ .rfkill_on_level = 0,
+
+ .rddm_size = 0,
+
+ .def_num_link = 0,
+ .max_mlo_peer = 256,
+
+ .otp_board_id_register = 0,
+
+ .supports_sta_ps = false,
+
+ .acpi_guid = NULL,
+ .supports_dynamic_smps_6ghz = false,
+ .iova_mask = 0,
+ .supports_aspm = false,
+
+ .ce_ie_addr = NULL,
+ .ce_remap = NULL,
+ .bdf_addr_offset = 0x940000,
+
+ .dp_primary_link_only = true,
+ },
};
/* Note: called under rcu_read_lock() */
--
2.34.1
^ permalink raw reply related
* [PATCH ath-next v4 3/6] wifi: ath12k: add ath12k_hw_version_map entry for IPQ5424
From: Raj Kumar Bhagat @ 2026-04-02 3:54 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat
In-Reply-To: <20260402-ath12k-ipq5424-v4-0-cd1e0f0a6c88@oss.qualcomm.com>
Add a new ath12k_hw_version_map entry for the AHB based WiFi 7 device
IPQ5424.
Reuse most of the ath12k_hw_version_map fields such as hal_ops,
hal_desc_sz, tcl_to_wbm_rbm_map, and hal_params from IPQ5332. The
register addresses differ on IPQ5424, hence set hw_regs temporarily
to NULL and populated it in a subsequent patch.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/wifi7/hal.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal.c b/drivers/net/wireless/ath/ath12k/wifi7/hal.c
index bd1753ca0db6..c2cc99a83f09 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal.c
@@ -50,6 +50,13 @@ static const struct ath12k_hw_version_map ath12k_wifi7_hw_ver_map[] = {
.hal_params = &ath12k_hw_hal_params_wcn7850,
.hw_regs = &qcc2072_regs,
},
+ [ATH12K_HW_IPQ5424_HW10] = {
+ .hal_ops = &hal_qcn9274_ops,
+ .hal_desc_sz = sizeof(struct hal_rx_desc_qcn9274_compact),
+ .tcl_to_wbm_rbm_map = ath12k_hal_tcl_to_wbm_rbm_map_qcn9274,
+ .hal_params = &ath12k_hw_hal_params_ipq5332,
+ .hw_regs = NULL,
+ },
};
int ath12k_wifi7_hal_init(struct ath12k_base *ab)
--
2.34.1
^ permalink raw reply related
* [PATCH ath-next v4 4/6] wifi: ath12k: add ath12k_hw_regs for IPQ5424
From: Raj Kumar Bhagat @ 2026-04-02 3:54 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat, Saravanakumar Duraisamy
In-Reply-To: <20260402-ath12k-ipq5424-v4-0-cd1e0f0a6c88@oss.qualcomm.com>
From: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Add register addresses (ath12k_hw_regs) for ath12k AHB based
WiFi 7 device IPQ5424.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/wifi7/hal.c | 2 +-
drivers/net/wireless/ath/ath12k/wifi7/hal.h | 3 +
.../net/wireless/ath/ath12k/wifi7/hal_qcn9274.c | 88 ++++++++++++++++++++++
.../net/wireless/ath/ath12k/wifi7/hal_qcn9274.h | 1 +
4 files changed, 93 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal.c b/drivers/net/wireless/ath/ath12k/wifi7/hal.c
index c2cc99a83f09..a0a1902fb491 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal.c
@@ -55,7 +55,7 @@ static const struct ath12k_hw_version_map ath12k_wifi7_hw_ver_map[] = {
.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9274_compact),
.tcl_to_wbm_rbm_map = ath12k_hal_tcl_to_wbm_rbm_map_qcn9274,
.hal_params = &ath12k_hw_hal_params_ipq5332,
- .hw_regs = NULL,
+ .hw_regs = &ipq5424_regs,
},
};
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal.h b/drivers/net/wireless/ath/ath12k/wifi7/hal.h
index 9337225a5253..3d9386198893 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal.h
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal.h
@@ -364,6 +364,9 @@
#define HAL_IPQ5332_CE_WFSS_REG_BASE 0x740000
#define HAL_IPQ5332_CE_SIZE 0x100000
+#define HAL_IPQ5424_CE_WFSS_REG_BASE 0x200000
+#define HAL_IPQ5424_CE_SIZE 0x100000
+
#define HAL_RX_MAX_BA_WINDOW 256
#define HAL_DEFAULT_BE_BK_VI_REO_TIMEOUT_USEC (100 * 1000)
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.c b/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.c
index 41c918eb1767..ba9ce1e718e8 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.c
@@ -484,6 +484,94 @@ const struct ath12k_hw_regs ipq5332_regs = {
HAL_IPQ5332_CE_WFSS_REG_BASE,
};
+const struct ath12k_hw_regs ipq5424_regs = {
+ /* SW2TCL(x) R0 ring configuration address */
+ .tcl1_ring_id = 0x00000918,
+ .tcl1_ring_misc = 0x00000920,
+ .tcl1_ring_tp_addr_lsb = 0x0000092c,
+ .tcl1_ring_tp_addr_msb = 0x00000930,
+ .tcl1_ring_consumer_int_setup_ix0 = 0x00000940,
+ .tcl1_ring_consumer_int_setup_ix1 = 0x00000944,
+ .tcl1_ring_msi1_base_lsb = 0x00000958,
+ .tcl1_ring_msi1_base_msb = 0x0000095c,
+ .tcl1_ring_base_lsb = 0x00000910,
+ .tcl1_ring_base_msb = 0x00000914,
+ .tcl1_ring_msi1_data = 0x00000960,
+ .tcl2_ring_base_lsb = 0x00000988,
+ .tcl_ring_base_lsb = 0x00000b68,
+
+ /* TCL STATUS ring address */
+ .tcl_status_ring_base_lsb = 0x00000d48,
+
+ /* REO DEST ring address */
+ .reo2_ring_base = 0x00000578,
+ .reo1_misc_ctrl_addr = 0x00000b9c,
+ .reo1_sw_cookie_cfg0 = 0x0000006c,
+ .reo1_sw_cookie_cfg1 = 0x00000070,
+ .reo1_qdesc_lut_base0 = 0x00000074,
+ .reo1_qdesc_lut_base1 = 0x00000078,
+ .reo1_ring_base_lsb = 0x00000500,
+ .reo1_ring_base_msb = 0x00000504,
+ .reo1_ring_id = 0x00000508,
+ .reo1_ring_misc = 0x00000510,
+ .reo1_ring_hp_addr_lsb = 0x00000514,
+ .reo1_ring_hp_addr_msb = 0x00000518,
+ .reo1_ring_producer_int_setup = 0x00000524,
+ .reo1_ring_msi1_base_lsb = 0x00000548,
+ .reo1_ring_msi1_base_msb = 0x0000054C,
+ .reo1_ring_msi1_data = 0x00000550,
+ .reo1_aging_thres_ix0 = 0x00000B28,
+ .reo1_aging_thres_ix1 = 0x00000B2C,
+ .reo1_aging_thres_ix2 = 0x00000B30,
+ .reo1_aging_thres_ix3 = 0x00000B34,
+
+ /* REO Exception ring address */
+ .reo2_sw0_ring_base = 0x000008c0,
+
+ /* REO Reinject ring address */
+ .sw2reo_ring_base = 0x00000320,
+ .sw2reo1_ring_base = 0x00000398,
+
+ /* REO cmd ring address */
+ .reo_cmd_ring_base = 0x000002A8,
+
+ /* REO status ring address */
+ .reo_status_ring_base = 0x00000aa0,
+
+ /* WBM idle link ring address */
+ .wbm_idle_ring_base_lsb = 0x00000d3c,
+ .wbm_idle_ring_misc_addr = 0x00000d4c,
+ .wbm_r0_idle_list_cntl_addr = 0x00000240,
+ .wbm_r0_idle_list_size_addr = 0x00000244,
+ .wbm_scattered_ring_base_lsb = 0x00000250,
+ .wbm_scattered_ring_base_msb = 0x00000254,
+ .wbm_scattered_desc_head_info_ix0 = 0x00000260,
+ .wbm_scattered_desc_head_info_ix1 = 0x00000264,
+ .wbm_scattered_desc_tail_info_ix0 = 0x00000270,
+ .wbm_scattered_desc_tail_info_ix1 = 0x00000274,
+ .wbm_scattered_desc_ptr_hp_addr = 0x0000027c,
+
+ /* SW2WBM release ring address */
+ .wbm_sw_release_ring_base_lsb = 0x0000037c,
+
+ /* WBM2SW release ring address */
+ .wbm0_release_ring_base_lsb = 0x00000e08,
+ .wbm1_release_ring_base_lsb = 0x00000e80,
+
+ /* PPE release ring address */
+ .ppe_rel_ring_base = 0x0000046c,
+
+ /* CE address */
+ .umac_ce0_src_reg_base = 0x00200000 -
+ HAL_IPQ5424_CE_WFSS_REG_BASE,
+ .umac_ce0_dest_reg_base = 0x00201000 -
+ HAL_IPQ5424_CE_WFSS_REG_BASE,
+ .umac_ce1_src_reg_base = 0x00202000 -
+ HAL_IPQ5424_CE_WFSS_REG_BASE,
+ .umac_ce1_dest_reg_base = 0x00203000 -
+ HAL_IPQ5424_CE_WFSS_REG_BASE,
+};
+
static inline
bool ath12k_hal_rx_desc_get_first_msdu_qcn9274(struct hal_rx_desc *desc)
{
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.h b/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.h
index 08c0a0469474..03cf3792d523 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.h
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hal_qcn9274.h
@@ -17,6 +17,7 @@ extern const struct hal_ops hal_qcn9274_ops;
extern const struct ath12k_hw_regs qcn9274_v1_regs;
extern const struct ath12k_hw_regs qcn9274_v2_regs;
extern const struct ath12k_hw_regs ipq5332_regs;
+extern const struct ath12k_hw_regs ipq5424_regs;
extern const struct ath12k_hal_tcl_to_wbm_rbm_map
ath12k_hal_tcl_to_wbm_rbm_map_qcn9274[DP_TCL_NUM_RING_MAX];
extern const struct ath12k_hw_hal_params ath12k_hw_hal_params_qcn9274;
--
2.34.1
^ permalink raw reply related
* [PATCH ath-next v4 5/6] wifi: ath12k: Add CE remap hardware parameters for IPQ5424
From: Raj Kumar Bhagat @ 2026-04-02 3:54 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat, Saravanakumar Duraisamy
In-Reply-To: <20260402-ath12k-ipq5424-v4-0-cd1e0f0a6c88@oss.qualcomm.com>
From: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Add CE remap hardware parameters for Ath12k AHB device IPQ5424.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/ce.h | 13 +++++++++----
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 22 +++++++++++++++++-----
2 files changed, 26 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/ce.h b/drivers/net/wireless/ath/ath12k/ce.h
index df4f2a4f8480..009cddf2d68d 100644
--- a/drivers/net/wireless/ath/ath12k/ce.h
+++ b/drivers/net/wireless/ath/ath12k/ce.h
@@ -38,10 +38,15 @@
#define PIPEDIR_INOUT 3 /* bidirectional */
#define PIPEDIR_INOUT_H2H 4 /* bidirectional, host to host */
-/* CE address/mask */
-#define CE_HOST_IE_ADDRESS 0x75804C
-#define CE_HOST_IE_2_ADDRESS 0x758050
-#define CE_HOST_IE_3_ADDRESS CE_HOST_IE_ADDRESS
+/* IPQ5332 CE address/mask */
+#define CE_HOST_IPQ5332_IE_ADDRESS 0x75804C
+#define CE_HOST_IPQ5332_IE_2_ADDRESS 0x758050
+#define CE_HOST_IPQ5332_IE_3_ADDRESS CE_HOST_IPQ5332_IE_ADDRESS
+
+/* IPQ5424 CE address/mask */
+#define CE_HOST_IPQ5424_IE_ADDRESS 0x21804C
+#define CE_HOST_IPQ5424_IE_2_ADDRESS 0x218050
+#define CE_HOST_IPQ5424_IE_3_ADDRESS CE_HOST_IPQ5424_IE_ADDRESS
#define CE_HOST_IE_3_SHIFT 0xC
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index 9b9ca06a9f45..a2c98cc1e348 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -329,9 +329,15 @@ static const struct ath12k_hw_ring_mask ath12k_wifi7_hw_ring_mask_wcn7850 = {
};
static const struct ce_ie_addr ath12k_wifi7_ce_ie_addr_ipq5332 = {
- .ie1_reg_addr = CE_HOST_IE_ADDRESS - HAL_IPQ5332_CE_WFSS_REG_BASE,
- .ie2_reg_addr = CE_HOST_IE_2_ADDRESS - HAL_IPQ5332_CE_WFSS_REG_BASE,
- .ie3_reg_addr = CE_HOST_IE_3_ADDRESS - HAL_IPQ5332_CE_WFSS_REG_BASE,
+ .ie1_reg_addr = CE_HOST_IPQ5332_IE_ADDRESS - HAL_IPQ5332_CE_WFSS_REG_BASE,
+ .ie2_reg_addr = CE_HOST_IPQ5332_IE_2_ADDRESS - HAL_IPQ5332_CE_WFSS_REG_BASE,
+ .ie3_reg_addr = CE_HOST_IPQ5332_IE_3_ADDRESS - HAL_IPQ5332_CE_WFSS_REG_BASE,
+};
+
+static const struct ce_ie_addr ath12k_wifi7_ce_ie_addr_ipq5424 = {
+ .ie1_reg_addr = CE_HOST_IPQ5424_IE_ADDRESS - HAL_IPQ5424_CE_WFSS_REG_BASE,
+ .ie2_reg_addr = CE_HOST_IPQ5424_IE_2_ADDRESS - HAL_IPQ5424_CE_WFSS_REG_BASE,
+ .ie3_reg_addr = CE_HOST_IPQ5424_IE_3_ADDRESS - HAL_IPQ5424_CE_WFSS_REG_BASE,
};
static const struct ce_remap ath12k_wifi7_ce_remap_ipq5332 = {
@@ -340,6 +346,12 @@ static const struct ce_remap ath12k_wifi7_ce_remap_ipq5332 = {
.cmem_offset = HAL_SEQ_WCSS_CMEM_OFFSET,
};
+static const struct ce_remap ath12k_wifi7_ce_remap_ipq5424 = {
+ .base = HAL_IPQ5424_CE_WFSS_REG_BASE,
+ .size = HAL_IPQ5424_CE_SIZE,
+ .cmem_offset = HAL_SEQ_WCSS_CMEM_OFFSET,
+};
+
static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
{
.name = "qcn9274 hw1.0",
@@ -822,8 +834,8 @@ static const struct ath12k_hw_params ath12k_wifi7_hw_params[] = {
.iova_mask = 0,
.supports_aspm = false,
- .ce_ie_addr = NULL,
- .ce_remap = NULL,
+ .ce_ie_addr = &ath12k_wifi7_ce_ie_addr_ipq5424,
+ .ce_remap = &ath12k_wifi7_ce_remap_ipq5424,
.bdf_addr_offset = 0x940000,
.dp_primary_link_only = true,
--
2.34.1
^ permalink raw reply related
* [PATCH ath-next v4 6/6] wifi: ath12k: Enable IPQ5424 WiFi device support
From: Raj Kumar Bhagat @ 2026-04-02 3:54 UTC (permalink / raw)
To: Johannes Berg, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Jeff Johnson
Cc: linux-wireless, devicetree, linux-kernel, ath12k,
Raj Kumar Bhagat, Sowmiya Sree Elavalagan,
Saravanakumar Duraisamy
In-Reply-To: <20260402-ath12k-ipq5424-v4-0-cd1e0f0a6c88@oss.qualcomm.com>
From: Sowmiya Sree Elavalagan <sowmiya.elavalagan@oss.qualcomm.com>
Currently, ath12k AHB (in IPQ5332) uses SCM calls to authenticate the
firmware image to bring up userpd. From IPQ5424 onwards, Q6 firmware can
directly communicate with the Trusted Management Engine - Lite (TME-L),
eliminating the need for SCM calls for userpd bring-up.
Hence, to enable IPQ5424 device support, use qcom_mdt_load_no_init() and
skip the SCM call as Q6 will directly authenticate the userpd firmware.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Sowmiya Sree Elavalagan <sowmiya.elavalagan@oss.qualcomm.com>
Co-developed-by: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Signed-off-by: Saravanakumar Duraisamy <quic_saradura@quicinc.com>
Co-developed-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
Signed-off-by: Raj Kumar Bhagat <raj.bhagat@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/ahb.c | 36 ++++++++++++++++++-----------
drivers/net/wireless/ath/ath12k/ahb.h | 1 +
drivers/net/wireless/ath/ath12k/wifi7/ahb.c | 8 +++++++
3 files changed, 31 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/ahb.c b/drivers/net/wireless/ath/ath12k/ahb.c
index 9a4d34e49104..2dcf0a52e4c1 100644
--- a/drivers/net/wireless/ath/ath12k/ahb.c
+++ b/drivers/net/wireless/ath/ath12k/ahb.c
@@ -382,8 +382,12 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)
ATH12K_AHB_UPD_SWID;
/* Load FW image to a reserved memory location */
- ret = qcom_mdt_load(dev, fw, fw_name, pasid, mem_region, mem_phys, mem_size,
- &mem_phys);
+ if (ab_ahb->scm_auth_enabled)
+ ret = qcom_mdt_load(dev, fw, fw_name, pasid, mem_region,
+ mem_phys, mem_size, &mem_phys);
+ else
+ ret = qcom_mdt_load_no_init(dev, fw, fw_name, mem_region,
+ mem_phys, mem_size, &mem_phys);
if (ret) {
ath12k_err(ab, "Failed to load MDT segments: %d\n", ret);
goto err_fw;
@@ -414,11 +418,13 @@ static int ath12k_ahb_power_up(struct ath12k_base *ab)
goto err_fw2;
}
- /* Authenticate FW image using peripheral ID */
- ret = qcom_scm_pas_auth_and_reset(pasid);
- if (ret) {
- ath12k_err(ab, "failed to boot the remote processor %d\n", ret);
- goto err_fw2;
+ if (ab_ahb->scm_auth_enabled) {
+ /* Authenticate FW image using peripheral ID */
+ ret = qcom_scm_pas_auth_and_reset(pasid);
+ if (ret) {
+ ath12k_err(ab, "failed to boot the remote processor %d\n", ret);
+ goto err_fw2;
+ }
}
/* Instruct Q6 to spawn userPD thread */
@@ -475,13 +481,15 @@ static void ath12k_ahb_power_down(struct ath12k_base *ab, bool is_suspend)
qcom_smem_state_update_bits(ab_ahb->stop_state, BIT(ab_ahb->stop_bit), 0);
- pasid = (u32_encode_bits(ab_ahb->userpd_id, ATH12K_USERPD_ID_MASK)) |
- ATH12K_AHB_UPD_SWID;
- /* Release the firmware */
- ret = qcom_scm_pas_shutdown(pasid);
- if (ret)
- ath12k_err(ab, "scm pas shutdown failed for userPD%d: %d\n",
- ab_ahb->userpd_id, ret);
+ if (ab_ahb->scm_auth_enabled) {
+ pasid = (u32_encode_bits(ab_ahb->userpd_id, ATH12K_USERPD_ID_MASK)) |
+ ATH12K_AHB_UPD_SWID;
+ /* Release the firmware */
+ ret = qcom_scm_pas_shutdown(pasid);
+ if (ret)
+ ath12k_err(ab, "scm pas shutdown failed for userPD%d\n",
+ ab_ahb->userpd_id);
+ }
}
static void ath12k_ahb_init_qmi_ce_config(struct ath12k_base *ab)
diff --git a/drivers/net/wireless/ath/ath12k/ahb.h b/drivers/net/wireless/ath/ath12k/ahb.h
index be9e31b3682d..0fa15daaa3e6 100644
--- a/drivers/net/wireless/ath/ath12k/ahb.h
+++ b/drivers/net/wireless/ath/ath12k/ahb.h
@@ -68,6 +68,7 @@ struct ath12k_ahb {
int userpd_irq_num[ATH12K_USERPD_MAX_IRQ];
const struct ath12k_ahb_ops *ahb_ops;
const struct ath12k_ahb_device_family_ops *device_family_ops;
+ bool scm_auth_enabled;
};
struct ath12k_ahb_driver {
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/ahb.c b/drivers/net/wireless/ath/ath12k/wifi7/ahb.c
index a6c5f7689edd..6a8b8b2a56f9 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/ahb.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/ahb.c
@@ -19,6 +19,9 @@ static const struct of_device_id ath12k_wifi7_ahb_of_match[] = {
{ .compatible = "qcom,ipq5332-wifi",
.data = (void *)ATH12K_HW_IPQ5332_HW10,
},
+ { .compatible = "qcom,ipq5424-wifi",
+ .data = (void *)ATH12K_HW_IPQ5424_HW10,
+ },
{ }
};
@@ -38,6 +41,11 @@ static int ath12k_wifi7_ahb_probe(struct platform_device *pdev)
switch (hw_rev) {
case ATH12K_HW_IPQ5332_HW10:
ab_ahb->userpd_id = ATH12K_IPQ5332_USERPD_ID;
+ ab_ahb->scm_auth_enabled = true;
+ break;
+ case ATH12K_HW_IPQ5424_HW10:
+ ab_ahb->userpd_id = ATH12K_IPQ5332_USERPD_ID;
+ ab_ahb->scm_auth_enabled = false;
break;
default:
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH rtw-next] wifi: rtw89: Add support for Elecom WDC-XE2402TU3-B
From: Ping-Ke Shih @ 2026-04-02 3:58 UTC (permalink / raw)
To: Zenm Chen, linux-wireless, pkshih, rtl8821cerfe2; +Cc: zenmchen
In-Reply-To: <20260330093440.3615-1-zenmchen@gmail.com>
Zenm Chen <zenmchen@gmail.com> wrote:
> Add the ID 056e:4024 to the table to support an additional RTL8832CU
> adapter: Elecom WDC-XE2402TU3-B.
>
> Link: https://github.com/morrownr/rtw89/commit/55c059e2bd49acd5cf93edbc8eda7b9e042f4efd
> Signed-off-by: Zenm Chen <zenmchen@gmail.com>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
4e4fc2149b0a wifi: rtw89: Add support for Elecom WDC-XE2402TU3-B
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* [PATCH ath-next] wifi: ath12k: Create symlink for each radio in a wiphy
From: Roopni Devanathan @ 2026-04-02 5:14 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, Roopni Devanathan, Harshitha Prem
In single-wiphy design, when more than one radio is registered as a
single-wiphy in the mac80211 layer, the following warnings are seen:
1. debugfs: File 'ath12k' in directory 'phy0' already present!
2. debugfs: File 'simulate_fw_crash' in directory 'pci-0000:57:00.0' already present!
debugfs: File 'device_dp_stats' in directory 'pci-01777777777777777777777:57:00.0' already present!
When more than one radio is registered as a single-wiphy, symlinks for
all the radios are created in the same debugfs directory:
/sys/kernel/debug/ieee80211/phyX/ath12k, resulting in warning 1. When a
symlink is created for the first radio, since the 'ath12k' directory is
not present, it will be created and no warning will be thrown. But when
symlink is created for more than one radio, since the 'ath12k'
directory was already created for symlink for radio 1, a warning is
thrown complaining that 'ath12k' directory is already present. To resolve
warning 1, create symlink for each radio in separate debugfs directories.
For the first radio, the symlink will always be the 'ath12k' directory.
This ensures that the existing directory structure is retained for
single-wiphy and multi-wiphy architectures. In single-wiphy architecture
with multiple radios, create symlink in separate debugfs directories
introduced by mac80211.
Existing debugfs directory in single-wiphy architecture:
/sys/kernel/debug/ieee80211/phyX/ath12k is a symlink to
/sys/kernel/debug/ath12k/pci-0001:01:00.0/macY
Proposed debugfs directory in single-wiphy architecture with one radio:
/sys/kernel/debug/ieee80211/phyX/ath12k is a symlink to
/sys/kernel/debug/ath12k/pci-0001:01:00.0/mac0
Proposed debugfs directory in single-wiphy architecture with more than
one radio:
/sys/kernel/debug/ieee80211/phyX/radio0/ath12k is a symlink to
/sys/kernel/debug/ath12k/pci-0001:01:00.0/mac0 and
/sys/kernel/debug/ieee80211/phyX/radioY/ath12k is a symlink to
/sys/kernel/debug/ath12k/pci-0001:01:00.0/macY
Where X is phy index and Y is radio index, seen in
'iw phyX info | grep Idx'. Two symlinks for the first radio are to ensure
compatibility with the existing design. Add radio_idx inside ar, to track
the radio index in probing order.
API ath12k_debugfs_pdev_create() that creates SoC entries is called more
than once when hardware group starts up, resulting in warning 2. To
resolve this warning, remove all other calls to this API and add one
inside the ath12k_core_pdev_create(). This API carries all pdev-specific
initializations and can conveniently hold a call to
ath12k_debugfs_pdev_create().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Co-developed-by: Harshitha Prem <harshitha.prem@oss.qualcomm.com>
Signed-off-by: Harshitha Prem <harshitha.prem@oss.qualcomm.com>
Signed-off-by: Roopni Devanathan <roopni.devanathan@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/core.c | 4 ++--
drivers/net/wireless/ath/ath12k/core.h | 2 ++
drivers/net/wireless/ath/ath12k/debugfs.c | 29 +++++++++++++++++++----
drivers/net/wireless/ath/ath12k/mac.c | 2 +-
4 files changed, 29 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
index c31c47fb5a73..2519e2400d58 100644
--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
@@ -835,8 +835,6 @@ static int ath12k_core_soc_create(struct ath12k_base *ab)
goto err_qmi_deinit;
}
- ath12k_debugfs_pdev_create(ab);
-
return 0;
err_qmi_deinit:
@@ -869,6 +867,8 @@ static int ath12k_core_pdev_create(struct ath12k_base *ab)
goto err_dp_pdev_free;
}
+ ath12k_debugfs_pdev_create(ab);
+
return 0;
err_dp_pdev_free:
diff --git a/drivers/net/wireless/ath/ath12k/core.h b/drivers/net/wireless/ath/ath12k/core.h
index 59c193b24764..046249c8763e 100644
--- a/drivers/net/wireless/ath/ath12k/core.h
+++ b/drivers/net/wireless/ath/ath12k/core.h
@@ -588,6 +588,7 @@ struct ath12k_dbg_htt_stats {
struct ath12k_debug {
struct dentry *debugfs_pdev;
struct dentry *debugfs_pdev_symlink;
+ struct dentry *debugfs_pdev_symlink_default;
struct ath12k_dbg_htt_stats htt_stats;
enum wmi_halphy_ctrl_path_stats_id tpc_stats_type;
bool tpc_request;
@@ -673,6 +674,7 @@ struct ath12k {
u8 pdev_idx;
u8 lmac_id;
u8 hw_link_id;
+ u8 radio_idx;
struct completion peer_assoc_done;
struct completion peer_delete_done;
diff --git a/drivers/net/wireless/ath/ath12k/debugfs.c b/drivers/net/wireless/ath/ath12k/debugfs.c
index 358031fa14eb..8c81a1c22449 100644
--- a/drivers/net/wireless/ath/ath12k/debugfs.c
+++ b/drivers/net/wireless/ath/ath12k/debugfs.c
@@ -1473,18 +1473,35 @@ void ath12k_debugfs_register(struct ath12k *ar)
{
struct ath12k_base *ab = ar->ab;
struct ieee80211_hw *hw = ar->ah->hw;
- char pdev_name[5];
+ struct ath12k_hw *ah = ath12k_hw_to_ah(hw);
+ struct dentry *ath12k_fs;
char buf[100] = {};
+ char pdev_name[5];
scnprintf(pdev_name, sizeof(pdev_name), "%s%d", "mac", ar->pdev_idx);
ar->debug.debugfs_pdev = debugfs_create_dir(pdev_name, ab->debugfs_soc);
/* Create a symlink under ieee80211/phy* */
- scnprintf(buf, sizeof(buf), "../../ath12k/%pd2", ar->debug.debugfs_pdev);
- ar->debug.debugfs_pdev_symlink = debugfs_create_symlink("ath12k",
- hw->wiphy->debugfsdir,
- buf);
+ if (ar->radio_idx == 0) {
+ scnprintf(buf, sizeof(buf), "../../ath12k/%pd2",
+ ar->debug.debugfs_pdev);
+ ath12k_fs = hw->wiphy->debugfsdir;
+
+ /* symbolic link for compatibility */
+ ar->debug.debugfs_pdev_symlink_default = debugfs_create_symlink("ath12k",
+ ath12k_fs,
+ buf);
+ }
+
+ if (ah->num_radio > 1) {
+ scnprintf(buf, sizeof(buf), "../../../ath12k/%pd2",
+ ar->debug.debugfs_pdev);
+ ath12k_fs = hw->wiphy->radio_cfg[ar->radio_idx].radio_debugfsdir;
+ ar->debug.debugfs_pdev_symlink = debugfs_create_symlink("ath12k",
+ ath12k_fs,
+ buf);
+ }
if (ar->mac.sbands[NL80211_BAND_5GHZ].channels) {
debugfs_create_file("dfs_simulate_radar", 0200,
@@ -1513,7 +1530,9 @@ void ath12k_debugfs_unregister(struct ath12k *ar)
/* Remove symlink under ieee80211/phy* */
debugfs_remove(ar->debug.debugfs_pdev_symlink);
+ debugfs_remove(ar->debug.debugfs_pdev_symlink_default);
debugfs_remove_recursive(ar->debug.debugfs_pdev);
ar->debug.debugfs_pdev_symlink = NULL;
+ ar->debug.debugfs_pdev_symlink_default = NULL;
ar->debug.debugfs_pdev = NULL;
}
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 553ec28b6aaa..c2b747f1b9f5 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -15065,6 +15065,7 @@ static struct ath12k_hw *ath12k_mac_hw_allocate(struct ath12k_hw_group *ag,
ar->hw_link_id = pdev->hw_link_id;
ar->pdev = pdev;
ar->pdev_idx = pdev_idx;
+ ar->radio_idx = i;
pdev->ar = ar;
ag->hw_links[ar->hw_link_id].device_id = ab->device_id;
@@ -15132,7 +15133,6 @@ int ath12k_mac_allocate(struct ath12k_hw_group *ag)
if (!ab)
continue;
- ath12k_debugfs_pdev_create(ab);
ath12k_mac_set_device_defaults(ab);
total_radio += ab->num_radios;
}
base-commit: 15551ababf6d4e857f2101366a0c3eaa86dd822c
--
2.43.0
^ permalink raw reply related
* [PATCH v6] wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
From: Lucid Duck @ 2026-04-02 5:22 UTC (permalink / raw)
To: pkshih; +Cc: linux-wireless, rtl8821cerfe2, morrownr, Lucid Duck
In-Reply-To: <20260330025959.399018-1-lucid_duck@justthetip.ca>
rtw89_usb_ops_check_and_reclaim_tx_resource() returns a hardcoded
placeholder value (42) instead of actual TX resource availability.
This violates mac80211's flow control contract, preventing backpressure
and causing uncontrolled URB accumulation under sustained TX load.
Fix by adding per-channel atomic counters (tx_inflight[]) that track
in-flight URBs. Increment before usb_submit_urb() with rollback on
failure, decrement in the completion callback, and return the
remaining capacity to mac80211. The firmware command channel (CH12)
always returns 1 since it has its own flow control.
The pre-increment pattern prevents a race where USB core completes the
URB on another CPU before the submitting code increments the counter.
128 URBs per channel provides headroom for RTL8832CU at 160 MHz
bandwidth. Tested on RTL8852AU (USB3 80 MHz) where 64 and 128 showed
equivalent throughput, and on RTL8832AU where 128 sustained full
throughput under 8-stream parallel load.
Tested on D-Link DWA-X1850 (RTL8832AU), kernel 6.19.8, Fedora 43:
Unpatched -> Patched (128 URBs)
USB3 5GHz UL: 844 -> 837 Mbps (no regression)
USB3 5GHz retx: 3 -> 0
USB3 2.4GHz UL: 162 -> 164 Mbps (no regression)
4-stream UL: 858 -> 826 Mbps (within variance)
8-stream UL: 872 -> 826 Mbps (within variance)
UDP flood: 0% loss (690K datagrams)
60-second soak: 855 Mbps, 0 retransmits
Reported-by: morrownr <morrownr@gmail.com>
Signed-off-by: Lucid Duck <lucid_duck@justthetip.ca>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
---
v6:
- Rebased onto rtw.git rtw-next to resolve merge conflict in usb.h
(new RXAGG register defines added upstream)
- No code changes from v5
v5:
- Sent from kernel tree (v4 was from standalone rtw89 tree)
v4:
- Increased URB limit from 64 to 128 per Ping-Ke's review (headroom
for RTL8832CU 160 MHz)
- Simplified CH12 handling per Ping-Ke's review
- Removed all comments per Ping-Ke's review
v3:
- Removed comments flagged as "AI-like" by reviewer
- Added 8-stream parallel load test data
v2:
- Pre-increment before usb_submit_urb() to prevent completion race
- Added per-channel tracking (was global)
- Added test data to commit message
drivers/net/wireless/realtek/rtw89/usb.c | 20 ++++++++++++++++++--
drivers/net/wireless/realtek/rtw89/usb.h | 3 +++
2 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
index 581b8c05f..767a95f75 100644
--- a/drivers/net/wireless/realtek/rtw89/usb.c
+++ b/drivers/net/wireless/realtek/rtw89/usb.c
@@ -161,16 +161,24 @@ static u32
rtw89_usb_ops_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev,
u8 txch)
{
+ struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev);
+ int inflight;
+
if (txch == RTW89_TXCH_CH12)
return 1;
- return 42; /* TODO some kind of calculation? */
+ inflight = atomic_read(&rtwusb->tx_inflight[txch]);
+ if (inflight >= RTW89_USB_MAX_TX_URBS_PER_CH)
+ return 0;
+
+ return RTW89_USB_MAX_TX_URBS_PER_CH - inflight;
}
static void rtw89_usb_write_port_complete(struct urb *urb)
{
struct rtw89_usb_tx_ctrl_block *txcb = urb->context;
struct rtw89_dev *rtwdev = txcb->rtwdev;
+ struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev);
struct ieee80211_tx_info *info;
struct rtw89_txwd_body *txdesc;
struct sk_buff *skb;
@@ -229,6 +237,8 @@ static void rtw89_usb_write_port_complete(struct urb *urb)
break;
}
+ atomic_dec(&rtwusb->tx_inflight[txcb->txch]);
+
kfree(txcb);
}
@@ -306,9 +316,13 @@ static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch)
skb_queue_tail(&txcb->tx_ack_queue, skb);
+ atomic_inc(&rtwusb->tx_inflight[txch]);
+
ret = rtw89_usb_write_port(rtwdev, txch, skb->data, skb->len,
txcb);
if (ret) {
+ atomic_dec(&rtwusb->tx_inflight[txch]);
+
if (ret != -ENODEV)
rtw89_err(rtwdev, "write port txch %d failed: %d\n",
txch, ret);
@@ -684,8 +698,10 @@ static void rtw89_usb_init_tx(struct rtw89_dev *rtwdev)
struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev);
int i;
- for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++)
+ for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++) {
skb_queue_head_init(&rtwusb->tx_queue[i]);
+ atomic_set(&rtwusb->tx_inflight[i], 0);
+ }
}
static void rtw89_usb_deinit_tx(struct rtw89_dev *rtwdev)
diff --git a/drivers/net/wireless/realtek/rtw89/usb.h b/drivers/net/wireless/realtek/rtw89/usb.h
index 3d17e514e..507f61f58 100644
--- a/drivers/net/wireless/realtek/rtw89/usb.h
+++ b/drivers/net/wireless/realtek/rtw89/usb.h
@@ -31,6 +31,8 @@
#define R_AX_RXAGG_0 0x8900
#define B_AX_RXAGG_0_BUF_SZ_4K GENMASK(7, 0)
+#define RTW89_USB_MAX_TX_URBS_PER_CH 128
+
struct rtw89_usb_info {
u32 usb_host_request_2;
u32 usb_wlan0_1;
@@ -75,6 +77,7 @@ struct rtw89_usb {
struct usb_anchor tx_submitted;
struct sk_buff_head tx_queue[RTW89_TXCH_NUM];
+ atomic_t tx_inflight[RTW89_TXCH_NUM];
};
static inline struct rtw89_usb *rtw89_usb_priv(struct rtw89_dev *rtwdev)
--
2.53.0
^ permalink raw reply related
* RE: [PATCH v6] wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
From: Ping-Ke Shih @ 2026-04-02 5:38 UTC (permalink / raw)
To: Lucid Duck
Cc: linux-wireless@vger.kernel.org, rtl8821cerfe2@gmail.com,
morrownr@gmail.com
In-Reply-To: <20260402052216.207858-1-lucid_duck@justthetip.ca>
Lucid Duck <lucid_duck@justthetip.ca> wrote:
> rtw89_usb_ops_check_and_reclaim_tx_resource() returns a hardcoded
> placeholder value (42) instead of actual TX resource availability.
> This violates mac80211's flow control contract, preventing backpressure
> and causing uncontrolled URB accumulation under sustained TX load.
>
> Fix by adding per-channel atomic counters (tx_inflight[]) that track
> in-flight URBs. Increment before usb_submit_urb() with rollback on
> failure, decrement in the completion callback, and return the
> remaining capacity to mac80211. The firmware command channel (CH12)
> always returns 1 since it has its own flow control.
>
> The pre-increment pattern prevents a race where USB core completes the
> URB on another CPU before the submitting code increments the counter.
>
> 128 URBs per channel provides headroom for RTL8832CU at 160 MHz
> bandwidth. Tested on RTL8852AU (USB3 80 MHz) where 64 and 128 showed
> equivalent throughput, and on RTL8832AU where 128 sustained full
> throughput under 8-stream parallel load.
>
> Tested on D-Link DWA-X1850 (RTL8832AU), kernel 6.19.8, Fedora 43:
>
> Unpatched -> Patched (128 URBs)
> USB3 5GHz UL: 844 -> 837 Mbps (no regression)
> USB3 5GHz retx: 3 -> 0
> USB3 2.4GHz UL: 162 -> 164 Mbps (no regression)
> 4-stream UL: 858 -> 826 Mbps (within variance)
> 8-stream UL: 872 -> 826 Mbps (within variance)
> UDP flood: 0% loss (690K datagrams)
> 60-second soak: 855 Mbps, 0 retransmits
>
> Reported-by: morrownr <morrownr@gmail.com>
Can you share a reported link?
^ permalink raw reply
* Re: [PATCH v6] wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
From: Ping-Ke Shih @ 2026-04-02 6:09 UTC (permalink / raw)
To: Lucid Duck, pkshih; +Cc: linux-wireless, rtl8821cerfe2, morrownr, Lucid Duck
In-Reply-To: <20260402052216.207858-1-lucid_duck@justthetip.ca>
Lucid Duck <lucid_duck@justthetip.ca> wrote:
> rtw89_usb_ops_check_and_reclaim_tx_resource() returns a hardcoded
> placeholder value (42) instead of actual TX resource availability.
> This violates mac80211's flow control contract, preventing backpressure
> and causing uncontrolled URB accumulation under sustained TX load.
>
> Fix by adding per-channel atomic counters (tx_inflight[]) that track
> in-flight URBs. Increment before usb_submit_urb() with rollback on
> failure, decrement in the completion callback, and return the
> remaining capacity to mac80211. The firmware command channel (CH12)
> always returns 1 since it has its own flow control.
>
> The pre-increment pattern prevents a race where USB core completes the
> URB on another CPU before the submitting code increments the counter.
>
> 128 URBs per channel provides headroom for RTL8832CU at 160 MHz
> bandwidth. Tested on RTL8852AU (USB3 80 MHz) where 64 and 128 showed
> equivalent throughput, and on RTL8832AU where 128 sustained full
> throughput under 8-stream parallel load.
>
> Tested on D-Link DWA-X1850 (RTL8832AU), kernel 6.19.8, Fedora 43:
>
> Unpatched -> Patched (128 URBs)
> USB3 5GHz UL: 844 -> 837 Mbps (no regression)
> USB3 5GHz retx: 3 -> 0
> USB3 2.4GHz UL: 162 -> 164 Mbps (no regression)
> 4-stream UL: 858 -> 826 Mbps (within variance)
> 8-stream UL: 872 -> 826 Mbps (within variance)
> UDP flood: 0% loss (690K datagrams)
> 60-second soak: 855 Mbps, 0 retransmits
>
> Reported-by: morrownr <morrownr@gmail.com>
I think Link for this case isn't strictly required, so apply it.
> Signed-off-by: Lucid Duck <lucid_duck@justthetip.ca>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>
1 patch(es) applied to rtw-next branch of rtw.git, thanks.
80119a77e5b0 wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* Re: [PATCH v2] iwlwifi: dvm: add missing cleaup for on error path
From: Markus Elfring @ 2026-04-02 6:10 UTC (permalink / raw)
To: Haoxiang Li, linux-wireless, Johannes Berg, Miri Korenblit; +Cc: LKML
In-Reply-To: <20260401030555.541685-1-lihaoxiang@isrc.iscas.ac.cn>
> In iwlagn_tx_agg_start(), call iwlagn_dealloc_agg_txq()
> to clear bit on error path.
1. See also:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0-rc6#n659
2. Please choose corresponding tags.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0-rc6#n145
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.0-rc6#n34
3. Would you like to avoid a typo in the summary phrase?
Regards,
Markus
^ permalink raw reply
* pull-request: rtw-next-2026-04-02
From: Ping-Ke Shih @ 2026-04-02 6:12 UTC (permalink / raw)
To: linux-wireless
Hi,
A pull-request of rtw-next to wireless-next tree, more info below. Please
let me know if any problems.
Thanks
Ping-Ke
---
The following changes since commit 7c6084d7fa4e61dd7824c34529277a814c7b3836:
wifi: cfg80211: support key installation on non-netdev wdevs (2026-03-02 11:28:33 +0100)
are available in the Git repository at:
https://github.com/pkshih/rtw.git tags/rtw-next-2026-04-02
for you to fetch changes up to 80119a77e5b03747b8886505df1b3cb26f49168d:
wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs (2026-04-02 14:06:53 +0800)
----------------------------------------------------------------
rtw-next patches for -next
Improve MLO and some random fixes. Notable changes are:
* drop usb device reference across drivers
rtw89:
* add RTL8922DE but not enabled yet, because BT coexistence is still
cooking.
* add USB RX aggregation to improve performance.
* add USB TX flow control by tracking in-flight URBs.
----------------------------------------------------------------
Alexey Velichayshiy (1):
wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()
Bitterblue Smith (5):
wifi: rtw89: Turbo mode for RTL8851BU/RTL8852BU
wifi: rtw88: TX QOS Null data the same way as Null data
wifi: rtw88: coex: Ignore BT info byte 5 from RTL8821A
wifi: rtw88: Fill fw_version member of struct wiphy
wifi: rtw89: Fill fw_version member of struct wiphy
Chin-Yen Lee (3):
wifi: rtw89: wow: add retry for ensuring packet are processed
wifi: rtw89: wow: use struct style to fill WOW wakeup control H2C command
wifi: rtw89: wow: enable MLD address for Magic packet wakeup
Ching-Te Ku (1):
wifi: rtw88: coex: Solve LE-HID lag & update coex version to 26020420
Christian Hewitt (1):
wifi: rtw89: retry efuse physical map dump on transient failure
Christos Longros (1):
wifi: rtw89: fix typo "frome" -> "from" in rx_freq_frome_ie
Duoming Zhou (1):
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
Eric Huang (1):
wifi: rtw89: phy: expand PHY page for RTL8922D
Fedor Pchelkin (1):
wifi: rtw88: check for PCI upstream bridge existence
J. Neuschäfer (1):
wifi: rtl8xxxu: Mark RTL8188ETV (0bda:0179) as tested
Jaime Saguillo Revilla (1):
wifi: rtlwifi: rtl8192d: fix typo in H2C wait counter names
Johan Hovold (5):
wifi: rtl818x: drop redundant device reference
wifi: rtl8xxxu: drop redundant device reference
wifi: rtw88: fix device leak on probe failure
wifi: rtw89: drop redundant device reference
wifi: rtlwifi: usb: drop redundant device reference
Kuan-Chung Chen (1):
wifi: rtw89: add H2C command to protect TX/RX for unused PHY
Lucid Duck (1):
wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs
Ping-Ke Shih (29):
wifi: rtw89: fw: add fw_def struct to put firmware name and format version
wifi: rtw89: fw: recognize firmware type B by AID
wifi: rtw89: 8852b: update supported firmware format to 2
wifi: rtw89: rfk: add hardware version to rtw89_fw_h2c_rf_pre_ntfy_mcc for new WiFi 7 firmware
wifi: rtw89: pci: update SER parameters for suspend/resume
wifi: rtw89: mac: remove A-die off setting for RTL8852C and RTL8922A
wifi: rtw89: phy: limit AMPDU number for RA try rate
wifi: rtw88: add quirks to disable PCI ASPM and deep LPS for HP P3S95EA#ACB
wifi: rtw88: validate RX rate to prevent out-of-bound
wifi: rtw89: 8922d: add definition of quota, registers and efuse block
wifi: rtw89: 8922d: add power on/off functions
wifi: rtw89: 8922d: define efuse map and read necessary fields
wifi: rtw89: 8922d: read and configure RF by calibration data from efuse physical map
wifi: rtw89: 8922d: add set channel of MAC part
wifi: rtw89: 8922d: add set channel of BB part
wifi: rtw89: 8922d: add set channel of RF part
wifi: rtw89: pci: clear SER ISR when initial and leaving WoWLAN for WiFi 7 chips
wifi: rtw89: mac: add specific case to dump mac memory for RTL8922D
wifi: rtw89: mac: disable pre-load function for RTL8922DE
wifi: rtw89: phy: load RF parameters relying on ACV for RTL8922D
wifi: rtw89: 8922d: BB hardware pre-/post-init, TX/RX path and power settings
wifi: rtw89: 8922d: add set channel with pre-/post- helpers
wifi: rtw89: 8922d: add RF calibration ops
wifi: rtw89: 8922d: add set TX power callback
wifi: rtw89: 8922d: configure TX/RX path assisting in BT coexistence
wifi: rtw89: 8922d: add RF ops of init hardware and get thermal
wifi: rtw89: 8922d: add ops related to BT coexistence mechanism
wifi: rtw89: 8922d: add chip_info and chip_ops struct
wifi: rtw89: 8922d: add PCI ID of RTL8922DE and RTL8922DE-VS
Po-Hao Huang (2):
wifi: rtw89: Drop malformed AMPDU frames with abnormal PN
wifi: rtw89: Recalculate station aggregates when AMSDU length changes for MLO links
Shin-Yi Lin (1):
wifi: rtw89: usb: Rx aggregation for RTL8832CU/RTL8851BU
Yi Cong (1):
wifi: rtl8xxxu: fix potential use of uninitialized value
Zenm Chen (3):
wifi: rtw89: Add support for TP-Link Archer TX50U
wifi: rtw89: Add support for Buffalo WI-U3-2400XE2
wifi: rtw89: Add support for Elecom WDC-XE2402TU3-B
Zong-Zhe Yang (14):
wifi: rtw89: add general way to generate module firmware string
wifi: rtw89: 8852a: move DIG tables to rtw8852a.c
wifi: rtw89: 8852a: update supported firmware format to 1
wifi: rtw89: 8851b: update supported firmware format to 1
wifi: rtw89: debug: add SER SW counters to count simulation
wifi: rtw89: ser: Wi-Fi 7 reset HALT C2H after reading it
wifi: rtw89: ser: post-recover DMAC state to prevent LPS
wifi: rtw89: move disabling dynamic mechanism functions to core
wifi: rtw89: tweak settings of TX power and channel for Wi-Fi 7
wifi: rtw89: chan: simplify link handling related to ROC
wifi: rtw89: chan: recalc MLO DBCC mode based on current entity mode
wifi: rtw89: replace RF mutex with wiphy lock assertion
wifi: rtw89: debug: simulate Wi-Fi 7 SER L0/L1 without PS mode
wifi: rtw89: fw: load TX power elements according to AID
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 4 -
drivers/net/wireless/realtek/rtl8xxxu/core.c | 40 +-
drivers/net/wireless/realtek/rtlwifi/pci.c | 1 +
.../wireless/realtek/rtlwifi/rtl8192d/fw_common.c | 12 +-
drivers/net/wireless/realtek/rtlwifi/usb.c | 4 -
drivers/net/wireless/realtek/rtw88/coex.c | 47 +-
drivers/net/wireless/realtek/rtw88/main.c | 6 +
drivers/net/wireless/realtek/rtw88/main.h | 6 +
drivers/net/wireless/realtek/rtw88/pci.c | 34 +-
drivers/net/wireless/realtek/rtw88/rtw8703b.c | 5 +
drivers/net/wireless/realtek/rtw88/rtw8723d.c | 5 +
drivers/net/wireless/realtek/rtw88/rtw8821a.c | 7 +-
drivers/net/wireless/realtek/rtw88/rtw8821c.c | 7 +-
drivers/net/wireless/realtek/rtw88/rtw8822b.c | 5 +
drivers/net/wireless/realtek/rtw88/rtw8822c.c | 5 +-
drivers/net/wireless/realtek/rtw88/rx.c | 8 +
drivers/net/wireless/realtek/rtw88/tx.c | 2 +-
drivers/net/wireless/realtek/rtw88/usb.c | 3 +-
drivers/net/wireless/realtek/rtw89/chan.c | 72 +-
drivers/net/wireless/realtek/rtw89/core.c | 155 +-
drivers/net/wireless/realtek/rtw89/core.h | 105 +-
drivers/net/wireless/realtek/rtw89/debug.c | 53 +-
drivers/net/wireless/realtek/rtw89/efuse.c | 23 +-
drivers/net/wireless/realtek/rtw89/fw.c | 159 +-
drivers/net/wireless/realtek/rtw89/fw.h | 134 +-
drivers/net/wireless/realtek/rtw89/mac.c | 69 +-
drivers/net/wireless/realtek/rtw89/mac.h | 34 +-
drivers/net/wireless/realtek/rtw89/mac80211.c | 11 +
drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +
drivers/net/wireless/realtek/rtw89/pci.h | 7 +
drivers/net/wireless/realtek/rtw89/pci_be.c | 104 +-
drivers/net/wireless/realtek/rtw89/phy.c | 71 +-
drivers/net/wireless/realtek/rtw89/phy.h | 5 +
drivers/net/wireless/realtek/rtw89/phy_be.c | 2 +-
drivers/net/wireless/realtek/rtw89/ps.c | 2 +
drivers/net/wireless/realtek/rtw89/reg.h | 287 +-
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 49 +-
drivers/net/wireless/realtek/rtw89/rtw8851bu.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 68 +-
.../net/wireless/realtek/rtw89/rtw8852a_table.c | 51 -
.../net/wireless/realtek/rtw89/rtw8852a_table.h | 1 -
drivers/net/wireless/realtek/rtw89/rtw8852au.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 41 +-
drivers/net/wireless/realtek/rtw89/rtw8852bt.c | 15 +-
drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 1 +
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 17 +-
drivers/net/wireless/realtek/rtw89/rtw8852cu.c | 7 +
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 18 +-
drivers/net/wireless/realtek/rtw89/rtw8922d.c | 3093 ++++++++++++++++++++
drivers/net/wireless/realtek/rtw89/rtw8922d.h | 83 +
drivers/net/wireless/realtek/rtw89/rtw8922d_rfk.c | 372 +++
drivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h | 22 +
drivers/net/wireless/realtek/rtw89/rtw8922de.c | 119 +
drivers/net/wireless/realtek/rtw89/ser.c | 4 +-
drivers/net/wireless/realtek/rtw89/usb.c | 107 +-
drivers/net/wireless/realtek/rtw89/usb.h | 15 +
drivers/net/wireless/realtek/rtw89/util.h | 17 +
drivers/net/wireless/realtek/rtw89/wow.c | 2 +
drivers/net/wireless/realtek/rtw89/wow.h | 7 -
59 files changed, 5192 insertions(+), 415 deletions(-)
create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8922d.c
create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8922d.h
create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8922d_rfk.c
create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h
create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8922de.c
^ permalink raw reply
* Re: [PATCH v3 04/15] firmware: qcom: Add a PAS TEE service
From: Sumit Garg @ 2026-04-02 6:23 UTC (permalink / raw)
To: Harshal Dev
Cc: linux-arm-msm, devicetree, dri-devel, freedreno, linux-media,
netdev, linux-wireless, ath12k, linux-remoteproc, andersson,
konradybcio, robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo,
lumag, abhinav.kumar, jesszhan0024, marijn.suijten, airlied,
simona, vikash.garodia, dikshita.agarwal, bod, mchehab, elder,
andrew+netdev, davem, edumazet, kuba, pabeni, jjohnson,
mathieu.poirier, trilokkumar.soni, mukesh.ojha, pavan.kondeti,
jorge.ramirez, tonyh, vignesh.viswanathan, srinivas.kandagatla,
amirreza.zarrabi, jens.wiklander, op-tee, apurupa, skare,
linux-kernel, Sumit Garg
In-Reply-To: <000abdb5-a8b4-47c4-860b-5666e650b545@oss.qualcomm.com>
On Mon, Mar 30, 2026 at 04:06:47PM +0530, Harshal Dev wrote:
>
>
> On 3/27/2026 6:40 PM, Sumit Garg wrote:
> > From: Sumit Garg <sumit.garg@oss.qualcomm.com>
> >
> > Add support for Peripheral Authentication Service (PAS) driver based
> > on TEE bus with OP-TEE providing the backend PAS service implementation.
> >
> > The TEE PAS service ABI is designed to be extensible with additional API
> > as PTA_QCOM_PAS_CAPABILITIES. This allows to accommodate any future
> > extensions of the PAS service needed while still maintaining backwards
> > compatibility.
> >
> > Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > ---
> > drivers/firmware/qcom/Kconfig | 10 +
> > drivers/firmware/qcom/Makefile | 1 +
> > drivers/firmware/qcom/qcom_pas_tee.c | 478 +++++++++++++++++++++++++++
> > 3 files changed, 489 insertions(+)
> > create mode 100644 drivers/firmware/qcom/qcom_pas_tee.c
> >
> [...]
>
> > diff --git a/drivers/firmware/qcom/qcom_pas_tee.c b/drivers/firmware/qcom/qcom_pas_tee.c
> > new file mode 100644
> > index 000000000000..d63122c34f04
> > --- /dev/null
> > +++ b/drivers/firmware/qcom/qcom_pas_tee.c
> > @@ -0,0 +1,478 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
> > + */
> > +
> > +#include <linux/delay.h>
> > +#include <linux/of.h>
> > +#include <linux/firmware/qcom/qcom_pas.h>
> > +#include <linux/kernel.h>
> > +#include <linux/module.h>
> > +#include <linux/slab.h>
> > +#include <linux/tee_drv.h>
> > +#include <linux/uuid.h>
> > +
> > +#include "qcom_pas.h"
> > +
> > +/*
> > + * Peripheral Authentication Service (PAS) supported.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + */
> > +#define TA_QCOM_PAS_IS_SUPPORTED 1
> > +
> > +/*
> > + * PAS capabilities.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + * [out] params[1].value.a: PAS capability flags
> > + */
> > +#define TA_QCOM_PAS_CAPABILITIES 2
> > +
> > +/*
> > + * PAS image initialization.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + * [in] params[1].memref: Loadable firmware metadata
> > + */
> > +#define TA_QCOM_PAS_INIT_IMAGE 3
> > +
> > +/*
> > + * PAS memory setup.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + * [in] params[0].value.b: Relocatable firmware size
> > + * [in] params[1].value.a: 32bit LSB relocatable firmware memory address
> > + * [in] params[1].value.b: 32bit MSB relocatable firmware memory address
> > + */
> > +#define TA_QCOM_PAS_MEM_SETUP 4
> > +
> > +/*
> > + * PAS get resource table.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + * [inout] params[1].memref: Resource table config
> > + */
> > +#define TA_QCOM_PAS_GET_RESOURCE_TABLE 5
> > +
> > +/*
> > + * PAS image authentication and co-processor reset.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + * [in] params[0].value.b: Firmware size
> > + * [in] params[1].value.a: 32bit LSB firmware memory address
> > + * [in] params[1].value.b: 32bit MSB firmware memory address
> > + * [in] params[2].memref: Optional fw memory space shared/lent
> > + */
> > +#define TA_QCOM_PAS_AUTH_AND_RESET 6
> > +
> > +/*
> > + * PAS co-processor set suspend/resume state.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + * [in] params[0].value.b: Co-processor state identifier
> > + */
> > +#define TA_QCOM_PAS_SET_REMOTE_STATE 7
> > +
> > +/*
> > + * PAS co-processor shutdown.
> > + *
> > + * [in] params[0].value.a: Unique 32bit remote processor identifier
> > + */
> > +#define TA_QCOM_PAS_SHUTDOWN 8
> > +
> > +#define TEE_NUM_PARAMS 4
> > +
> > +/**
> > + * struct qcom_pas_tee_private - PAS service private data
> > + * @dev: PAS service device.
> > + * @ctx: TEE context handler.
> > + * @session_id: PAS TA session identifier.
>
> Nit: Column alignment of comment descriptions.
These are aligned if you look at them after applying the patch-set.
Plain email text isn't good at showing the alignment here.
>
> > + */
> > +struct qcom_pas_tee_private {
> > + struct device *dev;
> > + struct tee_context *ctx;
> > + u32 session_id;
> > +};
> > +
> > +static bool qcom_pas_tee_supported(struct device *dev, u32 pas_id)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_IS_SUPPORTED,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = pas_id
> > + }
> > + };
> > + int ret;
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS not supported, pas_id: %d, err: %x\n",
> > + pas_id, inv_arg.ret);
>
> I can see that similar error handling pattern for tee_client_invoke_func() is
> being done by other clients. But it seems that this error log doesn't really convey
> whether we failed before or after entering OPTEE (or some other TEE) for invoking
> the service.
>
> Could be better if we print 'ret' when ret < 0. And print 'inv_arg.ret' when
> inv_arg.ret != 0. So for example, if the param marshalling fails, or some other
> issue is encountered when processing the params in a different back-end TEE
> driver, we could know from the logs.
Okay, I will add print for "ret" as well.
>
> > + return false;
> > + }
> > +
> > + return true;
> > +}
> > +
> > +static int qcom_pas_tee_init_image(struct device *dev, u32 pas_id,
> > + const void *metadata, size_t size,
> > + struct qcom_pas_context *ctx)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_INIT_IMAGE,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = pas_id
> > + },
> > + [1] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT,
> > + }
> > + };
> > + struct tee_shm *mdata_shm;
> > + u8 *mdata_buf = NULL;
> > + int ret;
> > +
> > + if (!ctx)
> > + return -EINVAL;
> > +
> > + mdata_shm = tee_shm_alloc_kernel_buf(data->ctx, size);
>
> Why not move the DEFINE_FREE() above this function so we can use scoped free
> here as well for mdata_shm?
>
> struct tee_shm *mdata_shm __free(shm_free) = ...
mdata_shm gets freed as part of qcom_pas_tee_metadata_release(), so no
automatic free here.
>
> > + if (IS_ERR(mdata_shm)) {
> > + dev_err(dev, "mdata_shm allocation failed\n");
> > + return PTR_ERR(mdata_shm);
> > + }
> > +
> > + mdata_buf = tee_shm_get_va(mdata_shm, 0);
> > + if (IS_ERR(mdata_buf)) {
> > + dev_err(dev, "mdata_buf get VA failed\n");
> > + tee_shm_free(mdata_shm);
> > + return PTR_ERR(mdata_buf);
> > + }
> > + memcpy(mdata_buf, metadata, size);
> > +
> > + param[1].u.memref.shm = mdata_shm;
> > + param[1].u.memref.size = size;
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS init image failed, pas_id: %d, err: %x\n",
>
> Nit: We can prefix %x with 0x. "err: 0x%x\n."
Ack
>
> > + pas_id, inv_arg.ret);
> > + tee_shm_free(mdata_shm);
> > + return -EINVAL;
> > + }
> > + ctx->ptr = (void *)mdata_shm;
> > +
> > + return 0;
> > +}
> > +
> > +static int qcom_pas_tee_mem_setup(struct device *dev, u32 pas_id,
> > + phys_addr_t addr, phys_addr_t size)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_MEM_SETUP,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = pas_id,
> > + .u.value.b = size,
> > + },
> > + [1] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = lower_32_bits(addr),
> > + .u.value.b = upper_32_bits(addr),
> > + }
> > + };
> > + int ret;
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS mem setup failed, pas_id: %d, err: %x\n",
> > + pas_id, inv_arg.ret);
> > + return -EINVAL;
>
> I can see that originally in-case of error, qcom_scm_pas_mem_setup() bubbles
> up the return value from qcom_scm_call(). Perhaps we should do the same as well,
> return ret here instead of hard-coded '-EINVAL' which overrides any useful
> return values returned from the back-end TEE driver.
ret can even be 0 while still error from TEE. Let's rather do following:
return ret ? ret : -EINVAL;
>
> > + }
> > +
> > + return 0;
> > +}
> > +
> > +DEFINE_FREE(shm_free, struct tee_shm *, tee_shm_free(_T))
> > +
> > +static void *qcom_pas_tee_get_rsc_table(struct device *dev,
> > + struct qcom_pas_context *ctx,
> > + void *input_rt, size_t input_rt_size,
> > + size_t *output_rt_size)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_GET_RESOURCE_TABLE,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = ctx->pas_id,
> > + },
> > + [1] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT,
> > + .u.memref.size = input_rt_size,
> > + }
> > + };
> > + void *rt_buf = NULL;
> > + int ret;
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS get RT failed, pas_id: %d, err: %x\n",
> > + ctx->pas_id, inv_arg.ret);
> > + return ERR_PTR(-EINVAL);
>
> Same comment here, we could return ERR_PTR(ret) instead of overriding to
> '-EINVAL'.
>
> > + }
> > +
> > + if (param[1].u.memref.size) {
> > + struct tee_shm *rt_shm __free(shm_free) =
> > + tee_shm_alloc_kernel_buf(data->ctx,
> > + param[1].u.memref.size);
> > + void *rt_shm_va;
> > +
> > + if (IS_ERR(rt_shm)) {
> > + dev_err(dev, "rt_shm allocation failed\n");
> > + return rt_shm;
> > + }
> > +
> > + rt_shm_va = tee_shm_get_va(rt_shm, 0);
> > + if (IS_ERR_OR_NULL(rt_shm_va)) {
> > + dev_err(dev, "rt_shm get VA failed\n");
> > + return ERR_PTR(-EINVAL);
>
> Why not just return rt_shm_va? It already encodes the error in the pointer.
Again let me add a null check while returning rt_shm_va.
>
> > + }
> > + memcpy(rt_shm_va, input_rt, input_rt_size);
> > +
> > + param[1].u.memref.shm = rt_shm;
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS get RT failed, pas_id: %d, err: %x\n",
> > + ctx->pas_id, inv_arg.ret);
> > + return ERR_PTR(-EINVAL);
>
> Same comment.
>
> > + }
> > +
> > + if (param[1].u.memref.size) {
>
> Is it possible for param[1].u.memref.size to be 0 after a successful tee_client_invoke_func()?
Yeah it's possible if there is no resource table entry needed for a
particular PAS id.
>
> > + *output_rt_size = param[1].u.memref.size;
> > + rt_buf = kmemdup(rt_shm_va, *output_rt_size, GFP_KERNEL);
> > + if (!rt_buf)
> > + return ERR_PTR(-ENOMEM);
> > + }
> > + }
> > +
> > + return rt_buf;
> > +}
> > +
> > +static int __qcom_pas_tee_auth_and_reset(struct device *dev, u32 pas_id,
> > + phys_addr_t mem_phys, size_t mem_size)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_AUTH_AND_RESET,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = pas_id,
> > + .u.value.b = mem_size,
> > + },
> > + [1] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = lower_32_bits(mem_phys),
> > + .u.value.b = upper_32_bits(mem_phys),
> > + },
> > + /* Reserved for fw memory space to be shared or lent */
>
> Can you explain this comment a bit more? Plan is to allow passing a MEM_REF here
> which could be lent/shared to TEE via FFA ABI?
This param is added for future compatibility where PAS firmware is
loaded in arbitrarity allocated memory region by the kernel. Then that
can be shared or lend with TZ for authentication and reset sequence.
Right now the kernel is already loading the PAS firmware is fixed
reserved memory regions, for which this param is unused.
>
> > + [2] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT,
> > + }
> > + };
> > + int ret;
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS auth reset failed, pas_id: %d, err: %x\n",
> > + pas_id, inv_arg.ret);
> > + return -EINVAL;
> > + }
> > +
> > + return 0;
> > +}
> > +
> > +static int qcom_pas_tee_auth_and_reset(struct device *dev, u32 pas_id)
>
> I'm guessing once all clients have migrated to PAS, plan is to drop this wrapper?
Yeah, this patch-set doesn't aim to change the kernel client PAS API
contract apart from just renaming APIs. Surely future work can change
the PAS API contract as needed.
>
> > +{
> > + return __qcom_pas_tee_auth_and_reset(dev, pas_id, 0, 0);
> > +}
> > +
> > +static int qcom_pas_tee_prepare_and_auth_reset(struct device *dev,
> > + struct qcom_pas_context *ctx)
> > +{
> > + return __qcom_pas_tee_auth_and_reset(dev, ctx->pas_id, ctx->mem_phys,
> > + ctx->mem_size);
> > +}
> > +
> > +static int qcom_pas_tee_set_remote_state(struct device *dev, u32 state,
> > + u32 pas_id)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_SET_REMOTE_STATE,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = pas_id,
> > + .u.value.b = state,
> > + }
> > + };
> > + int ret;
>
> Nit: Why not ret = 0 initialize and always use ret?
zero init will still be redundant..
>
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS shutdown failed, pas_id: %d, err: %x\n",
> > + pas_id, inv_arg.ret);
> > + return -EINVAL;
> > + }
> > +
> > + return 0;
.. will rather change this to return ret.
> > +}
> > +
> > +static int qcom_pas_tee_shutdown(struct device *dev, u32 pas_id)
> > +{
> > + struct qcom_pas_tee_private *data = dev_get_drvdata(dev);
> > + struct tee_ioctl_invoke_arg inv_arg = {
> > + .func = TA_QCOM_PAS_SHUTDOWN,
> > + .session = data->session_id,
> > + .num_params = TEE_NUM_PARAMS
> > + };
> > + struct tee_param param[4] = {
> > + [0] = {
> > + .attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
> > + .u.value.a = pas_id
> > + }
> > + };
> > + int ret = 0;
> > +
> > + ret = tee_client_invoke_func(data->ctx, &inv_arg, param);
> > + if (ret < 0 || inv_arg.ret != 0) {
> > + dev_err(dev, "PAS shutdown failed, pas_id: %d, err: %x\n",
> > + pas_id, inv_arg.ret);
> > + return -EINVAL;
> > + }
> > +
> > + return 0;
>
> You could just return 'ret' here. :)
Ack.
>
> > +}
> > +
> > +static void qcom_pas_tee_metadata_release(struct device *dev,
> > + struct qcom_pas_context *ctx)
> > +{
> > + struct tee_shm *mdata_shm = ctx->ptr;
> > +
>
> Nit: Unnecessary extra line.
Extra line is recommended after variables declaration.
>
> > + tee_shm_free(mdata_shm);
> > +}
> > +
>
> [...]
>
> > +
> > +module_tee_client_driver(optee_pas_tee_driver);
> > +
> > +MODULE_LICENSE("GPL");
> > +MODULE_DESCRIPTION("TEE bus based Qualcomm PAS driver");
>
> Since this is a tee_client driver, isn't it self-explanatary that it's TEE bus based?
>
I can rather say:
MODULE_DESCRIPTION("Qualcomm PAS TEE driver");
-Sumit
^ permalink raw reply
* [PATCH] wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
From: Junrui Luo @ 2026-04-02 6:48 UTC (permalink / raw)
To: Miri Korenblit, Johannes Berg, Shaul Triebitz, Daniel Gabay,
Benjamin Berg
Cc: Anjaneyulu, Emmanuel Grumbach, linux-wireless, linux-kernel,
Yuhao Jiang, stable, Junrui Luo
Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a
station ID without checking that sta_mask is non-zero. When sta_mask is
zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing
an out-of-bounds access on fw_id_to_link_sta[].
Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call,
consistent with the existing check in iwl_mld_ampdu_rx_start().
Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
index 3bf36f8f6874..e3627ad0321c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c
@@ -64,6 +64,9 @@ static void iwl_mld_release_frames_from_notif(struct iwl_mld *mld,
}
/* pick any STA ID to find the pointer */
+ if (WARN_ON_ONCE(!ba_data->sta_mask))
+ goto out_unlock;
+
sta_id = ffs(ba_data->sta_mask) - 1;
link_sta = rcu_dereference(mld->fw_id_to_link_sta[sta_id]);
if (WARN_ON_ONCE(IS_ERR_OR_NULL(link_sta) || !link_sta->sta))
@@ -166,6 +169,9 @@ void iwl_mld_del_ba(struct iwl_mld *mld, int queue,
goto out_unlock;
/* pick any STA ID to find the pointer */
+ if (WARN_ON_ONCE(!ba_data->sta_mask))
+ goto out_unlock;
+
sta_id = ffs(ba_data->sta_mask) - 1;
link_sta = rcu_dereference(mld->fw_id_to_link_sta[sta_id]);
if (WARN_ON_ONCE(IS_ERR_OR_NULL(link_sta) || !link_sta->sta))
@@ -347,6 +353,9 @@ static void iwl_mld_rx_agg_session_expired(struct timer_list *t)
}
/* timer expired, pick any STA ID to find the pointer */
+ if (WARN_ON_ONCE(!ba_data->sta_mask))
+ goto unlock;
+
sta_id = ffs(ba_data->sta_mask) - 1;
link_sta = rcu_dereference(ba_data->mld->fw_id_to_link_sta[sta_id]);
---
base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d
change-id: 20260402-fixes-8758bb638a7c
Best regards,
--
Junrui Luo <moonafterrain@outlook.com>
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox