* [PATCH iwlwifi-next 09/15] wifi: iwlwifi: mld: rename LINK_DEBUGFS_WRITE_FILE_OPS
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
These are with wiphy mutex held, so rename the macro to
LINK_DEBUGFS_WIPHY_WRITE_FILE_OPS indicating that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
tested: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/debugfs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
index ba5a47519aa1..afe972834cb8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
@@ -979,7 +979,8 @@ void iwl_mld_add_vif_debugfs(struct ieee80211_hw *hw,
VIF_DEBUGFS_ADD_FILE(twt_operation, mld_vif_dbgfs, 0200);
VIF_DEBUGFS_ADD_FILE(int_mlo_scan, mld_vif_dbgfs, 0200);
}
-#define LINK_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
+
+#define LINK_DEBUGFS_WIPHY_WRITE_FILE_OPS(name, bufsz) \
WIPHY_DEBUGFS_WRITE_FILE_OPS(link_##name, bufsz, bss_conf)
#define LINK_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) \
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 10/15] wifi: iwlwifi: mld: add link and link station FW IDs to debugfs
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
Add the link and link station FW IDs to debugfs to aid debug
and testing, since assignments can't be known ahead of time,
especially with ID randomisation turned on.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
.../net/wireless/intel/iwlwifi/mld/debugfs.c | 50 +++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
index afe972834cb8..351a4f177e92 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/debugfs.c
@@ -983,12 +983,35 @@ void iwl_mld_add_vif_debugfs(struct ieee80211_hw *hw,
#define LINK_DEBUGFS_WIPHY_WRITE_FILE_OPS(name, bufsz) \
WIPHY_DEBUGFS_WRITE_FILE_OPS(link_##name, bufsz, bss_conf)
+/*
+ * Note: no locking is provided, so the function must have its own,
+ * but it cannot acquire the wiphy mutex.
+ */
+#define LINK_DEBUGFS_READ_FILE_OPS(name, bufsz) \
+ _MLD_DEBUGFS_READ_FILE_OPS(link_##name, bufsz, struct ieee80211_bss_conf)
+
#define LINK_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) \
debugfs_create_file(alias, mode, parent, link_conf, \
&iwl_dbgfs_link_##name##_ops)
#define LINK_DEBUGFS_ADD_FILE(name, parent, mode) \
LINK_DEBUGFS_ADD_FILE_ALIAS(#name, name, parent, mode)
+static ssize_t iwl_dbgfs_link_fw_id_read(struct ieee80211_bss_conf *link_conf,
+ size_t buflen, void *buf)
+{
+ struct iwl_mld_link *mld_link;
+
+ guard(rcu)();
+
+ mld_link = iwl_mld_link_from_mac80211(link_conf);
+ if (!mld_link)
+ return -EINVAL;
+
+ return scnprintf(buf, buflen, "%d\n", mld_link->fw_id);
+}
+
+LINK_DEBUGFS_READ_FILE_OPS(fw_id, 64);
+
void iwl_mld_add_link_debugfs(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
struct ieee80211_bss_conf *link_conf,
@@ -1009,6 +1032,8 @@ void iwl_mld_add_link_debugfs(struct ieee80211_hw *hw,
/* Release the reference from debugfs_lookup */
dput(mld_link_dir);
}
+
+ LINK_DEBUGFS_ADD_FILE(fw_id, mld_link_dir, 0400);
}
static ssize_t _iwl_dbgfs_fixed_rate_write(struct iwl_mld *mld, char *buf,
@@ -1092,6 +1117,21 @@ static ssize_t iwl_dbgfs_link_sta_tlc_dhc_write(struct iwl_mld *mld, char *buf,
return ret ? : count;
}
+static ssize_t
+iwl_dbgfs_link_sta_fw_id_read(struct ieee80211_link_sta *link_sta,
+ size_t buflen, void *buf)
+{
+ struct iwl_mld_link_sta *mld_link_sta;
+
+ guard(rcu)();
+
+ mld_link_sta = iwl_mld_link_sta_from_mac80211(link_sta);
+ if (!mld_link_sta)
+ return -EINVAL;
+
+ return scnprintf(buf, buflen, "%u\n", mld_link_sta->fw_id);
+}
+
#define LINK_STA_DEBUGFS_ADD_FILE_ALIAS(alias, name, parent, mode) \
debugfs_create_file(alias, mode, parent, link_sta, \
&iwl_dbgfs_link_sta_##name##_ops)
@@ -1101,9 +1141,18 @@ static ssize_t iwl_dbgfs_link_sta_tlc_dhc_write(struct iwl_mld *mld, char *buf,
#define LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(name, bufsz) \
WIPHY_DEBUGFS_WRITE_FILE_OPS(link_sta_##name, bufsz, link_sta)
+/*
+ * Note: no locking is provided, so the function must have its own,
+ * but it cannot acquire the wiphy mutex.
+ */
+#define LINK_STA_DEBUGFS_READ_OPS(name, bufsz) \
+ _MLD_DEBUGFS_READ_FILE_OPS(link_sta_##name, bufsz, \
+ struct ieee80211_link_sta)
+
LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(tlc_dhc, 64);
LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(fixed_rate, 64);
LINK_STA_WIPHY_DEBUGFS_WRITE_OPS(fixed_rate_v3, 64);
+LINK_STA_DEBUGFS_READ_OPS(fw_id, 64);
void iwl_mld_add_link_sta_debugfs(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
@@ -1113,4 +1162,5 @@ void iwl_mld_add_link_sta_debugfs(struct ieee80211_hw *hw,
LINK_STA_DEBUGFS_ADD_FILE(fixed_rate, dir, 0200);
LINK_STA_DEBUGFS_ADD_FILE(fixed_rate_v3, dir, 0200);
LINK_STA_DEBUGFS_ADD_FILE(tlc_dhc, dir, 0200);
+ LINK_STA_DEBUGFS_ADD_FILE(fw_id, dir, 0400);
}
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 11/15] wifi: iwlwifi: api: remove NAN_GROUP
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
This is no longer used by the driver nor supported by firmware,
and the kernel-doc reference to enum iwl_nan_subcmd_ids is long
dead. Remove it.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/commands.h | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
index dcac0ba8cccf..24bac3f00310 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
@@ -22,7 +22,6 @@
* &enum iwl_data_path_subcmd_ids
* @SCAN_GROUP: scan group, uses command IDs from
* &enum iwl_scan_subcmd_ids
- * @NAN_GROUP: NAN group, uses command IDs from &enum iwl_nan_subcmd_ids
* @LOCATION_GROUP: location group, uses command IDs from
* &enum iwl_location_subcmd_ids
* @BT_COEX_GROUP: bt coex group, uses command IDs from
@@ -43,7 +42,6 @@ enum iwl_mvm_command_groups {
PHY_OPS_GROUP = 0x4,
DATA_PATH_GROUP = 0x5,
SCAN_GROUP = 0x6,
- NAN_GROUP = 0x7,
LOCATION_GROUP = 0x8,
BT_COEX_GROUP = 0x9,
PROT_OFFLOAD_GROUP = 0xb,
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 12/15] wifi: iwlwifi: api: clean up/fix some kernel-doc references
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
Some of these structs just don't exist (any more), or other
versions should be referenced, clean that up.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/fw/api/commands.h | 7 +++----
drivers/net/wireless/intel/iwlwifi/fw/api/location.h | 7 ++++---
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
index 24bac3f00310..abd259350589 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/commands.h
@@ -57,8 +57,7 @@ enum iwl_legacy_cmds {
/**
* @UCODE_ALIVE_NTFY:
* Alive data from the firmware, as described in
- * &struct iwl_alive_ntf_v3 or &struct iwl_alive_ntf_v4 or
- * &struct iwl_alive_ntf_v5 or &struct iwl_alive_ntf_v7.
+ * &struct iwl_alive_ntf_v3 or &struct iwl_alive_ntf_v7.
*/
UCODE_ALIVE_NTFY = 0x1,
@@ -384,7 +383,7 @@ enum iwl_legacy_cmds {
* @STATISTICS_NOTIFICATION:
* one of &struct iwl_notif_statistics_v10,
* &struct iwl_notif_statistics_v11,
- * &struct iwl_notif_statistic,
+ * &struct iwl_notif_statistics,
* &struct iwl_statistics_operational_ntfy_ver_14
* &struct iwl_statistics_operational_ntfy
*/
@@ -558,7 +557,7 @@ enum iwl_legacy_cmds {
WOWLAN_CONFIGURATION = 0xe1,
/**
- * @WOWLAN_TSC_RSC_PARAM: &struct iwl_wowlan_rsc_tsc_params_cmd_v4,
+ * @WOWLAN_TSC_RSC_PARAM: &struct iwl_wowlan_rsc_tsc_params_cmd_ver_2,
* &struct iwl_wowlan_rsc_tsc_params_cmd
*/
WOWLAN_TSC_RSC_PARAM = 0xe2,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
index 2ee3a48aa5df..d3f774ffacde 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/location.h
@@ -2,7 +2,7 @@
/*
* Copyright (C) 2015-2017 Intel Deutschland GmbH
* Copyright (C) 2018-2022 Intel Corporation
- * Copyright (C) 2024-2025 Intel Corporation
+ * Copyright (C) 2024-2026 Intel Corporation
*/
#ifndef __iwl_fw_api_location_h__
#define __iwl_fw_api_location_h__
@@ -81,8 +81,9 @@ enum iwl_location_subcmd_ids {
* @TOF_RANGE_RESPONSE_NOTIF: ranging response, using one of
* &struct iwl_tof_range_rsp_ntfy_v5,
* &struct iwl_tof_range_rsp_ntfy_v6,
- * &struct iwl_tof_range_rsp_ntfy_v7 or
- * &struct iwl_tof_range_rsp_ntfy_v8
+ * &struct iwl_tof_range_rsp_ntfy_v7,
+ * &struct iwl_tof_range_rsp_ntfy_v9 or
+ * &struct iwl_tof_range_rsp_ntfy
*/
TOF_RANGE_RESPONSE_NOTIF = 0xFF,
};
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 13/15] wifi: iwlwifi: pcie: add two LNL PCI IDs
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
Add two PCI IDs for two WiFi-7 BE1735x Killer devices (these
are CRFs) so they work when put into the LNL platform.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index fdafbad506a7..b0c59181907e 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -537,6 +537,8 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pci_device_id iwl_hw_card_ids[] = {
{IWL_PCI_DEVICE(0xA840, 0x4314, iwl_bz_mac_cfg)},
{IWL_PCI_DEVICE(0xA840, 0x1775, iwl_bz_mac_cfg)},
{IWL_PCI_DEVICE(0xA840, 0x1776, iwl_bz_mac_cfg)},
+ {IWL_PCI_DEVICE(0xA840, 0x1735, iwl_bz_mac_cfg)},
+ {IWL_PCI_DEVICE(0xA840, 0x1736, iwl_bz_mac_cfg)},
{IWL_PCI_DEVICE(0x7740, PCI_ANY_ID, iwl_bz_mac_cfg)},
{IWL_PCI_DEVICE(0x4D40, PCI_ANY_ID, iwl_bz_mac_cfg)},
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 14/15] wifi: iwlwifi: mld: expose beacon avg signal
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Shahar Tzarfati, Miriam Rachel Korenblit
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Shahar Tzarfati <shahar.tzarfati@intel.com>
Store beacon_average_energy from per-link FW statistics and expose it
via station_info as rx_beacon_signal_avg in sta statistics.
This fixes missing beacon average signal reporting to upper layers.
Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com>
tested: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
PerCI-Ready: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Tested-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/link.h | 3 ++
.../net/wireless/intel/iwlwifi/mld/stats.c | 47 ++++++++++++++++++-
2 files changed, 48 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.h b/drivers/net/wireless/intel/iwlwifi/mld/link.h
index 4527f054ce92..0b3974d86531 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/link.h
+++ b/drivers/net/wireless/intel/iwlwifi/mld/link.h
@@ -36,6 +36,8 @@ struct iwl_probe_resp_data {
* @rcu_head: RCU head for freeing this data.
* @fw_id: the fw id of the link.
* @active: if the link is active or not.
+ * @avg_signal: The current average signal of beacons [dBm] retrieved from
+ * firmware per-link periodic stats (STATISTICS_OPER_NOTIF).
* @queue_params: QoS data from mac80211. This is updated with a call to
* drv_conf_tx per each AC, and then notified once with BSS_CHANGED_QOS.
* So we store it here and then send one link cmd for all the ACs.
@@ -68,6 +70,7 @@ struct iwl_mld_link {
struct_group(zeroed_on_hw_restart,
u8 fw_id;
bool active;
+ s8 avg_signal;
struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
struct ieee80211_chanctx_conf __rcu *chan_ctx;
bool he_ru_2mhz_block;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/stats.c b/drivers/net/wireless/intel/iwlwifi/mld/stats.c
index b93e0f8ab5fb..e7b283cbe199 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/stats.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/stats.c
@@ -311,6 +311,40 @@ static void iwl_mld_sta_stats_fill_txrate(struct iwl_mld_sta *mld_sta,
}
}
+static void iwl_mld_sta_stats_fill_beacon_signal_avg(struct ieee80211_vif *vif,
+ struct station_info *sinfo)
+{
+ struct ieee80211_bss_conf *link_conf;
+ struct iwl_mld_link *link;
+ u8 link_id;
+
+ if (iwl_mld_emlsr_active(vif))
+ return;
+
+ /* TODO: support statistics for NAN */
+ if (vif->type == NL80211_IFTYPE_NAN ||
+ vif->type == NL80211_IFTYPE_NAN_DATA)
+ return;
+
+ link_id = iwl_mld_get_primary_link(vif);
+ link_conf = link_conf_dereference_protected(vif, link_id);
+
+ if (WARN_ONCE(!link_conf,
+ "link_conf is NULL for link_id=%u\n", link_id))
+ return;
+
+ link = iwl_mld_link_from_mac80211(link_conf);
+ if (WARN_ONCE(!link,
+ "iwl_mld_link is NULL for link_id=%u\n", link_id))
+ return;
+
+ if (!link->avg_signal)
+ return;
+
+ sinfo->rx_beacon_signal_avg = link->avg_signal;
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG);
+}
+
void iwl_mld_mac80211_sta_statistics(struct ieee80211_hw *hw,
struct ieee80211_vif *vif,
struct ieee80211_sta *sta,
@@ -329,9 +363,9 @@ void iwl_mld_mac80211_sta_statistics(struct ieee80211_hw *hw,
iwl_mld_sta_stats_fill_txrate(mld_sta, sinfo);
- /* TODO: NL80211_STA_INFO_BEACON_RX */
+ iwl_mld_sta_stats_fill_beacon_signal_avg(vif, sinfo);
- /* TODO: NL80211_STA_INFO_BEACON_SIGNAL_AVG */
+ /* TODO: NL80211_STA_INFO_BEACON_RX */
}
#define IWL_MLD_TRAFFIC_LOAD_MEDIUM_THRESH 10 /* percentage */
@@ -443,6 +477,8 @@ iwl_mld_process_per_link_stats(struct iwl_mld *mld,
fw_id++) {
const struct iwl_stats_ntfy_per_link *link_stats;
struct ieee80211_bss_conf *bss_conf;
+ struct iwl_mld_link *link;
+ u32 avg_raw;
int sig;
bss_conf = iwl_mld_fw_id_to_link_conf(mld, fw_id);
@@ -456,6 +492,13 @@ iwl_mld_process_per_link_stats(struct iwl_mld *mld,
sig = -le32_to_cpu(link_stats->beacon_filter_average_energy);
iwl_mld_update_link_sig(bss_conf->vif, sig, bss_conf);
+ link = iwl_mld_link_from_mac80211(bss_conf);
+ if (WARN_ON_ONCE(!link))
+ continue;
+
+ avg_raw = le32_to_cpu(link_stats->beacon_average_energy);
+ link->avg_signal = clamp_t(int, -(int)avg_raw, S8_MIN, 0);
+
/* TODO: parse more fields here (task=statistics)*/
}
--
2.34.1
^ permalink raw reply related
* [PATCH iwlwifi-next 15/15] wifi: iwlwifi: mld: disallow puncturing in US/CA for WH
From: Miri Korenblit @ 2026-05-14 19:44 UTC (permalink / raw)
To: linux-wireless; +Cc: Pagadala Yesu Anjaneyulu, Emmanuel Grumbach
In-Reply-To: <20260514194434.401241-1-miriam.rachel.korenblit@intel.com>
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
FM continues to follow the BIOS/MCC policy, while WH sets
DISALLOW_PUNCTURING for US/CA and clears it for other MCC values.
Update the MCC handling accordingly.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mld/mcc.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mcc.c b/drivers/net/wireless/intel/iwlwifi/mld/mcc.c
index 16bb1b4904f9..8502129abe49 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mcc.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mcc.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2024-2025 Intel Corporation
+ * Copyright (C) 2024-2026 Intel Corporation
*/
#include <net/cfg80211.h>
@@ -129,7 +129,7 @@ iwl_mld_get_regdomain(struct iwl_mld *mld,
mld->mcc_src = resp->source_id;
- /* FM is the earliest supported and later always do puncturing */
+ /* FM follows BIOS/MCC policy, WH disallows puncturing only in US/CA. */
if (CSR_HW_RFID_TYPE(mld->trans->info.hw_rf_id) == IWL_CFG_RF_TYPE_FM) {
if (!iwl_puncturing_is_allowed_in_bios(mld->bios_enable_puncturing,
le16_to_cpu(resp->mcc)))
@@ -137,6 +137,15 @@ iwl_mld_get_regdomain(struct iwl_mld *mld,
else
__clear_bit(IEEE80211_HW_DISALLOW_PUNCTURING,
mld->hw->flags);
+ } else if (CSR_HW_RFID_TYPE(mld->trans->info.hw_rf_id) ==
+ IWL_CFG_RF_TYPE_WH) {
+ u16 mcc = le16_to_cpu(resp->mcc);
+
+ if (mcc == IWL_MCC_US || mcc == IWL_MCC_CANADA)
+ ieee80211_hw_set(mld->hw, DISALLOW_PUNCTURING);
+ else
+ __clear_bit(IEEE80211_HW_DISALLOW_PUNCTURING,
+ mld->hw->flags);
}
out:
--
2.34.1
^ permalink raw reply related
* [PATCH v3] wifi: ath11k: fix txpower in ap mode for 6 Ghz
From: Sebastian Gottschall @ 2026-05-14 20:27 UTC (permalink / raw)
To: ath11k; +Cc: linux-wireless, Sebastian Gottschall
there is an issue which has been discovered a while ago while testing
which killed txpower to 0 dBm once scanning is triggered in AP mode
on QCN9074 based chipsets if 6 GHz is in use.
ath11k_wmi_send_vdev_set_tpc_power must be set in AP mode in the same
way is it is for STA as it is implemented in ath12k and in the
qsdk version for ath11k.
this patch must be considered to be backported (i discovered that issue
already 2 years ago)
fixes: 74ef2d05ede63fd6416aa635aa8972dff901325f
(wifi: ath11k: use WMI_VDEV_SET_TPC_POWER_CMDID when EXT_TPC_REG_SUPPORT for 6 GHz)
changes:
v2: code formating fixes, take care about LPI setting in AP mode
v3: fix typo in email annotation
Signed-off-by: Sebastian Gottschall <s.gottschall@dd-wrt.com>
---
drivers/net/wireless/ath/ath11k/mac.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index a48b6bf1f29a..0984c3981ee4 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -3497,13 +3497,13 @@ static int ath11k_mac_config_obss_pd(struct ath11k *ar,
return 0;
}
-static bool ath11k_mac_supports_station_tpc(struct ath11k *ar,
- struct ath11k_vif *arvif,
- const struct cfg80211_chan_def *chandef)
+static bool ath11k_mac_supports_tpc(struct ath11k *ar, struct ath11k_vif *arvif,
+ const struct cfg80211_chan_def *chandef)
{
return ath11k_wmi_supports_6ghz_cc_ext(ar) &&
test_bit(WMI_TLV_SERVICE_EXT_TPC_REG_SUPPORT, ar->ab->wmi_ab.svc_map) &&
- arvif->vdev_type == WMI_VDEV_TYPE_STA &&
+ (arvif->vdev_type == WMI_VDEV_TYPE_STA ||
+ arvif->vdev_type == WMI_VDEV_TYPE_AP) &&
arvif->vdev_subtype == WMI_VDEV_SUBTYPE_NONE &&
chandef->chan &&
chandef->chan->band == NL80211_BAND_6GHZ;
@@ -7647,8 +7647,8 @@ ath11k_mac_vdev_start_restart(struct ath11k_vif *arvif,
/* TODO: For now we only set TPC power here. However when
* channel changes, say CSA, it should be updated again.
*/
- if (ath11k_mac_supports_station_tpc(ar, arvif, chandef)) {
- ath11k_mac_fill_reg_tpc_info(ar, arvif->vif, &arvif->chanctx);
+ if (ath11k_mac_supports_tpc(ar, arvif, chandef)) {
+ ath11k_mac_fill_reg_tpc_info(ar, arvif->vif, ctx);
ath11k_wmi_send_vdev_set_tpc_power(ar, arvif->vdev_id,
&arvif->reg_tpc_info);
}
@@ -8155,6 +8155,7 @@ void ath11k_mac_fill_reg_tpc_info(struct ath11k *ar,
psd_power, tx_power;
s8 eirp_power = 0;
u16 start_freq, center_freq;
+ u8 reg_6ghz_power_mode;
chan = ctx->def.chan;
start_freq = ath11k_mac_get_6ghz_start_frequency(&ctx->def);
@@ -8311,8 +8312,14 @@ void ath11k_mac_fill_reg_tpc_info(struct ath11k *ar,
reg_tpc_info->num_pwr_levels = num_pwr_levels;
reg_tpc_info->is_psd_power = is_psd_power;
reg_tpc_info->eirp_power = eirp_power;
+ if (arvif->vdev_type == WMI_VDEV_TYPE_STA)
+ reg_6ghz_power_mode = vif->bss_conf.power_type;
+ else
+ /* For now, LPI is the only supported AP power mode */
+ reg_6ghz_power_mode = IEEE80211_REG_LPI_AP;
+
reg_tpc_info->ap_power_type =
- ath11k_reg_ap_pwr_convert(vif->bss_conf.power_type);
+ ath11k_reg_ap_pwr_convert(reg_6ghz_power_mode);
}
static void ath11k_mac_parse_tx_pwr_env(struct ath11k *ar,
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2] wifi: ath11k: Add two missing Lenovo IDs to the quirk table
From: Jeff Johnson @ 2026-05-14 22:54 UTC (permalink / raw)
To: Kyle Farnung, Santiago Ruano Rincón
Cc: Jeff Johnson, linux-wireless, ath11k, linux-kernel, kfarnung,
Mark Pearson, koike
In-Reply-To: <CAOPSVF2xwpR63MmngbG06_wPtQe2tOoVe87fanzXGRHBeJGYUA@mail.gmail.com>
On 5/13/2026 10:01 PM, Kyle Farnung wrote:
> On Wed, May 13, 2026 at 10:57 AM Santiago Ruano Rincón
> <santiagorr@riseup.net> wrote:
>>
>> El 12/05/26 a las 20:30, Kyle Farnung escribió:
>>> On Tue, May 12, 2026 at 5:03 PM Jeff Johnson
>>> <jeff.johnson@oss.qualcomm.com> wrote:
>>>>
>>>> On 5/6/2026 12:54 PM, Santiago Ruano Rincón wrote:
>>>>> Commit 0eb002c93c3b4 ("wifi: ath11k: Add missing platform IDs for quirk
>>>>> table") added some Lenovo platform IDs to the quirk table to address a
>>>>> wakeup from suspend issue [1]. However, at least P14s Gen 5 AMD, as
>>>>> reported by Kyle Farnung [2], and P14s Gen 3 AMD are missing in the
>>>>> table. This commit adds the two corresponding Lenovo version IDs for
>>>>> each.
>>>>>
>>>>> [1] https://bugzilla.kernel.org/show_bug.cgi?id=219196
>>>>> [2] https://bugzilla.kernel.org/show_bug.cgi?id=219196#c23
>>>>>
>>>>> Tested-on: P14s G3 AMD running 7.0.3.
>>>>>
>>>>> Fixes: ce8669a27016 ("wifi: ath11k: determine PM policy based on machine model")
>>>>> Co-authored-by: Kyle Farnung <kfarnung@gmail.com>
>>>>
>>>> This is not a standard Linux kernel commit tag.
>>>> Co-developed-by: could be used, but I'd need a Signed-off-by: from Kyle
>>>>
>>>> Kyle, if you'd like these added please reply with both a Co-developed-by and
>>>> a Signed-off-by tag
>>>
>>> I re-tested the bug behavior on the v7.0.4 tag and found that I'm not able
>>> to reproduce it on my device. I put the device to sleep and then unplugged
>>> and replugged power; it never woke up until I intentionally woke it.
>>>
>>> Based on discussion in [3], I narrowed my issue with wi-fi disassociation
>>> on wake to a suspect commit [4]. I'm developing a patch that clears the rdp
>>> and wrp buffers during wake to clear out any stale state in the LMAC rings.
>>> I'll submit that once I'm done testing it.
>>>
>>> Santiago: Are you seeing the sleep/wake bug from [1] or something similar
>>> to what I was seeing around disconnections on wake?
>>
>> I was seeing wifi issues after wake-up, including disassociations, as
>> described at https://bugs.debian.org/1132343.
>
> Thanks for the confirmation. I went ahead and submitted a patch for the
> suspected SRNG restart issue in [5].
>
> For my P14s Gen 5 AMD, I don't think the PM quirk is the right fix at
> this point, so please don't include the 21ME/21MF IDs on my account for
> now. This new patch seems like a better match for the disassociation
> issue I was seeing after resume.
Based upon this I'm dropping this patch.
Santiago, if Kyle's patch doesn't fix your problem feel free to resubmit
adding just the quirks needed by your machine.
/jeff
^ permalink raw reply
* Re: [PATCH] wifi: ath11k: clear shared SRNG pointer state on restart
From: Kyle Farnung @ 2026-05-15 1:08 UTC (permalink / raw)
To: Jeff Johnson
Cc: Jeff Johnson, Muhammad Usama Anjum, Baochen Qiang, linux-wireless,
ath11k, linux-kernel, santiagorr, stable
In-Reply-To: <ddd1601d-2eef-4a52-af16-594223449c8c@oss.qualcomm.com>
On Thu, May 14, 2026 at 8:16 AM Jeff Johnson
<jeff.johnson@oss.qualcomm.com> wrote:
>
> On 5/13/2026 9:52 PM, Kyle Farnung via B4 Relay wrote:
> > From: Kyle Farnung <kfarnung@gmail.com>
> >
> > LMAC rings reuse the shared rdp/wrp pointer buffers without going
> > through the normal SRNG hw-init path that zeros non-LMAC ring
> > pointers. After restart, ath11k_hal_srng_clear() can therefore hand
> > stale hp/tp state from the previous firmware instance back to the new
> > one.
> >
> > Clear the shared pointer buffers while keeping the allocations in
> > place so restart still avoids reallocating SRNG DMA memory, but starts
> > with fresh ring-pointer state.
> >
> > Fixes: 32be3ca4cf78b ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again")
> > Cc: stable@vger.kernel.org
> > Link: https://lore.kernel.org/all/CAOPSVF04q6uvVdq8GTRLHBrVMdpt9=o9wVcFMc6f-yhmSBcZqQ@mail.gmail.com/
>
> I'm going to change this to a Closes: tag in my pending branch
Thanks, that all makes sense.
I'm still running the fix locally and haven't seen the issue again after 9
suspend/resume cycles.
>
> > Signed-off-by: Kyle Farnung <kfarnung@gmail.com>
> > ---
> > This patch is the result of investigating suspend/resume failures on a
> > Lenovo ThinkPad P14s Gen 5 AMD with ath11k.
> >
> > I originally proposed extending the existing ath11k PM quirk for this
> > platform, but after discussion in [1] and bisection the issue appears to
> > be a regression introduced by [2]. There is also a parallel report in [3]
> > that appears consistent with the same root cause. This patch keeps the
> > intended no-reallocation behavior from that change, but clears the
> > preserved shared SRNG pointer state so restart begins from a clean state.
> >
> > Testing so far has been limited to local suspend/resume cycling on the
> > affected system. The issue was originally reproduced on v7.0.4, and the
> > patch was also built and tested on top of ath-current with repeated
> > suspend/resume cycles on a Lenovo ThinkPad P14s Gen 5 AMD.
> >
> > [1] https://lore.kernel.org/all/CAOPSVF04q6uvVdq8GTRLHBrVMdpt9=o9wVcFMc6f-yhmSBcZqQ@mail.gmail.com/
> > [2] 32be3ca4cf78b ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again")
> > [3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132343
> > ---
> > drivers/net/wireless/ath/ath11k/hal.c | 13 ++++++++++---
> > 1 file changed, 10 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c
> > index e821e5a62c1c0..0c0aeb803018e 100644
> > --- a/drivers/net/wireless/ath/ath11k/hal.c
> > +++ b/drivers/net/wireless/ath/ath11k/hal.c
> > @@ -1387,14 +1387,21 @@ EXPORT_SYMBOL(ath11k_hal_srng_deinit);
> >
> > void ath11k_hal_srng_clear(struct ath11k_base *ab)
> > {
> > - /* No need to memset rdp and wrp memory since each individual
> > - * segment would get cleared in ath11k_hal_srng_src_hw_init()
> > - * and ath11k_hal_srng_dst_hw_init().
> > + /* Preserve the shared pointer buffers, but clear the previous
>
> Since you are touching it I'm going to change this from the obsolete
> networking block comment style to the universal block comment style with
> /* on a line by itself
>
> > + * firmware instance's hp/tp state before handing them back to FW.
> > + * LMAC rings reuse this shared memory without going through the
> > + * normal SRNG hw-init path that zeros non-LMAC ring pointers.
> > */
> > memset(ab->hal.srng_list, 0,
> > sizeof(ab->hal.srng_list));
> > memset(ab->hal.shadow_reg_addr, 0,
> > sizeof(ab->hal.shadow_reg_addr));
> > + if (ab->hal.rdp.vaddr)
> > + memset(ab->hal.rdp.vaddr, 0,
> > + sizeof(*ab->hal.rdp.vaddr) * HAL_SRNG_RING_ID_MAX);
> > + if (ab->hal.wrp.vaddr)
> > + memset(ab->hal.wrp.vaddr, 0,
> > + sizeof(*ab->hal.wrp.vaddr) * HAL_SRNG_NUM_LMAC_RINGS);
> > ab->hal.avail_blk_resource = 0;
> > ab->hal.current_blk_index = 0;
> > ab->hal.num_shadow_reg_configured = 0;
> >
> > ---
> > base-commit: 54a5b38e4396530e5b2f12b54d3844e860ab6784
> > change-id: 20260513-kfarnung-ath11k-srng-clear-pointer-state-91d8ab07e5e2
> >
> > Best regards,
>
^ permalink raw reply
* [PATCH rtw-next 00/13] wifi: rtw89: update SER, PCI, WoW and quota settings
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
Update many stuffs according to internal updates.
Patches 1-3 are related to SER, which is to simulate SER trigger and dump
more related registers for debugging.
Patches 4-6 are PCIE PHY settings.
Patch 7 is to clear (reset) calibration value of delay function.
Patch 8 is to keep connection alive in WoWLAN mode.
Patch 9 is used to correct logic to handle malformed AMPDU packets.
Patches 10-13 are to extend quota definition for RTL8922D, because there
are many variants with different quota values.
Chin-Yen Lee (1):
wifi: rtw89: wow: send ARP reply packets instead of Null packets to
keep alive
Dian-Syuan Yang (1):
wifi: rtw89: pci: enable LTR based on pcie control register
Ping-Ke Shih (7):
wifi: rtw89: pci: not disable PCI completion timeout control for a
variant of RTL8922DE
wifi: rtw89: pci: disable PCI PHY error flag 8
wifi: rtw89: clear auto K delay value before downloading firmware
wifi: rtw89: 8922d: change naming number and update values for WDE/PLE
quota
wifi: rtw89: mac: add field of release report size to DLE quota
wifi: rtw89: mac: consolidate quota into a struct for variant chips
wifi: rtw89: 8922d: add quota for RTL8922DE variant
Po-Hao Huang (1):
wifi: rtw89: correct drop logic for malformed AMPDU frames
Zong-Zhe Yang (3):
wifi: rtw89: debug: Wi-Fi 7 show count of SER L0 simulation
wifi: rtw89: debug: Wi-Fi 7 update simulation of SER L0/L1 by halt H2C
command
wifi: rtw89: fw: dump status of H2C command and C2H event for SER
drivers/net/wireless/realtek/rtw89/core.c | 3 +-
drivers/net/wireless/realtek/rtw89/core.h | 21 +++-
drivers/net/wireless/realtek/rtw89/debug.c | 107 ++++++++----------
drivers/net/wireless/realtek/rtw89/fw.c | 12 +-
drivers/net/wireless/realtek/rtw89/mac.c | 26 ++++-
drivers/net/wireless/realtek/rtw89/mac.h | 27 ++++-
drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +-
drivers/net/wireless/realtek/rtw89/mac_be.c | 7 ++
drivers/net/wireless/realtek/rtw89/pci.c | 30 ++++-
drivers/net/wireless/realtek/rtw89/pci.h | 4 +-
drivers/net/wireless/realtek/rtw89/pci_be.c | 3 +
drivers/net/wireless/realtek/rtw89/reg.h | 4 +
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 6 +-
.../net/wireless/realtek/rtw89/rtw8852bt.c | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 6 +-
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 7 +-
drivers/net/wireless/realtek/rtw89/rtw8922d.c | 96 +++++++++++++---
19 files changed, 275 insertions(+), 105 deletions(-)
base-commit: 4c13e00cc6798f8e63354982ec172b7829ae825a
--
2.25.1
^ permalink raw reply
* [PATCH rtw-next 01/13] wifi: rtw89: debug: Wi-Fi 7 show count of SER L0 simulation
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
From: Zong-Zhe Yang <kevin_yang@realtek.com>
Wi-Fi 7 has dedicated HW register to count SER L0 simulation, i.e.
manually triggered by users. Show count of it in dbgfs ser_counters.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/debug.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c
index 8ee800c76cfe..e5976b8e7056 100644
--- a/drivers/net/wireless/realtek/rtw89/debug.c
+++ b/drivers/net/wireless/realtek/rtw89/debug.c
@@ -3760,6 +3760,7 @@ rtw89_debug_priv_fw_crash_set(struct rtw89_dev *rtwdev,
}
struct rtw89_dbg_ser_counters {
+ unsigned int l0_sim;
unsigned int l0;
unsigned int l1;
unsigned int l0_to_l1;
@@ -3780,6 +3781,7 @@ static void rtw89_dbg_get_ser_counters_be(struct rtw89_dev *rtwdev,
{
const u32 val = rtw89_read32(rtwdev, R_BE_SER_DBG_INFO);
+ cnt->l0_sim = rtw89_read8(rtwdev, R_BE_SER_L0_DBG_CNT1 + 3);
cnt->l0 = u32_get_bits(val, B_BE_SER_L0_COUNTER_MASK);
cnt->l1 = u32_get_bits(val, B_BE_SER_L1_COUNTER_MASK);
cnt->l0_to_l1 = u32_get_bits(val, B_BE_SER_L0_PROMOTE_L1_EVENT_MASK);
@@ -3810,6 +3812,10 @@ static ssize_t rtw89_debug_priv_ser_counters_get(struct rtw89_dev *rtwdev,
p += scnprintf(p, end - p, "SER L1 SW Count: %u\n", sw_cnt->l1);
p += scnprintf(p, end - p, "SER L2 SW Count: %u\n", sw_cnt->l2);
+ /* Some chipsets don't have dedicated cnt for SER simulation. */
+ p += scnprintf(p, end - p, "---\n");
+ p += scnprintf(p, end - p, "SER L0 Simulation Count: %d\n", cnt.l0_sim);
+
/* Some chipsets won't record SER simulation in HW cnt. */
p += scnprintf(p, end - p, "---\n");
p += scnprintf(p, end - p, "SER L0 Count: %d\n", cnt.l0);
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 02/13] wifi: rtw89: debug: Wi-Fi 7 update simulation of SER L0/L1 by halt H2C command
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
From: Zong-Zhe Yang <kevin_yang@realtek.com>
Wi-Fi 7 FW fixes support of triggering SER L0/L1 simulation via halt H2C
command on v0.35.108.0. After that, the halt H2C command trigger for
Wi-Fi 6 and Wi-Fi 7 can be the same. Update FW feature table and share the
halt H2C command trigger function between Wi-Fi 6 and Wi-Fi 7.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/debug.c | 101 +++++++++------------
drivers/net/wireless/realtek/rtw89/fw.c | 2 +-
2 files changed, 45 insertions(+), 58 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c
index e5976b8e7056..c0fbb016cea4 100644
--- a/drivers/net/wireless/realtek/rtw89/debug.c
+++ b/drivers/net/wireless/realtek/rtw89/debug.c
@@ -3543,20 +3543,38 @@ rtw89_debug_priv_early_h2c_set(struct rtw89_dev *rtwdev,
return count;
}
-static int rtw89_dbg_trigger_l1_error_by_halt_h2c_ax(struct rtw89_dev *rtwdev)
+static int rtw89_dbg_trigger_l1_error_ax(struct rtw89_dev *rtwdev)
{
- if (!test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags))
- return -EBUSY;
+ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
+ struct rtw89_cpuio_ctrl ctrl_para = {};
+ u16 pkt_id;
+ int ret;
- return rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RESET_FORCE);
+ ret = mac->dle_buf_req(rtwdev, 0x20, true, &pkt_id);
+ if (ret)
+ return ret;
+
+ /* intentionally, enqueue two pkt, but has only one pkt id */
+ ctrl_para.cmd_type = CPUIO_OP_CMD_ENQ_TO_HEAD;
+ ctrl_para.start_pktid = pkt_id;
+ ctrl_para.end_pktid = pkt_id;
+ ctrl_para.pkt_num = 1; /* start from 0 */
+ ctrl_para.dst_pid = WDE_DLE_PORT_ID_WDRLS;
+ ctrl_para.dst_qid = WDE_DLE_QUEID_NO_REPORT;
+
+ if (mac->set_cpuio(rtwdev, &ctrl_para, true))
+ return -EFAULT;
+
+ return 0;
}
-static int rtw89_dbg_trigger_l1_error_by_halt_h2c_be(struct rtw89_dev *rtwdev)
+static int rtw89_dbg_trigger_l1_error_be(struct rtw89_dev *rtwdev)
{
- if (!test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags))
- return -EBUSY;
+ int ret;
- rtw89_leave_ps_mode(rtwdev);
+ ret = rtw89_mac_check_mac_en(rtwdev, RTW89_MAC_0, RTW89_DMAC_SEL);
+ if (ret)
+ return ret;
rtw89_write32_set(rtwdev, R_BE_FW_TRIGGER_IDCT_ISR,
B_BE_DMAC_FW_TRIG_IDCT | B_BE_DMAC_FW_ERR_IDCT_IMR);
@@ -3565,47 +3583,35 @@ static int rtw89_dbg_trigger_l1_error_by_halt_h2c_be(struct rtw89_dev *rtwdev)
}
static int rtw89_dbg_trigger_l1_error_by_halt_h2c(struct rtw89_dev *rtwdev)
+{
+ if (!test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags))
+ return -EBUSY;
+
+ return rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RESET_FORCE);
+}
+
+static int rtw89_dbg_trigger_l1_error(struct rtw89_dev *rtwdev)
{
const struct rtw89_chip_info *chip = rtwdev->chip;
+ int (*sim_l1)(struct rtw89_dev *rtwdev);
switch (chip->chip_gen) {
case RTW89_CHIP_AX:
- return rtw89_dbg_trigger_l1_error_by_halt_h2c_ax(rtwdev);
+ sim_l1 = rtw89_dbg_trigger_l1_error_ax;
+ break;
case RTW89_CHIP_BE:
- return rtw89_dbg_trigger_l1_error_by_halt_h2c_be(rtwdev);
+ sim_l1 = rtw89_dbg_trigger_l1_error_be;
+ break;
default:
return -EOPNOTSUPP;
}
-}
-
-static int rtw89_dbg_trigger_l1_error(struct rtw89_dev *rtwdev)
-{
- const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
- struct rtw89_cpuio_ctrl ctrl_para = {0};
- u16 pkt_id;
- int ret;
if (RTW89_CHK_FW_FEATURE(SIM_SER_L0L1_BY_HALT_H2C, &rtwdev->fw))
return rtw89_dbg_trigger_l1_error_by_halt_h2c(rtwdev);
rtw89_leave_ps_mode(rtwdev);
- ret = mac->dle_buf_req(rtwdev, 0x20, true, &pkt_id);
- if (ret)
- return ret;
-
- /* intentionally, enqueue two pkt, but has only one pkt id */
- ctrl_para.cmd_type = CPUIO_OP_CMD_ENQ_TO_HEAD;
- ctrl_para.start_pktid = pkt_id;
- ctrl_para.end_pktid = pkt_id;
- ctrl_para.pkt_num = 1; /* start from 0 */
- ctrl_para.dst_pid = WDE_DLE_PORT_ID_WDRLS;
- ctrl_para.dst_qid = WDE_DLE_QUEID_NO_REPORT;
-
- if (mac->set_cpuio(rtwdev, &ctrl_para, true))
- return -EFAULT;
-
- return 0;
+ return sim_l1(rtwdev);
}
static int rtw89_dbg_trigger_l0_error_ax(struct rtw89_dev *rtwdev)
@@ -3632,22 +3638,19 @@ static int rtw89_dbg_trigger_l0_error_ax(struct rtw89_dev *rtwdev)
static int rtw89_dbg_trigger_l0_error_be(struct rtw89_dev *rtwdev)
{
- u8 val8;
int ret;
ret = rtw89_mac_check_mac_en(rtwdev, RTW89_MAC_0, RTW89_CMAC_SEL);
if (ret)
return ret;
- val8 = rtw89_read8(rtwdev, R_BE_CMAC_FUNC_EN);
- rtw89_write8(rtwdev, R_BE_CMAC_FUNC_EN, val8 & ~B_BE_TMAC_EN);
- mdelay(1);
- rtw89_write8(rtwdev, R_BE_CMAC_FUNC_EN, val8);
+ rtw89_write32_set(rtwdev, R_BE_CMAC_FW_TRIGGER_IDCT_ISR,
+ B_BE_CMAC_FW_TRIG_IDCT | B_BE_CMAC_FW_ERR_IDCT_IMR);
return 0;
}
-static int rtw89_dbg_trigger_l0_error_by_halt_h2c_ax(struct rtw89_dev *rtwdev)
+static int rtw89_dbg_trigger_l0_error_by_halt_h2c(struct rtw89_dev *rtwdev)
{
if (!test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags))
return -EBUSY;
@@ -3655,32 +3658,16 @@ static int rtw89_dbg_trigger_l0_error_by_halt_h2c_ax(struct rtw89_dev *rtwdev)
return rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L0_RESET_FORCE);
}
-static int rtw89_dbg_trigger_l0_error_by_halt_h2c_be(struct rtw89_dev *rtwdev)
-{
- if (!test_bit(RTW89_FLAG_FW_RDY, rtwdev->flags))
- return -EBUSY;
-
- rtw89_leave_ps_mode(rtwdev);
-
- rtw89_write32_set(rtwdev, R_BE_CMAC_FW_TRIGGER_IDCT_ISR,
- B_BE_CMAC_FW_TRIG_IDCT | B_BE_CMAC_FW_ERR_IDCT_IMR);
-
- return 0;
-}
-
static int rtw89_dbg_trigger_l0_error(struct rtw89_dev *rtwdev)
{
const struct rtw89_chip_info *chip = rtwdev->chip;
- int (*sim_l0_by_halt_h2c)(struct rtw89_dev *rtwdev);
int (*sim_l0)(struct rtw89_dev *rtwdev);
switch (chip->chip_gen) {
case RTW89_CHIP_AX:
- sim_l0_by_halt_h2c = rtw89_dbg_trigger_l0_error_by_halt_h2c_ax;
sim_l0 = rtw89_dbg_trigger_l0_error_ax;
break;
case RTW89_CHIP_BE:
- sim_l0_by_halt_h2c = rtw89_dbg_trigger_l0_error_by_halt_h2c_be;
sim_l0 = rtw89_dbg_trigger_l0_error_be;
break;
default:
@@ -3688,7 +3675,7 @@ static int rtw89_dbg_trigger_l0_error(struct rtw89_dev *rtwdev)
}
if (RTW89_CHK_FW_FEATURE(SIM_SER_L0L1_BY_HALT_H2C, &rtwdev->fw))
- return sim_l0_by_halt_h2c(rtwdev);
+ return rtw89_dbg_trigger_l0_error_by_halt_h2c(rtwdev);
rtw89_leave_ps_mode(rtwdev);
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index ff3914a16b81..c5a598a507f4 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -931,8 +931,8 @@ static const struct __fw_feat_cfg fw_feat_tbl[] = {
__CFG_FW_FEAT(RTL8922A, ge, 0, 35, 84, 0, RFK_PRE_NOTIFY_MCC_V1),
__CFG_FW_FEAT(RTL8922A, lt, 0, 35, 84, 0, ADDR_CAM_V0),
__CFG_FW_FEAT(RTL8922A, ge, 0, 35, 92, 0, TX_HISTORY_V1),
- __CFG_FW_FEAT(RTL8922A, ge, 0, 35, 97, 0, SIM_SER_L0L1_BY_HALT_H2C),
__CFG_FW_FEAT(RTL8922A, ge, 0, 35, 100, 0, SER_POST_RECOVER_DMAC),
+ __CFG_FW_FEAT(RTL8922A, ge, 0, 35, 108, 0, SIM_SER_L0L1_BY_HALT_H2C),
};
static void rtw89_fw_iterate_feature_cfg(struct rtw89_fw_info *fw,
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 03/13] wifi: rtw89: fw: dump status of H2C command and C2H event for SER
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
From: Zong-Zhe Yang <kevin_yang@realtek.com>
When SER (system error recovery) happens, there may be some handshake
between FW and SW, e.g. SER Level 1. These handshake are based on H2C
commands and C2H events. Dump the status of them to enhance SER debug.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/fw.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index c5a598a507f4..29d8d13d11fe 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -8293,6 +8293,12 @@ void rtw89_fw_st_dbg_dump(struct rtw89_dev *rtwdev)
rtw89_info(rtwdev, "FW MISC = 0x%x\n", rtw89_read32(rtwdev, R_AX_UDM3));
rtw89_info(rtwdev, "R_AX_HALT_C2H = 0x%x\n",
rtw89_read32(rtwdev, R_AX_HALT_C2H));
+ rtw89_info(rtwdev, "R_AX_HALT_C2H_CTRL = 0x%x\n",
+ rtw89_read32(rtwdev, R_AX_HALT_C2H_CTRL));
+ rtw89_info(rtwdev, "R_AX_HALT_H2C = 0x%x\n",
+ rtw89_read32(rtwdev, R_AX_HALT_H2C));
+ rtw89_info(rtwdev, "R_AX_HALT_H2C_CTRL = 0x%x\n",
+ rtw89_read32(rtwdev, R_AX_HALT_H2C_CTRL));
rtw89_info(rtwdev, "R_AX_SER_DBG_INFO = 0x%x\n",
rtw89_read32(rtwdev, R_AX_SER_DBG_INFO));
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 04/13] wifi: rtw89: pci: enable LTR based on pcie control register
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
Originally, driver always transmits LTR (Latency Tolerance Reporting) to
pcie host, but it may cause pcie link down on some platforms because
LTR is not supported. As a result, driver will check the control
register of LTR setting to decide whether to enable LTR feature.
This applies to Wi-Fi 6 chips only. For Wi-Fi 7 chips, although the
driver still issues LTR, the hardware has its own internal logic
to determine whether to actually transmit it to pcie host.
Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/pci.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
index 64554eb35a72..f7107dc05b71 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -3039,6 +3039,17 @@ static int rtw89_pci_mode_op(struct rtw89_dev *rtwdev)
return 0;
}
+static bool rtw89_pci_dev_ltr_enabled(struct rtw89_dev *rtwdev)
+{
+ struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv;
+ struct pci_dev *pdev = rtwpci->pdev;
+ u16 cap;
+
+ pcie_capability_read_word(pdev, PCI_EXP_DEVCTL2, &cap);
+
+ return !!(cap & PCI_EXP_DEVCTL2_LTR_EN);
+}
+
static int rtw89_pci_ops_deinit(struct rtw89_dev *rtwdev)
{
const struct rtw89_pci_info *info = rtwdev->pci_info;
@@ -3143,7 +3154,7 @@ int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en)
{
u32 val;
- if (!en)
+ if (!en || !rtw89_pci_dev_ltr_enabled(rtwdev))
return 0;
val = rtw89_read32(rtwdev, R_AX_LTR_CTRL_0);
@@ -3179,6 +3190,9 @@ int rtw89_pci_ltr_set_v1(struct rtw89_dev *rtwdev, bool en)
u32 dec_ctrl;
u32 val32;
+ if (!rtw89_pci_dev_ltr_enabled(rtwdev))
+ return 0;
+
val32 = rtw89_read32(rtwdev, R_AX_LTR_CTRL_0);
if (rtw89_pci_ltr_is_err_reg_val(val32))
return -EINVAL;
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 05/13] wifi: rtw89: pci: not disable PCI completion timeout control for a variant of RTL8922DE
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
The variant of RTL8922DE change the design, and no need to disable PCI
completion timeout. Apply the setting accordingly.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/pci.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
index f7107dc05b71..fe1152c560bd 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -4380,10 +4380,20 @@ static void rtw89_pci_l1ss_cfg(struct rtw89_dev *rtwdev)
static void rtw89_pci_cpl_timeout_cfg(struct rtw89_dev *rtwdev)
{
struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv;
+ enum rtw89_core_chip_id chip_id = rtwdev->chip->chip_id;
+ struct rtw89_hal *hal = &rtwdev->hal;
struct pci_dev *pdev = rtwpci->pdev;
+ bool dis = true;
+
+ if (chip_id == RTL8922D && hal->cid == RTL8922D_CID7090)
+ dis = false;
- pcie_capability_set_word(pdev, PCI_EXP_DEVCTL2,
- PCI_EXP_DEVCTL2_COMP_TMOUT_DIS);
+ if (dis)
+ pcie_capability_set_word(pdev, PCI_EXP_DEVCTL2,
+ PCI_EXP_DEVCTL2_COMP_TMOUT_DIS);
+ else
+ pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL2,
+ PCI_EXP_DEVCTL2_COMP_TMOUT_DIS);
}
static int rtw89_pci_poll_io_idle_ax(struct rtw89_dev *rtwdev)
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 06/13] wifi: rtw89: pci: disable PCI PHY error flag 8
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
As the PHY error flag 8 works improperly, disable it to prevent false
alarm causing SER.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/pci.h | 4 +++-
drivers/net/wireless/realtek/rtw89/pci_be.c | 3 +++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h
index d0d1e2b99698..c3f2d0df5846 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.h
+++ b/drivers/net/wireless/realtek/rtw89/pci.h
@@ -58,7 +58,7 @@
#define B_AX_DIV GENMASK(15, 14)
#define RAC_SET_PPR_V1 0x31
#define RAC_ANA40 0x40
-#define PHY_ERR_IMR_DIS (BIT(9) | BIT(0))
+#define PHY_ERR_IMR_DIS (BIT(9) | BIT(8) | BIT(0))
#define RAC_ANA41 0x41
#define PHY_ERR_FLAG_EN BIT(6)
@@ -963,6 +963,8 @@
#define R_BE_PCIE_HRPWM 0x30C0
#define R_BE_PCIE_CRPWM 0x30C4
+#define R_BE_PCIE_HCI2FW_ISR 0x30CC
+
#define R_BE_L1_2_CTRL_HCILDO 0x3110
#define B_BE_PM_CLKREQ_EXT_RB BIT(11)
#define B_BE_PCIE_DIS_RTK_PRST_N_L1_2 BIT(10)
diff --git a/drivers/net/wireless/realtek/rtw89/pci_be.c b/drivers/net/wireless/realtek/rtw89/pci_be.c
index 473d491eb3f4..6390980b8ee0 100644
--- a/drivers/net/wireless/realtek/rtw89/pci_be.c
+++ b/drivers/net/wireless/realtek/rtw89/pci_be.c
@@ -347,6 +347,7 @@ static void rtw89_pci_pcie_setting_be(struct rtw89_dev *rtwdev)
rtw89_write32_set(rtwdev, R_BE_RSV_CTRL, B_BE_R_SYM_PRST_CPHY_RST);
rtw89_write32_set(rtwdev, R_BE_SYS_PW_CTRL, B_BE_USUS_OFFCAPC_EN);
+ rtw89_write32(rtwdev, R_BE_PCIE_HCI2FW_ISR, 0xFFFFFFFF);
}
static void rtw89_pci_ser_setting_be(struct rtw89_dev *rtwdev)
@@ -843,6 +844,8 @@ static int __maybe_unused rtw89_pci_resume_be(struct device *dev)
rtw89_write16_set(rtwdev, RAC_DIRECT_OFFESET_L0_G1 +
RAC_ANA41 * RAC_MULT, PHY_ERR_FLAG_EN);
}
+
+ rtw89_write32(rtwdev, R_BE_PCIE_HCI2FW_ISR, 0xFFFFFFFF);
}
rtw89_pci_basic_cfg(rtwdev, true);
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 07/13] wifi: rtw89: clear auto K delay value before downloading firmware
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
Once downloading firmware, do calibration on delay function to ensure
firmware can do proper delay for hardware IO.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/mac.c | 3 +++
drivers/net/wireless/realtek/rtw89/mac.h | 12 ++++++++++++
drivers/net/wireless/realtek/rtw89/mac_be.c | 7 +++++++
drivers/net/wireless/realtek/rtw89/reg.h | 4 ++++
4 files changed, 26 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 87e3320b5a81..6153162ad9b0 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -4318,6 +4318,8 @@ int rtw89_mac_partial_init(struct rtw89_dev *rtwdev, bool include_bb)
return ret;
}
+ rtw89_mac_fwdl_preconfig(rtwdev);
+
ret = rtw89_fw_download(rtwdev, RTW89_FW_NORMAL, include_bb);
if (ret)
return ret;
@@ -7477,6 +7479,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = {
.reset_pwr_state = rtw89_mac_reset_pwr_state_ax,
.disable_cpu = rtw89_mac_disable_cpu_ax,
+ .fwdl_preconfig = NULL,
.fwdl_enable_wcpu = rtw89_mac_enable_cpu_ax,
.fwdl_get_status = rtw89_fw_get_rdy_ax,
.fwdl_check_path_ready = rtw89_fwdl_check_path_ready_ax,
diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
index 75691a9549a7..69f8d7d818a0 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.h
+++ b/drivers/net/wireless/realtek/rtw89/mac.h
@@ -1112,6 +1112,7 @@ struct rtw89_mac_gen_def {
int (*reset_pwr_state)(struct rtw89_dev *rtwdev);
void (*disable_cpu)(struct rtw89_dev *rtwdev);
+ void (*fwdl_preconfig)(struct rtw89_dev *rtwdev);
int (*fwdl_enable_wcpu)(struct rtw89_dev *rtwdev, u8 boot_reason,
bool dlfw, bool include_bb);
u8 (*fwdl_get_status)(struct rtw89_dev *rtwdev, enum rtw89_fwdl_check_type type);
@@ -1725,6 +1726,17 @@ static inline int rtw89_mac_efuse_read_ecv(struct rtw89_dev *rtwdev)
return mac->efuse_read_ecv(rtwdev);
}
+static inline
+void rtw89_mac_fwdl_preconfig(struct rtw89_dev *rtwdev)
+{
+ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
+
+ if (!mac->fwdl_preconfig)
+ return;
+
+ mac->fwdl_preconfig(rtwdev);
+}
+
static inline
void rtw89_fwdl_secure_idmem_share_mode(struct rtw89_dev *rtwdev, u8 mode)
{
diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
index dd0dbe78a1ed..f24c119b99f1 100644
--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
+++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
@@ -622,6 +622,12 @@ static void rtw89_mac_disable_cpu_be(struct rtw89_dev *rtwdev)
rtw89_write32(rtwdev, R_BE_UDM2, 0);
}
+static void rtw89_mac_fwdl_preconfig_be(struct rtw89_dev *rtwdev)
+{
+ rtw89_write32_clr(rtwdev, R_BE_FW_AUTO_CAL_DELAY, B_BE_WCPU_FW_DELAY_COUNT_VALID);
+ rtw89_write32_mask(rtwdev, R_BE_FW_AUTO_CAL_DELAY, B_BE_WCPU_FW_DELAY_COUNT_MASK, 0);
+}
+
static void set_cpu_en(struct rtw89_dev *rtwdev, bool include_bb)
{
u32 set = B_BE_WLANCPU_FWDL_EN;
@@ -3288,6 +3294,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = {
.reset_pwr_state = rtw89_mac_reset_pwr_state_be,
.disable_cpu = rtw89_mac_disable_cpu_be,
+ .fwdl_preconfig = rtw89_mac_fwdl_preconfig_be,
.fwdl_enable_wcpu = rtw89_mac_fwdl_enable_wcpu_be,
.fwdl_get_status = fwdl_get_status_be,
.fwdl_check_path_ready = rtw89_fwdl_check_path_ready_be,
diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h
index 716747c3a10e..226664615c5e 100644
--- a/drivers/net/wireless/realtek/rtw89/reg.h
+++ b/drivers/net/wireless/realtek/rtw89/reg.h
@@ -4329,6 +4329,10 @@
#define R_BE_SECURE_BOOT_MALLOC_INFO 0x0184
+#define R_BE_FW_AUTO_CAL_DELAY 0x0188
+#define B_BE_WCPU_FW_DELAY_COUNT_VALID BIT(15)
+#define B_BE_WCPU_FW_DELAY_COUNT_MASK GENMASK(14, 0)
+
#define R_BE_FWS0IMR 0x0190
#define B_BE_FS_HALT_H2C_INT_EN BIT(31)
#define B_BE_FS_FSM_HIOE_TO_EVENT_INT_EN BIT(30)
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 08/13] wifi: rtw89: wow: send ARP reply packets instead of Null packets to keep alive
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
From: Chin-Yen Lee <timlee@realtek.com>
In WoWLAN mode, the firmware periodically sends Null packets to the AP
to keep the connection alive and prevent the AP from disconnecting the
client due to inactivity. However, it was observed that certain APs,
such as TP-Link Archer BE800, do not recognize Null packets as
valid activity and still drop the connection. Replacing Null packets
with ARP reply packets effectively resolves this compatibility issue
and maintains the connection.
Specifically, while the firmware typically handles standard ARP
offloads by dynamically modifying target IP/MAC fields, these
keep-alive ARP reply packets are pre-filled by the driver with the
DUT's own MAC and IP addresses for both sender and target fields.
In this case, the firmware transmits the packets as-is without
further modification. This approach ensures compatibility with APs
that require valid Layer 3 traffic for activity monitoring while
simplifying the firmware's processing logic during WoWLAN mode.
Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/fw.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 29d8d13d11fe..eb5683d64461 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -2958,6 +2958,8 @@ static struct sk_buff *rtw89_arp_response_get(struct rtw89_dev *rtwdev,
ether_addr_copy(arp_skb->sender_hw, rtwvif_link->mac_addr);
arp_skb->sender_ip = rtwvif->ip_addr;
+ ether_addr_copy(arp_skb->target_hw, rtwvif_link->mac_addr);
+ arp_skb->target_ip = rtwvif->ip_addr;
return skb;
}
@@ -9617,7 +9619,7 @@ int rtw89_fw_h2c_keep_alive(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtw
if (enable) {
ret = rtw89_fw_h2c_add_general_pkt(rtwdev, rtwvif_link,
- RTW89_PKT_OFLD_TYPE_NULL_DATA,
+ RTW89_PKT_OFLD_TYPE_ARP_RSP,
&pkt_id);
if (ret)
return -EPERM;
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 09/13] wifi: rtw89: correct drop logic for malformed AMPDU frames
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
From: Po-Hao Huang <phhuang@realtek.com>
The previous commit aims to fix issue caused by malformed AMPDU frames.
But the drop logic fails to deal with the first AMPDU packet paired with
certain range of sequence number, and leads to unexpected packet drop.
It is more likely to encounter this failure when there are busy traffic
during rekey process and could lead to disconnection from the AP.
Fix this by adding a initial state judgement and only reset status
during pairwise rekey.
Fixes: bda294ed0ed0 ("wifi: rtw89: Drop malformed AMPDU frames with abnormal PN")
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
drivers/net/wireless/realtek/rtw89/mac80211.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 432d46dfd26a..533b83c32f8d 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -3948,7 +3948,8 @@ static bool rtw89_core_skb_pn_valid(struct rtw89_dev *rtwdev,
last_pn = tid_stats->last_pn;
if (pn > last_pn) {
- if (ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) {
+ if (last_pn != -1LL &&
+ ieee80211_sn_less(mpdu_sn, tid_stats->last_sn)) {
dev_kfree_skb_any(skb);
return false;
diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index 330ece51286d..aade5c5b79e8 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -979,7 +979,8 @@ static int rtw89_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
rtw89_err(rtwdev, "failed to add key to sec cam\n");
return ret;
}
- rtw89_core_tid_rx_stats_reset(rtwdev);
+ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+ rtw89_core_tid_rx_stats_reset(rtwdev);
break;
case DISABLE_KEY:
flush_work(&rtwdev->txq_work);
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 10/13] wifi: rtw89: 8922d: change naming number and update values for WDE/PLE quota
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
The WDE/PLE quota are to configure memory size for TX/RX. Some quota are
renamed, and some values are changed. Update them accordingly.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/mac.c | 7 ++++---
drivers/net/wireless/realtek/rtw89/mac.h | 7 ++++---
drivers/net/wireless/realtek/rtw89/rtw8922d.c | 18 ++++++++----------
3 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 6153162ad9b0..8df1b9af719d 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -1847,18 +1847,19 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.ple_qt28 = {1040, 0, 32, 48, 43, 13, 208, 0, 62, 14, 24, 0,},
/* USB 52C USB3.0 */
.ple_qt42 = {1068, 0, 16, 48, 4, 13, 178, 0, 16, 1, 8, 16, 0,},
- .ple_qt42_v2 = {91, 91, 32, 16, 19, 13, 91, 91, 44, 18, 1, 4, 0, 0,},
/* USB 52C USB3.0 */
.ple_qt43 = {3068, 0, 32, 48, 4, 13, 178, 0, 16, 1, 8, 16, 0,},
- .ple_qt43_v2 = {645, 645, 32, 16, 2062, 2056, 2134, 2134, 2087, 2061, 1, 2047, 0, 0,},
/* DLFW 52C */
.ple_qt44 = {0, 0, 16, 256, 0, 0, 0, 0, 0, 0, 0, 0,},
+ .ple_qt44_v2 = {91, 91, 32, 16, 19, 13, 91, 91, 44, 18, 1, 4, 0, 0,},
/* DLFW 52C */
.ple_qt45 = {0, 0, 32, 256, 0, 0, 0, 0, 0, 0, 0, 0,},
+ .ple_qt45_v2 = {645, 645, 32, 2055, 2058, 2052, 2132, 2132, 2083, 2057, 1, 2043, 0, 0,},
/* 8852C PCIE SCC */
.ple_qt46 = {525, 0, 16, 20, 13, 13, 178, 0, 32, 62, 8, 16,},
/* 8852C PCIE SCC */
.ple_qt47 = {525, 0, 32, 20, 1034, 13, 1199, 0, 1053, 62, 160, 1037,},
+ .ple_qt47_v2 = {0, 0, 32, 2703, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0,},
.ple_qt57 = {147, 0, 16, 20, 13, 13, 178, 0, 32, 14, 8, 0,},
/* PCIE 64 */
.ple_qt58 = {147, 0, 16, 20, 157, 13, 229, 0, 172, 14, 24, 0,},
@@ -1889,7 +1890,7 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.rsvd1_size0 = {587776, 2048,},
.rsvd1_size2 = {391168, 2048,},
.dle_input3 = {0, 0, 0, 16384, 0, 2048, 0, 0,},
- .dle_input18 = {128, 128, 11454, 2048, 0, 2048, 24, 24,},
+ .dle_input20 = {128, 128, 11454, 2048, 0, 2048, 24, 24,},
};
EXPORT_SYMBOL(rtw89_mac_size);
diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
index 69f8d7d818a0..3d57f0acfba1 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.h
+++ b/drivers/net/wireless/realtek/rtw89/mac.h
@@ -1007,13 +1007,14 @@ struct rtw89_mac_size_set {
const struct rtw89_ple_quota ple_qt27;
const struct rtw89_ple_quota ple_qt28;
const struct rtw89_ple_quota ple_qt42;
- const struct rtw89_ple_quota ple_qt42_v2;
const struct rtw89_ple_quota ple_qt43;
- const struct rtw89_ple_quota ple_qt43_v2;
const struct rtw89_ple_quota ple_qt44;
+ const struct rtw89_ple_quota ple_qt44_v2;
const struct rtw89_ple_quota ple_qt45;
+ const struct rtw89_ple_quota ple_qt45_v2;
const struct rtw89_ple_quota ple_qt46;
const struct rtw89_ple_quota ple_qt47;
+ const struct rtw89_ple_quota ple_qt47_v2;
const struct rtw89_ple_quota ple_qt57;
const struct rtw89_ple_quota ple_qt58;
const struct rtw89_ple_quota ple_qt59;
@@ -1037,7 +1038,7 @@ struct rtw89_mac_size_set {
const struct rtw89_dle_rsvd_size rsvd1_size0;
const struct rtw89_dle_rsvd_size rsvd1_size2;
const struct rtw89_dle_input dle_input3;
- const struct rtw89_dle_input dle_input18;
+ const struct rtw89_dle_input dle_input20;
};
extern const struct rtw89_mac_size_set rtw89_mac_size;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
index b8b75fca0a1b..baa9ead64aa2 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
@@ -37,9 +37,7 @@ static const struct rtw89_hfc_ch_cfg rtw8922d_hfc_chcfg_pcie[] = {
{0, 601, 0}, /* B0HIQ */
{2, 603, 0}, /* B1MGQ */
{0, 601, 0}, /* B1HIQ */
- {0, 0, 0}, /* FWCMDQ */
- {0, 0, 0}, /* BMC */
- {0, 0, 0}, /* H2D */
+ {0, 0, 0}, /* GCQ */
};
static const struct rtw89_hfc_pub_cfg rtw8922d_hfc_pubcfg_pcie = {
@@ -62,20 +60,20 @@ static const struct rtw89_hfc_param_ini rtw8922d_hfc_param_ini_pcie[] = {
static const struct rtw89_dle_mem rtw8922d_dle_mem_pcie[] = {
[RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size16_v1,
&rtw89_mac_size.ple_size20_v1, &rtw89_mac_size.wde_qt19_v1,
- &rtw89_mac_size.wde_qt19_v1, &rtw89_mac_size.ple_qt42_v2,
- &rtw89_mac_size.ple_qt43_v2, &rtw89_mac_size.ple_rsvd_qt9,
+ &rtw89_mac_size.wde_qt19_v1, &rtw89_mac_size.ple_qt44_v2,
+ &rtw89_mac_size.ple_qt45_v2, &rtw89_mac_size.ple_rsvd_qt9,
&rtw89_mac_size.rsvd0_size6, &rtw89_mac_size.rsvd1_size2,
- &rtw89_mac_size.dle_input18},
+ &rtw89_mac_size.dle_input20},
[RTW89_QTA_DBCC] = {RTW89_QTA_DBCC, &rtw89_mac_size.wde_size16_v1,
&rtw89_mac_size.ple_size20_v1, &rtw89_mac_size.wde_qt19_v1,
- &rtw89_mac_size.wde_qt19_v1, &rtw89_mac_size.ple_qt42_v2,
- &rtw89_mac_size.ple_qt43_v2, &rtw89_mac_size.ple_rsvd_qt9,
+ &rtw89_mac_size.wde_qt19_v1, &rtw89_mac_size.ple_qt44_v2,
+ &rtw89_mac_size.ple_qt45_v2, &rtw89_mac_size.ple_rsvd_qt9,
&rtw89_mac_size.rsvd0_size6, &rtw89_mac_size.rsvd1_size2,
- &rtw89_mac_size.dle_input18},
+ &rtw89_mac_size.dle_input20},
[RTW89_QTA_DLFW] = {RTW89_QTA_DLFW, &rtw89_mac_size.wde_size18_v1,
&rtw89_mac_size.ple_size22_v1, &rtw89_mac_size.wde_qt3,
&rtw89_mac_size.wde_qt3, &rtw89_mac_size.ple_qt5_v2,
- &rtw89_mac_size.ple_qt5_v2, &rtw89_mac_size.ple_rsvd_qt1,
+ &rtw89_mac_size.ple_qt47_v2, &rtw89_mac_size.ple_rsvd_qt1,
&rtw89_mac_size.rsvd0_size6, &rtw89_mac_size.rsvd1_size2,
&rtw89_mac_size.dle_input3},
[RTW89_QTA_INVALID] = {RTW89_QTA_INVALID, NULL, NULL, NULL, NULL, NULL,
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 11/13] wifi: rtw89: mac: add field of release report size to DLE quota
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
The release report size is defined to indicate quota for TX completion.
Define the field as vendor driver does.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/core.h | 1 +
drivers/net/wireless/realtek/rtw89/mac.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index a6dee97d99f2..fa5ba90f11c6 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -4157,6 +4157,7 @@ struct rtw89_dle_input {
u32 h2c_max_size;
u32 rx_amsdu_size; /* unit: KB */
u32 c2h_max_size;
+ u32 rls_rpt_max_size;
u32 mpdu_info_tbl_b0;
u32 mpdu_info_tbl_b1;
};
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 8df1b9af719d..5c22b2accf7c 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -1889,8 +1889,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.rsvd0_size6 = {40960, 0,},
.rsvd1_size0 = {587776, 2048,},
.rsvd1_size2 = {391168, 2048,},
- .dle_input3 = {0, 0, 0, 16384, 0, 2048, 0, 0,},
- .dle_input20 = {128, 128, 11454, 2048, 0, 2048, 24, 24,},
+ .dle_input3 = {0, 0, 0, 16384, 0, 2048, 0, 0, 0,},
+ .dle_input20 = {128, 128, 11454, 2048, 0, 2048, 1024, 24, 24,},
};
EXPORT_SYMBOL(rtw89_mac_size);
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 12/13] wifi: rtw89: mac: consolidate quota into a struct for variant chips
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
RTL8922D has many variants, using different quota tables. Consolidate the
quota data into a struct, and then select corresponding table for the
chip variant.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/core.h | 20 +++++++++++++++++--
drivers/net/wireless/realtek/rtw89/mac.c | 6 ++++--
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 6 ++++--
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 6 ++++--
drivers/net/wireless/realtek/rtw89/rtw8852b.c | 6 ++++--
.../net/wireless/realtek/rtw89/rtw8852bt.c | 6 ++++--
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 6 ++++--
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 7 +++++--
drivers/net/wireless/realtek/rtw89/rtw8922d.c | 7 +++++--
9 files changed, 52 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index fa5ba90f11c6..86e59dcccdff 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -4229,6 +4229,11 @@ struct rtw89_fw_def {
u16 fw_b_aid;
};
+struct rtw89_qta_def {
+ const struct rtw89_hfc_param_ini *hfc_param_ini[RTW89_HCI_DLE_TYPE_NUM];
+ const struct rtw89_dle_mem *dle_mem[RTW89_HCI_DLE_TYPE_NUM];
+};
+
struct rtw89_phy_table {
const struct rtw89_reg2_def *regs;
u32 n_regs;
@@ -4643,8 +4648,7 @@ struct rtw89_chip_info {
u16 max_rx_agg_num;
bool dis_2g_40m_ul_ofdma;
u32 rsvd_ple_ofst;
- const struct rtw89_hfc_param_ini *hfc_param_ini[RTW89_HCI_DLE_TYPE_NUM];
- const struct rtw89_dle_mem *dle_mem[RTW89_HCI_DLE_TYPE_NUM];
+ struct rtw89_qta_def qta_def;
u8 wde_qempty_acq_grpnum;
u8 wde_qempty_mgq_grpsel;
u32 rf_base_addr[2];
@@ -4773,6 +4777,7 @@ struct rtw89_chip_variant {
bool no_mcs_12_13: 1;
u32 fw_min_ver_code;
const struct rtw89_fw_def *fw_def_override;
+ const struct rtw89_qta_def *qta_def_override;
};
union rtw89_bus_info {
@@ -7722,6 +7727,17 @@ const struct rtw89_fw_def *rtw89_chip_get_fw_def(struct rtw89_dev *rtwdev)
return __rtw89_chip_get_fw_def(rtwdev->chip, rtwdev->variant);
}
+static inline
+const struct rtw89_qta_def *rtw89_chip_get_qta_def(struct rtw89_dev *rtwdev)
+{
+ const struct rtw89_chip_variant *variant = rtwdev->variant;
+
+ if (variant && variant->qta_def_override)
+ return variant->qta_def_override;
+
+ return &rtwdev->chip->qta_def;
+}
+
static inline void rtw89_load_txpwr_table(struct rtw89_dev *rtwdev,
const struct rtw89_txpwr_table *tbl)
{
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 5c22b2accf7c..bd606d1da634 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -894,11 +894,12 @@ EXPORT_SYMBOL(rtw89_mac_set_err_status);
static int hfc_reset_param(struct rtw89_dev *rtwdev)
{
+ const struct rtw89_qta_def *qta_def = rtw89_chip_get_qta_def(rtwdev);
const struct rtw89_hfc_param_ini *param_ini, *param_inis;
struct rtw89_hfc_param *param = &rtwdev->mac.hfc_param;
u8 qta_mode = rtwdev->mac.dle_info.qta_mode;
- param_inis = rtwdev->chip->hfc_param_ini[rtwdev->hci.dle_type];
+ param_inis = qta_def->hfc_param_ini[rtwdev->hci.dle_type];
if (!param_inis)
return -EINVAL;
@@ -1897,10 +1898,11 @@ EXPORT_SYMBOL(rtw89_mac_size);
static const struct rtw89_dle_mem *get_dle_mem_cfg(struct rtw89_dev *rtwdev,
enum rtw89_qta_mode mode)
{
+ const struct rtw89_qta_def *qta_def = rtw89_chip_get_qta_def(rtwdev);
struct rtw89_mac_info *mac = &rtwdev->mac;
const struct rtw89_dle_mem *cfg, *cfgs;
- cfgs = rtwdev->chip->dle_mem[rtwdev->hci.dle_type];
+ cfgs = qta_def->dle_mem[rtwdev->hci.dle_type];
if (!cfgs)
return NULL;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b.c b/drivers/net/wireless/realtek/rtw89/rtw8851b.c
index e047e716d9e3..cf2039fe81d3 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b.c
@@ -2647,14 +2647,16 @@ const struct rtw89_chip_info rtw8851b_chip_info = {
.max_rx_agg_num = 64,
.dis_2g_40m_ul_ofdma = true,
.rsvd_ple_ofst = 0x2f800,
- .hfc_param_ini = {rtw8851b_hfc_param_ini_pcie,
+ .qta_def = {
+ .hfc_param_ini = {rtw8851b_hfc_param_ini_pcie,
rtw8851b_hfc_param_ini_usb,
rtw8851b_hfc_param_ini_usb,
NULL},
- .dle_mem = {rtw8851b_dle_mem_pcie,
+ .dle_mem = {rtw8851b_dle_mem_pcie,
rtw8851b_dle_mem_usb2,
rtw8851b_dle_mem_usb3,
NULL},
+ },
.wde_qempty_acq_grpnum = 4,
.wde_qempty_mgq_grpsel = 4,
.rf_base_addr = {0xe000},
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
index 686e489d42f2..5787a1aa7ea3 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
@@ -2384,14 +2384,16 @@ const struct rtw89_chip_info rtw8852a_chip_info = {
.max_rx_agg_num = 64,
.dis_2g_40m_ul_ofdma = true,
.rsvd_ple_ofst = 0x6f800,
- .hfc_param_ini = {rtw8852a_hfc_param_ini_pcie,
+ .qta_def = {
+ .hfc_param_ini = {rtw8852a_hfc_param_ini_pcie,
rtw8852a_hfc_param_ini_usb,
rtw8852a_hfc_param_ini_usb,
NULL},
- .dle_mem = {rtw8852a_dle_mem_pcie,
+ .dle_mem = {rtw8852a_dle_mem_pcie,
rtw8852a_dle_mem_usb,
rtw8852a_dle_mem_usb,
NULL},
+ },
.wde_qempty_acq_grpnum = 16,
.wde_qempty_mgq_grpsel = 16,
.rf_base_addr = {0xc000, 0xd000},
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b.c b/drivers/net/wireless/realtek/rtw89/rtw8852b.c
index 6ab99f72fda7..74feea6e7909 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852b.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852b.c
@@ -978,14 +978,16 @@ const struct rtw89_chip_info rtw8852b_chip_info = {
.max_rx_agg_num = 64,
.dis_2g_40m_ul_ofdma = true,
.rsvd_ple_ofst = 0x2f800,
- .hfc_param_ini = {rtw8852b_hfc_param_ini_pcie,
+ .qta_def = {
+ .hfc_param_ini = {rtw8852b_hfc_param_ini_pcie,
rtw8852b_hfc_param_ini_usb,
rtw8852b_hfc_param_ini_usb,
NULL},
- .dle_mem = {rtw8852b_dle_mem_pcie,
+ .dle_mem = {rtw8852b_dle_mem_pcie,
rtw8852b_dle_mem_usb3,
rtw8852b_dle_mem_usb3,
NULL},
+ },
.wde_qempty_acq_grpnum = 4,
.wde_qempty_mgq_grpsel = 4,
.rf_base_addr = {0xe000, 0xf000},
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bt.c b/drivers/net/wireless/realtek/rtw89/rtw8852bt.c
index 83de26273100..fc569e4723bd 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852bt.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852bt.c
@@ -824,8 +824,10 @@ const struct rtw89_chip_info rtw8852bt_chip_info = {
.max_rx_agg_num = 64,
.dis_2g_40m_ul_ofdma = true,
.rsvd_ple_ofst = 0x6f800,
- .hfc_param_ini = {rtw8852bt_hfc_param_ini_pcie, NULL, NULL, NULL},
- .dle_mem = {rtw8852bt_dle_mem_pcie, NULL, NULL, NULL},
+ .qta_def = {
+ .hfc_param_ini = {rtw8852bt_hfc_param_ini_pcie, NULL, NULL, NULL},
+ .dle_mem = {rtw8852bt_dle_mem_pcie, NULL, NULL, NULL},
+ },
.wde_qempty_acq_grpnum = 4,
.wde_qempty_mgq_grpsel = 4,
.rf_base_addr = {0xe000, 0xf000},
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c.c b/drivers/net/wireless/realtek/rtw89/rtw8852c.c
index cc278587b532..1e4c555284f3 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852c.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852c.c
@@ -3173,14 +3173,16 @@ const struct rtw89_chip_info rtw8852c_chip_info = {
.max_rx_agg_num = 64,
.dis_2g_40m_ul_ofdma = false,
.rsvd_ple_ofst = 0x6f800,
- .hfc_param_ini = {rtw8852c_hfc_param_ini_pcie,
+ .qta_def = {
+ .hfc_param_ini = {rtw8852c_hfc_param_ini_pcie,
rtw8852c_hfc_param_ini_usb,
rtw8852c_hfc_param_ini_usb,
NULL},
- .dle_mem = {rtw8852c_dle_mem_pcie,
+ .dle_mem = {rtw8852c_dle_mem_pcie,
rtw8852c_dle_mem_usb2,
rtw8852c_dle_mem_usb3,
NULL},
+ },
.wde_qempty_acq_grpnum = 16,
.wde_qempty_mgq_grpsel = 16,
.rf_base_addr = {0xe000, 0xf000},
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
index e6f15ee2a86b..965c4c01a75f 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
@@ -3168,14 +3168,16 @@ const struct rtw89_chip_info rtw8922a_chip_info = {
.max_rx_agg_num = 64,
.dis_2g_40m_ul_ofdma = false,
.rsvd_ple_ofst = 0x8f800,
- .hfc_param_ini = {rtw8922a_hfc_param_ini_pcie,
+ .qta_def = {
+ .hfc_param_ini = {rtw8922a_hfc_param_ini_pcie,
rtw8922a_hfc_param_ini_usb2,
rtw8922a_hfc_param_ini_usb3,
NULL},
- .dle_mem = {rtw8922a_dle_mem_pcie,
+ .dle_mem = {rtw8922a_dle_mem_pcie,
rtw8922a_dle_mem_usb2,
rtw8922a_dle_mem_usb3,
NULL},
+ },
.wde_qempty_acq_grpnum = 4,
.wde_qempty_mgq_grpsel = 4,
.rf_base_addr = {0xe000, 0xf000},
@@ -3306,6 +3308,7 @@ const struct rtw89_chip_variant rtw8922ae_vs_variant = {
.no_mcs_12_13 = true,
.fw_min_ver_code = RTW89_FW_VER_CODE(0, 35, 54, 0),
.fw_def_override = NULL,
+ .qta_def_override = NULL,
};
EXPORT_SYMBOL(rtw8922ae_vs_variant);
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
index baa9ead64aa2..2f0c3a5d937c 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
@@ -3013,8 +3013,10 @@ const struct rtw89_chip_info rtw8922d_chip_info = {
.max_rx_agg_num = 256,
.dis_2g_40m_ul_ofdma = false,
.rsvd_ple_ofst = 0x5f800,
- .hfc_param_ini = {rtw8922d_hfc_param_ini_pcie, NULL, NULL, NULL},
- .dle_mem = {rtw8922d_dle_mem_pcie, NULL, NULL, NULL},
+ .qta_def = {
+ .hfc_param_ini = {rtw8922d_hfc_param_ini_pcie, NULL, NULL, NULL},
+ .dle_mem = {rtw8922d_dle_mem_pcie, NULL, NULL, NULL},
+ },
.wde_qempty_acq_grpnum = 8,
.wde_qempty_mgq_grpsel = 8,
.rf_base_addr = {0x3e000, 0x3f000},
@@ -3150,6 +3152,7 @@ const struct rtw89_chip_variant rtw8922de_vs_variant = {
.no_mcs_12_13 = true,
.fw_min_ver_code = RTW89_FW_VER_CODE(0, 0, 0, 0),
.fw_def_override = &rtw8922de_vs_fw_def,
+ .qta_def_override = NULL,
};
EXPORT_SYMBOL(rtw8922de_vs_variant);
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next 13/13] wifi: rtw89: 8922d: add quota for RTL8922DE variant
From: Ping-Ke Shih @ 2026-05-15 1:44 UTC (permalink / raw)
To: linux-wireless; +Cc: timlee, dian_syuan0116, phhuang, kevin_yang
In-Reply-To: <20260515014433.16168-1-pkshih@realtek.com>
The existing quota set is for RTL8922DE-VS, so rename the existing tables.
Add new quota set for RTL8922DE, containing more memory to yield better
performance, so rearrange quota accordingly.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/mac.c | 8 ++
drivers/net/wireless/realtek/rtw89/mac.h | 8 ++
drivers/net/wireless/realtek/rtw89/rtw8922d.c | 73 +++++++++++++++++--
3 files changed, 83 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index bd606d1da634..8c395517bd2f 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -1748,6 +1748,7 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.wde_size18_v1 = {RTW89_WDE_PG_64, 0, 640, 0,},
/* 8852C PCIE SCC */
.wde_size19 = {RTW89_WDE_PG_64, 3328, 0,},
+ .wde_size22_v1 = {RTW89_WDE_PG_128, 384, 0, 0,},
.wde_size23 = {RTW89_WDE_PG_64, 1022, 2,},
/* 8852B USB2.0/USB3.0 SCC turbo */
.wde_size30 = {RTW89_WDE_PG_64, 220, 36,},
@@ -1781,6 +1782,7 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.ple_size22_v1 = {RTW89_PLE_PG_128, 2736, 0, 40960,},
/* 8851B USB2.0 SCC turbo */
.ple_size27 = {RTW89_PLE_PG_128, 1396, 12,},
+ .ple_size29_v1 = {RTW89_PLE_PG_128, 1895, 182, 49152,},
/* 8852B USB3.0 SCC turbo */
.ple_size31 = {RTW89_PLE_PG_128, 1392, 16,},
/* 8852C USB2.0 */
@@ -1811,6 +1813,7 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.wde_qt18 = {3228, 60, 0, 40,},
.wde_qt19_v1 = {613, 6, 0, 20,},
.wde_qt23 = {958, 48, 0, 16,},
+ .wde_qt23_v1 = {371, 3, 0, 10,},
/* 8852B USB2.0/USB3.0 SCC turbo */
.wde_qt30 = {210, 2, 0, 8,},
/* 8852C USB2.0 */
@@ -1868,6 +1871,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
/* 8851B USB2.0 SCC turbo */
.ple_qt61 = {858, 0, 16, 48, 4, 13, 370, 0, 32, 14, 8, 0, 0,},
.ple_qt62 = {858, 0, 32, 48, 37, 13, 403, 0, 65, 14, 24, 0, 0,},
+ .ple_qt64_v2 = {91, 91, 32, 16, 19, 13, 93, 93, 44, 34, 1, 4, 0, 0,},
+ .ple_qt65_v2 = {645, 645, 32, 1380, 1383, 1377, 1457, 1457, 1408, 1398, 1, 1368,},
/* USB2.0 52C */
.ple_qt78 = {1560, 0, 16, 48, 13, 13, 390, 0, 32, 38, 8, 16, 0,},
/* USB2.0 52C */
@@ -1888,10 +1893,13 @@ const struct rtw89_mac_size_set rtw89_mac_size = {
.rsvd0_size3 = {57344, 0,},
.rsvd0_size5 = {32768, 0,},
.rsvd0_size6 = {40960, 0,},
+ .rsvd0_size17 = {49152, 0,},
.rsvd1_size0 = {587776, 2048,},
.rsvd1_size2 = {391168, 2048,},
+ .rsvd1_size3 = {315008, 78208,},
.dle_input3 = {0, 0, 0, 16384, 0, 2048, 0, 0, 0,},
.dle_input20 = {128, 128, 11454, 2048, 0, 2048, 1024, 24, 24,},
+ .dle_input28 = {128, 128, 11454, 2048, 0, 2048, 2048, 24, 24,},
};
EXPORT_SYMBOL(rtw89_mac_size);
diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
index 3d57f0acfba1..539061fc15e8 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.h
+++ b/drivers/net/wireless/realtek/rtw89/mac.h
@@ -946,6 +946,7 @@ struct rtw89_mac_size_set {
const struct rtw89_dle_size wde_size18;
const struct rtw89_dle_size wde_size18_v1;
const struct rtw89_dle_size wde_size19;
+ const struct rtw89_dle_size wde_size22_v1;
const struct rtw89_dle_size wde_size23;
const struct rtw89_dle_size wde_size30;
const struct rtw89_dle_size wde_size31;
@@ -966,6 +967,7 @@ struct rtw89_mac_size_set {
const struct rtw89_dle_size ple_size20_v1;
const struct rtw89_dle_size ple_size22_v1;
const struct rtw89_dle_size ple_size27;
+ const struct rtw89_dle_size ple_size29_v1;
const struct rtw89_dle_size ple_size31;
const struct rtw89_dle_size ple_size34;
const struct rtw89_wde_quota wde_qt0;
@@ -984,6 +986,7 @@ struct rtw89_mac_size_set {
const struct rtw89_wde_quota wde_qt18;
const struct rtw89_wde_quota wde_qt19_v1;
const struct rtw89_wde_quota wde_qt23;
+ const struct rtw89_wde_quota wde_qt23_v1;
const struct rtw89_wde_quota wde_qt30;
const struct rtw89_wde_quota wde_qt31;
const struct rtw89_ple_quota ple_qt0;
@@ -1020,6 +1023,8 @@ struct rtw89_mac_size_set {
const struct rtw89_ple_quota ple_qt59;
const struct rtw89_ple_quota ple_qt61;
const struct rtw89_ple_quota ple_qt62;
+ const struct rtw89_ple_quota ple_qt64_v2;
+ const struct rtw89_ple_quota ple_qt65_v2;
const struct rtw89_ple_quota ple_qt78;
const struct rtw89_ple_quota ple_qt79;
const struct rtw89_ple_quota ple_qt_52a_wow;
@@ -1035,10 +1040,13 @@ struct rtw89_mac_size_set {
const struct rtw89_dle_rsvd_size rsvd0_size3;
const struct rtw89_dle_rsvd_size rsvd0_size5;
const struct rtw89_dle_rsvd_size rsvd0_size6;
+ const struct rtw89_dle_rsvd_size rsvd0_size17;
const struct rtw89_dle_rsvd_size rsvd1_size0;
const struct rtw89_dle_rsvd_size rsvd1_size2;
+ const struct rtw89_dle_rsvd_size rsvd1_size3;
const struct rtw89_dle_input dle_input3;
const struct rtw89_dle_input dle_input20;
+ const struct rtw89_dle_input dle_input28;
};
extern const struct rtw89_mac_size_set rtw89_mac_size;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
index 2f0c3a5d937c..a453b220d7ae 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c
@@ -25,6 +25,62 @@
RTW89_GEN_MODULE_FWNAME(RTW8922DS_FW_BASENAME, RTW8922DS_FW_FORMAT_MAX)
static const struct rtw89_hfc_ch_cfg rtw8922d_hfc_chcfg_pcie[] = {
+ {2, 732, 0}, /* ACH 0 */
+ {0, 730, 0}, /* ACH 1 */
+ {2, 732, 0}, /* ACH 2 */
+ {0, 730, 0}, /* ACH 3 */
+ {2, 732, 0}, /* ACH 4 */
+ {0, 730, 0}, /* ACH 5 */
+ {2, 732, 0}, /* ACH 6 */
+ {0, 730, 0}, /* ACH 7 */
+ {2, 732, 0}, /* B0MGQ */
+ {0, 730, 0}, /* B0HIQ */
+ {2, 732, 0}, /* B1MGQ */
+ {0, 730, 0}, /* B1HIQ */
+ {0, 0, 0}, /* GCQ */
+};
+
+static const struct rtw89_hfc_pub_cfg rtw8922d_hfc_pubcfg_pcie = {
+ 742, /* Group 0 */
+ 0, /* Group 1 */
+ 742, /* Public Max */
+ 0, /* WP threshold */
+};
+
+static const struct rtw89_hfc_param_ini rtw8922d_hfc_param_ini_pcie[] = {
+ [RTW89_QTA_SCC] = {rtw8922d_hfc_chcfg_pcie, &rtw8922d_hfc_pubcfg_pcie,
+ &rtw89_mac_size.hfc_prec_cfg_c0, RTW89_HCIFC_POH},
+ [RTW89_QTA_DBCC] = {rtw8922d_hfc_chcfg_pcie, &rtw8922d_hfc_pubcfg_pcie,
+ &rtw89_mac_size.hfc_prec_cfg_c0, RTW89_HCIFC_POH},
+ [RTW89_QTA_DLFW] = {NULL, NULL, &rtw89_mac_size.hfc_prec_cfg_c2,
+ RTW89_HCIFC_POH},
+ [RTW89_QTA_INVALID] = {NULL},
+};
+
+static const struct rtw89_dle_mem rtw8922d_dle_mem_pcie[] = {
+ [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size22_v1,
+ &rtw89_mac_size.ple_size29_v1, &rtw89_mac_size.wde_qt23_v1,
+ &rtw89_mac_size.wde_qt23_v1, &rtw89_mac_size.ple_qt64_v2,
+ &rtw89_mac_size.ple_qt65_v2, &rtw89_mac_size.ple_rsvd_qt9,
+ &rtw89_mac_size.rsvd0_size17, &rtw89_mac_size.rsvd1_size3,
+ &rtw89_mac_size.dle_input28},
+ [RTW89_QTA_DBCC] = {RTW89_QTA_DBCC, &rtw89_mac_size.wde_size22_v1,
+ &rtw89_mac_size.ple_size29_v1, &rtw89_mac_size.wde_qt23_v1,
+ &rtw89_mac_size.wde_qt23_v1, &rtw89_mac_size.ple_qt64_v2,
+ &rtw89_mac_size.ple_qt65_v2, &rtw89_mac_size.ple_rsvd_qt9,
+ &rtw89_mac_size.rsvd0_size17, &rtw89_mac_size.rsvd1_size3,
+ &rtw89_mac_size.dle_input28},
+ [RTW89_QTA_DLFW] = {RTW89_QTA_DLFW, &rtw89_mac_size.wde_size18_v1,
+ &rtw89_mac_size.ple_size22_v1, &rtw89_mac_size.wde_qt3,
+ &rtw89_mac_size.wde_qt3, &rtw89_mac_size.ple_qt5_v2,
+ &rtw89_mac_size.ple_qt47_v2, &rtw89_mac_size.ple_rsvd_qt1,
+ &rtw89_mac_size.rsvd0_size6, &rtw89_mac_size.rsvd1_size2,
+ &rtw89_mac_size.dle_input3},
+ [RTW89_QTA_INVALID] = {RTW89_QTA_INVALID, NULL, NULL, NULL, NULL, NULL,
+ NULL},
+};
+
+static const struct rtw89_hfc_ch_cfg rtw8922ds_hfc_chcfg_pcie[] = {
{2, 603, 0}, /* ACH 0 */
{0, 601, 0}, /* ACH 1 */
{2, 603, 0}, /* ACH 2 */
@@ -40,24 +96,24 @@ static const struct rtw89_hfc_ch_cfg rtw8922d_hfc_chcfg_pcie[] = {
{0, 0, 0}, /* GCQ */
};
-static const struct rtw89_hfc_pub_cfg rtw8922d_hfc_pubcfg_pcie = {
+static const struct rtw89_hfc_pub_cfg rtw8922ds_hfc_pubcfg_pcie = {
613, /* Group 0 */
0, /* Group 1 */
613, /* Public Max */
0, /* WP threshold */
};
-static const struct rtw89_hfc_param_ini rtw8922d_hfc_param_ini_pcie[] = {
- [RTW89_QTA_SCC] = {rtw8922d_hfc_chcfg_pcie, &rtw8922d_hfc_pubcfg_pcie,
+static const struct rtw89_hfc_param_ini rtw8922ds_hfc_param_ini_pcie[] = {
+ [RTW89_QTA_SCC] = {rtw8922ds_hfc_chcfg_pcie, &rtw8922ds_hfc_pubcfg_pcie,
&rtw89_mac_size.hfc_prec_cfg_c0, RTW89_HCIFC_POH},
- [RTW89_QTA_DBCC] = {rtw8922d_hfc_chcfg_pcie, &rtw8922d_hfc_pubcfg_pcie,
+ [RTW89_QTA_DBCC] = {rtw8922ds_hfc_chcfg_pcie, &rtw8922ds_hfc_pubcfg_pcie,
&rtw89_mac_size.hfc_prec_cfg_c0, RTW89_HCIFC_POH},
[RTW89_QTA_DLFW] = {NULL, NULL, &rtw89_mac_size.hfc_prec_cfg_c2,
RTW89_HCIFC_POH},
[RTW89_QTA_INVALID] = {NULL},
};
-static const struct rtw89_dle_mem rtw8922d_dle_mem_pcie[] = {
+static const struct rtw89_dle_mem rtw8922ds_dle_mem_pcie[] = {
[RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size16_v1,
&rtw89_mac_size.ple_size20_v1, &rtw89_mac_size.wde_qt19_v1,
&rtw89_mac_size.wde_qt19_v1, &rtw89_mac_size.ple_qt44_v2,
@@ -3148,11 +3204,16 @@ static const struct rtw89_fw_def rtw8922de_vs_fw_def = {
.fw_b_aid = RTL8922D_AID7060,
};
+static const struct rtw89_qta_def rtw8922ds_qta_def = {
+ .hfc_param_ini = {rtw8922ds_hfc_param_ini_pcie, NULL, NULL},
+ .dle_mem = {rtw8922ds_dle_mem_pcie, NULL, NULL, NULL},
+};
+
const struct rtw89_chip_variant rtw8922de_vs_variant = {
.no_mcs_12_13 = true,
.fw_min_ver_code = RTW89_FW_VER_CODE(0, 0, 0, 0),
.fw_def_override = &rtw8922de_vs_fw_def,
- .qta_def_override = NULL,
+ .qta_def_override = &rtw8922ds_qta_def,
};
EXPORT_SYMBOL(rtw8922de_vs_variant);
--
2.25.1
^ permalink raw reply related
* Re: [PATCH] wifi: ath11k: fix warning when unbinding
From: Rameshkumar Sundaram @ 2026-05-15 2:27 UTC (permalink / raw)
To: Baochen Qiang, Jose Ignacio Tornos Martinez
Cc: ath11k, jjohnson, linux-kernel, linux-wireless, stable
In-Reply-To: <c2523379-ab12-47e1-a0d0-ef6073deaf11@oss.qualcomm.com>
On 5/14/2026 1:45 PM, Baochen Qiang wrote:
>
>
> On 5/14/2026 2:55 PM, Rameshkumar Sundaram wrote:
>> On 5/14/2026 11:48 AM, Jose Ignacio Tornos Martinez wrote:
>>> Hello Rameshkumar,
>>>
>>>> I agree that setting tx_status to NULL makes ath11k_dp_free() more
>>>> defensive, and it matches the ath12k fix.
>>> Ok, I agree too.
>>>
>>>> However, i am still wondering how the second ath11k_dp_free() is reached
>>>> if ATH11K_FLAG_QMI_FAIL is set.
>>>>
>>>> In ath11k_pci_remove(), when ATH11K_FLAG_QMI_FAIL is set, we take the
>>>> qmi_fail path and skip ath11k_core_deinit(). So the normal remove path:
>>>>
>>>> ath11k_pci_remove()
>>>> ath11k_core_deinit()
>>>> ath11k_core_soc_destroy()
>>>> ath11k_dp_free()
>>>>
>>>> should not run.
>>>>
>>>> So if the double free is still reproducible with QMI_FAIL set (with the
>>>> change i proposed), either the flag is not actually set in this failure
>>>> case, or there is another path calling ath11k_dp_free() ?
>>> Let me try to clarify the issue more.
>>> There are two error actions:
>>> - First the previous error. I reproduce the situation as I commented: running
>>> in a VM the default upstream kernel (with this card using PCI passthrough),
>>> since this is always failing. Let me show the logs in this situation:
>>> [ 15.906564] ath11k_pci 0000:07:00.0: BAR 0 [mem 0xfdc00000-0xfddfffff 64bit]: assigned
>>> [ 15.926520] ath11k_pci 0000:07:00.0: MSI vectors: 32
>>> [ 15.928572] ath11k_pci 0000:07:00.0: wcn6855 hw2.0
>>> [ 16.984192] ath11k_pci 0000:07:00.0: chip_id 0x2 chip_family 0xb board_id 0xff soc_id
>>> 0x400c0200
>>> [ 16.984351] ath11k_pci 0000:07:00.0: fw_version 0x11088c35 fw_build_timestamp
>>> 2024-04-17 08:34 fw_build_id WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
>>> [ 18.186971] ath11k_pci 0000:07:00.0: failed to receive control response completion,
>>> polling..
>>> [ 19.211036] ath11k_pci 0000:07:00.0: Service connect timeout
>>> [ 19.211815] ath11k_pci 0000:07:00.0: failed to connect to HTT: -110
>>> [ 19.214181] ath11k_pci 0000:07:00.0: failed to start core: -110
>>> [ 19.531989] ath11k_pci 0000:07:00.0: firmware crashed: MHI_CB_EE_RDDM
>>> [ 19.532930] ath11k_pci 0000:07:00.0: ignore reset dev flags 0xc000
>>> [ 29.259157] ath11k_pci 0000:07:00.0: failed to wait wlan mode request (mode 4): -110
>>> [ 29.259229] ath11k_pci 0000:07:00.0: qmi failed to send wlan mode off: -110
>>> - Second after this, I commanded the unbinded (ath11_pci) and I get the
>>> warning. Let extend here the stack trace:
>>> [ 24.238198] ? free_large_kmalloc+0x57/0x90
>>> [ 24.238199] ? report_bug+0x16b/0x180
>>> [ 24.238210] ? handle_bug+0x3c/0x70
>>> [ 24.238218] ? exc_invalid_op+0x14/0x70
>>> [ 24.238218] ? asm_exc_invalid_op+0x16/0x20
>>> [ 24.238224] ? free_large_kmalloc+0x57/0x90
>>> [ 24.238227] ath11k_dp_free+0x99/0xb0 [ath11k]
>>> [ 24.238275] ath11k_core_deinit+0x12b/0x1a0 [ath11k]
>>> [ 24.238287] ath11k_pci_remove+0x7b/0x120 [ath11k_pci]
>>> [ 24.238294] pci_device_remove+0x3e/0xb0
>>> [ 24.238304] device_release_driver_internal+0x193/0x200
>>> [ 24.238315] unbind_store+0x9d/0xb0
>>> [ 24.238320] kernfs_fop_write_iter+0x13a/0x1d0
>>> [ 24.238330] vfs_write+0x32e/0x470
>>> [ 24.238335] ksys_write+0x5f/0xe0
>>> [ 24.238336] do_syscall_64+0x5f/0xe0
>>> Very easy to reproduce.
>>>
>>
>>
>> Thanks much for the logs, that makes sense. The timestamps explain why my earlier
>> reasoning did not match the trace: unbind reaches ath11k_pci_remove() before
>> ATH11K_FLAG_QMI_FAIL is set by the QMI event worker as it is held up on wlan mode off qmi
>
> how could QMI worker set this flag? the first failure happens in
> ath12k_core_qmi_firmware_ready() and upon this failure the QMI worker just break out
> without setting any flag, no?
>
you mean ath1*1*k_core_qmi_firmware_ready() ?. Yes in ToT it breaks out
without setting any flags, so I proposed to set that on failure case
ATH11K_QMI_EVENT_FW_READY: (similar to case
ATH11K_QMI_EVENT_FW_INIT_DONE:) in this mail thread.
--
Ramesh
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox