* [PATCH rtw-next v2 4/9] wifi: rtw89: coex: Add Bluetooth binding for Bluetooth TX power setting
From: Ping-Ke Shih @ 2026-07-06 2:54 UTC (permalink / raw)
To: linux-wireless; +Cc: ku920601
In-Reply-To: <20260706025445.18428-1-pkshih@realtek.com>
From: Ching-Te Ku <ku920601@realtek.com>
Dual Bluetooth the each of Bluetooth may use different TX power by their
condition.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/coex.c | 65 ++++++++++++++++++-----
drivers/net/wireless/realtek/rtw89/core.h | 15 ++++--
drivers/net/wireless/realtek/rtw89/fw.h | 3 ++
3 files changed, 67 insertions(+), 16 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index 14cc62cf399d..2080253559a7 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -3078,6 +3078,7 @@ static void _set_bt_ignore_wlan_act(struct rtw89_dev *rtwdev, u8 enable)
#define WL_TX_POWER_FRA_PART GENMASK(1, 0)
#define B_BTC_WL_TX_POWER_SIGN BIT(7)
#define B_TSSI_WL_TX_POWER_SIGN BIT(8)
+#define SET_RF_PARA_AX_LEN 1
static void _set_wl_tx_power(struct rtw89_dev *rtwdev, u32 level, u8 phy_map)
{
@@ -3161,28 +3162,64 @@ static void _set_wl_rx_gain(struct rtw89_dev *rtwdev, u32 level, u8 phy_map)
chip->ops->btc_set_wl_rx_gain(rtwdev, level);
}
-static void _set_bt_tx_power(struct rtw89_dev *rtwdev, u8 level)
+static void _set_bt_tx_power(struct rtw89_dev *rtwdev, bool force_exec, u8 bid,
+ u8 rf_band, u8 level)
{
struct rtw89_btc *btc = &rtwdev->btc;
struct rtw89_btc_bt_info *bt = &btc->cx.bt0;
- int ret;
- u8 buf;
+ u8 h2c_func = SET_BT_TX_PWR;
+ u8 i, id_start, id_stop;
+ u8 buf[2] = {};
+ u8 len = sizeof(*buf);
- if (bt->bcnt[BTC_BCNT_INFOUPDATE] == 0)
+ if (bt->bcnt[BTC_BCNT_INFOUPDATE] == 0 || !rf_band)
return;
if (bt->rf_para.tx_pwr_freerun == level)
return;
- rtw89_debug(rtwdev, RTW89_DBG_BTC,
- "[BTC], %s(): level = %d\n",
- __func__, level);
+ if (bid == BTC_ALL_BT) {
+ id_start = BTC_BT_1ST;
+ id_stop = BTC_BT_2ND;
+ } else {
+ id_start = bid;
+ id_stop = bid;
+ }
- buf = (s8)(-level);
- ret = _send_fw_cmd(rtwdev, BTFC_SET, SET_BT_TX_PWR, &buf, 1);
- if (!ret) {
- bt->rf_para.tx_pwr_freerun = level;
- btc->dm.rf_trx_para.bt_tx_power[BTC_BT_1ST] = level;
+ for (i = id_start; i <= id_stop; i++) {
+ if (i == BTC_BT_2ND) {
+ if (!(rtwdev->chip->para_ver & BTC_FEAT_DUAL_BT))
+ continue;
+
+ bt = &btc->cx.bt1;
+ h2c_func |= BT_H2C_FUNC_BT2ND;
+ }
+
+ buf[0] = (s8)(-level);
+ buf[1] = rf_band; /* bit-map: bit1->5GHz/6Ghz, bit0->2.4GHz */
+
+ if (!force_exec && !btc->cli_h2c_cmd) {
+ if (rf_band == RTW89_BAND_2G &&
+ bt->tx_power_now == level)
+ continue;
+ else if (rf_band != RTW89_BAND_2G &&
+ bt->tx_power_now_6g == level)
+ continue;
+ }
+
+ if (rtwdev->chip->chip_gen == RTW89_CHIP_AX)
+ len = SET_RF_PARA_AX_LEN;
+
+ if (_send_fw_cmd(rtwdev, BTFC_SET, h2c_func, buf, len)) {
+ btc->dm.rf_trx_para.bt_tx_power[i] = level;
+ if (rf_band == RTW89_BAND_2G)
+ bt->tx_power_now = level;
+ else
+ bt->tx_power_now_6g = level;
+ rtw89_debug(rtwdev, RTW89_DBG_BTC,
+ "[BTC], %s(): bt%d_tx_power_level = %d\n",
+ __func__, i, level);
+ }
}
}
@@ -3229,6 +3266,8 @@ static void _set_rf_trx_para(struct rtw89_dev *rtwdev)
struct rtw89_btc_rf_trx_para_v9 para;
u8 lv, link_mode = 0, i, dbcc_2g_phy = 0;
u8 ul_para_num, dl_para_num;
+ u8 rf_band = RTW89_BAND_2G;
+ u8 bid = BTC_BT_1ST;
u32 wl_stb_chg = 0;
if (ver->fwlrole == 0) {
@@ -3321,7 +3360,7 @@ static void _set_rf_trx_para(struct rtw89_dev *rtwdev)
} else {
_set_wl_tx_power(rtwdev, para.wl_tx_power[RTW89_PHY_0], RTW89_PHY_0);
_set_wl_rx_gain(rtwdev, para.wl_rx_gain[RTW89_PHY_0], RTW89_PHY_0);
- _set_bt_tx_power(rtwdev, para.bt_tx_power[BTC_BT_1ST]);
+ _set_bt_tx_power(rtwdev, true, bid, rf_band, para.bt_tx_power[BTC_BT_1ST]);
_set_bt_rx_gain(rtwdev, para.bt_rx_gain[BTC_BT_1ST]);
}
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index a0f6929873ab..3f77707e2733 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -2302,7 +2302,18 @@ struct rtw89_btc_bt_info {
u8 raw_info[BTC_BTINFO_MAX]; /* raw bt info from mailbox */
u8 txpwr_info[BTC_BTINFO_MAX];
u8 rssi_level;
+ u8 rf_band_map;
u8 func_type;
+ u8 tx_power_now;
+ u8 tx_power_now_6g;
+
+ u8 fw_ver_mismatch: 1;
+ u8 band_56G_support: 1;
+ u8 hi_lna_rx: 1;
+ u8 lna_constrain: 3;
+ u8 hi_lna_rx_6g: 1;
+ u8 lna_constrain_6g: 3;
+ u8 rsvd: 6;
u32 scbd;
u32 feature;
@@ -2316,11 +2327,9 @@ struct rtw89_btc_bt_info {
u32 inq: 1;
u32 pag: 1;
u32 run_patch_code: 1;
- u32 hi_lna_rx: 1;
u32 scan_rx_low_pri: 1;
u32 scan_info_update: 1;
- u32 lna_constrain: 3;
- u32 rsvd: 17;
+ u32 rsvd1: 22;
u32 bcnt[BTC_BCNT_NUM];
};
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index de8b77de8705..a6f3b28b9e33 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -2337,6 +2337,9 @@ struct rtw89_h2c_arp_offload {
#define RTW89_H2C_ARP_OFFLOAD_W0_PKT_ID GENMASK(31, 24)
#define RTW89_H2C_ARP_OFFLOAD_W1_CONTENT GENMASK(31, 0)
+#define BT_H2C_FUNC_BT2ND 0x80
+#define BT_C2H_FUNC_BT2ND 0x80
+
enum rtw89_btc_btf_h2c_class {
BTFC_SET = 0x10,
BTFC_GET = 0x11,
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next v2 3/9] wifi: rtw89: coex: Update TDMA descriptor for dual MAC
From: Ping-Ke Shih @ 2026-07-06 2:54 UTC (permalink / raw)
To: linux-wireless; +Cc: ku920601
In-Reply-To: <20260706025445.18428-1-pkshih@realtek.com>
From: Ching-Te Ku <ku920601@realtek.com>
The mechanism needs information to know which MAC is coexisting with which
Bluetooth and when to enable TDMA with which MAC. So change an variable to
describe the binding target.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/coex.c | 15 ++++++++-------
drivers/net/wireless/realtek/rtw89/core.h | 4 ++--
2 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index 196bec751070..14cc62cf399d 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -2288,9 +2288,9 @@ static void _append_tdma(struct rtw89_dev *rtwdev)
}
rtw89_debug(rtwdev, RTW89_DBG_BTC,
- "[BTC], %s(): type:%d, rxflctrl=%d, txpause=%d, wtgle_n=%d, leak_n=%d, ext_ctrl=%d\n",
+ "[BTC], %s(): type:%d, rxflctrl=%d, txflctrl=%d, bind=%d, leak_n=%d, ext_ctrl=%d\n",
__func__, dm->tdma.type, dm->tdma.rxflctrl,
- dm->tdma.txpause, dm->tdma.wtgle_n, dm->tdma.leak_n,
+ dm->tdma.txflctrl, dm->tdma.bind, dm->tdma.leak_n,
dm->tdma.ext_ctrl);
}
@@ -3733,7 +3733,8 @@ static bool _check_freerun(struct rtw89_dev *rtwdev)
#define _tdma_set_flctrl(btc, flc) ({(btc)->dm.tdma.rxflctrl = flc; })
#define _tdma_set_flctrl_role(btc, role) ({(btc)->dm.tdma.rxflctrl_role = role; })
-#define _tdma_set_tog(btc, wtg) ({(btc)->dm.tdma.wtgle_n = wtg; })
+#define _tdma_set_rxflctrl(btc, rxflc) ({(btc)->dm.tdma.rxflctrl = rxflc; })
+#define _tdma_set_txflctrl(btc, txflc) ({(btc)->dm.tdma.txflctrl = txflc; })
#define _tdma_set_lek(btc, lek) ({(btc)->dm.tdma.leak_n = lek; })
struct btc_btinfo_lb2 {
@@ -9967,13 +9968,13 @@ static int _show_fbtc_tdma(struct rtw89_dev *rtwdev, char *buf, size_t bufsz)
p += scnprintf(p, end - p,
" %-15s : ", "[tdma_policy]");
p += scnprintf(p, end - p,
- "type:%d, rx_flow_ctrl:%d, tx_pause:%d, ",
+ "type:%d, rx_flow_ctrl:%d, txflctrl:%d, ",
(u32)t->type,
- t->rxflctrl, t->txpause);
+ t->rxflctrl, t->txflctrl);
p += scnprintf(p, end - p,
- "wl_toggle_n:%d, leak_n:%d, ext_ctrl:%d, ",
- t->wtgle_n, t->leak_n, t->ext_ctrl);
+ "bind:%d, leak_n:%d, ext_ctrl:%d, ",
+ t->bind, t->leak_n, t->ext_ctrl);
p += scnprintf(p, end - p,
"policy_type:%d",
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index 1e72c9b9f3b7..a0f6929873ab 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -2354,8 +2354,8 @@ struct rtw89_btc_cx {
struct rtw89_btc_fbtc_tdma {
u8 type; /* btc_ver::fcxtdma */
u8 rxflctrl;
- u8 txpause;
- u8 wtgle_n;
+ u8 txflctrl;
+ u8 bind;
u8 leak_n;
u8 ext_ctrl;
u8 rxflctrl_role;
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next v2 2/9] wifi: rtw89: coex: add rtw89_btc_init() entry for initialization once
From: Ping-Ke Shih @ 2026-07-06 2:54 UTC (permalink / raw)
To: linux-wireless; +Cc: ku920601
In-Reply-To: <20260706025445.18428-1-pkshih@realtek.com>
From: Ching-Te Ku <ku920601@realtek.com>
Separate these two type of initialize entry. Because Wi-Fi power save
leaving will also call the initializing, but don't have to reset all the
stored variables.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/coex.c | 35 ++++++++++++++---------
drivers/net/wireless/realtek/rtw89/coex.h | 1 +
drivers/net/wireless/realtek/rtw89/core.c | 1 +
3 files changed, 24 insertions(+), 13 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index 43de238c18f8..196bec751070 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -7858,6 +7858,28 @@ void _run_coex(struct rtw89_dev *rtwdev, enum btc_reason_and_action reason)
_action_common(rtwdev);
}
+void rtw89_btc_init(struct rtw89_dev *rtwdev)
+{
+ const struct rtw89_chip_info *chip = rtwdev->chip;
+ struct rtw89_btc *btc = &rtwdev->btc;
+ struct rtw89_btc_wl_info *wl = &btc->cx.wl;
+ const struct rtw89_btc_ver *ver = btc->ver;
+
+ rtw89_debug(rtwdev, RTW89_DBG_BTC,
+ "[BTC], %s(): Init %s !!\n", __func__,
+ chip_id_str(chip->chip_id));
+
+ _reset_btc_var(rtwdev, BTC_RESET_ALL);
+
+ btc->dm.run_reason = BTC_RSN_NONE;
+ btc->dm.run_action = BTC_ACT_NONE;
+ if (ver->fcxctrl >= 7)
+ btc->ctrl.ctrl_v7.igno_bt = true;
+ else
+ btc->ctrl.ctrl.igno_bt = true;
+ wl->status.map.init_ok = true;
+}
+
void rtw89_btc_ntfy_poweron(struct rtw89_dev *rtwdev)
{
struct rtw89_btc *btc = &rtwdev->btc;
@@ -7941,19 +7963,6 @@ void rtw89_btc_ntfy_init(struct rtw89_dev *rtwdev, u8 mode)
const struct rtw89_chip_info *chip = rtwdev->chip;
const struct rtw89_btc_ver *ver = btc->ver;
- rtw89_debug(rtwdev, RTW89_DBG_BTC,
- "[BTC], %s(): Init %s !!\n", __func__,
- chip_id_str(chip->chip_id));
-
- _reset_btc_var(rtwdev, BTC_RESET_ALL);
- btc->dm.run_reason = BTC_RSN_NONE;
- btc->dm.run_action = BTC_ACT_NONE;
- if (ver->fcxctrl >= 7)
- btc->ctrl.ctrl_v7.igno_bt = true;
- else
- btc->ctrl.ctrl.igno_bt = true;
- wl->status.map.init_ok = true;
-
rtw89_debug(rtwdev, RTW89_DBG_BTC,
"[BTC], %s(): mode=%d\n", __func__, mode);
diff --git a/drivers/net/wireless/realtek/rtw89/coex.h b/drivers/net/wireless/realtek/rtw89/coex.h
index 259c6e2c0e3c..fb151f68eb64 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.h
+++ b/drivers/net/wireless/realtek/rtw89/coex.h
@@ -272,6 +272,7 @@ enum btc_wl_gpio_debug {
BTC_DBG_USER_DEF = 31,
};
+void rtw89_btc_init(struct rtw89_dev *rtwdev);
void rtw89_btc_ntfy_poweron(struct rtw89_dev *rtwdev);
void rtw89_btc_ntfy_poweroff(struct rtw89_dev *rtwdev);
void rtw89_btc_ntfy_init(struct rtw89_dev *rtwdev, u8 mode);
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 26b744dfbcf8..85aeb9e90812 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -7488,6 +7488,7 @@ static int rtw89_core_register_hw(struct rtw89_dev *rtwdev)
}
rtw89_rfkill_polling_init(rtwdev);
+ rtw89_btc_init(rtwdev);
return 0;
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next v2 1/9] wifi: rtw89: coex: Add Init info version 10
From: Ping-Ke Shih @ 2026-07-06 2:54 UTC (permalink / raw)
To: linux-wireless; +Cc: ku920601
In-Reply-To: <20260706025445.18428-1-pkshih@realtek.com>
From: Ching-Te Ku <ku920601@realtek.com>
The version 10 Init info add I/O offload type & variable Bluetooth
function (EX: Zigbee/Thread...etc) into the structure definition.
Firmware need to synchronize these information to do corresponding
setting.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
drivers/net/wireless/realtek/rtw89/coex.c | 58 +++++++++++++++++--
drivers/net/wireless/realtek/rtw89/coex.h | 6 ++
drivers/net/wireless/realtek/rtw89/core.h | 54 ++++++++++++++++-
drivers/net/wireless/realtek/rtw89/fw.c | 41 +++++++++++++
drivers/net/wireless/realtek/rtw89/fw.h | 6 ++
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 2 -
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 1 -
.../wireless/realtek/rtw89/rtw8852b_common.c | 1 -
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 1 -
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 1 -
10 files changed, 159 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index 1361d4d54528..43de238c18f8 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -2822,6 +2822,8 @@ static void _fw_set_drv_info(struct rtw89_dev *rtwdev, u8 index)
case CXDRVINFO_INIT:
if (ver->fcxinit == 7)
rtw89_fw_h2c_cxdrv_init_v7(rtwdev, index);
+ else if (ver->fcxinit == 10)
+ rtw89_fw_h2c_cxdrv_init_v10(rtwdev, index);
else
rtw89_fw_h2c_cxdrv_init(rtwdev, index);
break;
@@ -7884,15 +7886,30 @@ void rtw89_btc_ntfy_poweroff(struct rtw89_dev *rtwdev)
btc->cx.wl.status.map.rf_off_pre = btc->cx.wl.status.map.rf_off;
}
+#define BTC_PLATFORM_LITTLE_ENDIAN 0
static void _set_init_info(struct rtw89_dev *rtwdev)
{
const struct rtw89_chip_info *chip = rtwdev->chip;
struct rtw89_btc *btc = &rtwdev->btc;
const struct rtw89_btc_ver *ver = btc->ver;
struct rtw89_btc_dm *dm = &btc->dm;
+ struct rtw89_btc_cx *cx = &btc->cx;
struct rtw89_btc_wl_info *wl = &btc->cx.wl;
- if (ver->fcxinit == 7) {
+ if (ver->fcxinit == 10) {
+ dm->init_info.init_v10.init_mode = wl->coex_mode;
+ dm->init_info.init_v10.wl_init_ok = wl->status.map.init_ok;
+ dm->init_info.init_v10.endian_type = BTC_PLATFORM_LITTLE_ENDIAN;
+
+ dm->init_info.init_v10.module = btc->mdinfo.md_v10;
+
+ dm->init_info.init_v10.bt0_function = cx->bt0.func_type;
+ dm->init_info.init_v10.bt1_function = cx->bt1.func_type;
+ dm->init_info.init_v10.bt2_function = cx->bt_ext.func_type;
+
+ dm->init_info.init_v10.pta_mode = RTW89_MAC_AX_COEX_RTK_MODE;
+ dm->init_info.init_v10.pta_direction = RTW89_MAC_AX_COEX_INNER;
+ } else if (ver->fcxinit == 7) {
dm->init_info.init_v7.wl_only = (u8)dm->wl_only;
dm->init_info.init_v7.bt_only = (u8)dm->bt_only;
dm->init_info.init_v7.wl_init_ok = (u8)wl->status.map.init_ok;
@@ -7908,6 +7925,12 @@ static void _set_init_info(struct rtw89_dev *rtwdev)
dm->init_info.init.wl_guard_ch = chip->afh_guard_ch;
dm->init_info.init.module = btc->mdinfo.md;
}
+
+ _fw_set_drv_info(rtwdev, CXDRVINFO_INIT);
+ _fw_set_drv_info(rtwdev, CXDRVINFO_CTRL);
+ rtw89_btc_fw_set_slots(rtwdev);
+ btc_fw_set_monreg(rtwdev);
+ _set_wl_tx_power(rtwdev, RTW89_BTC_WL_DEF_TX_PWR, RTW89_PHY_0);
}
void rtw89_btc_ntfy_init(struct rtw89_dev *rtwdev, u8 mode)
@@ -7918,13 +7941,18 @@ void rtw89_btc_ntfy_init(struct rtw89_dev *rtwdev, u8 mode)
const struct rtw89_chip_info *chip = rtwdev->chip;
const struct rtw89_btc_ver *ver = btc->ver;
+ rtw89_debug(rtwdev, RTW89_DBG_BTC,
+ "[BTC], %s(): Init %s !!\n", __func__,
+ chip_id_str(chip->chip_id));
+
_reset_btc_var(rtwdev, BTC_RESET_ALL);
btc->dm.run_reason = BTC_RSN_NONE;
btc->dm.run_action = BTC_ACT_NONE;
- if (ver->fcxctrl == 7)
+ if (ver->fcxctrl >= 7)
btc->ctrl.ctrl_v7.igno_bt = true;
else
btc->ctrl.ctrl.igno_bt = true;
+ wl->status.map.init_ok = true;
rtw89_debug(rtwdev, RTW89_DBG_BTC,
"[BTC], %s(): mode=%d\n", __func__, mode);
@@ -7934,9 +7962,11 @@ void rtw89_btc_ntfy_init(struct rtw89_dev *rtwdev, u8 mode)
dm->wl_only = mode == BTC_MODE_WL ? 1 : 0;
dm->bt_only = mode == BTC_MODE_BT ? 1 : 0;
wl->status.map.rf_off = mode == BTC_MODE_WLOFF ? 1 : 0;
-
- chip->ops->btc_set_rfe(rtwdev);
- chip->ops->btc_init_cfg(rtwdev);
+ dm->vid = rtwdev->custid;
+ if (ver->fcxctrl >= 7)
+ btc->ctrl.ctrl_v7.always_freerun = mode == BTC_MODE_COTX;
+ else
+ btc->ctrl.ctrl.always_freerun = mode == BTC_MODE_COTX;
if (!wl->status.map.init_ok) {
rtw89_debug(rtwdev, RTW89_DBG_BTC,
@@ -7946,8 +7976,26 @@ void rtw89_btc_ntfy_init(struct rtw89_dev *rtwdev, u8 mode)
return;
}
+ if (rtwdev->chip->para_ver & BTC_FEAT_DUAL_BT) {
+ btc->cx.bt1.enable.now = 1;
+ btc->cx.bt1.run_patch_code = 1;
+ }
+
+ if (rtwdev->chip->para_ver & BTC_FEAT_H2C_MACRO) {
+ btc->cx.bt0.enable.now = 1;
+ btc->cx.bt0.run_patch_code = 1;
+ btc->io_oflld_type = BTC_IO_OFLD_BTC_H2C;
+ } else {
+ btc->io_oflld_type = BTC_IO_OFLD_NO_SUPPORT;
+ _update_bt_scbd(rtwdev, true);
+ }
+
+ chip->ops->btc_set_rfe(rtwdev);
+ chip->ops->btc_init_cfg(rtwdev);
+
_write_scbd(rtwdev,
BTC_WSCB_ACTIVE | BTC_WSCB_ON | BTC_WSCB_BTLOG, true);
+
if (rtw89_mac_get_ctrl_path(rtwdev)) {
rtw89_debug(rtwdev, RTW89_DBG_BTC,
"[BTC], %s(): PTA owner warning!!\n",
diff --git a/drivers/net/wireless/realtek/rtw89/coex.h b/drivers/net/wireless/realtek/rtw89/coex.h
index 6ac14611607c..259c6e2c0e3c 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.h
+++ b/drivers/net/wireless/realtek/rtw89/coex.h
@@ -16,6 +16,8 @@ enum btc_mode {
BTC_MODE_WL,
BTC_MODE_BT,
BTC_MODE_WLOFF,
+ BTC_MODE_COTX,
+ BTC_MODE_MECHANISM_INIT,
BTC_MODE_MAX
};
@@ -212,6 +214,10 @@ enum btc_chip_feature {
BTC_FEAT_NEW_BBAPI_FLOW = BIT(3), /* new btg_ctrl/pre_agc_ctrl */
BTC_FEAT_MLO_SUPPORT = BIT(4),
BTC_FEAT_H2C_MACRO = BIT(5),
+ BTC_FEAT_DUAL_BT = BIT(6),
+ BTC_FEAT_BT_6G = BIT(7),
+ BTC_FEAT_MULTI_PTA = BIT(8),
+ BTC_FEAT_DUAL_BTGA = BIT(9) /* the future A-Die */
};
enum btc_wl_mode {
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index 5dde620b1e5e..1e72c9b9f3b7 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -1451,6 +1451,12 @@ enum rtw89_btc_bt_rf_band {
BTC_BT_BMAX = 0x2
};
+enum rtw89_btc_io_offload_type {
+ BTC_IO_OFLD_NO_SUPPORT = 0,
+ BTC_IO_OFLD_MAC_API = 1,
+ BTC_IO_OFLD_BTC_H2C = 2
+};
+
enum rtw89_btc_bt_profile {
BTC_BT_NOPROFILE = 0,
BTC_BT_HFP = BIT(0),
@@ -1483,6 +1489,19 @@ struct rtw89_btc_ant_info_v7 {
u8 rsvd;
} __packed;
+struct rtw89_btc_ant_info_v10 {
+ u8 type; /* shared, dedicated(non-shared) */
+ u8 num; /* antenna count */
+ u8 isolation; /* Ant-Iso between WL/BT */
+ u8 single_pos; /* wifi 1ss-1ant at 0:S0 or 1:S1 */
+
+ u8 stream_cnt; /* spatial_stream count: Tx[7:4], Rx[3:0] */
+ u8 btg_pos; /* BT0 btg-circuit at 0:WL-S0/1:WL-S1 */
+ u8 btg1_pos; /* BT1 btg-circuit at 0:WL-S0/1:WL-S1 */
+ u8 func[5]; /* function at 1~5 Ant refer to enum btc_bt_func_type */
+ u8 ant_xmap[2][4];
+} __packed;
+
enum rtw89_tfc_dir {
RTW89_TFC_UL,
RTW89_TFC_DL,
@@ -2129,9 +2148,24 @@ struct rtw89_btc_module_v7 {
struct rtw89_btc_ant_info_v7 ant;
} __packed;
+struct rtw89_btc_module_v10 {
+ u8 rfe_type;
+ u8 wa_type; /* Refer to enum btc_wa_type */
+ u8 kt_ver;
+ u8 kt_ver_adie;
+
+ u8 bt0_pos; /* wl-end view: get from efuse, must compare bt.btg_type*/
+ u8 bt0_sw_type; /* BT Ant-switch: None(non-share), Int(BTG), Ext(SPDT)*/
+ u8 bt1_pos; /* BTC_BT_ALONE or BTC_BT_BTG */
+ u8 bt1_sw_type;
+
+ struct rtw89_btc_ant_info_v10 ant;
+} __packed;
+
union rtw89_btc_module_info {
struct rtw89_btc_module md;
struct rtw89_btc_module_v7 md_v7;
+ struct rtw89_btc_module_v10 md_v10;
};
#define RTW89_BTC_DM_MAXSTEP 30
@@ -2170,9 +2204,24 @@ struct rtw89_btc_init_info_v7 {
struct rtw89_btc_module_v7 module;
} __packed;
+struct rtw89_btc_init_info_v10 {
+ u8 endian_type; /* 0: little-endian, 1:big-endian */
+ u8 init_mode; /* refer to enum BTC_MODE_xxx */
+ u8 wl_init_ok;
+ u8 bt0_function;
+
+ u8 bt1_function;
+ u8 bt2_function;
+ u8 pta_mode;
+ u8 pta_direction;
+
+ struct rtw89_btc_module_v10 module;
+};
+
union rtw89_btc_init_info_u {
struct rtw89_btc_init_info init;
struct rtw89_btc_init_info_v7 init_v7;
+ struct rtw89_btc_init_info_v10 init_v10;
};
struct rtw89_btc_wl_tx_limit_para {
@@ -2253,6 +2302,7 @@ struct rtw89_btc_bt_info {
u8 raw_info[BTC_BTINFO_MAX]; /* raw bt info from mailbox */
u8 txpwr_info[BTC_BTINFO_MAX];
u8 rssi_level;
+ u8 func_type;
u32 scbd;
u32 feature;
@@ -3173,6 +3223,7 @@ struct rtw89_btc_dm {
u8 run_reason;
u8 run_action;
u8 wl_tx_pwr_phy_map;
+ u8 vid;
u8 wl_pre_agc: 2;
u8 wl_lna2: 1;
@@ -3203,7 +3254,7 @@ struct rtw89_btc_ctrl_v7 {
union rtw89_btc_ctrl_list {
struct rtw89_btc_ctrl ctrl;
- struct rtw89_btc_ctrl_v7 ctrl_v7;
+ struct rtw89_btc_ctrl_v7 ctrl_v7; /* ver 8, 9 is the same */
};
struct rtw89_btc_dbg {
@@ -3425,6 +3476,7 @@ struct rtw89_btc {
u8 policy[RTW89_BTC_POLICY_MAXLEN];
u8 ant_type;
u8 btg_pos;
+ u8 io_oflld_type;
u16 policy_len;
u16 policy_type;
u32 hubmsg_cnt;
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 9d98805835d6..b97c6e9c18bc 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -5863,6 +5863,47 @@ int rtw89_fw_h2c_cxdrv_init_v7(struct rtw89_dev *rtwdev, u8 type)
return ret;
}
+int rtw89_fw_h2c_cxdrv_init_v10(struct rtw89_dev *rtwdev, u8 type)
+{
+ struct rtw89_btc *btc = &rtwdev->btc;
+ struct rtw89_btc_dm *dm = &btc->dm;
+ struct rtw89_btc_init_info_v10 *init_info = &dm->init_info.init_v10;
+ struct rtw89_h2c_cxinit_v10 *h2c;
+ u32 len = sizeof(*h2c);
+ struct sk_buff *skb;
+ int ret;
+
+ skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);
+ if (!skb) {
+ rtw89_err(rtwdev, "failed to alloc skb for h2c cxdrv_init_v10\n");
+ return -ENOMEM;
+ }
+ skb_put(skb, len);
+ h2c = (struct rtw89_h2c_cxinit_v10 *)skb->data;
+
+ h2c->hdr.type = type;
+ h2c->hdr.ver = btc->ver->fcxinit;
+ h2c->hdr.len = len - H2C_LEN_CXDRVHDR_V7;
+ h2c->init = *init_info;
+
+ rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,
+ H2C_CAT_OUTSRC, BTFC_SET,
+ SET_DRV_INFO, 0, 0,
+ len);
+
+ ret = rtw89_h2c_tx(rtwdev, skb, false);
+ if (ret) {
+ rtw89_err(rtwdev, "failed to send h2c\n");
+ goto fail;
+ }
+
+ return 0;
+fail:
+ dev_kfree_skb_any(skb);
+
+ return ret;
+}
+
#define PORT_DATA_OFFSET 4
#define H2C_LEN_CXDRVINFO_ROLE_DBCC_LEN 12
#define H2C_LEN_CXDRVINFO_ROLE_SIZE(max_role_num) \
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index 71e8554a7af7..de8b77de8705 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -2592,6 +2592,11 @@ struct rtw89_h2c_cxinit_v7 {
struct rtw89_btc_init_info_v7 init;
} __packed;
+struct rtw89_h2c_cxinit_v10 {
+ struct rtw89_h2c_cxhdr_v7 hdr;
+ struct rtw89_btc_init_info_v10 init;
+} __packed;
+
static inline void RTW89_SET_FWCMD_CXROLE_CONNECT_CNT(void *cmd, u8 val)
{
u8p_replace_bits((u8 *)(cmd) + 2, val, GENMASK(7, 0));
@@ -5380,6 +5385,7 @@ int rtw89_fw_h2c_tx_history(struct rtw89_dev *rtwdev, u16 mac_id);
int rtw89_fw_h2c_drv_ctrl_fw(struct rtw89_dev *rtwdev);
int rtw89_fw_h2c_cxdrv_init(struct rtw89_dev *rtwdev, u8 type);
int rtw89_fw_h2c_cxdrv_init_v7(struct rtw89_dev *rtwdev, u8 type);
+int rtw89_fw_h2c_cxdrv_init_v10(struct rtw89_dev *rtwdev, u8 type);
int rtw89_fw_h2c_cxdrv_role(struct rtw89_dev *rtwdev, u8 type);
int rtw89_fw_h2c_cxdrv_role_v1(struct rtw89_dev *rtwdev, u8 type);
int rtw89_fw_h2c_cxdrv_role_v2(struct rtw89_dev *rtwdev, u8 type);
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b.c b/drivers/net/wireless/realtek/rtw89/rtw8851b.c
index 4caf231c6287..a1a63588cb90 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8851b.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8851b.c
@@ -2277,8 +2277,6 @@ static void rtw8851b_btc_init_cfg(struct rtw89_dev *rtwdev)
/* enable BT counter 0xda40[16,2] = 2b'11 */
rtw89_write32_set(rtwdev, R_AX_CSR_MODE, B_AX_BT_CNT_RST | B_AX_STATIS_BT_EN);
-
- btc->cx.wl.status.map.init_ok = true;
}
static
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
index 78addc0aef69..055c67a07cea 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c
@@ -1945,7 +1945,6 @@ static void rtw8852a_btc_init_cfg(struct rtw89_dev *rtwdev)
/* enable BT counter 0xda40[16,2] = 2b'11 */
rtw89_write32_set(rtwdev,
R_AX_CSR_MODE, B_AX_BT_CNT_RST | B_AX_STATIS_BT_EN);
- btc->cx.wl.status.map.init_ok = true;
}
static
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b_common.c b/drivers/net/wireless/realtek/rtw89/rtw8852b_common.c
index df5fbae50ff5..7d409a64869f 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852b_common.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852b_common.c
@@ -1838,7 +1838,6 @@ static void __rtw8852bx_btc_init_cfg(struct rtw89_dev *rtwdev)
/* enable BT counter 0xda40[16,2] = 2b'11 */
rtw89_write32_set(rtwdev, R_AX_CSR_MODE, B_AX_BT_CNT_RST | B_AX_STATIS_BT_EN);
- btc->cx.wl.status.map.init_ok = true;
}
static
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c.c b/drivers/net/wireless/realtek/rtw89/rtw8852c.c
index 29a3c90021f3..9e630b897986 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852c.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852c.c
@@ -2761,7 +2761,6 @@ static void rtw8852c_btc_init_cfg(struct rtw89_dev *rtwdev)
rtw89_write32_set(rtwdev,
R_AX_BT_CNT_CFG, B_AX_BT_CNT_EN |
B_AX_BT_CNT_RST_V1);
- btc->cx.wl.status.map.init_ok = true;
}
static
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
index 6d4301661b04..382034eb27d0 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
@@ -2828,7 +2828,6 @@ static void rtw8922a_btc_init_cfg(struct rtw89_dev *rtwdev)
rtw89_write32(rtwdev, R_BTC_ZB_COEX_TBL_1, 0xda5a5a5a);
rtw89_write32(rtwdev, R_BTC_ZB_BREAK_TBL, 0xf0ffffff);
- btc->cx.wl.status.map.init_ok = true;
}
static void
--
2.25.1
^ permalink raw reply related
* [PATCH rtw-next v2 0/9] wifi: rtw89: coex: implement components for dual Bluetooth
From: Ping-Ke Shih @ 2026-07-06 2:54 UTC (permalink / raw)
To: linux-wireless; +Cc: ku920601
Extend more components of BT-coexitence to support dual Bluetooth,
including TDMA descriptor, TX power, RX gain, scoreboard and etc.
v2:
- patch 6/9: fix wrong compare logic, which should be && instead of ||
found by kernel test robot.
https://lore.kernel.org/oe-kbuild-all/202607032153.rVIyuBbI-lkp@intel.com/T/#u
Ching-Te Ku (9):
wifi: rtw89: coex: Add Init info version 10
wifi: rtw89: coex: add rtw89_btc_init() entry for initialization once
wifi: rtw89: coex: Update TDMA descriptor for dual MAC
wifi: rtw89: coex: Add Bluetooth binding for Bluetooth TX power
setting
wifi: rtw89: coex: Add Bluetooth binding for Bluetooth RX gain setting
wifi: rtw89: coex: Add WiFi/Bluetooth adapter binding info
wifi: rtw89: coex: Add TDMA binding for dual MAC
wifi: rtw89: coex: Update scoreboard related logic for dual Bluetooth
wifi: rtw89: coex: Add Co-RX logic
drivers/net/wireless/realtek/rtw89/coex.c | 1493 +++++++++++------
drivers/net/wireless/realtek/rtw89/coex.h | 16 +
drivers/net/wireless/realtek/rtw89/core.c | 5 +-
drivers/net/wireless/realtek/rtw89/core.h | 241 ++-
drivers/net/wireless/realtek/rtw89/fw.c | 41 +
drivers/net/wireless/realtek/rtw89/fw.h | 9 +
drivers/net/wireless/realtek/rtw89/rtw8851b.c | 2 -
drivers/net/wireless/realtek/rtw89/rtw8852a.c | 1 -
.../wireless/realtek/rtw89/rtw8852b_common.c | 1 -
drivers/net/wireless/realtek/rtw89/rtw8852c.c | 1 -
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 1 -
11 files changed, 1298 insertions(+), 513 deletions(-)
base-commit: 2b7858891b100587c10c136cf07205335a897be0
--
2.25.1
^ permalink raw reply
* [PATCH] wifi: mt76: mt7925: Add flag to control if need DMA re-init
From: JB Tsai @ 2026-07-06 2:43 UTC (permalink / raw)
To: nbd, lorenzo
Cc: linux-wireless, linux-mediatek, Sean.Wang, Quan.Zhou, Ryder.Lee,
Leon.Yen, litien.chang, jeff.hsu, jb.tsai, Jeff Hsu
From: Jeff Hsu <Jeff.Hsu@mediatek.com>
Add flag(skip_wpdma_reinit) to control if need do DMA re-init
Signed-off-by: Jeff Hsu <Jeff.Hsu@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 4 ++++
drivers/net/wireless/mediatek/mt76/mt792x.h | 1 +
drivers/net/wireless/mediatek/mt76/mt792x_dma.c | 5 +++++
3 files changed, 10 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
index c8537a5cdf67..154e4372664e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
@@ -650,6 +650,10 @@ static int mt7925_pci_probe(struct pci_dev *pdev,
if (!mt7925_disable_aspm && mt76_pci_aspm_supported(pdev))
dev->aspm_supported = true;
+ /* MT7935 does not need wpdma reinit */
+ if (is_mt7928(&dev->mt76))
+ dev->skip_wpdma_reinit = true;
+
ret = __mt792x_mcu_fw_pmctrl(dev);
if (ret)
goto err_free_dev;
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x.h b/drivers/net/wireless/mediatek/mt76/mt792x.h
index 8c7ecd3ce126..18d6e2c35606 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x.h
+++ b/drivers/net/wireless/mediatek/mt76/mt792x.h
@@ -271,6 +271,7 @@ struct mt792x_dev {
bool hif_idle:1;
bool hif_resumed:1;
bool regd_change:1;
+ bool skip_wpdma_reinit:1;
wait_queue_head_t wait;
struct work_struct init_work;
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_dma.c b/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
index 8ad94fa58340..8308935491d3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
@@ -418,6 +418,11 @@ int mt792x_wpdma_reinit_cond(struct mt792x_dev *dev)
struct mt76_connac_pm *pm = &dev->pm;
int err;
+ /* Skip wpdma reinit if chip doesn't need it */
+ if (dev->skip_wpdma_reinit) {
+ return 0;
+ }
+
/* check if the wpdma must be reinitialized */
if (mt792x_dma_need_reinit(dev)) {
/* disable interrutpts */
--
2.45.2
^ permalink raw reply related
* [PATCH] wifi: mt76: mt7921: Add flag to control if need DMA re-init
From: JB Tsai @ 2026-07-06 2:43 UTC (permalink / raw)
To: nbd, lorenzo
Cc: linux-wireless, linux-mediatek, Sean.Wang, Quan.Zhou, Ryder.Lee,
Leon.Yen, litien.chang, jeff.hsu, jb.tsai, Jeff Hsu
From: Jeff Hsu <Jeff.Hsu@mediatek.com>
Add flag(skip_wpdma_reinit) to control if need do DMA re-init
Signed-off-by: Jeff Hsu <Jeff.Hsu@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
index a93cdc1f1c93..c5af9cd3edce 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
@@ -398,6 +398,9 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
if (!mt7921_disable_aspm && mt76_pci_aspm_supported(pdev))
dev->aspm_supported = true;
+ /* MT7921 needs wpdma reinit */
+ dev->skip_wpdma_reinit = false;
+
ret = mt792xe_mcu_fw_pmctrl(dev);
if (ret)
goto err_free_dev;
--
2.45.2
^ permalink raw reply related
* Re: [PATCH ath-next] wifi: ath12k: fix ML-STA authentication timeout on QCC2072
From: Baochen Qiang @ 2026-07-06 1:32 UTC (permalink / raw)
To: Miaoqing Pan, jjohnson; +Cc: ath12k, linux-wireless, linux-kernel
In-Reply-To: <20260704073000.3300099-1-miaoqing.pan@oss.qualcomm.com>
On 7/4/2026 3:30 PM, Miaoqing Pan wrote:
> QCC2072 firmware interprets the MLO_LINK_ADD and MLO_START_AS_ACTIVE
> flags to control the link state during MLO vdev start. MLO_LINK_ADD
> indicates that a link is being added, while MLO_START_AS_ACTIVE specifies
> that the link should become active during the start.
>
> When an association link is added without setting MLO_START_AS_ACTIVE,
> the firmware may transition the link into a suspended state. In this
> case, authentication frames transmitted by the host can be dropped,
> leading to repeated authentication retries and eventual timeout,
> for example:
> wlp1s0: send auth to <AP> (try 1/3)
> wlp1s0: send auth to <AP> (try 2/3)
> wlp1s0: send auth to <AP> (try 3/3)
> wlp1s0: authentication with <AP> timed out
>
> Avoid triggering this behavior by setting the MLO_START_AS_ACTIVE flag
> when MLO_ASSOC_LINK is set, which tells the firmware that the current
> vdev must not enter suspend mode
>
> Note that this change relies on firmware behavior observed on the QCC2072
> platform. The firmware on WCN7850 and QCN9274 does not use the
> MLO_START_AS_ACTIVE flag, so this change is effectively a no-op on those
> platforms
>
> Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0.c2-00068-QCACOLSWPL_V1_TO_SILICONZ-1
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
>
> Fixes: d8e1f4a19310 ("wifi: ath12k: enable QCC2072 support")
> Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
^ permalink raw reply
* RE: [PATCH rtw-next v3] wifi: rtw89: check return values in rtw89_ops_start_ap()
From: Ping-Ke Shih @ 2026-07-06 1:28 UTC (permalink / raw)
To: d.morgun@ispras.ru
Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org
In-Reply-To: <6754361d578f7418fe85e1aec8a6b618@ispras.ru>
d.morgun@ispras.ru <d.morgun@ispras.ru> wrote:
> Hi Ping-Ke,
>
> Sorry for the confusion. The v3 suffix was added by mistake during local
> iterations of the patch.
>
> There is no public v1/v2 in the mailing list history. This is the first
> version submitted upstream.
>
> I will resend as v1 if needed.
No need to resend. I have merged this patch.
Thanks
Ping-Ke
^ permalink raw reply
* Re: [PATCH v2] ath12k: fix NULL pointer dereference in rhash table destroy
From: Jeff Johnson @ 2026-07-05 19:15 UTC (permalink / raw)
To: Vasanthakumar Thiagarajan, Jose Ignacio Tornos Martinez, jjohnson
Cc: linux-wireless, ath12k, linux-kernel, stable
In-Reply-To: <b25be5a2-bef6-4fda-b166-becca3d1d650@oss.qualcomm.com>
On 7/5/2026 10:27 AM, Vasanthakumar Thiagarajan wrote:
>
>
> On 7/5/2026 10:53 PM, Vasanthakumar Thiagarajan wrote:
>>
>>
>> On 6/15/2026 4:51 PM, Jose Ignacio Tornos Martinez wrote:
>>> When unbinding the ath12k driver, kernel NULL pointer dereferences
>>> occur in irq_work_sync() called from rhashtable_destroy().
>>>
>>> Two hash tables are affected:
>>> 1. ath12k_link_sta hash table in ath12k_base
>>> 2. ath12k_dp_link_peer hash table in ath12k_dp
>>>
>>> The issue happens because the destroy functions are called unconditionally
>>> in cleanup paths, but the hash tables are only initialized late in their
>>> respective init functions. If the device was never fully started or if the
>>> init functions failed before initializing the hash tables, the pointers
>>> will be NULL. The issues are always reproducible from a VM because the MSI
>>> addressing initialization is failing.
>>>
>>> Call trace for ath12k_link_sta_rhash_tbl_destroy:
>>> RIP: irq_work_sync+0x1e/0x70
>>> rhashtable_destroy+0x12/0x60
>>> ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]
>>> ath12k_core_stop+0xe/0x80 [ath12k]
>>> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
>>> ath12k_pci_remove+0x60/0x110 [ath12k]
>>>
>>> Call trace for ath12k_dp_link_peer_rhash_tbl_destroy:
>>> RIP: irq_work_sync+0x1e/0x70
>>> rhashtable_destroy+0x12/0x60
>>> ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]
>>> ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]
>>> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
>>> ath12k_pci_remove+0x60/0x110 [ath12k]
>>>
>>> Fix this by adding NULL checks before calling rhashtable_destroy() in
>>> both destroy functions.
>>>
>>> The NULL check approach was chosen because the rhashtable pointer
>>> serves as the initialization state indicator. The init can fail at
>>> various points, leaving some components uninitialized. Checking the
>>> pointer directly is simpler than adding separate state flags that
>>> would need synchronization.
>>>
>>> Fixes: 57ccca410237 ("wifi: ath12k: Add hash table for ath12k_link_sta in ath12k_base")
>>> Fixes: a88cf5f71adf ("wifi: ath12k: Add hash table for ath12k_dp_link_peer")
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
>>
>> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
>
> Missed to mention that pls add wifi prefix to the patch title.
I'll fix this in my pending branch.
/jeff
^ permalink raw reply
* Re: [PATCH v2] ath12k: fix NULL pointer dereference in rhash table destroy
From: Vasanthakumar Thiagarajan @ 2026-07-05 17:27 UTC (permalink / raw)
To: Jose Ignacio Tornos Martinez, jjohnson
Cc: linux-wireless, ath12k, linux-kernel, stable
In-Reply-To: <d0fd509f-760f-4632-b116-0b6494466f22@oss.qualcomm.com>
On 7/5/2026 10:53 PM, Vasanthakumar Thiagarajan wrote:
>
>
> On 6/15/2026 4:51 PM, Jose Ignacio Tornos Martinez wrote:
>> When unbinding the ath12k driver, kernel NULL pointer dereferences
>> occur in irq_work_sync() called from rhashtable_destroy().
>>
>> Two hash tables are affected:
>> 1. ath12k_link_sta hash table in ath12k_base
>> 2. ath12k_dp_link_peer hash table in ath12k_dp
>>
>> The issue happens because the destroy functions are called unconditionally
>> in cleanup paths, but the hash tables are only initialized late in their
>> respective init functions. If the device was never fully started or if the
>> init functions failed before initializing the hash tables, the pointers
>> will be NULL. The issues are always reproducible from a VM because the MSI
>> addressing initialization is failing.
>>
>> Call trace for ath12k_link_sta_rhash_tbl_destroy:
>> RIP: irq_work_sync+0x1e/0x70
>> rhashtable_destroy+0x12/0x60
>> ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]
>> ath12k_core_stop+0xe/0x80 [ath12k]
>> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
>> ath12k_pci_remove+0x60/0x110 [ath12k]
>>
>> Call trace for ath12k_dp_link_peer_rhash_tbl_destroy:
>> RIP: irq_work_sync+0x1e/0x70
>> rhashtable_destroy+0x12/0x60
>> ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]
>> ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]
>> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
>> ath12k_pci_remove+0x60/0x110 [ath12k]
>>
>> Fix this by adding NULL checks before calling rhashtable_destroy() in
>> both destroy functions.
>>
>> The NULL check approach was chosen because the rhashtable pointer
>> serves as the initialization state indicator. The init can fail at
>> various points, leaving some components uninitialized. Checking the
>> pointer directly is simpler than adding separate state flags that
>> would need synchronization.
>>
>> Fixes: 57ccca410237 ("wifi: ath12k: Add hash table for ath12k_link_sta in ath12k_base")
>> Fixes: a88cf5f71adf ("wifi: ath12k: Add hash table for ath12k_dp_link_peer")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
>
> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Missed to mention that pls add wifi prefix to the patch title.
^ permalink raw reply
* [PATCH] wifi: ath10k: Drop redundant NULL check on devm_clk_get()
From: Krzysztof Kozlowski @ 2026-07-05 17:24 UTC (permalink / raw)
To: Jeff Johnson, linux-wireless, ath10k, linux-kernel; +Cc: Krzysztof Kozlowski
devm_clk_get() does not return NULL (only valid clock or ERR pointer),
so simplify the code to drop redundant IS_ERR_OR_NULL().
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath10k/ahb.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c
index eb8b35b6224d..7456f885d2b5 100644
--- a/drivers/net/wireless/ath/ath10k/ahb.c
+++ b/drivers/net/wireless/ath/ath10k/ahb.c
@@ -87,24 +87,24 @@ static int ath10k_ahb_clock_init(struct ath10k *ar)
dev = &ar_ahb->pdev->dev;
ar_ahb->cmd_clk = devm_clk_get(dev, "wifi_wcss_cmd");
- if (IS_ERR_OR_NULL(ar_ahb->cmd_clk)) {
+ if (IS_ERR(ar_ahb->cmd_clk)) {
ath10k_err(ar, "failed to get cmd clk: %ld\n",
PTR_ERR(ar_ahb->cmd_clk));
- return ar_ahb->cmd_clk ? PTR_ERR(ar_ahb->cmd_clk) : -ENODEV;
+ return PTR_ERR(ar_ahb->cmd_clk);
}
ar_ahb->ref_clk = devm_clk_get(dev, "wifi_wcss_ref");
- if (IS_ERR_OR_NULL(ar_ahb->ref_clk)) {
+ if (IS_ERR(ar_ahb->ref_clk)) {
ath10k_err(ar, "failed to get ref clk: %ld\n",
PTR_ERR(ar_ahb->ref_clk));
- return ar_ahb->ref_clk ? PTR_ERR(ar_ahb->ref_clk) : -ENODEV;
+ return PTR_ERR(ar_ahb->ref_clk);
}
ar_ahb->rtc_clk = devm_clk_get(dev, "wifi_wcss_rtc");
- if (IS_ERR_OR_NULL(ar_ahb->rtc_clk)) {
+ if (IS_ERR(ar_ahb->rtc_clk)) {
ath10k_err(ar, "failed to get rtc clk: %ld\n",
PTR_ERR(ar_ahb->rtc_clk));
- return ar_ahb->rtc_clk ? PTR_ERR(ar_ahb->rtc_clk) : -ENODEV;
+ return PTR_ERR(ar_ahb->rtc_clk);
}
return 0;
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v2] ath12k: fix NULL pointer dereference in rhash table destroy
From: Vasanthakumar Thiagarajan @ 2026-07-05 17:23 UTC (permalink / raw)
To: Jose Ignacio Tornos Martinez, jjohnson
Cc: linux-wireless, ath12k, linux-kernel, stable
In-Reply-To: <20260615112103.601982-1-jtornosm@redhat.com>
On 6/15/2026 4:51 PM, Jose Ignacio Tornos Martinez wrote:
> When unbinding the ath12k driver, kernel NULL pointer dereferences
> occur in irq_work_sync() called from rhashtable_destroy().
>
> Two hash tables are affected:
> 1. ath12k_link_sta hash table in ath12k_base
> 2. ath12k_dp_link_peer hash table in ath12k_dp
>
> The issue happens because the destroy functions are called unconditionally
> in cleanup paths, but the hash tables are only initialized late in their
> respective init functions. If the device was never fully started or if the
> init functions failed before initializing the hash tables, the pointers
> will be NULL. The issues are always reproducible from a VM because the MSI
> addressing initialization is failing.
>
> Call trace for ath12k_link_sta_rhash_tbl_destroy:
> RIP: irq_work_sync+0x1e/0x70
> rhashtable_destroy+0x12/0x60
> ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]
> ath12k_core_stop+0xe/0x80 [ath12k]
> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
> ath12k_pci_remove+0x60/0x110 [ath12k]
>
> Call trace for ath12k_dp_link_peer_rhash_tbl_destroy:
> RIP: irq_work_sync+0x1e/0x70
> rhashtable_destroy+0x12/0x60
> ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]
> ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]
> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]
> ath12k_pci_remove+0x60/0x110 [ath12k]
>
> Fix this by adding NULL checks before calling rhashtable_destroy() in
> both destroy functions.
>
> The NULL check approach was chosen because the rhashtable pointer
> serves as the initialization state indicator. The init can fail at
> various points, leaving some components uninitialized. Checking the
> pointer directly is simpler than adding separate state flags that
> would need synchronization.
>
> Fixes: 57ccca410237 ("wifi: ath12k: Add hash table for ath12k_link_sta in ath12k_base")
> Fixes: a88cf5f71adf ("wifi: ath12k: Add hash table for ath12k_dp_link_peer")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
^ permalink raw reply
* [PATCH] wifi: cfg80211: bound Common-Info-Length in ieee80211_mle_size_ok()
From: Aldo Ariel Panzardo @ 2026-07-05 13:50 UTC (permalink / raw)
To: Johannes Berg
Cc: linux-wireless, linux-kernel, security, Greg Kroah-Hartman,
Aldo Ariel Panzardo
ieee80211_mle_size_ok() only lower-bounds the Common-Info-Length octet
(mle->variable[0]) of a Multi-Link element. After accumulating the
expected 'common' length from the presence bitmap it checks
len >= fixed + common and then returns "mle->variable[0] >= common", but
it never verifies that variable[0] fits within the element, i.e. that
variable[0] <= len - fixed.
Because ieee80211_mle_common_size() returns "sizeof(*mle) +
mle->variable[0]" truncated to u8, a Common-Info-Length of 254 wraps it
to 0. cfg80211_defrag_mle() then starts walking per-STA-profile
subelements from offset 0, and a body crafted to also parse as a valid
element stream passes the for_each_element_completed() interlock.
cfg80211_parse_ml_elem_sta_data() finally does:
ml_common_len = ml_elem->variable[0];
...
memcpy(new_ie + data.ielen, ml_elem,
sizeof(*ml_elem) + ml_common_len);
Only the destination is bounded (against IEEE80211_MAX_DATA_LEN); the
source read of sizeof(*ml_elem) + variable[0] bytes from the received
frame is not. A crafted probe response therefore makes the parser
over-read up to ~230 bytes past the element into adjacent slab memory
(the RX skb head, including skb_shared_info), and the copied bytes are
exposed to unprivileged user space through the per-link BSS information
elements in nl80211 scan results -- a remotely-plantable,
locally-readable kernel heap infoleak.
Confirmed over the air between two physical Intel radios on an
unmodified v7.2-rc1 KASAN build: scan results contained heap pointer
values and a kernel uevent string that were absent from the transmitted
frame.
Add the missing upper bound so the Common-Info-Length can never exceed
the element. This also removes the same latent gap in the other
ieee80211_mle_common_size() consumers.
Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element")
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
include/linux/ieee80211-eht.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h
index 18f9c662cf4c..dd1ec8a0af5a 100644
--- a/include/linux/ieee80211-eht.h
+++ b/include/linux/ieee80211-eht.h
@@ -919,7 +919,8 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)
return true;
/* if present, common length is the first octet there */
- return mle->variable[0] >= common;
+ return mle->variable[0] >= common &&
+ mle->variable[0] <= len - fixed;
}
/**
--
2.43.0
^ permalink raw reply related
* [PATCH] timekeeping: Document monotonic raw timestamps in snapshots correctly
From: Thomas Gleixner @ 2026-07-05 12:38 UTC (permalink / raw)
To: Thomas Weißschuh
Cc: LKML, David Woodhouse, Miroslav Lichvar, John Stultz,
Stephen Boyd, Anna-Maria Behnsen, Frederic Weisbecker,
Arthur Kiyanovski, Rodolfo Giometti, Vincent Donnefort,
Marc Zyngier, Oliver Upton, kvmarm, Oliver Upton, Richard Cochran,
netdev, Takashi Iwai, Miri Korenblit, Johannes Berg, Jacob Keller,
Tony Nguyen, Saeed Mahameed, Peter Hilber, Michael S. Tsirkin,
virtualization, linux-wireless, linux-sound
In-Reply-To: <87bjctsptt.ffs@fw13>
The comments related to raw monotonic timestamps for the various
snapshot mechanisms in code and struct documentation are ambiguous. They
reference them as CLOCK_MONOTONIC_RAW timestamps, but with the arrival
of AUX clocks that's not longer correct.
The raw monotonic timestamps only represent CLOCK_MONOTONIC_RAW for the
system time clock IDs, i.e. REALTIME, MONOTONIC, BOOTTIME, TAI.
For AUX clocks they refer to the monotonic raw clock which is related to
the individual AUX clocks. These monotonic raw timestamps have the same
conversion factor as CLOCK_MONOTONIC_RAW, but differ from that by an
offset:
MONORAW(AUX$N) = MONORAW(SYSTEM) + OFFSET(AUX$N)
The offset is established when a AUX clock is enabled and stays constant
for the lifetime of the AUX clock.
Update the comments so they reflect reality.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reported-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
---
include/linux/timekeeping.h | 10 +++++++++-
kernel/time/timekeeping.c | 16 +++++++++++++++-
2 files changed, 24 insertions(+), 2 deletions(-)
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -276,7 +276,7 @@ static inline bool ktime_get_aux_ts64(cl
#endif
/**
- * struct system_time_snapshot - Simultaneous time capture of CLOCK_MONOTONIC_RAW,
+ * struct system_time_snapshot - Simultaneous time capture of monotonic raw time,
* a selected CLOCK_* and the clocksource counter value
* @cycles: Clocksource counter value to produce the system times
* @hw_cycles: For derived clocksources, the hardware counter value from
@@ -289,6 +289,10 @@ static inline bool ktime_get_aux_ts64(cl
* @clock_was_set_seq: The sequence number of clock-was-set events
* @cs_was_changed_seq: The sequence number of clocksource change events
* @valid: True if the snapshot is valid
+ *
+ * @monoraw is CLOCK_MONOTONIC_RAW for system time CLOCK ids. For CLOCK_AUX$N
+ * clock ids it's the monotonic raw time related to the AUX clock, which is
+ * CLOCK_MONOTONIC_RAW plus a AUX clock specific offset.
*/
struct system_time_snapshot {
u64 cycles;
@@ -326,6 +330,10 @@ struct system_counterval_t {
* @sys_counter: Clocksource counter value simultaneous with device time
* @sys_systime: System time for @clock_id
* @sys_monoraw: Monotonic raw simultaneous with device time
+ *
+ * @sys_monoraw is CLOCK_MONOTONIC_RAW for system time CLOCK ids. For
+ * CLOCK_AUX$N clock ids it's the monotonic raw time related to the AUX clock,
+ * which is CLOCK_MONOTONIC_RAW plus a AUX clock specific offset.
*/
struct system_device_crosststamp {
clockid_t clock_id;
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1202,10 +1202,21 @@ static inline u64 tk_clock_read_snapshot
/**
* ktime_get_snapshot_id - Simultaneously snapshot a given clock ID with
- * CLOCK_MONOTONIC_RAW and the underlying
+ * the corresponding monotonic raw and the underlying
* clocksource counter value.
* @clock_id: The clock ID to snapshot
* @systime_snapshot: Pointer to struct receiving the system time snapshot
+ *
+ * For the system time keeping clocks (REALTIME, MONOTONIC and BOOTTIME) the
+ * monotonic raw clock is CLOCK_MONOTONIC_RAW. For AUX clocks this is the
+ * monotonic raw clock related to the AUX clock. These AUX clock related
+ * monotonic raw clocks have a strict linear offset to the system time
+ * CLOCK_MONOTONIC_RAW:
+ *
+ * MONOTONIC_RAW(AUX$N) = CLOCK_MONOTONIC_RAW(system) + offset(AUX$N)
+ *
+ * The offset is established when a AUX clock is initialized, but it is
+ * currently not accessible.
*/
void ktime_get_snapshot_id(clockid_t clock_id, struct system_time_snapshot *systime_snapshot)
{
@@ -1512,6 +1523,9 @@ EXPORT_SYMBOL_GPL(ktime_real_to_base_clo
* @xtstamp: Receives simultaneously captured system and device time
*
* Reads a timestamp from a device and correlates it to system time
+ *
+ * See documentation for ktime_get_snapshot_id() for information about the raw
+ * monotonic time stamp which is used here.
*/
int get_device_system_crosststamp(int (*get_time_fn)
(ktime_t *device_time,
^ permalink raw reply
* [PATCH] wifi: rsi: validate beacon length before fixed buffer copy
From: Pengpeng Hou @ 2026-07-05 8:48 UTC (permalink / raw)
To: Kees Cook, linux-wireless, linux-kernel; +Cc: Pengpeng Hou
rsi_prepare_beacon() copies the mac80211 beacon frame after
FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller
than MAX_MGMT_PKT_SIZE after alignment.
Validate the beacon length against the actual tailroom before the copy
and skb_put(). Leave ownership of the management skb with the caller on
error, matching the existing rsi_send_beacon() cleanup path.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -431,6 +431,7 @@
struct ieee80211_vif *vif;
struct sk_buff *mac_bcn;
u8 vap_id = 0, i;
+ unsigned int tailroom;
u16 tim_offset = 0;
for (i = 0; i < RSI_MAX_VIFS; i++) {
@@ -479,6 +480,13 @@
if (mac_bcn->data[tim_offset + 2] == 0)
bcn_frm->frame_info |= cpu_to_le16(RSI_DATA_DESC_DTIM_BEACON);
+
+ tailroom = skb_tailroom(skb);
+ if (tailroom < FRAME_DESC_SZ ||
+ mac_bcn->len > tailroom - FRAME_DESC_SZ) {
+ dev_kfree_skb(mac_bcn);
+ return -EMSGSIZE;
+ }
memcpy(&skb->data[FRAME_DESC_SZ], mac_bcn->data, mac_bcn->len);
skb_put(skb, mac_bcn->len + FRAME_DESC_SZ);
^ permalink raw reply
* [PATCH] wifi: libipw: fix key index receive bound checks
From: Pengpeng Hou @ 2026-07-05 8:35 UTC (permalink / raw)
To: Stanislav Yakovlev, linux-wireless, linux-kernel; +Cc: Pengpeng Hou
libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in
both the software-decrypt key selection path and the hardware-decrypted
IV/ICV strip path. In both places the existing guard only checks
skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the
byte at hdrlen + 3.
Require hdrlen + 4 bytes before reading that item in both paths. This is
a local source-boundary check only; it does not change the key index
semantics.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
--- a/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/intel/ipw2x00/libipw_rx.c
@@ -414,7 +414,7 @@
ieee->host_mc_decrypt : ieee->host_decrypt;
if (can_be_decrypted) {
- if (skb->len >= hdrlen + 3) {
+ if (skb->len >= hdrlen + 4) {
/* Top two-bits of byte 3 are the key index */
keyidx = skb->data[hdrlen + 3] >> 6;
}
@@ -660,7 +660,7 @@
int trimlen = 0;
/* Top two-bits of byte 3 are the key index */
- if (skb->len >= hdrlen + 3)
+ if (skb->len >= hdrlen + 4)
keyidx = skb->data[hdrlen + 3] >> 6;
/* To strip off any security data which appears before the
^ permalink raw reply
* [PATCH 3/3] MIPS: BCM47XX: Convert buttons to software nodes
From: Dmitry Torokhov @ 2026-07-05 5:25 UTC (permalink / raw)
To: Rafał Miłecki, Michael Buesch, Hauke Mehrtens,
Thomas Bogendoerfer
Cc: Bartosz Golaszewski, Arnd Bergmann, linux-wireless, linux-kernel,
linux-mips
In-Reply-To: <20260704-b4-bcm47xx-swnode-v1-0-730d59340237@gmail.com>
Convert the legacy gpio-keys platform device on BCM47XX boards to
use software nodes/properties. This allows us to describe the GPIO
keys and their GPIO bindings using software nodes, so that support
for platform data can eventually be removed from the gpio-keys
driver.
Detect the active bus type (BCMA or SSB) and reference the
corresponding GPIO controller's software node (bcma_gpio_swnode or
ssb_gpio_swnode) in the button properties.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
arch/mips/bcm47xx/buttons.c | 434 +++++++++++++++++++++++++-------------------
1 file changed, 247 insertions(+), 187 deletions(-)
diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c
index 46994f9bb821..ff2e70a2e18c 100644
--- a/arch/mips/bcm47xx/buttons.c
+++ b/arch/mips/bcm47xx/buttons.c
@@ -1,9 +1,14 @@
// SPDX-License-Identifier: GPL-2.0
#include "bcm47xx_private.h"
-#include <linux/input.h>
-#include <linux/gpio_keys.h>
+#include "linux/err.h"
+#include <linux/gpio/machine.h>
+#include <linux/gpio/property.h>
+#include <linux/input-event-codes.h>
#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/property.h>
+
#include <bcm47xx_board.h>
#include <bcm47xx.h>
@@ -11,29 +16,34 @@
* Database
**************************************************/
-#define BCM47XX_GPIO_KEY(_gpio, _code) \
- { \
- .code = _code, \
- .gpio = _gpio, \
- .active_low = 1, \
+struct bcm47xx_gpio_key {
+ u16 code;
+ u8 pin;
+ u8 flags;
+};
+
+#define BCM47XX_GPIO_KEY(_gpio, _code) \
+ { \
+ .code = _code, \
+ .pin = _gpio, \
+ .flags = GPIO_ACTIVE_LOW, \
}
-#define BCM47XX_GPIO_KEY_H(_gpio, _code) \
- { \
- .code = _code, \
- .gpio = _gpio, \
+#define BCM47XX_GPIO_KEY_H(_gpio, _code) \
+ { \
+ .code = _code, \
+ .pin = _gpio, \
+ .flags = GPIO_ACTIVE_HIGH, \
}
/* Asus */
-static const struct gpio_keys_button
-bcm47xx_buttons_asus_rtn10u[] __initconst = {
+static const struct bcm47xx_gpio_key bcm47xx_buttons_asus_rtn10u[] __initconst = {
BCM47XX_GPIO_KEY(20, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(21, KEY_RESTART),
};
-static const struct gpio_keys_button
-bcm47xx_buttons_asus_rtn12[] __initconst = {
+static const struct bcm47xx_gpio_key bcm47xx_buttons_asus_rtn12[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(1, KEY_RESTART),
BCM47XX_GPIO_KEY(4, BTN_0), /* Router mode */
@@ -41,74 +51,73 @@ bcm47xx_buttons_asus_rtn12[] __initconst = {
BCM47XX_GPIO_KEY(6, BTN_2), /* AP mode */
};
-static const struct gpio_keys_button
-bcm47xx_buttons_asus_rtn16[] __initconst = {
+static const struct bcm47xx_gpio_key bcm47xx_buttons_asus_rtn16[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_rtn66u[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(9, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl300g[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl320ge[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl330ge[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl500g[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl500gd[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl500gpv1[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_RESTART),
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl500gpv2[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_RESTART),
BCM47XX_GPIO_KEY(3, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl500w[] __initconst = {
BCM47XX_GPIO_KEY_H(6, KEY_RESTART),
BCM47XX_GPIO_KEY_H(7, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl520gc[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_RESTART),
BCM47XX_GPIO_KEY(3, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl520gu[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_RESTART),
BCM47XX_GPIO_KEY(3, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wl700ge[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_POWER), /* Hard disk power switch */
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON), /* EZSetup */
@@ -116,21 +125,21 @@ bcm47xx_buttons_asus_wl700ge[] __initconst = {
BCM47XX_GPIO_KEY(7, KEY_RESTART), /* Hard reset */
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_asus_wlhdd[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
/* Huawei */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_huawei_e970[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
/* Belkin */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_belkin_f7d4301[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
BCM47XX_GPIO_KEY(8, KEY_WPS_BUTTON),
@@ -138,44 +147,44 @@ bcm47xx_buttons_belkin_f7d4301[] __initconst = {
/* Buffalo */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_whr2_a54g54[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_whr_g125[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(4, KEY_RESTART),
BCM47XX_GPIO_KEY(5, BTN_0), /* Router / AP mode switch */
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_whr_g54s[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY_H(4, KEY_RESTART),
BCM47XX_GPIO_KEY(5, BTN_0), /* Router / AP mode switch */
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_whr_hp_g54[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(4, KEY_RESTART),
BCM47XX_GPIO_KEY(5, BTN_0), /* Router / AP mode switch */
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_wzr_g300n[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_wzr_rs_g54[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(4, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_buffalo_wzr_rs_g54hp[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(4, KEY_RESTART),
@@ -183,20 +192,20 @@ bcm47xx_buttons_buffalo_wzr_rs_g54hp[] __initconst = {
/* Dell */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_dell_tm2300[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_RESTART),
};
/* D-Link */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_dlink_dir130[] __initconst = {
BCM47XX_GPIO_KEY(3, KEY_RESTART),
BCM47XX_GPIO_KEY(7, KEY_UNKNOWN),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_dlink_dir330[] __initconst = {
BCM47XX_GPIO_KEY(3, KEY_RESTART),
BCM47XX_GPIO_KEY(7, KEY_UNKNOWN),
@@ -204,127 +213,127 @@ bcm47xx_buttons_dlink_dir330[] __initconst = {
/* Linksys */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e1000v1[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e1000v21[] __initconst = {
BCM47XX_GPIO_KEY(9, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(10, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e2000v1[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e2500v3[] __initconst = {
BCM47XX_GPIO_KEY(9, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(10, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e3000v1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e3200v1[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_RESTART),
BCM47XX_GPIO_KEY(8, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_e4200v1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt150nv1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt150nv11[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt160nv1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt160nv3[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt300n_v1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt300nv11[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_UNKNOWN),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt310nv1[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
BCM47XX_GPIO_KEY(8, KEY_UNKNOWN),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt310n_v2[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt320n_v1[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_WIMAX),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt54g_generic[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt610nv1[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
BCM47XX_GPIO_KEY(8, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrt610nv2[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_linksys_wrtsl54gs[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
@@ -332,154 +341,154 @@ bcm47xx_buttons_linksys_wrtsl54gs[] __initconst = {
/* Luxul */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_abr_4400_v1[] = {
BCM47XX_GPIO_KEY(14, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xap_310_v1[] = {
BCM47XX_GPIO_KEY(20, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xap_1210_v1[] = {
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xap_1230_v1[] = {
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xap_1240_v1[] = {
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xap_1500_v1[] = {
BCM47XX_GPIO_KEY(14, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xbr_4400_v1[] = {
BCM47XX_GPIO_KEY(14, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xvw_p30_v1[] = {
BCM47XX_GPIO_KEY(20, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xwr_600_v1[] = {
BCM47XX_GPIO_KEY(8, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_luxul_xwr_1750_v1[] = {
BCM47XX_GPIO_KEY(14, KEY_RESTART),
};
/* Microsoft */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_microsoft_nm700[] __initconst = {
BCM47XX_GPIO_KEY(7, KEY_RESTART),
};
/* Motorola */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_motorola_we800g[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_motorola_wr850gp[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_motorola_wr850gv2v3[] __initconst = {
BCM47XX_GPIO_KEY(5, KEY_RESTART),
};
/* Netgear */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_r6200_v1[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_RFKILL),
BCM47XX_GPIO_KEY(3, KEY_RESTART),
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_r6300_v1[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wn2500rp_v1[] __initconst = {
BCM47XX_GPIO_KEY(12, KEY_RESTART),
BCM47XX_GPIO_KEY(31, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wndr3400v1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_RESTART),
BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(8, KEY_RFKILL),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wndr3400_v3[] __initconst = {
BCM47XX_GPIO_KEY(12, KEY_RESTART),
BCM47XX_GPIO_KEY(23, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wndr3700v3[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_RFKILL),
BCM47XX_GPIO_KEY(3, KEY_RESTART),
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wndr4500v1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(5, KEY_RFKILL),
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wnr1000_v3[] __initconst = {
BCM47XX_GPIO_KEY(2, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(3, KEY_RESTART),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wnr3500lv1[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_RESTART),
BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wnr3500lv2[] __initconst = {
BCM47XX_GPIO_KEY(4, KEY_RESTART),
BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
BCM47XX_GPIO_KEY(8, KEY_RFKILL),
};
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_netgear_wnr834bv2[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
/* SimpleTech */
-static const struct gpio_keys_button
+static const struct bcm47xx_gpio_key
bcm47xx_buttons_simpletech_simpleshare[] __initconst = {
BCM47XX_GPIO_KEY(0, KEY_RESTART),
};
@@ -488,31 +497,88 @@ bcm47xx_buttons_simpletech_simpleshare[] __initconst = {
* Init
**************************************************/
-static struct gpio_keys_platform_data bcm47xx_button_pdata;
-
-static struct platform_device bcm47xx_buttons_gpio_keys = {
- .name = "gpio-keys",
- .dev = {
- .platform_data = &bcm47xx_button_pdata,
+static int __init
+bcm47xx_buttons_add(const struct bcm47xx_gpio_key *buttons, int nbuttons)
+{
+ struct platform_device *pdev;
+ const struct software_node *gpio_swnode;
+ struct property_entry *p;
+ int error;
+ int i;
+
+ switch (bcm47xx_bus_type) {
+#ifdef CONFIG_BCM47XX_BCMA
+ case BCM47XX_BUS_TYPE_BCMA:
+ gpio_swnode = &bcma_gpio_swnode;
+ break;
+#endif
+#ifdef CONFIG_BCM47XX_SSB
+ case BCM47XX_BUS_TYPE_SSB:
+ gpio_swnode = &ssb_gpio_swnode;
+ break;
+#endif
+ default:
+ return -ENODEV;
}
-};
-/* Copy data from __initconst */
-static int __init bcm47xx_buttons_copy(const struct gpio_keys_button *buttons,
- size_t nbuttons)
-{
- size_t size = nbuttons * sizeof(*buttons);
+ /* 1 node for gpio-keys device, 1 node for each button, 1 terminator */
+ const struct software_node **node_group __free(kfree) =
+ kcalloc(1 + nbuttons + 1, sizeof(*node_group), GFP_KERNEL);
+ if (!node_group)
+ return -ENOMEM;
+
+ /* 1 code property, 1 gpio property, 1 terminator */
+ struct property_entry *props __free(kfree) =
+ kcalloc(nbuttons * 3, sizeof(*props), GFP_KERNEL);
+ if (!props)
+ return -ENOMEM;
- bcm47xx_button_pdata.buttons = kmemdup(buttons, size, GFP_KERNEL);
- if (!bcm47xx_button_pdata.buttons)
+ /* 1 node for gpio-keys device, 1 node for each button */
+ struct software_node *nodes __free(kfree) =
+ kcalloc(1 + nbuttons, sizeof(*nodes), GFP_KERNEL);
+ if (!nodes)
return -ENOMEM;
- bcm47xx_button_pdata.nbuttons = nbuttons;
+ /* gpio-keys node */
+ nodes[0].name = "bcm47xx-gpio-buttons";
+
+ p = props;
+ for (i = 0; i < nbuttons; i++) {
+ const struct bcm47xx_gpio_key *button = &buttons[i];
+ struct software_node *node = &nodes[1 + i];
+
+ node->parent = &nodes[0];
+ node->properties = p;
+
+ *p++ = PROPERTY_ENTRY_U32("linux,code", button->code);
+ *p++ = PROPERTY_ENTRY_GPIO("gpios", gpio_swnode, button->pin, button->flags);
+ p++;
+ }
+
+ for (i = 0; i < nbuttons + 1; i++)
+ node_group[i] = &nodes[i];
+
+ error = software_node_register_node_group(node_group);
+ if (error)
+ return error;
+
+ pdev = platform_device_register_full(&(struct platform_device_info){
+ .name = "gpio-keys",
+ .swnode = &nodes[0],
+ });
+ error = PTR_ERR_OR_ZERO(pdev);
+ if (error) {
+ software_node_unregister_node_group(node_group);
+ return error;
+ }
+
+ retain_and_null_ptr(props);
+ retain_and_null_ptr(nodes);
return 0;
}
-#define bcm47xx_copy_bdata(dev_buttons) \
- bcm47xx_buttons_copy(dev_buttons, ARRAY_SIZE(dev_buttons));
+#define bcm47xx_add_bdata(dev_buttons) \
+ bcm47xx_buttons_add(dev_buttons, ARRAY_SIZE(dev_buttons))
int __init bcm47xx_buttons_register(void)
{
@@ -521,52 +587,52 @@ int __init bcm47xx_buttons_register(void)
switch (board) {
case BCM47XX_BOARD_ASUS_RTN10U:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn10u);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_rtn10u);
break;
case BCM47XX_BOARD_ASUS_RTN12:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn12);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_rtn12);
break;
case BCM47XX_BOARD_ASUS_RTN16:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn16);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_rtn16);
break;
case BCM47XX_BOARD_ASUS_RTN66U:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn66u);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_rtn66u);
break;
case BCM47XX_BOARD_ASUS_WL300G:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl300g);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl300g);
break;
case BCM47XX_BOARD_ASUS_WL320GE:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl320ge);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl320ge);
break;
case BCM47XX_BOARD_ASUS_WL330GE:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl330ge);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl330ge);
break;
case BCM47XX_BOARD_ASUS_WL500G:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl500g);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl500g);
break;
case BCM47XX_BOARD_ASUS_WL500GD:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl500gd);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl500gd);
break;
case BCM47XX_BOARD_ASUS_WL500GPV1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl500gpv1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl500gpv1);
break;
case BCM47XX_BOARD_ASUS_WL500GPV2:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl500gpv2);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl500gpv2);
break;
case BCM47XX_BOARD_ASUS_WL500W:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl500w);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl500w);
break;
case BCM47XX_BOARD_ASUS_WL520GC:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl520gc);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl520gc);
break;
case BCM47XX_BOARD_ASUS_WL520GU:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl520gu);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl520gu);
break;
case BCM47XX_BOARD_ASUS_WL700GE:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wl700ge);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wl700ge);
break;
case BCM47XX_BOARD_ASUS_WLHDD:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_wlhdd);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_asus_wlhdd);
break;
case BCM47XX_BOARD_BELKIN_F7D3301:
@@ -574,193 +640,193 @@ int __init bcm47xx_buttons_register(void)
case BCM47XX_BOARD_BELKIN_F7D4301:
case BCM47XX_BOARD_BELKIN_F7D4302:
case BCM47XX_BOARD_BELKIN_F7D4401:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_belkin_f7d4301);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_belkin_f7d4301);
break;
case BCM47XX_BOARD_BUFFALO_WHR2_A54G54:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_whr2_a54g54);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_whr2_a54g54);
break;
case BCM47XX_BOARD_BUFFALO_WHR_G125:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_whr_g125);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_whr_g125);
break;
case BCM47XX_BOARD_BUFFALO_WHR_G54S:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_whr_g54s);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_whr_g54s);
break;
case BCM47XX_BOARD_BUFFALO_WHR_HP_G54:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_whr_hp_g54);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_whr_hp_g54);
break;
case BCM47XX_BOARD_BUFFALO_WZR_G300N:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_wzr_g300n);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_wzr_g300n);
break;
case BCM47XX_BOARD_BUFFALO_WZR_RS_G54:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_wzr_rs_g54);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_wzr_rs_g54);
break;
case BCM47XX_BOARD_BUFFALO_WZR_RS_G54HP:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_buffalo_wzr_rs_g54hp);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_buffalo_wzr_rs_g54hp);
break;
case BCM47XX_BOARD_DELL_TM2300:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_dell_tm2300);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_dell_tm2300);
break;
case BCM47XX_BOARD_DLINK_DIR130:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_dlink_dir130);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_dlink_dir130);
break;
case BCM47XX_BOARD_DLINK_DIR330:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_dlink_dir330);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_dlink_dir330);
break;
case BCM47XX_BOARD_HUAWEI_E970:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_huawei_e970);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_huawei_e970);
break;
case BCM47XX_BOARD_LINKSYS_E1000V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e1000v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e1000v1);
break;
case BCM47XX_BOARD_LINKSYS_E1000V21:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e1000v21);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e1000v21);
break;
case BCM47XX_BOARD_LINKSYS_E2000V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e2000v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e2000v1);
break;
case BCM47XX_BOARD_LINKSYS_E2500V3:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e2500v3);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e2500v3);
break;
case BCM47XX_BOARD_LINKSYS_E3000V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e3000v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e3000v1);
break;
case BCM47XX_BOARD_LINKSYS_E3200V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e3200v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e3200v1);
break;
case BCM47XX_BOARD_LINKSYS_E4200V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_e4200v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_e4200v1);
break;
case BCM47XX_BOARD_LINKSYS_WRT150NV1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt150nv1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt150nv1);
break;
case BCM47XX_BOARD_LINKSYS_WRT150NV11:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt150nv11);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt150nv11);
break;
case BCM47XX_BOARD_LINKSYS_WRT160NV1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt160nv1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt160nv1);
break;
case BCM47XX_BOARD_LINKSYS_WRT160NV3:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt160nv3);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt160nv3);
break;
case BCM47XX_BOARD_LINKSYS_WRT300N_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt300n_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt300n_v1);
break;
case BCM47XX_BOARD_LINKSYS_WRT300NV11:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt300nv11);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt300nv11);
break;
case BCM47XX_BOARD_LINKSYS_WRT310NV1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310nv1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt310nv1);
break;
case BCM47XX_BOARD_LINKSYS_WRT310NV2:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310n_v2);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt310n_v2);
break;
case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt320n_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt320n_v1);
break;
case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt54g3gv2);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt54g3gv2);
break;
case BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0101:
case BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0467:
case BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0708:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt54g_generic);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt54g_generic);
break;
case BCM47XX_BOARD_LINKSYS_WRT610NV1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt610nv1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt610nv1);
break;
case BCM47XX_BOARD_LINKSYS_WRT610NV2:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt610nv2);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrt610nv2);
break;
case BCM47XX_BOARD_LINKSYS_WRTSL54GS:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrtsl54gs);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_linksys_wrtsl54gs);
break;
case BCM47XX_BOARD_LUXUL_ABR_4400_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_abr_4400_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_abr_4400_v1);
break;
case BCM47XX_BOARD_LUXUL_XAP_310_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xap_310_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xap_310_v1);
break;
case BCM47XX_BOARD_LUXUL_XAP_1210_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xap_1210_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xap_1210_v1);
break;
case BCM47XX_BOARD_LUXUL_XAP_1230_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xap_1230_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xap_1230_v1);
break;
case BCM47XX_BOARD_LUXUL_XAP_1240_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xap_1240_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xap_1240_v1);
break;
case BCM47XX_BOARD_LUXUL_XAP_1500_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xap_1500_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xap_1500_v1);
break;
case BCM47XX_BOARD_LUXUL_XBR_4400_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xbr_4400_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xbr_4400_v1);
break;
case BCM47XX_BOARD_LUXUL_XVW_P30_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xvw_p30_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xvw_p30_v1);
break;
case BCM47XX_BOARD_LUXUL_XWR_600_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xwr_600_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xwr_600_v1);
break;
case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xwr_1750_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_luxul_xwr_1750_v1);
break;
case BCM47XX_BOARD_MICROSOFT_MN700:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_microsoft_nm700);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_microsoft_nm700);
break;
case BCM47XX_BOARD_MOTOROLA_WE800G:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_motorola_we800g);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_motorola_we800g);
break;
case BCM47XX_BOARD_MOTOROLA_WR850GP:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_motorola_wr850gp);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_motorola_wr850gp);
break;
case BCM47XX_BOARD_MOTOROLA_WR850GV2V3:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_motorola_wr850gv2v3);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_motorola_wr850gv2v3);
break;
case BCM47XX_BOARD_NETGEAR_R6200_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_r6200_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_r6200_v1);
break;
case BCM47XX_BOARD_NETGEAR_R6300_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_r6300_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_r6300_v1);
break;
case BCM47XX_BOARD_NETGEAR_WN2500RP_V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wn2500rp_v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wn2500rp_v1);
break;
case BCM47XX_BOARD_NETGEAR_WNDR3400V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wndr3400v1);
break;
case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400_v3);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wndr3400_v3);
break;
case BCM47XX_BOARD_NETGEAR_WNDR3700V3:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3700v3);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wndr3700v3);
break;
case BCM47XX_BOARD_NETGEAR_WNDR4500V1:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr4500v1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wndr4500v1);
break;
case BCM47XX_BOARD_NETGEAR_WNR1000_V3:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr1000_v3);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wnr1000_v3);
break;
case BCM47XX_BOARD_NETGEAR_WNR3500L:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr3500lv1);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wnr3500lv1);
break;
case BCM47XX_BOARD_NETGEAR_WNR3500L_V2:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr3500lv2);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wnr3500lv2);
break;
case BCM47XX_BOARD_NETGEAR_WNR834BV2:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr834bv2);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_netgear_wnr834bv2);
break;
case BCM47XX_BOARD_SIMPLETECH_SIMPLESHARE:
- err = bcm47xx_copy_bdata(bcm47xx_buttons_simpletech_simpleshare);
+ err = bcm47xx_add_bdata(bcm47xx_buttons_simpletech_simpleshare);
break;
default:
@@ -769,13 +835,7 @@ int __init bcm47xx_buttons_register(void)
}
if (err)
- return -ENOMEM;
-
- err = platform_device_register(&bcm47xx_buttons_gpio_keys);
- if (err) {
- pr_err("Failed to register platform device: %d\n", err);
return err;
- }
return 0;
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related
* [PATCH 1/3] bcma: gpio: Add and register software node for GPIO controller
From: Dmitry Torokhov @ 2026-07-05 5:25 UTC (permalink / raw)
To: Rafał Miłecki, Michael Buesch, Hauke Mehrtens,
Thomas Bogendoerfer
Cc: Bartosz Golaszewski, Arnd Bergmann, linux-wireless, linux-kernel,
linux-mips
In-Reply-To: <20260704-b4-bcm47xx-swnode-v1-0-730d59340237@gmail.com>
We want to convert the legacy gpio-keys platform device on BCM47XX
boards to use software nodes. To do this properly and allow
referencing the GPIO controller by address rather than relying on
name-based matching (which is being removed from the gpiolib core),
we need to associate the GPIO controller with a software node.
Introduce bcma_gpio_swnode, register it if the device does not
already have a firmware node, and associate it with the gpio_chip.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/bcma/driver_gpio.c | 17 ++++++++++++++++-
include/linux/bcma/bcma.h | 3 +++
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 658c7e2ac8bf..0dad8d6dbe5a 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -19,6 +19,11 @@
#define BCMA_GPIO_MAX_PINS 32
+const struct software_node bcma_gpio_swnode = {
+ .name = "bcma-gpio",
+};
+EXPORT_SYMBOL_GPL(bcma_gpio_swnode);
+
static int bcma_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
{
struct bcma_drv_cc *cc = gpiochip_get_data(chip);
@@ -190,7 +195,15 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
chip->direction_input = bcma_gpio_direction_input;
chip->direction_output = bcma_gpio_direction_output;
chip->parent = bus->dev;
- chip->fwnode = dev_fwnode(&cc->core->dev);
+
+ if (!dev_fwnode(&cc->core->dev)) {
+ err = software_node_register(&bcma_gpio_swnode);
+ if (err)
+ return err;
+ chip->fwnode = software_node_fwnode(&bcma_gpio_swnode);
+ } else {
+ chip->fwnode = dev_fwnode(&cc->core->dev);
+ }
switch (bus->chipinfo.id) {
case BCMA_CHIP_ID_BCM4707:
@@ -234,5 +247,7 @@ int bcma_gpio_unregister(struct bcma_drv_cc *cc)
{
bcma_gpio_irq_exit(cc);
gpiochip_remove(&cc->gpio);
+ if (cc->gpio.fwnode && is_software_node(cc->gpio.fwnode))
+ software_node_unregister(&bcma_gpio_swnode);
return 0;
}
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index f02cb3909375..aa88c2d64bfb 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -486,4 +486,7 @@ extern u32 bcma_core_dma_translation(struct bcma_device *core);
extern unsigned int bcma_core_irq(struct bcma_device *core, int num);
+struct software_node;
+extern const struct software_node bcma_gpio_swnode;
+
#endif /* LINUX_BCMA_H_ */
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related
* [PATCH 2/3] ssb: gpio: Add and register software node for GPIO controller
From: Dmitry Torokhov @ 2026-07-05 5:25 UTC (permalink / raw)
To: Rafał Miłecki, Michael Buesch, Hauke Mehrtens,
Thomas Bogendoerfer
Cc: Bartosz Golaszewski, Arnd Bergmann, linux-wireless, linux-kernel,
linux-mips
In-Reply-To: <20260704-b4-bcm47xx-swnode-v1-0-730d59340237@gmail.com>
We want to convert the legacy gpio-keys platform device on BCM47XX
boards to use software nodes. To do this properly and allow
referencing the GPIO controller by address rather than relying on
name-based matching (which is being removed from the gpiolib core),
we need to associate the GPIO controller with a software node.
Introduce ssb_gpio_swnode, register it, and associate it with the
gpio_chip.
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/ssb/driver_gpio.c | 27 ++++++++++++++++++++++++---
include/linux/ssb/ssb.h | 3 +++
2 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index 905657c925bc..8aebc4145454 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -15,8 +15,14 @@
#include <linux/interrupt.h>
#include <linux/irqdomain.h>
#include <linux/export.h>
+#include <linux/property.h>
#include <linux/ssb/ssb.h>
+const struct software_node ssb_gpio_swnode = {
+ .name = "ssb-gpio",
+};
+EXPORT_SYMBOL_GPL(ssb_gpio_swnode);
+
/**************************************************
* Shared
@@ -232,6 +238,7 @@ static int ssb_gpio_chipco_init(struct ssb_bus *bus)
chip->to_irq = ssb_gpio_to_irq;
#endif
chip->ngpio = 16;
+ chip->fwnode = software_node_fwnode(&ssb_gpio_swnode);
/* There is just one SoC in one device and its GPIO addresses should be
* deterministic to address them more easily. The other buses could get
* a random base number.
@@ -429,6 +436,7 @@ static int ssb_gpio_extif_init(struct ssb_bus *bus)
chip->to_irq = ssb_gpio_to_irq;
#endif
chip->ngpio = 5;
+ chip->fwnode = software_node_fwnode(&ssb_gpio_swnode);
/* There is just one SoC in one device and its GPIO addresses should be
* deterministic to address them more easily. The other buses could get
* a random base number.
@@ -464,11 +472,23 @@ static int ssb_gpio_extif_init(struct ssb_bus *bus)
int ssb_gpio_init(struct ssb_bus *bus)
{
+ int err;
+
+ err = software_node_register(&ssb_gpio_swnode);
+ if (err)
+ return err;
+
if (ssb_chipco_available(&bus->chipco))
- return ssb_gpio_chipco_init(bus);
+ err = ssb_gpio_chipco_init(bus);
else if (ssb_extif_available(&bus->extif))
- return ssb_gpio_extif_init(bus);
- return -1;
+ err = ssb_gpio_extif_init(bus);
+ else
+ err = -1;
+
+ if (err)
+ software_node_unregister(&ssb_gpio_swnode);
+
+ return err;
}
int ssb_gpio_unregister(struct ssb_bus *bus)
@@ -476,6 +496,7 @@ int ssb_gpio_unregister(struct ssb_bus *bus)
if (ssb_chipco_available(&bus->chipco) ||
ssb_extif_available(&bus->extif)) {
gpiochip_remove(&bus->gpio);
+ software_node_unregister(&ssb_gpio_swnode);
return 0;
}
return -1;
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 7fee9afa9458..b2b265674a4a 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -671,4 +671,7 @@ int ssb_pcibios_plat_dev_init(struct pci_dev *dev);
int ssb_pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin);
#endif /* CONFIG_SSB_EMBEDDED */
+struct software_node;
+extern const struct software_node ssb_gpio_swnode;
+
#endif /* LINUX_SSB_H_ */
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related
* [PATCH 0/3] MIPS: BCM47XX: convert buttons to software nodes
From: Dmitry Torokhov @ 2026-07-05 5:25 UTC (permalink / raw)
To: Rafał Miłecki, Michael Buesch, Hauke Mehrtens,
Thomas Bogendoerfer
Cc: Bartosz Golaszewski, Arnd Bergmann, linux-wireless, linux-kernel,
linux-mips
This series converts the legacy gpio-keys platform device on BCM47XX
boards to use software nodes and static properties.
To do this properly without relying on legacy name-based matching
(which is being removed from gpiolib), we introduce and register
software nodes for the underlying GPIO controllers (BCMA and SSB)
and reference them in the button properties.
The first two patches add the software nodes to bcma-gpio and
ssb-gpio respectively. The third patch performs the conversion
for the BCM47XX buttons.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
Dmitry Torokhov (3):
bcma: gpio: Add and register software node for GPIO controller
ssb: gpio: Add and register software node for GPIO controller
MIPS: BCM47XX: Convert buttons to software nodes
arch/mips/bcm47xx/buttons.c | 434 +++++++++++++++++++++++++-------------------
drivers/bcma/driver_gpio.c | 17 +-
drivers/ssb/driver_gpio.c | 27 ++-
include/linux/bcma/bcma.h | 3 +
include/linux/ssb/ssb.h | 3 +
5 files changed, 293 insertions(+), 191 deletions(-)
---
base-commit: 2b763db0c2763d6bf73d7d3e69665222d1f377cf
change-id: 20260627-b4-bcm47xx-swnode-99836e552166
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH wireless] wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
From: Christian Lamparter @ 2026-07-04 20:08 UTC (permalink / raw)
To: Xiang Mei, linux-wireless
Cc: linux-kernel, Johannes Berg, Arien Judge, Lachlan Hodges,
Weiming Shi
In-Reply-To: <20260628000510.4152481-1-xmei5@asu.edu>
On 6/28/26 2:05 AM, Xiang Mei wrote:
> p54_rx_eeprom_readback() copies the requested EEPROM slice out of a
> device-supplied readback frame without checking that the skb actually holds
> that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in
> p54_rx_eeprom_readback()") closed the destination overflow by copying a
> fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len),
> but the source side is still unbounded: nothing verifies the frame is long
> enough to supply that many bytes.
>
> A malicious USB device can send a short frame whose advertised len matches
> priv->eeprom_slice_size while the payload is truncated. The equality check
> passes and memcpy() reads past the end of the skb, leaking adjacent heap:
>
> BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)
> Read of size 1016 at addr ffff88800f077114 by task swapper/0/0
> Call Trace:
> <IRQ>
> ...
> __asan_memcpy (mm/kasan/shadow.c:105)
> p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)
> p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163)
> __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)
> dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005)
> ...
> </IRQ>
>
> The buggy address belongs to the object at ffff88800f0770c0
> which belongs to the cache skbuff_small_head of size 704
> The buggy address is located 84 bytes inside of
> allocated 704-byte region [ffff88800f0770c0, ffff88800f077380)
>
> Check that the slice fits in the skb before copying.
>
> Fixes: 7cb770729ba8 ("p54: move eeprom code into common library")
Sure
Acked-by: Christian Lamparter <chunkeey@gmail.com>
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Xiang Mei <xmei5@asu.edu>
> ---
> drivers/net/wireless/intersil/p54/txrx.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c
> index 1294a1d6528e..9f491334c8d0 100644
> --- a/drivers/net/wireless/intersil/p54/txrx.c
> +++ b/drivers/net/wireless/intersil/p54/txrx.c
> @@ -499,11 +499,19 @@ static void p54_rx_eeprom_readback(struct p54_common *priv,
> if (le16_to_cpu(eeprom->v2.len) != priv->eeprom_slice_size)
> return;
>
> + if (eeprom->v2.data + priv->eeprom_slice_size >
> + skb_tail_pointer(skb))
> + return;
> +
> memcpy(priv->eeprom, eeprom->v2.data, priv->eeprom_slice_size);
> } else {
> if (le16_to_cpu(eeprom->v1.len) != priv->eeprom_slice_size)
> return;
>
> + if (eeprom->v1.data + priv->eeprom_slice_size >
> + skb_tail_pointer(skb))
> + return;
> +
> memcpy(priv->eeprom, eeprom->v1.data, priv->eeprom_slice_size);
> }
>
^ permalink raw reply
* Re: [PATCH] wifi: carl9170: reject mismatched command response lengths
From: Christian Lamparter @ 2026-07-04 19:56 UTC (permalink / raw)
To: Yousef Alhouseen, Christian Lamparter
Cc: linux-wireless, linux-kernel, stable, syzbot+5c1ca6ccaa1215781cac
In-Reply-To: <20260628092814.40583-1-alhouseenyousef@gmail.com>
Hi,
On 6/28/26 11:28 AM, Yousef Alhouseen wrote:
> The firmware response length is controlled by the USB device. Although
> carl9170_cmd_callback() detects when it differs from the output buffer
> length, the function falls through and copies the entire response into
> that buffer. Callers commonly provide stack objects, so a malformed
> response can overwrite the kernel stack.
>
> Return after scheduling device recovery. This also preserves the stated
> behavior of leaving the command incomplete so that its waiter times out
> and clears the pending output buffer.
>
> Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
> Reported-by: syzbot+5c1ca6ccaa1215781cac@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
> Cc: stable@vger.kernel.org
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
This was posted earlier too:
https://lore.kernel.org/linux-wireless/20260421134929.325662-1-tristmd@gmail.com/
In fact, there was even a mail before that that was sent to security@vger.kernel.org.
I told Tristan that I would much rather not return and instead fix the memcpy.
carl9170_restart can completely unbind the device, so it's unlikely that one would
see a timeout.
Cheers,
Christian
> ---
> drivers/net/wireless/ath/carl9170/rx.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
> index 6833430130f4..ea3f435fb64c 100644
> --- a/drivers/net/wireless/ath/carl9170/rx.c
> +++ b/drivers/net/wireless/ath/carl9170/rx.c
> @@ -145,6 +145,7 @@ static void carl9170_cmd_callback(struct ar9170 *ar, u32 len, void *buffer)
> * and we get a stack trace from there.
> */
> carl9170_restart(ar, CARL9170_RR_INVALID_RSP);
> + return;
> }
>
> spin_lock(&ar->cmd_lock);
^ permalink raw reply
* Re: [PATCH v3 3/3] wifi: carl9170: fix buffer overflow in rx_stream failover path
From: Christian Lamparter @ 2026-07-04 19:48 UTC (permalink / raw)
To: Tristan Madani, Christian Lamparter
Cc: Johannes Berg, linux-wireless, linux-kernel, Tristan Madani
In-Reply-To: <20260421134929.325662-4-tristmd@gmail.com>
On 4/21/26 3:49 PM, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
>
> The failover continuation in carl9170_rx_stream() copies the full tlen
> from the second USB transfer instead of capping at rx_failover_missing
> bytes. When both transfers are near maximum size, the total exceeds the
> 65535-byte failover SKB, triggering skb_over_panic.
>
> Limit the copy size to the missing byte count.
>
> Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
> ---
> Changes in v3:
> - Regenerated from wireless-next with proper git format-patch.
>
> Changes in v2:
> - Use min_t() instead of separate if-check, per Christian Lamparter.
>
> drivers/net/wireless/ath/carl9170/rx.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
> index f6855efc05c0f..ccadc46385240 100644
> --- a/drivers/net/wireless/ath/carl9170/rx.c
> +++ b/drivers/net/wireless/ath/carl9170/rx.c
> @@ -918,7 +918,9 @@ static void carl9170_rx_stream(struct ar9170 *ar, void *buf, unsigned int len)
> }
> }
>
> - skb_put_data(ar->rx_failover, tbuf, tlen);
> + skb_put_data(ar->rx_failover, tbuf,
> + min_t(unsigned int, tlen,
> + ar->rx_failover_missing));
> ar->rx_failover_missing -= tlen;
>
> if (ar->rx_failover_missing <= 0) {
^ permalink raw reply
* Re: [PATCH v3 2/3] wifi: carl9170: fix OOB read from off-by-two in TX status handler
From: Christian Lamparter @ 2026-07-04 19:48 UTC (permalink / raw)
To: Tristan Madani, Christian Lamparter
Cc: Johannes Berg, linux-wireless, linux-kernel, Tristan Madani
In-Reply-To: <20260421134929.325662-3-tristmd@gmail.com>
On 4/21/26 3:49 PM, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
>
> The bounds check in carl9170_tx_process_status() uses
> `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing
> 2 extra iterations past valid _tx_status entries when the firmware-
> controlled hdr.ext exceeds hdr.len/2. Fix by using the correct
> comparison `i >= (cmd->hdr.len / 2)`.
>
> Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
> ---
> Changes in v3:
> - Regenerated from wireless-next with proper git format-patch to
> produce valid index hashes (v2 had post-processed index lines).
>
> Changes in v2:
> - No code changes from v1.
>
> drivers/net/wireless/ath/carl9170/tx.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
> index 59caf1e4b1589..06aaf281655b1 100644
> --- a/drivers/net/wireless/ath/carl9170/tx.c
> +++ b/drivers/net/wireless/ath/carl9170/tx.c
> @@ -692,7 +692,7 @@ void carl9170_tx_process_status(struct ar9170 *ar,
> unsigned int i;
>
> for (i = 0; i < cmd->hdr.ext; i++) {
> - if (WARN_ON(i > ((cmd->hdr.len / 2) + 1))) {
> + if (WARN_ON(i >= (cmd->hdr.len / 2))) {
> print_hex_dump_bytes("UU:", DUMP_PREFIX_NONE,
> (void *) cmd, cmd->hdr.len + 4);
> break;
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox