From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF06B3CF68A; Mon, 20 Apr 2026 13:29:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776691777; cv=none; b=JVZFQoNo7k15bmIVkCL4Hsv1seVcmY0j+8borsNZ5UA53f9J4gPq1pmenWhQgGoW5pQcym9Zvk0lB8/6HrxN9AuMvMomq37r4UExtKxLigRojrJl4YPWSADvLCFCdYBbw9G2n24xzp3QzZuN3jqtGI1oLlKDdu8ezPamGtFU9sk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776691777; c=relaxed/simple; bh=2gTTkgwvWS+AHMc9oy4Ot3thD3kKxbtgMzTju/4T6rk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LaQecfwQSMxZDIZbpMaMUmfTuaSs+cd4Y2+raHf7ejE1gelWQWV1CZHWFXydEK0B4Z2aiNpMMDzV6cXQPxCQauN48Nqry76MoY250aAHFH/dl56xFSz85GYSljaPzpoo/+BlMPeuAcBAVDsKJxsLupOpqjhSK0oag3Eu3EaSVmw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Ny5sfWfC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Ny5sfWfC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2D11C2BCB4; Mon, 20 Apr 2026 13:29:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776691777; bh=2gTTkgwvWS+AHMc9oy4Ot3thD3kKxbtgMzTju/4T6rk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ny5sfWfCN5LRuFEhRxuw14uLpUGLoROqyzy0V2adzUEBjcHy2t0TVoHWyl36lZtwB BkVbKydOsu9WVcbyxOJa7V3J3gvgEs7AWoJu5EhWFLPgAW8KyEcrVPC4vg0QbnMA2W FZc3c/Xha2Fm9Gq8gaPENe/GRH2uTdDTfSvAz/1BwT91tWYPPv0kMdxwJa77ijEolN mZqksoEHAmqz1uVKAxmJwbX5DamMwE9OjpUvnxmFOmkaMwHRiRX1pN6u507gmofPu7 Ex30LgpSAwAn18sozzcKhM+PPsFAaHLxeCljahgwEA0x5dqNjMGufxxNILEqkUyc5K pJ6zvEMX2Pshg== From: Sasha Levin To: patches@lists.linux.dev, stable@vger.kernel.org Cc: Ping-Ke Shih , Sasha Levin , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH AUTOSEL 7.0-6.19] wifi: rtw89: mac: remove A-die off setting for RTL8852C and RTL8922A Date: Mon, 20 Apr 2026 09:19:42 -0400 Message-ID: <20260420132314.1023554-188-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260420132314.1023554-1-sashal@kernel.org> References: <20260420132314.1023554-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 7.0 Content-Transfer-Encoding: 8bit From: Ping-Ke Shih [ Upstream commit 9a38ef92aaa2d3c02ae1f6f1cacc3d3a8cf19db6 ] Fix timing issue of A-die off followed by XTAL off. Otherwise, device might get lost potentially. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-4-pkshih@realtek.com Signed-off-by: Sasha Levin --- LLM Generated explanations, may be completely bogus: Now I have all the information needed. Let me compile the complete analysis. --- ## PHASE 1: COMMIT MESSAGE FORENSICS ### Step 1.1: PARSE THE SUBJECT LINE - **Subsystem**: `wifi: rtw89: mac` - **Action verb**: "remove" (but the body says "Fix timing issue" -- this is a bug fix) - **Summary**: Clears the A-die off bit instead of setting it during power-off for RTL8852C and RTL8922A Record: [wifi: rtw89: mac] [Fix/remove] [Fixes timing issue in power-off sequence that causes device loss] ### Step 1.2: PARSE ALL COMMIT MESSAGE TAGS - **Signed-off-by**: Ping-Ke Shih (author and rtw89 subsystem maintainer) - **Link**: https://patch.msgid.link/20260310080146.31113-4-pkshih@realtek.com - No Fixes: tag (expected for this review pipeline) - No Cc: stable (expected) - No Reported-by tag Record: Author is the subsystem maintainer at Realtek. No bug reporters listed. ### Step 1.3: ANALYZE THE COMMIT BODY TEXT - **Bug**: "timing issue of A-die off followed by XTAL off" - **Symptom**: "device might get lost potentially" -- the WiFi device disappears from the bus - **Root cause**: During power-off, the XTAL_OFF_A_DIE bit was being SET (enabling A-die power-off), but this creates a timing conflict with the subsequent XTAL-off sequence, potentially causing the device to become unreachable Record: Hardware timing bug in power-off sequence causes device loss. Affects RTL8852C and RTL8922A. ### Step 1.4: DETECT HIDDEN BUG FIXES Despite the subject saying "remove", the body explicitly says "Fix timing issue" and describes a concrete failure (device loss). This is unambiguously a bug fix. Record: Yes, this is a real bug fix despite the "remove" wording. --- ## PHASE 2: DIFF ANALYSIS ### Step 2.1: INVENTORY THE CHANGES - `rtw8852c.c`: 1 line changed (`write32_set` -> `write32_clr`) in `rtw8852c_pwr_off_func()` - `rtw8922a.c`: 1 line changed (`write32_set` -> `write32_clr`) in `rtw8922a_pwr_off_func()` - Total: 2 lines changed, net 0 lines added/removed - **Scope**: Extremely surgical single-line fix in each file Record: [2 files, 2 lines changed] [rtw8852c_pwr_off_func, rtw8922a_pwr_off_func] [Single-file surgical fix x2] ### Step 2.2: UNDERSTAND THE CODE FLOW CHANGE In `rtw8852c_pwr_off_func()`: ```466:466:drivers/net/wireless/realtek/rtw89/rtw8852c.c rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_XTAL_OFF_A_DIE); ``` Changed to `rtw89_write32_clr()`. The semantics from `core.h`: - `write32_set`: reads register, ORs with bit mask, writes back (SETS the bit) - `write32_clr`: reads register, ANDs with ~bit mask, writes back (CLEARS the bit) Before: The A-die off bit was being **set** (enabled) during power-off, triggering A-die shutdown. After: The bit is **cleared** (disabled), preventing A-die shutdown at this point in the sequence. Record: [Before: set XTAL_OFF_A_DIE bit -> After: clear XTAL_OFF_A_DIE bit in SYS_PW_CTRL register during power-off] ### Step 2.3: IDENTIFY THE BUG MECHANISM - **Category**: Hardware timing / logic correctness fix - **Mechanism**: Setting the XTAL_OFF_A_DIE bit triggers A-die power- off, which when followed immediately by XTAL off creates a timing race. The hardware cannot properly sequence these two operations, causing the device to become unreachable on the bus. - **Fix**: Clear the bit instead, preventing the A-die off at this point. Record: [Logic correctness / hardware timing fix] [Setting bit triggered conflicting power-off sequences; clearing prevents the race] ### Step 2.4: ASSESS THE FIX QUALITY - **Obviously correct**: Single function call change, from subsystem maintainer, based on Realtek internal hardware documentation - **Minimal**: Cannot be more minimal -- 1 line per chip - **Regression risk**: Extremely low -- only changes one register bit in power-off path - **No red flags**: No locking changes, no API changes, no structural changes Record: [Fix quality: excellent, obviously correct] [Regression risk: negligible] --- ## PHASE 3: GIT HISTORY INVESTIGATION ### Step 3.1: BLAME THE CHANGED LINES - **rtw8852c.c line 466**: Introduced by `2a7e54db40f0e1` ("rtw89: add power_{on/off}_func") by Ping-Ke Shih, 2022-03-07, first in **v5.18** - **rtw8922a.c line 495**: Introduced by `f20b2b7d3f1b1d` ("wifi: rtw89: 8922a: add power on/off functions") by Ping-Ke Shih, 2023-12-11, first in **v6.8** Record: [RTL8852C bug since v5.18, RTL8922A bug since v6.8] ### Step 3.2: FOLLOW THE FIXES TAG No Fixes: tag present (expected for this review pipeline). ### Step 3.3: CHECK FILE HISTORY 206 commits to rtw8852c.c since the buggy code was introduced. Active subsystem, the buggy power-off bit has been wrong since inception. Record: [Bug present since initial chip support] [No prior fix attempts found] ### Step 3.4: CHECK THE AUTHOR Ping-Ke Shih is the **rtw89 subsystem maintainer** at Realtek. He wrote the original code and is fixing it now based on hardware team findings. Record: [Author is subsystem maintainer and hardware vendor developer] ### Step 3.5: CHECK FOR DEPENDENCIES The fix is completely standalone -- just changes `_set` to `_clr` on a single line. No new functions, no new definitions, no structural dependencies. Record: [No dependencies. Fully standalone fix.] --- ## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH ### Step 4.1: FIND THE ORIGINAL PATCH DISCUSSION - Series: [PATCH rtw-next 00/13] wifi: rtw89: update hardware settings and tweak for MLO - This is patch 03/13 in the series - Applied as commit `9a38ef92aaa2` to rtw-next tree - 12 of 13 patches were applied (only patch 01 was dropped for performance concerns) - No objections or concerns raised for this specific patch Record: [Series context found. Patch applied without issues. No review concerns.] ### Step 4.2: CHECK WHO REVIEWED THE PATCH - Sent to linux-wireless@vger.kernel.org - CC'd damon.chen@realtek.com and kevin_yang@realtek.com (Realtek colleagues) - Applied by the maintainer to their tree Record: [Applied by maintainer to rtw-next tree] ### Steps 4.3-4.5 No specific bug report or stable discussion found. The cover letter describes these as "hardware settings, which are written according to internal patches" -- the fix came from Realtek internal hardware validation. --- ## PHASE 5: CODE SEMANTIC ANALYSIS ### Step 5.1: KEY FUNCTIONS - `rtw8852c_pwr_off_func()` and `rtw8922a_pwr_off_func()` ### Step 5.2: TRACE CALLERS - Both are assigned to `.pwr_off_func` in their chip_ops structures - Called from `rtw89_mac_power_switch()` in `mac.c` when `on=false` - `rtw89_mac_power_switch()` is called on **every WiFi power-off event**: suspend, sleep, interface disable, shutdown ### Step 5.3-5.4: CALL CHAIN - User action (suspend/disable wifi) -> `rtw89_mac_pwr_off()` -> `rtw89_mac_power_switch(rtwdev, false)` -> `chip->ops->pwr_off_func(rtwdev)` -> the buggy code Record: [Common code path triggered on every WiFi power-off event] ### Step 5.5: SEARCH FOR SIMILAR PATTERNS The `XTAL_OFF_A_DIE` bit is only used in these two pwr_off_func functions. No other chips use this bit. --- ## PHASE 6: CROSS-REFERENCING AND STABLE TREE ANALYSIS ### Step 6.1: BUGGY CODE IN STABLE TREES - **RTL8852C** (`B_AX_XTAL_OFF_A_DIE`): Present in v6.1.y, v6.6.y, v6.12.y (bug since v5.18) - **RTL8922A** (`B_BE_XTAL_OFF_A_DIE`): Present in v6.12.y (bug since v6.8, not in v6.1 or v6.6) Verified: `git show v6.1/v6.6/v6.12:...rtw8852c.c` all contain `rtw89_write32_set(..., B_AX_XTAL_OFF_A_DIE)`. ### Step 6.2: BACKPORT COMPLICATIONS - In v6.1 and v6.6, the surrounding context is slightly different (no USB HCI type check before the buggy line -- USB support was added later). The line before reads `rtw89_write32(rtwdev, R_AX_WLLPS_CTRL, 0x0001A0B0)` instead of the PCIE/USB conditional block. The actual buggy line is identical, so only minor context adaptation needed. - In v6.12, context matches closely. Record: [Minor context difference in v6.1/v6.6; buggy line itself is identical] --- ## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT - **Subsystem**: WiFi driver (drivers/net/wireless/realtek/rtw89) - **Criticality**: IMPORTANT -- RTL8852C and RTL8922A are widely-used WiFi chipsets in modern laptops and desktops - **Subsystem activity**: Very active (200+ commits since the bug was introduced) --- ## PHASE 8: IMPACT AND RISK ASSESSMENT ### Step 8.1: WHO IS AFFECTED All users of RTL8852C WiFi adapters (v6.1+) and RTL8922A WiFi adapters (v6.12+). ### Step 8.2: TRIGGER CONDITIONS **Every WiFi power-off event**: suspend, resume cycle, disabling WiFi, shutdown. This is an extremely common operation -- laptops suspend and resume many times per day. ### Step 8.3: FAILURE MODE SEVERITY "Device might get lost potentially" -- the WiFi device disappears from the PCI bus, requiring a reboot to recover. **Severity: HIGH** (device loss, requires reboot). ### Step 8.4: RISK-BENEFIT RATIO - **Benefit**: HIGH -- prevents WiFi device loss during power management operations - **Risk**: VERY LOW -- single register bit operation change, 1 line per file, from the hardware vendor - **Ratio**: Overwhelmingly positive --- ## PHASE 9: FINAL SYNTHESIS ### Step 9.1: EVIDENCE COMPILATION **FOR backporting:** - Fixes a real hardware bug (timing issue in power-off sequence) - Concrete failure mode: WiFi device gets lost, requiring reboot - Affects common code path (every power-off/suspend) - Extremely small and surgical (1 line change per chip, 2 files total) - From the subsystem maintainer and hardware vendor (Ping-Ke Shih at Realtek) - Based on Realtek internal hardware validation - Buggy code has been present since inception (v5.18 for RTL8852C, v6.8 for RTL8922A) - Applied without any objections or review concerns - No dependencies on other patches - No regression risk (only changes a single register bit in power-off path) **AGAINST backporting:** - No explicit Cc: stable (expected and not a negative signal) - No Fixes: tag (expected) - No user bug reports (found from internal hardware validation) - Context differs slightly in older stable trees (minor, trivially adaptable) ### Step 9.2: STABLE RULES CHECKLIST 1. Obviously correct and tested? **YES** -- from hardware vendor, applied by maintainer 2. Fixes a real bug? **YES** -- timing issue causing device loss 3. Important issue? **YES** -- device disappears from bus, requires reboot 4. Small and contained? **YES** -- 2 lines total across 2 files 5. No new features/APIs? **YES** -- just changes set to clear on existing register write 6. Can apply to stable trees? **YES** -- with minor context adaptation for older trees ### Step 9.3: EXCEPTION CATEGORIES Not an exception category -- this is a straightforward bug fix. ### Step 9.4: DECISION This is a clear YES. The fix is tiny, obviously correct, from the subsystem maintainer/hardware vendor, fixes a real bug that causes WiFi device loss on power-off operations, and affects popular WiFi chipsets. --- ## Verification - [Phase 1] Parsed commit message: explicitly says "Fix timing issue", describes device loss failure - [Phase 2] Diff analysis: confirmed 2 identical 1-line changes (`write32_set` -> `write32_clr`) in `rtw8852c_pwr_off_func()` and `rtw8922a_pwr_off_func()` - [Phase 2] Verified `write32_set` sets bits (OR) and `write32_clr` clears bits (AND ~bit) from `core.h` lines 6667-6699 - [Phase 3] git blame: RTL8852C buggy line from `2a7e54db40f0e1` (v5.18, 2022-03-07); RTL8922A from `f20b2b7d3f1b1d` (v6.8, 2023-12-11) - [Phase 3] git merge-base: confirmed `2a7e54db40f0e1` in v6.1 and v6.6; `f20b2b7d3f1b1d` in v6.8 and v6.12 - [Phase 4] b4 mbox: found series [PATCH rtw-next 00-13/13], patch 03/13 applied as `9a38ef92aaa2` - [Phase 4] Maintainer reply: 12/13 patches applied, no objections to this patch - [Phase 5] Grep: `XTAL_OFF_A_DIE` bit only used in these two pwr_off_func functions - [Phase 5] Callers: pwr_off_func called from `rtw89_mac_power_switch()` on every power-off event - [Phase 6] Verified buggy code exists in v6.1, v6.6, v6.12 via `git show v6.x:...` + grep - [Phase 6] Context differs in v6.1/v6.6 (no USB HCI check) but buggy line is identical - [Phase 8] Failure mode: device loss requiring reboot; trigger: every WiFi power-off/suspend **YES** drivers/net/wireless/realtek/rtw89/rtw8852c.c | 2 +- drivers/net/wireless/realtek/rtw89/rtw8922a.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c.c b/drivers/net/wireless/realtek/rtw89/rtw8852c.c index de5d343f80a57..896801879328d 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852c.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852c.c @@ -463,7 +463,7 @@ static int rtw8852c_pwr_off_func(struct rtw89_dev *rtwdev) else if (rtwdev->hci.type == RTW89_HCI_TYPE_USB) rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_SOP_EDSWR); - rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_XTAL_OFF_A_DIE); + rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_XTAL_OFF_A_DIE); rtw89_write32_set(rtwdev, R_AX_SYS_SWR_CTRL1, B_AX_SYM_CTRL_SPS_PWMFREQ); rtw89_write32_mask(rtwdev, R_AX_SPS_DIG_ON_CTRL0, B_AX_REG_ZCDC_H_MASK, 0x3); diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c index f41b66b362c4e..fd9cb5c281d3b 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c @@ -492,7 +492,7 @@ static int rtw8922a_pwr_off_func(struct rtw89_dev *rtwdev) return ret; rtw89_write32(rtwdev, R_BE_WLLPS_CTRL, 0x0000A1B2); - rtw89_write32_set(rtwdev, R_BE_SYS_PW_CTRL, B_BE_XTAL_OFF_A_DIE); + rtw89_write32_clr(rtwdev, R_BE_SYS_PW_CTRL, B_BE_XTAL_OFF_A_DIE); rtw89_write32_set(rtwdev, R_BE_SYS_PW_CTRL, B_BE_APFM_SWLPS); rtw89_write32(rtwdev, R_BE_UDM1, 0); -- 2.53.0