[PATCH AUTOSEL 6.19-6.12] wifi: rtw89: mac: correct page number for CSI response

[Sasha Levin <sashal@kernel.org>]

From: Ping-Ke Shih <pkshih@realtek.com>

[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ]

For beamforming procedure, hardware reserve memory page for CSI response.
The unit of register is (value - 1), so add one accordingly as expected.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Analysis of commit: "wifi: rtw89: mac: correct page number for CSI
response"

### 1. Commit Message Analysis

The commit message states that for the beamforming procedure, hardware
reserves memory pages for CSI (Channel State Information) response. The
register expects a value where the unit is `(value - 1)`, meaning the
driver needs to write `pg_num + 1` to get the correct number of pages
reserved. The current code writes `pg_num` directly, which results in
one fewer page than intended.

This is a hardware register programming bug — an off-by-one error in how
a register value is interpreted.

### 2. Code Change Analysis

The change is a single-line fix:
```c
- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK,
  qt_cfg.pg_num);
+ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK,
qt_cfg.pg_num + 1);
```

This is about as minimal and surgical as a fix can be. It corrects the
value written to the `R_BE_RESP_CSI_RESERVED_PAGE` register's page
number field by adding 1 to account for the hardware's `(value - 1)`
encoding.

### 3. Bug Classification

This is a **hardware register programming bug** (off-by-one). The
consequence is that the hardware reserves one fewer memory page than
needed for CSI response in beamforming. This could lead to:
- **Beamforming failures** or degraded WiFi performance
- Potential **memory corruption within the hardware's DLE (Data Link
  Engine)** if CSI responses overflow the allocated pages
- Possible **firmware/hardware hangs** if the CSI response data
  overwrites adjacent memory regions in the hardware

### 4. Scope and Risk Assessment

- **Lines changed**: 1 line
- **Files touched**: 1 file
  (`drivers/net/wireless/realtek/rtw89/mac_be.c`)
- **Complexity**: Trivially simple — adds `+ 1` to a value
- **Risk of regression**: Extremely low. The fix aligns the driver with
  the hardware's documented register encoding. Writing the wrong value
  was the bug.
- **Subsystem**: WiFi driver (rtw89 — Realtek WiFi), which is a commonly
  used wireless driver

### 5. User Impact

- **Who is affected**: Users of Realtek WiFi chipsets supported by the
  rtw89 driver (specifically the "BE" generation, likely WiFi 7 chips
  like RTL8922AE)
- **Severity**: Medium-high. Beamforming is important for WiFi
  performance and reliability. With incorrect page reservation, users
  may experience degraded throughput, connection instability, or
  potential hardware issues
- **Real-world impact**: Any user with this hardware would be affected
  during beamforming operations

### 6. Stability Indicators

- **Author**: Ping-Ke Shih (pkshih@realtek.com) — the primary maintainer
  of the rtw89 driver at Realtek. Highly trusted for this subsystem.
- **Obviously correct**: The commit message clearly explains the
  hardware register encoding, and the fix directly addresses it.

### 7. Dependency Check

This is a standalone fix. It doesn't depend on other patches (it's patch
7 of a series, but this particular change is self-contained — it just
corrects a value written to a register). The function
`resp_pktctl_init_be()` and the register definitions need to exist in
the stable tree.

### 8. Stable Kernel Criteria Assessment

- **Obviously correct**: Yes — the hardware register uses `(value - 1)`
  encoding, so writing `pg_num + 1` is the correct value
- **Fixes a real bug**: Yes — off-by-one in hardware register
  programming causes incorrect page reservation
- **Small and contained**: Yes — single line change in a single file
- **No new features**: Correct — this is purely a bug fix
- **Tested**: From the Realtek driver maintainer, submitted through
  proper channels

### Risk vs. Benefit

- **Risk**: Negligible. A one-line arithmetic correction to a hardware
  register value, authored by the subsystem maintainer.
- **Benefit**: Fixes beamforming page allocation for rtw89 BE-generation
  WiFi hardware, preventing potential performance degradation or
  hardware issues.

### Concerns

The only concern is whether the `mac_be.c` file exists in the target
stable trees. The "BE" generation support was added relatively recently,
so this fix would only apply to stable kernels that already include
rtw89 BE support. But if the code exists in the stable tree, this fix is
clearly appropriate.

**YES**

 drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
index 9b9e646487346..dee5ff71b75fe 100644
--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
+++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
@@ -1175,7 +1175,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx)
 
 	reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx);
 	rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid);
-	rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num);
+	rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1);
 
 	return 0;
 }
-- 
2.51.0