summaryrefslogtreecommitdiff
path: root/drivers/net/wireless
AgeCommit message (Collapse)Author
2026-01-09wifi: rtw89: fw: set RACK bit every 4 H2C command for WiFi 6 chips onlyPing-Ke Shih
RACK is to ask firmware send received ACK to driver when a H2C command is received. This is necessary for WiFi 6 chips only. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-11-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: consider hardware AID for firmware elementsPing-Ke Shih
The coming chip RTL8922D has variant of hardware with different AID. Add AID field to header of firmware elements, and compare AID with the value read from hardware. Currently, apply this rule to BB and RF parameters. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-10-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for punctured for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block while puncturing is changing. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-9-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for TX time for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block when BT-coex want shorter TX time due to timeslot assignment, or when MCC want higher retry time to improve connection rate. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-8-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for TX AMPDU for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block while AMPDU is established. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-7-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for association for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block according to associated peer. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-6-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to reset CMAC function block to default value. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-5-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add DMAC v3 H2C command for RTL8922DPing-Ke Shih
Write association data including address and security key of peer to hardware. Add the command for RTL8922D accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-4-pkshih@realtek.com
2026-01-09wifi: rtw89: update query RXDESC v3 for RTL8922DPing-Ke Shih
Add RXDESC v3 to parse meta data of receiving packets for RTL8922D. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-3-pkshih@realtek.com
2026-01-09wifi: rtw89: update TXWD v3 for RTL8922DPing-Ke Shih
Add TXWD v3 to assist in transmitting for RTL8922D according to hardware design. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-2-pkshih@realtek.com
2026-01-08Merge tag 'net-6.19-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter and wireless. Current release - fix to a fix: - net: do not write to msg_get_inq in callee - arp: do not assume dev_hard_header() does not change skb->head Current release - regressions: - wifi: mac80211: don't iterate not running interfaces - eth: mlx5: fix NULL pointer dereference in ioctl module EEPROM Current release - new code bugs: - eth: bnge: add AUXILIARY_BUS to Kconfig dependencies Previous releases - regressions: - eth: mlx5: dealloc forgotten PSP RX modify header Previous releases - always broken: - ping: fix ICMP out SNMP stats double-counting with ICMP sockets - bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - eth: bnxt: fix potential data corruption with HW GRO/LRO" * tag 'net-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits) arp: do not assume dev_hard_header() does not change skb->head net: enetc: fix build warning when PAGE_SIZE is greater than 128K atm: Fix dma_free_coherent() size tools: ynl: don't install tests net: do not write to msg_get_inq in callee bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup net: usb: pegasus: fix memory leak in update_eth_regs_async() net: 3com: 3c59x: fix possible null dereference in vortex_probe1() net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point net: airoha: Fix schedule while atomic in airoha_ppe_deinit() selftests: netdevsim: add carrier state consistency test net: netdevsim: fix inconsistent carrier state after link/unlink selftests: drv-net: Bring back tool() to driver __init__s net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy ...
2026-01-08wifi: libertas: fix WARNING in usb_tx_blockSzymon Wilczek
The function usb_tx_block() submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed. If a second call occurs while the URB is still active (e.g. during rapid firmware loading), usb_submit_urb() detects the active state and triggers a warning: 'URB submitted while active'. Fix this by enforcing serialization: call usb_kill_urb() before submitting the new request. This ensures the URB is idle and safe to reuse. Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com> Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: mwifiex: Allocate dev name earlier for interface workqueue nameChen-Yu Tsai
The interface specific workqueues are allocated with the interface name as part of the workqueue name. However when they are allocated, the interface name has not been allocated, thus the "name" is actually the pattern for the name "mlan%d". This ends up pretty ugly and could conflict if multiple interfaces were added. Allocate the device name earlier and use that to allocate the workqueues. Also tweak the workqueue name patterns to add a separator between the prefix and the interface name parts for readability. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Link: https://patch.msgid.link/20260107092744.1131314-1-wenst@chromium.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: mac80211_hwsim: disable BHs for hwsim_radio_lockBenjamin Berg
The hwsim_radio_lock spinlock expects bottom-half to be disabled, fix the call in mac80211_hwsim_nan_stop to ensure BHs are disabled. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Link: https://patch.msgid.link/20260107143805.ce7406511608.I688f8b19346e94c1f8de0cdadde072054d4b861c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: mac80211_hwsim: fix typo in frequency notificationBenjamin Berg
The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could result in a NULL pointer dereference in cfg80211_next_nan_dw_notif. Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device") Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08Merge tag 'ath-next-20260105' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.20 Propagate the "Next Generation" of the ath12k driver to wireless-next. NOTE TO MAINTAINERS: There is a conflict between this tree and the MHI tree. This conflict has already been resolved by Stephen Rothwell in linux-next. Please refer to his resolution comments in: https://lore.kernel.org/all/20260105154243.7cd5d049@canb.auug.org.au/ ================== Link: https://patch.msgid.link/4ba3aecf-5194-48e3-a112-31da3a8646aa@oss.qualcomm.com/ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: wlcore: sdio: Use pm_ptr instead of #ifdef CONFIG_PMUwe Kleine-König
This increases build coverage and removes two ugly #ifdefs. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20251217112033.3309281-4-u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: brcmfmac: rename function that frees vifRafał Miłecki
Since the commit cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.") netdev isn't freed anymore in the brcmf_cfg80211_free_netdev(). Adjust this function name to match what it actually does (freeing vif). Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20251215103817.29598-1-zajec5@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: brcmfmac: fix/add kernel-doc commentsRandy Dunlap
Correct or add kernel-doc comments for: - an enum name typo - missing struct member comments in struct vif_saved_ie and struct brcmf_cfg80211_vif fixing these warnings: Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:195 Enum value 'BRCMF_VIF_STATUS_EAP_SUCCESS' not described in enum 'brcmf_vif_status' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:195 Excess enum value '@BRCMF_VIF_STATUS_EAP_SUCCUSS' description in 'brcmf_vif_status' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:220 struct member 'assoc_req_ie' not described in 'vif_saved_ie' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:220 struct member 'assoc_req_ie_len' not described in 'vif_saved_ie' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:255 struct member 'saved_ie' not described in 'brcmf_cfg80211_vif' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:255 struct member 'is_11d' not described in 'brcmf_cfg80211_vif' kernel-doc warnings for missing struct member descriptions in struct brcmf_cfg80211_info and struct brcmf_cfg80211_profile are still present. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20251129073803.1814384-1-rdunlap@infradead.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-07wifi: rtw89: 8852b: refine hardware parameters for RFE type 5Dian-Syuan Yang
The RFE type 5 should set different DSWR parameters when card power on. Therefore, add the corresponding register settings for this type. Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-12-pkshih@realtek.com
2026-01-07wifi: rtw89: fix potential zero beacon interval in beacon trackingKuan-Chung Chen
During fuzz testing, it was discovered that bss_conf->beacon_int might be zero, which could result in a division by zero error in subsequent calculations. Set a default value of 100 TU if the interval is zero to ensure stability. Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com
2026-01-07wifi: rtw89: rfk: update rtw89_fw_h2c_rf_pre_ntfy_mcc formatChih-Kang Chang
The H2C command rtw89_fw_h2c_rf_pre_ntfy_mcc have different format. 8922A after FW 0.35.49.0 use v0, after FW 0.35.84.0 use v1. The coming 8922D will use v2. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-10-pkshih@realtek.com
2026-01-07wifi: rtw89: fw: change WITH_RFK_PRE_NOTIFY to be a FW feature groupZong-Zhe Yang
Actually, WITH_RFK_PRE_NOTIFY means supporting one of RFK_PRE_NOTIFY_Vx. So, change it to be a FW feature group which contains RFK_PRE_NOTIFY_Vx. Then, because WITH_RFK_PRE_NOTIFY is abandoned after some FW versions by chip, disable WITH_RFK_PRE_NOTIFY correspondingly in FW feature table. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-9-pkshih@realtek.com
2026-01-07wifi: rtw89: refine mis-ordered entries in FW feature tableZong-Zhe Yang
Make all entries in firmware feature table in increasing order of firmware version. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-8-pkshih@realtek.com
2026-01-07wifi: rtw89: 8922a: tweak RFK_PRE_NOTIFY FW feature configuration to align ↵Zong-Zhe Yang
handling In the FW feature table, V0 and V1 was configured by lt, less than. So, V1 flag was also set in the range of V0. However, in RFK_PRE_NOTIFY handling, rtw89_fw_h2c_rf_pre_ntfy, V1 is tested before V0. Things would process as V1 even if V0 should be used. Tweak FW feature configuration by ge, greater or equal, to align handling. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-7-pkshih@realtek.com
2026-01-07wifi: rtw89: fw: introduce helper for disabling FW feature configurationZong-Zhe Yang
Some FW features (groups) may be valid only in a range of FW versions, i.e. after some FW versions, they can no longer be used. So, introduce some helper macros to configure this kind of things in FW feature table. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-6-pkshih@realtek.com
2026-01-07wifi: rtw89: fw: change FW feature map to a BITMAPZong-Zhe Yang
Originally, FW feature map was declared as a u32. But, the number of FW feature flags is going to be over than 32. So, change it to a BITMAP and update the corresponding macros. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-5-pkshih@realtek.com
2026-01-07wifi: rtw89: pre-handle RF calibration on link when neededZong-Zhe Yang
The Wi-Fi 7 RF calibration flow has a new design which mainly affect MLO cases. Before, old RFK H2C command can just send the used channels and MLO mode even if there are multiple active links. After, each RFK H2C command should send one channel corresponding to one active link. For example, connect MLD AP (channel X) and then activate second link (channel X + channel Y) Before: RFK#1: channel X (path A + path B) RFK#2: channel X (path A) + channel Y (path B) After: RFK#1: channel X (path A + path B) [set MLO mode to focus on 2nd link/channel] RFK#2: channel Y (path A + path B) [set MLO mode back to target case] Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-4-pkshih@realtek.com
2026-01-07wifi: rtw89: rfk: add rtw89_fw_h2c_rf_pre_ntfy_mcc for new WiFi 7 firmwareChih-Kang Chang
The pre-notify is to notify firmware the configured channels, and then RF calibration in firmware can use these values to calibrate RF properly. Since we need more information, change and add the new H2C command format. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-3-pkshih@realtek.com
2026-01-07wifi: rtw89: rfk: update RFK pre info V2 for RTL8922DPing-Ke Shih
The H2C command of RFK pre info is to tell current operating channels to firmware, so RF calibrations can rely on these information as arguments to configure hardware. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251231090647.56407-2-pkshih@realtek.com
2026-01-05compiler-context-analysis: Remove __cond_lock() function-like helperMarco Elver
As discussed in [1], removing __cond_lock() will improve the readability of trylock code. Now that Sparse context tracking support has been removed, we can also remove __cond_lock(). Change existing APIs to either drop __cond_lock() completely, or make use of the __cond_acquires() function attribute instead. In particular, spinlock and rwlock implementations required switching over to inline helpers rather than statement-expressions for their trylock_* variants. Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Marco Elver <elver@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/all/20250207082832.GU7145@noisy.programming.kicks-ass.net/ [1] Link: https://patch.msgid.link/20251219154418.3592607-25-elver@google.com
2025-12-31wifi: mt76: Remove blank line after mt792x firmware version dmesgShuah Khan
An extra blank line gets printed after printing firmware version because the build date is null terminated. Remove the "\n" from dev_info() calls to print firmware version and build date to fix the problem. Reported-by: Mario Limonciello <superm1@gmail.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-12-31Revert "wifi: mt76: Strip whitespace from build ddate"Shuah Khan
This reverts commit f804a5895ebad2b2d4fb8a3688d2115926e993d5. This change introduced the following panic, and mt792x_load_firmware() fails. wifi is dead on systems with mt792x wireless. kern :crit : kernel BUG at lib/string_helpers.c:1043! kern :warn : Oops: invalid opcode: 0000 [#1] SMP NOPTI kern :warn : CPU: 14 UID: 0 PID: 61 Comm: kworker/14:0 Tainted: G W 6.19.0-rc1 #1 PREEMPT(voluntary) kern :warn : Tainted: [W]=WARN kern :warn : Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.16 07/25/2025 kern :warn : Workqueue: events mt7921_init_work [mt7921_common] kern :warn : RIP: 0010:__fortify_panic+0xd/0xf kern :warn : Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 40 0f b6 ff e8 c3 55 71 00 <0f> 0b 48 8b 54 24 10 48 8b 74 24 08 4c 89 e9 48 c7 c7 00 a2 d5 a0 kern :warn : RSP: 0018:ffffa7a5c03a3d10 EFLAGS: 00010246 kern :warn : RAX: ffffffffa0d7aaf2 RBX: 0000000000000000 RCX: ffffffffa0d7aaf2 kern :warn : RDX: 0000000000000011 RSI: ffffffffa0d5a170 RDI: ffffffffa128db10 kern :warn : RBP: ffff91650ae52060 R08: 0000000000000010 R09: ffffa7a5c31b2000 kern :warn : R10: ffffa7a5c03a3bf0 R11: 00000000ffffffff R12: 0000000000000000 kern :warn : R13: ffffa7a5c31b2000 R14: 0000000000001000 R15: 0000000000000000 kern :warn : FS: 0000000000000000(0000) GS:ffff91743e664000(0000) knlGS:0000000000000000 kern :warn : CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kern :warn : CR2: 00007f10786c241c CR3: 00000003eca24000 CR4: 0000000000f50ef0 kern :warn : PKRU: 55555554 kern :warn : Call Trace: kern :warn : <TASK> kern :warn : mt76_connac2_load_patch.cold+0x2b/0xa41 [mt76_connac_lib] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : mt792x_load_firmware+0x36/0x150 [mt792x_lib] kern :warn : mt7921_run_firmware+0x2c/0x4a0 [mt7921_common] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : ? mt7921_rr+0x12/0x30 [mt7921e] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : ? ____mt76_poll_msec+0x75/0xb0 [mt76] kern :warn : mt7921e_mcu_init+0x4c/0x7a [mt7921e] kern :warn : mt7921_init_work+0x51/0x190 [mt7921_common] kern :warn : process_one_work+0x18b/0x340 kern :warn : worker_thread+0x256/0x3a0 kern :warn : ? __pfx_worker_thread+0x10/0x10 kern :warn : kthread+0xfc/0x240 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ret_from_fork+0x254/0x290 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ret_from_fork_asm+0x1a/0x30 kern :warn : </TASK> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-12-31net: qrtr: Drop the MHI auto_queue feature for IPCR DL channelsManivannan Sadhasivam
MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the dl_callback gets called, the client driver's structures might not be initialized, leading to NULL ptr dereference. Currently, the drivers have to workaround this issue by initializing the internal structures before calling mhi_prepare_for_transfer_autoqueue(). But even so, there is a chance that the client driver's internal code path may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is called, leading to similar NULL ptr dereference. This issue has been reported on the Qcom X1E80100 CRD machines affecting boot. So to properly fix all these races, drop the MHI 'auto_queue' feature altogether and let the client driver (QRTR) manage the RX buffers manually. In the QRTR driver, queue the RX buffers based on the ring length during probe and recycle the buffers in 'dl_callback' once they are consumed. This also warrants removing the setting of 'auto_queue' flag from controller drivers. Currently, this 'auto_queue' feature is only enabled for IPCR DL channel. So only the QRTR client driver requires the modification. Fixes: 227fee5fc99e ("bus: mhi: core: Add an API for auto queueing buffers for DL channel") Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation") Reported-by: Johan Hovold <johan@kernel.org> Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com Suggested-by: Chris Lew <quic_clew@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Acked-by: Jeff Johnson <jjohnson@kernel.org> # drivers/net/wireless/ath/... Acked-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Acked-by: Paolo Abeni <pabeni@redhat.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251218-qrtr-fix-v2-1-c7499bfcfbe0@oss.qualcomm.com
2025-12-31wifi: rtw89: enhance connection stability when triggering beacon lossDian-Syuan Yang
If the driver supports ack status reports of TX frames, mac80211 allows it to detect AP if it's alive and determine whether the client can maintain the connection by sending null-data. Therefore, refine the flow to let driver inform mac80211 to enable beacon loss work to track AP's status upon receiving beacon loss event. Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-13-pkshih@realtek.com
2025-12-31wifi: rtw89: regd: 6 GHz power type marks default when inactiveZong-Zhe Yang
When inactive, 6 GHz power type has been assigned to the default one, but missed to mark the local control variable, dflt, true. Then, this might let some 6 GHz power info of disconnected APs keep being taken into account under certain cases. So, mark default when inactive. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com
2025-12-31wifi: rtw89: 8922a: configure FW version for SCAN_OFFLOAD_EXTRA_OP featureChih-Kang Chang
8922a supports SCAN_OFFLOAD_EXTRA_OP feature. Enable it, FW can do back-op and TX NULL frames on the second connection. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-11-pkshih@realtek.com
2025-12-31wifi: rtw89: refine TX nulldata judgement when scan with 2 OP channelsChih-Kang Chang
When scan with 2 OP channels, for the case like not-connect(macid 0) + GO(macid 1) or not-connect(macid 0) + GC(macid 1), the macid 0 doesn't offload NULL data packet to FW. Therefore, refine the NULL data judgement to let interfaces that only connected and non-AP mode need to TX nulldata. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-10-pkshih@realtek.com
2025-12-31wifi: rtw89: add default quirks as features to chip_infoPing-Ke Shih
The coming chip will support thermal protection by default, so add default quirks to chip_info. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-9-pkshih@realtek.com
2025-12-31wifi: rtw89: read chip ID for RTL8922D variantsPing-Ke Shih
The coming RTL8922D has many kinds of hardware variants. Read chips ID ahead, so we can configure proper hardware settings accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-8-pkshih@realtek.com
2025-12-31wifi: rtw89: efuse: read hardware version from efuse for WiFi 7 chipsPing-Ke Shih
Hardware version from efuse prioritizes to the version from register. For WiFi 7 chips, this becomes required, so implement this in common flow. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-7-pkshih@realtek.com
2025-12-31wifi: rtw89: define TX/RX aggregation and MPDU capability per chipKuan-Chung Chen
Since TX/RX aggregation is different from chip to chip, define individual number according to hardware ability. Also the coming chip RTL8922DE can get expected performance. Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-6-pkshih@realtek.com
2025-12-31wifi: rtw89: wow: abstract DMA check register for RTL8922DEChin-Yen Lee
The coming RTL8922DE use different register and its bit to poll if DMA becomes idle before entering WoWLAN. Abstract to share common flow. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-5-pkshih@realtek.com
2025-12-31wifi: rtw89: wow: add WOW_CAM update function for 8922DChin-Yen Lee
For WOW_CAM update function, 8922DE use different H2C command from 8922AE. Use chip to distinguish them. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-4-pkshih@realtek.com
2025-12-31wifi: rtw89: wow: change type of WoWLAN pattern mask to __le32Ping-Ke Shih
The WoWLAN pattern mask is generated in byte stream, and actually firmware expects to see the same byte stream too. Since these byte stream is sent to firmware with 32-bit stream in little-endian order. Change to mask to __le32, and just do assignment instead of le32 conversion to wkfm fields of H2C command. For little-endian machine, it doesn't change logic at all. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-3-pkshih@realtek.com
2025-12-31wifi: rtw89: wow: use struct style to fill WOW CAM H2C commandChin-Yen Lee
The WOW CAM H2C command is used to tell firmware the content of pattern match. Use struct instead of macros to fill the data. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251229030926.27004-2-pkshih@realtek.com
2025-12-31wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_addAli Tariq
The driver does not set hw->sta_data_size, which causes mac80211 to allocate insufficient space for driver private station data in __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of struct rtl8xxxu_sta_info through sta->drv_priv, this results in a slab-out-of-bounds write. KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter: BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12 Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during probe, similar to how hw->vif_data_size is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data. Tested on StarFive VisionFive 2 v1.2A board. Fixes: eef55f1545c9 ("wifi: rtl8xxxu: support multiple interfaces in {add,remove}_interface()") Cc: stable@vger.kernel.org Signed-off-by: Ali Tariq <alitariq45892@gmail.com> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20251225115430.13011-1-alitariq45892@gmail.com
2025-12-26wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band dataBitterblue Smith
Internally wiphy writes to individual channels in this structure, so we must not share one static definition of channel list between multiple device instances, because that causes hard to debug breakage. For example, with two rtw88 driven devices in the system, channel information may get incoherent, preventing channel use. Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing of struct ieee80211_supported_band data"). Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com
2025-12-26wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()Bitterblue Smith
Simplify the code by using device managed memory allocations. This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path. Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*"). Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com
2025-12-26wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()Bitterblue Smith
rtw_core_enable_beacon() reads 4 bytes from an address that is not a multiple of 4. This results in a crash on some systems. Do 1 byte reads/writes instead. Unable to handle kernel paging request at virtual address ffff8000827e0522 Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000 [ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13 Internal error: Oops: 0000000096000021 [#1] SMP Modules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...] CPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G W 6.17.9 #1-NixOS VOLUNTARY Tainted: [W]=WARN Hardware name: FriendlyElec NanoPC-T6 LTS (DT) Workqueue: phy0 rtw_c2h_work [rtw88_core] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : rtw_pci_read32+0x18/0x40 [rtw88_pci] lr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core] sp : ffff800080cc3ca0 x29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828 x26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00 x23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001 x20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522 Call trace: rtw_pci_read32+0x18/0x40 [rtw88_pci] (P) rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core] rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core] rtw_c2h_work+0x50/0x98 [rtw88_core] process_one_work+0x178/0x3f8 worker_thread+0x208/0x418 kthread+0x120/0x220 ret_from_fork+0x10/0x20 Code: d28fe202 8b020000 f9524400 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- Fixes: ad6741b1e044 ("wifi: rtw88: Stop high queue during scan") Cc: stable@vger.kernel.org Closes: https://github.com/lwfinger/rtw88/issues/418 Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/6345300d-8c93-464c-9b05-d0d9af3c97ad@gmail.com
generated by cgit v1.2.3 (git 2.46.0) at 2026-02-27 02:26:41 +0000