From 8530efdd73ffcc38cca25e895b27513456c89dda Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Sat, 1 Nov 2025 21:20:38 +0200 Subject: [PATCH 01/25] wifi: rtw89: Add rtw89_core_get_ch_dma_v2() commit 89acd6c49322db4603a122e20780904021dc0491 upstream. RTL8852CU, RTL8852AU, and RTL8922AU need a different mapping of TX queue to DMA channel compared to their PCI versions, so make get_ch_dma in struct rtw89_chip_ops an array and add rtw89_core_get_ch_dma_v2(). Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/6c7b2f01-2c78-47c8-a4c4-98cd3060d7f3@gmail.com --- drivers/net/wireless/realtek/rtw89/core.c | 19 +++++++++++++++++++ drivers/net/wireless/realtek/rtw89/core.h | 5 +++-- drivers/net/wireless/realtek/rtw89/rtw8851b.c | 4 +++- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 4 +++- drivers/net/wireless/realtek/rtw89/rtw8852b.c | 4 +++- .../net/wireless/realtek/rtw89/rtw8852bt.c | 4 +++- drivers/net/wireless/realtek/rtw89/rtw8852c.c | 4 +++- drivers/net/wireless/realtek/rtw89/rtw8922a.c | 4 +++- 8 files changed, 40 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index def596703c371a..0b3467a2027d6e 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -759,6 +759,25 @@ u8 rtw89_core_get_ch_dma_v1(struct rtw89_dev *rtwdev, u8 qsel) } EXPORT_SYMBOL(rtw89_core_get_ch_dma_v1); +u8 rtw89_core_get_ch_dma_v2(struct rtw89_dev *rtwdev, u8 qsel) +{ + switch (qsel) { + default: + rtw89_warn(rtwdev, "Cannot map qsel to dma v2: %d\n", qsel); + fallthrough; + case RTW89_TX_QSEL_BE_0: + case RTW89_TX_QSEL_VO_0: + return RTW89_TXCH_ACH0; + case RTW89_TX_QSEL_BK_0: + case RTW89_TX_QSEL_VI_0: + return RTW89_TXCH_ACH2; + case RTW89_TX_QSEL_B0_MGMT: + case RTW89_TX_QSEL_B0_HI: + return RTW89_TXCH_CH8; + } +} +EXPORT_SYMBOL(rtw89_core_get_ch_dma_v2); + static void rtw89_core_tx_update_mgmt_info(struct rtw89_dev *rtwdev, struct rtw89_core_tx_request *tx_req) diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 4f2a9ac1ffd63d..a6e17b64d36f91 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -3767,7 +3767,7 @@ struct rtw89_chip_ops { void (*fill_txdesc_fwcmd)(struct rtw89_dev *rtwdev, struct rtw89_tx_desc_info *desc_info, void *txdesc); - u8 (*get_ch_dma)(struct rtw89_dev *rtwdev, u8 qsel); + u8 (*get_ch_dma[RTW89_HCI_TYPE_NUM])(struct rtw89_dev *rtwdev, u8 qsel); int (*cfg_ctrl_path)(struct rtw89_dev *rtwdev, bool wl); int (*mac_cfg_gnt)(struct rtw89_dev *rtwdev, const struct rtw89_mac_ax_coex_gnt *gnt_cfg); @@ -7261,7 +7261,7 @@ u8 rtw89_chip_get_ch_dma(struct rtw89_dev *rtwdev, u8 qsel) { const struct rtw89_chip_info *chip = rtwdev->chip; - return chip->ops->get_ch_dma(rtwdev, qsel); + return chip->ops->get_ch_dma[rtwdev->hci.type](rtwdev, qsel); } static inline @@ -7515,6 +7515,7 @@ void rtw89_core_fill_txdesc_fwcmd_v2(struct rtw89_dev *rtwdev, void *txdesc); u8 rtw89_core_get_ch_dma(struct rtw89_dev *rtwdev, u8 qsel); u8 rtw89_core_get_ch_dma_v1(struct rtw89_dev *rtwdev, u8 qsel); +u8 rtw89_core_get_ch_dma_v2(struct rtw89_dev *rtwdev, u8 qsel); void rtw89_core_rx(struct rtw89_dev *rtwdev, struct rtw89_rx_desc_info *desc_info, struct sk_buff *skb); diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b.c b/drivers/net/wireless/realtek/rtw89/rtw8851b.c index edcbda124916c0..2019f6022cbb4d 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8851b.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8851b.c @@ -2537,7 +2537,9 @@ static const struct rtw89_chip_ops rtw8851b_chip_ops = { .query_rxdesc = rtw89_core_query_rxdesc, .fill_txdesc = rtw89_core_fill_txdesc, .fill_txdesc_fwcmd = rtw89_core_fill_txdesc, - .get_ch_dma = rtw89_core_get_ch_dma, + .get_ch_dma = {rtw89_core_get_ch_dma, + rtw89_core_get_ch_dma, + NULL,}, .cfg_ctrl_path = rtw89_mac_cfg_ctrl_path, .mac_cfg_gnt = rtw89_mac_cfg_gnt, .stop_sch_tx = rtw89_mac_stop_sch_tx, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c index 3defb38223e8bd..d0f724a69b6e05 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c @@ -2179,7 +2179,9 @@ static const struct rtw89_chip_ops rtw8852a_chip_ops = { .query_rxdesc = rtw89_core_query_rxdesc, .fill_txdesc = rtw89_core_fill_txdesc, .fill_txdesc_fwcmd = rtw89_core_fill_txdesc, - .get_ch_dma = rtw89_core_get_ch_dma, + .get_ch_dma = {rtw89_core_get_ch_dma, + rtw89_core_get_ch_dma_v2, + NULL,}, .cfg_ctrl_path = rtw89_mac_cfg_ctrl_path, .mac_cfg_gnt = rtw89_mac_cfg_gnt, .stop_sch_tx = rtw89_mac_stop_sch_tx, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b.c b/drivers/net/wireless/realtek/rtw89/rtw8852b.c index 0777e336aaa1d6..38cd151f8c3f22 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852b.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852b.c @@ -842,7 +842,9 @@ static const struct rtw89_chip_ops rtw8852b_chip_ops = { .query_rxdesc = rtw89_core_query_rxdesc, .fill_txdesc = rtw89_core_fill_txdesc, .fill_txdesc_fwcmd = rtw89_core_fill_txdesc, - .get_ch_dma = rtw89_core_get_ch_dma, + .get_ch_dma = {rtw89_core_get_ch_dma, + rtw89_core_get_ch_dma, + NULL,}, .cfg_ctrl_path = rtw89_mac_cfg_ctrl_path, .mac_cfg_gnt = rtw89_mac_cfg_gnt, .stop_sch_tx = rtw89_mac_stop_sch_tx, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bt.c b/drivers/net/wireless/realtek/rtw89/rtw8852bt.c index b3a79ebc7e754a..15ba780492d617 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852bt.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852bt.c @@ -708,7 +708,9 @@ static const struct rtw89_chip_ops rtw8852bt_chip_ops = { .query_rxdesc = rtw89_core_query_rxdesc, .fill_txdesc = rtw89_core_fill_txdesc, .fill_txdesc_fwcmd = rtw89_core_fill_txdesc, - .get_ch_dma = rtw89_core_get_ch_dma, + .get_ch_dma = {rtw89_core_get_ch_dma, + NULL, + NULL,}, .cfg_ctrl_path = rtw89_mac_cfg_ctrl_path, .mac_cfg_gnt = rtw89_mac_cfg_gnt, .stop_sch_tx = rtw89_mac_stop_sch_tx, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c.c b/drivers/net/wireless/realtek/rtw89/rtw8852c.c index 440801d633437d..ee191530737676 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852c.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852c.c @@ -2962,7 +2962,9 @@ static const struct rtw89_chip_ops rtw8852c_chip_ops = { .query_rxdesc = rtw89_core_query_rxdesc, .fill_txdesc = rtw89_core_fill_txdesc_v1, .fill_txdesc_fwcmd = rtw89_core_fill_txdesc_fwcmd_v1, - .get_ch_dma = rtw89_core_get_ch_dma, + .get_ch_dma = {rtw89_core_get_ch_dma, + rtw89_core_get_ch_dma_v2, + NULL,}, .cfg_ctrl_path = rtw89_mac_cfg_ctrl_path_v1, .mac_cfg_gnt = rtw89_mac_cfg_gnt_v1, .stop_sch_tx = rtw89_mac_stop_sch_tx_v1, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c index 730e5d0d657503..b7c2fd9061f159 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c @@ -2872,7 +2872,9 @@ static const struct rtw89_chip_ops rtw8922a_chip_ops = { .query_rxdesc = rtw89_core_query_rxdesc_v2, .fill_txdesc = rtw89_core_fill_txdesc_v2, .fill_txdesc_fwcmd = rtw89_core_fill_txdesc_fwcmd_v2, - .get_ch_dma = rtw89_core_get_ch_dma, + .get_ch_dma = {rtw89_core_get_ch_dma, + rtw89_core_get_ch_dma_v2, + NULL,}, .cfg_ctrl_path = rtw89_mac_cfg_ctrl_path_v2, .mac_cfg_gnt = rtw89_mac_cfg_gnt_v2, .stop_sch_tx = rtw89_mac_stop_sch_tx_v2, From dd6a4512ecdc45195b037d39632103d64f8a5eb6 Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Sat, 1 Nov 2025 21:22:19 +0200 Subject: [PATCH 02/25] wifi: rtw89: usb: Move bulk out map to new struct rtw89_usb_info commit 994944aa58f84a4798664408a95606bd9f8a40f2 upstream. RTL8852AU, RTL8852CU, and RTL8922AU will need a different TX channel to bulk out endpoint mapping, so create a new struct rtw89_usb_info and move the mapping there. Initialise it in each chip's driver. Struct rtw89_usb_info will also hold some registers which are located at different offsets in RTL8852CU compared to the other wifi 6 chips. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/de11cfae-1dc0-4514-95b2-02b1bbfa92be@gmail.com --- drivers/net/wireless/realtek/rtw89/core.h | 2 ++ .../net/wireless/realtek/rtw89/rtw8851bu.c | 15 +++++++++++ .../net/wireless/realtek/rtw89/rtw8852bu.c | 15 +++++++++++ drivers/net/wireless/realtek/rtw89/usb.c | 25 +++---------------- drivers/net/wireless/realtek/rtw89/usb.h | 5 ++++ 5 files changed, 40 insertions(+), 22 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index a6e17b64d36f91..15aaed5c38c892 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -15,6 +15,7 @@ struct rtw89_dev; struct rtw89_pci_info; +struct rtw89_usb_info; struct rtw89_mac_gen_def; struct rtw89_phy_gen_def; struct rtw89_fw_blacklist; @@ -4517,6 +4518,7 @@ struct rtw89_chip_variant { union rtw89_bus_info { const struct rtw89_pci_info *pci; + const struct rtw89_usb_info *usb; }; struct rtw89_driver_info { diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c index 10fcfade6151ec..ffc10bc1d97073 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c @@ -7,10 +7,25 @@ #include "rtw8851b.h" #include "usb.h" +static const struct rtw89_usb_info rtw8851b_usb_info = { + .bulkout_id = { + [RTW89_DMA_ACH0] = 3, + [RTW89_DMA_ACH1] = 4, + [RTW89_DMA_ACH2] = 5, + [RTW89_DMA_ACH3] = 6, + [RTW89_DMA_B0MG] = 0, + [RTW89_DMA_B0HI] = 1, + [RTW89_DMA_H2C] = 2, + }, +}; + static const struct rtw89_driver_info rtw89_8851bu_info = { .chip = &rtw8851b_chip_info, .variant = NULL, .quirks = NULL, + .bus = { + .usb = &rtw8851b_usb_info, + } }; static const struct usb_device_id rtw_8851bu_id_table[] = { diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c index add5987110b33f..d6a7595ceaa0e3 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c @@ -7,10 +7,25 @@ #include "rtw8852b.h" #include "usb.h" +static const struct rtw89_usb_info rtw8852b_usb_info = { + .bulkout_id = { + [RTW89_DMA_ACH0] = 3, + [RTW89_DMA_ACH1] = 4, + [RTW89_DMA_ACH2] = 5, + [RTW89_DMA_ACH3] = 6, + [RTW89_DMA_B0MG] = 0, + [RTW89_DMA_B0HI] = 1, + [RTW89_DMA_H2C] = 2, + }, +}; + static const struct rtw89_driver_info rtw89_8852bu_info = { .chip = &rtw8852b_chip_info, .variant = NULL, .quirks = NULL, + .bus = { + .usb = &rtw8852b_usb_info, + } }; static const struct usb_device_id rtw_8852bu_id_table[] = { diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index 512a46dd9d06a3..18712d7d38442e 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -167,27 +167,6 @@ rtw89_usb_ops_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev, return 42; /* TODO some kind of calculation? */ } -static u8 rtw89_usb_get_bulkout_id(u8 ch_dma) -{ - switch (ch_dma) { - case RTW89_DMA_ACH0: - return 3; - case RTW89_DMA_ACH1: - return 4; - case RTW89_DMA_ACH2: - return 5; - case RTW89_DMA_ACH3: - return 6; - default: - case RTW89_DMA_B0MG: - return 0; - case RTW89_DMA_B0HI: - return 1; - case RTW89_DMA_H2C: - return 2; - } -} - static void rtw89_usb_write_port_complete(struct urb *urb) { struct rtw89_usb_tx_ctrl_block *txcb = urb->context; @@ -249,9 +228,10 @@ static int rtw89_usb_write_port(struct rtw89_dev *rtwdev, u8 ch_dma, void *data, int len, void *context) { struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + const struct rtw89_usb_info *info = rtwusb->info; struct usb_device *usbd = rtwusb->udev; struct urb *urb; - u8 bulkout_id = rtw89_usb_get_bulkout_id(ch_dma); + u8 bulkout_id = info->bulkout_id[ch_dma]; unsigned int pipe; int ret; @@ -950,6 +930,7 @@ int rtw89_usb_probe(struct usb_interface *intf, rtwusb = rtw89_usb_priv(rtwdev); rtwusb->rtwdev = rtwdev; + rtwusb->info = info->bus.usb; rtwdev->hci.ops = &rtw89_usb_ops; rtwdev->hci.type = RTW89_HCI_TYPE_USB; diff --git a/drivers/net/wireless/realtek/rtw89/usb.h b/drivers/net/wireless/realtek/rtw89/usb.h index c1b4bfa2097958..a27c698a424c4b 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.h +++ b/drivers/net/wireless/realtek/rtw89/usb.h @@ -20,6 +20,10 @@ #define RTW89_MAX_ENDPOINT_NUM 9 #define RTW89_MAX_BULKOUT_NUM 7 +struct rtw89_usb_info { + u8 bulkout_id[RTW89_DMA_CH_NUM]; +}; + struct rtw89_usb_rx_ctrl_block { struct rtw89_dev *rtwdev; struct urb *rx_urb; @@ -35,6 +39,7 @@ struct rtw89_usb_tx_ctrl_block { struct rtw89_usb { struct rtw89_dev *rtwdev; struct usb_device *udev; + const struct rtw89_usb_info *info; __le32 *vendor_req_buf; From 6de968b966de62659318dcf6ff6821c4a7ae037c Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Sat, 1 Nov 2025 21:22:56 +0200 Subject: [PATCH 03/25] wifi: rtw89: usb: Prepare rtw89_usb_ops_mac_pre_init() for RTL8852CU commit 7697701d6c0356cecda03be516023cb527ddb007 upstream. The registers used in rtw89_usb_ops_mac_pre_init() are located at different offsets in RTL8852CU, so move them to struct rtw89_usb_info, which is filled in each chip's driver. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/36b823c9-2cb5-4191-8492-2a291f9dc1db@gmail.com --- drivers/net/wireless/realtek/rtw89/rtw8851bu.c | 4 ++++ drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 4 ++++ drivers/net/wireless/realtek/rtw89/usb.c | 13 ++++++++----- drivers/net/wireless/realtek/rtw89/usb.h | 3 +++ 4 files changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c index ffc10bc1d97073..f79a67a62dfd7f 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c @@ -5,9 +5,13 @@ #include #include #include "rtw8851b.h" +#include "reg.h" #include "usb.h" static const struct rtw89_usb_info rtw8851b_usb_info = { + .usb_host_request_2 = R_AX_USB_HOST_REQUEST_2, + .usb_wlan0_1 = R_AX_USB_WLAN0_1, + .hci_func_en = R_AX_HCI_FUNC_EN, .bulkout_id = { [RTW89_DMA_ACH0] = 3, [RTW89_DMA_ACH1] = 4, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c index d6a7595ceaa0e3..10b20531461ea2 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c @@ -5,9 +5,13 @@ #include #include #include "rtw8852b.h" +#include "reg.h" #include "usb.h" static const struct rtw89_usb_info rtw8852b_usb_info = { + .usb_host_request_2 = R_AX_USB_HOST_REQUEST_2, + .usb_wlan0_1 = R_AX_USB_WLAN0_1, + .hci_func_en = R_AX_HCI_FUNC_EN, .bulkout_id = { [RTW89_DMA_ACH0] = 3, [RTW89_DMA_ACH1] = 4, diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index 18712d7d38442e..175dca8cc60363 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -679,20 +679,23 @@ static int rtw89_usb_ops_deinit(struct rtw89_dev *rtwdev) static int rtw89_usb_ops_mac_pre_init(struct rtw89_dev *rtwdev) { + struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + const struct rtw89_usb_info *info = rtwusb->info; u32 val32; - rtw89_write32_set(rtwdev, R_AX_USB_HOST_REQUEST_2, B_AX_R_USBIO_MODE); + rtw89_write32_set(rtwdev, info->usb_host_request_2, + B_AX_R_USBIO_MODE); /* fix USB IO hang suggest by chihhanli@realtek.com */ - rtw89_write32_clr(rtwdev, R_AX_USB_WLAN0_1, + rtw89_write32_clr(rtwdev, info->usb_wlan0_1, B_AX_USBRX_RST | B_AX_USBTX_RST); - val32 = rtw89_read32(rtwdev, R_AX_HCI_FUNC_EN); + val32 = rtw89_read32(rtwdev, info->hci_func_en); val32 &= ~(B_AX_HCI_RXDMA_EN | B_AX_HCI_TXDMA_EN); - rtw89_write32(rtwdev, R_AX_HCI_FUNC_EN, val32); + rtw89_write32(rtwdev, info->hci_func_en, val32); val32 |= B_AX_HCI_RXDMA_EN | B_AX_HCI_TXDMA_EN; - rtw89_write32(rtwdev, R_AX_HCI_FUNC_EN, val32); + rtw89_write32(rtwdev, info->hci_func_en, val32); /* fix USB TRX hang suggest by chihhanli@realtek.com */ return 0; diff --git a/drivers/net/wireless/realtek/rtw89/usb.h b/drivers/net/wireless/realtek/rtw89/usb.h index a27c698a424c4b..be3a9fbe42c0bc 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.h +++ b/drivers/net/wireless/realtek/rtw89/usb.h @@ -21,6 +21,9 @@ #define RTW89_MAX_BULKOUT_NUM 7 struct rtw89_usb_info { + u32 usb_host_request_2; + u32 usb_wlan0_1; + u32 hci_func_en; u8 bulkout_id[RTW89_DMA_CH_NUM]; }; From abe4628d792261dadb9dfd89b652d027c414bb0d Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Sat, 1 Nov 2025 21:23:33 +0200 Subject: [PATCH 04/25] wifi: rtw89: usb: Prepare rtw89_usb_ops_mac_post_init() for RTL8852CU commit 199afd3af12c81f663734d8fe290197288618ada upstream. The registers used in rtw89_usb_ops_mac_post_init() are located at different offsets in RTL8852CU, so move them to struct rtw89_usb_info, which is filled in each chip's driver. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/c12b621a-037c-4870-ac12-9795ddde6b53@gmail.com --- drivers/net/wireless/realtek/rtw89/rtw8851bu.c | 3 +++ drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 3 +++ drivers/net/wireless/realtek/rtw89/usb.c | 7 ++++--- drivers/net/wireless/realtek/rtw89/usb.h | 3 +++ 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c index f79a67a62dfd7f..5ac531d11acd0a 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c @@ -12,6 +12,9 @@ static const struct rtw89_usb_info rtw8851b_usb_info = { .usb_host_request_2 = R_AX_USB_HOST_REQUEST_2, .usb_wlan0_1 = R_AX_USB_WLAN0_1, .hci_func_en = R_AX_HCI_FUNC_EN, + .usb3_mac_npi_config_intf_0 = R_AX_USB3_MAC_NPI_CONFIG_INTF_0, + .usb_endpoint_0 = R_AX_USB_ENDPOINT_0, + .usb_endpoint_2 = R_AX_USB_ENDPOINT_2, .bulkout_id = { [RTW89_DMA_ACH0] = 3, [RTW89_DMA_ACH1] = 4, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c index 10b20531461ea2..92d2cd6288e713 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c @@ -12,6 +12,9 @@ static const struct rtw89_usb_info rtw8852b_usb_info = { .usb_host_request_2 = R_AX_USB_HOST_REQUEST_2, .usb_wlan0_1 = R_AX_USB_WLAN0_1, .hci_func_en = R_AX_HCI_FUNC_EN, + .usb3_mac_npi_config_intf_0 = R_AX_USB3_MAC_NPI_CONFIG_INTF_0, + .usb_endpoint_0 = R_AX_USB_ENDPOINT_0, + .usb_endpoint_2 = R_AX_USB_ENDPOINT_2, .bulkout_id = { [RTW89_DMA_ACH0] = 3, [RTW89_DMA_ACH1] = 4, diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index 175dca8cc60363..88f5b69073981b 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -709,10 +709,11 @@ static int rtw89_usb_ops_mac_pre_deinit(struct rtw89_dev *rtwdev) static int rtw89_usb_ops_mac_post_init(struct rtw89_dev *rtwdev) { struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + const struct rtw89_usb_info *info = rtwusb->info; enum usb_device_speed speed; u32 ep; - rtw89_write32_clr(rtwdev, R_AX_USB3_MAC_NPI_CONFIG_INTF_0, + rtw89_write32_clr(rtwdev, info->usb3_mac_npi_config_intf_0, B_AX_SSPHY_LFPS_FILTER); speed = rtwusb->udev->speed; @@ -728,9 +729,9 @@ static int rtw89_usb_ops_mac_post_init(struct rtw89_dev *rtwdev) if (ep == 8) continue; - rtw89_write8_mask(rtwdev, R_AX_USB_ENDPOINT_0, + rtw89_write8_mask(rtwdev, info->usb_endpoint_0, B_AX_EP_IDX, ep); - rtw89_write8(rtwdev, R_AX_USB_ENDPOINT_2 + 1, NUMP); + rtw89_write8(rtwdev, info->usb_endpoint_2 + 1, NUMP); } return 0; diff --git a/drivers/net/wireless/realtek/rtw89/usb.h b/drivers/net/wireless/realtek/rtw89/usb.h index be3a9fbe42c0bc..32cdbf5128e456 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.h +++ b/drivers/net/wireless/realtek/rtw89/usb.h @@ -24,6 +24,9 @@ struct rtw89_usb_info { u32 usb_host_request_2; u32 usb_wlan0_1; u32 hci_func_en; + u32 usb3_mac_npi_config_intf_0; + u32 usb_endpoint_0; + u32 usb_endpoint_2; u8 bulkout_id[RTW89_DMA_CH_NUM]; }; From 9e7e8ee438baea97d0ab957f83ed9a85347ff50f Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Sat, 1 Nov 2025 21:24:05 +0200 Subject: [PATCH 05/25] wifi: rtw89: Fix rtw89_mac_dmac_func_pre_en_ax() for USB/SDIO commit 32e0381e86031d0289b98e82a7a872ed1698676d upstream. Set the DMA mode according to the interface type. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/d2250e72-0aa1-422c-8f7f-9aeb283ca376@gmail.com --- drivers/net/wireless/realtek/rtw89/mac.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c index f0773f7c3749ac..0b469660d22790 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.c +++ b/drivers/net/wireless/realtek/rtw89/mac.c @@ -3985,8 +3985,15 @@ static void rtw89_mac_dmac_func_pre_en_ax(struct rtw89_dev *rtwdev) val = rtw89_read32(rtwdev, R_AX_HAXI_INIT_CFG1); val &= ~(B_AX_DMA_MODE_MASK | B_AX_STOP_AXI_MST); - val |= FIELD_PREP(B_AX_DMA_MODE_MASK, DMA_MOD_PCIE_1B) | - B_AX_TXHCI_EN_V1 | B_AX_RXHCI_EN_V1; + val |= B_AX_TXHCI_EN_V1 | B_AX_RXHCI_EN_V1; + + if (rtwdev->hci.type == RTW89_HCI_TYPE_PCIE) + val |= FIELD_PREP(B_AX_DMA_MODE_MASK, DMA_MOD_PCIE_1B); + else if (rtwdev->hci.type == RTW89_HCI_TYPE_USB) + val |= FIELD_PREP(B_AX_DMA_MODE_MASK, DMA_MOD_USB); + else + val |= FIELD_PREP(B_AX_DMA_MODE_MASK, DMA_MOD_SDIO); + rtw89_write32(rtwdev, R_AX_HAXI_INIT_CFG1, val); rtw89_write32_clr(rtwdev, R_AX_HAXI_DMA_STOP1, From 3056b67cf7c7afbc46bf5020037f8233093b25f8 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:10 +0300 Subject: [PATCH 06/25] wifi: rtw89: usb: use ieee80211_free_txskb() where appropriate commit 45a6a88f011fc57ba8518f4d032cc2b4f6543c12 upstream. rtw89_usb_ops_tx_kick_off() may need to release skb if a failure occurs. It operates mainly on skbs coming from the core wireless stack and the ones containing firmware commands. Use ieee80211_free_txskb() for the former case. Suggested-by: Ping-Ke Shih Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-4-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/usb.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index 88f5b69073981b..3afd3158571671 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -258,6 +258,15 @@ static int rtw89_usb_write_port(struct rtw89_dev *rtwdev, u8 ch_dma, return ret; } +static void rtw89_usb_tx_free_skb(struct rtw89_dev *rtwdev, u8 txch, + struct sk_buff *skb) +{ + if (txch == RTW89_TXCH_CH12) + dev_kfree_skb_any(skb); + else + ieee80211_free_txskb(rtwdev->hw, skb); +} + static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch) { struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); @@ -272,7 +281,7 @@ static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch) txcb = kmalloc(sizeof(*txcb), GFP_ATOMIC); if (!txcb) { - dev_kfree_skb_any(skb); + rtw89_usb_tx_free_skb(rtwdev, txch, skb); continue; } @@ -291,7 +300,7 @@ static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch) skb_dequeue(&txcb->tx_ack_queue); kfree(txcb); - dev_kfree_skb_any(skb); + rtw89_usb_tx_free_skb(rtwdev, txch, skb); } } } From 87aecbd344aab66b02c36cf6f435b5b4289d62a1 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:11 +0300 Subject: [PATCH 07/25] wifi: rtw89: refine rtw89_core_tx_wait_complete() commit 8986bafb0945821b7fc160780074d39eae5f7247 upstream. Pass TX status value directly into rtw89_core_tx_wait_complete(). This will make it a bit in sync with further patches and will give flexibility in future work. Also use scope based RCU locking which simplifies the code of the function. Found by Linux Verification Center (linuxtesting.org). Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-5-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/core.h | 20 ++++++++++---------- drivers/net/wireless/realtek/rtw89/pci.c | 2 +- drivers/net/wireless/realtek/rtw89/pci.h | 4 ---- 3 files changed, 11 insertions(+), 15 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 15aaed5c38c892..08b61fec1ba465 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -3510,6 +3510,11 @@ struct rtw89_phy_rate_pattern { bool enable; }; +#define RTW89_TX_DONE 0x0 +#define RTW89_TX_RETRY_LIMIT 0x1 +#define RTW89_TX_LIFE_TIME 0x2 +#define RTW89_TX_MACID_DROP 0x3 + #define RTW89_TX_WAIT_WORK_TIMEOUT msecs_to_jiffies(500) struct rtw89_tx_wait_info { struct rcu_head rcu_head; @@ -7396,25 +7401,20 @@ static inline struct sk_buff *rtw89_alloc_skb_for_rx(struct rtw89_dev *rtwdev, static inline bool rtw89_core_tx_wait_complete(struct rtw89_dev *rtwdev, struct rtw89_tx_skb_data *skb_data, - bool tx_done) + u8 tx_status) { struct rtw89_tx_wait_info *wait; - bool ret = false; - rcu_read_lock(); + guard(rcu)(); wait = rcu_dereference(skb_data->wait); if (!wait) - goto out; + return false; - ret = true; - wait->tx_done = tx_done; + wait->tx_done = tx_status == RTW89_TX_DONE; /* Don't access skb anymore after completion */ complete_all(&wait->completion); - -out: - rcu_read_unlock(); - return ret; + return true; } static inline bool rtw89_is_mlo_1_1(struct rtw89_dev *rtwdev) diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c index 364278a71e87dd..c2a4c048a6de68 100644 --- a/drivers/net/wireless/realtek/rtw89/pci.c +++ b/drivers/net/wireless/realtek/rtw89/pci.c @@ -464,7 +464,7 @@ static void rtw89_pci_tx_status(struct rtw89_dev *rtwdev, struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb); struct ieee80211_tx_info *info; - if (rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE)) + if (rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status)) return; info = IEEE80211_SKB_CB(skb); diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h index 09fca0e46cd1b0..872e05b5eb2f26 100644 --- a/drivers/net/wireless/realtek/rtw89/pci.h +++ b/drivers/net/wireless/realtek/rtw89/pci.h @@ -1487,10 +1487,6 @@ struct rtw89_pci_tx_addr_info_32_v1 { #define RTW89_PCI_RPP_POLLUTED BIT(31) #define RTW89_PCI_RPP_SEQ GENMASK(30, 16) #define RTW89_PCI_RPP_TX_STATUS GENMASK(15, 13) -#define RTW89_TX_DONE 0x0 -#define RTW89_TX_RETRY_LIMIT 0x1 -#define RTW89_TX_LIFE_TIME 0x2 -#define RTW89_TX_MACID_DROP 0x3 #define RTW89_PCI_RPP_QSEL GENMASK(12, 8) #define RTW89_PCI_RPP_MACID GENMASK(7, 0) From 46f9d82956e3d8e9fda3657ac73284f8026e5480 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:12 +0300 Subject: [PATCH 08/25] wifi: rtw89: implement C2H TX report handler commit c33c6a1b6f72ae48570530a271c68131c17abdbb upstream. rtw89 has several ways of handling TX status report events. The first one is based on RPP feature which is used by PCIe HCI. The other one depends on firmware sending a corresponding C2H message, quite similar to what rtw88 has. Toggle a bit in the TX descriptor to indicate to the firmware that TX report for the frame is expected. This will allow handling TX wait skbs and the ones flagged with IEEE80211_TX_CTL_REQ_TX_STATUS correctly. Do the bulk of the patch according to the vendor driver for RTL8851BU. However, there are slight differences in C2H message format between different types of chips. RTL885xB ones follow format V0. RTL8852C has format V1, and RTL8922AU has format V2. Found by Linux Verification Center (linuxtesting.org). Suggested-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-6-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/core.c | 28 +++++++++++--- drivers/net/wireless/realtek/rtw89/core.h | 4 ++ drivers/net/wireless/realtek/rtw89/fw.h | 41 ++++++++++++++++++++ drivers/net/wireless/realtek/rtw89/mac.c | 46 +++++++++++++++++++++++ drivers/net/wireless/realtek/rtw89/mac.h | 7 ++++ drivers/net/wireless/realtek/rtw89/txrx.h | 6 ++- 6 files changed, 126 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 0b3467a2027d6e..e2d5b3f1b9ca5d 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -1419,7 +1419,10 @@ static __le32 rtw89_build_txwd_info1(struct rtw89_tx_desc_info *desc_info) u32 dword = FIELD_PREP(RTW89_TXWD_INFO1_MAX_AGGNUM, desc_info->ampdu_num) | FIELD_PREP(RTW89_TXWD_INFO1_A_CTRL_BSR, desc_info->a_ctrl_bsr) | FIELD_PREP(RTW89_TXWD_INFO1_DATA_RTY_LOWEST_RATE, - desc_info->data_retry_lowest_rate); + desc_info->data_retry_lowest_rate) | + FIELD_PREP(RTW89_TXWD_INFO1_DATA_TXCNT_LMT_SEL, + desc_info->tx_cnt_lmt_en) | + FIELD_PREP(RTW89_TXWD_INFO1_DATA_TXCNT_LMT, desc_info->tx_cnt_lmt); return cpu_to_le32(dword); } @@ -1443,11 +1446,19 @@ static __le32 rtw89_build_txwd_info2_v1(struct rtw89_tx_desc_info *desc_info) return cpu_to_le32(dword); } +static __le32 rtw89_build_txwd_info3(struct rtw89_tx_desc_info *desc_info) +{ + u32 dword = FIELD_PREP(RTW89_TXWD_INFO3_SPE_RPT, desc_info->report); + + return cpu_to_le32(dword); +} + static __le32 rtw89_build_txwd_info4(struct rtw89_tx_desc_info *desc_info) { bool rts_en = !desc_info->is_bmc; u32 dword = FIELD_PREP(RTW89_TXWD_INFO4_RTS_EN, rts_en) | - FIELD_PREP(RTW89_TXWD_INFO4_HW_RTS_EN, 1); + FIELD_PREP(RTW89_TXWD_INFO4_HW_RTS_EN, 1) | + FIELD_PREP(RTW89_TXWD_INFO4_SW_DEFINE, desc_info->sn); return cpu_to_le32(dword); } @@ -1470,6 +1481,7 @@ void rtw89_core_fill_txdesc(struct rtw89_dev *rtwdev, txwd_info->dword0 = rtw89_build_txwd_info0(desc_info); txwd_info->dword1 = rtw89_build_txwd_info1(desc_info); txwd_info->dword2 = rtw89_build_txwd_info2(desc_info); + txwd_info->dword3 = rtw89_build_txwd_info3(desc_info); txwd_info->dword4 = rtw89_build_txwd_info4(desc_info); } @@ -1499,6 +1511,7 @@ void rtw89_core_fill_txdesc_v1(struct rtw89_dev *rtwdev, txwd_info->dword0 = rtw89_build_txwd_info0_v1(desc_info); txwd_info->dword1 = rtw89_build_txwd_info1(desc_info); txwd_info->dword2 = rtw89_build_txwd_info2_v1(desc_info); + txwd_info->dword3 = rtw89_build_txwd_info3(desc_info); txwd_info->dword4 = rtw89_build_txwd_info4(desc_info); } EXPORT_SYMBOL(rtw89_core_fill_txdesc_v1); @@ -1584,7 +1597,10 @@ static __le32 rtw89_build_txwd_info0_v2(struct rtw89_tx_desc_info *desc_info) u32 dword = FIELD_PREP(BE_TXD_INFO0_DATA_STBC, desc_info->stbc) | FIELD_PREP(BE_TXD_INFO0_DATA_LDPC, desc_info->ldpc) | FIELD_PREP(BE_TXD_INFO0_DISDATAFB, desc_info->dis_data_fb) | - FIELD_PREP(BE_TXD_INFO0_MULTIPORT_ID, desc_info->port); + FIELD_PREP(BE_TXD_INFO0_MULTIPORT_ID, desc_info->port) | + FIELD_PREP(BE_TXD_INFO0_DATA_TXCNT_LMT_SEL, + desc_info->tx_cnt_lmt_en) | + FIELD_PREP(BE_TXD_INFO0_DATA_TXCNT_LMT, desc_info->tx_cnt_lmt); return cpu_to_le32(dword); } @@ -1594,7 +1610,8 @@ static __le32 rtw89_build_txwd_info1_v2(struct rtw89_tx_desc_info *desc_info) u32 dword = FIELD_PREP(BE_TXD_INFO1_MAX_AGG_NUM, desc_info->ampdu_num) | FIELD_PREP(BE_TXD_INFO1_A_CTRL_BSR, desc_info->a_ctrl_bsr) | FIELD_PREP(BE_TXD_INFO1_DATA_RTY_LOWEST_RATE, - desc_info->data_retry_lowest_rate); + desc_info->data_retry_lowest_rate) | + FIELD_PREP(BE_TXD_INFO1_SW_DEFINE, desc_info->sn); return cpu_to_le32(dword); } @@ -1603,7 +1620,8 @@ static __le32 rtw89_build_txwd_info2_v2(struct rtw89_tx_desc_info *desc_info) { u32 dword = FIELD_PREP(BE_TXD_INFO2_AMPDU_DENSITY, desc_info->ampdu_density) | FIELD_PREP(BE_TXD_INFO2_FORCE_KEY_EN, desc_info->sec_en) | - FIELD_PREP(BE_TXD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx); + FIELD_PREP(BE_TXD_INFO2_SEC_CAM_IDX, desc_info->sec_cam_idx) | + FIELD_PREP(BE_TXD_INFO2_SPE_RPT_V1, desc_info->report); return cpu_to_le32(dword); } diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 08b61fec1ba465..d308422b9bf542 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -1170,6 +1170,10 @@ struct rtw89_tx_desc_info { u8 ampdu_density; u8 ampdu_num; bool sec_en; + bool report; + bool tx_cnt_lmt_en; + u8 sn: 4; + u8 tx_cnt_lmt: 6; u8 addr_info_nr; u8 sec_keyid; u8 sec_type; diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h index 98078a3ef89e69..3d8a2b1f7c2810 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.h +++ b/drivers/net/wireless/realtek/rtw89/fw.h @@ -3751,6 +3751,47 @@ struct rtw89_c2h_scanofld { #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_FUNC(c2h) \ le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) +struct rtw89_c2h_mac_tx_rpt { + struct rtw89_c2h_hdr hdr; + __le32 w2; + __le32 w3; + __le32 w4; + __le32 w5; + __le32 w6; + __le32 w7; +} __packed; + +#define RTW89_C2H_MAC_TX_RPT_W2_TX_STATE GENMASK(7, 6) +#define RTW89_C2H_MAC_TX_RPT_W2_SW_DEFINE GENMASK(11, 8) +#define RTW89_C2H_MAC_TX_RPT_W5_DATA_TX_CNT GENMASK(13, 8) +#define RTW89_C2H_MAC_TX_RPT_W5_DATA_TX_CNT_V1 GENMASK(15, 10) + +struct rtw89_c2h_mac_tx_rpt_v2 { + struct rtw89_c2h_hdr hdr; + __le32 w2; + __le32 w3; + __le32 w4; + __le32 w5; + __le32 w6; + __le32 w7; + __le32 w8; + __le32 w9; + __le32 w10; + __le32 w11; + __le32 w12; + __le32 w13; + __le32 w14; + __le32 w15; + __le32 w16; + __le32 w17; + __le32 w18; + __le32 w19; +} __packed; + +#define RTW89_C2H_MAC_TX_RPT_W12_TX_STATE_V2 GENMASK(9, 8) +#define RTW89_C2H_MAC_TX_RPT_W12_SW_DEFINE_V2 GENMASK(15, 12) +#define RTW89_C2H_MAC_TX_RPT_W14_DATA_TX_CNT_V2 GENMASK(15, 10) + struct rtw89_mac_mcc_tsf_rpt { u32 macid_x; u32 macid_y; diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c index 0b469660d22790..c35d9ff203e60c 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.c +++ b/drivers/net/wireless/realtek/rtw89/mac.c @@ -5481,6 +5481,40 @@ rtw89_mac_c2h_mcc_status_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 rtw89_complete_cond(&rtwdev->mcc.wait, cond, &data); } +static void +rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len) +{ + u8 sw_define, tx_status, txcnt; + + if (rtwdev->chip->chip_id == RTL8922A) { + const struct rtw89_c2h_mac_tx_rpt_v2 *rpt_v2; + + rpt_v2 = (const struct rtw89_c2h_mac_tx_rpt_v2 *)c2h->data; + sw_define = le32_get_bits(rpt_v2->w12, + RTW89_C2H_MAC_TX_RPT_W12_SW_DEFINE_V2); + tx_status = le32_get_bits(rpt_v2->w12, + RTW89_C2H_MAC_TX_RPT_W12_TX_STATE_V2); + txcnt = le32_get_bits(rpt_v2->w14, + RTW89_C2H_MAC_TX_RPT_W14_DATA_TX_CNT_V2); + } else { + const struct rtw89_c2h_mac_tx_rpt *rpt; + + rpt = (const struct rtw89_c2h_mac_tx_rpt *)c2h->data; + sw_define = le32_get_bits(rpt->w2, RTW89_C2H_MAC_TX_RPT_W2_SW_DEFINE); + tx_status = le32_get_bits(rpt->w2, RTW89_C2H_MAC_TX_RPT_W2_TX_STATE); + if (rtwdev->chip->chip_id == RTL8852C) + txcnt = le32_get_bits(rpt->w5, + RTW89_C2H_MAC_TX_RPT_W5_DATA_TX_CNT_V1); + else + txcnt = le32_get_bits(rpt->w5, + RTW89_C2H_MAC_TX_RPT_W5_DATA_TX_CNT); + } + + rtw89_debug(rtwdev, RTW89_DBG_TXRX, + "C2H TX RPT: sn %d, tx_status %d, txcnt %d\n", + sw_define, tx_status, txcnt); +} + static void rtw89_mac_c2h_mrc_tsf_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len) { @@ -5715,6 +5749,12 @@ void (* const rtw89_mac_c2h_mcc_handler[])(struct rtw89_dev *rtwdev, [RTW89_MAC_C2H_FUNC_MCC_STATUS_RPT] = rtw89_mac_c2h_mcc_status_rpt, }; +static +void (* const rtw89_mac_c2h_misc_handler[])(struct rtw89_dev *rtwdev, + struct sk_buff *c2h, u32 len) = { + [RTW89_MAC_C2H_FUNC_TX_REPORT] = rtw89_mac_c2h_tx_rpt, +}; + static void (* const rtw89_mac_c2h_mlo_handler[])(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len) = { @@ -5801,6 +5841,8 @@ bool rtw89_mac_c2h_chk_atomic(struct rtw89_dev *rtwdev, struct sk_buff *c2h, } case RTW89_MAC_C2H_CLASS_MCC: return true; + case RTW89_MAC_C2H_CLASS_MISC: + return true; case RTW89_MAC_C2H_CLASS_MLO: return true; case RTW89_MAC_C2H_CLASS_MRC: @@ -5836,6 +5878,10 @@ void rtw89_mac_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb, if (func < NUM_OF_RTW89_MAC_C2H_FUNC_MCC) handler = rtw89_mac_c2h_mcc_handler[func]; break; + case RTW89_MAC_C2H_CLASS_MISC: + if (func < NUM_OF_RTW89_MAC_C2H_FUNC_MISC) + handler = rtw89_mac_c2h_misc_handler[func]; + break; case RTW89_MAC_C2H_CLASS_MLO: if (func < NUM_OF_RTW89_MAC_C2H_FUNC_MLO) handler = rtw89_mac_c2h_mlo_handler[func]; diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h index 1ac1d0cd795945..dc19fb23d82da6 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.h +++ b/drivers/net/wireless/realtek/rtw89/mac.h @@ -432,6 +432,12 @@ enum rtw89_mac_c2h_mcc_func { NUM_OF_RTW89_MAC_C2H_FUNC_MCC, }; +enum rtw89_mac_c2h_misc_func { + RTW89_MAC_C2H_FUNC_TX_REPORT = 1, + + NUM_OF_RTW89_MAC_C2H_FUNC_MISC, +}; + enum rtw89_mac_c2h_mlo_func { RTW89_MAC_C2H_FUNC_MLO_GET_TBL = 0x0, RTW89_MAC_C2H_FUNC_MLO_EMLSR_TRANS_DONE = 0x1, @@ -470,6 +476,7 @@ enum rtw89_mac_c2h_class { RTW89_MAC_C2H_CLASS_WOW = 0x3, RTW89_MAC_C2H_CLASS_MCC = 0x4, RTW89_MAC_C2H_CLASS_FWDBG = 0x5, + RTW89_MAC_C2H_CLASS_MISC = 0x9, RTW89_MAC_C2H_CLASS_MLO = 0xc, RTW89_MAC_C2H_CLASS_MRC = 0xe, RTW89_MAC_C2H_CLASS_AP = 0x18, diff --git a/drivers/net/wireless/realtek/rtw89/txrx.h b/drivers/net/wireless/realtek/rtw89/txrx.h index 984c9fdbb018b2..b37dbac7b79086 100644 --- a/drivers/net/wireless/realtek/rtw89/txrx.h +++ b/drivers/net/wireless/realtek/rtw89/txrx.h @@ -127,6 +127,8 @@ static inline u8 rtw89_get_data_nss(struct rtw89_dev *rtwdev, u16 hw_rate) #define RTW89_TXWD_INFO0_MULTIPORT_ID GENMASK(6, 4) /* TX WD INFO DWORD 1 */ +#define RTW89_TXWD_INFO1_DATA_TXCNT_LMT_SEL BIT(31) +#define RTW89_TXWD_INFO1_DATA_TXCNT_LMT GENMASK(30, 25) #define RTW89_TXWD_INFO1_DATA_RTY_LOWEST_RATE GENMASK(24, 16) #define RTW89_TXWD_INFO1_A_CTRL_BSR BIT(14) #define RTW89_TXWD_INFO1_MAX_AGGNUM GENMASK(7, 0) @@ -139,10 +141,12 @@ static inline u8 rtw89_get_data_nss(struct rtw89_dev *rtwdev, u16 hw_rate) #define RTW89_TXWD_INFO2_SEC_CAM_IDX GENMASK(7, 0) /* TX WD INFO DWORD 3 */ +#define RTW89_TXWD_INFO3_SPE_RPT BIT(10) /* TX WD INFO DWORD 4 */ -#define RTW89_TXWD_INFO4_RTS_EN BIT(27) #define RTW89_TXWD_INFO4_HW_RTS_EN BIT(31) +#define RTW89_TXWD_INFO4_RTS_EN BIT(27) +#define RTW89_TXWD_INFO4_SW_DEFINE GENMASK(3, 0) /* TX WD INFO DWORD 5 */ From 1fb2f036f72537dd69f7a6889f0c35a4d94de477 Mon Sep 17 00:00:00 2001 From: Ping-Ke Shih Date: Tue, 4 Nov 2025 16:57:13 +0300 Subject: [PATCH 09/25] wifi: rtw89: fill TX descriptor of FWCMD in shortcut commit 21b946104087cd48e16ea51903c421cc3962225b upstream. TX type FWCMD is used to download firmware and send H2C commands, and it only fill few fields of TX description, such as desc_info->pkt_size. Therefore, early return the TX type FWCMD. Signed-off-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20251104135720.321110-7-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/core.c | 26 ++++++++++++----------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index e2d5b3f1b9ca5d..023ba607241567 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -1110,32 +1110,35 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev, struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); struct ieee80211_hdr *hdr = (void *)skb->data; struct rtw89_addr_cam_entry *addr_cam; - enum rtw89_core_tx_type tx_type; enum btc_pkt_type pkt_type; bool upd_wlan_hdr = false; bool is_bmc; u16 seq; + desc_info->pkt_size = skb->len; + + if (unlikely(tx_req->tx_type == RTW89_CORE_TX_TYPE_FWCMD)) { + rtw89_core_tx_update_h2c_info(rtwdev, tx_req); + return; + } + + tx_req->tx_type = rtw89_core_get_tx_type(rtwdev, skb); + if (tx_req->sta) desc_info->mlo = tx_req->sta->mlo; else if (tx_req->vif) desc_info->mlo = ieee80211_vif_is_mld(tx_req->vif); seq = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4; - if (tx_req->tx_type != RTW89_CORE_TX_TYPE_FWCMD) { - tx_type = rtw89_core_get_tx_type(rtwdev, skb); - tx_req->tx_type = tx_type; + addr_cam = rtw89_get_addr_cam_of(tx_req->rtwvif_link, + tx_req->rtwsta_link); + if (addr_cam->valid && desc_info->mlo) + upd_wlan_hdr = true; - addr_cam = rtw89_get_addr_cam_of(tx_req->rtwvif_link, - tx_req->rtwsta_link); - if (addr_cam->valid && desc_info->mlo) - upd_wlan_hdr = true; - } is_bmc = (is_broadcast_ether_addr(hdr->addr1) || is_multicast_ether_addr(hdr->addr1)); desc_info->seq = seq; - desc_info->pkt_size = skb->len; desc_info->is_bmc = is_bmc; desc_info->wd_page = true; desc_info->hiq = info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM; @@ -1152,8 +1155,7 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev, rtw89_core_tx_update_ampdu_info(rtwdev, tx_req, pkt_type); rtw89_core_tx_update_llc_hdr(rtwdev, desc_info, skb); break; - case RTW89_CORE_TX_TYPE_FWCMD: - rtw89_core_tx_update_h2c_info(rtwdev, tx_req); + default: break; } } From cc79e63e1928bc6e4e034db726cfae2badffaa6c Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:14 +0300 Subject: [PATCH 10/25] wifi: rtw89: usb: anchor TX URBs commit 26a42d804aa89f6e62be68126114a4b62a8fe713 upstream. During HCI reset all pending TX URBs should be canceled. Use anchor to keep track of them and have an ability to cancel them synchronously. Note however that canceling RX URBs can't be done here in rtw89_usb_ops_reset() as it breaks driver initialization. Found by Linux Verification Center (linuxtesting.org). Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-8-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/usb.c | 24 ++++++++++++++++++++---- drivers/net/wireless/realtek/rtw89/usb.h | 1 + 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index 3afd3158571671..f56941ca4b01a5 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -221,7 +221,6 @@ static void rtw89_usb_write_port_complete(struct urb *urb) } kfree(txcb); - usb_free_urb(urb); } static int rtw89_usb_write_port(struct rtw89_dev *rtwdev, u8 ch_dma, @@ -247,10 +246,17 @@ static int rtw89_usb_write_port(struct rtw89_dev *rtwdev, u8 ch_dma, usb_fill_bulk_urb(urb, usbd, pipe, data, len, rtw89_usb_write_port_complete, context); urb->transfer_flags |= URB_ZERO_PACKET; - ret = usb_submit_urb(urb, GFP_ATOMIC); + usb_anchor_urb(urb, &rtwusb->tx_submitted); + ret = usb_submit_urb(urb, GFP_ATOMIC); if (ret) - usb_free_urb(urb); + usb_unanchor_urb(urb); + + /* release our reference to this URB, USB core will eventually free it + * on its own after the completion callback finishes (or URB is + * immediately freed here if its submission has failed) + */ + usb_free_urb(urb); if (ret == -ENODEV) set_bit(RTW89_FLAG_UNPLUGGED, rtwdev->flags); @@ -557,6 +563,11 @@ static void rtw89_usb_cancel_rx_bufs(struct rtw89_usb *rtwusb) } } +static void rtw89_usb_cancel_tx_bufs(struct rtw89_usb *rtwusb) +{ + usb_kill_anchored_urbs(&rtwusb->tx_submitted); +} + static void rtw89_usb_free_rx_bufs(struct rtw89_usb *rtwusb) { struct rtw89_usb_rx_ctrl_block *rxcb; @@ -658,7 +669,9 @@ static void rtw89_usb_deinit_tx(struct rtw89_dev *rtwdev) static void rtw89_usb_ops_reset(struct rtw89_dev *rtwdev) { - /* TODO: anything to do here? */ + struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + + rtw89_usb_cancel_tx_bufs(rtwusb); } static int rtw89_usb_ops_start(struct rtw89_dev *rtwdev) @@ -895,6 +908,8 @@ static int rtw89_usb_intf_init(struct rtw89_dev *rtwdev, struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); int ret; + init_usb_anchor(&rtwusb->tx_submitted); + ret = rtw89_usb_parse(rtwdev, intf); if (ret) return ret; @@ -1021,6 +1036,7 @@ void rtw89_usb_disconnect(struct usb_interface *intf) rtwusb = rtw89_usb_priv(rtwdev); rtw89_usb_cancel_rx_bufs(rtwusb); + rtw89_usb_cancel_tx_bufs(rtwusb); rtw89_core_unregister(rtwdev); rtw89_core_deinit(rtwdev); diff --git a/drivers/net/wireless/realtek/rtw89/usb.h b/drivers/net/wireless/realtek/rtw89/usb.h index 32cdbf5128e456..203ec8e993e9ff 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.h +++ b/drivers/net/wireless/realtek/rtw89/usb.h @@ -60,6 +60,7 @@ struct rtw89_usb { struct sk_buff_head rx_free_queue; struct work_struct rx_work; struct work_struct rx_urb_work; + struct usb_anchor tx_submitted; struct sk_buff_head tx_queue[RTW89_TXCH_NUM]; }; From 7d5371cb3d206a0bb1fe8a7c1481c32172427166 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:15 +0300 Subject: [PATCH 11/25] wifi: rtw89: handle IEEE80211_TX_CTL_REQ_TX_STATUS frames for USB commit 816e849ef83aaf989035545d4a927b50a3d03525 upstream. Frames flagged with IEEE80211_TX_CTL_REQ_TX_STATUS mean the driver has to report to mac80211 stack whether AP sent ACK for the null frame/probe request or not. It's not implemented in USB part of the driver yet. PCIe HCI has its own way of getting TX status incorporated into RPP feature, and it's always enabled there. Other HCIs need a different scheme based on processing C2H messages. Thus define a .tx_rpt_enabled flag indicating which HCIs need to enable a TX report feature. Currently it is USB only. Toggle a bit in the TX descriptor and place flagged skbs in a fix-sized queue to wait for a message from the firmware. Firmware maintains a 4-bit sequence number for required frames hence the queue can contain just 16 elements simultaneously. That's enough for normal driver / firmware communication. If the firmware crashes for any reason and doesn't provide TX reports in time, driver will handle this and report the obsolete frames as dropped. rtw89 also has a new feature providing a TX report for each transmission attempt. Ignore a failed TX status reported by the firmware until retry limit is reached or successful status appears. When there is no success and the retry limit is reached, report the frame up to the wireless stack as failed eventually. HCI reset should stop all pending TX activity so forcefully flush the queue there. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-9-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/core.c | 4 ++ drivers/net/wireless/realtek/rtw89/core.h | 14 ++++ drivers/net/wireless/realtek/rtw89/mac.c | 32 +++++++++ drivers/net/wireless/realtek/rtw89/mac.h | 81 +++++++++++++++++++++++ drivers/net/wireless/realtek/rtw89/usb.c | 18 +++++ 5 files changed, 149 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 023ba607241567..223d56852c0f69 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -1135,6 +1135,9 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev, if (addr_cam->valid && desc_info->mlo) upd_wlan_hdr = true; + if (rtw89_is_tx_rpt_skb(tx_req->skb)) + rtw89_tx_rpt_init(rtwdev, tx_req); + is_bmc = (is_broadcast_ether_addr(hdr->addr1) || is_multicast_ether_addr(hdr->addr1)); @@ -5888,6 +5891,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) wiphy_work_init(&rtwdev->cancel_6ghz_probe_work, rtw89_cancel_6ghz_probe_work); INIT_WORK(&rtwdev->load_firmware_work, rtw89_load_firmware_work); + spin_lock_init(&rtwdev->tx_rpt.skb_lock); skb_queue_head_init(&rtwdev->c2h_queue); rtw89_core_ppdu_sts_init(rtwdev); rtw89_traffic_stats_init(rtwdev, &rtwdev->stats); diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index d308422b9bf542..725a942ed38ba4 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -3519,6 +3519,15 @@ struct rtw89_phy_rate_pattern { #define RTW89_TX_LIFE_TIME 0x2 #define RTW89_TX_MACID_DROP 0x3 +#define RTW89_MAX_TX_RPTS 16 +#define RTW89_MAX_TX_RPTS_MASK (RTW89_MAX_TX_RPTS - 1) +struct rtw89_tx_rpt { + struct sk_buff *skbs[RTW89_MAX_TX_RPTS]; + /* protect skbs array access/modification */ + spinlock_t skb_lock; + atomic_t sn; +}; + #define RTW89_TX_WAIT_WORK_TIMEOUT msecs_to_jiffies(500) struct rtw89_tx_wait_info { struct rcu_head rcu_head; @@ -3530,6 +3539,8 @@ struct rtw89_tx_wait_info { struct rtw89_tx_skb_data { struct rtw89_tx_wait_info __rcu *wait; + u8 tx_rpt_sn; + u8 tx_pkt_cnt_lmt; u8 hci_priv[]; }; @@ -3701,6 +3712,7 @@ struct rtw89_hci_info { u32 rpwm_addr; u32 cpwm_addr; bool paused; + bool tx_rpt_enabled; }; struct rtw89_chip_ops { @@ -6022,6 +6034,8 @@ struct rtw89_dev { struct list_head tx_waits; struct wiphy_delayed_work tx_wait_work; + struct rtw89_tx_rpt tx_rpt; + struct rtw89_cam_info cam_info; struct sk_buff_head c2h_queue; diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c index c35d9ff203e60c..b416052f2ca520 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.c +++ b/drivers/net/wireless/realtek/rtw89/mac.c @@ -5484,7 +5484,10 @@ rtw89_mac_c2h_mcc_status_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 static void rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len) { + struct rtw89_tx_rpt *tx_rpt = &rtwdev->tx_rpt; + struct rtw89_tx_skb_data *skb_data; u8 sw_define, tx_status, txcnt; + struct sk_buff *skb; if (rtwdev->chip->chip_id == RTL8922A) { const struct rtw89_c2h_mac_tx_rpt_v2 *rpt_v2; @@ -5513,6 +5516,35 @@ rtw89_mac_c2h_tx_rpt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len) rtw89_debug(rtwdev, RTW89_DBG_TXRX, "C2H TX RPT: sn %d, tx_status %d, txcnt %d\n", sw_define, tx_status, txcnt); + + /* claim sw_define is not over size of tx_rpt->skbs[] */ + static_assert(hweight32(RTW89_MAX_TX_RPTS_MASK) == + hweight32(RTW89_C2H_MAC_TX_RPT_W12_SW_DEFINE_V2) && + hweight32(RTW89_MAX_TX_RPTS_MASK) == + hweight32(RTW89_C2H_MAC_TX_RPT_W2_SW_DEFINE)); + + scoped_guard(spinlock_irqsave, &tx_rpt->skb_lock) { + skb = tx_rpt->skbs[sw_define]; + + /* skip if no skb (normally shouldn't happen) */ + if (!skb) { + rtw89_debug(rtwdev, RTW89_DBG_TXRX, + "C2H TX RPT: no skb found in queue\n"); + return; + } + + skb_data = RTW89_TX_SKB_CB(skb); + + /* skip if TX attempt has failed and retry limit has not been + * reached yet + */ + if (tx_status != RTW89_TX_DONE && + txcnt != skb_data->tx_pkt_cnt_lmt) + return; + + tx_rpt->skbs[sw_define] = NULL; + rtw89_tx_rpt_tx_status(rtwdev, skb, tx_status); + } } static void diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h index dc19fb23d82da6..3881c9ce6e03be 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.h +++ b/drivers/net/wireless/realtek/rtw89/mac.h @@ -1615,4 +1615,85 @@ int rtw89_mac_scan_offload(struct rtw89_dev *rtwdev, return ret; } + +static inline +void rtw89_tx_rpt_init(struct rtw89_dev *rtwdev, + struct rtw89_core_tx_request *tx_req) +{ + struct rtw89_tx_rpt *tx_rpt = &rtwdev->tx_rpt; + + if (!rtwdev->hci.tx_rpt_enabled) + return; + + tx_req->desc_info.report = true; + /* firmware maintains a 4-bit sequence number */ + tx_req->desc_info.sn = atomic_inc_return(&tx_rpt->sn) & + RTW89_MAX_TX_RPTS_MASK; + tx_req->desc_info.tx_cnt_lmt_en = true; + tx_req->desc_info.tx_cnt_lmt = 8; +} + +static inline +bool rtw89_is_tx_rpt_skb(struct sk_buff *skb) +{ + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + + return info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS; +} + +static inline +void rtw89_tx_rpt_tx_status(struct rtw89_dev *rtwdev, struct sk_buff *skb, + u8 tx_status) +{ + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + + ieee80211_tx_info_clear_status(info); + + if (tx_status == RTW89_TX_DONE) + info->flags |= IEEE80211_TX_STAT_ACK; + else + info->flags &= ~IEEE80211_TX_STAT_ACK; + + ieee80211_tx_status_irqsafe(rtwdev->hw, skb); +} + +static inline +void rtw89_tx_rpt_skb_add(struct rtw89_dev *rtwdev, struct sk_buff *skb) +{ + struct rtw89_tx_rpt *tx_rpt = &rtwdev->tx_rpt; + struct rtw89_tx_skb_data *skb_data; + u8 idx; + + skb_data = RTW89_TX_SKB_CB(skb); + idx = skb_data->tx_rpt_sn; + + scoped_guard(spinlock_irqsave, &tx_rpt->skb_lock) { + /* if skb having the similar seq number is still in the queue, + * this means the queue is overflowed - it isn't normal and + * should indicate firmware doesn't provide TX reports in time; + * report the old skb as dropped, we can't do much more here + */ + if (tx_rpt->skbs[idx]) + rtw89_tx_rpt_tx_status(rtwdev, tx_rpt->skbs[idx], + RTW89_TX_MACID_DROP); + tx_rpt->skbs[idx] = skb; + } +} + +static inline +void rtw89_tx_rpt_skbs_purge(struct rtw89_dev *rtwdev) +{ + struct rtw89_tx_rpt *tx_rpt = &rtwdev->tx_rpt; + struct sk_buff *skbs[RTW89_MAX_TX_RPTS]; + + scoped_guard(spinlock_irqsave, &tx_rpt->skb_lock) { + memcpy(skbs, tx_rpt->skbs, sizeof(tx_rpt->skbs)); + memset(tx_rpt->skbs, 0, sizeof(tx_rpt->skbs)); + } + + for (int i = 0; i < ARRAY_SIZE(skbs); i++) + if (skbs[i]) + rtw89_tx_rpt_tx_status(rtwdev, skbs[i], + RTW89_TX_MACID_DROP); +} #endif diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index f56941ca4b01a5..51e99002b6fa17 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -194,6 +194,15 @@ static void rtw89_usb_write_port_complete(struct urb *urb) skb_pull(skb, txdesc_size); + if (rtw89_is_tx_rpt_skb(skb)) { + if (urb->status == 0) + rtw89_tx_rpt_skb_add(rtwdev, skb); + else + rtw89_tx_rpt_tx_status(rtwdev, skb, + RTW89_TX_MACID_DROP); + continue; + } + info = IEEE80211_SKB_CB(skb); ieee80211_tx_info_clear_status(info); @@ -358,6 +367,7 @@ static int rtw89_usb_ops_tx_write(struct rtw89_dev *rtwdev, { struct rtw89_tx_desc_info *desc_info = &tx_req->desc_info; struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + struct rtw89_tx_skb_data *skb_data; struct sk_buff *skb = tx_req->skb; struct rtw89_txwd_body *txdesc; u32 txdesc_size; @@ -384,6 +394,12 @@ static int rtw89_usb_ops_tx_write(struct rtw89_dev *rtwdev, le32p_replace_bits(&txdesc->dword0, 1, RTW89_TXWD_BODY0_STF_MODE); + skb_data = RTW89_TX_SKB_CB(skb); + if (tx_req->desc_info.sn) + skb_data->tx_rpt_sn = tx_req->desc_info.sn; + if (tx_req->desc_info.tx_cnt_lmt) + skb_data->tx_pkt_cnt_lmt = tx_req->desc_info.tx_cnt_lmt; + skb_queue_tail(&rtwusb->tx_queue[desc_info->ch_dma], skb); return 0; @@ -672,6 +688,7 @@ static void rtw89_usb_ops_reset(struct rtw89_dev *rtwdev) struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); rtw89_usb_cancel_tx_bufs(rtwusb); + rtw89_tx_rpt_skbs_purge(rtwdev); } static int rtw89_usb_ops_start(struct rtw89_dev *rtwdev) @@ -962,6 +979,7 @@ int rtw89_usb_probe(struct usb_interface *intf, rtwdev->hci.ops = &rtw89_usb_ops; rtwdev->hci.type = RTW89_HCI_TYPE_USB; + rtwdev->hci.tx_rpt_enabled = true; ret = rtw89_usb_intf_init(rtwdev, intf); if (ret) { From 3547cf1d20b1e6faeabf869b47ee0836ead0d606 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:16 +0300 Subject: [PATCH 12/25] wifi: rtw89: provide TX reports for management frames commit cc7070e41786a51953f71e39a1e6e803a1ed2d50 upstream. In order to provide TX reports for the management queue rtw89 should configure the firmware. Do this with SET_CMC_TBL_MGQ_RPT_EN() for the WiFi6 chips and with CCTLINFO_G7_W0_MGQ_RPT_EN flag for the WiFi7 ones. Suggested-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-10-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/fw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index c6533a085c7fe7..e3506ae2d4edda 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3205,6 +3205,7 @@ int rtw89_fw_h2c_default_cmac_tbl(struct rtw89_dev *rtwdev, SET_CMC_TBL_ANTSEL_C(skb->data, 0); SET_CMC_TBL_ANTSEL_D(skb->data, 0); } + SET_CMC_TBL_MGQ_RPT_EN(skb->data, rtwdev->hci.tx_rpt_enabled); SET_CMC_TBL_DOPPLER_CTRL(skb->data, 0); SET_CMC_TBL_TXPWR_TOLERENCE(skb->data, 0); if (rtwvif_link->net_type == RTW89_NET_TYPE_AP_MODE) @@ -3250,7 +3251,8 @@ int rtw89_fw_h2c_default_cmac_tbl_g7(struct rtw89_dev *rtwdev, h2c->c0 = le32_encode_bits(mac_id, CCTLINFO_G7_C0_MACID) | le32_encode_bits(1, CCTLINFO_G7_C0_OP); - h2c->w0 = le32_encode_bits(4, CCTLINFO_G7_W0_DATARATE); + h2c->w0 = le32_encode_bits(4, CCTLINFO_G7_W0_DATARATE) | + le32_encode_bits(rtwdev->hci.tx_rpt_enabled, CCTLINFO_G7_W0_MGQ_RPT_EN); h2c->m0 = cpu_to_le32(CCTLINFO_G7_W0_ALL); h2c->w1 = le32_encode_bits(4, CCTLINFO_G7_W1_DATA_RTY_LOWEST_RATE) | From 252364cee2881003f8141c62d34539f72d89ed02 Mon Sep 17 00:00:00 2001 From: Fedor Pchelkin Date: Tue, 4 Nov 2025 16:57:17 +0300 Subject: [PATCH 13/25] wifi: rtw89: process TX wait skbs for USB via C2H handler commit d5da3d9fb05f6e2b2685c58b37067749b342b518 upstream. TX wait skbs need to be completed when they are done. PCIe part does this inside rtw89_pci_tx_status() during RPP processing. Other HCIs use a mechanism based on C2H firmware messages. Store TX wait skbs inside TX report queue so that it'll be possible to identify completed items inside the C2H handler. Try to do this as similar to PCIe path as possible. When the corresponding TX wait skb is found inside TX report queue, unlink it from there and call rtw89_core_tx_wait_complete() to mark the completion. If the callee waiting for the completion has already timed out, the TX wait skb is placed into TX wait list (like PCIe part does). It's important that during HCI reset all pending TX wait frames should be completed inside hci.ops->reset method before calling rtw89_tx_wait_list_clear(). Found by Linux Verification Center (linuxtesting.org). Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-11-pchelkin@ispras.ru --- drivers/net/wireless/realtek/rtw89/core.c | 5 ++--- drivers/net/wireless/realtek/rtw89/core.h | 7 +++++++ drivers/net/wireless/realtek/rtw89/mac.h | 13 ++++++++++--- drivers/net/wireless/realtek/rtw89/usb.c | 2 +- 4 files changed, 20 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 223d56852c0f69..84b7023a33bf5a 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -1135,7 +1135,7 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev, if (addr_cam->valid && desc_info->mlo) upd_wlan_hdr = true; - if (rtw89_is_tx_rpt_skb(tx_req->skb)) + if (rtw89_is_tx_rpt_skb(rtwdev, tx_req->skb)) rtw89_tx_rpt_init(rtwdev, tx_req); is_bmc = (is_broadcast_ether_addr(hdr->addr1) || @@ -1267,14 +1267,13 @@ static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev, tx_req.rtwvif_link = rtwvif_link; tx_req.rtwsta_link = rtwsta_link; tx_req.desc_info.sw_mld = sw_mld; + rcu_assign_pointer(skb_data->wait, wait); rtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true); rtw89_wow_parse_akm(rtwdev, skb); rtw89_core_tx_update_desc_info(rtwdev, &tx_req); rtw89_core_tx_wake(rtwdev, &tx_req); - rcu_assign_pointer(skb_data->wait, wait); - ret = rtw89_hci_tx_write(rtwdev, &tx_req); if (ret) { rtw89_err(rtwdev, "failed to transmit skb to HCI\n"); diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 725a942ed38ba4..4135e8ed64f053 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -6327,6 +6327,7 @@ static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev, static inline void rtw89_hci_reset(struct rtw89_dev *rtwdev) { rtwdev->hci.ops->reset(rtwdev); + /* hci.ops->reset must complete all pending TX wait SKBs */ rtw89_tx_wait_list_clear(rtwdev); } @@ -7417,6 +7418,12 @@ static inline struct sk_buff *rtw89_alloc_skb_for_rx(struct rtw89_dev *rtwdev, return dev_alloc_skb(length); } +static inline bool rtw89_core_is_tx_wait(struct rtw89_dev *rtwdev, + struct rtw89_tx_skb_data *skb_data) +{ + return rcu_access_pointer(skb_data->wait); +} + static inline bool rtw89_core_tx_wait_complete(struct rtw89_dev *rtwdev, struct rtw89_tx_skb_data *skb_data, u8 tx_status) diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h index 3881c9ce6e03be..c4bf8de02aa243 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.h +++ b/drivers/net/wireless/realtek/rtw89/mac.h @@ -1634,19 +1634,26 @@ void rtw89_tx_rpt_init(struct rtw89_dev *rtwdev, } static inline -bool rtw89_is_tx_rpt_skb(struct sk_buff *skb) +bool rtw89_is_tx_rpt_skb(struct rtw89_dev *rtwdev, struct sk_buff *skb) { + struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb); struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - return info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS; + return rtw89_core_is_tx_wait(rtwdev, skb_data) || + (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS); } static inline void rtw89_tx_rpt_tx_status(struct rtw89_dev *rtwdev, struct sk_buff *skb, u8 tx_status) { - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb); + struct ieee80211_tx_info *info; + + if (rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status)) + return; + info = IEEE80211_SKB_CB(skb); ieee80211_tx_info_clear_status(info); if (tx_status == RTW89_TX_DONE) diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index 51e99002b6fa17..cc5889296a7925 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -194,7 +194,7 @@ static void rtw89_usb_write_port_complete(struct urb *urb) skb_pull(skb, txdesc_size); - if (rtw89_is_tx_rpt_skb(skb)) { + if (rtw89_is_tx_rpt_skb(rtwdev, skb)) { if (urb->status == 0) rtw89_tx_rpt_skb_add(rtwdev, skb); else From e6e4d0812f85d78e8c4497ce0fcfcf2ba24fa4e6 Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Fri, 7 Nov 2025 18:06:27 +0200 Subject: [PATCH 14/25] wifi: rtw89: Use the correct power sequences for USB/SDIO commit 233542f5b4a8ea1fe3535f8021d37e7e92ffc4e5 upstream. Make rtw89_mac_pwr_seq() select the right parts of the power sequences based on the interface type. This is only relevant for RTL8852A. The other chips don't use power sequences. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/dec13310-06eb-429e-acb8-4c5b62656836@gmail.com --- drivers/net/wireless/realtek/rtw89/mac.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c index b416052f2ca520..c4d30032be9f6e 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.c +++ b/drivers/net/wireless/realtek/rtw89/mac.c @@ -1294,11 +1294,26 @@ static int rtw89_mac_sub_pwr_seq(struct rtw89_dev *rtwdev, u8 cv_msk, static int rtw89_mac_pwr_seq(struct rtw89_dev *rtwdev, const struct rtw89_pwr_cfg * const *cfg_seq) { + u8 intf_msk; int ret; + switch (rtwdev->hci.type) { + case RTW89_HCI_TYPE_PCIE: + intf_msk = PWR_INTF_MSK_PCIE; + break; + case RTW89_HCI_TYPE_USB: + intf_msk = PWR_INTF_MSK_USB; + break; + case RTW89_HCI_TYPE_SDIO: + intf_msk = PWR_INTF_MSK_SDIO; + break; + default: + return -EOPNOTSUPP; + } + for (; *cfg_seq; cfg_seq++) { ret = rtw89_mac_sub_pwr_seq(rtwdev, BIT(rtwdev->hal.cv), - PWR_INTF_MSK_PCIE, *cfg_seq); + intf_msk, *cfg_seq); if (ret) return -EBUSY; } From 39ec6ca9e5708045740e5407eadcfb99f1fdc5c7 Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Fri, 7 Nov 2025 18:07:06 +0200 Subject: [PATCH 15/25] wifi: rtw89: Add rtw8852a_dle_mem_usb commit 0eea5e0f03db84d3d1a1a8926fca12295bda1f04 upstream. Add rtw8852a_dle_mem_usb and its various quotas and sizes in struct rtw89_mac_size_set. "dle" could be "Data Link Engine" or "Double Link Engine". These are some parameters needed for RTL8852AU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/d0a09039-97a8-4501-b023-510c126d8c61@gmail.com --- drivers/net/wireless/realtek/rtw89/mac.c | 9 +++++++++ drivers/net/wireless/realtek/rtw89/mac.h | 5 +++++ drivers/net/wireless/realtek/rtw89/rtw8852a.c | 18 +++++++++++++++++- 3 files changed, 31 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c index c4d30032be9f6e..32c1724559de38 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.c +++ b/drivers/net/wireless/realtek/rtw89/mac.c @@ -1666,6 +1666,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = { /* PCIE 64 */ .wde_size0 = {RTW89_WDE_PG_64, 4095, 1,}, .wde_size0_v1 = {RTW89_WDE_PG_64, 3328, 0, 0,}, + /* 8852A USB */ + .wde_size1 = {RTW89_WDE_PG_64, 768, 0,}, /* DLFW */ .wde_size4 = {RTW89_WDE_PG_64, 0, 4096,}, .wde_size4_v1 = {RTW89_WDE_PG_64, 0, 3328, 0,}, @@ -1685,6 +1687,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = { /* PCIE */ .ple_size0 = {RTW89_PLE_PG_128, 1520, 16,}, .ple_size0_v1 = {RTW89_PLE_PG_128, 2688, 240, 212992,}, + /* 8852A USB */ + .ple_size1 = {RTW89_PLE_PG_128, 3184, 16,}, .ple_size3_v1 = {RTW89_PLE_PG_128, 2928, 0, 212992,}, /* DLFW */ .ple_size4 = {RTW89_PLE_PG_128, 64, 1472,}, @@ -1704,6 +1708,8 @@ const struct rtw89_mac_size_set rtw89_mac_size = { /* PCIE 64 */ .wde_qt0 = {3792, 196, 0, 107,}, .wde_qt0_v1 = {3302, 6, 0, 20,}, + /* 8852A USB */ + .wde_qt1 = {512, 196, 0, 60,}, /* DLFW */ .wde_qt4 = {0, 0, 0, 0,}, /* PCIE 64 */ @@ -1728,6 +1734,9 @@ const struct rtw89_mac_size_set rtw89_mac_size = { .ple_qt13 = {0, 0, 16, 48, 0, 0, 0, 0, 0, 0, 0,}, /* PCIE 64 */ .ple_qt18 = {147, 0, 16, 20, 17, 13, 89, 0, 32, 14, 8, 0,}, + /* 8852A USB SCC */ + .ple_qt25 = {1536, 0, 16, 48, 13, 13, 360, 0, 32, 40, 8, 0,}, + .ple_qt26 = {2654, 0, 1134, 48, 64, 13, 1478, 0, 64, 128, 120, 0,}, /* DLFW 52C */ .ple_qt44 = {0, 0, 16, 256, 0, 0, 0, 0, 0, 0, 0, 0,}, /* DLFW 52C */ diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h index c4bf8de02aa243..f003f3b00b951d 100644 --- a/drivers/net/wireless/realtek/rtw89/mac.h +++ b/drivers/net/wireless/realtek/rtw89/mac.h @@ -922,6 +922,7 @@ struct rtw89_mac_size_set { const struct rtw89_hfc_prec_cfg hfc_prec_cfg_c0; const struct rtw89_hfc_prec_cfg hfc_prec_cfg_c2; const struct rtw89_dle_size wde_size0; + const struct rtw89_dle_size wde_size1; const struct rtw89_dle_size wde_size0_v1; const struct rtw89_dle_size wde_size4; const struct rtw89_dle_size wde_size4_v1; @@ -933,6 +934,7 @@ struct rtw89_mac_size_set { const struct rtw89_dle_size wde_size23; const struct rtw89_dle_size wde_size25; const struct rtw89_dle_size ple_size0; + const struct rtw89_dle_size ple_size1; const struct rtw89_dle_size ple_size0_v1; const struct rtw89_dle_size ple_size3_v1; const struct rtw89_dle_size ple_size4; @@ -944,6 +946,7 @@ struct rtw89_mac_size_set { const struct rtw89_dle_size ple_size32; const struct rtw89_dle_size ple_size33; const struct rtw89_wde_quota wde_qt0; + const struct rtw89_wde_quota wde_qt1; const struct rtw89_wde_quota wde_qt0_v1; const struct rtw89_wde_quota wde_qt4; const struct rtw89_wde_quota wde_qt6; @@ -959,6 +962,8 @@ struct rtw89_mac_size_set { const struct rtw89_ple_quota ple_qt9; const struct rtw89_ple_quota ple_qt13; const struct rtw89_ple_quota ple_qt18; + const struct rtw89_ple_quota ple_qt25; + const struct rtw89_ple_quota ple_qt26; const struct rtw89_ple_quota ple_qt44; const struct rtw89_ple_quota ple_qt45; const struct rtw89_ple_quota ple_qt46; diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c index d0f724a69b6e05..e6f3d0c83197f4 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c @@ -65,6 +65,19 @@ static const struct rtw89_dle_mem rtw8852a_dle_mem_pcie[] = { NULL}, }; +static const struct rtw89_dle_mem rtw8852a_dle_mem_usb[] = { + [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size1, + &rtw89_mac_size.ple_size1, &rtw89_mac_size.wde_qt1, + &rtw89_mac_size.wde_qt1, &rtw89_mac_size.ple_qt25, + &rtw89_mac_size.ple_qt26}, + [RTW89_QTA_DLFW] = {RTW89_QTA_DLFW, &rtw89_mac_size.wde_size4, + &rtw89_mac_size.ple_size4, &rtw89_mac_size.wde_qt4, + &rtw89_mac_size.wde_qt4, &rtw89_mac_size.ple_qt13, + &rtw89_mac_size.ple_qt13}, + [RTW89_QTA_INVALID] = {RTW89_QTA_INVALID, NULL, NULL, NULL, NULL, NULL, + NULL}, +}; + static const struct rtw89_reg2_def rtw8852a_pmac_ht20_mcs7_tbl[] = { {0x44AC, 0x00000000}, {0x44B0, 0x00000000}, @@ -2226,7 +2239,10 @@ const struct rtw89_chip_info rtw8852a_chip_info = { .dis_2g_40m_ul_ofdma = true, .rsvd_ple_ofst = 0x6f800, .hfc_param_ini = {rtw8852a_hfc_param_ini_pcie, NULL, NULL}, - .dle_mem = {rtw8852a_dle_mem_pcie, NULL, NULL, NULL}, + .dle_mem = {rtw8852a_dle_mem_pcie, + rtw8852a_dle_mem_usb, + rtw8852a_dle_mem_usb, + NULL}, .wde_qempty_acq_grpnum = 16, .wde_qempty_mgq_grpsel = 16, .rf_base_addr = {0xc000, 0xd000}, From 73d40732365c30bb18484475fc71c7739f65dbfd Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Fri, 7 Nov 2025 18:08:14 +0200 Subject: [PATCH 16/25] wifi: rtw89: Add rtw8852a_hfc_param_ini_usb commit c19b106609f398b3b1b14a89dc68ed0244420d08 upstream. "hfc" means "hci fc" which is "Host Control Interface Flow Control". These are some parameters needed for RTL8852AU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/d1032888-2a53-4c52-a8b9-6e00cd6758dc@gmail.com --- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 46 ++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c index e6f3d0c83197f4..8d894b6ac48c2c 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c @@ -48,6 +48,48 @@ static const struct rtw89_hfc_param_ini rtw8852a_hfc_param_ini_pcie[] = { [RTW89_QTA_INVALID] = {NULL}, }; +static const struct rtw89_hfc_ch_cfg rtw8852a_hfc_chcfg_usb[] = { + {22, 402, grp_0}, /* ACH 0 */ + {0, 0, grp_0}, /* ACH 1 */ + {22, 402, grp_0}, /* ACH 2 */ + {0, 0, grp_0}, /* ACH 3 */ + {22, 402, grp_0}, /* ACH 4 */ + {0, 0, grp_0}, /* ACH 5 */ + {22, 402, grp_0}, /* ACH 6 */ + {0, 0, grp_0}, /* ACH 7 */ + {22, 402, grp_0}, /* B0MGQ */ + {0, 0, grp_0}, /* B0HIQ */ + {22, 402, grp_0}, /* B1MGQ */ + {0, 0, grp_0}, /* B1HIQ */ + {0, 0, 0} /* FWCMDQ */ +}; + +static const struct rtw89_hfc_pub_cfg rtw8852a_hfc_pubcfg_usb = { + 512, /* Group 0 */ + 0, /* Group 1 */ + 512, /* Public Max */ + 104 /* WP threshold */ +}; + +static const struct rtw89_hfc_prec_cfg rtw8852a_hfc_preccfg_usb = { + 11, /* CH 0-11 pre-cost */ + 32, /* H2C pre-cost */ + 76, /* WP CH 0-7 pre-cost */ + 25, /* WP CH 8-11 pre-cost */ + 1, /* CH 0-11 full condition */ + 1, /* H2C full condition */ + 1, /* WP CH 0-7 full condition */ + 1, /* WP CH 8-11 full condition */ +}; + +static const struct rtw89_hfc_param_ini rtw8852a_hfc_param_ini_usb[] = { + [RTW89_QTA_SCC] = {rtw8852a_hfc_chcfg_usb, &rtw8852a_hfc_pubcfg_usb, + &rtw8852a_hfc_preccfg_usb, RTW89_HCIFC_STF}, + [RTW89_QTA_DLFW] = {NULL, NULL, + &rtw8852a_hfc_preccfg_usb, RTW89_HCIFC_STF}, + [RTW89_QTA_INVALID] = {NULL}, +}; + static const struct rtw89_dle_mem rtw8852a_dle_mem_pcie[] = { [RTW89_QTA_SCC] = {RTW89_QTA_SCC, &rtw89_mac_size.wde_size0, &rtw89_mac_size.ple_size0, &rtw89_mac_size.wde_qt0, @@ -2238,7 +2280,9 @@ const struct rtw89_chip_info rtw8852a_chip_info = { .max_amsdu_limit = 3500, .dis_2g_40m_ul_ofdma = true, .rsvd_ple_ofst = 0x6f800, - .hfc_param_ini = {rtw8852a_hfc_param_ini_pcie, NULL, NULL}, + .hfc_param_ini = {rtw8852a_hfc_param_ini_pcie, + rtw8852a_hfc_param_ini_usb, + NULL}, .dle_mem = {rtw8852a_dle_mem_pcie, rtw8852a_dle_mem_usb, rtw8852a_dle_mem_usb, From a128ef0cae3e4c6502c48b956a40a4f4d3c8e86b Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Fri, 7 Nov 2025 18:08:46 +0200 Subject: [PATCH 17/25] wifi: rtw89: 8852a: Accept USB devices and load their MAC address commit 1dfd11e70022a0117bdf3fd02d2b541c9c732845 upstream. Make rtw8852a_read_efuse() accept USB devices and load the MAC address from the correct offset. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/97412e2c-ac98-403c-9056-9d9fe1ed9f28@gmail.com --- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852a.c b/drivers/net/wireless/realtek/rtw89/rtw8852a.c index 8d894b6ac48c2c..918f1ba197ad5e 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852a.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852a.c @@ -621,14 +621,6 @@ static const struct rtw89_edcca_regs rtw8852a_edcca_regs = { .tx_collision_t2r_st_mask = B_TX_COLLISION_T2R_ST_M, }; -static void rtw8852ae_efuse_parsing(struct rtw89_efuse *efuse, - struct rtw8852a_efuse *map) -{ - ether_addr_copy(efuse->addr, map->e.mac_addr); - efuse->rfe_type = map->rfe_type; - efuse->xtal_cap = map->xtal_k; -} - static void rtw8852a_efuse_parsing_tssi(struct rtw89_dev *rtwdev, struct rtw8852a_efuse *map) { @@ -674,12 +666,18 @@ static int rtw8852a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map, switch (rtwdev->hci.type) { case RTW89_HCI_TYPE_PCIE: - rtw8852ae_efuse_parsing(efuse, map); + ether_addr_copy(efuse->addr, map->e.mac_addr); + break; + case RTW89_HCI_TYPE_USB: + ether_addr_copy(efuse->addr, map->u.mac_addr); break; default: return -ENOTSUPP; } + efuse->rfe_type = map->rfe_type; + efuse->xtal_cap = map->xtal_k; + rtw89_info(rtwdev, "chip rfe_type is %d\n", efuse->rfe_type); return 0; From c3f324ce85f5b8fa527b006a2fb440bc95a80100 Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Fri, 7 Nov 2025 18:09:22 +0200 Subject: [PATCH 18/25] wifi: rtw89: Add rtw8852au.c commit 0029ccab53accee4919971547f4e38036ef62b2f upstream. This is the entry point of the new rtw89_8852au module. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/9580e5be-2bd1-45f9-ab75-616b86e25694@gmail.com --- .../net/wireless/realtek/rtw89/rtw8852au.c | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 drivers/net/wireless/realtek/rtw89/rtw8852au.c diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c new file mode 100644 index 00000000000000..ca782469c455dc --- /dev/null +++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c @@ -0,0 +1,79 @@ +// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause +/* Copyright(c) 2025 Realtek Corporation + */ + +#include +#include +#include "rtw8852a.h" +#include "reg.h" +#include "usb.h" + +static const struct rtw89_usb_info rtw8852a_usb_info = { + .usb_host_request_2 = R_AX_USB_HOST_REQUEST_2, + .usb_wlan0_1 = R_AX_USB_WLAN0_1, + .hci_func_en = R_AX_HCI_FUNC_EN, + .usb3_mac_npi_config_intf_0 = R_AX_USB3_MAC_NPI_CONFIG_INTF_0, + .usb_endpoint_0 = R_AX_USB_ENDPOINT_0, + .usb_endpoint_2 = R_AX_USB_ENDPOINT_2, + .bulkout_id = { + [RTW89_DMA_ACH0] = 3, + [RTW89_DMA_ACH2] = 5, + [RTW89_DMA_ACH4] = 4, + [RTW89_DMA_ACH6] = 6, + [RTW89_DMA_B0MG] = 0, + [RTW89_DMA_B0HI] = 0, + [RTW89_DMA_B1MG] = 1, + [RTW89_DMA_B1HI] = 1, + [RTW89_DMA_H2C] = 2, + }, +}; + +static const struct rtw89_driver_info rtw89_8852au_info = { + .chip = &rtw8852a_chip_info, + .variant = NULL, + .quirks = NULL, + .bus = { + .usb = &rtw8852a_usb_info, + } +}; + +static const struct usb_device_id rtw_8852au_id_table[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x0411, 0x0312, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x4020, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x1997, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0bda, 0x8832, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0bda, 0x885a, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x0bda, 0x885c, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3321, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x332c, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x013f, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0140, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0141, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010f, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + {}, +}; +MODULE_DEVICE_TABLE(usb, rtw_8852au_id_table); + +static struct usb_driver rtw_8852au_driver = { + .name = KBUILD_MODNAME, + .id_table = rtw_8852au_id_table, + .probe = rtw89_usb_probe, + .disconnect = rtw89_usb_disconnect, +}; +module_usb_driver(rtw_8852au_driver); + +MODULE_AUTHOR("Bitterblue Smith "); +MODULE_DESCRIPTION("Realtek 802.11ax wireless 8852AU driver"); +MODULE_LICENSE("Dual BSD/GPL"); From 5edc731e10b0d769eaca68a468dcddc4e0eb6cac Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Fri, 7 Nov 2025 18:10:19 +0200 Subject: [PATCH 19/25] wifi: rtw89: Enable the new rtw89_8852au module commit 623c177323ec16c2c72b4ea0ad68bda223928488 upstream. Tested in station mode and a little in AP mode. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/180a5e77-9297-4ffc-80d5-191dfef47661@gmail.com --- drivers/net/wireless/realtek/rtw89/Kconfig | 11 +++++++++++ drivers/net/wireless/realtek/rtw89/Makefile | 3 +++ 2 files changed, 14 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/Kconfig b/drivers/net/wireless/realtek/rtw89/Kconfig index 4288c30b400a17..5480eb695276d0 100644 --- a/drivers/net/wireless/realtek/rtw89/Kconfig +++ b/drivers/net/wireless/realtek/rtw89/Kconfig @@ -74,6 +74,17 @@ config RTW89_8852AE 802.11ax PCIe wireless network (Wi-Fi 6) adapter +config RTW89_8852AU + tristate "Realtek 8852AU USB wireless network (Wi-Fi 6) adapter" + depends on USB + select RTW89_CORE + select RTW89_USB + select RTW89_8852A + help + Select this option will enable support for 8852AU chipset + + 802.11ax USB wireless network (Wi-Fi 6) adapter + config RTW89_8852BE tristate "Realtek 8852BE PCI wireless network (Wi-Fi 6) adapter" depends on PCI diff --git a/drivers/net/wireless/realtek/rtw89/Makefile b/drivers/net/wireless/realtek/rtw89/Makefile index 23e43c444f69fc..7178c0ec9bd97f 100644 --- a/drivers/net/wireless/realtek/rtw89/Makefile +++ b/drivers/net/wireless/realtek/rtw89/Makefile @@ -43,6 +43,9 @@ rtw89_8852a-objs := rtw8852a.o \ obj-$(CONFIG_RTW89_8852AE) += rtw89_8852ae.o rtw89_8852ae-objs := rtw8852ae.o +obj-$(CONFIG_RTW89_8852AU) += rtw89_8852au.o +rtw89_8852au-objs := rtw8852au.o + obj-$(CONFIG_RTW89_8852B_COMMON) += rtw89_8852b_common.o rtw89_8852b_common-objs := rtw8852b_common.o From b2ba665f70112615a7298efe48468e0bb74a86a2 Mon Sep 17 00:00:00 2001 From: Jan Gerber Date: Fri, 12 Dec 2025 01:54:21 +0100 Subject: [PATCH 20/25] wifi: rtw89: 8852au: add support for TP TX30U Plus commit a2f1fc9ab6fb0d5c9d701a516c342944258fb20e upstream. the device shows up like this and everything seams to work: Bus 004 Device 003: ID 3625:010d Realtek 802.11ax WLAN Adapter Signed-off-by: Jan Gerber Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251212005515.2059533-1-j@mailb.org --- drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c index ca782469c455dc..74a976c984ad84 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c @@ -60,6 +60,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = { .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0141, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010d, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010f, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, {}, From 990237b395d9fe2fabe7c398da3780ede982af61 Mon Sep 17 00:00:00 2001 From: Ping-Ke Shih Date: Wed, 17 Dec 2025 15:26:46 +0800 Subject: [PATCH 21/25] wifi: rtw89: correct use sequence of driver_data in skb->info commit d3a9e132a4c6273a5254e743da14887502e928c8 upstream. As ieee80211_tx_info is used to assist filling TX descriptor, and layout of IEEE80211_SKB_CB(skb)->driver_data (accessing by RTW89_TX_SKB_CB()) is union, so driver_data must be used by/after rtw89_hci_tx_write() or just before calling rtw89_hci_tx_write(). Otherwise, ieee80211_tx_info::control data is overwritten. Found this by using injected packets which uses ieee80211_tx_info::control, but always sending incorrect data rate. Cc: Fedor Pchelkin Fixes: d5da3d9fb05f ("wifi: rtw89: process TX wait skbs for USB via C2H handler") Signed-off-by: Ping-Ke Shih Tested-by: Fedor Pchelkin Link: https://patch.msgid.link/20251217072646.43209-1-pkshih@realtek.com --- drivers/net/wireless/realtek/rtw89/core.c | 6 ++++-- drivers/net/wireless/realtek/rtw89/core.h | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 84b7023a33bf5a..439f2f61e74aa0 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -1135,7 +1135,7 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev, if (addr_cam->valid && desc_info->mlo) upd_wlan_hdr = true; - if (rtw89_is_tx_rpt_skb(rtwdev, tx_req->skb)) + if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS || tx_req->with_wait) rtw89_tx_rpt_init(rtwdev, tx_req); is_bmc = (is_broadcast_ether_addr(hdr->addr1) || @@ -1267,13 +1267,15 @@ static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev, tx_req.rtwvif_link = rtwvif_link; tx_req.rtwsta_link = rtwsta_link; tx_req.desc_info.sw_mld = sw_mld; - rcu_assign_pointer(skb_data->wait, wait); + tx_req.with_wait = !!wait; rtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true); rtw89_wow_parse_akm(rtwdev, skb); rtw89_core_tx_update_desc_info(rtwdev, &tx_req); rtw89_core_tx_wake(rtwdev, &tx_req); + rcu_assign_pointer(skb_data->wait, wait); + ret = rtw89_hci_tx_write(rtwdev, &tx_req); if (ret) { rtw89_err(rtwdev, "failed to transmit skb to HCI\n"); diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 4135e8ed64f053..280d75490a2fd4 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -1207,6 +1207,8 @@ struct rtw89_core_tx_request { struct rtw89_vif_link *rtwvif_link; struct rtw89_sta_link *rtwsta_link; struct rtw89_tx_desc_info desc_info; + + bool with_wait; }; struct rtw89_txq { From f5a4f3ebfb5b8b54e62b92f1abc8289e3e084ff7 Mon Sep 17 00:00:00 2001 From: Zenm Chen Date: Mon, 12 Jan 2026 08:47:59 +0800 Subject: [PATCH 22/25] wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18) commit 292c0bc8acb687de7e83fc454bb98af19187b6bf upstream. Add the ID 2001:3323 to the table to support an additional RTL8832AU adapter: D-Link VR Air Bridge (DWA-F18). Compile tested only. Link: https://github.com/morrownr/rtw89/pull/44 Signed-off-by: Zenm Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260112004759.6028-1-zenmchen@gmail.com --- drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c index 74a976c984ad84..ccdbcc178c2a4c 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c @@ -52,6 +52,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = { .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3321, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3323, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x332c, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&rtw89_8852au_info }, { USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x013f, 0xff, 0xff, 0xff), From b17063faec53c9dba9705c8f5995a50e6b36afbb Mon Sep 17 00:00:00 2001 From: Lucid Duck Date: Wed, 1 Apr 2026 22:22:16 -0700 Subject: [PATCH 23/25] wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs commit 80119a77e5b03747b8886505df1b3cb26f49168d upstream. rtw89_usb_ops_check_and_reclaim_tx_resource() returns a hardcoded placeholder value (42) instead of actual TX resource availability. This violates mac80211's flow control contract, preventing backpressure and causing uncontrolled URB accumulation under sustained TX load. Fix by adding per-channel atomic counters (tx_inflight[]) that track in-flight URBs. Increment before usb_submit_urb() with rollback on failure, decrement in the completion callback, and return the remaining capacity to mac80211. The firmware command channel (CH12) always returns 1 since it has its own flow control. The pre-increment pattern prevents a race where USB core completes the URB on another CPU before the submitting code increments the counter. 128 URBs per channel provides headroom for RTL8832CU at 160 MHz bandwidth. Tested on RTL8852AU (USB3 80 MHz) where 64 and 128 showed equivalent throughput, and on RTL8832AU where 128 sustained full throughput under 8-stream parallel load. Tested on D-Link DWA-X1850 (RTL8832AU), kernel 6.19.8, Fedora 43: Unpatched -> Patched (128 URBs) USB3 5GHz UL: 844 -> 837 Mbps (no regression) USB3 5GHz retx: 3 -> 0 USB3 2.4GHz UL: 162 -> 164 Mbps (no regression) 4-stream UL: 858 -> 826 Mbps (within variance) 8-stream UL: 872 -> 826 Mbps (within variance) UDP flood: 0% loss (690K datagrams) 60-second soak: 855 Mbps, 0 retransmits Reported-by: morrownr Signed-off-by: Lucid Duck Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260402052216.207858-1-lucid_duck@justthetip.ca --- drivers/net/wireless/realtek/rtw89/usb.c | 20 ++++++++++++++++++-- drivers/net/wireless/realtek/rtw89/usb.h | 3 +++ 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index cc5889296a7925..e1161d70ada9bc 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -161,16 +161,24 @@ static u32 rtw89_usb_ops_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev, u8 txch) { + struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + int inflight; + if (txch == RTW89_TXCH_CH12) return 1; - return 42; /* TODO some kind of calculation? */ + inflight = atomic_read(&rtwusb->tx_inflight[txch]); + if (inflight >= RTW89_USB_MAX_TX_URBS_PER_CH) + return 0; + + return RTW89_USB_MAX_TX_URBS_PER_CH - inflight; } static void rtw89_usb_write_port_complete(struct urb *urb) { struct rtw89_usb_tx_ctrl_block *txcb = urb->context; struct rtw89_dev *rtwdev = txcb->rtwdev; + struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); struct ieee80211_tx_info *info; struct rtw89_txwd_body *txdesc; struct sk_buff *skb; @@ -229,6 +237,8 @@ static void rtw89_usb_write_port_complete(struct urb *urb) break; } + atomic_dec(&rtwusb->tx_inflight[txcb->txch]); + kfree(txcb); } @@ -306,9 +316,13 @@ static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch) skb_queue_tail(&txcb->tx_ack_queue, skb); + atomic_inc(&rtwusb->tx_inflight[txch]); + ret = rtw89_usb_write_port(rtwdev, txch, skb->data, skb->len, txcb); if (ret) { + atomic_dec(&rtwusb->tx_inflight[txch]); + if (ret != -ENODEV) rtw89_err(rtwdev, "write port txch %d failed: %d\n", txch, ret); @@ -666,8 +680,10 @@ static void rtw89_usb_init_tx(struct rtw89_dev *rtwdev) struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); int i; - for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++) + for (i = 0; i < ARRAY_SIZE(rtwusb->tx_queue); i++) { skb_queue_head_init(&rtwusb->tx_queue[i]); + atomic_set(&rtwusb->tx_inflight[i], 0); + } } static void rtw89_usb_deinit_tx(struct rtw89_dev *rtwdev) diff --git a/drivers/net/wireless/realtek/rtw89/usb.h b/drivers/net/wireless/realtek/rtw89/usb.h index 203ec8e993e9ff..e62bde69d57146 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.h +++ b/drivers/net/wireless/realtek/rtw89/usb.h @@ -20,6 +20,8 @@ #define RTW89_MAX_ENDPOINT_NUM 9 #define RTW89_MAX_BULKOUT_NUM 7 +#define RTW89_USB_MAX_TX_URBS_PER_CH 128 + struct rtw89_usb_info { u32 usb_host_request_2; u32 usb_wlan0_1; @@ -63,6 +65,7 @@ struct rtw89_usb { struct usb_anchor tx_submitted; struct sk_buff_head tx_queue[RTW89_TXCH_NUM]; + atomic_t tx_inflight[RTW89_TXCH_NUM]; }; static inline struct rtw89_usb *rtw89_usb_priv(struct rtw89_dev *rtwdev) From 55e3fea6f6f1d8c893b1d3ded57bd61ebf80b036 Mon Sep 17 00:00:00 2001 From: Bitterblue Smith Date: Wed, 20 May 2026 17:44:35 +0300 Subject: [PATCH 24/25] wifi: rtw89: usb: Support switching to USB 3 mode commit 8368970b62404ce2ce70d04c1cfff62700d7d8d5 upstream. The Realtek wifi 6/7 devices which support USB 3 are weird: when first plugged in, they pretend to be USB 2. The driver needs to send some commands to the device, which make it disappear and come back as a USB 3 device. Implement the required commands in rtw89. Add a new function rtw89_usb_write32_quiet() to avoid the warnings when writing to R_{AX,BE}_PAD_CTRL2. Even though the write succeeds, usb_control_msg() returns -EPROTO, probably because the USB device disappears immediately. This results in some confusing warnings in the kernel log. When a USB 3 device is plugged into a USB 2 port, rtw89 will try to switch it to USB 3 mode only once. The device will disappear and come back still in USB 2 mode, of course. Tested with RTL8832AU, RTL8832BU, RTL8832CU, and RTL8912AU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/e955451c-93a1-4d04-8024-d224a04f1d4a@gmail.com --- drivers/net/wireless/realtek/rtw89/reg.h | 27 ++++++ drivers/net/wireless/realtek/rtw89/usb.c | 104 ++++++++++++++++++++++- 2 files changed, 128 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h index ed1d958bc49e3c..79e8b9523f8879 100644 --- a/drivers/net/wireless/realtek/rtw89/reg.h +++ b/drivers/net/wireless/realtek/rtw89/reg.h @@ -163,6 +163,19 @@ #define R_AX_DBG_PORT_SEL 0x00C0 #define B_AX_DEBUG_ST_MASK GENMASK(31, 0) +#define R_AX_PAD_CTRL2 0x00C4 +#define B_AX_FORCE_U3_CK BIT(23) +#define B_AX_USB2_FORCE BIT(22) +#define B_AX_USB3_FORCE BIT(21) +#define B_AX_USB3_USB2_TRANSITION BIT(20) +#define B_AX_USB23_SW_MODE_V1 GENMASK(19, 18) +#define USB_MODE_U2 0x1 +#define USB_MODE_U3 0x2 +#define B_AX_NO_PDN_CHIPOFF_V1 BIT(17) +#define B_AX_RSM_EN_V1 BIT(16) +#define B_AX_MATCH_CNT GENMASK(15, 8) +#define USB_SWITCH_DELAY 0xF + #define R_AX_PMC_DBG_CTRL2 0x00CC #define B_AX_SYSON_DIS_PMCR_AX_WRMSK BIT(2) @@ -4170,6 +4183,20 @@ #define B_BE_EF_DSB_EN BIT(11) #define B_BE_EF_DLY_SEL_MASK GENMASK(3, 0) +#define R_BE_PAD_CTRL2 0x00C4 +#define B_BE_USB23_SW_MODE BIT(31) +#define B_BE_USB3_GEN_MODE BIT(30) +#define B_BE_USB3_LANE_MODE BIT(29) +#define B_BE_USB_AUTO_INSTALL_MASK BIT(28) +#define B_BE_FORCE_CLK_U2 BIT(25) +#define B_BE_FORCE_U2_CK BIT(24) +#define B_BE_FORCE_U3_CK BIT(23) +#define B_BE_USB2_FORCE BIT(22) +#define B_BE_USB3_FORCE BIT(21) +#define B_BE_NO_PDN_CHIPOFF_V1 BIT(17) +#define B_BE_RSM_EN_V1 BIT(16) +#define B_BE_MATCH_CNT GENMASK(15, 8) + #define R_BE_PMC_DBG_CTRL2 0x00CC #define B_BE_EFUSE_BURN_GNT_MASK GENMASK(31, 24) #define B_BE_DIS_IOWRAP_TIMEOUT BIT(16) diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c index e1161d70ada9bc..bb23074942a341 100644 --- a/drivers/net/wireless/realtek/rtw89/usb.c +++ b/drivers/net/wireless/realtek/rtw89/usb.c @@ -11,8 +11,8 @@ static void rtw89_usb_read_port_complete(struct urb *urb); -static void rtw89_usb_vendorreq(struct rtw89_dev *rtwdev, u32 addr, - void *data, u16 len, u8 reqtype) +static void __rtw89_usb_vendorreq(struct rtw89_dev *rtwdev, u32 addr, + void *data, u16 len, u8 reqtype, bool warn) { struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); struct usb_device *udev = rtwusb->udev; @@ -52,7 +52,7 @@ static void rtw89_usb_vendorreq(struct rtw89_dev *rtwdev, u32 addr, if (ret == -ESHUTDOWN || ret == -ENODEV) set_bit(RTW89_FLAG_UNPLUGGED, rtwdev->flags); - else if (ret < 0) + else if (ret < 0 && warn) rtw89_warn(rtwdev, "usb %s%u 0x%x fail ret=%d value=0x%x attempt=%d\n", reqtype == RTW89_USB_VENQT_READ ? "read" : "write", @@ -69,6 +69,12 @@ static void rtw89_usb_vendorreq(struct rtw89_dev *rtwdev, u32 addr, } } +static void rtw89_usb_vendorreq(struct rtw89_dev *rtwdev, u32 addr, + void *data, u16 len, u8 reqtype) +{ + __rtw89_usb_vendorreq(rtwdev, addr, data, len, reqtype, true); +} + static u32 rtw89_usb_read_cmac(struct rtw89_dev *rtwdev, u32 addr) { u32 addr32, val32, shift; @@ -157,6 +163,14 @@ static void rtw89_usb_ops_write32(struct rtw89_dev *rtwdev, u32 addr, u32 val) rtw89_usb_vendorreq(rtwdev, addr, &data, 4, RTW89_USB_VENQT_WRITE); } +static void rtw89_usb_write32_quiet(struct rtw89_dev *rtwdev, u32 addr, u32 val) +{ + __le32 data = cpu_to_le32(val); + + __rtw89_usb_vendorreq(rtwdev, addr, &data, 4, + RTW89_USB_VENQT_WRITE, false); +} + static u32 rtw89_usb_ops_check_and_reclaim_tx_resource(struct rtw89_dev *rtwdev, u8 txch) @@ -971,6 +985,83 @@ static void rtw89_usb_intf_deinit(struct rtw89_dev *rtwdev, usb_set_intfdata(intf, NULL); } +static int rtw89_usb_switch_mode_ax(struct rtw89_dev *rtwdev) +{ + u32 pad_ctrl2; + + /* No known USB 3 devices with this chip. */ + if (rtwdev->chip->chip_id == RTL8851B) + return 0; + + pad_ctrl2 = rtw89_usb_ops_read32(rtwdev, R_AX_PAD_CTRL2); + + rtw89_debug(rtwdev, RTW89_DBG_HCI, "%s: pad_ctrl2: %#x\n", + __func__, pad_ctrl2); + + /* Already tried to switch but it's a USB 2 port. */ + if (u32_get_bits(pad_ctrl2, B_AX_MATCH_CNT) == USB_SWITCH_DELAY) + return 0; + + /* Add delay to prevent some platforms would not detect USB switch */ + u32p_replace_bits(&pad_ctrl2, USB_SWITCH_DELAY, B_AX_MATCH_CNT); + + pad_ctrl2 &= ~(B_AX_FORCE_U3_CK | B_AX_USB2_FORCE | + B_AX_USB3_FORCE | B_AX_USB3_USB2_TRANSITION); + + u32p_replace_bits(&pad_ctrl2, USB_MODE_U3, B_AX_USB23_SW_MODE_V1); + + pad_ctrl2 |= B_AX_NO_PDN_CHIPOFF_V1 | B_AX_RSM_EN_V1; + + rtw89_usb_write32_quiet(rtwdev, R_AX_PAD_CTRL2, pad_ctrl2); + + return 1; +} + +static int rtw89_usb_switch_mode_be(struct rtw89_dev *rtwdev) +{ + u32 pad_ctrl2; + + pad_ctrl2 = rtw89_usb_ops_read32(rtwdev, R_BE_PAD_CTRL2); + + rtw89_debug(rtwdev, RTW89_DBG_HCI, "%s: pad_ctrl2: %#x\n", + __func__, pad_ctrl2); + + /* Already tried to switch but it's a USB 2 port. */ + if (u32_get_bits(pad_ctrl2, B_BE_MATCH_CNT) == USB_SWITCH_DELAY) + return 0; + + /* Add delay to prevent some platforms would not detect USB switch */ + u32p_replace_bits(&pad_ctrl2, USB_SWITCH_DELAY, B_BE_MATCH_CNT); + + pad_ctrl2 |= B_BE_RSM_EN_V1 | B_BE_NO_PDN_CHIPOFF_V1 | + B_BE_USB_AUTO_INSTALL_MASK | B_BE_USB23_SW_MODE; + + pad_ctrl2 &= ~(B_BE_USB3_FORCE | B_BE_USB2_FORCE | + B_BE_FORCE_U3_CK | B_BE_FORCE_U2_CK | + B_BE_FORCE_CLK_U2 | B_BE_USB3_GEN_MODE | + B_BE_USB3_LANE_MODE); + + rtw89_usb_write32_quiet(rtwdev, R_BE_PAD_CTRL2, pad_ctrl2); + + return 1; +} + +static int rtw89_usb_switch_mode(struct rtw89_dev *rtwdev) +{ + struct rtw89_usb *rtwusb = rtw89_usb_priv(rtwdev); + + if (rtwusb->udev->speed == USB_SPEED_SUPER) { + rtw89_info(rtwdev, + "2.4 GHz performance may be better in a USB 2 port\n"); + return 0; + } + + if (rtwdev->chip->chip_gen == RTW89_CHIP_AX) + return rtw89_usb_switch_mode_ax(rtwdev); + + return rtw89_usb_switch_mode_be(rtwdev); +} + int rtw89_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) { @@ -1003,6 +1094,13 @@ int rtw89_usb_probe(struct usb_interface *intf, goto err_free_hw; } + ret = rtw89_usb_switch_mode(rtwdev); + if (ret) { + /* Not a fail, but we do need to skip rtw89_core_register. */ + ret = 0; + goto err_intf_deinit; + } + if (rtwusb->udev->speed == USB_SPEED_SUPER) rtwdev->hci.dle_type = RTW89_HCI_DLE_TYPE_USB3; else From 58b9ca9897cd045712e1fed81a03dcd2bbd201d7 Mon Sep 17 00:00:00 2001 From: Phil Elwell Date: Fri, 25 Sep 2026 09:39:37 +0100 Subject: [PATCH 25/25] configs: Enable the rtw8852au driver module Signed-off-by: Phil Elwell --- arch/arm/configs/bcm2709_defconfig | 1 + arch/arm/configs/bcmrpi_defconfig | 1 + arch/arm64/configs/bcm2711_defconfig | 1 + arch/arm64/configs/bcm2711_rt_defconfig | 1 + arch/arm64/configs/bcm2712_defconfig | 1 + 5 files changed, 5 insertions(+) diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig index a533632be25195..4715bfbd2716b2 100644 --- a/arch/arm/configs/bcm2709_defconfig +++ b/arch/arm/configs/bcm2709_defconfig @@ -601,6 +601,7 @@ CONFIG_RTW88_8812AU=m CONFIG_RTW88_8814AU=m CONFIG_RTW89=m CONFIG_RTW89_8851BU=m +CONFIG_RTW89_8852AU=m CONFIG_RTW89_8852BU=m CONFIG_WL12XX=m CONFIG_ZD1211RW=m diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig index 76d2e840108f36..433210485bf53f 100644 --- a/arch/arm/configs/bcmrpi_defconfig +++ b/arch/arm/configs/bcmrpi_defconfig @@ -595,6 +595,7 @@ CONFIG_RTW88_8812AU=m CONFIG_RTW88_8814AU=m CONFIG_RTW89=m CONFIG_RTW89_8851BU=m +CONFIG_RTW89_8852AU=m CONFIG_RTW89_8852BU=m CONFIG_WL12XX=m CONFIG_ZD1211RW=m diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig index 8b7e62d3105e50..97ebdcbb7d8ecf 100644 --- a/arch/arm64/configs/bcm2711_defconfig +++ b/arch/arm64/configs/bcm2711_defconfig @@ -671,6 +671,7 @@ CONFIG_RTW89=m CONFIG_RTW89_8851BE=m CONFIG_RTW89_8851BU=m CONFIG_RTW89_8852AE=m +CONFIG_RTW89_8852AU=m CONFIG_RTW89_8852BE=m CONFIG_RTW89_8852BU=m CONFIG_RTW89_8852BTE=m diff --git a/arch/arm64/configs/bcm2711_rt_defconfig b/arch/arm64/configs/bcm2711_rt_defconfig index 45c03ddb7b6127..ace5e320d5a578 100644 --- a/arch/arm64/configs/bcm2711_rt_defconfig +++ b/arch/arm64/configs/bcm2711_rt_defconfig @@ -671,6 +671,7 @@ CONFIG_RTW89=m CONFIG_RTW89_8851BE=m CONFIG_RTW89_8851BU=m CONFIG_RTW89_8852AE=m +CONFIG_RTW89_8852AU=m CONFIG_RTW89_8852BE=m CONFIG_RTW89_8852BU=m CONFIG_RTW89_8852BTE=m diff --git a/arch/arm64/configs/bcm2712_defconfig b/arch/arm64/configs/bcm2712_defconfig index 14bbd7296590a3..e88a19e65d7c41 100644 --- a/arch/arm64/configs/bcm2712_defconfig +++ b/arch/arm64/configs/bcm2712_defconfig @@ -674,6 +674,7 @@ CONFIG_RTW89=m CONFIG_RTW89_8851BE=m CONFIG_RTW89_8851BU=m CONFIG_RTW89_8852AE=m +CONFIG_RTW89_8852AU=m CONFIG_RTW89_8852BE=m CONFIG_RTW89_8852BU=m CONFIG_RTW89_8852BTE=m