wifi: rtw89: mlo: fix incorrect link address in management frames

Deauth frames used wrong link address after switching from default link
to another, causing AP to reject subsequent auth frames. This affected
not only deauth but all management frames. Fixed by setting correct
mac_id to let header conversion references correct address CAM.

Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251223030651.480633-4-pkshih@realtek.com

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 53d32f3137ebe972d49691c9924437d0c8255782..d07dc97e22d4cc50d1da1353a2fa5463b6612e3a 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -548,7 +548,7 @@ rtw89_core_get_tx_type(struct rtw89_dev *rtwdev,
        struct ieee80211_hdr *hdr = (void *)skb->data;
        __le16 fc = hdr->frame_control;
 
-       if (ieee80211_is_mgmt(fc) || ieee80211_is_nullfunc(fc))
+       if (ieee80211_is_mgmt(fc) || ieee80211_is_any_nullfunc(fc))
                return RTW89_CORE_TX_TYPE_MGMT;
 
        return RTW89_CORE_TX_TYPE_DATA;
@@ -833,6 +833,7 @@ rtw89_core_tx_update_mgmt_info(struct rtw89_dev *rtwdev,
 
        desc_info->qsel = qsel;
        desc_info->ch_dma = ch_dma;
+       desc_info->sw_mld = true;
        desc_info->port = desc_info->hiq ? rtwvif_link->port : 0;
        desc_info->mac_id = rtw89_core_tx_get_mac_id(rtwdev, tx_req);
        desc_info->hw_ssn_sel = RTW89_MGMT_HW_SSN_SEL;
@@ -1051,6 +1052,7 @@ rtw89_core_tx_update_data_info(struct rtw89_dev *rtwdev,
        desc_info->ch_dma = ch_dma;
        desc_info->tid_indicate = tid_indicate;
        desc_info->qsel = qsel;
+       desc_info->sw_mld = false;
        desc_info->mac_id = rtw89_core_tx_get_mac_id(rtwdev, tx_req);
        desc_info->port = desc_info->hiq ? rtwvif_link->port : 0;
        desc_info->er_cap = rtwsta_link ? rtwsta_link->er_cap : false;
@@ -1326,7 +1328,7 @@ int rtw89_h2c_tx(struct rtw89_dev *rtwdev,
 static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,
                                    struct rtw89_vif_link *rtwvif_link,
                                    struct rtw89_sta_link *rtwsta_link,
-                                   struct sk_buff *skb, int *qsel, bool sw_mld,
+                                   struct sk_buff *skb, int *qsel,
                                    struct rtw89_tx_wait_info *wait)
 {
        struct ieee80211_sta *sta = rtwsta_link_to_sta_safe(rtwsta_link);
@@ -1341,7 +1343,6 @@ static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,
        tx_req.sta = sta;
        tx_req.rtwvif_link = rtwvif_link;
        tx_req.rtwsta_link = rtwsta_link;
-       tx_req.desc_info.sw_mld = sw_mld;
        tx_req.with_wait = !!wait;
 
        rtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true);
@@ -1387,8 +1388,7 @@ int rtw89_core_tx_write(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
                }
        }
 
-       return rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, qsel, false,
-                                       NULL);
+       return rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, qsel, NULL);
 }
 
 static __le32 rtw89_build_txwd_body0(struct rtw89_tx_desc_info *desc_info)
@@ -4093,8 +4093,7 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt
                goto out;
        }
 
-       ret = rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, &qsel, true,
-                                      wait);
+       ret = rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, &qsel, wait);
        if (ret) {
                rtw89_warn(rtwdev, "nullfunc transmit failed: %d\n", ret);
                dev_kfree_skb_any(skb);