Bitterblue Smith [Thu, 20 Nov 2025 14:13:49 +0000 (16:13 +0200)]
wifi: rtl8xxxu: Enable 40 MHz width by default
40 MHz support is hidden behind the ht40_2g module parameter with
this comment:
/*
* Some APs will negotiate HT20_40 in a noisy environment leading
* to miserable performance. Rather than defaulting to this, only
* enable it if explicitly requested at module load time.
*/
This parameter was added in commit 26f1fad29ad9 ("New driver:
rtl8xxxu (mac80211)"). Back then rtl8xxxu only supported RTL8723AU
and the RTL8192CU family. It's entirely possible the miserable
performance was due to mistakes in the channel switching function,
which were fixed in a previous patch.
Delete the ht40_2g module parameter. If someone still needs to
disable 40 MHz support, cfg80211 has the module parameter
cfg80211_disable_40mhz_24ghz. That works too.
Bitterblue Smith [Thu, 20 Nov 2025 14:10:01 +0000 (16:10 +0200)]
wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
Flip the response rate subchannel. It was backwards, causing low
speeds when using 40 MHz channel width. "iw dev ... station dump"
showed a low RX rate, 11M or less.
Also fix the channel width field of RF6052_REG_MODE_AG.
Tested only with RTL8192CU, but these settings are identical for
RTL8723AU.
Ping-Ke Shih [Thu, 20 Nov 2025 03:10:43 +0000 (11:10 +0800)]
wifi: rtw89: 8852a: correct field mask of reset DAC/ADC FIFO
The field mask should be bits 16-31, but suddenly use wrong bits 24-31,
rarely causing a little performance degraded if DAC/DAC FIFO stays on
an unexpected state.
Found this by Geert who works on bit field functions.
Marco Crivellari [Tue, 18 Nov 2025 10:20:32 +0000 (11:20 +0100)]
wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users
Currently if a user enqueues a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
For more details see the Link tag below.
alloc_workqueue() treats all queues as per-CPU by default, while unbound
workqueues must opt-in via WQ_UNBOUND.
This default is suboptimal: most workloads benefit from unbound queues,
allowing the scheduler to place worker threads where they’re needed and
reducing noise when CPUs are isolated.
This continues the effort to refactor workqueue APIs, which began with
the introduction of new workqueues and a new alloc_workqueue flag in:
commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
This change adds the WQ_UNBOUND flag to explicitly request
alloc_workqueue() to be unbound, because this specific workload has no
benefit being per-cpu.
With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
must now use WQ_PERCPU.
Once migration is complete, WQ_UNBOUND can be removed and unbound will
become the implicit default.
Marco Crivellari [Tue, 18 Nov 2025 10:20:31 +0000 (11:20 +0100)]
wifi: rtlwifi: add WQ_UNBOUND to alloc_workqueue users
Currently if a user enqueues a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
For more details see the Link tag below.
alloc_workqueue() treats all queues as per-CPU by default, while unbound
workqueues must opt-in via WQ_UNBOUND.
This default is suboptimal: most workloads benefit from unbound queues,
allowing the scheduler to place worker threads where they’re needed and
reducing noise when CPUs are isolated.
This continues the effort to refactor workqueue APIs, which began with
the introduction of new workqueues and a new alloc_workqueue flag in:
commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
This change adds the WQ_UNBOUND flag to explicitly request
alloc_workqueue() to be unbound, because this specific workload has no
benefit being per-cpu.
With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
must now use WQ_PERCPU.
Once migration is complete, WQ_UNBOUND can be removed and unbound will
become the implicit default.
Seungjin Bae [Tue, 18 Nov 2025 01:32:59 +0000 (20:32 -0500)]
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
The rtl8187_rx_cb() calculates the rx descriptor header address
by subtracting its size from the skb tail pointer.
However, it does not validate if the received packet
(skb->len from urb->actual_length) is large enough to contain this
header.
If a truncated packet is received, this will lead to a buffer
underflow, reading memory before the start of the skb data area,
and causing a kernel panic.
Add length checks for both rtl8187 and rtl8187b descriptor headers
before attempting to access them, dropping the packet cleanly if the
check fails.
Abdun Nihaal [Fri, 14 Nov 2025 09:45:26 +0000 (15:15 +0530)]
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA
allocations in a loop. When an allocation fails, the previously
successful allocations are not freed on exit.
Fix that by jumping to err_free_rings label on error, which calls
rtl8180_free_rx_ring() to free the allocations. Remove the free of
rx_ring in rtl8180_init_rx_ring() error path, and set the freed
priv->rx_buf entry to null, to avoid double free.
Ping-Ke Shih [Thu, 13 Nov 2025 05:34:59 +0000 (13:34 +0800)]
wifi: rtw89: use separated function to set RX filter
Normally use rtw89_write32_mask() with a consecutive bit mask, but mask of
RX filter B_AX_RX_FLTR_CFG_MASK is bits 31-22 and 15-0, which excludes bits
of B_AX_RX_MPDU_MAX_LEN_MASK (bits 21-16).
Though the original logic is well to set RX filter, change it to a separate
function to avoid the tricky design.
Chih-Kang Chang [Fri, 14 Nov 2025 06:01:27 +0000 (14:01 +0800)]
wifi: rtw89: update format of addr cam H2C command
The addr cam H2C command is to tell firmware the addr related info.
For RTL8922D and RTL8922A after firmware version 0.35.84.0, the addr cam
must be updated with update mode to avoid clearing previously set
fields. Update it accordingly.
Ping-Ke Shih [Fri, 14 Nov 2025 06:01:25 +0000 (14:01 +0800)]
wifi: rtw89: fill addr cam H2C command by struct
The addr cam is used to tell firmware the MAC address and BSSID associated
to connected stations. Use struct instead of macros with pointer arithmetic
to fill the data.
Ping-Ke Shih [Fri, 14 Nov 2025 06:01:24 +0000 (14:01 +0800)]
wifi: rtw89: align RA H2C format v1 for RTL8922A
For RTL8922A, the bits [16:31] of word 3 of v1 format isn't as WiFi 6
chips. Instead, it only needs to fill additional band type and partial
bandwidth ER.
Ping-Ke Shih [Fri, 14 Nov 2025 06:01:23 +0000 (14:01 +0800)]
wifi: rtw89: fw: print band and port where beacon update on
The C2H event of BCN_UPD_DONE is to notify driver that firmware changes
beacon content on certain band/port asked by driver. Print the
notification for debug purpose for now.
Ping-Ke Shih [Fri, 14 Nov 2025 06:01:22 +0000 (14:01 +0800)]
wifi: rtw89: phy: ignore DCFO if not defined in chip_info
For WiFi 7 chips, DCFO (digital carrier frequency offset) feature isn't
supported, so the corresponding registers aren't defined in chip_info.
Check and ignore this feature accordingly.
The existing flow is doing BB pre-init before downloading BB MCU firmware,
because existing chip RTL8922A has BB MCU. However, the coming chips don't
have this, and BB pre-init configuring registers can affect downloading
WiFi-CPU firmware. Therefore, calling BB pre-init afterward for new coming
chips without BB MCU.
For existing WiFi 6 chips, no BB pre-init. For RTL8922A, don't change
the logic.
Ping-Ke Shih [Fri, 14 Nov 2025 06:01:17 +0000 (14:01 +0800)]
wifi: rtw89: mac: separate pre-init code before downloading firmware
Driver needs to initialize registers before downloading firmware, so
move pre-init part (power on) from original rtw89_mac_init(). The
consequence patches will add more pre-init codes before downloading
firmware.
Since rtw89_phy_init_bb_afe() is used by coming RTL8922D, don't change
logic at all for existing chips.
Ping-Ke Shih [Fri, 14 Nov 2025 06:01:16 +0000 (14:01 +0800)]
wifi: rtw89: fw: part size to download firmware by header info
The part size is the unit to download firmware piece by piece. Old chips
use 2020 bytes as a piece, but in new chips the part size is defined in
firmware header. Change to use the value dynamically.
Chih-Kang Chang [Fri, 14 Nov 2025 06:01:15 +0000 (14:01 +0800)]
wifi: rtw89: flush TX queue before deleting key
In the wpa_supplicant rekey flow, it sends an EAPOL packet 4/4 through
nl80211_tx_control_port() and triggers wake_tx_queue() in the driver.
Then, it sends nl80211_new_key() to configure a new key in mac80211.
However, in wake_tx_queue(), a workqueue is used to process the TX packet,
which might cause the driver to process the EAPOL packet later than
nl80211_new_key(). This results in the EAPOL packet 4/4 being transmitted
with the new key and IV, causing it to be dropped by the AP. Therefore,
needs to flush TX queue before deleting the old key to ensure that the
EAPOL 4/4 packet is transmitted using the old key.
Dan Hamik [Wed, 12 Nov 2025 07:04:51 +0000 (07:04 +0000)]
wifi: rtw89: rtw8852bu: Added dev id for ASUS AX57 NANO USB Wifi dongle
Add the USB device ID 0x0b05:0x1cb6 to the rtw8852bu driver to support the
ASUS AX57 Nano WiFi 6 USB adapter.This device uses the same Realtek
RTL8852BU chipset as other supported models.
Tested on: Linux Mint 22 with kernel 6.8.0-87-generic.
The adapter initializes successfully and connects to networks.
Ping-Ke Shih [Tue, 11 Nov 2025 02:24:51 +0000 (10:24 +0800)]
wifi: rtw89: do RF calibration once setting channel when running pure monitor mode
To be able to capture and inject packets in monitor mode, do RF calibration
once setting certain channel. Since calibration costs time, do not change
behavior of normal usage, which do calibration only when starting as AP
or going to connect AP.
Since driver declares IEEE80211_HW_WANT_MONITOR_VIF, the pure monitor vif
must be only one when adding interface with type NL80211_IFTYPE_MONITOR.
Otherwise, monitor vif must be NULL.
Kuan-Chung Chen [Tue, 11 Nov 2025 02:24:49 +0000 (10:24 +0800)]
wifi: rtw89: phy: fix out-of-bounds access in rtw89_phy_read_txpwr_limit()
Coverity reported a potential out-of-bounds access when 'bw' exceeds the
valid range for the specified band. Add a helper `rtw89_bw_is_valid()`
to check bandwidth validity for each band before accessing limit tables.
Ping-Ke Shih [Tue, 11 Nov 2025 02:24:47 +0000 (10:24 +0800)]
wifi: rtw89: debug: add parser to diagnose along DIAG_MAC fw element
The rules to diagnose MAC have a common header, and a cmd field is used
to know the exact command and its format. The rules with the same tuple of
fields {sheet, seq} can be seen as a set of compound rules, which treat
it as positive rule if just one of the rules is positive.
Take EQUALV rules as example, if value of {addr, mask} is equal to
predefined value as field val, a rule is positive. Fields addr_name_offset
and msg_offset are offsets related to textual messages for human readable.
Format of common rule header (8 bytes)
+-------+-----+--------+-----------+-----+---------+
| sheet | cmd | seq[2] | io / band | len | rsvd[2] |
+-------+-----+--------+-----------+-----+---------+
Format of rule command is EQUALV (equal value) (24 bytes):
+------+------------------+------+-----+------------+---------+
| addr | addr_name_offset | mask | val | msg_offset | rsvd[4] |
+------+------------------+------+-----+------------+---------+
Format of message:
+-----+----------+
| len | string[] |
+-----+----------+
An example of output:
Plain(Ignore)/Rules/Positive: 115(4)/86/81
Where, Plain is total rules written in firmware element.
Ignore is the ignored rules, such as USB IO, but current is PCIE.
Rules is number of set of compound rules.
Positive is number of positive Rules.
Ping-Ke Shih [Tue, 11 Nov 2025 02:24:45 +0000 (10:24 +0800)]
wifi: rtw89: pci: add to read PCI configuration space from common code
Normally only access PCI device in pci.c. However for debug purpose,
a set of registers predefined in firmware element including PCI
configuration space should be read for diagnosis.
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:17 +0000 (16:57 +0300)]
wifi: rtw89: process TX wait skbs for USB via C2H handler
TX wait skbs need to be completed when they are done. PCIe part does this
inside rtw89_pci_tx_status() during RPP processing. Other HCIs use a
mechanism based on C2H firmware messages.
Store TX wait skbs inside TX report queue so that it'll be possible to
identify completed items inside the C2H handler. Try to do this as
similar to PCIe path as possible. When the corresponding TX wait skb is
found inside TX report queue, unlink it from there and call
rtw89_core_tx_wait_complete() to mark the completion.
If the callee waiting for the completion has already timed out, the TX
wait skb is placed into TX wait list (like PCIe part does).
It's important that during HCI reset all pending TX wait frames should be
completed inside hci.ops->reset method before calling
rtw89_tx_wait_list_clear().
Found by Linux Verification Center (linuxtesting.org).
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:16 +0000 (16:57 +0300)]
wifi: rtw89: provide TX reports for management frames
In order to provide TX reports for the management queue rtw89 should
configure the firmware. Do this with SET_CMC_TBL_MGQ_RPT_EN() for the
WiFi6 chips and with CCTLINFO_G7_W0_MGQ_RPT_EN flag for the WiFi7 ones.
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:15 +0000 (16:57 +0300)]
wifi: rtw89: handle IEEE80211_TX_CTL_REQ_TX_STATUS frames for USB
Frames flagged with IEEE80211_TX_CTL_REQ_TX_STATUS mean the driver has to
report to mac80211 stack whether AP sent ACK for the null frame/probe
request or not. It's not implemented in USB part of the driver yet.
PCIe HCI has its own way of getting TX status incorporated into RPP
feature, and it's always enabled there. Other HCIs need a different
scheme based on processing C2H messages.
Thus define a .tx_rpt_enabled flag indicating which HCIs need to enable a
TX report feature. Currently it is USB only.
Toggle a bit in the TX descriptor and place flagged skbs in a fix-sized
queue to wait for a message from the firmware. Firmware maintains a 4-bit
sequence number for required frames hence the queue can contain just 16
elements simultaneously. That's enough for normal driver / firmware
communication. If the firmware crashes for any reason and doesn't provide
TX reports in time, driver will handle this and report the obsolete frames
as dropped.
rtw89 also has a new feature providing a TX report for each transmission
attempt. Ignore a failed TX status reported by the firmware until retry
limit is reached or successful status appears. When there is no success
and the retry limit is reached, report the frame up to the wireless stack
as failed eventually.
HCI reset should stop all pending TX activity so forcefully flush the
queue there.
Found by Linux Verification Center (linuxtesting.org).
Ping-Ke Shih [Tue, 4 Nov 2025 13:57:13 +0000 (16:57 +0300)]
wifi: rtw89: fill TX descriptor of FWCMD in shortcut
TX type FWCMD is used to download firmware and send H2C commands, and
it only fill few fields of TX description, such as desc_info->pkt_size.
Therefore, early return the TX type FWCMD.
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:12 +0000 (16:57 +0300)]
wifi: rtw89: implement C2H TX report handler
rtw89 has several ways of handling TX status report events. The first one
is based on RPP feature which is used by PCIe HCI. The other one depends
on firmware sending a corresponding C2H message, quite similar to what
rtw88 has.
Toggle a bit in the TX descriptor to indicate to the firmware that TX
report for the frame is expected. This will allow handling TX wait skbs
and the ones flagged with IEEE80211_TX_CTL_REQ_TX_STATUS correctly.
Do the bulk of the patch according to the vendor driver for RTL8851BU.
However, there are slight differences in C2H message format between
different types of chips. RTL885xB ones follow format V0. RTL8852C has
format V1, and RTL8922AU has format V2.
Found by Linux Verification Center (linuxtesting.org).
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:11 +0000 (16:57 +0300)]
wifi: rtw89: refine rtw89_core_tx_wait_complete()
Pass TX status value directly into rtw89_core_tx_wait_complete(). This
will make it a bit in sync with further patches and will give flexibility
in future work. Also use scope based RCU locking which simplifies the
code of the function.
Found by Linux Verification Center (linuxtesting.org).
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:10 +0000 (16:57 +0300)]
wifi: rtw89: usb: use ieee80211_free_txskb() where appropriate
rtw89_usb_ops_tx_kick_off() may need to release skb if a failure occurs.
It operates mainly on skbs coming from the core wireless stack and the
ones containing firmware commands.
Fedor Pchelkin [Tue, 4 Nov 2025 13:57:09 +0000 (16:57 +0300)]
wifi: rtw89: usb: fix leak in rtw89_usb_write_port()
When there is an attempt to write data and RTW89_FLAG_UNPLUGGED is set,
this means device is disconnected and no urb is submitted. Return
appropriate error code to the caller to properly free the allocated
resources.
Found by Linux Verification Center (linuxtesting.org).
Chin-Yen Lee [Mon, 27 Oct 2025 07:02:59 +0000 (15:02 +0800)]
wifi: rtw88: 8822c: use fixed rate and bandwidth to reply CSI packets
AP could trigger beamform and send NDPA packet with 6Mbps rate
on bandwidth 80MHz, but RTL8822C can't reply CSI packet with
the same setting. Therefore, force to use OFDM rate and
bandwidth 20MHz instead.
wifi: rtw89: 8852c: Fix rtw8852c_pwr_{on,off}_func() for USB
There are a few differences in the power on/off functions between PCIE
and USB. The changes in the power off function in particular are needed
for the RTL8832CU to be able to power on again after it's powered off.
While the RTL8832CU appears to work without the changes in the power on
function, it's probably best to implement them, in case they are needed
in some situations.
wifi: rtw89: usb: Prepare rtw89_usb_ops_mac_post_init() for RTL8852CU
The registers used in rtw89_usb_ops_mac_post_init() are located at
different offsets in RTL8852CU, so move them to struct rtw89_usb_info,
which is filled in each chip's driver.
wifi: rtw89: usb: Prepare rtw89_usb_ops_mac_pre_init() for RTL8852CU
The registers used in rtw89_usb_ops_mac_pre_init() are located at
different offsets in RTL8852CU, so move them to struct rtw89_usb_info,
which is filled in each chip's driver.
wifi: rtw89: usb: Move bulk out map to new struct rtw89_usb_info
RTL8852AU, RTL8852CU, and RTL8922AU will need a different TX channel
to bulk out endpoint mapping, so create a new struct rtw89_usb_info
and move the mapping there. Initialise it in each chip's driver.
Struct rtw89_usb_info will also hold some registers which are located
at different offsets in RTL8852CU compared to the other wifi 6 chips.
RTL8852CU, RTL8852AU, and RTL8922AU need a different mapping of TX
queue to DMA channel compared to their PCI versions, so make
get_ch_dma in struct rtw89_chip_ops an array and add
rtw89_core_get_ch_dma_v2().
Ping-Ke Shih [Sat, 1 Nov 2025 19:19:55 +0000 (21:19 +0200)]
wifi: rtw89: 8832cu: turn off TX partial mode
The TX partial mode in USB devices will cause timeout to wait for payload,
causing SER 0x999 and disconnection. Turn off this mode according to
design suggestion.
Jui-Peng Tsai [Tue, 21 Oct 2025 13:34:02 +0000 (21:34 +0800)]
wifi: rtw89: improve scan time on 6 GHz band
Reduce scan time for all supported channels from 4.4s to 3.5s.
If NL80211_SCAN_FLAG_COLOCATED_6GHZ is set in scan request, only scan PSC
channels and the channels from the RNR element found on the 2.4/5 GHz
channels. When firmware support parsing RNR element from received beacon
or probe response, offload the decision about non-PSC channels to firmware.
Driver do not need to fill non-PSC channels to scan list. If
NL80211_SCAN_FLAG_COLOCATED_6GHZ is not set, scan all supported channels.
Chin-Yen Lee [Tue, 21 Oct 2025 13:34:01 +0000 (21:34 +0800)]
wifi: rtw89: restart hardware to recover firmware if power-save becomes abnormal
Somehow power-save related functions get failure, such as failed to
send null packet, or no response form firmware, and then WiFi will
become unstable. Trigger SER function actively to reset firmware/driver
to recover from abnormal states, including
- firmware failed to ACK for entering PS mode
- firmware failed to ACK for leaving PS mode
- check PS H2C command received by firmware fail
- failed to leave PS state
When operating in 160 MHz, the ADC may oscillate and affect AGC, leading
to unstable RX quality. This issue can be resolved by ensuring proper
RF filter bandwidth switching to avoid ADC oscillation.
Zong-Zhe Yang [Tue, 21 Oct 2025 13:33:59 +0000 (21:33 +0800)]
wifi: rtw89: regd: apply ACPI policy even if country code is programmed
There are regulatory related policy according to BIOS/ACPI configuration,
e.g. distro decides to disable some bands or some channels. Even if chip
has a programmed country code, these policy should still be applied within
regulatory notifier.
Zong-Zhe Yang [Tue, 21 Oct 2025 13:33:58 +0000 (21:33 +0800)]
wifi: rtw89: support EHT rate pattern via bitrate mask
When setting bitrate mask, e.g. using iw set bitrates, there are some
designated patterns to be recognized, called rate pattern. When a rate
pattern is matched, treat the setting as asking a fixed rate. Now, add
support to recognize EHT rates.
Zong-Zhe Yang [Tue, 21 Oct 2025 13:33:57 +0000 (21:33 +0800)]
wifi: rtw89: mlo: handle needed H2C when link switching is requested by stack
To switch link, FW needs H2C commands to indicate which link is on or off.
Originally, these H2C commands are considered only when the link switching
is initiated by driver. But, in some cases, e.g. ml_reconf or TTLM, link
switching would be initiated by stack. Hence, plan these H2C commands into
ieee80211_ops.
Ping-Ke Shih [Tue, 21 Oct 2025 13:33:56 +0000 (21:33 +0800)]
wifi: rtw89: use skb_dequeue() for queued ROC packets to prevent racing
TX task can enqueue ROC skb, but other tasks dequeue the skb. Using
skb_queue_walk_safe() without locking will cause potential racing.
Use skb_dequeue() with lock instead.
Ping-Ke Shih [Tue, 21 Oct 2025 13:33:55 +0000 (21:33 +0800)]
wifi: rtw89: splice C2H events queue to local to prevent racing
RX task enqueues C2H events and fork a C2H work to handle events, but
the work uses skb_queue_walk_safe() without a lock causing potential
racing. Use skb_queue_splice() and its friends with spin_lock to splice
the queue to local, and then still use skb_queue_walk_safe() to iterate
all events.
wifi: rtl8xxxu: Use correct power off sequence for RTL8192CU
RTL8192CU disappears and reappears when rtl8xxxu is unloaded:
usbcore: deregistering interface driver rtl8xxxu
wlp3s0f3u2: deauthenticating from ... by local choice (Reason: 3=DEAUTH_LEAVING)
usb 1-2: rtl8xxxu_active_to_emu: Disabling MAC timed out
usb 1-2: USB disconnect, device number 7
usb 1-2: disconnecting
usb 1-2: new high-speed USB device number 8 using xhci_hcd
usb 1-2: New USB device found, idVendor=0bda, idProduct=8178, bcdDevice= 2.00
usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-2: Product: 802.11n WLAN Adapter
usb 1-2: Manufacturer: Realtek
usb 1-2: SerialNumber: 00e04c000001
This is because rtl8xxxu is using the power off sequence for RTL8723AU.
Add the correct power off sequence for RTL8192CU.
rtl8xxxu_power_off(), rtl8xxxu_active_to_emu(), and
rtl8xxxu_emu_to_disabled() are now only used for RTL8723AU, so move
them to 8723a.c and rename them to have the "rtl8723au" prefix.
wifi: rtl8xxxu: Dump the efuse right after reading it
Someone reported a problem with their TP-Link WN722N (RTL8188EUS):
usb 1-1: This Realtek USB WiFi dongle (0x2357:0x010c) is untested!
usb 1-1: Please report results to Jes.Sorensen@gmail.com
usb 1-1: Fatal - failed to parse EFuse
rtl8xxxu: probe of 1-1:1.0 failed with error -22
This error can happen when the first two bytes of the efuse don't have
the expected magic value of 0x8129. In a situation like this it could
be useful to see the contents of the efuse.
Dump the efuse right after reading it, before trying to parse it.
wifi: rtl8xxxu: Report the signal strength only if it's known
These chips don't report the signal strength for many (any?) data
frames. When the signal strength is not known, set RX_FLAG_NO_SIGNAL_VAL
in order to avoid reporting a signal strength of 0.
Linus Torvalds [Thu, 16 Oct 2025 16:41:21 +0000 (09:41 -0700)]
Merge tag 'net-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from CAN
Current release - regressions:
- udp: do not use skb_release_head_state() before
skb_attempt_defer_free()
- gro_cells: use nested-BH locking for gro_cell
- dpll: zl3073x: increase maximum size of flash utility
Previous releases - regressions:
- core: fix lockdep splat on device unregister
- tcp: fix tcp_tso_should_defer() vs large RTT
- tls:
- don't rely on tx_work during send()
- wait for pending async decryptions if tls_strp_msg_hold fails
- can: j1939: add missing calls in NETDEV_UNREGISTER notification
handler
- eth: lan78xx: fix lost EEPROM write timeout in
lan78xx_write_raw_eeprom
Previous releases - always broken:
- ip6_tunnel: prevent perpetual tunnel growth
- dpll: zl3073x: handle missing or corrupted flash configuration
- can: m_can: fix pm_runtime and CAN state handling
- eth:
- ixgbe: fix too early devlink_free() in ixgbe_remove()
- ixgbevf: fix mailbox API compatibility
- gve: Check valid ts bit on RX descriptor before hw timestamping
- idpf: cleanup remaining SKBs in PTP flows
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H"
* tag 'net-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits)
udp: do not use skb_release_head_state() before skb_attempt_defer_free()
net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
netdevsim: set the carrier when the device goes up
selftests: tls: add test for short splice due to full skmsg
selftests: net: tls: add tests for cmsg vs MSG_MORE
tls: don't rely on tx_work during send()
tls: wait for pending async decryptions if tls_strp_msg_hold fails
tls: always set record_type in tls_process_cmsg
tls: wait for async encrypt in case of error during latter iterations of sendmsg
tls: trim encrypted message to match the plaintext on short splice
tg3: prevent use of uninitialized remote_adv and local_adv variables
MAINTAINERS: new entry for IPv6 IOAM
gve: Check valid ts bit on RX descriptor before hw timestamping
net: core: fix lockdep splat on device unregister
MAINTAINERS: add myself as maintainer for b53
selftests: net: check jq command is supported
net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit()
tcp: fix tcp_tso_should_defer() vs large RTT
r8152: add error handling in rtl8152_driver_init
usbnet: Fix using smp_processor_id() in preemptible code warnings
...
Linus Torvalds [Thu, 16 Oct 2025 16:39:29 +0000 (09:39 -0700)]
Merge tag 'ata-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fix from Niklas Cassel:
- Do not print an error message (and assume that the General Purpose
Log Directory log page is not supported) for a device that reports a
bogus General Purpose Logging Version.
Unsurprisingly, many vendors fail to report the only valid General
Purpose Logging Version (Damien)
* tag 'ata-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-core: relax checks in ata_read_log_directory()
Eric Dumazet [Wed, 15 Oct 2025 05:27:15 +0000 (05:27 +0000)]
udp: do not use skb_release_head_state() before skb_attempt_defer_free()
Michal reported and bisected an issue after recent adoption
of skb_attempt_defer_free() in UDP.
The issue here is that skb_release_head_state() is called twice per skb,
one time from skb_consume_udp(), then a second time from skb_defer_free_flush()
and napi_consume_skb().
As Sabrina suggested, remove skb_release_head_state() call from
skb_consume_udp().
Add a DEBUG_NET_WARN_ON_ONCE(skb_nfct(skb)) in skb_attempt_defer_free()
Many thanks to Michal, Sabrina, Paolo and Florian for their help.
Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()") Reported-and-bisected-by: Michal Kubecek <mkubecek@suse.cz> Closes: https://lore.kernel.org/netdev/gpjh4lrotyephiqpuldtxxizrsg6job7cvhiqrw72saz2ubs3h@g6fgbvexgl3r/ Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Michal Kubecek <mkubecek@suse.cz> Cc: Sabrina Dubroca <sd@queasysnail.net> Cc: Florian Westphal <fw@strlen.de> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/20251015052715.4140493-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Jiawen Wu [Tue, 14 Oct 2025 06:17:25 +0000 (14:17 +0800)]
net: txgbe: optimize the flow to setup PHY for AML devices
To adapt to new firmware for AML devices, the driver should send the
"SET_LINK_CMD" to the firmware only once when switching PHY interface
mode, and no longer needs to re-trigger PHY configuration based on the
RX signal interrupt (TXGBE_GPIOBIT_3).
In previous firmware versions, the PHY was configured only after receiving
"SET_LINK_CMD", and might remain incomplete if the RX signal was lost.
To handle this case, the driver used TXGBE_GPIOBIT_3 interrupt to resend
the command. This workaround is no longer necessary with the new firmware.
And the unknown link speed is permitted in the mailbox buffer.
Recent firmware updates introduce additional fields in the mailbox message
to provide more information for identifying 40G and 100G QSFP modules.
To accommodate these new fields, expand the mailbox buffer size by 4 bytes.
Without this change, drivers built against the updated firmware cannot
properly identify modules due to mismatched mailbox message lengths.
The old firmware version that used the smaller mailbox buffer has never
been publicly released, so there are no backward-compatibility concerns.
net: fbnic: Fix page chunking logic when PAGE_SIZE > 4K
The HW always works on a 4K page size. When the OS supports larger
pages, we fragment them across multiple BDQ descriptors.
We were not properly incrementing the descriptor, which resulted in us
specifying the last chunks id/addr and then 15 zero descriptors. This
would cause packet loss and driver crashes. This is not a fix since the
Kconfig prevents use outside of x86.
I Viswanath [Mon, 13 Oct 2025 18:16:48 +0000 (23:46 +0530)]
net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
dev->chipid is used in lan78xx_init_mac_address before it's initialized:
lan78xx_reset() {
lan78xx_init_mac_address()
lan78xx_read_eeprom()
lan78xx_read_raw_eeprom() <- dev->chipid is used here
dev->chipid = ... <- dev->chipid is initialized correctly here
}
Reorder initialization so that dev->chipid is set before calling
lan78xx_init_mac_address().
Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Khalid Aziz <khalid@kernel.org> Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Jakub Kicinski [Thu, 16 Oct 2025 00:56:20 +0000 (17:56 -0700)]
Merge tag 'linux-can-fixes-for-6.18-20251014' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2025-10-14
The first 2 paches are by Celeste Liu and target the gS_usb driver.
The first patch remove the limitation to 3 CAN interface per USB
device. The second patch adds the missing population of
net_device->dev_port.
The next 4 patches are by me and fix the m_can driver. They add a
missing pm_runtime_disable(), fix the CAN state transition back to
Error Active and fix the state after ifup and suspend/resume.
Another patch by me targets the m_can driver, too and replaces Dong
Aisheng's old email address.
The next 2 patches are by Vincent Mailhol and update the CAN
networking Documentation.
Tetsuo Handa contributes the last patch that add missing cleanup calls
in the NETDEV_UNREGISTER notification handler.
* tag 'linux-can-fixes-for-6.18-20251014' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
can: add Transmitter Delay Compensation (TDC) documentation
can: remove false statement about 1:1 mapping between DLC and length
can: m_can: replace Dong Aisheng's old email address
can: m_can: fix CAN state in system PM
can: m_can: m_can_chip_config(): bring up interface in correct state
can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active
can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
can: gs_usb: gs_make_candev(): populate net_device->dev_port
can: gs_usb: increase max interface to U8_MAX
====================
Lorenzo Bianconi [Mon, 13 Oct 2025 13:58:50 +0000 (15:58 +0200)]
net: airoha: npu: Add airoha_npu_soc_data struct
Introduce airoha_npu_soc_data structure in order to generalize per-SoC
NPU firmware info. Introduce airoha_npu_load_firmware utility routine.
This is a preliminary patch in order to introduce AN7583 NPU support.
====================
Preserve PSE PD692x0 configuration across reboots
Previously, the driver would always reconfigure the PSE hardware on
probe, causing a port matrix reflash that resulted in temporary power
loss to all connected devices. This change maintains power continuity
by preserving existing configuration when the PSE has been previously
initialized.
====================
net: pse-pd: pd692x0: Preserve PSE configuration across reboots
Detect when PSE hardware is already configured (user byte == 42) and
skip hardware initialization to prevent power interruption to connected
devices during system reboots.
Previously, the driver would always reconfigure the PSE hardware on
probe, causing a port matrix reflash that resulted in temporary power
loss to all connected devices. This change maintains power continuity
by preserving existing configuration when the PSE has been previously
initialized.
projects / thirdparty / kernel / linux.git / log
