AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/26 06:47	flow	patch-triage	4m Args: null Results: { "EnableConfigs": [ "RTW89_8922DE", "RTW89_8922AU", "RTW89_8852AU" ], "FocusSymbols": [ "rtw89_chanctx_pause", "rtw89_chanctx_paused", "rtw89_fw_h2c_phy_rfe_type", "rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan", "rtw89_vif_type_mapping", "rtw89_recalc_lps" ], "KMSANReasoning": "The patch modifies the rtw89 driver to add support for P2P_DEVICE interface type, introduces new PHY BB wrap configuration logic, adds a new firmware H2C command (rtw89_fw_h2c_phy_rfe_type), and adds some quirks. \n\nA careful review of the changes shows no uninitialized memory risks:\n1. The new H2C command `rtw89_fw_h2c_phy_rfe_type` allocates an skb using `rtw89_fw_h2c_alloc_skb_with_hdr`. This function internally calls `memset(skb-\u003edata, 0, len)`, ensuring the entire payload buffer is zeroed. The code then sets the `rfe_type` field, leaving the `rsvd` padding bytes safely zeroed before sending it to the firmware.\n2. The new `iqk_info-\u003eiqk_rx_fail` array is properly initialized to false in `_iqk_init` and updated from parsed C2H events.\n3. The new `rtw89_bb_wrap_data` structures are statically defined `const` data, so they are fully initialized at compile time.\n4. Other changes involve control flow updates, macro replacements (`rtw89_for_each_active_rtwvif`), and register writes, none of which expose uninitialized stack or heap memory.\n\nAny potential out-of-bounds accesses or use-after-free bugs in the modified logic would be caught by standard KASAN. There are no uninitialized memory reads or info-leaks that would require a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false, "Reasoning": "The patch modifies the core logic of the rtw89 wireless driver, including channel context pausing, interface type mapping (adding P2P_DEVICE support), and LPS recalculation. It also modifies the rtw8922d chip-specific logic. The core changes are reachable via the mac80211/cfg80211 netlink interface, and the driver can be probed in virtualized environments using USB emulation (e.g., dummy_hcd) for its USB variants (like rtw8922au, rtw8852au). Therefore, the changes are functionally impactful and testable.", "WorthFuzzing": true }
1/1	2026/08/26 06:47	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 136ba4a873ea4bf58f38736a81cc6cf1e6c6be99\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Aug 26 06:47:42 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c\nindex 6f11335b49687..a7ba47bd9abd8 100644\n--- a/drivers/net/wireless/realtek/rtw89/chan.c\n+++ b/drivers/net/wireless/realtek/rtw89/chan.c\n@@ -185,7 +185,7 @@ static void rtw89_chan_update_punctured(struct rtw89_dev rtwdev,\n \tstruct rtw89_vif rtwvif;\n \tunsigned int link_id;\n \n-\trtw89_for_each_rtwvif(rtwdev, rtwvif) {\n+\trtw89_for_each_active_rtwvif(rtwdev, rtwvif) {\n \t\trtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) {\n \t\t\tif (!rtwvif_link-\u003echanctx_assigned \|\|\n \t\t\t rtwvif_link-\u003echanctx_idx != idx)\n@@ -358,10 +358,8 @@ static void rtw89_entity_calculate_weight(struct rtw89_dev rtwdev,\n \t\t\tw-\u003eactive_chanctxs++;\n \t}\n \n-\trtw89_for_each_rtwvif(rtwdev, rtwvif) {\n-\t\tif (rtw89_vif_is_active_role(rtwvif))\n-\t\t\tw-\u003eactive_roles++;\n-\t}\n+\trtw89_for_each_active_rtwvif(rtwdev, rtwvif)\n+\t\tw-\u003eactive_roles++;\n }\n \n static void rtw89_normalize_link_chanctx(struct rtw89_dev rtwdev,\n@@ -527,7 +525,7 @@ static void rtw89_entity_recalc_mlo_dbcc_mode(struct rtw89_dev rtwdev)\n \tmode = rtw89_entity_sel_mlo_dbcc_mode(rtwdev, active_hws);\n \trtwdev-\u003emlo_dbcc_mode = mode;\n \n-\trtw89_debug(rtwdev, RTW89_DBG_STATE, \"recalc mlo dbcc mode to %d\\n\", mode);\n+\trtw89_debug(rtwdev, RTW89_DBG_STATE, \"recalc mlo dbcc mode to 0x%x\\n\", mode);\n }\n \n static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev)\n@@ -553,7 +551,7 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev)\n \t which uses RTW89_CHANCTX_0 to put at position 0 and its designated\n \t * link take RTW89_CHANCTX_0. (normalizing)\n \t /\n-\tlist_for_each_entry(role, \u0026mgnt-\u003eactive_list, mgnt_entry) {\n+\trtw89_for_each_active_rtwvif(rtwdev, role) {\n \t\tfor (i = 0; i \u003c role-\u003elinks_inst_valid_num; i++) {\n \t\t\tlink = rtw89_vif_get_link_inst(role, i);\n \t\t\tif (!link \|\| !link-\u003echanctx_assigned)\n@@ -570,7 +568,7 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev)\n \t}\n \n fill:\n-\tlist_for_each_entry(role, \u0026mgnt-\u003eactive_list, mgnt_entry) {\n+\trtw89_for_each_active_rtwvif(rtwdev, role) {\n \t\tif (unlikely(pos \u003e= RTW89_MAX_INTERFACE_NUM)) {\n \t\t\trtw89_warn(rtwdev,\n \t\t\t\t \"%s: active roles are over max iface num\\n\",\n@@ -3232,6 +3230,9 @@ void rtw89_chanctx_pause(struct rtw89_dev rtwdev,\n \n \tlockdep_assert_wiphy(rtwdev-\u003ehw-\u003ewiphy);\n \n+\tif (test_bit(RTW89_FLAG_LEISURE_PS, rtwdev-\u003eflags))\n+\t\trtw89_warn(rtwdev, \"LPS isn't off when pausing chanctx\\n\");\n+\n \tif (hal-\u003eentity_pause)\n \t\treturn;\n \n@@ -3249,6 +3250,15 @@ void rtw89_chanctx_pause(struct rtw89_dev rtwdev,\n \thal-\u003eentity_pause = true;\n }\n \n+bool rtw89_chanctx_paused(struct rtw89_dev rtwdev)\n+{\n+\tstruct rtw89_hal hal = \u0026rtwdev-\u003ehal;\n+\n+\tlockdep_assert_wiphy(rtwdev-\u003ehw-\u003ewiphy);\n+\n+\treturn hal-\u003eentity_pause;\n+}\n+\n static void rtw89_chanctx_proceed_cb(struct rtw89_dev rtwdev,\n \t\t\t\t const struct rtw89_chanctx_cb_parm parm)\n {\n@@ -3335,7 +3345,7 @@ static void rtw89_swap_chanctx(struct rtw89_dev rtwdev,\n \n \tswap(hal-\u003echanctx[idx1], hal-\u003echanctx[idx2]);\n \n-\trtw89_for_each_rtwvif(rtwdev, rtwvif)\n+\trtw89_for_each_active_rtwvif(rtwdev, rtwvif)\n \t\t__rtw89_swap_chanctx(rtwvif, idx1, idx2);\n \n \tcur = atomic_read(\u0026hal-\u003eroc_chanctx_idx);\ndiff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h\nindex a9a5f1b307a27..f99aca9ef6a44 100644\n--- a/drivers/net/wireless/realtek/rtw89/chan.h\n+++ b/drivers/net/wireless/realtek/rtw89/chan.h\n@@ -185,6 +185,7 @@ void rtw89_query_mr_chanctx_info(struct rtw89_dev rtwdev, u8 inst_idx,\n void rtw89_chanctx_track(struct rtw89_dev rtwdev);\n void rtw89_chanctx_pause(struct rtw89_dev rtwdev,\n \t\t\t const struct rtw89_chanctx_pause_parm parm);\n+bool __must_check rtw89_chanctx_paused(struct rtw89_dev rtwdev);\n void rtw89_chanctx_proceed(struct rtw89_dev rtwdev,\n \t\t\t const struct rtw89_chanctx_cb_parm cb_parm);\n \ndiff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c\nindex 397ebbfcac09a..572d9c65a2dd1 100644\n--- a/drivers/net/wireless/realtek/rtw89/core.c\n+++ b/drivers/net/wireless/realtek/rtw89/core.c\n@@ -167,7 +167,7 @@ static struct ieee80211_rate rtw89_bitrates[] = {\n \n static const struct ieee80211_iface_limit rtw89_iface_limits[] = {\n \t{\n-\t\t.max = 1,\n+\t\t.max = 2,\n \t\t.types = BIT(NL80211_IFTYPE_STATION),\n \t},\n \t{\n@@ -176,6 +176,10 @@ static const struct ieee80211_iface_limit rtw89_iface_limits[] = {\n \t\t\t BIT(NL80211_IFTYPE_P2P_GO) \|\n \t\t\t BIT(NL80211_IFTYPE_AP),\n \t},\n+\t{\n+\t\t.max = 1,\n+\t\t.types = BIT(NL80211_IFTYPE_P2P_DEVICE),\n+\t},\n };\n \n static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = {\n@@ -188,6 +192,10 @@ static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = {\n \t\t.types = BIT(NL80211_IFTYPE_P2P_CLIENT) \|\n \t\t\t BIT(NL80211_IFTYPE_P2P_GO),\n \t},\n+\t{\n+\t\t.max = 1,\n+\t\t.types = BIT(NL80211_IFTYPE_P2P_DEVICE),\n+\t},\n };\n \n static const struct ieee80211_iface_combination rtw89_iface_combs[] = {\n@@ -5496,6 +5504,9 @@ static void rtw89_track_ps_work(struct wiphy wiphy, struct wiphy_work work)\n \tif (rtwdev-\u003escanning)\n \t\treturn;\n \n+\tif (rtw89_chanctx_paused(rtwdev))\n+\t\treturn;\n+\n \tif (rtwdev-\u003elps_enabled \u0026\u0026 !rtwdev-\u003ebtc.btc_ctrl_lps)\n \t\trtw89_enter_lps_track(rtwdev, RTW89_TFC_INTERVAL_100MS);\n }\n@@ -5521,6 +5532,9 @@ static void rtw89_track_work(struct wiphy wiphy, struct wiphy_work work)\n \tif (rtwdev-\u003escanning)\n \t\treturn;\n \n+\tif (rtw89_chanctx_paused(rtwdev))\n+\t\treturn;\n+\n \trtw89_leave_lps(rtwdev);\n \n \tif (tfc_changed) {\n@@ -5691,6 +5705,7 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc)\n \t\telse\n \t\t\trtwvif_link-\u003ewifi_role = RTW89_WIFI_ROLE_AP;\n \t\tbreak;\n+\tRTW89_TYPE_MAPPING(P2P_DEVICE);\n \tRTW89_TYPE_MAPPING(ADHOC);\n \tRTW89_TYPE_MAPPING(MONITOR);\n \tRTW89_TYPE_MAPPING(MESH_POINT);\n@@ -5724,6 +5739,10 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc)\n \t\trtwvif_link-\u003eself_role = RTW89_SELF_ROLE_CLIENT;\n \t\trtwvif_link-\u003eaddr_cam.sec_ent_mode = RTW89_ADDR_CAM_SEC_NORMAL;\n \t\tbreak;\n+\tcase NL80211_IFTYPE_P2P_DEVICE:\n+\t\trtwvif_link-\u003enet_type = RTW89_NET_TYPE_NO_LINK;\n+\t\trtwvif_link-\u003eself_role = RTW89_SELF_ROLE_CLIENT;\n+\t\tbreak;\n \tcase NL80211_IFTYPE_MONITOR:\n \t\tbreak;\n \tdefault:\n@@ -7517,7 +7536,8 @@ static int rtw89_core_register_hw(struct rtw89_dev rtwdev)\n \thw-\u003ewiphy-\u003einterface_modes = BIT(NL80211_IFTYPE_STATION) \|\n \t\t\t\t BIT(NL80211_IFTYPE_AP) \|\n \t\t\t\t BIT(NL80211_IFTYPE_P2P_CLIENT) \|\n-\t\t\t\t BIT(NL80211_IFTYPE_P2P_GO);\n+\t\t\t\t BIT(NL80211_IFTYPE_P2P_GO) \|\n+\t\t\t\t BIT(NL80211_IFTYPE_P2P_DEVICE);\n \n \tif (hal-\u003eant_diversity) {\n \t\thw-\u003ewiphy-\u003eavailable_antennas_tx = 0x3;\ndiff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h\nindex 2b21d969ece7b..83554a2c87323 100644\n--- a/drivers/net/wireless/realtek/rtw89/core.h\n+++ b/drivers/net/wireless/realtek/rtw89/core.h\n@@ -6340,7 +6340,7 @@ enum rtw89_entity_mode {\n \tRTW89_ENTITY_MODE_UNHANDLED = -ESRCH,\n };\n \n-#define RTW89_MAX_INTERFACE_NUM 2\n+#define RTW89_MAX_INTERFACE_NUM 3\n \n / only valid when running with chanctx_ops /\n struct rtw89_entity_mgnt {\n@@ -6463,8 +6463,10 @@ enum rtw89_quirks {\n \tRTW89_QUIRK_PCI_BER,\n \tRTW89_QUIRK_THERMAL_PROT_120C,\n \tRTW89_QUIRK_THERMAL_PROT_110C,\n+\tRTW89_QUIRK_THERMAL_PROT_VCORE,\n \tRTW89_QUIRK_HW_INFO_SYSFS,\n \tRTW89_QUIRK_DISABLE_2GHZ,\n+\tRTW89_QUIRK_LOW_LATENCY,\n \n \tNUM_OF_RTW89_QUIRKS,\n };\n@@ -6479,6 +6481,7 @@ enum rtw89_custid {\n \tRTW89_CUSTID_AMD = 6,\n \tRTW89_CUSTID_FUJITSU = 7,\n \tRTW89_CUSTID_DELL = 8,\n+\tRTW89_CUSTID_VALVE, / driver only /\n };\n \n enum rtw89_pkt_drop_sel {\ndiff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c\nindex 7e640c7166e4d..2417381bca1cd 100644\n--- a/drivers/net/wireless/realtek/rtw89/debug.c\n+++ b/drivers/net/wireless/realtek/rtw89/debug.c\n@@ -5463,12 +5463,11 @@ rtw89_debug_priv_diag_rf_get(struct rtw89_dev rtwdev,\n \n static void rtw89_dbg_diag_rf_set_rfk(struct rtw89_dev rtwdev)\n {\n-\tstruct rtw89_entity_mgnt mgnt = \u0026rtwdev-\u003ehal.entity_mgnt;\n \tstruct rtw89_vif_link rtwvif_link;\n \tstruct rtw89_vif rtwvif;\n \tunsigned int link_id;\n \n-\tlist_for_each_entry(rtwvif, \u0026mgnt-\u003eactive_list, mgnt_entry)\n+\trtw89_for_each_active_rtwvif(rtwdev, rtwvif)\n \t\trtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)\n \t\t\trtw89_chip_rfk_channel(rtwdev, rtwvif_link);\n }\ndiff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c\nindex 0099c5c03e7a6..fd721c971ba3e 100644\n--- a/drivers/net/wireless/realtek/rtw89/fw.c\n+++ b/drivers/net/wireless/realtek/rtw89/fw.c\n@@ -3535,6 +3535,46 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev,\n \treturn ret;\n }\n \n+int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev)\n+{\n+\tconst struct rtw89_chip_info chip = rtwdev-\u003echip;\n+\tstruct rtw89_efuse efuse = \u0026rtwdev-\u003eefuse;\n+\tstruct rtw89_h2c_phy_rfe_type h2c;\n+\tu32 len = sizeof(h2c);\n+\tstruct sk_buff skb;\n+\tint ret;\n+\n+\tif (chip-\u003echip_id != RTL8922D)\n+\t\treturn 0;\n+\n+\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\n+\tif (!skb) {\n+\t\trtw89_err(rtwdev, \"failed to alloc skb for h2c phy_rfe_type\\n\");\n+\t\treturn -ENOMEM;\n+\t}\n+\tskb_put(skb, len);\n+\th2c = (struct rtw89_h2c_phy_rfe_type )skb-\u003edata;\n+\n+\th2c-\u003erfe_type = efuse-\u003erfe_type;\n+\n+\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\n+\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM,\n+\t\t\t H2C_FUNC_FW_RFE_TYPE, 0, 0, len);\n+\n+\tret = rtw89_h2c_tx(rtwdev, skb, false);\n+\tif (ret) {\n+\t\trtw89_err(rtwdev, \"failed to send h2c\\n\");\n+\t\tgoto fail;\n+\t}\n+\n+\treturn 0;\n+fail:\n+\tdev_kfree_skb_any(skb);\n+\n+\treturn ret;\n+}\n+EXPORT_SYMBOL(rtw89_fw_h2c_phy_rfe_type);\n+\n #define H2C_P2P_ACT_LEN 20\n int rtw89_fw_h2c_p2p_act(struct rtw89_dev rtwdev,\n \t\t\t struct rtw89_vif_link rtwvif_link,\n@@ -10271,7 +10311,6 @@ static void rtw89_hw_scan_update_link_beacon_noa(struct rtw89_dev rtwdev,\n \n static void rtw89_hw_scan_update_beacon_noa(struct rtw89_dev rtwdev, bool scan)\n {\n-\tconst struct rtw89_entity_mgnt mgnt = \u0026rtwdev-\u003ehal.entity_mgnt;\n \tconst struct rtw89_hw_scan_info scan_info = \u0026rtwdev-\u003escan_info;\n \tconst struct rtw89_chip_info chip = rtwdev-\u003echip;\n \tstruct rtw89_mac_chinfo_ax chinfo_ax;\n@@ -10311,7 +10350,7 @@ static void rtw89_hw_scan_update_beacon_noa(struct rtw89_dev rtwdev, bool scan)\n \t}\n \n update:\n-\tlist_for_each_entry(rtwvif, \u0026mgnt-\u003eactive_list, mgnt_entry) {\n+\trtw89_for_each_active_rtwvif(rtwdev, rtwvif) {\n \t\tunsigned int link_id;\n \n \t\tvif = rtwvif_to_vif(rtwvif);\n@@ -10328,7 +10367,6 @@ static void rtw89_hw_scan_set_extra_op_info(struct rtw89_dev rtwdev,\n \t\t\t\t\t struct rtw89_vif scan_rtwvif,\n \t\t\t\t\t const struct rtw89_chan scan_op)\n {\n-\tstruct rtw89_entity_mgnt mgnt = \u0026rtwdev-\u003ehal.entity_mgnt;\n \tstruct rtw89_hw_scan_info scan_info = \u0026rtwdev-\u003escan_info;\n \tstruct rtw89_hw_scan_extra_op ext = \u0026scan_info-\u003eextra_op;\n \tstruct rtw89_vif tmp;\n@@ -10337,7 +10375,7 @@ static void rtw89_hw_scan_set_extra_op_info(struct rtw89_dev rtwdev,\n \tif (!RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD_EXTRA_OP, \u0026rtwdev-\u003efw))\n \t\treturn;\n \n-\tlist_for_each_entry(tmp, \u0026mgnt-\u003eactive_list, mgnt_entry) {\n+\trtw89_for_each_active_rtwvif(rtwdev, tmp) {\n \t\tconst struct rtw89_chan tmp_chan;\n \t\tstruct rtw89_vif_link tmp_link;\n \ndiff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h\nindex 375ca0a243a65..f7d017d3ced08 100644\n--- a/drivers/net/wireless/realtek/rtw89/fw.h\n+++ b/drivers/net/wireless/realtek/rtw89/fw.h\n@@ -2101,6 +2101,11 @@ struct rtw89_h2c_lps_ml_cmn_info_v1 {\n \tstruct rtw89_bb_link_info_rx_gain rx_gain[RTW89_BB_PS_LINK_BUF_MAX];\n } __packed;\n \n+struct rtw89_h2c_phy_rfe_type {\n+\tu8 rfe_type;\n+\tu8 rsvd[3];\n+} __packed;\n+\n struct rtw89_h2c_trig_cpu_except {\n \t__le32 w0;\n } __packed;\n@@ -4886,6 +4891,7 @@ enum rtw89_mrc_h2c_func {\n #define H2C_FUNC_FW_MCC_DIG\t\t0x6\n #define H2C_FUNC_FW_LPS_CH_INFO\t\t0xb\n #define H2C_FUNC_FW_LPS_ML_CMN_INFO\t0xe\n+#define H2C_FUNC_FW_RFE_TYPE\t\t0x1b\n \n #define H2C_CL_OUTSRC_RF_REG_A\t\t0x8\n #define H2C_CL_OUTSRC_RF_REG_B\t\t0x9\n@@ -5568,6 +5574,7 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev,\n \t\t\t\t struct rtw89_vif rtwvif);\n int rtw89_fw_h2c_fwips(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n \t\t bool enable);\n+int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev);\n struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len);\n struct sk_buff rtw89_fw_h2c_alloc_skb_no_hdr(struct rtw89_dev rtwdev, u32 len);\n int rtw89_fw_msg_reg(struct rtw89_dev rtwdev,\ndiff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c\nindex c78107e922063..cd56f9164cf41 100644\n--- a/drivers/net/wireless/realtek/rtw89/phy.c\n+++ b/drivers/net/wireless/realtek/rtw89/phy.c\n@@ -3345,7 +3345,8 @@ static void __rtw89_phy_c2h_ra_rpt_iter(struct rtw89_sta_link rtwsta_link,\n \t\tchanged = true;\n \t}\n \n-\trtwsta_link-\u003emax_agg_wait = link_sta-\u003eagg.max_rc_amsdu_len / 1500 - 1;\n+\tif (!test_bit(RTW89_QUIRK_LOW_LATENCY, rtwdev-\u003equirks))\n+\t\trtwsta_link-\u003emax_agg_wait = link_sta-\u003eagg.max_rc_amsdu_len / 1500 - 1;\n }\n \n static void rtw89_phy_c2h_ra_rpt_iter(void data, struct ieee80211_sta sta)\n@@ -3574,6 +3575,8 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev,\n \t\t\t \"[IQK] iqk-\u003efwk_status = %x\\n\", iqk-\u003efwk_status);\n \n \t\tfor (i = 0; i \u003c 2; i++) {\n+\t\t\tstruct rtw89_iqk_info iqk_info = \u0026rtwdev-\u003eiqk;\n+\n \t\t\trtw89_debug(rtwdev, RTW89_DBG_RFK,\n \t\t\t\t \"[IQK] ======== Path %x ========\\n\", i);\n \t\t\trtw89_debug(rtwdev, RTW89_DBG_RFK, \"[IQK] iqk-\u003eiqk_band[%d] = %x\\n\",\n@@ -3592,6 +3595,9 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev,\n \t\t\t\t i, iqk-\u003eiqk_tx_fail[i]);\n \t\t\trtw89_debug(rtwdev, RTW89_DBG_RFK, \"[IQK] iqk-\u003eiqk_rx_fail[%d] = %x\\n\",\n \t\t\t\t i, iqk-\u003eiqk_rx_fail[i]);\n+\n+\t\t\tiqk_info-\u003eiqk_rx_fail[0][i] = iqk-\u003eiqk_rx_fail[i];\n+\n \t\t\tfor (j = 0; j \u003c 6; j++)\n \t\t\t\trtw89_debug(rtwdev, RTW89_DBG_RFK,\n \t\t\t\t\t \"[IQK] iqk-\u003erftxgain[%d][%d] = %x\\n\",\ndiff --git a/drivers/net/wireless/realtek/rtw89/phy.h b/drivers/net/wireless/realtek/rtw89/phy.h\nindex 0963cdfb15949..7bbda2ba5b5c8 100644\n--- a/drivers/net/wireless/realtek/rtw89/phy.h\n+++ b/drivers/net/wireless/realtek/rtw89/phy.h\n@@ -631,8 +631,19 @@ struct rtw89_bb_wrap_common_data {\n \t\t} cim3k;\n \t\tu32 rfsi_ct_opt[2];\n \t\tu8 pb_tb;\n+\t\tu8 qam_th[3];\n \t} bands[RFSI_CTRL_BAND_NUM];\n-\tu8 qam_th[6];\n+};\n+\n+struct rtw89_bb_wrap_common_data_gen2 {\n+\tstruct {\n+\t\tu8 mdpd_160m;\n+\t\tu8 mdpd_320m;\n+\t\tu8 oob_dpd_20m;\n+\t\tu8 oob_dpd_40m;\n+\t\tu8 oob_dpd_80m;\n+\t\tu8 cim3k;\n+\t} qam_th;\n };\n \n struct rtw89_bb_wrap_common_data_gen3 {\n@@ -644,6 +655,7 @@ struct rtw89_bb_wrap_common_data_gen3 {\n \n struct rtw89_bb_wrap_data {\n \tconst struct rtw89_bb_wrap_common_data common;\n+\tconst struct rtw89_bb_wrap_common_data_gen2 common_gen2;\n \tconst struct rtw89_bb_wrap_common_data_gen3 common_gen3;\n \tstruct {\n \t\tu16 qam_comp_th0[MAX_TX_RFSI_CTRL_OPT];\n@@ -1039,9 +1051,9 @@ static inline void rtw89_phy_bb_wrap_init(struct rtw89_dev rtwdev)\n \t\tphy-\u003ebb_wrap_init(rtwdev);\n }\n \n-void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev,\n-\t\t\t\t enum rtw89_rfsi_ctrl_band ctrl_band,\n-\t\t\t\t enum rtw89_phy_idx phy_idx);\n+void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n+\t\t\t\t\t\t u8 mac_idx);\n void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev,\n \t\t\t\t\t const struct rtw89_chan chan,\n \t\t\t\t\t enum rtw89_phy_idx phy_idx);\ndiff --git a/drivers/net/wireless/realtek/rtw89/phy_be.c b/drivers/net/wireless/realtek/rtw89/phy_be.c\nindex c06927d1dc781..b94754d386737 100644\n--- a/drivers/net/wireless/realtek/rtw89/phy_be.c\n+++ b/drivers/net/wireless/realtek/rtw89/phy_be.c\n@@ -682,9 +682,9 @@ static u32 rtw89_phy_bb_wrap_be_bandedge_decision(struct rtw89_dev rtwdev,\n \treturn val;\n }\n \n-void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev,\n-\t\t\t\t enum rtw89_rfsi_ctrl_band rfsi_band,\n-\t\t\t\t enum rtw89_phy_idx phy_idx)\n+static void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev,\n+\t\t\t\t\t const struct rtw89_chan chan,\n+\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n {\n \tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n \tconst u32 val;\n@@ -693,15 +693,14 @@ void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev,\n \tif (!d \|\| !d-\u003ecommon)\n \t\treturn;\n \n-\tval = d-\u003ecommon-\u003ebands[rfsi_band].rfsi_ct_opt;\n+\tval = d-\u003ecommon-\u003ebands[chan-\u003erfsi_band].rfsi_ct_opt;\n \n-\treg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_0_BE4, phy_idx);\n+\treg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_0_BE4, mac_idx);\n \trtw89_write32(rtwdev, reg, val[0]);\n \n-\treg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_8_BE4, phy_idx);\n+\treg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_8_BE4, mac_idx);\n \trtw89_write32(rtwdev, reg, val[1]);\n }\n-EXPORT_SYMBOL(rtw89_phy_bb_wrap_set_rfsi_ct_opt);\n \n void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev,\n \t\t\t\t\t const struct rtw89_chan chan,\n@@ -733,6 +732,7 @@ void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev,\n EXPORT_SYMBOL(rtw89_phy_bb_wrap_set_rfsi_bandedge_ch);\n \n static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n \t\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n {\n \tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n@@ -741,9 +741,9 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev,\n \tif (!d \|\| !d-\u003ecommon)\n \t\treturn;\n \n-\tth0 = d-\u003ecommon-\u003eqam_th[0];\n-\tth1 = d-\u003ecommon-\u003eqam_th[1];\n-\tth2 = d-\u003ecommon-\u003eqam_th[2];\n+\tth0 = d-\u003ecommon-\u003ebands[chan-\u003erfsi_band].qam_th[0];\n+\tth1 = d-\u003ecommon-\u003ebands[chan-\u003erfsi_band].qam_th[1];\n+\tth2 = d-\u003ecommon-\u003ebands[chan-\u003erfsi_band].qam_th[2];\n \n \t/ TH0 /\n \trtw89_write32_idx(rtwdev, R_QAM_TH0_BE4, B_QAM_TH0_0_BE4, th0, mac_idx);\n@@ -772,6 +772,26 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_2_BE4, th2, mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_5_BE4, th2, mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_8_BE4, th2, mac_idx);\n+}\n+\n+static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen2_init(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n+{\n+\tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n+\tconst struct rtw89_bb_wrap_common_data_gen2 common_gen2;\n+\tu8 th0, th2, th3, th4, th5;\n+\n+\tif (!d \|\| !d-\u003ecommon_gen2)\n+\t\treturn;\n+\n+\tcommon_gen2 = d-\u003ecommon_gen2;\n+\tth0 = common_gen2-\u003eqam_th.mdpd_160m;\n+\t/ th1 (MDPD 320M) has no RTL8922D wrapper register /\n+\tth2 = common_gen2-\u003eqam_th.oob_dpd_20m;\n+\tth3 = common_gen2-\u003eqam_th.oob_dpd_40m;\n+\tth4 = common_gen2-\u003eqam_th.oob_dpd_80m;\n+\tth5 = common_gen2-\u003eqam_th.cim3k;\n+\n \t/ DPD 160M /\n \trtw89_write32_idx(rtwdev, R_DPD_DBW160_TH0_BE4, B_DPD_DBW160_TH0_0_BE4, th0, mac_idx);\n \trtw89_write32_idx(rtwdev, R_DPD_DBW160_TH0_BE4, B_DPD_DBW160_TH0_1_BE4, th0, mac_idx);\n@@ -782,34 +802,34 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_DPD_DBW160_TH1_BE4, B_DPD_DBW160_TH1_6_BE4, th0, mac_idx);\n \trtw89_write32_idx(rtwdev, R_DPD_DBW160_TH1_BE4, B_DPD_DBW160_TH1_7_BE4, th0, mac_idx);\n \t/* DPD 20M /\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_0_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_1_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_2_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_3_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_4_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_5_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_6_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH1_7_BE4, 0x2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_0_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_1_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_2_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_3_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_4_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_5_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_6_BE4, th2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH1_7_BE4, th2, mac_idx);\n \t/ DPD 40M /\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_0_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_1_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_2_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_3_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_4_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_3_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_4_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_5_BE4, 0x2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_0_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_1_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_2_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_3_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_4_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_5_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_6_BE4, th3, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_7_BE4, th3, mac_idx);\n \t/ DPD 80M /\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW80_TH1_0_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_1_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_2_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_3_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_4_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_5_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_6_BE4, 0x2, mac_idx);\n-\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_7_BE4, 0x2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW80_TH1_0_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_1_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_2_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_3_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_4_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_5_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_6_BE4, th4, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_7_BE4, th4, mac_idx);\n \t/ CIM3K /\n-\trtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH2_BE4, 0x2, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH2_BE4, th5, mac_idx);\n }\n \n static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(struct rtw89_dev rtwdev,\n@@ -882,13 +902,14 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(struct rtw89_dev rt\n }\n \n static void rtw89_phy_bb_wrap_tx_rfsi_scenario_def(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n \t\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n {\n \tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n \tu8 pb_tb = 0;\n \n \tif (d \u0026\u0026 d-\u003ecommon)\n-\t\tpb_tb = d-\u003ecommon-\u003ebands[0].pb_tb;\n+\t\tpb_tb = d-\u003ecommon-\u003ebands[chan-\u003erfsi_band].pb_tb;\n \n \trtw89_write32_idx(rtwdev, R_RFSI_CT_DEF_BE4, B_RFSI_CT_ER_BE4, 0x0, mac_idx);\n \trtw89_write32_idx(rtwdev, R_RFSI_CT_DEF_BE4, B_RFSI_CT_SUBF_BE4, 0x0, mac_idx);\n@@ -905,15 +926,16 @@ static void rtw89_phy_bb_wrap_tx_rfsi_scenario_def(struct rtw89_dev rtwdev,\n }\n \n static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n \t\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n {\n \tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n \tconst u16 th;\n \n-\tif (!d \|\| !d-\u003ecommon)\n+\tif (!d)\n \t\treturn;\n \n-\tth = d-\u003ebands[0].qam_comp_th0;\n+\tth = d-\u003ebands[chan-\u003erfsi_band].qam_comp_th0;\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKLWORD, th[0], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKHWORD, th[1], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKLWORD, th[2], mac_idx);\n@@ -923,7 +945,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKLWORD, th[6], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKHWORD, th[7], mac_idx);\n \n-\tth = d-\u003ebands[0].qam_comp_th1;\n+\tth = d-\u003ebands[chan-\u003erfsi_band].qam_comp_th1;\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_L, th[0], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_M, th[1], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_H, th[2], mac_idx);\n@@ -933,7 +955,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_L, th[6], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_M, th[7], mac_idx);\n \n-\tth = d-\u003ebands[0].qam_comp_th2;\n+\tth = d-\u003ebands[chan-\u003erfsi_band].qam_comp_th2;\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2L, th[0], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2M, th[1], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2H, th[2], mac_idx);\n@@ -943,7 +965,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_2L, th[6], mac_idx);\n \trtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_2M, th[7], mac_idx);\n \n-\tth = d-\u003ebands[0].qam_comp_ow;\n+\tth = d-\u003ebands[chan-\u003erfsi_band].qam_comp_ow;\n \trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKLWORD, th[0], mac_idx);\n \trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKHWORD, th[1], mac_idx);\n \trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKLWORD, th[2], mac_idx);\n@@ -954,7 +976,46 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKHWORD, th[7], mac_idx);\n }\n \n+static void rtw89_phy_trig_spect_tx_shape_disabled(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n+\t\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n+{\n+\tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n+\tu8 band = chan-\u003eband_type;\n+\tu8 tx_shape_idx;\n+\n+\t/\n+\t Only needed by chips with d-\u003ebands[].{qam_comp_th0, qam_comp_ow} as\n+\t * what rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val() does.\n+\t /\n+\tif (!d)\n+\t\treturn;\n+\n+\ttx_shape_idx = rtw89_get_tx_shape_idx(rtwdev, band, RTW89_RS_OFDM);\n+\tif (tx_shape_idx)\n+\t\treturn;\n+\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx);\n+\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx);\n+}\n+\n static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n \t\t\t\t\t\t enum rtw89_mac_idx mac_idx)\n {\n \tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n@@ -963,7 +1024,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \tif (!d)\n \t\treturn;\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[0];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[0];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK2_BE4, th, mac_idx);\n@@ -973,7 +1034,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[1];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[1];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK2_BE4, th, mac_idx);\n@@ -983,7 +1044,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[2];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[2];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH2_BE4, th, mac_idx);\n@@ -993,7 +1054,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[3];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[3];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH2_BE4, th, mac_idx);\n@@ -1003,7 +1064,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[4];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[4];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH2_BE4, th, mac_idx);\n@@ -1013,7 +1074,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[5];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[5];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW2_BE4, th, mac_idx);\n@@ -1023,7 +1084,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[6];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[6];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW2_BE4, th, mac_idx);\n@@ -1033,7 +1094,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev,\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW6_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW7_BE4, th, mac_idx);\n \n-\tth = d-\u003ebands[0].oob_dpd_by_cbw[7];\n+\tth = d-\u003ebands[chan-\u003erfsi_band].oob_dpd_by_cbw[7];\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW0_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW1_BE4, th, mac_idx);\n \trtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW2_BE4, th, mac_idx);\n@@ -1075,6 +1136,7 @@ static void rtw89_phy_bb_set_mdpd_qam_comp_val(struct rtw89_dev rtwdev,\n }\n \n static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev,\n+\t\t\t\t const struct rtw89_chan chan,\n \t\t\t\t enum rtw89_mac_idx mac_idx)\n {\n \tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n@@ -1083,7 +1145,7 @@ static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev,\n \tif (!d \|\| !d-\u003ecommon)\n \t\treturn;\n \n-\tp = \u0026d-\u003ecommon-\u003ebands[0].cim3k;\n+\tp = \u0026d-\u003ecommon-\u003ebands[chan-\u003erfsi_band].cim3k;\n \n \trtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH_BE4, p-\u003eth, mac_idx);\n \trtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_OW_BE4, p-\u003eow, mac_idx);\n@@ -1097,6 +1159,14 @@ static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev,\n \n \trtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_SU_FORCE_EN, 1, mac_idx);\n \trtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_SU_FORCE_VAL, 0, mac_idx);\n+\n+\tif (rtwdev-\u003ehal.cid == RTL8922D_CID7025)\n+\t\treturn;\n+\n+\trtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU26_FORCE_EN, 1, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU26_FORCE_VAL, 0, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU52_FORCE_EN, 1, mac_idx);\n+\trtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU52_FORCE_VAL, 1, mac_idx);\n }\n \n static void rtw89_phy_bb_set_cck_cfir_filter_val_gen3(struct rtw89_dev rtwdev,\n@@ -1146,17 +1216,26 @@ static void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init(struct rtw89_dev rtwdev,\n \trtw89_entity_get_conf(rtwdev, \u0026conf);\n \tchan = conf.chans[phy_idx];\n \n-\trtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(rtwdev, mac_idx);\n+\trtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(rtwdev, chan, mac_idx);\n+}\n+\n+void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev,\n+\t\t\t\t\t\t const struct rtw89_chan chan,\n+\t\t\t\t\t\t u8 mac_idx)\n+{\n+\trtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(rtwdev, chan, mac_idx);\n+\trtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen2_init(rtwdev, mac_idx);\n \trtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(rtwdev, chan, mac_idx);\n-\trtw89_phy_bb_wrap_tx_rfsi_scenario_def(rtwdev, mac_idx);\n-\trtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(rtwdev, mac_idx);\n-\trtw89_phy_bb_set_oob_dpd_qam_comp_val(rtwdev, mac_idx);\n+\trtw89_phy_bb_wrap_tx_rfsi_scenario_def(rtwdev, chan, mac_idx);\n+\trtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(rtwdev, chan, mac_idx);\n+\trtw89_phy_trig_spect_tx_shape_disabled(rtwdev, chan, mac_idx);\n+\trtw89_phy_bb_set_oob_dpd_qam_comp_val(rtwdev, chan, mac_idx);\n \trtw89_phy_bb_set_mdpd_qam_comp_val(rtwdev, mac_idx);\n-\trtw89_phy_bb_set_cim3k_val(rtwdev, mac_idx);\n+\trtw89_phy_bb_set_cim3k_val(rtwdev, chan, mac_idx);\n \trtw89_phy_bb_set_cck_cfir_filter_val_gen3(rtwdev, mac_idx);\n-\trtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, 0, phy_idx);\n-\trtw89_phy_bb_wrap_set_rfsi_bandedge_ch(rtwdev, chan, phy_idx);\n+\trtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, chan, mac_idx);\n }\n+EXPORT_SYMBOL(rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan);\n \n static void rtw89_phy_bb_wrap_ul_pwr(struct rtw89_dev rtwdev)\n {\ndiff --git a/drivers/net/wireless/realtek/rtw89/ps.c b/drivers/net/wireless/realtek/rtw89/ps.c\nindex 31bb5dcd284ae..23a9c7a0704a7 100644\n--- a/drivers/net/wireless/realtek/rtw89/ps.c\n+++ b/drivers/net/wireless/realtek/rtw89/ps.c\n@@ -363,15 +363,12 @@ void rtw89_recalc_lps(struct rtw89_dev rtwdev)\n {\n \tstruct ieee80211_vif vif, found_vif = NULL;\n \tstruct rtw89_vif rtwvif;\n-\tenum rtw89_entity_mode mode;\n \tint count = 0;\n \n-\tmode = rtw89_get_entity_mode(rtwdev);\n-\tif (mode == RTW89_ENTITY_MODE_MCC)\n-\t\tgoto disable_lps;\n-\n \trtw89_for_each_rtwvif(rtwdev, rtwvif) {\n \t\tvif = rtwvif_to_vif(rtwvif);\n+\t\tif (vif-\u003etype == NL80211_IFTYPE_P2P_DEVICE)\n+\t\t\tcontinue;\n \n \t\tif (vif-\u003etype != NL80211_IFTYPE_STATION) {\n \t\t\tcount = 0;\n@@ -387,7 +384,6 @@ void rtw89_recalc_lps(struct rtw89_dev rtwdev)\n \t\treturn;\n \t}\n \n-disable_lps:\n \trtw89_leave_lps(rtwdev);\n \trtwdev-\u003elps_enabled = false;\n }\ndiff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h\nindex abeeb61007dce..4291e8115f105 100644\n--- a/drivers/net/wireless/realtek/rtw89/reg.h\n+++ b/drivers/net/wireless/realtek/rtw89/reg.h\n@@ -10696,6 +10696,10 @@\n #define B_FBTB_CT_FTM_BE4 GENMASK(23, 20)\n #define B_FBTB_CT_SENS_BE4 GENMASK(27, 24)\n #define R_CIM3K_SU_FORCE 0x119F8\n+#define B_CIM3K_RU26_FORCE_EN BIT(13)\n+#define B_CIM3K_RU26_FORCE_VAL BIT(14)\n+#define B_CIM3K_RU52_FORCE_EN BIT(15)\n+#define B_CIM3K_RU52_FORCE_VAL BIT(16)\n #define B_CIM3K_SU_FORCE_EN BIT(17)\n #define B_CIM3K_SU_FORCE_VAL BIT(18)\n #define R_QAM3_TH0_BE4 0x119FC\n@@ -11068,13 +11072,17 @@\n #define B_KTBL0_RST BIT(31)\n #define R_CFIR_CTRL_A_BE4 0x38124\n #define R_CFIR_CTRL_B_BE4 0x38224\n+#define B_CFIR_CTRL_RXKIDX0_EN BIT(0)\n #define B_CFIR_CTRL_KIDX0_EN BIT(8)\n+#define B_CFIR_CTRL_RXKIDX1_EN BIT(16)\n #define B_CFIR_CTRL_KIDX1_EN BIT(24)\n #define R_TX_IQC_A_BE4 0x38138\n #define R_TX_IQC_B_BE4 0x38238\n #define B_TX_IQC_X GENMASK(31, 20)\n #define B_TX_IQC_Y GENMASK(19, 8)\n #define B_TX_IQC_DPK BIT(3)\n+#define R_RX_IQC_A_BE4 0x3813c\n+#define R_RX_IQC_B_BE4 0x3823c\n #define R_KTBL1A_BE4 0x38154\n #define R_KTBL1B_BE4 0x38254\n #define B_KTBL1_TBL0 BIT(3)\ndiff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c\nindex 14fab6b1a74a7..942f556339421 100644\n--- a/drivers/net/wireless/realtek/rtw89/regd.c\n+++ b/drivers/net/wireless/realtek/rtw89/regd.c\n@@ -1091,7 +1091,7 @@ static bool __rtw89_reg_6ghz_power_recalc(struct rtw89_dev rtwdev)\n \tint count = 0;\n \tu8 index;\n \n-\trtw89_for_each_rtwvif(rtwdev, rtwvif) {\n+\trtw89_for_each_active_rtwvif(rtwdev, rtwvif) {\n \t\trtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) {\n \t\t\tchan = rtw89_chan_get(rtwdev, rtwvif_link-\u003echanctx_idx);\n \t\t\tif (chan-\u003eband_type != RTW89_BAND_6G)\ndiff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c\nindex 142e693c87bfd..75297b39c4d78 100644\n--- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c\n+++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c\n@@ -343,35 +343,79 @@ static const struct rtw89_efuse_block_cfg rtw8922d_efuse_blocks[] = {\n static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7025 = {\n \t.bands = {\n \t[RFSI_CTRL_BAND_5_6GHZ] = {\n-\t\t.cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_ENABLE, CIM3K_ENABLE},\n+\t\t.cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE},\n \t\t.rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1),\n \t\t\t\t_8nibble(2, 2, 2, 2, 1, 1, 1, 1)},\n \t\t.pb_tb = 3,\n+\t\t.qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM},\n \t},\n \t[RFSI_CTRL_BAND_2GHZ] = {\n-\t\t.cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_ENABLE, CIM3K_ENABLE},\n+\t\t.cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE},\n \t\t.rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1),\n \t\t\t\t_8nibble(2, 2, 2, 2, 1, 1, 1, 1)},\n \t\t.pb_tb = 0,\n+\t\t.qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM},\n \t}},\n-\t.qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM, RFSI_MAX, RFSI_MAX, RFSI_MAX},\n };\n \n static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090 = {\n \t.bands = {\n \t[RFSI_CTRL_BAND_5_6GHZ] = {\n-\t\t.cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_DISABLE, CIM3K_ENABLE},\n+\t\t.cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE},\n \t\t.rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1),\n \t\t\t\t_8nibble(2, 2, 2, 2, 1, 1, 1, 1)},\n-\t\t.pb_tb = 3,\n+\t\t.pb_tb = 0,\n+\t\t.qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM},\n \t},\n \t[RFSI_CTRL_BAND_2GHZ] = {\n-\t\t.cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_DISABLE, CIM3K_ENABLE},\n+\t\t.cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE},\n \t\t.rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1),\n \t\t\t\t_8nibble(2, 2, 2, 2, 1, 1, 1, 1)},\n \t\t.pb_tb = 0,\n+\t\t.qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM},\n \t}},\n-\t.qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM, RFSI_MAX, RFSI_MAX, RFSI_MAX},\n+};\n+\n+static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090_rfe38 = {\n+\t.bands = {\n+\t[RFSI_CTRL_BAND_5_6GHZ] = {\n+\t\t.cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE},\n+\t\t.rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1),\n+\t\t\t\t_8nibble(2, 2, 2, 2, 1, 1, 1, 1)},\n+\t\t.pb_tb = 0,\n+\t\t.qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM},\n+\t},\n+\t[RFSI_CTRL_BAND_2GHZ] = {\n+\t\t.cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE},\n+\t\t.rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1),\n+\t\t\t\t_8nibble(2, 2, 2, 2, 1, 1, 1, 1)},\n+\t\t.pb_tb = 0,\n+\t\t.qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM},\n+\t}},\n+};\n+\n+static const\n+struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7025 = {\n+\t.qam_th = {\n+\t\t.mdpd_160m = RFSI_BPSK,\n+\t\t.mdpd_320m = RFSI_BPSK,\n+\t\t.oob_dpd_20m = RFSI_16QAM,\n+\t\t.oob_dpd_40m = RFSI_16QAM,\n+\t\t.oob_dpd_80m = RFSI_16QAM,\n+\t\t.cim3k = RFSI_16QAM,\n+\t},\n+};\n+\n+static const\n+struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7090 = {\n+\t.qam_th = {\n+\t\t.mdpd_160m = RFSI_16QAM,\n+\t\t.mdpd_320m = RFSI_16QAM,\n+\t\t.oob_dpd_20m = RFSI_16QAM,\n+\t\t.oob_dpd_40m = RFSI_16QAM,\n+\t\t.oob_dpd_80m = RFSI_16QAM,\n+\t\t.cim3k = RFSI_16QAM,\n+\t},\n };\n \n static const\n@@ -390,6 +434,7 @@ struct rtw89_bb_wrap_common_data_gen3 rtw8922d_bb_wrap_common_data_gen3_7090 = {\n \n static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = {\n \t.common = \u0026rtw8922d_bb_wrap_common_data_7025,\n+\t.common_gen2 = \u0026rtw8922d_bb_wrap_common_data_gen2_7025,\n \t.common_gen3 = NULL,\n \t.bands = {\n \t[RFSI_CTRL_BAND_5_6GHZ] = {\n@@ -417,21 +462,22 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = {\n \n static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = {\n \t.common = \u0026rtw8922d_bb_wrap_common_data_7090,\n+\t.common_gen2 = \u0026rtw8922d_bb_wrap_common_data_gen2_7090,\n \t.common_gen3 = \u0026rtw8922d_bb_wrap_common_data_gen3_7090,\n \t.bands = {\n \t[RFSI_CTRL_BAND_5_6GHZ] = {\n-\t\t.qam_comp_th0 = {0x4000, 0x6420, 0x6520, 0x6000, 0, 0, 0, 0, 0, 0},\n-\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x6400, 0x6500, 0x6000,\n+\t\t.qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0},\n+\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0, 0)},\n-\t\t.qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0x4000,\n+\t\t.qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0, 0)},\n-\t\t.qam_comp_ow = {0x4000, 0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0},\n+\t\t.qam_comp_ow = {0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0, 0},\n \t\t.oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF,\n \t\t\t\t OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF},\n \t},\n \t[RFSI_CTRL_BAND_2GHZ] = {\n \t\t.qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0},\n-\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0,\n+\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4600, 0, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0)},\n \t\t.qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0)},\n@@ -442,23 +488,24 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = {\n \t.mdpd_by_dbw = {MDPD_OFF, MDPD_OFF, MDPD_ON, MDPD_ON},\n };\n \n-static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe35_41_44 = {\n-\t.common = \u0026rtw8922d_bb_wrap_common_data_7090,\n+static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe38 = {\n+\t.common = \u0026rtw8922d_bb_wrap_common_data_7090_rfe38,\n+\t.common_gen2 = \u0026rtw8922d_bb_wrap_common_data_gen2_7090,\n \t.common_gen3 = \u0026rtw8922d_bb_wrap_common_data_gen3_7090,\n \t.bands = {\n \t[RFSI_CTRL_BAND_5_6GHZ] = {\n-\t\t.qam_comp_th0 = {0x4000, 0x6420, 0x6520, 0x6000, 0, 0, 0, 0, 0, 0},\n-\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x6400, 0x6500, 0x6000,\n+\t\t.qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0},\n+\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4600, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0, 0)},\n-\t\t.qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0x4000,\n+\t\t.qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0, 0)},\n-\t\t.qam_comp_ow = {0x4000, 0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0},\n+\t\t.qam_comp_ow = {0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0, 0},\n \t\t.oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF,\n \t\t\t\t OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF},\n \t},\n \t[RFSI_CTRL_BAND_2GHZ] = {\n \t\t.qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0},\n-\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0,\n+\t\t.qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4700, 0, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0)},\n \t\t.qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0,\n \t\t\t\t\t\t 0, 0, 0, 0, 0)},\n@@ -466,7 +513,7 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe35_41_44 =\n \t\t.oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF,\n \t\t\t\t OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF},\n \t}},\n-\t.mdpd_by_dbw = {MDPD_OFF, MDPD_OFF, MDPD_ON, MDPD_ON},\n+\t.mdpd_by_dbw = {MDPD_ON, MDPD_ON, MDPD_ON, MDPD_ON},\n };\n \n static void rtw8922d_sel_bt_rx_path(struct rtw89_dev rtwdev, u8 val,\n@@ -901,6 +948,9 @@ static int rtw8922d_read_sys(struct rtw89_dev rtwdev, u8 log_map)\n \tu16 digk;\n \tu8 vmin;\n \n+\tif (!test_bit(RTW89_QUIRK_THERMAL_PROT_VCORE, rtwdev-\u003equirks))\n+\t\treturn 0;\n+\n \tdigk = log_map[0x200] \| log_map[0x201] \u003c\u003c 8;\n \thal-\u003ethermal_prot_vmax = u16_get_bits(digk, B_BE_PWMTUNE_MASK);\n \n@@ -1142,24 +1192,13 @@ static int rtw8922d_data_setup(struct rtw89_dev rtwdev)\n {\n \tconst struct rtw89_bb_wrap_data data;\n \tstruct rtw89_hal hal = \u0026rtwdev-\u003ehal;\n-\tbool rfe35_41_44 = false;\n-\n-\tswitch (rtwdev-\u003eefuse.rfe_type) {\n-\tcase 35:\n-\tcase 41:\n-\tcase 44:\n-\t\trfe35_41_44 = true;\n-\t\tbreak;\n-\t}\n \n-\tif (hal-\u003ecid == RTL8922D_CID7025) {\n+\tif (hal-\u003ecid == RTL8922D_CID7025)\n \t\tdata = \u0026rtw8922d_bb_wrap_data_7025_default;\n-\t} else {\n-\t\tif (rfe35_41_44)\n-\t\t\tdata = \u0026rtw8922d_bb_wrap_data_7090_rfe35_41_44;\n-\t\telse\n-\t\t\tdata = \u0026rtw8922d_bb_wrap_data_7090_default;\n-\t}\n+\telse if (rtwdev-\u003eefuse.rfe_type == 38)\n+\t\tdata = \u0026rtw8922d_bb_wrap_data_7090_rfe38;\n+\telse\n+\t\tdata = \u0026rtw8922d_bb_wrap_data_7090_default;\n \n \trtwdev-\u003ephy_info.bb_wrap_data = data;\n \n@@ -2432,14 +2471,15 @@ static int rtw8922d_ctrl_mlo(struct rtw89_dev rtwdev, enum rtw89_mlo_dbcc_mode\n \t\trtw89_write32_mask(rtwdev, reg1, B_BBWRAP_ELMSR_EN_BE4, 0);\n \t} else if (mode == MLO_0_PLUS_2_1RF) {\n \t\trtw89_phy_write32_mask(rtwdev, R_SYS_DBCC_BE4,\n-\t\t\t\t B_SYS_DBCC_24G_BAND_SEL_BE4, RTW89_PHY_0);\n+\t\t\t\t B_SYS_DBCC_24G_BAND_SEL_BE4, RTW89_PHY_1);\n \t\trtw89_write32_mask(rtwdev, reg0, B_BBWRAP_ELMSR_EN_BE4, 0);\n \t\trtw89_write32_mask(rtwdev, reg1, B_BBWRAP_ELMSR_EN_BE4, 0);\n \t} else if ((mode == MLO_1_PLUS_1_1RF) \|\| (mode == DBCC_LEGACY)) {\n \t\tstruct rtw89_entity_conf conf;\n \n \t\trtw89_entity_get_conf(rtwdev, \u0026conf);\n-\t\tcck_phy_idx = conf.chans[1]-\u003eband_type == RTW89_BAND_2G ?\n+\t\tcck_phy_idx = conf.chans[0]-\u003eband_type != RTW89_BAND_2G \u0026\u0026\n+\t\t\t conf.chans[1]-\u003eband_type == RTW89_BAND_2G ?\n \t\t\t RTW89_PHY_1 : RTW89_PHY_0;\n \n \t\trtw89_phy_write32_mask(rtwdev, R_SYS_DBCC_BE4,\n@@ -2465,6 +2505,8 @@ static void rtw8922d_bb_sethw(struct rtw89_dev rtwdev)\n \tenum rtw89_phy_idx phy_idx;\n \tu32 reg;\n \n+\trtw89_fw_h2c_phy_rfe_type(rtwdev);\n+\n \treg = rtw89_mac_reg_by_idx(rtwdev, R_BE_PWR_BOOST, RTW89_PHY_0);\n \trtw89_write32_clr(rtwdev, reg, B_BE_PWR_CTRL_SEL);\n \treg = rtw89_mac_reg_by_idx(rtwdev, R_BE_PWR_BOOST, RTW89_PHY_1);\n@@ -2508,7 +2550,8 @@ static void rtw8922d_set_channel_bb(struct rtw89_dev rtwdev,\n \tu8 pri_sb = chan-\u003epri_sb_idx;\n \tu32 val;\n \n-\trtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, chan-\u003erfsi_band, phy_idx);\n+\trtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(rtwdev, chan, phy_idx);\n+\n \trtw8922d_ctrl_ch(rtwdev, chan, phy_idx);\n \trtw8922d_ctrl_bw(rtwdev, pri_sb, chan-\u003eband_width, phy_idx);\n \trtw89_phy_bb_wrap_set_rfsi_bandedge_ch(rtwdev, chan, phy_idx);\n@@ -2822,6 +2865,64 @@ static void __rtw8922d_txiqk_enable(struct rtw89_dev rtwdev)\n \t}\n }\n \n+static void __rtw8922d_rxiqk_disable(struct rtw89_dev rtwdev)\n+{\n+\tstruct rtw89_rfk_mcc_info_data rfk_mcc = rtwdev-\u003erfk_mcc.data;\n+\tu8 path, kidx;\n+\n+\tfor (path = RF_PATH_A; path \u003c= RF_PATH_B; path++) {\n+\t\tkidx = rfk_mcc[path].table_idx;\n+\n+\t\tif (kidx == 0) {\n+\t\t\trtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path \u003c\u003c 8),\n+\t\t\t\t\t B_CFIR_CTRL_RXKIDX0_EN);\n+\t\t} else if (kidx == 1) {\n+\t\t\trtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path \u003c\u003c 8),\n+\t\t\t\t\t B_CFIR_CTRL_RXKIDX1_EN);\n+\t\t} else {\n+\t\t\trtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4,\n+\t\t\t\t\t B_NCTL_CFG_BE4_SPAGE, 0x1);\n+\t\t\trtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path \u003c\u003c 8),\n+\t\t\t\t\t B_CFIR_CTRL_RXKIDX0_EN);\n+\t\t\trtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4,\n+\t\t\t\t\t B_NCTL_CFG_BE4_SPAGE, 0x0);\n+\t\t}\n+\n+\t\trtw89_phy_write32(rtwdev, R_RX_IQC_A_BE4 + (path \u003c\u003c 8), 0x40000002);\n+\t}\n+}\n+\n+static void __rtw8922d_rxiqk_enable(struct rtw89_dev rtwdev)\n+{\n+\tstruct rtw89_rfk_mcc_info_data rfk_mcc = rtwdev-\u003erfk_mcc.data;\n+\tstruct rtw89_iqk_info iqk_info = \u0026rtwdev-\u003eiqk;\n+\tu8 path, kidx;\n+\n+\tfor (path = RF_PATH_A; path \u003c= RF_PATH_B; path++) {\n+\t\tif (iqk_info-\u003eiqk_rx_fail[0][path])\n+\t\t\tcontinue;\n+\n+\t\tkidx = rfk_mcc[path].table_idx;\n+\n+\t\tif (kidx == 0) {\n+\t\t\trtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path \u003c\u003c 8),\n+\t\t\t\t\t B_CFIR_CTRL_RXKIDX0_EN);\n+\t\t} else if (kidx == 1) {\n+\t\t\trtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path \u003c\u003c 8),\n+\t\t\t\t\t B_CFIR_CTRL_RXKIDX1_EN);\n+\t\t} else {\n+\t\t\trtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4,\n+\t\t\t\t\t B_NCTL_CFG_BE4_SPAGE, 0x1);\n+\t\t\trtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path \u003c\u003c 8),\n+\t\t\t\t\t B_CFIR_CTRL_RXKIDX0_EN);\n+\t\t\trtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4,\n+\t\t\t\t\t B_NCTL_CFG_BE4_SPAGE, 0x0);\n+\t\t}\n+\n+\t\trtw89_phy_write32(rtwdev, R_RX_IQC_A_BE4 + (path \u003c\u003c 8), 0x40000000);\n+\t}\n+}\n+\n static void rtw8922d_rfk_scan(struct rtw89_dev rtwdev,\n \t\t\t struct rtw89_vif_link rtwvif_link,\n \t\t\t bool start)\n@@ -2829,9 +2930,11 @@ static void rtw8922d_rfk_scan(struct rtw89_dev rtwdev,\n \tif (start) {\n \t\t__rtw8922d_tssi_disable(rtwdev, rtwvif_link-\u003ephy_idx);\n \t\t__rtw8922d_txiqk_disable(rtwdev);\n+\t\t__rtw8922d_rxiqk_disable(rtwdev);\n \t} else {\n \t\t__rtw8922d_tssi_enable(rtwdev, rtwvif_link-\u003ephy_idx);\n \t\t__rtw8922d_txiqk_enable(rtwdev);\n+\t\t__rtw8922d_rxiqk_enable(rtwdev);\n \t}\n }\n \n@@ -2909,61 +3012,6 @@ static void rtw8922d_set_txpwr_ref(struct rtw89_dev rtwdev,\n \t\t\t\t B_BE_PWR_REF_CTRL_CCK, ref_cck);\n }\n \n-static void rtw8922d_set_tx_shape(struct rtw89_dev rtwdev,\n-\t\t\t\t const struct rtw89_chan chan,\n-\t\t\t\t enum rtw89_phy_idx phy_idx)\n-{\n-\tconst struct rtw89_bb_wrap_data d = rtwdev-\u003ephy_info.bb_wrap_data;\n-\tu8 band = chan-\u003eband_type;\n-\tu8 tx_shape_idx;\n-\tconst u16 th;\n-\n-\ttx_shape_idx = rtw89_get_tx_shape_idx(rtwdev, band, RTW89_RS_OFDM);\n-\tif (tx_shape_idx == 0)\n-\t\tgoto disable;\n-\n-\tth = d-\u003ebands[chan-\u003erfsi_band].qam_comp_th0;\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKLWORD, th[0], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKHWORD, th[1], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKLWORD, th[2], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKHWORD, th[3], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, MASKLWORD, th[4], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, MASKHWORD, th[5], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKLWORD, th[6], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKHWORD, th[7], phy_idx);\n-\n-\tth = d-\u003ebands[chan-\u003erfsi_band].qam_comp_ow;\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKLWORD, th[0], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKHWORD, th[1], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKLWORD, th[2], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKHWORD, th[3], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, MASKLWORD, th[4], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, MASKHWORD, th[5], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKLWORD, th[6], phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKHWORD, th[7], phy_idx);\n-\n-\treturn;\n-\n-disable:\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx);\n-\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx);\n-\trtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx);\n-}\n-\n static void rtw8922d_set_txpwr_sar_diff(struct rtw89_dev rtwdev,\n \t\t\t\t\tconst struct rtw89_chan chan,\n \t\t\t\t\tenum rtw89_phy_idx phy_idx)\n@@ -2995,7 +3043,6 @@ static void rtw8922d_set_txpwr(struct rtw89_dev rtwdev,\n {\n \trtw89_phy_set_txpwr_byrate(rtwdev, chan, phy_idx);\n \trtw89_phy_set_txpwr_offset(rtwdev, chan, phy_idx);\n-\trtw8922d_set_tx_shape(rtwdev, chan, phy_idx);\n \trtw89_phy_set_txpwr_limit(rtwdev, chan, phy_idx);\n \trtw89_phy_set_txpwr_limit_ru(rtwdev, chan, phy_idx);\n \trtw8922d_set_txpwr_ref(rtwdev, chan, phy_idx);\ndiff --git a/drivers/net/wireless/realtek/rtw89/rtw8922de.c b/drivers/net/wireless/realtek/rtw89/rtw8922de.c\nindex a71e41f285446..d0dede477fb4a 100644\n--- a/drivers/net/wireless/realtek/rtw89/rtw8922de.c\n+++ b/drivers/net/wireless/realtek/rtw89/rtw8922de.c\n@@ -9,6 +9,12 @@\n #include \"reg.h\"\n #include \"rtw8922d.h\"\n \n+static const struct rtw89_pci_ssid_quirk rtw8922de_pci_ssid_quirks[] = {\n+\t{RTW89_PCI_SSID(PCI_VENDOR_ID_REALTEK, 0x892D, 0x1E44, 0x1400, VALVE),\n+\t\t.bitmap = BIT(RTW89_QUIRK_LOW_LATENCY)},\n+\t{},\n+};\n+\n static const struct rtw89_pci_info rtw8922d_pci_info = {\n \t.gen_def\t\t= \u0026rtw89_pci_gen_be,\n \t.isr_def\t\t= \u0026rtw89_pci_isr_be_v1,\n@@ -66,7 +72,7 @@ static const struct rtw89_pci_info rtw8922d_pci_info = {\n \t.disable_intr\t\t= rtw89_pci_disable_intr_v3,\n \t.recognize_intrs\t= rtw89_pci_recognize_intrs_v3,\n \n-\t.ssid_quirks\t\t= NULL,\n+\t.ssid_quirks\t\t= rtw8922de_pci_ssid_quirks,\n };\n \n static const struct rtw89_driver_info rtw89_8922de_vs_info = {\ndiff --git a/drivers/net/wireless/realtek/rtw89/util.h b/drivers/net/wireless/realtek/rtw89/util.h\nindex c16e7a7f8bc92..aa87a520bdc38 100644\n--- a/drivers/net/wireless/realtek/rtw89/util.h\n+++ b/drivers/net/wireless/realtek/rtw89/util.h\n@@ -21,6 +21,10 @@\n #define rtw89_for_each_rtwvif(rtwdev, rtwvif)\t\t\t\t \\\n \tlist_for_each_entry(rtwvif, \u0026(rtwdev)-\u003ertwvifs_list, list)\n \n+/ call this function with wiphy mutex is held /\n+#define rtw89_for_each_active_rtwvif(rtwdev, rtwvif) \\\n+\tlist_for_each_entry(rtwvif, \u0026(rtwdev)-\u003ehal.entity_mgnt.active_list, mgnt_entry)\n+\n / Before adding rtwvif to list, we need to check if it already exist, beacase\n * in some case such as SER L2 happen during WoWLAN flow, calling reconfig\n * twice cause the list to be added twice.\n" }
2/1	2026/08/26 06:47	agent	patch-evaluator	3m Model: best-expensive Args: null Results: { "EnableConfigs": [ "RTW89_8922DE", "RTW89_8922AU", "RTW89_8852AU" ], "FocusSymbols": [ "rtw89_chanctx_pause", "rtw89_chanctx_paused", "rtw89_fw_h2c_phy_rfe_type", "rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan", "rtw89_vif_type_mapping", "rtw89_recalc_lps" ], "Reasoning": "The patch modifies the core logic of the rtw89 wireless driver, including channel context pausing, interface type mapping (adding P2P_DEVICE support), and LPS recalculation. It also modifies the rtw8922d chip-specific logic. The core changes are reachable via the mac80211/cfg80211 netlink interface, and the driver can be probed in virtualized environments using USB emulation (e.g., dummy_hcd) for its USB variants (like rtw8922au, rtw8852au). Therefore, the changes are functionally impactful and testable.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 136ba4a873ea4bf58f38736a81cc6cf1e6c6be99 Author: syz-cluster <triage@syzkaller.com> Date: Wed Aug 26 06:47:42 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c index 6f11335b49687..a7ba47bd9abd8 100644 --- a/drivers/net/wireless/realtek/rtw89/chan.c +++ b/drivers/net/wireless/realtek/rtw89/chan.c @@ -185,7 +185,7 @@ static void rtw89_chan_update_punctured(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif; unsigned int link_id; - rtw89_for_each_rtwvif(rtwdev, rtwvif) { + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) { rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) { if (!rtwvif_link->chanctx_assigned \|\| rtwvif_link->chanctx_idx != idx) @@ -358,10 +358,8 @@ static void rtw89_entity_calculate_weight(struct rtw89_dev rtwdev, w->active_chanctxs++; } - rtw89_for_each_rtwvif(rtwdev, rtwvif) { - if (rtw89_vif_is_active_role(rtwvif)) - w->active_roles++; - } + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) + w->active_roles++; } static void rtw89_normalize_link_chanctx(struct rtw89_dev rtwdev, @@ -527,7 +525,7 @@ static void rtw89_entity_recalc_mlo_dbcc_mode(struct rtw89_dev rtwdev) mode = rtw89_entity_sel_mlo_dbcc_mode(rtwdev, active_hws); rtwdev->mlo_dbcc_mode = mode; - rtw89_debug(rtwdev, RTW89_DBG_STATE, "recalc mlo dbcc mode to %d\n", mode); + rtw89_debug(rtwdev, RTW89_DBG_STATE, "recalc mlo dbcc mode to 0x%x\n", mode); } static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev) @@ -553,7 +551,7 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev) which uses RTW89_CHANCTX_0 to put at position 0 and its designated * link take RTW89_CHANCTX_0. (normalizing) / - list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, role) { for (i = 0; i < role->links_inst_valid_num; i++) { link = rtw89_vif_get_link_inst(role, i); if (!link \|\| !link->chanctx_assigned) @@ -570,7 +568,7 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev) } fill: - list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, role) { if (unlikely(pos >= RTW89_MAX_INTERFACE_NUM)) { rtw89_warn(rtwdev, "%s: active roles are over max iface num\n", @@ -3232,6 +3230,9 @@ void rtw89_chanctx_pause(struct rtw89_dev rtwdev, lockdep_assert_wiphy(rtwdev->hw->wiphy); + if (test_bit(RTW89_FLAG_LEISURE_PS, rtwdev->flags)) + rtw89_warn(rtwdev, "LPS isn't off when pausing chanctx\n"); + if (hal->entity_pause) return; @@ -3249,6 +3250,15 @@ void rtw89_chanctx_pause(struct rtw89_dev rtwdev, hal->entity_pause = true; } +bool rtw89_chanctx_paused(struct rtw89_dev rtwdev) +{ + struct rtw89_hal hal = &rtwdev->hal; + + lockdep_assert_wiphy(rtwdev->hw->wiphy); + + return hal->entity_pause; +} + static void rtw89_chanctx_proceed_cb(struct rtw89_dev rtwdev, const struct rtw89_chanctx_cb_parm parm) { @@ -3335,7 +3345,7 @@ static void rtw89_swap_chanctx(struct rtw89_dev rtwdev, swap(hal->chanctx[idx1], hal->chanctx[idx2]); - rtw89_for_each_rtwvif(rtwdev, rtwvif) + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) __rtw89_swap_chanctx(rtwvif, idx1, idx2); cur = atomic_read(&hal->roc_chanctx_idx); diff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h index a9a5f1b307a27..f99aca9ef6a44 100644 --- a/drivers/net/wireless/realtek/rtw89/chan.h +++ b/drivers/net/wireless/realtek/rtw89/chan.h @@ -185,6 +185,7 @@ void rtw89_query_mr_chanctx_info(struct rtw89_dev rtwdev, u8 inst_idx, void rtw89_chanctx_track(struct rtw89_dev rtwdev); void rtw89_chanctx_pause(struct rtw89_dev rtwdev, const struct rtw89_chanctx_pause_parm parm); +bool __must_check rtw89_chanctx_paused(struct rtw89_dev rtwdev); void rtw89_chanctx_proceed(struct rtw89_dev rtwdev, const struct rtw89_chanctx_cb_parm cb_parm); diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 397ebbfcac09a..572d9c65a2dd1 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -167,7 +167,7 @@ static struct ieee80211_rate rtw89_bitrates[] = { static const struct ieee80211_iface_limit rtw89_iface_limits[] = { { - .max = 1, + .max = 2, .types = BIT(NL80211_IFTYPE_STATION), }, { @@ -176,6 +176,10 @@ static const struct ieee80211_iface_limit rtw89_iface_limits[] = { BIT(NL80211_IFTYPE_P2P_GO) \| BIT(NL80211_IFTYPE_AP), }, + { + .max = 1, + .types = BIT(NL80211_IFTYPE_P2P_DEVICE), + }, }; static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = { @@ -188,6 +192,10 @@ static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = { .types = BIT(NL80211_IFTYPE_P2P_CLIENT) \| BIT(NL80211_IFTYPE_P2P_GO), }, + { + .max = 1, + .types = BIT(NL80211_IFTYPE_P2P_DEVICE), + }, }; static const struct ieee80211_iface_combination rtw89_iface_combs[] = { @@ -5496,6 +5504,9 @@ static void rtw89_track_ps_work(struct wiphy wiphy, struct wiphy_work work) if (rtwdev->scanning) return; + if (rtw89_chanctx_paused(rtwdev)) + return; + if (rtwdev->lps_enabled && !rtwdev->btc.btc_ctrl_lps) rtw89_enter_lps_track(rtwdev, RTW89_TFC_INTERVAL_100MS); } @@ -5521,6 +5532,9 @@ static void rtw89_track_work(struct wiphy wiphy, struct wiphy_work work) if (rtwdev->scanning) return; + if (rtw89_chanctx_paused(rtwdev)) + return; + rtw89_leave_lps(rtwdev); if (tfc_changed) { @@ -5691,6 +5705,7 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc) else rtwvif_link->wifi_role = RTW89_WIFI_ROLE_AP; break; + RTW89_TYPE_MAPPING(P2P_DEVICE); RTW89_TYPE_MAPPING(ADHOC); RTW89_TYPE_MAPPING(MONITOR); RTW89_TYPE_MAPPING(MESH_POINT); @@ -5724,6 +5739,10 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc) rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT; rtwvif_link->addr_cam.sec_ent_mode = RTW89_ADDR_CAM_SEC_NORMAL; break; + case NL80211_IFTYPE_P2P_DEVICE: + rtwvif_link->net_type = RTW89_NET_TYPE_NO_LINK; + rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT; + break; case NL80211_IFTYPE_MONITOR: break; default: @@ -7517,7 +7536,8 @@ static int rtw89_core_register_hw(struct rtw89_dev rtwdev) hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) \| BIT(NL80211_IFTYPE_AP) \| BIT(NL80211_IFTYPE_P2P_CLIENT) \| - BIT(NL80211_IFTYPE_P2P_GO); + BIT(NL80211_IFTYPE_P2P_GO) \| + BIT(NL80211_IFTYPE_P2P_DEVICE); if (hal->ant_diversity) { hw->wiphy->available_antennas_tx = 0x3; diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 2b21d969ece7b..83554a2c87323 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -6340,7 +6340,7 @@ enum rtw89_entity_mode { RTW89_ENTITY_MODE_UNHANDLED = -ESRCH, }; -#define RTW89_MAX_INTERFACE_NUM 2 +#define RTW89_MAX_INTERFACE_NUM 3 / only valid when running with chanctx_ops / struct rtw89_entity_mgnt { @@ -6463,8 +6463,10 @@ enum rtw89_quirks { RTW89_QUIRK_PCI_BER, RTW89_QUIRK_THERMAL_PROT_120C, RTW89_QUIRK_THERMAL_PROT_110C, + RTW89_QUIRK_THERMAL_PROT_VCORE, RTW89_QUIRK_HW_INFO_SYSFS, RTW89_QUIRK_DISABLE_2GHZ, + RTW89_QUIRK_LOW_LATENCY, NUM_OF_RTW89_QUIRKS, }; @@ -6479,6 +6481,7 @@ enum rtw89_custid { RTW89_CUSTID_AMD = 6, RTW89_CUSTID_FUJITSU = 7, RTW89_CUSTID_DELL = 8, + RTW89_CUSTID_VALVE, / driver only / }; enum rtw89_pkt_drop_sel { diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c index 7e640c7166e4d..2417381bca1cd 100644 --- a/drivers/net/wireless/realtek/rtw89/debug.c +++ b/drivers/net/wireless/realtek/rtw89/debug.c @@ -5463,12 +5463,11 @@ rtw89_debug_priv_diag_rf_get(struct rtw89_dev rtwdev, static void rtw89_dbg_diag_rf_set_rfk(struct rtw89_dev rtwdev) { - struct rtw89_entity_mgnt mgnt = &rtwdev->hal.entity_mgnt; struct rtw89_vif_link rtwvif_link; struct rtw89_vif rtwvif; unsigned int link_id; - list_for_each_entry(rtwvif, &mgnt->active_list, mgnt_entry) + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) rtw89_chip_rfk_channel(rtwdev, rtwvif_link); } diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 0099c5c03e7a6..fd721c971ba3e 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3535,6 +3535,46 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev, return ret; } +int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev) +{ + const struct rtw89_chip_info chip = rtwdev->chip; + struct rtw89_efuse efuse = &rtwdev->efuse; + struct rtw89_h2c_phy_rfe_type h2c; + u32 len = sizeof(h2c); + struct sk_buff skb; + int ret; + + if (chip->chip_id != RTL8922D) + return 0; + + skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len); + if (!skb) { + rtw89_err(rtwdev, "failed to alloc skb for h2c phy_rfe_type\n"); + return -ENOMEM; + } + skb_put(skb, len); + h2c = (struct rtw89_h2c_phy_rfe_type )skb->data; + + h2c->rfe_type = efuse->rfe_type; + + rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C, + H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM, + H2C_FUNC_FW_RFE_TYPE, 0, 0, len); + + ret = rtw89_h2c_tx(rtwdev, skb, false); + if (ret) { + rtw89_err(rtwdev, "failed to send h2c\n"); + goto fail; + } + + return 0; +fail: + dev_kfree_skb_any(skb); + + return ret; +} +EXPORT_SYMBOL(rtw89_fw_h2c_phy_rfe_type); + #define H2C_P2P_ACT_LEN 20 int rtw89_fw_h2c_p2p_act(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link, @@ -10271,7 +10311,6 @@ static void rtw89_hw_scan_update_link_beacon_noa(struct rtw89_dev rtwdev, static void rtw89_hw_scan_update_beacon_noa(struct rtw89_dev rtwdev, bool scan) { - const struct rtw89_entity_mgnt mgnt = &rtwdev->hal.entity_mgnt; const struct rtw89_hw_scan_info scan_info = &rtwdev->scan_info; const struct rtw89_chip_info chip = rtwdev->chip; struct rtw89_mac_chinfo_ax chinfo_ax; @@ -10311,7 +10350,7 @@ static void rtw89_hw_scan_update_beacon_noa(struct rtw89_dev rtwdev, bool scan) } update: - list_for_each_entry(rtwvif, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) { unsigned int link_id; vif = rtwvif_to_vif(rtwvif); @@ -10328,7 +10367,6 @@ static void rtw89_hw_scan_set_extra_op_info(struct rtw89_dev rtwdev, struct rtw89_vif scan_rtwvif, const struct rtw89_chan scan_op) { - struct rtw89_entity_mgnt mgnt = &rtwdev->hal.entity_mgnt; struct rtw89_hw_scan_info scan_info = &rtwdev->scan_info; struct rtw89_hw_scan_extra_op ext = &scan_info->extra_op; struct rtw89_vif tmp; @@ -10337,7 +10375,7 @@ static void rtw89_hw_scan_set_extra_op_info(struct rtw89_dev rtwdev, if (!RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD_EXTRA_OP, &rtwdev->fw)) return; - list_for_each_entry(tmp, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, tmp) { const struct rtw89_chan tmp_chan; struct rtw89_vif_link tmp_link; diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h index 375ca0a243a65..f7d017d3ced08 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.h +++ b/drivers/net/wireless/realtek/rtw89/fw.h @@ -2101,6 +2101,11 @@ struct rtw89_h2c_lps_ml_cmn_info_v1 { struct rtw89_bb_link_info_rx_gain rx_gain[RTW89_BB_PS_LINK_BUF_MAX]; } __packed; +struct rtw89_h2c_phy_rfe_type { + u8 rfe_type; + u8 rsvd[3]; +} __packed; + struct rtw89_h2c_trig_cpu_except { __le32 w0; } __packed; @@ -4886,6 +4891,7 @@ enum rtw89_mrc_h2c_func { #define H2C_FUNC_FW_MCC_DIG 0x6 #define H2C_FUNC_FW_LPS_CH_INFO 0xb #define H2C_FUNC_FW_LPS_ML_CMN_INFO 0xe +#define H2C_FUNC_FW_RFE_TYPE 0x1b #define H2C_CL_OUTSRC_RF_REG_A 0x8 #define H2C_CL_OUTSRC_RF_REG_B 0x9 @@ -5568,6 +5574,7 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif); int rtw89_fw_h2c_fwips(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link, bool enable); +int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev); struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len); struct sk_buff rtw89_fw_h2c_alloc_skb_no_hdr(struct rtw89_dev rtwdev, u32 len); int rtw89_fw_msg_reg(struct rtw89_dev rtwdev, diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c index c78107e922063..cd56f9164cf41 100644 --- a/drivers/net/wireless/realtek/rtw89/phy.c +++ b/drivers/net/wireless/realtek/rtw89/phy.c @@ -3345,7 +3345,8 @@ static void __rtw89_phy_c2h_ra_rpt_iter(struct rtw89_sta_link rtwsta_link, changed = true; } - rtwsta_link->max_agg_wait = link_sta->agg.max_rc_amsdu_len / 1500 - 1; + if (!test_bit(RTW89_QUIRK_LOW_LATENCY, rtwdev->quirks)) + rtwsta_link->max_agg_wait = link_sta->agg.max_rc_amsdu_len / 1500 - 1; } static void rtw89_phy_c2h_ra_rpt_iter(void data, struct ieee80211_sta sta) @@ -3574,6 +3575,8 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev, "[IQK] iqk->fwk_status = %x\n", iqk->fwk_status); for (i = 0; i < 2; i++) { + struct rtw89_iqk_info iqk_info = &rtwdev->iqk; + rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] ======== Path %x ========\n", i); rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->iqk_band[%d] = %x\n", @@ -3592,6 +3595,9 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev, i, iqk->iqk_tx_fail[i]); rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->iqk_rx_fail[%d] = %x\n", i, iqk->iqk_rx_fail[i]); + + iqk_info->iqk_rx_fail[0][i] = iqk->iqk_rx_fail[i]; + for (j = 0; j < 6; j++) rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->rftxgain[%d][%d] = %x\n", diff --git a/drivers/net/wireless/realtek/rtw89/phy.h b/drivers/net/wireless/realtek/rtw89/phy.h index 0963cdfb15949..7bbda2ba5b5c8 100644 --- a/drivers/net/wireless/realtek/rtw89/phy.h +++ b/drivers/net/wireless/realtek/rtw89/phy.h @@ -631,8 +631,19 @@ struct rtw89_bb_wrap_common_data { } cim3k; u32 rfsi_ct_opt[2]; u8 pb_tb; + u8 qam_th[3]; } bands[RFSI_CTRL_BAND_NUM]; - u8 qam_th[6]; +}; + +struct rtw89_bb_wrap_common_data_gen2 { + struct { + u8 mdpd_160m; + u8 mdpd_320m; + u8 oob_dpd_20m; + u8 oob_dpd_40m; + u8 oob_dpd_80m; + u8 cim3k; + } qam_th; }; struct rtw89_bb_wrap_common_data_gen3 { @@ -644,6 +655,7 @@ struct rtw89_bb_wrap_common_data_gen3 { struct rtw89_bb_wrap_data { const struct rtw89_bb_wrap_common_data common; + const struct rtw89_bb_wrap_common_data_gen2 common_gen2; const struct rtw89_bb_wrap_common_data_gen3 common_gen3; struct { u16 qam_comp_th0[MAX_TX_RFSI_CTRL_OPT]; @@ -1039,9 +1051,9 @@ static inline void rtw89_phy_bb_wrap_init(struct rtw89_dev rtwdev) phy->bb_wrap_init(rtwdev); } -void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, - enum rtw89_rfsi_ctrl_band ctrl_band, - enum rtw89_phy_idx phy_idx); +void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + u8 mac_idx); void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev, const struct rtw89_chan chan, enum rtw89_phy_idx phy_idx); diff --git a/drivers/net/wireless/realtek/rtw89/phy_be.c b/drivers/net/wireless/realtek/rtw89/phy_be.c index c06927d1dc781..b94754d386737 100644 --- a/drivers/net/wireless/realtek/rtw89/phy_be.c +++ b/drivers/net/wireless/realtek/rtw89/phy_be.c @@ -682,9 +682,9 @@ static u32 rtw89_phy_bb_wrap_be_bandedge_decision(struct rtw89_dev rtwdev, return val; } -void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, - enum rtw89_rfsi_ctrl_band rfsi_band, - enum rtw89_phy_idx phy_idx) +static void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; const u32 val; @@ -693,15 +693,14 @@ void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, if (!d \|\| !d->common) return; - val = d->common->bands[rfsi_band].rfsi_ct_opt; + val = d->common->bands[chan->rfsi_band].rfsi_ct_opt; - reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_0_BE4, phy_idx); + reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_0_BE4, mac_idx); rtw89_write32(rtwdev, reg, val[0]); - reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_8_BE4, phy_idx); + reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_8_BE4, mac_idx); rtw89_write32(rtwdev, reg, val[1]); } -EXPORT_SYMBOL(rtw89_phy_bb_wrap_set_rfsi_ct_opt); void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev, const struct rtw89_chan chan, @@ -733,6 +732,7 @@ void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev, EXPORT_SYMBOL(rtw89_phy_bb_wrap_set_rfsi_bandedge_ch); static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; @@ -741,9 +741,9 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, if (!d \|\| !d->common) return; - th0 = d->common->qam_th[0]; - th1 = d->common->qam_th[1]; - th2 = d->common->qam_th[2]; + th0 = d->common->bands[chan->rfsi_band].qam_th[0]; + th1 = d->common->bands[chan->rfsi_band].qam_th[1]; + th2 = d->common->bands[chan->rfsi_band].qam_th[2]; / TH0 / rtw89_write32_idx(rtwdev, R_QAM_TH0_BE4, B_QAM_TH0_0_BE4, th0, mac_idx); @@ -772,6 +772,26 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_2_BE4, th2, mac_idx); rtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_5_BE4, th2, mac_idx); rtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_8_BE4, th2, mac_idx); +} + +static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen2_init(struct rtw89_dev rtwdev, + enum rtw89_mac_idx mac_idx) +{ + const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; + const struct rtw89_bb_wrap_common_data_gen2 common_gen2; + u8 th0, th2, th3, th4, th5; + + if (!d \|\| !d->common_gen2) + return; + + common_gen2 = d->common_gen2; + th0 = common_gen2->qam_th.mdpd_160m; + / th1 (MDPD 320M) has no RTL8922D wrapper register / + th2 = common_gen2->qam_th.oob_dpd_20m; + th3 = common_gen2->qam_th.oob_dpd_40m; + th4 = common_gen2->qam_th.oob_dpd_80m; + th5 = common_gen2->qam_th.cim3k; + / DPD 160M / rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH0_BE4, B_DPD_DBW160_TH0_0_BE4, th0, mac_idx); rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH0_BE4, B_DPD_DBW160_TH0_1_BE4, th0, mac_idx); @@ -782,34 +802,34 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH1_BE4, B_DPD_DBW160_TH1_6_BE4, th0, mac_idx); rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH1_BE4, B_DPD_DBW160_TH1_7_BE4, th0, mac_idx); /* DPD 20M / - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_0_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_1_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_2_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_5_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_6_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH1_7_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_0_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_1_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_2_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_3_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_4_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_5_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_6_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH1_7_BE4, th2, mac_idx); / DPD 40M / - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_0_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_1_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_2_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_5_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_0_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_1_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_2_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_3_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_4_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_5_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_6_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_7_BE4, th3, mac_idx); / DPD 80M / - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW80_TH1_0_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_1_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_2_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_5_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_6_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_7_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW80_TH1_0_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_1_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_2_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_3_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_4_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_5_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_6_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_7_BE4, th4, mac_idx); / CIM3K / - rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH2_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH2_BE4, th5, mac_idx); } static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(struct rtw89_dev rtwdev, @@ -882,13 +902,14 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(struct rtw89_dev rt } static void rtw89_phy_bb_wrap_tx_rfsi_scenario_def(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; u8 pb_tb = 0; if (d && d->common) - pb_tb = d->common->bands[0].pb_tb; + pb_tb = d->common->bands[chan->rfsi_band].pb_tb; rtw89_write32_idx(rtwdev, R_RFSI_CT_DEF_BE4, B_RFSI_CT_ER_BE4, 0x0, mac_idx); rtw89_write32_idx(rtwdev, R_RFSI_CT_DEF_BE4, B_RFSI_CT_SUBF_BE4, 0x0, mac_idx); @@ -905,15 +926,16 @@ static void rtw89_phy_bb_wrap_tx_rfsi_scenario_def(struct rtw89_dev rtwdev, } static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; const u16 th; - if (!d \|\| !d->common) + if (!d) return; - th = d->bands[0].qam_comp_th0; + th = d->bands[chan->rfsi_band].qam_comp_th0; rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKLWORD, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKHWORD, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKLWORD, th[2], mac_idx); @@ -923,7 +945,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKLWORD, th[6], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKHWORD, th[7], mac_idx); - th = d->bands[0].qam_comp_th1; + th = d->bands[chan->rfsi_band].qam_comp_th1; rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_L, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_M, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_H, th[2], mac_idx); @@ -933,7 +955,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_L, th[6], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_M, th[7], mac_idx); - th = d->bands[0].qam_comp_th2; + th = d->bands[chan->rfsi_band].qam_comp_th2; rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2L, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2M, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2H, th[2], mac_idx); @@ -943,7 +965,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_2L, th[6], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_2M, th[7], mac_idx); - th = d->bands[0].qam_comp_ow; + th = d->bands[chan->rfsi_band].qam_comp_ow; rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKLWORD, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKHWORD, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKLWORD, th[2], mac_idx); @@ -954,7 +976,46 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKHWORD, th[7], mac_idx); } +static void rtw89_phy_trig_spect_tx_shape_disabled(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + enum rtw89_mac_idx mac_idx) +{ + const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; + u8 band = chan->band_type; + u8 tx_shape_idx; + + /* + * Only needed by chips with d->bands[].{qam_comp_th0, qam_comp_ow} as + * what rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val() does. + / + if (!d) + return; + + tx_shape_idx = rtw89_get_tx_shape_idx(rtwdev, band, RTW89_RS_OFDM); + if (tx_shape_idx) + return; + + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + + rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); +} + static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; @@ -963,7 +1024,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, if (!d) return; - th = d->bands[0].oob_dpd_by_cbw[0]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[0]; rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK2_BE4, th, mac_idx); @@ -973,7 +1034,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[1]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[1]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK2_BE4, th, mac_idx); @@ -983,7 +1044,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[2]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[2]; rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH2_BE4, th, mac_idx); @@ -993,7 +1054,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[3]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[3]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH2_BE4, th, mac_idx); @@ -1003,7 +1064,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[4]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[4]; rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH2_BE4, th, mac_idx); @@ -1013,7 +1074,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[5]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[5]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW2_BE4, th, mac_idx); @@ -1023,7 +1084,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[6]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[6]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW2_BE4, th, mac_idx); @@ -1033,7 +1094,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[7]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[7]; rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW2_BE4, th, mac_idx); @@ -1075,6 +1136,7 @@ static void rtw89_phy_bb_set_mdpd_qam_comp_val(struct rtw89_dev rtwdev, } static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; @@ -1083,7 +1145,7 @@ static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev, if (!d \|\| !d->common) return; - p = &d->common->bands[0].cim3k; + p = &d->common->bands[chan->rfsi_band].cim3k; rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH_BE4, p->th, mac_idx); rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_OW_BE4, p->ow, mac_idx); @@ -1097,6 +1159,14 @@ static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_SU_FORCE_EN, 1, mac_idx); rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_SU_FORCE_VAL, 0, mac_idx); + + if (rtwdev->hal.cid == RTL8922D_CID7025) + return; + + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU26_FORCE_EN, 1, mac_idx); + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU26_FORCE_VAL, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU52_FORCE_EN, 1, mac_idx); + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU52_FORCE_VAL, 1, mac_idx); } static void rtw89_phy_bb_set_cck_cfir_filter_val_gen3(struct rtw89_dev rtwdev, @@ -1146,17 +1216,26 @@ static void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init(struct rtw89_dev rtwdev, rtw89_entity_get_conf(rtwdev, &conf); chan = conf.chans[phy_idx]; - rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(rtwdev, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(rtwdev, chan, mac_idx); +} + +void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + u8 mac_idx) +{ + rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(rtwdev, chan, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen2_init(rtwdev, mac_idx); rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(rtwdev, chan, mac_idx); - rtw89_phy_bb_wrap_tx_rfsi_scenario_def(rtwdev, mac_idx); - rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(rtwdev, mac_idx); - rtw89_phy_bb_set_oob_dpd_qam_comp_val(rtwdev, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_scenario_def(rtwdev, chan, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(rtwdev, chan, mac_idx); + rtw89_phy_trig_spect_tx_shape_disabled(rtwdev, chan, mac_idx); + rtw89_phy_bb_set_oob_dpd_qam_comp_val(rtwdev, chan, mac_idx); rtw89_phy_bb_set_mdpd_qam_comp_val(rtwdev, mac_idx); - rtw89_phy_bb_set_cim3k_val(rtwdev, mac_idx); + rtw89_phy_bb_set_cim3k_val(rtwdev, chan, mac_idx); rtw89_phy_bb_set_cck_cfir_filter_val_gen3(rtwdev, mac_idx); - rtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, 0, phy_idx); - rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(rtwdev, chan, phy_idx); + rtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, chan, mac_idx); } +EXPORT_SYMBOL(rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan); static void rtw89_phy_bb_wrap_ul_pwr(struct rtw89_dev rtwdev) { diff --git a/drivers/net/wireless/realtek/rtw89/ps.c b/drivers/net/wireless/realtek/rtw89/ps.c index 31bb5dcd284ae..23a9c7a0704a7 100644 --- a/drivers/net/wireless/realtek/rtw89/ps.c +++ b/drivers/net/wireless/realtek/rtw89/ps.c @@ -363,15 +363,12 @@ void rtw89_recalc_lps(struct rtw89_dev rtwdev) { struct ieee80211_vif vif, found_vif = NULL; struct rtw89_vif rtwvif; - enum rtw89_entity_mode mode; int count = 0; - mode = rtw89_get_entity_mode(rtwdev); - if (mode == RTW89_ENTITY_MODE_MCC) - goto disable_lps; - rtw89_for_each_rtwvif(rtwdev, rtwvif) { vif = rtwvif_to_vif(rtwvif); + if (vif->type == NL80211_IFTYPE_P2P_DEVICE) + continue; if (vif->type != NL80211_IFTYPE_STATION) { count = 0; @@ -387,7 +384,6 @@ void rtw89_recalc_lps(struct rtw89_dev rtwdev) return; } -disable_lps: rtw89_leave_lps(rtwdev); rtwdev->lps_enabled = false; } diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h index abeeb61007dce..4291e8115f105 100644 --- a/drivers/net/wireless/realtek/rtw89/reg.h +++ b/drivers/net/wireless/realtek/rtw89/reg.h @@ -10696,6 +10696,10 @@ #define B_FBTB_CT_FTM_BE4 GENMASK(23, 20) #define B_FBTB_CT_SENS_BE4 GENMASK(27, 24) #define R_CIM3K_SU_FORCE 0x119F8 +#define B_CIM3K_RU26_FORCE_EN BIT(13) +#define B_CIM3K_RU26_FORCE_VAL BIT(14) +#define B_CIM3K_RU52_FORCE_EN BIT(15) +#define B_CIM3K_RU52_FORCE_VAL BIT(16) #define B_CIM3K_SU_FORCE_EN BIT(17) #define B_CIM3K_SU_FORCE_VAL BIT(18) #define R_QAM3_TH0_BE4 0x119FC @@ -11068,13 +11072,17 @@ #define B_KTBL0_RST BIT(31) #define R_CFIR_CTRL_A_BE4 0x38124 #define R_CFIR_CTRL_B_BE4 0x38224 +#define B_CFIR_CTRL_RXKIDX0_EN BIT(0) #define B_CFIR_CTRL_KIDX0_EN BIT(8) +#define B_CFIR_CTRL_RXKIDX1_EN BIT(16) #define B_CFIR_CTRL_KIDX1_EN BIT(24) #define R_TX_IQC_A_BE4 0x38138 #define R_TX_IQC_B_BE4 0x38238 #define B_TX_IQC_X GENMASK(31, 20) #define B_TX_IQC_Y GENMASK(19, 8) #define B_TX_IQC_DPK BIT(3) +#define R_RX_IQC_A_BE4 0x3813c +#define R_RX_IQC_B_BE4 0x3823c #define R_KTBL1A_BE4 0x38154 #define R_KTBL1B_BE4 0x38254 #define B_KTBL1_TBL0 BIT(3) diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c index 14fab6b1a74a7..942f556339421 100644 --- a/drivers/net/wireless/realtek/rtw89/regd.c +++ b/drivers/net/wireless/realtek/rtw89/regd.c @@ -1091,7 +1091,7 @@ static bool __rtw89_reg_6ghz_power_recalc(struct rtw89_dev rtwdev) int count = 0; u8 index; - rtw89_for_each_rtwvif(rtwdev, rtwvif) { + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) { rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) { chan = rtw89_chan_get(rtwdev, rtwvif_link->chanctx_idx); if (chan->band_type != RTW89_BAND_6G) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c index 142e693c87bfd..75297b39c4d78 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c @@ -343,35 +343,79 @@ static const struct rtw89_efuse_block_cfg rtw8922d_efuse_blocks[] = { static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7025 = { .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_ENABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, .pb_tb = 3, + .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM}, }, [RFSI_CTRL_BAND_2GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_ENABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, .pb_tb = 0, + .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM}, }}, - .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM, RFSI_MAX, RFSI_MAX, RFSI_MAX}, }; static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090 = { .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_DISABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, - .pb_tb = 3, + .pb_tb = 0, + .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM}, }, [RFSI_CTRL_BAND_2GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_DISABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, .pb_tb = 0, + .qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM}, }}, - .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM, RFSI_MAX, RFSI_MAX, RFSI_MAX}, +}; + +static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090_rfe38 = { + .bands = { + [RFSI_CTRL_BAND_5_6GHZ] = { + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, + .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), + _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, + .pb_tb = 0, + .qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM}, + }, + [RFSI_CTRL_BAND_2GHZ] = { + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, + .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), + _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, + .pb_tb = 0, + .qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM}, + }}, +}; + +static const +struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7025 = { + .qam_th = { + .mdpd_160m = RFSI_BPSK, + .mdpd_320m = RFSI_BPSK, + .oob_dpd_20m = RFSI_16QAM, + .oob_dpd_40m = RFSI_16QAM, + .oob_dpd_80m = RFSI_16QAM, + .cim3k = RFSI_16QAM, + }, +}; + +static const +struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7090 = { + .qam_th = { + .mdpd_160m = RFSI_16QAM, + .mdpd_320m = RFSI_16QAM, + .oob_dpd_20m = RFSI_16QAM, + .oob_dpd_40m = RFSI_16QAM, + .oob_dpd_80m = RFSI_16QAM, + .cim3k = RFSI_16QAM, + }, }; static const @@ -390,6 +434,7 @@ struct rtw89_bb_wrap_common_data_gen3 rtw8922d_bb_wrap_common_data_gen3_7090 = { static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = { .common = &rtw8922d_bb_wrap_common_data_7025, + .common_gen2 = &rtw8922d_bb_wrap_common_data_gen2_7025, .common_gen3 = NULL, .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { @@ -417,21 +462,22 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = { static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = { .common = &rtw8922d_bb_wrap_common_data_7090, + .common_gen2 = &rtw8922d_bb_wrap_common_data_gen2_7090, .common_gen3 = &rtw8922d_bb_wrap_common_data_gen3_7090, .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .qam_comp_th0 = {0x4000, 0x6420, 0x6520, 0x6000, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x6400, 0x6500, 0x6000, + .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0x4000, + .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0}, + .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0, 0}, .oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF}, }, [RFSI_CTRL_BAND_2GHZ] = { .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4600, 0, 0, 0, 0, 0, 0, 0)}, .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, @@ -442,23 +488,24 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = { .mdpd_by_dbw = {MDPD_OFF, MDPD_OFF, MDPD_ON, MDPD_ON}, }; -static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe35_41_44 = { - .common = &rtw8922d_bb_wrap_common_data_7090, +static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe38 = { + .common = &rtw8922d_bb_wrap_common_data_7090_rfe38, + .common_gen2 = &rtw8922d_bb_wrap_common_data_gen2_7090, .common_gen3 = &rtw8922d_bb_wrap_common_data_gen3_7090, .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .qam_comp_th0 = {0x4000, 0x6420, 0x6520, 0x6000, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x6400, 0x6500, 0x6000, + .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4600, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0x4000, + .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0}, + .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0, 0}, .oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF}, }, [RFSI_CTRL_BAND_2GHZ] = { .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4700, 0, 0, 0, 0, 0, 0, 0)}, .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, @@ -466,7 +513,7 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe35_41_44 = .oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF}, }}, - .mdpd_by_dbw = {MDPD_OFF, MDPD_OFF, MDPD_ON, MDPD_ON}, + .mdpd_by_dbw = {MDPD_ON, MDPD_ON, MDPD_ON, MDPD_ON}, }; static void rtw8922d_sel_bt_rx_path(struct rtw89_dev rtwdev, u8 val, @@ -901,6 +948,9 @@ static int rtw8922d_read_sys(struct rtw89_dev rtwdev, u8 log_map) u16 digk; u8 vmin; + if (!test_bit(RTW89_QUIRK_THERMAL_PROT_VCORE, rtwdev->quirks)) + return 0; + digk = log_map[0x200] \| log_map[0x201] << 8; hal->thermal_prot_vmax = u16_get_bits(digk, B_BE_PWMTUNE_MASK); @@ -1142,24 +1192,13 @@ static int rtw8922d_data_setup(struct rtw89_dev rtwdev) { const struct rtw89_bb_wrap_data data; struct rtw89_hal hal = &rtwdev->hal; - bool rfe35_41_44 = false; - - switch (rtwdev->efuse.rfe_type) { - case 35: - case 41: - case 44: - rfe35_41_44 = true; - break; - } - if (hal->cid == RTL8922D_CID7025) { + if (hal->cid == RTL8922D_CID7025) data = &rtw8922d_bb_wrap_data_7025_default; - } else { - if (rfe35_41_44) - data = &rtw8922d_bb_wrap_data_7090_rfe35_41_44; - else - data = &rtw8922d_bb_wrap_data_7090_default; - } + else if (rtwdev->efuse.rfe_type == 38) + data = &rtw8922d_bb_wrap_data_7090_rfe38; + else + data = &rtw8922d_bb_wrap_data_7090_default; rtwdev->phy_info.bb_wrap_data = data; @@ -2432,14 +2471,15 @@ static int rtw8922d_ctrl_mlo(struct rtw89_dev rtwdev, enum rtw89_mlo_dbcc_mode rtw89_write32_mask(rtwdev, reg1, B_BBWRAP_ELMSR_EN_BE4, 0); } else if (mode == MLO_0_PLUS_2_1RF) { rtw89_phy_write32_mask(rtwdev, R_SYS_DBCC_BE4, - B_SYS_DBCC_24G_BAND_SEL_BE4, RTW89_PHY_0); + B_SYS_DBCC_24G_BAND_SEL_BE4, RTW89_PHY_1); rtw89_write32_mask(rtwdev, reg0, B_BBWRAP_ELMSR_EN_BE4, 0); rtw89_write32_mask(rtwdev, reg1, B_BBWRAP_ELMSR_EN_BE4, 0); } else if ((mode == MLO_1_PLUS_1_1RF) \|\| (mode == DBCC_LEGACY)) { struct rtw89_entity_conf conf; rtw89_entity_get_conf(rtwdev, &conf); - cck_phy_idx = conf.chans[1]->band_type == RTW89_BAND_2G ? + cck_phy_idx = conf.chans[0]->band_type != RTW89_BAND_2G && + conf.chans[1]->band_type == RTW89_BAND_2G ? RTW89_PHY_1 : RTW89_PHY_0; rtw89_phy_write32_mask(rtwdev, R_SYS_DBCC_BE4, @@ -2465,6 +2505,8 @@ static void rtw8922d_bb_sethw(struct rtw89_dev rtwdev) enum rtw89_phy_idx phy_idx; u32 reg; + rtw89_fw_h2c_phy_rfe_type(rtwdev); + reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_PWR_BOOST, RTW89_PHY_0); rtw89_write32_clr(rtwdev, reg, B_BE_PWR_CTRL_SEL); reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_PWR_BOOST, RTW89_PHY_1); @@ -2508,7 +2550,8 @@ static void rtw8922d_set_channel_bb(struct rtw89_dev rtwdev, u8 pri_sb = chan->pri_sb_idx; u32 val; - rtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, chan->rfsi_band, phy_idx); + rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(rtwdev, chan, phy_idx); + rtw8922d_ctrl_ch(rtwdev, chan, phy_idx); rtw8922d_ctrl_bw(rtwdev, pri_sb, chan->band_width, phy_idx); rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(rtwdev, chan, phy_idx); @@ -2822,6 +2865,64 @@ static void __rtw8922d_txiqk_enable(struct rtw89_dev rtwdev) } } +static void __rtw8922d_rxiqk_disable(struct rtw89_dev rtwdev) +{ + struct rtw89_rfk_mcc_info_data rfk_mcc = rtwdev->rfk_mcc.data; + u8 path, kidx; + + for (path = RF_PATH_A; path <= RF_PATH_B; path++) { + kidx = rfk_mcc[path].table_idx; + + if (kidx == 0) { + rtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + } else if (kidx == 1) { + rtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX1_EN); + } else { + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x1); + rtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x0); + } + + rtw89_phy_write32(rtwdev, R_RX_IQC_A_BE4 + (path << 8), 0x40000002); + } +} + +static void __rtw8922d_rxiqk_enable(struct rtw89_dev rtwdev) +{ + struct rtw89_rfk_mcc_info_data rfk_mcc = rtwdev->rfk_mcc.data; + struct rtw89_iqk_info iqk_info = &rtwdev->iqk; + u8 path, kidx; + + for (path = RF_PATH_A; path <= RF_PATH_B; path++) { + if (iqk_info->iqk_rx_fail[0][path]) + continue; + + kidx = rfk_mcc[path].table_idx; + + if (kidx == 0) { + rtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + } else if (kidx == 1) { + rtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX1_EN); + } else { + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x1); + rtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x0); + } + + rtw89_phy_write32(rtwdev, R_RX_IQC_A_BE4 + (path << 8), 0x40000000); + } +} + static void rtw8922d_rfk_scan(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link, bool start) @@ -2829,9 +2930,11 @@ static void rtw8922d_rfk_scan(struct rtw89_dev rtwdev, if (start) { __rtw8922d_tssi_disable(rtwdev, rtwvif_link->phy_idx); __rtw8922d_txiqk_disable(rtwdev); + __rtw8922d_rxiqk_disable(rtwdev); } else { __rtw8922d_tssi_enable(rtwdev, rtwvif_link->phy_idx); __rtw8922d_txiqk_enable(rtwdev); + __rtw8922d_rxiqk_enable(rtwdev); } } @@ -2909,61 +3012,6 @@ static void rtw8922d_set_txpwr_ref(struct rtw89_dev rtwdev, B_BE_PWR_REF_CTRL_CCK, ref_cck); } -static void rtw8922d_set_tx_shape(struct rtw89_dev rtwdev, - const struct rtw89_chan chan, - enum rtw89_phy_idx phy_idx) -{ - const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; - u8 band = chan->band_type; - u8 tx_shape_idx; - const u16 th; - - tx_shape_idx = rtw89_get_tx_shape_idx(rtwdev, band, RTW89_RS_OFDM); - if (tx_shape_idx == 0) - goto disable; - - th = d->bands[chan->rfsi_band].qam_comp_th0; - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKLWORD, th[0], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKHWORD, th[1], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKLWORD, th[2], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKHWORD, th[3], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, MASKLWORD, th[4], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, MASKHWORD, th[5], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKLWORD, th[6], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKHWORD, th[7], phy_idx); - - th = d->bands[chan->rfsi_band].qam_comp_ow; - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKLWORD, th[0], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKHWORD, th[1], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKLWORD, th[2], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKHWORD, th[3], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, MASKLWORD, th[4], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, MASKHWORD, th[5], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKLWORD, th[6], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKHWORD, th[7], phy_idx); - - return; - -disable: - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); -} - static void rtw8922d_set_txpwr_sar_diff(struct rtw89_dev rtwdev, const struct rtw89_chan chan, enum rtw89_phy_idx phy_idx) @@ -2995,7 +3043,6 @@ static void rtw8922d_set_txpwr(struct rtw89_dev rtwdev, { rtw89_phy_set_txpwr_byrate(rtwdev, chan, phy_idx); rtw89_phy_set_txpwr_offset(rtwdev, chan, phy_idx); - rtw8922d_set_tx_shape(rtwdev, chan, phy_idx); rtw89_phy_set_txpwr_limit(rtwdev, chan, phy_idx); rtw89_phy_set_txpwr_limit_ru(rtwdev, chan, phy_idx); rtw8922d_set_txpwr_ref(rtwdev, chan, phy_idx); diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922de.c b/drivers/net/wireless/realtek/rtw89/rtw8922de.c index a71e41f285446..d0dede477fb4a 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8922de.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8922de.c @@ -9,6 +9,12 @@ #include "reg.h" #include "rtw8922d.h" +static const struct rtw89_pci_ssid_quirk rtw8922de_pci_ssid_quirks[] = { + {RTW89_PCI_SSID(PCI_VENDOR_ID_REALTEK, 0x892D, 0x1E44, 0x1400, VALVE), + .bitmap = BIT(RTW89_QUIRK_LOW_LATENCY)}, + {}, +}; + static const struct rtw89_pci_info rtw8922d_pci_info = { .gen_def = &rtw89_pci_gen_be, .isr_def = &rtw89_pci_isr_be_v1, @@ -66,7 +72,7 @@ static const struct rtw89_pci_info rtw8922d_pci_info = { .disable_intr = rtw89_pci_disable_intr_v3, .recognize_intrs = rtw89_pci_recognize_intrs_v3, - .ssid_quirks = NULL, + .ssid_quirks = rtw8922de_pci_ssid_quirks, }; static const struct rtw89_driver_info rtw89_8922de_vs_info = { diff --git a/drivers/net/wireless/realtek/rtw89/util.h b/drivers/net/wireless/realtek/rtw89/util.h index c16e7a7f8bc92..aa87a520bdc38 100644 --- a/drivers/net/wireless/realtek/rtw89/util.h +++ b/drivers/net/wireless/realtek/rtw89/util.h @@ -21,6 +21,10 @@ #define rtw89_for_each_rtwvif(rtwdev, rtwvif) \ list_for_each_entry(rtwvif, &(rtwdev)->rtwvifs_list, list) +/ call this function with wiphy mutex is held / +#define rtw89_for_each_active_rtwvif(rtwdev, rtwvif) \ + list_for_each_entry(rtwvif, &(rtwdev)->hal.entity_mgnt.active_list, mgnt_entry) + / Before adding rtwvif to list, we need to check if it already exist, beacase * in some case such as SER L2 happen during WoWLAN flow, calling reconfig * twice cause the list to be added twice.
3/2	2026/08/26 06:47	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 34435 output: 24 thoughts: 1169 Thoughts: Assessing the Fuzzability of this rtw89 Patch Okay, so I've got this patch for the `rtw89` wireless driver. It touches a whole bunch of files – looks like a fairly comprehensive change. I immediately notice it’s modifying a Realtek wireless driver, `rtw89`, which, as a PCIe driver, generally means it's tightly coupled with the hardware, making it immediately raise a question in my mind regarding fuzzing. My primary concern is whether this is something that's reasonably testable or fuzzable in a standard environment. Can I use a tool like QEMU, or will I need physical hardware? Specifically, the fact that it's a Realtek 802.11ax/be driver means it's likely dependent on physical hardware for full functionality. My experience with similar PCI wireless drivers, like `iwlwifi` or `ath10k`, tells me that these often necessitate specific emulation or actual hardware. `mac80211_hwsim` offers software emulation, but this is a hardware driver, so that's not the same. The patch introduces a new macro `rtw89_for_each_active_rtwvif`, and it looks like it's handling changes to channel context and firmware interactions, adding quirks (specifically, `RTW89_QUIRK_LOW_LATENCY` and `RTW89_QUIRK_THERMAL_PROT_VCORE`), and even device-specific quirks like the `rtw8922de_pci_ssid_quirks` relating to Valve hardware. These areas are all potentially interesting from a fuzzing perspective, but the crucial question is how to reach them. I know Syzkaller can fuzz PCI devices, and I'm aware that it has methods for interacting via the netlink interface, like `mac80211/cfg80211`, but I need to quickly determine the reachability here. I see a few clues. Firstly, `rtw8922de` is PCIe, meaning it's dependent on the PCI subsystem. Secondly, the prompt itself is clear on the topic. The driver's vendor-specific PCIe nature might exclude it from being readily tested with standard QEMU. Realistically, for something like this, the driver needs to be probed by the PCI subsystem to be accessible. That means a virtual PCI device needs to exist or manual binding will be necessary, and even then, I would expect probe failures without hardware. Syzkaller doesn't seem to have a generic PCI emulator that can bypass this. Is there a workaround via `cfg80211`? I need to check if the driver can be probed without hardware. The issue is that if the driver isn't probed, then the `cfg80211` wiphy isn't registered, and thus the netlink commands won't even reach the driver code. The final question would be whether there is any form of "virtual test mode" built into the `rtw89` driver itself.
4/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "rtw89_core_register_hw" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/core.c=7459=void rtw89_chip_cfg_txpwr_ul_tb_offset(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7479-\ndrivers/net/wireless/realtek/rtw89/core.c:7480:static int rtw89_core_register_hw(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-7481-{\n--\ndrivers/net/wireless/realtek/rtw89/core.c=7632=int rtw89_core_register(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7635-\ndrivers/net/wireless/realtek/rtw89/core.c:7636:\tret = rtw89_core_register_hw(rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.c-7637-\tif (ret) {\n" }
5/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 36606 output: 22 thoughts: 40 Thoughts: Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person: Registering the Hardware: A Deep Dive Right, so the driver, that `rtw89` thing, it's hooking itself into the mac80211 stack. Specifically, it's using `rtw89_core_register_hw`. That's the key registration function. I need to be sure the hardware is registered at the right time. The real question I need to consider is: where is `rtw89_core_register` getting called from? Is it being called in the PCI probe routine? That's the most likely place. If so, it would mean the driver's initialization is properly tied to the PCI device's detection, which would be ideal. I want to confirm that the hardware is properly initialized at the time the module probes the device. This is a crucial area to check for any potential initialization flaws in my own code.
6/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "rtw89_core_register" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/core.c=7459=void rtw89_chip_cfg_txpwr_ul_tb_offset(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7479-\ndrivers/net/wireless/realtek/rtw89/core.c:7480:static int rtw89_core_register_hw(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-7481-{\n--\ndrivers/net/wireless/realtek/rtw89/core.c=7623=static void rtw89_core_unregister_hw(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7631-\ndrivers/net/wireless/realtek/rtw89/core.c:7632:int rtw89_core_register(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/core.c-7633-{\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7635-\ndrivers/net/wireless/realtek/rtw89/core.c:7636:\tret = rtw89_core_register_hw(rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.c-7637-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7646-}\ndrivers/net/wireless/realtek/rtw89/core.c:7647:EXPORT_SYMBOL(rtw89_core_register);\ndrivers/net/wireless/realtek/rtw89/core.c-7648-\n--\ndrivers/net/wireless/realtek/rtw89/core.h=9306=void rtw89_core_deinit(struct rtw89_dev rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h:9307:int rtw89_core_register(struct rtw89_dev rtwdev);\ndrivers/net/wireless/realtek/rtw89/core.h-9308-void rtw89_core_unregister(struct rtw89_dev rtwdev);\n--\ndrivers/net/wireless/realtek/rtw89/pci.c=4769=int rtw89_pci_probe(struct pci_dev pdev, const struct pci_device_id id)\n--\ndrivers/net/wireless/realtek/rtw89/pci.c-4836-\ndrivers/net/wireless/realtek/rtw89/pci.c:4837:\tret = rtw89_core_register(rtwdev);\ndrivers/net/wireless/realtek/rtw89/pci.c-4838-\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=1203=int rtw89_usb_probe(struct usb_interface intf,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-1237-\tif (ret) {\ndrivers/net/wireless/realtek/rtw89/usb.c:1238:\t\t/* Not a fail, but we do need to skip rtw89_core_register. */\ndrivers/net/wireless/realtek/rtw89/usb.c-1239-\t\tret = 0;\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-1269-\ndrivers/net/wireless/realtek/rtw89/usb.c:1270:\tret = rtw89_core_register(rtwdev);\ndrivers/net/wireless/realtek/rtw89/usb.c-1271-\tif (ret) {\n" }
7/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 37926 output: 21 thoughts: 154 Thoughts: USB Interface Investigation Okay, so this patch affects the Realtek wireless driver, specifically `rtw89`, and it's got a USB interface – that's good news, I see it right there: `drivers/net/wireless/realtek/rtw89/usb.c`. My first thought is, can I leverage Syzkaller for this? I remember Syzkaller's USB fuzzing capabilities, the dummy_hcd and vhci stuff. The question is, can Syzkaller really emulate USB devices effectively here? I'm pretty sure it can, it can certainly emulate some USB devices, but I need to make sure this is the right approach. Hmm, this is important; does the patch actually touch USB-specific code? I need to verify that it does or does not modify the USB-specific code to confirm the path I'm on. Let's see... it looks like the changes are in `rtw8922d.c`, `rtw8922de.c`, `chan.c`, `core.c`, `fw.c`, `phy.c`, etc. But hold on, `rtw8922de.c` seems to be PCIe related. Is there an `rtw8922du.c` to account for the USB interface? I need to check the full scope.
8/2	2026/08/26 06:48	tool	grepper	0m Error: no matches Args: { "Expression": "rtw8922du" } Results: { "error": "no matches" }
9/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 38413 output: 22 thoughts: 16 Thoughts: Here's my thought process, as if I were considering this query: Investigating rtw89 USB Device Support Okay, so the user wants to know about USB device support within the `rtw89` driver. My initial reaction is to consider the typical approach to determine this. Since I'm familiar with this area, I'd immediately think about how the driver interacts with the USB subsystem. I'd begin by considering the kernel source. I'll need to delve into the `rtw89` driver code itself, specifically focusing on its USB-related sections. I'll have to look for device IDs, probe functions, and any associated USB descriptors to understand which specific USB devices are explicitly handled. I will likely need to check the relevant include files. I will also make sure to check the kernel documentation in case there is some helpful information to review. The documentation will probably point to relevant source code. Hopefully, there is some kind of device tree information somewhere. This will then allow me to ascertain whether the driver handles the necessary initialization and communication protocols for various USB devices. Essentially, I need to find the "supported devices" list, probably in the form of a table or series of entries that match against the USB device IDs. I'm going to determine what USB hardware this driver is intended to manage.
10/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "rtw89_usb_probe" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/rtw8851bu.c=62=static struct usb_driver rtw_8851bu_driver = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c-64-\t.id_table = rtw_8851bu_id_table,\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c:65:\t.probe = rtw89_usb_probe,\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c-66-\t.disconnect = rtw89_usb_disconnect,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c=76=static struct usb_driver rtw_8852au_driver = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c-78-\t.id_table = rtw_8852au_id_table,\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c:79:\t.probe = rtw89_usb_probe,\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c-80-\t.disconnect = rtw89_usb_disconnect,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c=76=static struct usb_driver rtw_8852bu_driver = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c-78-\t.id_table = rtw_8852bu_id_table,\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c:79:\t.probe = rtw89_usb_probe,\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c-80-\t.disconnect = rtw89_usb_disconnect,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c=136=static struct usb_driver rtw_8852cu_driver = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c-138-\t.id_table = rtw_8852cu_id_table,\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c:139:\t.probe = rtw89_usb_probe,\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c-140-\t.disconnect = rtw89_usb_disconnect,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c=77=static struct usb_driver rtw_8922au_driver = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c-79-\t.id_table = rtw_8922au_id_table,\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c:80:\t.probe = rtw89_usb_probe,\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c-81-\t.disconnect = rtw89_usb_disconnect,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=1201=__ATTRIBUTE_GROUPS(rtw89_usb);\ndrivers/net/wireless/realtek/rtw89/usb.c-1202-\ndrivers/net/wireless/realtek/rtw89/usb.c:1203:int rtw89_usb_probe(struct usb_interface intf,\ndrivers/net/wireless/realtek/rtw89/usb.c-1204-\t\t const struct usb_device_id id)\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-1294-}\ndrivers/net/wireless/realtek/rtw89/usb.c:1295:EXPORT_SYMBOL(rtw89_usb_probe);\ndrivers/net/wireless/realtek/rtw89/usb.c-1296-\n--\ndrivers/net/wireless/realtek/rtw89/usb.h=92=static inline struct rtw89_usb rtw89_usb_priv(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/usb.h-96-\ndrivers/net/wireless/realtek/rtw89/usb.h:97:int rtw89_usb_probe(struct usb_interface intf,\ndrivers/net/wireless/realtek/rtw89/usb.h-98-\t\t const struct usb_device_id id);\n" }
11/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 40012 output: 22 thoughts: 86 Thoughts: Here's my take on the situation: Investigating the rtw8922 Driver Updates Okay, so I'm looking at these patches, and it's clear we're dealing with the `rtw8922` driver. Specifically, `rtw8922au.c` immediately flags as USB, that's straightforward. Now the modification is going to `rtw8922d.c`, and `rtw8922de.c`. From memory, `rtw8922d.c` should be the core logic for the 8922d chipset. And `rtw8922de.c` should be the PCIe variant. But hold on, this is interesting. I'm getting a little curious. I need to be absolutely certain on this. Does `rtw8922d.c`, the core driver, actually get used by the USB implementation as well? Given the typical driver architecture, it probably does. But let's verify that with some quick cross-referencing. Gotta make sure the implications of the patch on the core driver, and potential side-effects on the USB implementation, are fully understood.
12/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "rtw8922d_" } Results: { "Output": "\nFull output is too long, showing 500 out of 1203 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtw89/Makefile=95=rtw89_8922d-objs := rtw8922d.o \\\ndrivers/net/wireless/realtek/rtw89/Makefile:96:\t\t rtw8922d_rfk.o\ndrivers/net/wireless/realtek/rtw89/Makefile-97-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-12-#include \"rtw8922d.h\"\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:13:#include \"rtw8922d_rfk.h\"\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-14-#include \"sar.h\"\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-17-#define RTW8922D_FW_FORMAT_MAX 0\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:18:#define RTW8922D_FW_BASENAME \"rtw89/rtw8922d_fw\"\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-19-#define RTW8922D_MODULE_FIRMWARE \\\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-26-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:27:static const struct rtw89_hfc_ch_cfg rtw8922d_hfc_chcfg_pcie[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-28-\t{2, 732, 0}, /* ACH 0 /\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-42-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:43:static const struct rtw89_hfc_pub_cfg rtw8922d_hfc_pubcfg_pcie = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-44-\t742, / Group 0 /\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-49-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:50:static const struct rtw89_hfc_param_ini rtw8922d_hfc_param_ini_pcie[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:51:\t[RTW89_QTA_SCC] = {rtw8922d_hfc_chcfg_pcie, \u0026rtw8922d_hfc_pubcfg_pcie,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-52-\t\t\t \u0026rtw89_mac_size.hfc_prec_cfg_c0, RTW89_HCIFC_POH},\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:53:\t[RTW89_QTA_DBCC] = {rtw8922d_hfc_chcfg_pcie, \u0026rtw8922d_hfc_pubcfg_pcie,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-54-\t\t\t \u0026rtw89_mac_size.hfc_prec_cfg_c0, RTW89_HCIFC_POH},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-59-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:60:static const struct rtw89_dle_mem rtw8922d_dle_mem_pcie[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-61-\t[RTW89_QTA_SCC] = {RTW89_QTA_SCC, \u0026rtw89_mac_size.wde_size22_v1,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=116=static const struct rtw89_dle_mem rtw8922ds_dle_mem_pcie[] = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-138-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:139:static const u32 rtw8922d_h2c_regs[RTW89_H2CREG_MAX] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-140-\tR_BE_H2CREG_DATA0, R_BE_H2CREG_DATA1, R_BE_H2CREG_DATA2,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-143-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:144:static const u32 rtw8922d_c2h_regs[RTW89_H2CREG_MAX] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-145-\tR_BE_C2HREG_DATA0, R_BE_C2HREG_DATA1, R_BE_C2HREG_DATA2,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-148-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:149:static const u32 rtw8922d_wow_wakeup_regs[RTW89_WOW_REASON_NUM] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-150-\tR_BE_DBG_WOW, R_BE_DBG_WOW,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-152-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:153:static const struct rtw89_page_regs rtw8922d_page_regs = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-154-\t.hci_fc_ctrl\t= R_BE_HCI_FC_CTRL,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-167-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:168:static const struct rtw89_reg_imr rtw8922d_imr_dmac_regs[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-169-\t{R_BE_HCI_BUF_IMR, B_BE_HCI_BUF_IMR_CLR, B_BE_HCI_BUF_IMR_SET},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-195-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:196:static const struct rtw89_imr_table rtw8922d_imr_dmac_table = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:197:\t.regs = rtw8922d_imr_dmac_regs,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:198:\t.n_regs = ARRAY_SIZE(rtw8922d_imr_dmac_regs),\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-199-};\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-200-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:201:static const struct rtw89_reg_imr rtw8922d_imr_cmac_regs[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-202-\t{R_BE_RESP_IMR, B_BE_RESP_IMR_CLR_V1, B_BE_RESP_IMR_SET_V1},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-217-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:218:static const struct rtw89_imr_table rtw8922d_imr_cmac_table = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:219:\t.regs = rtw8922d_imr_cmac_regs,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:220:\t.n_regs = ARRAY_SIZE(rtw8922d_imr_cmac_regs),\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-221-};\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-222-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:223:static const struct rtw89_rrsr_cfgs rtw8922d_rrsr_cfgs = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-224-\t.ref_rate = {R_BE_TRXPTCL_RESP_1, B_BE_WMAC_RESP_REF_RATE_SEL, 0},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-227-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:228:static const struct rtw89_rfkill_regs rtw8922d_rfkill_regs = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-229-\t.pinmux = {R_BE_GPIO8_15_FUNC_SEL,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-236-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:237:static const struct rtw89_dig_regs rtw8922d_dig_regs = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-238-\t.seg0_pd_reg = R_SEG0R_PD_BE4,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-260-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:261:static const struct rtw89_edcca_regs rtw8922d_edcca_regs = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-262-\t.edcca_level\t\t\t= R_SEG0R_EDCCA_LVL_BE4,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-283-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:284:static const struct rtw89_pmac_regs rtw8922d_pmac_regs = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-285-\t.cck_txon = {R_CNT_CCKTXON_BE4, B_CNT_CCKTXON},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-331-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:332:static const struct rtw89_efuse_block_cfg rtw8922d_efuse_blocks[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-333-\t[RTW89_EFUSE_BLOCK_SYS]\t\t\t= {.offset = 0x00000, .size = 0x310},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-342-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:343:static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7025 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-344-\t.bands = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-360-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:361:static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-362-\t.bands = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-378-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:379:static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090_rfe38 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-380-\t.bands = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=397=static const\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:398:struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7025 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-399-\t.qam_th = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=409=static const\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:410:struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7090 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-411-\t.qam_th = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=421=static const\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:422:struct rtw89_bb_wrap_common_data_gen3 rtw8922d_bb_wrap_common_data_gen3_7090 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-423-\t.bands = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-434-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:435:static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:436:\t.common = \u0026rtw8922d_bb_wrap_common_data_7025,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:437:\t.common_gen2 = \u0026rtw8922d_bb_wrap_common_data_gen2_7025,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-438-\t.common_gen3 = NULL,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-462-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:463:static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:464:\t.common = \u0026rtw8922d_bb_wrap_common_data_7090,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:465:\t.common_gen2 = \u0026rtw8922d_bb_wrap_common_data_gen2_7090,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:466:\t.common_gen3 = \u0026rtw8922d_bb_wrap_common_data_gen3_7090,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-467-\t.bands = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-490-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:491:static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe38 = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:492:\t.common = \u0026rtw8922d_bb_wrap_common_data_7090_rfe38,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:493:\t.common_gen2 = \u0026rtw8922d_bb_wrap_common_data_gen2_7090,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:494:\t.common_gen3 = \u0026rtw8922d_bb_wrap_common_data_gen3_7090,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-495-\t.bands = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-518-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:519:static void rtw8922d_sel_bt_rx_path(struct rtw89_dev rtwdev, u8 val,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-520-\t\t\t\t enum rtw89_rf_path rx_path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-531-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:532:static void rtw8922d_sel_bt_rx_phy(struct rtw89_dev rtwdev, u8 val,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-533-\t\t\t\t enum rtw89_phy_idx phy_idx)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-538-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:539:static void rtw8922d_set_gbt_bt_rx_sel(struct rtw89_dev rtwdev, bool en,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-540-\t\t\t\t enum rtw89_phy_idx phy_idx)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-541-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:542:\trtw8922d_sel_bt_rx_path(rtwdev, 0x3, RF_PATH_A);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:543:\trtw8922d_sel_bt_rx_phy(rtwdev, 0x0, RTW89_PHY_0);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:544:\trtw8922d_sel_bt_rx_path(rtwdev, 0x3, RF_PATH_B);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:545:\trtw8922d_sel_bt_rx_phy(rtwdev, 0x0, RTW89_PHY_1);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-546-}\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-547-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:548:static int rtw8922d_pwr_on_func(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-549-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-716-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:717:static int rtw8922d_pwr_off_func(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-718-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-797-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:798:static void rtw8922d_efuse_parsing_tssi(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:799:\t\t\t\t\tstruct rtw8922d_efuse map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-800-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:801:\tconst struct rtw8922d_tssi_offset_6g * const ofst_6g[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-802-\t\t\u0026map-\u003epath_a_tssi_6g,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-804-\t};\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:805:\tconst struct rtw8922d_tssi_offset * const ofst[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-806-\t\t\u0026map-\u003epath_a_tssi,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=842=static void\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:843:__rtw8922d_efuse_parsing_gain_offset(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-844-\t\t\t\t s8 offset[RTW89_GAIN_OFFSET_NR],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-845-\t\t\t\t const s8 offset_default,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:846:\t\t\t\t const struct rtw8922d_rx_gain rx_gain,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:847:\t\t\t\t const struct rtw8922d_rx_gain_6g rx_gain_6g)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-848-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-883-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:884:static void rtw8922d_efuse_parsing_gain_offset(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:885:\t\t\t\t\t struct rtw8922d_efuse map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-886-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-888-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:889:\t__rtw8922d_efuse_parsing_gain_offset(rtwdev, gain-\u003eoffset[RF_PATH_A],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-890-\t\t\t\t\t NULL,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-891-\t\t\t\t\t \u0026map-\u003erx_gain_a, \u0026map-\u003erx_gain_6g_a);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:892:\t__rtw8922d_efuse_parsing_gain_offset(rtwdev, gain-\u003eoffset[RF_PATH_B],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-893-\t\t\t\t\t NULL,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-895-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:896:\t__rtw8922d_efuse_parsing_gain_offset(rtwdev, gain-\u003eoffset2[RF_PATH_A],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-897-\t\t\t\t\t gain-\u003eoffset[RF_PATH_A],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-898-\t\t\t\t\t \u0026map-\u003erx_gain_a_2, \u0026map-\u003erx_gain_6g_a_2);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:899:\t__rtw8922d_efuse_parsing_gain_offset(rtwdev, gain-\u003eoffset2[RF_PATH_B],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-900-\t\t\t\t\t gain-\u003eoffset[RF_PATH_B],\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-905-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:906:static int rtw8922d_read_efuse_pci_sdio(struct rtw89_dev rtwdev, u8 log_map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-907-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-917-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:918:static int rtw8922d_read_efuse_usb(struct rtw89_dev rtwdev, u8 log_map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-919-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-926-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:927:static int rtw8922d_read_efuse_rf(struct rtw89_dev rtwdev, u8 log_map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-928-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:929:\tstruct rtw8922d_efuse map = (struct rtw8922d_efuse )log_map;\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-930-\tstruct rtw89_efuse efuse = \u0026rtwdev-\u003eefuse;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-937-\tefuse-\u003ebt_setting_3 = map-\u003ebt_setting_3;\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:938:\trtw8922d_efuse_parsing_tssi(rtwdev, map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:939:\trtw8922d_efuse_parsing_gain_offset(rtwdev, map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-940-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-943-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:944:static int rtw8922d_read_sys(struct rtw89_dev rtwdev, u8 log_map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-945-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-968-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:969:static int rtw8922d_read_efuse(struct rtw89_dev rtwdev, u8 log_map,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-970-\t\t\t enum rtw89_efuse_block block)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-973-\tcase RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO:\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:974:\t\treturn rtw8922d_read_efuse_pci_sdio(rtwdev, log_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-975-\tcase RTW89_EFUSE_BLOCK_HCI_DIG_USB:\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:976:\t\treturn rtw8922d_read_efuse_usb(rtwdev, log_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-977-\tcase RTW89_EFUSE_BLOCK_RF:\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:978:\t\treturn rtw8922d_read_efuse_rf(rtwdev, log_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-979-\tcase RTW89_EFUSE_BLOCK_SYS:\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:980:\t\treturn rtw8922d_read_sys(rtwdev, log_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-981-\tdefault:\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-985-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:986:static void rtw8922d_phycap_parsing_vco_trim(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-987-\t\t\t\t\t u8 phycap_map)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1004-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1005:static void rtw8922d_vco_trim(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1006-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1020-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1021:static void rtw8922d_phycap_parsing_thermal_trim(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1022-\t\t\t\t\t\t u8 phycap_map)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1060-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1061:static void rtw8922d_thermal_trim(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1062-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1072-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1073:static void rtw8922d_phycap_parsing_pa_bias_trim(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1074-\t\t\t\t\t\t u8 phycap_map)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1101-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1102:static void rtw8922d_pa_bias_trim(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1103-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1127-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1128:static void rtw8922d_phycap_parsing_pad_bias_trim(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1129-\t\t\t\t\t\t u8 phycap_map)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1147-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1148:static void rtw8922d_pad_bias_trim(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1149-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1172-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1173:static int rtw8922d_read_phycap(struct rtw89_dev rtwdev, u8 phycap_map)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1174-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1175:\trtw8922d_phycap_parsing_vco_trim(rtwdev, phycap_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1176:\trtw8922d_phycap_parsing_thermal_trim(rtwdev, phycap_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1177:\trtw8922d_phycap_parsing_pa_bias_trim(rtwdev, phycap_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1178:\trtw8922d_phycap_parsing_pad_bias_trim(rtwdev, phycap_map);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1179-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1182-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1183:static void rtw8922d_power_trim(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1184-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1185:\trtw8922d_vco_trim(rtwdev);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1186:\trtw8922d_thermal_trim(rtwdev);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1187:\trtw8922d_pa_bias_trim(rtwdev);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1188:\trtw8922d_pad_bias_trim(rtwdev);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1189-}\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1190-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1191:static int rtw8922d_data_setup(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1192-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1196-\tif (hal-\u003ecid == RTL8922D_CID7025)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1197:\t\tdata = \u0026rtw8922d_bb_wrap_data_7025_default;\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1198-\telse if (rtwdev-\u003eefuse.rfe_type == 38)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1199:\t\tdata = \u0026rtw8922d_bb_wrap_data_7090_rfe38;\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1200-\telse\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1201:\t\tdata = \u0026rtw8922d_bb_wrap_data_7090_default;\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1202-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1207-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1208:static void rtw8922d_set_channel_mac(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1209-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1306-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1307:static const u32 rtw8922d_sco_barker_threshold[14] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1308-\t0x1fe4f, 0x1ff5e, 0x2006c, 0x2017b, 0x2028a, 0x20399, 0x204a8, 0x205b6,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1311-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1312:static const u32 rtw8922d_sco_cck_threshold[14] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1313-\t0x2bdac, 0x2bf21, 0x2c095, 0x2c209, 0x2c37e, 0x2c4f2, 0x2c666, 0x2c7db,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1316-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1317:static int rtw8922d_ctrl_sco_cck(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1318-\t\t\t\t u8 primary_ch, enum rtw89_bandwidth bw,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1328-\trtw89_phy_write32_idx(rtwdev, R_BK_FC0_INV_BE4, B_BK_FC0_INV_BE4,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1329:\t\t\t rtw8922d_sco_barker_threshold[ch_element],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1330-\t\t\t phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1331-\trtw89_phy_write32_idx(rtwdev, R_CCK_FC0_INV_BE4, B_CCK_FC0_INV_BE4,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1332:\t\t\t rtw8922d_sco_cck_threshold[ch_element],\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1333-\t\t\t phy_idx);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1337-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1338:static void rtw8922d_ctrl_ch_core(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1339-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1366-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1367:struct rtw8922d_bb_gain {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1368-\tu32 gain_g[BB_PATH_NUM_8922D];\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=1397=static const struct rtw89_reg_def rpl_comp_bw20[RTW89_BW20_SC_20M] = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1400-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1401:static const struct rtw8922d_bb_gain bb_gain_lna[LNA_GAIN_NUM] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1402-\t{ .gain_g = {0x2409C, 0x2449C}, .gain_a = {0x2406C, 0x2446C},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1417-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1418:static const struct rtw8922d_bb_gain bb_gain_tia[TIA_GAIN_NUM] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1419-\t{ .gain_g = {0x24054, 0x24454}, .gain_a = {0x24054, 0x24454},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1424-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1425:static const struct rtw8922d_bb_gain bb_op1db_lna[LNA_GAIN_NUM] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1426-\t{ .gain_g = {0x240AC, 0x244AC}, .gain_a = {0x24078, 0x24478},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1441-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1442:static const struct rtw8922d_bb_gain bb_op1db_tia_lna[TIA_LNA_OP1DB_NUM] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1443-\t{ .gain_g = {0x240B4, 0x244B4}, .gain_a = {0x24080, 0x24480},\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1460-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1461:static void rtw8922d_set_rpl_gain(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1462-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1505-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1506:static void rtw8922d_set_lna_tia_gain(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1507-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1546-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1547:static void rtw8922d_set_op1db(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1548-\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1587-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1588:static void rtw8922d_set_gain(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1589-\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1592-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1593:\trtw8922d_set_rpl_gain(rtwdev, chan, path, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1594:\trtw8922d_set_lna_tia_gain(rtwdev, chan, path, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1595:\trtw8922d_set_op1db(rtwdev, chan, path, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1596-}\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1597-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1598:static s8 rtw8922d_get_rx_gain_by_chan(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1599-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1710-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1711:static void rtw8922d_calc_rx_gain_normal_cck(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1712-\t\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1719-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1720:\trx_gain_offset = -rtw8922d_get_rx_gain_by_chan(rtwdev, chan, path, true);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1721-\tcalc-\u003ecck_mean_gain_bias = (rx_gain_offset \u0026 0x3) \u003c\u003c 1;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1724-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1725:static void rtw8922d_set_rx_gain_normal_cck(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1726-\t\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1731-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1732:\trtw8922d_calc_rx_gain_normal_cck(rtwdev, chan, path, phy_idx, \u0026calc);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1733-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1741-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1742:static void rtw8922d_calc_rx_gain_normal_ofdm(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1743-\t\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1750-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1751:\trx_gain_offset = rtw8922d_get_rx_gain_by_chan(rtwdev, chan, path, false);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1752-\tcalc-\u003erssi_ofst = (rx_gain_offset + gain-\u003eref_gain_base[phy_idx]) \u0026 0xff;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1754-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1755:static void rtw8922d_set_rx_gain_normal_ofdm(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1756-\t\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1765-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1766:\trtw8922d_calc_rx_gain_normal_ofdm(rtwdev, chan, path, phy_idx, \u0026calc);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1767-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1772-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1773:static void rtw8922d_set_rx_gain_normal(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1774-\t\t\t\t\tconst struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1783-\tif (chan-\u003eband_type == RTW89_BAND_2G)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1784:\t\trtw8922d_set_rx_gain_normal_cck(rtwdev, chan, path, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1785-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1786:\trtw8922d_set_rx_gain_normal_ofdm(rtwdev, chan, path, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1787-}\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1788-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1789:static void rtw8922d_calc_rx_gain_normal(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1790-\t\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1794-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1795:\trtw8922d_calc_rx_gain_normal_ofdm(rtwdev, chan, path, phy_idx, calc);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1796-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1799-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1800:\trtw8922d_calc_rx_gain_normal_cck(rtwdev, chan, path, phy_idx, calc);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1801-}\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1802-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1803:static void rtw8922d_path_diff_update(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1804-\t\t\t\t struct rtw89_bb_ctx bb)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1869-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1870:static void rtw8922d_set_cck_parameters(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1871-\t\t\t\t\tconst struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1910-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1911:static void rtw8922d_ctrl_ch(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1912-\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1923-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1924:\trtw8922d_ctrl_ch_core(rtwdev, chan, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1925-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1928-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1929:\trtw8922d_set_gain(rtwdev, chan, RF_PATH_A, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1930:\trtw8922d_set_gain(rtwdev, chan, RF_PATH_B, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1931-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1932:\trtw8922d_set_rx_gain_normal(rtwdev, chan, RF_PATH_A, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1933:\trtw8922d_set_rx_gain_normal(rtwdev, chan, RF_PATH_B, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1934-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1935-\tif (band == RTW89_BAND_2G)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1936:\t\trtw8922d_set_cck_parameters(rtwdev, chan, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1937-}\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1938-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1939:static void rtw8922d_ctrl_bw(struct rtw89_dev rtwdev, u8 pri_sb, u8 bw,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1940-\t\t\t enum rtw89_phy_idx phy_idx)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=1976=static const u16 spur_csi[] = {6400};\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1977-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:1978:static u32 rtw8922d_spur_freq(struct rtw89_dev rtwdev, const struct rtw89_chan chan,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-1979-\t\t\t bool nbi_or_csi, enum rtw89_rf_path path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2020-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2021:static void rtw8922d_set_csi_tone_idx(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2022-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2027-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2028:\tspur_freq = rtw8922d_spur_freq(rtwdev, chan, false, RF_PATH_AB);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2029-\tif (spur_freq == 0) {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2043-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2044:static const struct rtw89_nbi_reg_def rtw8922d_nbi_reg_def[] = {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2045-\t[RF_PATH_A] = {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2062-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2063:static void rtw8922d_set_nbi_tone_idx(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2064-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2067-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2068:\tconst struct rtw89_nbi_reg_def nbi = \u0026rtw8922d_nbi_reg_def[path];\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2069-\ts32 nbi_frac_idx, nbi_frac_tone_idx;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2074-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2075:\tspur_freq = rtw8922d_spur_freq(rtwdev, chan, true, path);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2076-\tif (spur_freq == 0) {\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2135-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2136:static void rtw8922d_spur_elimination(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2137-\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2139-{\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2140:\trtw8922d_set_csi_tone_idx(rtwdev, chan, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2141:\trtw8922d_set_nbi_tone_idx(rtwdev, chan, RF_PATH_A, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2142:\trtw8922d_set_nbi_tone_idx(rtwdev, chan, RF_PATH_B, phy_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2143-}\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=2147=static const u32 chip_top_bitmask[2] = {0xffff, 0xffff0000};\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2148-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2149:static void rtw8922d_bb_preinit(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2150-{\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2158-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2159:static void rtw8922d_bb_postinit(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx)\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2160-{\n--\n\n" }
13/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 59081 output: 21 thoughts: 105 Thoughts: Analyzing the 8922d Chip Driver Files Alright, let's break this down. It looks like `rtw8922d.c` is the central file for the 8922d chip's core functionality. Given my experience, I'd expect this to contain the fundamental logic, the heart of the driver. Now, the interesting part is how it's implemented for different interfaces. It looks like we have specialized files: `rtw8922de.c` for PCIe implementations, and `rtw8922au.c` for USB. Hang on... I need to double-check that `rtw8922au.c` exists. A quick grep also showed something like `rtw_8922au_driver`, so I'll want to verify that. I'm going to quickly confirm that file path. It will be important to understand how they leverage that core functionality in the context of the different bus types.
14/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "rtw8922au" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/Makefile=91=obj-$(CONFIG_RTW89_8922AU) += rtw89_8922au.o\ndrivers/net/wireless/realtek/rtw89/Makefile:92:rtw89_8922au-objs := rtw8922au.o\ndrivers/net/wireless/realtek/rtw89/Makefile-93-\n" }
15/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 59543 output: 19 thoughts: 503 Thoughts: Fuzzing Feasibility Assessment: Realtek rtw89 Driver Patch Okay, so this patch affects the `rtw89` Wi-Fi driver, specifically core files like `chan.c`, `core.c`, `fw.c`, `phy.c`, and `ps.c`. Crucially, I see that `rtw8922au.c` is present, confirming it's a USB driver, making it accessible through USB fuzzing techniques. That's a huge plus! The code in both `rtw8922d.c` and `rtw8922au.c` could be reached using tools like `dummy_hcd`. This patch messes with delayed work functions (`rtw89_track_ps_work`, `rtw89_track_work`), and adds `rtw89_chanctx_paused`. It's also modifying functions involving Wi-Fi entities and roles and adding support for `NL80211_IFTYPE_P2P_DEVICE`, all of which point to functional changes in the core driver logic. Now, the question is, is this fuzzable? Absolutely. Given the USB interface and the netlink interface, this thing is definitely worth fuzzing. I need to make sure this is reachable. I need to check how initialization works with this driver. Does it require firmware to initialize? It's often the case that syzkaller can bypass firmware checks, or at least fuzz up to the firmware loading point. I should verify if `rtw89` fails probe if firmware is missing. I'll need to confirm that. Wait, I need to make sure I meet the criteria in the prompt. I see from the prompt that I should return WorthFuzzing=false if the changes are specific to PCI hardware. Thankfully, `rtw89` is a Wi-Fi driver, and the USB interface means I can work with emulated environments using `dummy_hcd` or `vhci` within syzkaller. Perfect! That's another check in the "worth fuzzing" box. Now, I'll need to check the required configuration options.
16/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "config RTW89" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/Kconfig-1-# SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\ndrivers/net/wireless/realtek/rtw89/Kconfig:2:menuconfig RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-3-\ttristate \"Realtek 802.11ax wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=11=if RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-12-\ndrivers/net/wireless/realtek/rtw89/Kconfig:13:config RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-16-\ndrivers/net/wireless/realtek/rtw89/Kconfig:17:config RTW89_PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-19-\ndrivers/net/wireless/realtek/rtw89/Kconfig:20:config RTW89_USB\ndrivers/net/wireless/realtek/rtw89/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-22-\ndrivers/net/wireless/realtek/rtw89/Kconfig:23:config RTW89_8851B\ndrivers/net/wireless/realtek/rtw89/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-25-\ndrivers/net/wireless/realtek/rtw89/Kconfig:26:config RTW89_8852A\ndrivers/net/wireless/realtek/rtw89/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-28-\ndrivers/net/wireless/realtek/rtw89/Kconfig:29:config RTW89_8852B_COMMON\ndrivers/net/wireless/realtek/rtw89/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-31-\ndrivers/net/wireless/realtek/rtw89/Kconfig:32:config RTW89_8852B\ndrivers/net/wireless/realtek/rtw89/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-34-\ndrivers/net/wireless/realtek/rtw89/Kconfig:35:config RTW89_8852BT\ndrivers/net/wireless/realtek/rtw89/Kconfig-36-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-37-\ndrivers/net/wireless/realtek/rtw89/Kconfig:38:config RTW89_8852C\ndrivers/net/wireless/realtek/rtw89/Kconfig-39-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-40-\ndrivers/net/wireless/realtek/rtw89/Kconfig:41:config RTW89_8922A\ndrivers/net/wireless/realtek/rtw89/Kconfig-42-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-43-\ndrivers/net/wireless/realtek/rtw89/Kconfig:44:config RTW89_8922D\ndrivers/net/wireless/realtek/rtw89/Kconfig-45-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-46-\ndrivers/net/wireless/realtek/rtw89/Kconfig:47:config RTW89_8851BE\ndrivers/net/wireless/realtek/rtw89/Kconfig-48-\ttristate \"Realtek 8851BE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-57-\ndrivers/net/wireless/realtek/rtw89/Kconfig:58:config RTW89_8851BU\ndrivers/net/wireless/realtek/rtw89/Kconfig-59-\ttristate \"Realtek 8851BU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-68-\ndrivers/net/wireless/realtek/rtw89/Kconfig:69:config RTW89_8852AE\ndrivers/net/wireless/realtek/rtw89/Kconfig-70-\ttristate \"Realtek 8852AE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-79-\ndrivers/net/wireless/realtek/rtw89/Kconfig:80:config RTW89_8852AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-81-\ttristate \"Realtek 8852AU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-90-\ndrivers/net/wireless/realtek/rtw89/Kconfig:91:config RTW89_8852BE\ndrivers/net/wireless/realtek/rtw89/Kconfig-92-\ttristate \"Realtek 8852BE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-102-\ndrivers/net/wireless/realtek/rtw89/Kconfig:103:config RTW89_8852BU\ndrivers/net/wireless/realtek/rtw89/Kconfig-104-\ttristate \"Realtek 8852BU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-114-\ndrivers/net/wireless/realtek/rtw89/Kconfig:115:config RTW89_8852BTE\ndrivers/net/wireless/realtek/rtw89/Kconfig-116-\ttristate \"Realtek 8852BE-VT PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-126-\ndrivers/net/wireless/realtek/rtw89/Kconfig:127:config RTW89_8852CE\ndrivers/net/wireless/realtek/rtw89/Kconfig-128-\ttristate \"Realtek 8852CE PCI wireless network (Wi-Fi 6E) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-137-\ndrivers/net/wireless/realtek/rtw89/Kconfig:138:config RTW89_8852CU\ndrivers/net/wireless/realtek/rtw89/Kconfig-139-\ttristate \"Realtek 8852CU USB wireless network (Wi-Fi 6E) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-148-\ndrivers/net/wireless/realtek/rtw89/Kconfig:149:config RTW89_8922AE\ndrivers/net/wireless/realtek/rtw89/Kconfig-150-\ttristate \"Realtek 8922AE/8922AE-VS PCI wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-162-\ndrivers/net/wireless/realtek/rtw89/Kconfig:163:config RTW89_8922AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-164-\ttristate \"Realtek 8922AU USB wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-174-\ndrivers/net/wireless/realtek/rtw89/Kconfig:175:config RTW89_8922DE\ndrivers/net/wireless/realtek/rtw89/Kconfig-176-\ttristate \"Realtek 8922DE/8922DE-VS PCI wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-186-\ndrivers/net/wireless/realtek/rtw89/Kconfig:187:config RTW89_DEBUG\ndrivers/net/wireless/realtek/rtw89/Kconfig-188-\tbool\ndrivers/net/wireless/realtek/rtw89/Kconfig-189-\ndrivers/net/wireless/realtek/rtw89/Kconfig:190:config RTW89_DEBUGMSG\ndrivers/net/wireless/realtek/rtw89/Kconfig-191-\tbool \"Realtek rtw89 debug message support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-198-\ndrivers/net/wireless/realtek/rtw89/Kconfig:199:config RTW89_DEBUGFS\ndrivers/net/wireless/realtek/rtw89/Kconfig-200-\tbool \"Realtek rtw89 debugfs support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-207-\ndrivers/net/wireless/realtek/rtw89/Kconfig:208:config RTW89_LEDS\ndrivers/net/wireless/realtek/rtw89/Kconfig-209-\tbool\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-214-\ndrivers/net/wireless/realtek/rtw89/Kconfig:215:config RTW89_LEDS_MC\ndrivers/net/wireless/realtek/rtw89/Kconfig-216-\tbool\n" }
17/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 63189 output: 24 thoughts: 89 Thoughts: Okay, here's my interpretation of these thoughts, formatted as you requested: Analyzing a Driver Patch Alright, so this patch targets `rtw8922d.c` and `rtw8922de.c`. My initial reaction is to immediately connect `rtw8922d.c` with the `RTW89_8922D` configuration. It's a reflex, really, given my familiarity with this codebase. My mind immediately jumps to the implication of a modification here. Now, my next thought is about whether this specific driver has a corresponding USB variant. It's crucial to understand the target platform. I need to quickly determine if we're dealing with PCIe or USB implementation. A quick check of the `rtw89_8922d` entry in the Makefile should give me the answer. That's the first thing I need to do.
18/2	2026/08/26 06:48	tool	grepper	0m Args: { "Expression": "RTW89_8922D" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/Kconfig=41=config RTW89_8922A\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-43-\ndrivers/net/wireless/realtek/rtw89/Kconfig:44:config RTW89_8922D\ndrivers/net/wireless/realtek/rtw89/Kconfig-45-\ttristate\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=163=config RTW89_8922AU\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-174-\ndrivers/net/wireless/realtek/rtw89/Kconfig:175:config RTW89_8922DE\ndrivers/net/wireless/realtek/rtw89/Kconfig-176-\ttristate \"Realtek 8922DE/8922DE-VS PCI wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-179-\tselect RTW89_PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:180:\tselect RTW89_8922D\ndrivers/net/wireless/realtek/rtw89/Kconfig-181-\thelp\n--\ndrivers/net/wireless/realtek/rtw89/Makefile=92=rtw89_8922au-objs := rtw8922au.o\ndrivers/net/wireless/realtek/rtw89/Makefile-93-\ndrivers/net/wireless/realtek/rtw89/Makefile:94:obj-$(CONFIG_RTW89_8922D) += rtw89_8922d.o\ndrivers/net/wireless/realtek/rtw89/Makefile-95-rtw89_8922d-objs := rtw8922d.o \\\n--\ndrivers/net/wireless/realtek/rtw89/Makefile-97-\ndrivers/net/wireless/realtek/rtw89/Makefile:98:obj-$(CONFIG_RTW89_8922DE) += rtw89_8922de.o\ndrivers/net/wireless/realtek/rtw89/Makefile-99-rtw89_8922de-objs := rtw8922de.o\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.h-4-\ndrivers/net/wireless/realtek/rtw89/rtw8922d.h:5:#ifndef __RTW89_8922D_H__\ndrivers/net/wireless/realtek/rtw89/rtw8922d.h:6:#define __RTW89_8922D_H__\ndrivers/net/wireless/realtek/rtw89/rtw8922d.h-7-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h-4-\ndrivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h:5:#ifndef __RTW89_8922D_RFK_H__\ndrivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h:6:#define __RTW89_8922D_RFK_H__\ndrivers/net/wireless/realtek/rtw89/rtw8922d_rfk.h-7-\n" }
19/2	2026/08/26 06:48	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 64427 output: 24 thoughts: 75 Thoughts: Okay, here's my interpretation of those thoughts, summarized from my perspective as a specialist in this domain: Investigating a Configuration Imbalance Right, it looks like `RTW89_8922DE` is the sole configuration selecting `RTW89_8922D`. That's unusual; I need to understand why. Hang on, there's no `RTW89_8922DU` present? That's a red flag. I would have expected a derivative or related configuration to exist. The best course of action is to go straight to Kconfig. I need to dive into the configuration files and make sure `RTW89_8922DU` isn't defined somewhere unexpectedly, or perhaps has a typo that prevents it from being used. Let's see what's what.
20/2	2026/08/26 06:49	tool	grepper	0m Error: no matches Args: { "Expression": "RTW89_8922DU" } Results: { "error": "no matches" }
21/2	2026/08/26 06:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 64722 output: 20 thoughts: 170 Thoughts: Analyzing the Impact of the Patch Okay, so I see this `rtw8922d` thing, and it looks like it's only used by `rtw8922de`, which is a PCI driver. My initial thought is, "Well, that's isolated, manageable," but hold on a second. This patch also touches `chan.c`, `core.c`, `fw.c`, `phy.c`, and `ps.c`. Those are all part of the `RTW89_CORE` subsystem. And that's... that's the shared core component, used by all the `rtw89` drivers, including the USB ones like `RTW89_8852AU`, `RTW89_8852BU`, `RTW89_8852CU`, and `RTW89_8922AU`. Right, that changes things significantly. Okay, so the PCI driver aspect is just one entry point, the core code is the real target. The change to the core implies I can reach the core changes via the USB drivers. That's a good thing, because USB drivers are often easier to trigger various edge cases with. I can probably fuzz the core code just as effectively, or even more effectively, through those USB interfaces. I should verify what `RTW89_CORE` actually encompasses to be certain. I need to understand the full scope of those core changes.
22/2	2026/08/26 06:49	tool	grepper	0m Args: { "Expression": "RTW89_CORE" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/Kconfig=11=if RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-12-\ndrivers/net/wireless/realtek/rtw89/Kconfig:13:config RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=47=config RTW89_8851BE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-49-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:50:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-51-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=58=config RTW89_8851BU\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-60-\tdepends on USB\ndrivers/net/wireless/realtek/rtw89/Kconfig:61:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-62-\tselect RTW89_USB\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=69=config RTW89_8852AE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-71-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:72:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-73-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=80=config RTW89_8852AU\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-82-\tdepends on USB\ndrivers/net/wireless/realtek/rtw89/Kconfig:83:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-84-\tselect RTW89_USB\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=91=config RTW89_8852BE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-93-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:94:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-95-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=103=config RTW89_8852BU\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-105-\tdepends on USB\ndrivers/net/wireless/realtek/rtw89/Kconfig:106:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-107-\tselect RTW89_USB\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=115=config RTW89_8852BTE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-117-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:118:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-119-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=127=config RTW89_8852CE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-129-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:130:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-131-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=138=config RTW89_8852CU\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-140-\tdepends on USB\ndrivers/net/wireless/realtek/rtw89/Kconfig:141:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-142-\tselect RTW89_USB\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=149=config RTW89_8922AE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-151-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:152:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-153-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=163=config RTW89_8922AU\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-165-\tdepends on USB\ndrivers/net/wireless/realtek/rtw89/Kconfig:166:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-167-\tselect RTW89_USB\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=175=config RTW89_8922DE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-177-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig:178:\tselect RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-179-\tselect RTW89_PCI\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=190=config RTW89_DEBUGMSG\ndrivers/net/wireless/realtek/rtw89/Kconfig-191-\tbool \"Realtek rtw89 debug message support\"\ndrivers/net/wireless/realtek/rtw89/Kconfig:192:\tdepends on RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-193-\tselect RTW89_DEBUG\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=199=config RTW89_DEBUGFS\ndrivers/net/wireless/realtek/rtw89/Kconfig-200-\tbool \"Realtek rtw89 debugfs support\"\ndrivers/net/wireless/realtek/rtw89/Kconfig:201:\tdepends on RTW89_CORE \u0026\u0026 CFG80211_DEBUGFS\ndrivers/net/wireless/realtek/rtw89/Kconfig-202-\tselect RTW89_DEBUG\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=208=config RTW89_LEDS\ndrivers/net/wireless/realtek/rtw89/Kconfig-209-\tbool\ndrivers/net/wireless/realtek/rtw89/Kconfig:210:\tdepends on RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-211-\tdepends on LEDS_CLASS=y \|\| LEDS_CLASS=MAC80211\n--\ndrivers/net/wireless/realtek/rtw89/Makefile-2-\ndrivers/net/wireless/realtek/rtw89/Makefile:3:obj-$(CONFIG_RTW89_CORE) += rtw89_core.o\ndrivers/net/wireless/realtek/rtw89/Makefile-4-rtw89_core-y += core.o \\\n--\ndrivers/net/wireless/realtek/rtw89/core.c=632=rtw89_core_get_tx_type(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-638-\tif (ieee80211_is_mgmt(fc) \|\| ieee80211_is_any_nullfunc(fc))\ndrivers/net/wireless/realtek/rtw89/core.c:639:\t\treturn RTW89_CORE_TX_TYPE_MGMT;\ndrivers/net/wireless/realtek/rtw89/core.c-640-\ndrivers/net/wireless/realtek/rtw89/core.c:641:\treturn RTW89_CORE_TX_TYPE_DATA;\ndrivers/net/wireless/realtek/rtw89/core.c-642-}\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1204=rtw89_core_tx_wake(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1222-\t\tif (test_bit(RTW89_FLAG_LOW_POWER_MODE, rtwdev-\u003eflags) \u0026\u0026\ndrivers/net/wireless/realtek/rtw89/core.c:1223:\t\t tx_req-\u003etx_type == RTW89_CORE_TX_TYPE_MGMT)\ndrivers/net/wireless/realtek/rtw89/core.c-1224-\t\t\tgoto notify;\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1273=rtw89_core_tx_update_desc_info(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1287-\ndrivers/net/wireless/realtek/rtw89/core.c:1288:\tif (unlikely(tx_req-\u003etx_type == RTW89_CORE_TX_TYPE_FWCMD)) {\ndrivers/net/wireless/realtek/rtw89/core.c-1289-\t\trtw89_core_tx_update_h2c_info(rtwdev, tx_req);\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1318-\tswitch (tx_req-\u003etx_type) {\ndrivers/net/wireless/realtek/rtw89/core.c:1319:\tcase RTW89_CORE_TX_TYPE_MGMT:\ndrivers/net/wireless/realtek/rtw89/core.c-1320-\t\trtw89_core_tx_update_mgmt_info(rtwdev, tx_req);\ndrivers/net/wireless/realtek/rtw89/core.c-1321-\t\tbreak;\ndrivers/net/wireless/realtek/rtw89/core.c:1322:\tcase RTW89_CORE_TX_TYPE_DATA:\ndrivers/net/wireless/realtek/rtw89/core.c-1323-\t\trtw89_core_tx_update_data_info(rtwdev, tx_req);\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1381=int rtw89_h2c_tx(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1396-\ttx_req.skb = skb;\ndrivers/net/wireless/realtek/rtw89/core.c:1397:\ttx_req.tx_type = RTW89_CORE_TX_TYPE_FWCMD;\ndrivers/net/wireless/realtek/rtw89/core.c-1398-\tif (fwdl)\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1907=static __le32 rtw89_build_txwd_fwcmd0_v1(struct rtw89_tx_desc_info desc_info)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1910-\t\t FIELD_PREP(AX_RXD_RPKT_TYPE_MASK, desc_info-\u003efw_dl ?\ndrivers/net/wireless/realtek/rtw89/core.c:1911:\t\t\t\t\t\t RTW89_CORE_RX_TYPE_FWDL :\ndrivers/net/wireless/realtek/rtw89/core.c:1912:\t\t\t\t\t\t RTW89_CORE_RX_TYPE_H2C);\ndrivers/net/wireless/realtek/rtw89/core.c-1913-\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1927=static __le32 rtw89_build_txwd_fwcmd0_v2(struct rtw89_tx_desc_info desc_info)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1930-\t\t FIELD_PREP(BE_RXD_RPKT_TYPE_MASK, desc_info-\u003efw_dl ?\ndrivers/net/wireless/realtek/rtw89/core.c:1931:\t\t\t\t\t\t RTW89_CORE_RX_TYPE_FWDL :\ndrivers/net/wireless/realtek/rtw89/core.c:1932:\t\t\t\t\t\t RTW89_CORE_RX_TYPE_H2C);\ndrivers/net/wireless/realtek/rtw89/core.c-1933-\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4096=static void rtw89_core_rx_process_report(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4100-\tswitch (desc_info-\u003epkt_type) {\ndrivers/net/wireless/realtek/rtw89/core.c:4101:\tcase RTW89_CORE_RX_TYPE_C2H:\ndrivers/net/wireless/realtek/rtw89/core.c-4102-\t\trtw89_fw_c2h_irqsafe(rtwdev, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-4103-\t\tbreak;\ndrivers/net/wireless/realtek/rtw89/core.c:4104:\tcase RTW89_CORE_RX_TYPE_PPDU_STAT:\ndrivers/net/wireless/realtek/rtw89/core.c-4105-\t\trtw89_core_rx_process_ppdu_sts(rtwdev, desc_info, skb);\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4171=void rtw89_core_query_rxdesc_v2(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4189-\tdesc_info-\u003ebb_sel = le32_get_bits(rxd_s-\u003edword0, BE_RXD_BB_SEL);\ndrivers/net/wireless/realtek/rtw89/core.c:4190:\tif (desc_info-\u003epkt_type == RTW89_CORE_RX_TYPE_PPDU_STAT)\ndrivers/net/wireless/realtek/rtw89/core.c-4191-\t\tdesc_info-\u003emac_info_valid = true;\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4246=void rtw89_core_query_rxdesc_v3(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4264-\tdesc_info-\u003ebb_sel = le32_get_bits(rxd_s-\u003edword0, BE_RXD_BB_SEL);\ndrivers/net/wireless/realtek/rtw89/core.c:4265:\tif (desc_info-\u003epkt_type == RTW89_CORE_RX_TYPE_PPDU_STAT)\ndrivers/net/wireless/realtek/rtw89/core.c-4266-\t\tdesc_info-\u003emac_info_valid = true;\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4535=void rtw89_core_rx(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4543-\ndrivers/net/wireless/realtek/rtw89/core.c:4544:\tif (desc_info-\u003epkt_type != RTW89_CORE_RX_TYPE_WIFI) {\ndrivers/net/wireless/realtek/rtw89/core.c-4545-\t\trtw89_core_rx_process_report(rtwdev, desc_info, skb);\n--\ndrivers/net/wireless/realtek/rtw89/core.h-4-\ndrivers/net/wireless/realtek/rtw89/core.h:5:#ifndef __RTW89_CORE_H__\ndrivers/net/wireless/realtek/rtw89/core.h:6:#define __RTW89_CORE_H__\ndrivers/net/wireless/realtek/rtw89/core.h-7-\n--\ndrivers/net/wireless/realtek/rtw89/core.h=219=enum rtw89_core_tx_type {\ndrivers/net/wireless/realtek/rtw89/core.h:220:\tRTW89_CORE_TX_TYPE_DATA,\ndrivers/net/wireless/realtek/rtw89/core.h:221:\tRTW89_CORE_TX_TYPE_MGMT,\ndrivers/net/wireless/realtek/rtw89/core.h:222:\tRTW89_CORE_TX_TYPE_FWCMD,\ndrivers/net/wireless/realtek/rtw89/core.h-223-};\n--\ndrivers/net/wireless/realtek/rtw89/core.h=225=enum rtw89_core_rx_type {\ndrivers/net/wireless/realtek/rtw89/core.h:226:\tRTW89_CORE_RX_TYPE_WIFI\t\t= 0,\ndrivers/net/wireless/realtek/rtw89/core.h:227:\tRTW89_CORE_RX_TYPE_PPDU_STAT\t= 1,\ndrivers/net/wireless/realtek/rtw89/core.h:228:\tRTW89_CORE_RX_TYPE_CHAN_INFO\t= 2,\ndrivers/net/wireless/realtek/rtw89/core.h:229:\tRTW89_CORE_RX_TYPE_BB_SCOPE\t= 3,\ndrivers/net/wireless/realtek/rtw89/core.h:230:\tRTW89_CORE_RX_TYPE_F2P_TXCMD\t= 4,\ndrivers/net/wireless/realtek/rtw89/core.h:231:\tRTW89_CORE_RX_TYPE_SS2FW\t= 5,\ndrivers/net/wireless/realtek/rtw89/core.h:232:\tRTW89_CORE_RX_TYPE_TX_REPORT\t= 6,\ndrivers/net/wireless/realtek/rtw89/core.h:233:\tRTW89_CORE_RX_TYPE_TX_REL_HOST\t= 7,\ndrivers/net/wireless/realtek/rtw89/core.h:234:\tRTW89_CORE_RX_TYPE_DFS_REPORT\t= 8,\ndrivers/net/wireless/realtek/rtw89/core.h:235:\tRTW89_CORE_RX_TYPE_TX_REL_CPU\t= 9,\ndrivers/net/wireless/realtek/rtw89/core.h:236:\tRTW89_CORE_RX_TYPE_C2H\t\t= 10,\ndrivers/net/wireless/realtek/rtw89/core.h:237:\tRTW89_CORE_RX_TYPE_CSI\t\t= 11,\ndrivers/net/wireless/realtek/rtw89/core.h:238:\tRTW89_CORE_RX_TYPE_CQI\t\t= 12,\ndrivers/net/wireless/realtek/rtw89/core.h:239:\tRTW89_CORE_RX_TYPE_H2C\t\t= 13,\ndrivers/net/wireless/realtek/rtw89/core.h:240:\tRTW89_CORE_RX_TYPE_FWDL\t\t= 14,\ndrivers/net/wireless/realtek/rtw89/core.h-241-};\n--\ndrivers/net/wireless/realtek/rtw89/pci.c=1637=static int rtw89_pci_tx_write(struct rtw89_dev rtwdev, struct rtw89_core_tx_request tx_req,\n--\ndrivers/net/wireless/realtek/rtw89/pci.c-1647-\tif ((txch == RTW89_TXCH_CH12 \|\|\ndrivers/net/wireless/realtek/rtw89/pci.c:1648:\t tx_req-\u003etx_type == RTW89_CORE_TX_TYPE_FWCMD) \u0026\u0026\ndrivers/net/wireless/realtek/rtw89/pci.c-1649-\t (txch != RTW89_TXCH_CH12 \|\|\ndrivers/net/wireless/realtek/rtw89/pci.c:1650:\t tx_req-\u003etx_type != RTW89_CORE_TX_TYPE_FWCMD)) {\ndrivers/net/wireless/realtek/rtw89/pci.c-1651-\t\trtw89_err(rtwdev, \"only fw cmd uses dma channel 12\\n\");\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=393=static int rtw89_usb_ops_tx_write(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-403-\tif ((desc_info-\u003ech_dma == RTW89_TXCH_CH12 \|\|\ndrivers/net/wireless/realtek/rtw89/usb.c:404:\t tx_req-\u003etx_type == RTW89_CORE_TX_TYPE_FWCMD) \u0026\u0026\ndrivers/net/wireless/realtek/rtw89/usb.c-405-\t (desc_info-\u003ech_dma != RTW89_TXCH_CH12 \|\|\ndrivers/net/wireless/realtek/rtw89/usb.c:406:\t tx_req-\u003etx_type != RTW89_CORE_TX_TYPE_FWCMD)) {\ndrivers/net/wireless/realtek/rtw89/usb.c-407-\t\trtw89_err(rtwdev, \"dma channel %d/TX type %d mismatch\\n\",\n" }
23/2	2026/08/26 06:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 71205 output: 25 thoughts: 895 Thoughts: Reaching and Testing the Core RTW89 Changes Okay, so I've been looking at this patch for the RTW89 driver, and here's my breakdown of what's going on and what needs to be considered for testing. The core module is `RTW89_CORE`, and this patch makes changes to several files within it: `chan.c`, `core.c`, `fw.c`, `phy.c`, and `ps.c`. The patch also touches `rtw8922d.c`, which is specific to the `RTW89_8922D` variant. I need to make sure I understand the reachability of these changes. First, let's nail down the `rtw8922d.c` changes. I know that `RTW89_8922D` is only selected if `RTW89_8922DE` (PCI) is enabled. So, the modifications in this file are definitely PCI-specific. However, the core file changes are a different story. I was wondering whether these core changes could be triggered via USB drivers, like the `RTW89_8852AU` driver. Thankfully, it looks like they are. Specifically, `rtw89_chanctx_pause`, `rtw89_for_each_active_rtwvif`, and the support for `NL80211_IFTYPE_P2P_DEVICE` are all in `core.c` and `chan.c`, which are part of `RTW89_CORE`. Aha, and confirming, `NL80211_IFTYPE_P2P_DEVICE` is reachable; I see that it's added to `rtw89_iface_limits` and `rtw89_iface_limits_mcc` in `core.c`. Additionally, `rtw89_core_register_hw` adds it to the wiphy's interface modes. This is really interesting because that means userspace can definitely create a `P2P_DEVICE` interface via netlink! This is excellent news, it means I can easily trigger and test the changes through the mac80211/cfg80211 netlink interface. Even without real hardware, if I can get the driver to probe, like, using a `dummy_hcd` USB setup, I'm good. And yes, I think that's possible. I've used Syzkaller before, and I think its `syz_usb_connect` call can simulate the USB device. It provides the needed descriptors, so the driver's `probe` function should succeed, and it will register the wiphy. Then, I can use netlink to create the interfaces, including the `NL80211_IFTYPE_P2P_DEVICE`, and trigger all the new code paths, like `rtw89_vif_type_mapping`, `rtw89_recalc_lps`, etc. Also, `rtw89_chanctx_pause` gets called from delayed works, so that's a good coverage point too. So, the core changes are definitely reachable and very worth fuzzing. I'd say `WorthFuzzing=true`. Even though the `rtw8922d.c` stuff is PCI-only, the core changes are enough to justify fuzzing. For configurations, I'll need `RTW89_CORE` enabled, of course. To make sure that I'm able to reach the core via USB, I should enable `RTW89_8852AU` (the USB driver). Of course, I could also enable `RTW89_8852AU` and `RTW89_8922DE` (PCI driver), just in case Syzkaller might have some PCI capabilities, or just to provide it for later. I should double check the exact names in the Kconfig, but I'm pretty sure it's: `RTW89_8852AU`, `RTW89_8922DE`, `RTW89_8852CU`, and `RTW89_8922AU` (Wait, let me just double check `RTW89_8922AU` in Kconfig real quick... and nope, it doesn't select `RTW89_8922D`. Okay, that's that.)
24/2	2026/08/26 06:49	tool	grepper	0m Args: { "Expression": "config RTW89_8922AU" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/Kconfig=149=config RTW89_8922AE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-162-\ndrivers/net/wireless/realtek/rtw89/Kconfig:163:config RTW89_8922AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-164-\ttristate \"Realtek 8922AU USB wireless network (Wi-Fi 7) adapter\"\n" }
25/2	2026/08/26 06:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 73266 output: 47 thoughts: 19 Thoughts: Here's my take on those thoughts: Analyzing the Selection of `RTW89_8922AU` Okay, so the first thing I need to do is quickly run through what `RTW89_8922AU` actually selects. I need to understand its scope. Is this a specific dataset? A particular algorithm? A hardware configuration? I need to know exactly what the input is and what the output is. Understanding the parameters of this selection is going to inform everything else, so I'll need to know. What are the dependencies and where do I find the source definition? Once I have a clear picture of its functionality and role, I can continue. It is important to remember that such details will affect the overall objective.
26/2	2026/08/26 06:49	tool	grepper	0m Args: { "Expression": "config RTW89_8922AU", "PathPrefix": "drivers/net/wireless/realtek/rtw89/Kconfig" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/Kconfig=149=config RTW89_8922AE\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-162-\ndrivers/net/wireless/realtek/rtw89/Kconfig:163:config RTW89_8922AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-164-\ttristate \"Realtek 8922AU USB wireless network (Wi-Fi 7) adapter\"\n" }
27/2	2026/08/26 06:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 73643 output: 44 thoughts: 20 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: Analyzing the Configuration Lines Alright, the objective is clear: let's dive into examining the configuration lines that follow the `config RTW89_8922AU` directive. My assumption is this is related to configuring a specific Realtek wireless adapter, the RTW89_8922AU. It's safe to deduce we're looking at kernel configuration options, probably within a `.config` file or something similar. I need to understand what's being enabled, disabled, or conditionally compiled based on this `RTW89_8922AU` flag. The goal is likely to understand driver behavior, feature sets, dependencies, or to troubleshoot a specific configuration issue.
28/2	2026/08/26 06:49	tool	read-file	0m Args: { "File": "drivers/net/wireless/realtek/rtw89/Kconfig", "FirstLine": 163, "LineCount": 20 } Results: { "Contents": " 163:\tconfig RTW89_8922AU\n 164:\t\ttristate \"Realtek 8922AU USB wireless network (Wi-Fi 7) adapter\"\n 165:\t\tdepends on USB\n 166:\t\tselect RTW89_CORE\n 167:\t\tselect RTW89_USB\n 168:\t\tselect RTW89_8922A\n 169:\t\thelp\n 170:\t\t Select this option will enable support for 8922AU chipset\n 171:\t\n 172:\t\t 802.11be USB wireless network (Wi-Fi 7) adapter\n 173:\t\t supporting 2x2 2GHz/5GHz/6GHz 4096-QAM 160MHz channels.\n 174:\t\n 175:\tconfig RTW89_8922DE\n 176:\t\ttristate \"Realtek 8922DE/8922DE-VS PCI wireless network (Wi-Fi 7) adapter\"\n 177:\t\tdepends on PCI\n 178:\t\tselect RTW89_CORE\n 179:\t\tselect RTW89_PCI\n 180:\t\tselect RTW89_8922D\n 181:\t\thelp\n 182:\t\t Select this option will enable support for 8922DE/8922DE-VS chipset\n" }
29/2	2026/08/26 06:49	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 74258 output: 26 thoughts: 809 Thoughts: Analyzing the Potential for Fuzzing this Wi-Fi Driver Patch Okay, so `RTW89_8922AU` selects `RTW89_8922A`, not the `D` variant, which is only picked up by `RTW89_8922DE`. The crux of the changes, however, are in `RTW89_CORE`. To test, I should enable `RTW89_8852AU` or any USB variant to exercise the core modifications, and also enable `RTW89_8922DE` to get the `rtw8922d.c` specific changes compiled. Now, regarding fuzzing, I initially thought syzkaller could only handle virtualized PCI devices, and `rtw8922de` is a physical device driver. But then I remember the prompt: it says `WorthFuzzing=false` if the changes are limited to vendor-specific PCIe switch, SmartNIC, or GPU drivers. My focus here is on `rtw89`, which is a Wi-Fi driver, not any of those. Plus, the core Wi-Fi logic is being modified - `chan.c`, `core.c`, `fw.c`, `phy.c`, and `ps.c` - all of which can be reached through USB emulation. Therefore, I can confirm that `WorthFuzzing=true` is the right assessment here. Now, let's identify the key symbols modified by this patch. I see changes to: * `rtw89_chanctx_pause` * `rtw89_chanctx_paused` (new) * `rtw89_entity_calculate_weight` * `rtw89_entity_recalc_mlo_dbcc_mode` * `rtw89_entity_recalc_mgnt_roles` * `rtw89_swap_chanctx` * `rtw89_track_ps_work` * `rtw89_track_work` * `rtw89_vif_type_mapping` * `rtw89_core_register_hw` * `rtw89_fw_h2c_phy_rfe_type` (new) * `rtw89_hw_scan_update_beacon_noa` * `rtw89_hw_scan_set_extra_op_info` * `rtw89_phy_c2h_ra_rpt_iter` * `rtw89_phy_c2h_rfk_rpt_log` * `rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan` (new) * `rtw89_recalc_lps` * `__rtw89_reg_6ghz_power_recalc` I need to focus on non-static, non-inlined API entrypoint functions for testing. I'll pick these to begin with: * `rtw89_chanctx_pause` * `rtw89_chanctx_paused` * `rtw89_fw_h2c_phy_rfe_type` * `rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan` * `rtw89_vif_type_mapping` * `rtw89_recalc_lps` Next step, I need to confirm `rtw89_vif_type_mapping` is, in fact, not static.
30/2	2026/08/26 06:50	tool	grepper	0m Args: { "Expression": "void rtw89_vif_type_mapping" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/core.c=5661=int rtw89_core_release_sta_ba_entry(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5689-\t\tbreak\ndrivers/net/wireless/realtek/rtw89/core.c:5690:void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc)\ndrivers/net/wireless/realtek/rtw89/core.c-5691-{\n--\ndrivers/net/wireless/realtek/rtw89/core.h=9347=void rtw89_core_free_sta_pending_roc_tx(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.h-9348-\t\t\t\t\tstruct ieee80211_sta sta);\ndrivers/net/wireless/realtek/rtw89/core.h:9349:void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc);\ndrivers/net/wireless/realtek/rtw89/core.h-9350-int rtw89_chip_info_setup(struct rtw89_dev rtwdev);\n" }
31/2	2026/08/26 06:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 76306 output: 25 thoughts: 22 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Confirming and Directing Focus Yes, that's definitely the case. Okay, I need to check the `rtw89_recalc_lps` function now. That's the critical piece here for this area, so let's dig into that directly.
32/2	2026/08/26 06:50	tool	grepper	0m Args: { "Expression": "void rtw89_recalc_lps" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/ps.c=354=void rtw89_process_p2p_ps(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/ps.c-361-\ndrivers/net/wireless/realtek/rtw89/ps.c:362:void rtw89_recalc_lps(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/ps.c-363-{\n--\ndrivers/net/wireless/realtek/rtw89/ps.h=17=void rtw89_process_p2p_ps(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/ps.h-19-\t\t\t struct ieee80211_bss_conf bss_conf);\ndrivers/net/wireless/realtek/rtw89/ps.h:20:void rtw89_recalc_lps(struct rtw89_dev rtwdev);\ndrivers/net/wireless/realtek/rtw89/ps.h-21-void rtw89_p2p_noa_renew(struct rtw89_vif_link rtwvif_link);\n" }
33/2	2026/08/26 06:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 76781 output: 24 thoughts: 21 Thoughts: Here's my take on those thoughts: Analyzing `rtw89_chanctx_pause` Alright, that's what I thought. Confirmed. Now, let's dive into examining `rtw89_chanctx_pause`. Time to see what's going on within that specific function. Let's see how that routine handles a channel context pause, and the surrounding logic.
34/2	2026/08/26 06:50	tool	grepper	0m Args: { "Expression": "void rtw89_chanctx_pause" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/chan.c=3205=void rtw89_chanctx_track(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/chan.c-3224-\ndrivers/net/wireless/realtek/rtw89/chan.c:3225:void rtw89_chanctx_pause(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/chan.c-3226-\t\t\t const struct rtw89_chanctx_pause_parm pause_parm)\n--\ndrivers/net/wireless/realtek/rtw89/chan.h=185=void rtw89_chanctx_track(struct rtw89_dev rtwdev);\ndrivers/net/wireless/realtek/rtw89/chan.h:186:void rtw89_chanctx_pause(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/chan.h-187-\t\t\t const struct rtw89_chanctx_pause_parm parm);\n" }
35/2	2026/08/26 06:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 77227 output: 24 thoughts: 21 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Analyzing the Pause Condition Yes, that's correct, the situation seems to warrant this investigation. My immediate next step is clear. Let's drill down into the `rtw89_chanctx_paused` variable. I need to understand its current state and how it's being managed. Understanding this variable's context is going to be crucial to determining the problem's root cause. It's the central data point I need to examine to understand if we are in fact paused as expected, or if something else is going on.
36/2	2026/08/26 06:50	tool	grepper	0m Args: { "Expression": "bool rtw89_chanctx_paused" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/chan.c=3225=void rtw89_chanctx_pause(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/chan.c-3252-\ndrivers/net/wireless/realtek/rtw89/chan.c:3253:bool rtw89_chanctx_paused(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/chan.c-3254-{\n" }
37/2	2026/08/26 06:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 77561 output: 32 thoughts: 29 Thoughts: Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person: Confirming and Zeroing in Alright, that confirms what I suspected. Now, let's drill down into the details. I need to take a look at the `rtw89_fw_h2c_phy_rfe_type` parameter. This is likely the key to what I'm trying to figure out. I want to understand exactly how this setting is being handled.
38/2	2026/08/26 06:50	tool	grepper	0m Args: { "Expression": "int rtw89_fw_h2c_phy_rfe_type" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/fw.c=3454=int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3537-\ndrivers/net/wireless/realtek/rtw89/fw.c:3538:int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev)\ndrivers/net/wireless/realtek/rtw89/fw.c-3539-{\n--\ndrivers/net/wireless/realtek/rtw89/fw.h=5575=int rtw89_fw_h2c_fwips(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\ndrivers/net/wireless/realtek/rtw89/fw.h-5576-\t\t bool enable);\ndrivers/net/wireless/realtek/rtw89/fw.h:5577:int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev);\ndrivers/net/wireless/realtek/rtw89/fw.h-5578-struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev *rtwdev, u32 len);\n" }
39/2	2026/08/26 06:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 78129 output: 38 thoughts: 35 Thoughts: Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person: Initial Assessment and Targeted Function Check Yes, that's correct. I'm confirming my initial hypothesis. Now, let's dive into the details, specifically, I need to take a look at the `rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan` function. I want to quickly evaluate this part of the PHY initialization. I anticipate needing to review how the channel parameters are being handled at this stage.
40/2	2026/08/26 06:50	tool	grepper	0m Args: { "Expression": "void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/phy.h=1046=static inline void rtw89_phy_bb_wrap_init(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/phy.h-1053-\ndrivers/net/wireless/realtek/rtw89/phy.h:1054:void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/phy.h-1055-\t\t\t\t\t\t const struct rtw89_chan chan,\n--\ndrivers/net/wireless/realtek/rtw89/phy_be.c=1205=static void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/phy_be.c-1221-\ndrivers/net/wireless/realtek/rtw89/phy_be.c:1222:void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/phy_be.c-1223-\t\t\t\t\t\t const struct rtw89_chan chan,\n" }
41/2	2026/08/26 06:50	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 78704 output: 298 thoughts: 493 Thoughts: My Configuration Checklist Okay, so I'm on it. Yes, these are the focus symbols I need to keep in mind: `rtw89_chanctx_pause`, `rtw89_chanctx_paused`, `rtw89_fw_h2c_phy_rfe_type`, `rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan`, `rtw89_vif_type_mapping`, and `rtw89_recalc_lps`. These are the key functions and structures I'm tracking. Now, let's look at the configurations. I initially thought `RTW89_8852AU` would suffice, just to get a USB driver compiled and ensure the core is reachable. I also added `RTW89_8922DE` specifically to include the changes in `rtw8922d.c`. But wait, hold on. `RTW89_8922AU` is Wi-Fi 7, isn't it? Perhaps I should enable that too. Yes, I'll need both `RTW89_8922AU` and `RTW89_8922DE`, in addition to `RTW89_8852AU`. That way I have both the newest and the original driver. Just to be absolutely certain, let me double-check the configuration names: `RTW89_8922AU`, `RTW89_8922DE`, `RTW89_8852AU`, along with the general ones: `RTW89_CORE`, `RTW89_PCI`, and `RTW89_USB`. I can simplify it to just the three device configurations. But thinking a bit deeper, I have to ensure that `RTW89_8922DE` selects `RTW89_8922D`, because this is where the critical `rtw8922d.c` file is actually compiled. So yes, `RTW89_8922DE` is definitely required. Alright, I'm satisfied. Time to call `set-results`. I have all that I need.
42/2	2026/08/26 06:50	tool	set-results	0m Args: { "EnableConfigs": [ "RTW89_8922DE", "RTW89_8922AU", "RTW89_8852AU" ], "FocusSymbols": [ "rtw89_chanctx_pause", "rtw89_chanctx_paused", "rtw89_fw_h2c_phy_rfe_type", "rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan", "rtw89_vif_type_mapping", "rtw89_recalc_lps" ], "Reasoning": "The patch modifies the core logic of the rtw89 wireless driver, including channel context pausing, interface type mapping (adding P2P_DEVICE support), and LPS recalculation. It also modifies the rtw8922d chip-specific logic. The core changes are reachable via the mac80211/cfg80211 netlink interface, and the driver can be probed in virtualized environments using USB emulation (e.g., dummy_hcd) for its USB variants (like rtw8922au, rtw8852au). Therefore, the changes are functionally impactful and testable.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "RTW89_8922DE", "RTW89_8922AU", "RTW89_8852AU" ], "FocusSymbols": [ "rtw89_chanctx_pause", "rtw89_chanctx_paused", "rtw89_fw_h2c_phy_rfe_type", "rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan", "rtw89_vif_type_mapping", "rtw89_recalc_lps" ], "Reasoning": "The patch modifies the core logic of the rtw89 wireless driver, including channel context pausing, interface type mapping (adding P2P_DEVICE support), and LPS recalculation. It also modifies the rtw8922d chip-specific logic. The core changes are reachable via the mac80211/cfg80211 netlink interface, and the driver can be probed in virtualized environments using USB emulation (e.g., dummy_hcd) for its USB variants (like rtw8922au, rtw8852au). Therefore, the changes are functionally impactful and testable.", "WorthFuzzing": true }
43/1	2026/08/26 06:50	action	If	1m Args: { "WorthFuzzing": true } Results: null
44/2	2026/08/26 06:50	agent	kmsan-evaluator	1m Model: best-expensive Args: null Results: { "KMSANReasoning": "The patch modifies the rtw89 driver to add support for P2P_DEVICE interface type, introduces new PHY BB wrap configuration logic, adds a new firmware H2C command (rtw89_fw_h2c_phy_rfe_type), and adds some quirks. \n\nA careful review of the changes shows no uninitialized memory risks:\n1. The new H2C command `rtw89_fw_h2c_phy_rfe_type` allocates an skb using `rtw89_fw_h2c_alloc_skb_with_hdr`. This function internally calls `memset(skb-\u003edata, 0, len)`, ensuring the entire payload buffer is zeroed. The code then sets the `rfe_type` field, leaving the `rsvd` padding bytes safely zeroed before sending it to the firmware.\n2. The new `iqk_info-\u003eiqk_rx_fail` array is properly initialized to false in `_iqk_init` and updated from parsed C2H events.\n3. The new `rtw89_bb_wrap_data` structures are statically defined `const` data, so they are fully initialized at compile time.\n4. Other changes involve control flow updates, macro replacements (`rtw89_for_each_active_rtwvif`), and register writes, none of which expose uninitialized stack or heap memory.\n\nAny potential out-of-bounds accesses or use-after-free bugs in the modified logic would be caught by standard KASAN. There are no uninitialized memory reads or info-leaks that would require a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 136ba4a873ea4bf58f38736a81cc6cf1e6c6be99 Author: syz-cluster <triage@syzkaller.com> Date: Wed Aug 26 06:47:42 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c index 6f11335b49687..a7ba47bd9abd8 100644 --- a/drivers/net/wireless/realtek/rtw89/chan.c +++ b/drivers/net/wireless/realtek/rtw89/chan.c @@ -185,7 +185,7 @@ static void rtw89_chan_update_punctured(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif; unsigned int link_id; - rtw89_for_each_rtwvif(rtwdev, rtwvif) { + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) { rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) { if (!rtwvif_link->chanctx_assigned \|\| rtwvif_link->chanctx_idx != idx) @@ -358,10 +358,8 @@ static void rtw89_entity_calculate_weight(struct rtw89_dev rtwdev, w->active_chanctxs++; } - rtw89_for_each_rtwvif(rtwdev, rtwvif) { - if (rtw89_vif_is_active_role(rtwvif)) - w->active_roles++; - } + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) + w->active_roles++; } static void rtw89_normalize_link_chanctx(struct rtw89_dev rtwdev, @@ -527,7 +525,7 @@ static void rtw89_entity_recalc_mlo_dbcc_mode(struct rtw89_dev rtwdev) mode = rtw89_entity_sel_mlo_dbcc_mode(rtwdev, active_hws); rtwdev->mlo_dbcc_mode = mode; - rtw89_debug(rtwdev, RTW89_DBG_STATE, "recalc mlo dbcc mode to %d\n", mode); + rtw89_debug(rtwdev, RTW89_DBG_STATE, "recalc mlo dbcc mode to 0x%x\n", mode); } static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev) @@ -553,7 +551,7 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev) which uses RTW89_CHANCTX_0 to put at position 0 and its designated * link take RTW89_CHANCTX_0. (normalizing) / - list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, role) { for (i = 0; i < role->links_inst_valid_num; i++) { link = rtw89_vif_get_link_inst(role, i); if (!link \|\| !link->chanctx_assigned) @@ -570,7 +568,7 @@ static void rtw89_entity_recalc_mgnt_roles(struct rtw89_dev rtwdev) } fill: - list_for_each_entry(role, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, role) { if (unlikely(pos >= RTW89_MAX_INTERFACE_NUM)) { rtw89_warn(rtwdev, "%s: active roles are over max iface num\n", @@ -3232,6 +3230,9 @@ void rtw89_chanctx_pause(struct rtw89_dev rtwdev, lockdep_assert_wiphy(rtwdev->hw->wiphy); + if (test_bit(RTW89_FLAG_LEISURE_PS, rtwdev->flags)) + rtw89_warn(rtwdev, "LPS isn't off when pausing chanctx\n"); + if (hal->entity_pause) return; @@ -3249,6 +3250,15 @@ void rtw89_chanctx_pause(struct rtw89_dev rtwdev, hal->entity_pause = true; } +bool rtw89_chanctx_paused(struct rtw89_dev rtwdev) +{ + struct rtw89_hal hal = &rtwdev->hal; + + lockdep_assert_wiphy(rtwdev->hw->wiphy); + + return hal->entity_pause; +} + static void rtw89_chanctx_proceed_cb(struct rtw89_dev rtwdev, const struct rtw89_chanctx_cb_parm parm) { @@ -3335,7 +3345,7 @@ static void rtw89_swap_chanctx(struct rtw89_dev rtwdev, swap(hal->chanctx[idx1], hal->chanctx[idx2]); - rtw89_for_each_rtwvif(rtwdev, rtwvif) + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) __rtw89_swap_chanctx(rtwvif, idx1, idx2); cur = atomic_read(&hal->roc_chanctx_idx); diff --git a/drivers/net/wireless/realtek/rtw89/chan.h b/drivers/net/wireless/realtek/rtw89/chan.h index a9a5f1b307a27..f99aca9ef6a44 100644 --- a/drivers/net/wireless/realtek/rtw89/chan.h +++ b/drivers/net/wireless/realtek/rtw89/chan.h @@ -185,6 +185,7 @@ void rtw89_query_mr_chanctx_info(struct rtw89_dev rtwdev, u8 inst_idx, void rtw89_chanctx_track(struct rtw89_dev rtwdev); void rtw89_chanctx_pause(struct rtw89_dev rtwdev, const struct rtw89_chanctx_pause_parm parm); +bool __must_check rtw89_chanctx_paused(struct rtw89_dev rtwdev); void rtw89_chanctx_proceed(struct rtw89_dev rtwdev, const struct rtw89_chanctx_cb_parm cb_parm); diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 397ebbfcac09a..572d9c65a2dd1 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -167,7 +167,7 @@ static struct ieee80211_rate rtw89_bitrates[] = { static const struct ieee80211_iface_limit rtw89_iface_limits[] = { { - .max = 1, + .max = 2, .types = BIT(NL80211_IFTYPE_STATION), }, { @@ -176,6 +176,10 @@ static const struct ieee80211_iface_limit rtw89_iface_limits[] = { BIT(NL80211_IFTYPE_P2P_GO) \| BIT(NL80211_IFTYPE_AP), }, + { + .max = 1, + .types = BIT(NL80211_IFTYPE_P2P_DEVICE), + }, }; static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = { @@ -188,6 +192,10 @@ static const struct ieee80211_iface_limit rtw89_iface_limits_mcc[] = { .types = BIT(NL80211_IFTYPE_P2P_CLIENT) \| BIT(NL80211_IFTYPE_P2P_GO), }, + { + .max = 1, + .types = BIT(NL80211_IFTYPE_P2P_DEVICE), + }, }; static const struct ieee80211_iface_combination rtw89_iface_combs[] = { @@ -5496,6 +5504,9 @@ static void rtw89_track_ps_work(struct wiphy wiphy, struct wiphy_work work) if (rtwdev->scanning) return; + if (rtw89_chanctx_paused(rtwdev)) + return; + if (rtwdev->lps_enabled && !rtwdev->btc.btc_ctrl_lps) rtw89_enter_lps_track(rtwdev, RTW89_TFC_INTERVAL_100MS); } @@ -5521,6 +5532,9 @@ static void rtw89_track_work(struct wiphy wiphy, struct wiphy_work work) if (rtwdev->scanning) return; + if (rtw89_chanctx_paused(rtwdev)) + return; + rtw89_leave_lps(rtwdev); if (tfc_changed) { @@ -5691,6 +5705,7 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc) else rtwvif_link->wifi_role = RTW89_WIFI_ROLE_AP; break; + RTW89_TYPE_MAPPING(P2P_DEVICE); RTW89_TYPE_MAPPING(ADHOC); RTW89_TYPE_MAPPING(MONITOR); RTW89_TYPE_MAPPING(MESH_POINT); @@ -5724,6 +5739,10 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link rtwvif_link, bool assoc) rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT; rtwvif_link->addr_cam.sec_ent_mode = RTW89_ADDR_CAM_SEC_NORMAL; break; + case NL80211_IFTYPE_P2P_DEVICE: + rtwvif_link->net_type = RTW89_NET_TYPE_NO_LINK; + rtwvif_link->self_role = RTW89_SELF_ROLE_CLIENT; + break; case NL80211_IFTYPE_MONITOR: break; default: @@ -7517,7 +7536,8 @@ static int rtw89_core_register_hw(struct rtw89_dev rtwdev) hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) \| BIT(NL80211_IFTYPE_AP) \| BIT(NL80211_IFTYPE_P2P_CLIENT) \| - BIT(NL80211_IFTYPE_P2P_GO); + BIT(NL80211_IFTYPE_P2P_GO) \| + BIT(NL80211_IFTYPE_P2P_DEVICE); if (hal->ant_diversity) { hw->wiphy->available_antennas_tx = 0x3; diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h index 2b21d969ece7b..83554a2c87323 100644 --- a/drivers/net/wireless/realtek/rtw89/core.h +++ b/drivers/net/wireless/realtek/rtw89/core.h @@ -6340,7 +6340,7 @@ enum rtw89_entity_mode { RTW89_ENTITY_MODE_UNHANDLED = -ESRCH, }; -#define RTW89_MAX_INTERFACE_NUM 2 +#define RTW89_MAX_INTERFACE_NUM 3 / only valid when running with chanctx_ops / struct rtw89_entity_mgnt { @@ -6463,8 +6463,10 @@ enum rtw89_quirks { RTW89_QUIRK_PCI_BER, RTW89_QUIRK_THERMAL_PROT_120C, RTW89_QUIRK_THERMAL_PROT_110C, + RTW89_QUIRK_THERMAL_PROT_VCORE, RTW89_QUIRK_HW_INFO_SYSFS, RTW89_QUIRK_DISABLE_2GHZ, + RTW89_QUIRK_LOW_LATENCY, NUM_OF_RTW89_QUIRKS, }; @@ -6479,6 +6481,7 @@ enum rtw89_custid { RTW89_CUSTID_AMD = 6, RTW89_CUSTID_FUJITSU = 7, RTW89_CUSTID_DELL = 8, + RTW89_CUSTID_VALVE, / driver only / }; enum rtw89_pkt_drop_sel { diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c index 7e640c7166e4d..2417381bca1cd 100644 --- a/drivers/net/wireless/realtek/rtw89/debug.c +++ b/drivers/net/wireless/realtek/rtw89/debug.c @@ -5463,12 +5463,11 @@ rtw89_debug_priv_diag_rf_get(struct rtw89_dev rtwdev, static void rtw89_dbg_diag_rf_set_rfk(struct rtw89_dev rtwdev) { - struct rtw89_entity_mgnt mgnt = &rtwdev->hal.entity_mgnt; struct rtw89_vif_link rtwvif_link; struct rtw89_vif rtwvif; unsigned int link_id; - list_for_each_entry(rtwvif, &mgnt->active_list, mgnt_entry) + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) rtw89_chip_rfk_channel(rtwdev, rtwvif_link); } diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 0099c5c03e7a6..fd721c971ba3e 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3535,6 +3535,46 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev, return ret; } +int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev) +{ + const struct rtw89_chip_info chip = rtwdev->chip; + struct rtw89_efuse efuse = &rtwdev->efuse; + struct rtw89_h2c_phy_rfe_type h2c; + u32 len = sizeof(h2c); + struct sk_buff skb; + int ret; + + if (chip->chip_id != RTL8922D) + return 0; + + skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len); + if (!skb) { + rtw89_err(rtwdev, "failed to alloc skb for h2c phy_rfe_type\n"); + return -ENOMEM; + } + skb_put(skb, len); + h2c = (struct rtw89_h2c_phy_rfe_type )skb->data; + + h2c->rfe_type = efuse->rfe_type; + + rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C, + H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM, + H2C_FUNC_FW_RFE_TYPE, 0, 0, len); + + ret = rtw89_h2c_tx(rtwdev, skb, false); + if (ret) { + rtw89_err(rtwdev, "failed to send h2c\n"); + goto fail; + } + + return 0; +fail: + dev_kfree_skb_any(skb); + + return ret; +} +EXPORT_SYMBOL(rtw89_fw_h2c_phy_rfe_type); + #define H2C_P2P_ACT_LEN 20 int rtw89_fw_h2c_p2p_act(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link, @@ -10271,7 +10311,6 @@ static void rtw89_hw_scan_update_link_beacon_noa(struct rtw89_dev rtwdev, static void rtw89_hw_scan_update_beacon_noa(struct rtw89_dev rtwdev, bool scan) { - const struct rtw89_entity_mgnt mgnt = &rtwdev->hal.entity_mgnt; const struct rtw89_hw_scan_info scan_info = &rtwdev->scan_info; const struct rtw89_chip_info chip = rtwdev->chip; struct rtw89_mac_chinfo_ax chinfo_ax; @@ -10311,7 +10350,7 @@ static void rtw89_hw_scan_update_beacon_noa(struct rtw89_dev rtwdev, bool scan) } update: - list_for_each_entry(rtwvif, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) { unsigned int link_id; vif = rtwvif_to_vif(rtwvif); @@ -10328,7 +10367,6 @@ static void rtw89_hw_scan_set_extra_op_info(struct rtw89_dev rtwdev, struct rtw89_vif scan_rtwvif, const struct rtw89_chan scan_op) { - struct rtw89_entity_mgnt mgnt = &rtwdev->hal.entity_mgnt; struct rtw89_hw_scan_info scan_info = &rtwdev->scan_info; struct rtw89_hw_scan_extra_op ext = &scan_info->extra_op; struct rtw89_vif tmp; @@ -10337,7 +10375,7 @@ static void rtw89_hw_scan_set_extra_op_info(struct rtw89_dev rtwdev, if (!RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD_EXTRA_OP, &rtwdev->fw)) return; - list_for_each_entry(tmp, &mgnt->active_list, mgnt_entry) { + rtw89_for_each_active_rtwvif(rtwdev, tmp) { const struct rtw89_chan tmp_chan; struct rtw89_vif_link tmp_link; diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h index 375ca0a243a65..f7d017d3ced08 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.h +++ b/drivers/net/wireless/realtek/rtw89/fw.h @@ -2101,6 +2101,11 @@ struct rtw89_h2c_lps_ml_cmn_info_v1 { struct rtw89_bb_link_info_rx_gain rx_gain[RTW89_BB_PS_LINK_BUF_MAX]; } __packed; +struct rtw89_h2c_phy_rfe_type { + u8 rfe_type; + u8 rsvd[3]; +} __packed; + struct rtw89_h2c_trig_cpu_except { __le32 w0; } __packed; @@ -4886,6 +4891,7 @@ enum rtw89_mrc_h2c_func { #define H2C_FUNC_FW_MCC_DIG 0x6 #define H2C_FUNC_FW_LPS_CH_INFO 0xb #define H2C_FUNC_FW_LPS_ML_CMN_INFO 0xe +#define H2C_FUNC_FW_RFE_TYPE 0x1b #define H2C_CL_OUTSRC_RF_REG_A 0x8 #define H2C_CL_OUTSRC_RF_REG_B 0x9 @@ -5568,6 +5574,7 @@ int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif); int rtw89_fw_h2c_fwips(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link, bool enable); +int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev); struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len); struct sk_buff rtw89_fw_h2c_alloc_skb_no_hdr(struct rtw89_dev rtwdev, u32 len); int rtw89_fw_msg_reg(struct rtw89_dev rtwdev, diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c index c78107e922063..cd56f9164cf41 100644 --- a/drivers/net/wireless/realtek/rtw89/phy.c +++ b/drivers/net/wireless/realtek/rtw89/phy.c @@ -3345,7 +3345,8 @@ static void __rtw89_phy_c2h_ra_rpt_iter(struct rtw89_sta_link rtwsta_link, changed = true; } - rtwsta_link->max_agg_wait = link_sta->agg.max_rc_amsdu_len / 1500 - 1; + if (!test_bit(RTW89_QUIRK_LOW_LATENCY, rtwdev->quirks)) + rtwsta_link->max_agg_wait = link_sta->agg.max_rc_amsdu_len / 1500 - 1; } static void rtw89_phy_c2h_ra_rpt_iter(void data, struct ieee80211_sta sta) @@ -3574,6 +3575,8 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev, "[IQK] iqk->fwk_status = %x\n", iqk->fwk_status); for (i = 0; i < 2; i++) { + struct rtw89_iqk_info iqk_info = &rtwdev->iqk; + rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] ======== Path %x ========\n", i); rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->iqk_band[%d] = %x\n", @@ -3592,6 +3595,9 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev, i, iqk->iqk_tx_fail[i]); rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->iqk_rx_fail[%d] = %x\n", i, iqk->iqk_rx_fail[i]); + + iqk_info->iqk_rx_fail[0][i] = iqk->iqk_rx_fail[i]; + for (j = 0; j < 6; j++) rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->rftxgain[%d][%d] = %x\n", diff --git a/drivers/net/wireless/realtek/rtw89/phy.h b/drivers/net/wireless/realtek/rtw89/phy.h index 0963cdfb15949..7bbda2ba5b5c8 100644 --- a/drivers/net/wireless/realtek/rtw89/phy.h +++ b/drivers/net/wireless/realtek/rtw89/phy.h @@ -631,8 +631,19 @@ struct rtw89_bb_wrap_common_data { } cim3k; u32 rfsi_ct_opt[2]; u8 pb_tb; + u8 qam_th[3]; } bands[RFSI_CTRL_BAND_NUM]; - u8 qam_th[6]; +}; + +struct rtw89_bb_wrap_common_data_gen2 { + struct { + u8 mdpd_160m; + u8 mdpd_320m; + u8 oob_dpd_20m; + u8 oob_dpd_40m; + u8 oob_dpd_80m; + u8 cim3k; + } qam_th; }; struct rtw89_bb_wrap_common_data_gen3 { @@ -644,6 +655,7 @@ struct rtw89_bb_wrap_common_data_gen3 { struct rtw89_bb_wrap_data { const struct rtw89_bb_wrap_common_data common; + const struct rtw89_bb_wrap_common_data_gen2 common_gen2; const struct rtw89_bb_wrap_common_data_gen3 common_gen3; struct { u16 qam_comp_th0[MAX_TX_RFSI_CTRL_OPT]; @@ -1039,9 +1051,9 @@ static inline void rtw89_phy_bb_wrap_init(struct rtw89_dev rtwdev) phy->bb_wrap_init(rtwdev); } -void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, - enum rtw89_rfsi_ctrl_band ctrl_band, - enum rtw89_phy_idx phy_idx); +void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + u8 mac_idx); void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev, const struct rtw89_chan chan, enum rtw89_phy_idx phy_idx); diff --git a/drivers/net/wireless/realtek/rtw89/phy_be.c b/drivers/net/wireless/realtek/rtw89/phy_be.c index c06927d1dc781..b94754d386737 100644 --- a/drivers/net/wireless/realtek/rtw89/phy_be.c +++ b/drivers/net/wireless/realtek/rtw89/phy_be.c @@ -682,9 +682,9 @@ static u32 rtw89_phy_bb_wrap_be_bandedge_decision(struct rtw89_dev rtwdev, return val; } -void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, - enum rtw89_rfsi_ctrl_band rfsi_band, - enum rtw89_phy_idx phy_idx) +static void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; const u32 val; @@ -693,15 +693,14 @@ void rtw89_phy_bb_wrap_set_rfsi_ct_opt(struct rtw89_dev rtwdev, if (!d \|\| !d->common) return; - val = d->common->bands[rfsi_band].rfsi_ct_opt; + val = d->common->bands[chan->rfsi_band].rfsi_ct_opt; - reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_0_BE4, phy_idx); + reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_0_BE4, mac_idx); rtw89_write32(rtwdev, reg, val[0]); - reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_8_BE4, phy_idx); + reg = rtw89_mac_reg_by_idx(rtwdev, R_RFSI_CT_OPT_8_BE4, mac_idx); rtw89_write32(rtwdev, reg, val[1]); } -EXPORT_SYMBOL(rtw89_phy_bb_wrap_set_rfsi_ct_opt); void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev, const struct rtw89_chan chan, @@ -733,6 +732,7 @@ void rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(struct rtw89_dev rtwdev, EXPORT_SYMBOL(rtw89_phy_bb_wrap_set_rfsi_bandedge_ch); static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; @@ -741,9 +741,9 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, if (!d \|\| !d->common) return; - th0 = d->common->qam_th[0]; - th1 = d->common->qam_th[1]; - th2 = d->common->qam_th[2]; + th0 = d->common->bands[chan->rfsi_band].qam_th[0]; + th1 = d->common->bands[chan->rfsi_band].qam_th[1]; + th2 = d->common->bands[chan->rfsi_band].qam_th[2]; / TH0 / rtw89_write32_idx(rtwdev, R_QAM_TH0_BE4, B_QAM_TH0_0_BE4, th0, mac_idx); @@ -772,6 +772,26 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_2_BE4, th2, mac_idx); rtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_5_BE4, th2, mac_idx); rtw89_write32_idx(rtwdev, R_QAM_TH2_BE4, B_QAM_TH2_8_BE4, th2, mac_idx); +} + +static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen2_init(struct rtw89_dev rtwdev, + enum rtw89_mac_idx mac_idx) +{ + const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; + const struct rtw89_bb_wrap_common_data_gen2 common_gen2; + u8 th0, th2, th3, th4, th5; + + if (!d \|\| !d->common_gen2) + return; + + common_gen2 = d->common_gen2; + th0 = common_gen2->qam_th.mdpd_160m; + / th1 (MDPD 320M) has no RTL8922D wrapper register / + th2 = common_gen2->qam_th.oob_dpd_20m; + th3 = common_gen2->qam_th.oob_dpd_40m; + th4 = common_gen2->qam_th.oob_dpd_80m; + th5 = common_gen2->qam_th.cim3k; + / DPD 160M / rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH0_BE4, B_DPD_DBW160_TH0_0_BE4, th0, mac_idx); rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH0_BE4, B_DPD_DBW160_TH0_1_BE4, th0, mac_idx); @@ -782,34 +802,34 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH1_BE4, B_DPD_DBW160_TH1_6_BE4, th0, mac_idx); rtw89_write32_idx(rtwdev, R_DPD_DBW160_TH1_BE4, B_DPD_DBW160_TH1_7_BE4, th0, mac_idx); /* DPD 20M / - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_0_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_1_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_2_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_5_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_6_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH1_7_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_0_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_1_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_2_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_3_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_4_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_5_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH0_BE4, B_DPD_CBW20_TH0_6_BE4, th2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH1_7_BE4, th2, mac_idx); / DPD 40M / - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_0_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_1_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_2_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW20_TH0_5_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_0_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_1_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_2_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_3_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_4_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_5_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_6_BE4, th3, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW40_TH1_7_BE4, th3, mac_idx); / DPD 80M / - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW80_TH1_0_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_1_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_2_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_3_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_4_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_5_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_6_BE4, 0x2, mac_idx); - rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_7_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH1_BE4, B_DPD_CBW80_TH1_0_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_1_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_2_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_3_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_4_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_5_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_6_BE4, th4, mac_idx); + rtw89_write32_idx(rtwdev, R_DPD_CBW_TH2_BE4, B_DPD_CBW80_TH2_7_BE4, th4, mac_idx); / CIM3K / - rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH2_BE4, 0x2, mac_idx); + rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH2_BE4, th5, mac_idx); } static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(struct rtw89_dev rtwdev, @@ -882,13 +902,14 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(struct rtw89_dev rt } static void rtw89_phy_bb_wrap_tx_rfsi_scenario_def(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; u8 pb_tb = 0; if (d && d->common) - pb_tb = d->common->bands[0].pb_tb; + pb_tb = d->common->bands[chan->rfsi_band].pb_tb; rtw89_write32_idx(rtwdev, R_RFSI_CT_DEF_BE4, B_RFSI_CT_ER_BE4, 0x0, mac_idx); rtw89_write32_idx(rtwdev, R_RFSI_CT_DEF_BE4, B_RFSI_CT_SUBF_BE4, 0x0, mac_idx); @@ -905,15 +926,16 @@ static void rtw89_phy_bb_wrap_tx_rfsi_scenario_def(struct rtw89_dev rtwdev, } static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; const u16 th; - if (!d \|\| !d->common) + if (!d) return; - th = d->bands[0].qam_comp_th0; + th = d->bands[chan->rfsi_band].qam_comp_th0; rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKLWORD, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKHWORD, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKLWORD, th[2], mac_idx); @@ -923,7 +945,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKLWORD, th[6], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKHWORD, th[7], mac_idx); - th = d->bands[0].qam_comp_th1; + th = d->bands[chan->rfsi_band].qam_comp_th1; rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_L, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_M, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_H, th[2], mac_idx); @@ -933,7 +955,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_L, th[6], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_M, th[7], mac_idx); - th = d->bands[0].qam_comp_th2; + th = d->bands[chan->rfsi_band].qam_comp_th2; rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2L, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2M, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH4_BE4, B_QAM_COMP_TH4_2H, th[2], mac_idx); @@ -943,7 +965,7 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_2L, th[6], mac_idx); rtw89_write32_idx(rtwdev, R_QAM_COMP_TH6_BE4, B_QAM_COMP_TH6_2M, th[7], mac_idx); - th = d->bands[0].qam_comp_ow; + th = d->bands[chan->rfsi_band].qam_comp_ow; rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKLWORD, th[0], mac_idx); rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKHWORD, th[1], mac_idx); rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKLWORD, th[2], mac_idx); @@ -954,7 +976,46 @@ static void rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKHWORD, th[7], mac_idx); } +static void rtw89_phy_trig_spect_tx_shape_disabled(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + enum rtw89_mac_idx mac_idx) +{ + const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; + u8 band = chan->band_type; + u8 tx_shape_idx; + + /* + * Only needed by chips with d->bands[].{qam_comp_th0, qam_comp_ow} as + * what rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val() does. + / + if (!d) + return; + + tx_shape_idx = rtw89_get_tx_shape_idx(rtwdev, band, RTW89_RS_OFDM); + if (tx_shape_idx) + return; + + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, mac_idx); + + rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_L, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_H, 0, mac_idx); +} + static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; @@ -963,7 +1024,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, if (!d) return; - th = d->bands[0].oob_dpd_by_cbw[0]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[0]; rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK2_BE4, th, mac_idx); @@ -973,7 +1034,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_CCK7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[1]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[1]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK2_BE4, th, mac_idx); @@ -983,7 +1044,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_CCK7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[2]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[2]; rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH2_BE4, th, mac_idx); @@ -993,7 +1054,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW20_BE4, B_OOB_CBW20_TH7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[3]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[3]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH2_BE4, th, mac_idx); @@ -1003,7 +1064,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_TH7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[4]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[4]; rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH2_BE4, th, mac_idx); @@ -1013,7 +1074,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_TH7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[5]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[5]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW2_BE4, th, mac_idx); @@ -1023,7 +1084,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW20_OW7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[6]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[6]; rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW2_BE4, th, mac_idx); @@ -1033,7 +1094,7 @@ static void rtw89_phy_bb_set_oob_dpd_qam_comp_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW6_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW40_BE4, B_OOB_CBW40_OW7_BE4, th, mac_idx); - th = d->bands[0].oob_dpd_by_cbw[7]; + th = d->bands[chan->rfsi_band].oob_dpd_by_cbw[7]; rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW0_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW1_BE4, th, mac_idx); rtw89_write32_idx(rtwdev, R_OOB_CBW80_BE4, B_OOB_CBW80_OW2_BE4, th, mac_idx); @@ -1075,6 +1136,7 @@ static void rtw89_phy_bb_set_mdpd_qam_comp_val(struct rtw89_dev rtwdev, } static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, enum rtw89_mac_idx mac_idx) { const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; @@ -1083,7 +1145,7 @@ static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev, if (!d \|\| !d->common) return; - p = &d->common->bands[0].cim3k; + p = &d->common->bands[chan->rfsi_band].cim3k; rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_TH_BE4, p->th, mac_idx); rtw89_write32_idx(rtwdev, R_COMP_CIM3K_BE4, B_COMP_CIM3K_OW_BE4, p->ow, mac_idx); @@ -1097,6 +1159,14 @@ static void rtw89_phy_bb_set_cim3k_val(struct rtw89_dev rtwdev, rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_SU_FORCE_EN, 1, mac_idx); rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_SU_FORCE_VAL, 0, mac_idx); + + if (rtwdev->hal.cid == RTL8922D_CID7025) + return; + + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU26_FORCE_EN, 1, mac_idx); + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU26_FORCE_VAL, 0, mac_idx); + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU52_FORCE_EN, 1, mac_idx); + rtw89_write32_idx(rtwdev, R_CIM3K_SU_FORCE, B_CIM3K_RU52_FORCE_VAL, 1, mac_idx); } static void rtw89_phy_bb_set_cck_cfir_filter_val_gen3(struct rtw89_dev rtwdev, @@ -1146,17 +1216,26 @@ static void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init(struct rtw89_dev rtwdev, rtw89_entity_get_conf(rtwdev, &conf); chan = conf.chans[phy_idx]; - rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(rtwdev, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(rtwdev, chan, mac_idx); +} + +void rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(struct rtw89_dev rtwdev, + const struct rtw89_chan chan, + u8 mac_idx) +{ + rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_init(rtwdev, chan, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen2_init(rtwdev, mac_idx); rtw89_phy_bb_wrap_tx_rfsi_qam_comp_th_gen3_init(rtwdev, chan, mac_idx); - rtw89_phy_bb_wrap_tx_rfsi_scenario_def(rtwdev, mac_idx); - rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(rtwdev, mac_idx); - rtw89_phy_bb_set_oob_dpd_qam_comp_val(rtwdev, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_scenario_def(rtwdev, chan, mac_idx); + rtw89_phy_bb_wrap_tx_rfsi_qam_comp_val(rtwdev, chan, mac_idx); + rtw89_phy_trig_spect_tx_shape_disabled(rtwdev, chan, mac_idx); + rtw89_phy_bb_set_oob_dpd_qam_comp_val(rtwdev, chan, mac_idx); rtw89_phy_bb_set_mdpd_qam_comp_val(rtwdev, mac_idx); - rtw89_phy_bb_set_cim3k_val(rtwdev, mac_idx); + rtw89_phy_bb_set_cim3k_val(rtwdev, chan, mac_idx); rtw89_phy_bb_set_cck_cfir_filter_val_gen3(rtwdev, mac_idx); - rtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, 0, phy_idx); - rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(rtwdev, chan, phy_idx); + rtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, chan, mac_idx); } +EXPORT_SYMBOL(rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan); static void rtw89_phy_bb_wrap_ul_pwr(struct rtw89_dev rtwdev) { diff --git a/drivers/net/wireless/realtek/rtw89/ps.c b/drivers/net/wireless/realtek/rtw89/ps.c index 31bb5dcd284ae..23a9c7a0704a7 100644 --- a/drivers/net/wireless/realtek/rtw89/ps.c +++ b/drivers/net/wireless/realtek/rtw89/ps.c @@ -363,15 +363,12 @@ void rtw89_recalc_lps(struct rtw89_dev rtwdev) { struct ieee80211_vif vif, found_vif = NULL; struct rtw89_vif rtwvif; - enum rtw89_entity_mode mode; int count = 0; - mode = rtw89_get_entity_mode(rtwdev); - if (mode == RTW89_ENTITY_MODE_MCC) - goto disable_lps; - rtw89_for_each_rtwvif(rtwdev, rtwvif) { vif = rtwvif_to_vif(rtwvif); + if (vif->type == NL80211_IFTYPE_P2P_DEVICE) + continue; if (vif->type != NL80211_IFTYPE_STATION) { count = 0; @@ -387,7 +384,6 @@ void rtw89_recalc_lps(struct rtw89_dev rtwdev) return; } -disable_lps: rtw89_leave_lps(rtwdev); rtwdev->lps_enabled = false; } diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h index abeeb61007dce..4291e8115f105 100644 --- a/drivers/net/wireless/realtek/rtw89/reg.h +++ b/drivers/net/wireless/realtek/rtw89/reg.h @@ -10696,6 +10696,10 @@ #define B_FBTB_CT_FTM_BE4 GENMASK(23, 20) #define B_FBTB_CT_SENS_BE4 GENMASK(27, 24) #define R_CIM3K_SU_FORCE 0x119F8 +#define B_CIM3K_RU26_FORCE_EN BIT(13) +#define B_CIM3K_RU26_FORCE_VAL BIT(14) +#define B_CIM3K_RU52_FORCE_EN BIT(15) +#define B_CIM3K_RU52_FORCE_VAL BIT(16) #define B_CIM3K_SU_FORCE_EN BIT(17) #define B_CIM3K_SU_FORCE_VAL BIT(18) #define R_QAM3_TH0_BE4 0x119FC @@ -11068,13 +11072,17 @@ #define B_KTBL0_RST BIT(31) #define R_CFIR_CTRL_A_BE4 0x38124 #define R_CFIR_CTRL_B_BE4 0x38224 +#define B_CFIR_CTRL_RXKIDX0_EN BIT(0) #define B_CFIR_CTRL_KIDX0_EN BIT(8) +#define B_CFIR_CTRL_RXKIDX1_EN BIT(16) #define B_CFIR_CTRL_KIDX1_EN BIT(24) #define R_TX_IQC_A_BE4 0x38138 #define R_TX_IQC_B_BE4 0x38238 #define B_TX_IQC_X GENMASK(31, 20) #define B_TX_IQC_Y GENMASK(19, 8) #define B_TX_IQC_DPK BIT(3) +#define R_RX_IQC_A_BE4 0x3813c +#define R_RX_IQC_B_BE4 0x3823c #define R_KTBL1A_BE4 0x38154 #define R_KTBL1B_BE4 0x38254 #define B_KTBL1_TBL0 BIT(3) diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c index 14fab6b1a74a7..942f556339421 100644 --- a/drivers/net/wireless/realtek/rtw89/regd.c +++ b/drivers/net/wireless/realtek/rtw89/regd.c @@ -1091,7 +1091,7 @@ static bool __rtw89_reg_6ghz_power_recalc(struct rtw89_dev rtwdev) int count = 0; u8 index; - rtw89_for_each_rtwvif(rtwdev, rtwvif) { + rtw89_for_each_active_rtwvif(rtwdev, rtwvif) { rtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id) { chan = rtw89_chan_get(rtwdev, rtwvif_link->chanctx_idx); if (chan->band_type != RTW89_BAND_6G) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922d.c b/drivers/net/wireless/realtek/rtw89/rtw8922d.c index 142e693c87bfd..75297b39c4d78 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8922d.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8922d.c @@ -343,35 +343,79 @@ static const struct rtw89_efuse_block_cfg rtw8922d_efuse_blocks[] = { static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7025 = { .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_ENABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, .pb_tb = 3, + .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM}, }, [RFSI_CTRL_BAND_2GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_ENABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, .pb_tb = 0, + .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM}, }}, - .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM, RFSI_MAX, RFSI_MAX, RFSI_MAX}, }; static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090 = { .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_DISABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, - .pb_tb = 3, + .pb_tb = 0, + .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM}, }, [RFSI_CTRL_BAND_2GHZ] = { - .cim3k = {CIM3K_OFF, CIM3K_OFF, CIM3K_DISABLE, CIM3K_ENABLE}, + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, .pb_tb = 0, + .qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM}, }}, - .qam_th = {RFSI_BPSK, RFSI_QPSK, RFSI_256QAM, RFSI_MAX, RFSI_MAX, RFSI_MAX}, +}; + +static const struct rtw89_bb_wrap_common_data rtw8922d_bb_wrap_common_data_7090_rfe38 = { + .bands = { + [RFSI_CTRL_BAND_5_6GHZ] = { + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, + .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), + _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, + .pb_tb = 0, + .qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM}, + }, + [RFSI_CTRL_BAND_2GHZ] = { + .cim3k = {CIM3K_ON, CIM3K_ON, CIM3K_ENABLE, CIM3K_ENABLE}, + .rfsi_ct_opt = {_8nibble(2, 2, 2, 2, 1, 1, 1, 1), + _8nibble(2, 2, 2, 2, 1, 1, 1, 1)}, + .pb_tb = 0, + .qam_th = {RFSI_QPSK, RFSI_16QAM, RFSI_256QAM}, + }}, +}; + +static const +struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7025 = { + .qam_th = { + .mdpd_160m = RFSI_BPSK, + .mdpd_320m = RFSI_BPSK, + .oob_dpd_20m = RFSI_16QAM, + .oob_dpd_40m = RFSI_16QAM, + .oob_dpd_80m = RFSI_16QAM, + .cim3k = RFSI_16QAM, + }, +}; + +static const +struct rtw89_bb_wrap_common_data_gen2 rtw8922d_bb_wrap_common_data_gen2_7090 = { + .qam_th = { + .mdpd_160m = RFSI_16QAM, + .mdpd_320m = RFSI_16QAM, + .oob_dpd_20m = RFSI_16QAM, + .oob_dpd_40m = RFSI_16QAM, + .oob_dpd_80m = RFSI_16QAM, + .cim3k = RFSI_16QAM, + }, }; static const @@ -390,6 +434,7 @@ struct rtw89_bb_wrap_common_data_gen3 rtw8922d_bb_wrap_common_data_gen3_7090 = { static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = { .common = &rtw8922d_bb_wrap_common_data_7025, + .common_gen2 = &rtw8922d_bb_wrap_common_data_gen2_7025, .common_gen3 = NULL, .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { @@ -417,21 +462,22 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7025_default = { static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = { .common = &rtw8922d_bb_wrap_common_data_7090, + .common_gen2 = &rtw8922d_bb_wrap_common_data_gen2_7090, .common_gen3 = &rtw8922d_bb_wrap_common_data_gen3_7090, .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .qam_comp_th0 = {0x4000, 0x6420, 0x6520, 0x6000, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x6400, 0x6500, 0x6000, + .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0x4000, + .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0}, + .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0, 0}, .oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF}, }, [RFSI_CTRL_BAND_2GHZ] = { .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4600, 0, 0, 0, 0, 0, 0, 0)}, .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, @@ -442,23 +488,24 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_default = { .mdpd_by_dbw = {MDPD_OFF, MDPD_OFF, MDPD_ON, MDPD_ON}, }; -static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe35_41_44 = { - .common = &rtw8922d_bb_wrap_common_data_7090, +static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe38 = { + .common = &rtw8922d_bb_wrap_common_data_7090_rfe38, + .common_gen2 = &rtw8922d_bb_wrap_common_data_gen2_7090, .common_gen3 = &rtw8922d_bb_wrap_common_data_gen3_7090, .bands = { [RFSI_CTRL_BAND_5_6GHZ] = { - .qam_comp_th0 = {0x4000, 0x6420, 0x6520, 0x6000, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x6400, 0x6500, 0x6000, + .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4600, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0x4000, + .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, - .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0}, + .qam_comp_ow = {0x4000, 0x4000, 0x4000, 0, 0, 0, 0, 0, 0, 0}, .oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF}, }, [RFSI_CTRL_BAND_2GHZ] = { .qam_comp_th0 = {0x4000, 0x4400, 0x4500, 0, 0, 0, 0, 0, 0, 0}, - .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4500, 0, 0, + .qam_comp_th1 = {_10qam_comp_code(0x4000, 0x4400, 0x4700, 0, 0, 0, 0, 0, 0, 0)}, .qam_comp_th2 = {_10qam_comp_code(0x4000, 0x4400, 0x4400, 0, 0, 0, 0, 0, 0, 0)}, @@ -466,7 +513,7 @@ static const struct rtw89_bb_wrap_data rtw8922d_bb_wrap_data_7090_rfe35_41_44 = .oob_dpd_by_cbw = {OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF, OOB_DPD_OFF}, }}, - .mdpd_by_dbw = {MDPD_OFF, MDPD_OFF, MDPD_ON, MDPD_ON}, + .mdpd_by_dbw = {MDPD_ON, MDPD_ON, MDPD_ON, MDPD_ON}, }; static void rtw8922d_sel_bt_rx_path(struct rtw89_dev rtwdev, u8 val, @@ -901,6 +948,9 @@ static int rtw8922d_read_sys(struct rtw89_dev rtwdev, u8 log_map) u16 digk; u8 vmin; + if (!test_bit(RTW89_QUIRK_THERMAL_PROT_VCORE, rtwdev->quirks)) + return 0; + digk = log_map[0x200] \| log_map[0x201] << 8; hal->thermal_prot_vmax = u16_get_bits(digk, B_BE_PWMTUNE_MASK); @@ -1142,24 +1192,13 @@ static int rtw8922d_data_setup(struct rtw89_dev rtwdev) { const struct rtw89_bb_wrap_data data; struct rtw89_hal hal = &rtwdev->hal; - bool rfe35_41_44 = false; - - switch (rtwdev->efuse.rfe_type) { - case 35: - case 41: - case 44: - rfe35_41_44 = true; - break; - } - if (hal->cid == RTL8922D_CID7025) { + if (hal->cid == RTL8922D_CID7025) data = &rtw8922d_bb_wrap_data_7025_default; - } else { - if (rfe35_41_44) - data = &rtw8922d_bb_wrap_data_7090_rfe35_41_44; - else - data = &rtw8922d_bb_wrap_data_7090_default; - } + else if (rtwdev->efuse.rfe_type == 38) + data = &rtw8922d_bb_wrap_data_7090_rfe38; + else + data = &rtw8922d_bb_wrap_data_7090_default; rtwdev->phy_info.bb_wrap_data = data; @@ -2432,14 +2471,15 @@ static int rtw8922d_ctrl_mlo(struct rtw89_dev rtwdev, enum rtw89_mlo_dbcc_mode rtw89_write32_mask(rtwdev, reg1, B_BBWRAP_ELMSR_EN_BE4, 0); } else if (mode == MLO_0_PLUS_2_1RF) { rtw89_phy_write32_mask(rtwdev, R_SYS_DBCC_BE4, - B_SYS_DBCC_24G_BAND_SEL_BE4, RTW89_PHY_0); + B_SYS_DBCC_24G_BAND_SEL_BE4, RTW89_PHY_1); rtw89_write32_mask(rtwdev, reg0, B_BBWRAP_ELMSR_EN_BE4, 0); rtw89_write32_mask(rtwdev, reg1, B_BBWRAP_ELMSR_EN_BE4, 0); } else if ((mode == MLO_1_PLUS_1_1RF) \|\| (mode == DBCC_LEGACY)) { struct rtw89_entity_conf conf; rtw89_entity_get_conf(rtwdev, &conf); - cck_phy_idx = conf.chans[1]->band_type == RTW89_BAND_2G ? + cck_phy_idx = conf.chans[0]->band_type != RTW89_BAND_2G && + conf.chans[1]->band_type == RTW89_BAND_2G ? RTW89_PHY_1 : RTW89_PHY_0; rtw89_phy_write32_mask(rtwdev, R_SYS_DBCC_BE4, @@ -2465,6 +2505,8 @@ static void rtw8922d_bb_sethw(struct rtw89_dev rtwdev) enum rtw89_phy_idx phy_idx; u32 reg; + rtw89_fw_h2c_phy_rfe_type(rtwdev); + reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_PWR_BOOST, RTW89_PHY_0); rtw89_write32_clr(rtwdev, reg, B_BE_PWR_CTRL_SEL); reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_PWR_BOOST, RTW89_PHY_1); @@ -2508,7 +2550,8 @@ static void rtw8922d_set_channel_bb(struct rtw89_dev rtwdev, u8 pri_sb = chan->pri_sb_idx; u32 val; - rtw89_phy_bb_wrap_set_rfsi_ct_opt(rtwdev, chan->rfsi_band, phy_idx); + rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan(rtwdev, chan, phy_idx); + rtw8922d_ctrl_ch(rtwdev, chan, phy_idx); rtw8922d_ctrl_bw(rtwdev, pri_sb, chan->band_width, phy_idx); rtw89_phy_bb_wrap_set_rfsi_bandedge_ch(rtwdev, chan, phy_idx); @@ -2822,6 +2865,64 @@ static void __rtw8922d_txiqk_enable(struct rtw89_dev rtwdev) } } +static void __rtw8922d_rxiqk_disable(struct rtw89_dev rtwdev) +{ + struct rtw89_rfk_mcc_info_data rfk_mcc = rtwdev->rfk_mcc.data; + u8 path, kidx; + + for (path = RF_PATH_A; path <= RF_PATH_B; path++) { + kidx = rfk_mcc[path].table_idx; + + if (kidx == 0) { + rtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + } else if (kidx == 1) { + rtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX1_EN); + } else { + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x1); + rtw89_phy_write32_clr(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x0); + } + + rtw89_phy_write32(rtwdev, R_RX_IQC_A_BE4 + (path << 8), 0x40000002); + } +} + +static void __rtw8922d_rxiqk_enable(struct rtw89_dev rtwdev) +{ + struct rtw89_rfk_mcc_info_data rfk_mcc = rtwdev->rfk_mcc.data; + struct rtw89_iqk_info iqk_info = &rtwdev->iqk; + u8 path, kidx; + + for (path = RF_PATH_A; path <= RF_PATH_B; path++) { + if (iqk_info->iqk_rx_fail[0][path]) + continue; + + kidx = rfk_mcc[path].table_idx; + + if (kidx == 0) { + rtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + } else if (kidx == 1) { + rtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX1_EN); + } else { + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x1); + rtw89_phy_write32_set(rtwdev, R_CFIR_CTRL_A_BE4 + (path << 8), + B_CFIR_CTRL_RXKIDX0_EN); + rtw89_phy_write32_mask(rtwdev, R_NCTL_CFG_BE4, + B_NCTL_CFG_BE4_SPAGE, 0x0); + } + + rtw89_phy_write32(rtwdev, R_RX_IQC_A_BE4 + (path << 8), 0x40000000); + } +} + static void rtw8922d_rfk_scan(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link, bool start) @@ -2829,9 +2930,11 @@ static void rtw8922d_rfk_scan(struct rtw89_dev rtwdev, if (start) { __rtw8922d_tssi_disable(rtwdev, rtwvif_link->phy_idx); __rtw8922d_txiqk_disable(rtwdev); + __rtw8922d_rxiqk_disable(rtwdev); } else { __rtw8922d_tssi_enable(rtwdev, rtwvif_link->phy_idx); __rtw8922d_txiqk_enable(rtwdev); + __rtw8922d_rxiqk_enable(rtwdev); } } @@ -2909,61 +3012,6 @@ static void rtw8922d_set_txpwr_ref(struct rtw89_dev rtwdev, B_BE_PWR_REF_CTRL_CCK, ref_cck); } -static void rtw8922d_set_tx_shape(struct rtw89_dev rtwdev, - const struct rtw89_chan chan, - enum rtw89_phy_idx phy_idx) -{ - const struct rtw89_bb_wrap_data d = rtwdev->phy_info.bb_wrap_data; - u8 band = chan->band_type; - u8 tx_shape_idx; - const u16 th; - - tx_shape_idx = rtw89_get_tx_shape_idx(rtwdev, band, RTW89_RS_OFDM); - if (tx_shape_idx == 0) - goto disable; - - th = d->bands[chan->rfsi_band].qam_comp_th0; - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKLWORD, th[0], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, MASKHWORD, th[1], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKLWORD, th[2], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, MASKHWORD, th[3], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, MASKLWORD, th[4], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, MASKHWORD, th[5], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKLWORD, th[6], phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, MASKHWORD, th[7], phy_idx); - - th = d->bands[chan->rfsi_band].qam_comp_ow; - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKLWORD, th[0], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, MASKHWORD, th[1], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKLWORD, th[2], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, MASKHWORD, th[3], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, MASKLWORD, th[4], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, MASKHWORD, th[5], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKLWORD, th[6], phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, MASKHWORD, th[7], phy_idx); - - return; - -disable: - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH0_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH1_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH2_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_QAM_COMP_TH3_BE4, B_QAM_COMP_TH_TRIANGULAR_H, 0, phy_idx); - - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_0_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_1_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_2_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_L, 0, phy_idx); - rtw89_write32_idx(rtwdev, R_OW_VAL_3_BE4, B_OW_VAL_TRIANGULAR_H, 0, phy_idx); -} - static void rtw8922d_set_txpwr_sar_diff(struct rtw89_dev rtwdev, const struct rtw89_chan chan, enum rtw89_phy_idx phy_idx) @@ -2995,7 +3043,6 @@ static void rtw8922d_set_txpwr(struct rtw89_dev rtwdev, { rtw89_phy_set_txpwr_byrate(rtwdev, chan, phy_idx); rtw89_phy_set_txpwr_offset(rtwdev, chan, phy_idx); - rtw8922d_set_tx_shape(rtwdev, chan, phy_idx); rtw89_phy_set_txpwr_limit(rtwdev, chan, phy_idx); rtw89_phy_set_txpwr_limit_ru(rtwdev, chan, phy_idx); rtw8922d_set_txpwr_ref(rtwdev, chan, phy_idx); diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922de.c b/drivers/net/wireless/realtek/rtw89/rtw8922de.c index a71e41f285446..d0dede477fb4a 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8922de.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8922de.c @@ -9,6 +9,12 @@ #include "reg.h" #include "rtw8922d.h" +static const struct rtw89_pci_ssid_quirk rtw8922de_pci_ssid_quirks[] = { + {RTW89_PCI_SSID(PCI_VENDOR_ID_REALTEK, 0x892D, 0x1E44, 0x1400, VALVE), + .bitmap = BIT(RTW89_QUIRK_LOW_LATENCY)}, + {}, +}; + static const struct rtw89_pci_info rtw8922d_pci_info = { .gen_def = &rtw89_pci_gen_be, .isr_def = &rtw89_pci_isr_be_v1, @@ -66,7 +72,7 @@ static const struct rtw89_pci_info rtw8922d_pci_info = { .disable_intr = rtw89_pci_disable_intr_v3, .recognize_intrs = rtw89_pci_recognize_intrs_v3, - .ssid_quirks = NULL, + .ssid_quirks = rtw8922de_pci_ssid_quirks, }; static const struct rtw89_driver_info rtw89_8922de_vs_info = { diff --git a/drivers/net/wireless/realtek/rtw89/util.h b/drivers/net/wireless/realtek/rtw89/util.h index c16e7a7f8bc92..aa87a520bdc38 100644 --- a/drivers/net/wireless/realtek/rtw89/util.h +++ b/drivers/net/wireless/realtek/rtw89/util.h @@ -21,6 +21,10 @@ #define rtw89_for_each_rtwvif(rtwdev, rtwvif) \ list_for_each_entry(rtwvif, &(rtwdev)->rtwvifs_list, list) +/ call this function with wiphy mutex is held / +#define rtw89_for_each_active_rtwvif(rtwdev, rtwvif) \ + list_for_each_entry(rtwvif, &(rtwdev)->hal.entity_mgnt.active_list, mgnt_entry) + / Before adding rtwvif to list, we need to check if it already exist, beacase * in some case such as SER L2 happen during WoWLAN flow, calling reconfig * twice cause the list to be added twice.
45/3	2026/08/26 06:50	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 34432 output: 33 thoughts: 1424 Thoughts: KMSAN Evaluation of rtw89 Patch Okay, so this patch is touching the `rtw89` driver, specifically for Realtek's 802.11ax/be wireless. My immediate concern is the introduction of any uninitialized memory risks, thus necessitating a KMSAN analysis. I need to methodically go through this. First, I see the replacement of `rtw89_for_each_rtwvif` with `rtw89_for_each_active_rtwvif` in several key locations. This is generally a good sign, potentially narrowing the scope, but I need to understand why the change was made to determine if it introduces any subtle issues. Then, there's the addition of `rtw89_chanctx_paused` and its usage, along with support for the `NL80211_IFTYPE_P2P_DEVICE` interface type – nothing immediately alarming, but worth noting for potential context-dependent issues. The introduction of `rtw89_fw_h2c_phy_rfe_type` has caught my attention. It looks like a firmware command. Okay, I'll dive in, but let's see, it uses `struct rtw89_h2c_phy_rfe_type` to send the `efuse->rfe_type` value to the firmware. Let's dig deeper: ```c +int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev) +{ + const struct rtw89_chip_info chip = rtwdev->chip; + struct rtw89_efuse efuse = &rtwdev->efuse; + struct rtw89_h2c_phy_rfe_type h2c; + u32 len = sizeof(h2c); + struct sk_buff skb; + int ret; + + if (chip->chip_id != RTL8922D) + return 0; + + skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len); + if (!skb) { + rtw89_err(rtwdev, "failed to alloc skb for h2c phy_rfe_type\n"); + return -ENOMEM; + } + skb_put(skb, len); + h2c = (struct rtw89_h2c_phy_rfe_type )skb->data; + + h2c->rfe_type = efuse->rfe_type; + + rtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C, + H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM, + H2C_FUNC_FW_RFE_TYPE, 0, 0, len); + + ret = rtw89_h2c_tx(rtwdev, skb, false); +... ``` Right, looking at `struct rtw89_h2c_phy_rfe_type`, it contains just `rfe_type` and three reserved bytes, packed. This is 4 bytes. Within `rtw89_fw_h2c_phy_rfe_type`, it calls `skb_put(skb, len)`, and then casts `skb->data` to the `h2c` structure. The potential risk here is if the header is added incorrectly by `rtw89_fw_h2c_alloc_skb_with_hdr` or if `skb_put` is misused. `skb_put(skb, len)` should add `len` bytes to the skb after* the current data. I'm going to have to make sure `skb->data` correctly points to the newly added data. I need to confirm that `skb_put` is called correctly after `rtw89_fw_h2c_alloc_skb_with_hdr`. Okay, need to check `rtw89_fw_h2c_alloc_skb_with_hdr` now to ensure there isn't a problem with how it sets up the `skb`. I'll use `grepper` to
46/3	2026/08/26 06:51	tool	grepper	0m Args: { "Expression": "rtw89_fw_h2c_alloc_skb_with_hdr" } Results: { "Output": "\nFull output is too long, showing 500 out of 795 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtw89/cam.c=12=rtw89_cam_get_sec_key_cmd(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/cam.c-21-\ndrivers/net/wireless/realtek/rtw89/cam.c:22:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, cmd_len);\ndrivers/net/wireless/realtek/rtw89/cam.c-23-\tif (!skb)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=77=static struct sk_buff rtw89_fw_h2c_alloc_skb(struct rtw89_dev rtwdev, u32 len,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-95-\ndrivers/net/wireless/realtek/rtw89/fw.c:96:struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len)\ndrivers/net/wireless/realtek/rtw89/fw.c-97-{\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=1729=static int __rtw89_fw_download_hdr(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-1740-\ndrivers/net/wireless/realtek/rtw89/fw.c:1741:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-1742-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2290=int rtw89_fw_h2c_cam(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2307-\ndrivers/net/wireless/realtek/rtw89/fw.c:2308:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2309-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2346=int rtw89_fw_h2c_dctl_sec_cam_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2354-\ndrivers/net/wireless/realtek/rtw89/fw.c:2355:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2356-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2385=int rtw89_fw_h2c_dctl_sec_cam_v2(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2393-\ndrivers/net/wireless/realtek/rtw89/fw.c:2394:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2395-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2424=int rtw89_fw_h2c_dctl_sec_cam_v3(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2432-\ndrivers/net/wireless/realtek/rtw89/fw.c:2433:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2434-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2463=int rtw89_fw_h2c_default_dmac_tbl_v2(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2472-\ndrivers/net/wireless/realtek/rtw89/fw.c:2473:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2474-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2518=int rtw89_fw_h2c_default_dmac_tbl_v3(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2527-\ndrivers/net/wireless/realtek/rtw89/fw.c:2528:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2529-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2574=int rtw89_fw_h2c_ba_cam(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2601-\ndrivers/net/wireless/realtek/rtw89/fw.c:2602:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2603-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2654=static int rtw89_fw_h2c_init_ba_cam_v0_ext(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2661-\ndrivers/net/wireless/realtek/rtw89/fw.c:2662:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2663-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2709=int rtw89_fw_h2c_ba_cam_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2737-\ndrivers/net/wireless/realtek/rtw89/fw.c:2738:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2739-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2788=int rtw89_fw_h2c_init_ba_cam_users(struct rtw89_dev rtwdev, u8 users,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2795-\ndrivers/net/wireless/realtek/rtw89/fw.c:2796:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-2797-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2828=int rtw89_fw_h2c_fw_log(struct rtw89_dev rtwdev, bool enable)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2838-\ndrivers/net/wireless/realtek/rtw89/fw.c:2839:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LOG_CFG_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-2840-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3114=int rtw89_fw_h2c_general_pkt(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3129-\ndrivers/net/wireless/realtek/rtw89/fw.c:3130:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_GENERAL_PKT_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-3131-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3163=int rtw89_fw_h2c_lps_parm(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3174-\ndrivers/net/wireless/realtek/rtw89/fw.c:3175:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LPS_PARM_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-3176-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3212=int rtw89_fw_h2c_lps_ch_info(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3228-\ndrivers/net/wireless/realtek/rtw89/fw.c:3229:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-3230-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3282=int rtw89_fw_h2c_lps_ml_cmn_info(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3307-\ndrivers/net/wireless/realtek/rtw89/fw.c:3308:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-3309-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3454=int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3473-\ndrivers/net/wireless/realtek/rtw89/fw.c:3474:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-3475-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3538=int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3549-\ndrivers/net/wireless/realtek/rtw89/fw.c:3550:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-3551-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3579=int rtw89_fw_h2c_p2p_act(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3588-\ndrivers/net/wireless/realtek/rtw89/fw.c:3589:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_P2P_ACT_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-3590-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3653=int rtw89_fw_h2c_default_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3661-\ndrivers/net/wireless/realtek/rtw89/fw.c:3662:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-3663-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3703=int rtw89_fw_h2c_default_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3712-\ndrivers/net/wireless/realtek/rtw89/fw.c:3713:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-3714-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3788=int rtw89_fw_h2c_default_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3798-\ndrivers/net/wireless/realtek/rtw89/fw.c:3799:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-3800-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3929=int rtw89_fw_h2c_assoc_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3945-\ndrivers/net/wireless/realtek/rtw89/fw.c:3946:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-3947-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4076=int rtw89_fw_h2c_assoc_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4093-\ndrivers/net/wireless/realtek/rtw89/fw.c:4094:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4095-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4204=int rtw89_fw_h2c_assoc_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4221-\ndrivers/net/wireless/realtek/rtw89/fw.c:4222:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4223-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4332=int rtw89_fw_h2c_ampdu_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4344-\ndrivers/net/wireless/realtek/rtw89/fw.c:4345:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4346-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4398=int rtw89_fw_h2c_ampdu_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4410-\ndrivers/net/wireless/realtek/rtw89/fw.c:4411:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4412-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4464=int rtw89_fw_h2c_txtime_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4470-\ndrivers/net/wireless/realtek/rtw89/fw.c:4471:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-4472-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4507=int rtw89_fw_h2c_txtime_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4514-\ndrivers/net/wireless/realtek/rtw89/fw.c:4515:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4516-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4561=int rtw89_fw_h2c_txtime_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4568-\ndrivers/net/wireless/realtek/rtw89/fw.c:4569:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4570-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4615=int rtw89_fw_h2c_punctured_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4623-\ndrivers/net/wireless/realtek/rtw89/fw.c:4624:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4625-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4658=int rtw89_fw_h2c_punctured_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4666-\ndrivers/net/wireless/realtek/rtw89/fw.c:4667:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4668-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4700=int rtw89_fw_h2c_txpath_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4709-\ndrivers/net/wireless/realtek/rtw89/fw.c:4710:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_CMC_TBL_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-4711-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4739=int rtw89_fw_h2c_update_beacon(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4781-\tbcn_total_len = len + skb_beacon-\u003elen;\ndrivers/net/wireless/realtek/rtw89/fw.c:4782:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, bcn_total_len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4783-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4819=int rtw89_fw_h2c_update_beacon_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4860-\tbcn_total_len = len + skb_beacon-\u003elen;\ndrivers/net/wireless/realtek/rtw89/fw.c:4861:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, bcn_total_len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4862-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4902=int rtw89_fw_h2c_tbtt_tuning(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4909-\ndrivers/net/wireless/realtek/rtw89/fw.c:4910:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4911-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4940=int rtw89_fw_h2c_pwr_lvl(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4952-\ndrivers/net/wireless/realtek/rtw89/fw.c:4953:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-4954-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4989=int rtw89_fw_h2c_role_maintain(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5009-\ndrivers/net/wireless/realtek/rtw89/fw.c:5010:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5011-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5085=int rtw89_fw_h2c_join_info(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5112-\ndrivers/net/wireless/realtek/rtw89/fw.c:5113:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5114-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5185=int rtw89_fw_h2c_notify_dbcc(struct rtw89_dev rtwdev, bool en)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5191-\ndrivers/net/wireless/realtek/rtw89/fw.c:5192:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5193-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5220=int rtw89_fw_h2c_macid_pause(struct rtw89_dev rtwdev, u8 sh, u8 grp,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5238-\ndrivers/net/wireless/realtek/rtw89/fw.c:5239:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5240-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5282=int rtw89_fw_h2c_set_edca(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5287-\ndrivers/net/wireless/realtek/rtw89/fw.c:5288:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_EDCA_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-5289-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5319=int rtw89_fw_h2c_tsf32_toggle(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5327-\ndrivers/net/wireless/realtek/rtw89/fw.c:5328:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_TSF32_TOGL_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-5329-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5360=int rtw89_fw_h2c_set_ofld_cfg(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5365-\ndrivers/net/wireless/realtek/rtw89/fw.c:5366:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_OFLD_CFG_LEN);\ndrivers/net/wireless/realtek/rtw89/fw.c-5367-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5391=int rtw89_fw_h2c_tx_duty(struct rtw89_dev rtwdev, u8 lv)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5398-\ndrivers/net/wireless/realtek/rtw89/fw.c:5399:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5400-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5437=int rtw89_fw_h2c_set_bcn_fltr_cfg(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5466-\ndrivers/net/wireless/realtek/rtw89/fw.c:5467:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5468-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5512=int rtw89_fw_h2c_rssi_offload(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5526-\ndrivers/net/wireless/realtek/rtw89/fw.c:5527:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5528-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5558=int rtw89_fw_h2c_tp_offload(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5569-\ndrivers/net/wireless/realtek/rtw89/fw.c:5570:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5571-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5600=int rtw89_fw_h2c_ra(struct rtw89_dev rtwdev, struct rtw89_ra_info ra, bool csi)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5617-\ndrivers/net/wireless/realtek/rtw89/fw.c:5618:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5619-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5691=int rtw89_fw_h2c_tx_history(struct rtw89_dev rtwdev, u16 mac_id)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5702-\ndrivers/net/wireless/realtek/rtw89/fw.c:5703:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5704-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5734=int rtw89_fw_h2c_phy_ch_rpt(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5744-\ndrivers/net/wireless/realtek/rtw89/fw.c:5745:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5746-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5773=int rtw89_fw_h2c_drv_ctrl_fw(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5783-\ndrivers/net/wireless/realtek/rtw89/fw.c:5784:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5785-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5812=int rtw89_fw_h2c_cxdrv_init(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5823-\ndrivers/net/wireless/realtek/rtw89/fw.c:5824:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5825-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5879=int rtw89_fw_h2c_cxdrv_init_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5890-\ndrivers/net/wireless/realtek/rtw89/fw.c:5891:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5892-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5946=int rtw89_fw_h2c_cxdrv_init_v10(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5957-\ndrivers/net/wireless/realtek/rtw89/fw.c:5958:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-5959-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6018=int rtw89_fw_h2c_cxdrv_init_v11(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6027-\ndrivers/net/wireless/realtek/rtw89/fw.c:6028:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6029-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6098=int rtw89_fw_h2c_cxdrv_role(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6114-\ndrivers/net/wireless/realtek/rtw89/fw.c:6115:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6116-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6180=int rtw89_fw_h2c_cxdrv_role_v1(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6195-\ndrivers/net/wireless/realtek/rtw89/fw.c:6196:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6197-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6269=int rtw89_fw_h2c_cxdrv_role_v101(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6280-\ndrivers/net/wireless/realtek/rtw89/fw.c:6281:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6282-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6354=int rtw89_fw_h2c_cxdrv_role_v2(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6369-\ndrivers/net/wireless/realtek/rtw89/fw.c:6370:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6371-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6439=int rtw89_fw_h2c_cxdrv_role_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6449-\ndrivers/net/wireless/realtek/rtw89/fw.c:6450:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6451-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6510=int rtw89_fw_h2c_cxdrv_role_v8(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6520-\ndrivers/net/wireless/realtek/rtw89/fw.c:6521:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6522-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6584=int rtw89_fw_h2c_cxdrv_role_v10(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6594-\ndrivers/net/wireless/realtek/rtw89/fw.c:6595:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6596-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6661=int rtw89_fw_h2c_cxdrv_mlo_v2(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6668-\ndrivers/net/wireless/realtek/rtw89/fw.c:6669:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6670-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6719=int rtw89_fw_h2c_cxdrv_osi_info(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6728-\ndrivers/net/wireless/realtek/rtw89/fw.c:6729:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6730-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6786=int rtw89_fw_h2c_cxdrv_osi_info_v6(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6795-\ndrivers/net/wireless/realtek/rtw89/fw.c:6796:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6797-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6859=int rtw89_fw_h2c_cxdrv_ctrl(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6867-\ndrivers/net/wireless/realtek/rtw89/fw.c:6868:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_CXDRVINFO_CTRL);\ndrivers/net/wireless/realtek/rtw89/fw.c-6869-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6903=int rtw89_fw_h2c_cxdrv_ctrl_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6911-\ndrivers/net/wireless/realtek/rtw89/fw.c:6912:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6913-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6945=int rtw89_fw_h2c_cxdrv_ctrl_v9(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6954-\ndrivers/net/wireless/realtek/rtw89/fw.c:6955:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-6956-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7034=int rtw89_fw_h2c_cxdrv_trx_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7044-\ndrivers/net/wireless/realtek/rtw89/fw.c:7045:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7046-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7094=int rtw89_fw_h2c_cxdrv_trx_v9(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7105-\ndrivers/net/wireless/realtek/rtw89/fw.c:7106:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7107-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7161=int rtw89_fw_h2c_cxdrv_trx_v107(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7171-\ndrivers/net/wireless/realtek/rtw89/fw.c:7172:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7173-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7220=int rtw89_fw_h2c_cxdrv_rfk(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7228-\ndrivers/net/wireless/realtek/rtw89/fw.c:7229:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_CXDRVINFO_RFK);\ndrivers/net/wireless/realtek/rtw89/fw.c-7230-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7264=int rtw89_fw_h2c_cxtxpwr_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7273-\ndrivers/net/wireless/realtek/rtw89/fw.c:7274:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7275-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7304=int rtw89_fw_h2c_cxtxpwr_v9(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7313-\ndrivers/net/wireless/realtek/rtw89/fw.c:7314:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7315-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7349=int rtw89_fw_h2c_del_pkt_offload(struct rtw89_dev rtwdev, u8 id)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7356-\ndrivers/net/wireless/realtek/rtw89/fw.c:7357:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_PKT_OFLD);\ndrivers/net/wireless/realtek/rtw89/fw.c-7358-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7387=static int __rtw89_fw_h2c_add_pkt_offload(struct rtw89_dev rtwdev, u8 id,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7403-\ndrivers/net/wireless/realtek/rtw89/fw.c:7404:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, H2C_LEN_PKT_OFLD + skb_ofld-\u003elen);\ndrivers/net/wireless/realtek/rtw89/fw.c-7405-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7458=int rtw89_fw_h2c_scan_list_offload_ax(struct rtw89_dev rtwdev, int ch_num,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7473-\tskb_len = struct_size(h2c, elem, ch_num);\ndrivers/net/wireless/realtek/rtw89/fw.c:7474:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, skb_len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7475-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7535=int rtw89_fw_h2c_scan_list_offload_be(struct rtw89_dev rtwdev, int ch_num,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7552-\tskb_len = struct_size(h2c, elem, ch_num);\ndrivers/net/wireless/realtek/rtw89/fw.c:7553:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, skb_len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7554-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7649=int rtw89_fw_h2c_scan_offload_ax(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7664-\ndrivers/net/wireless/realtek/rtw89/fw.c:7665:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7666-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7787=int rtw89_fw_h2c_scan_offload_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7844-\ndrivers/net/wireless/realtek/rtw89/fw.c:7845:\tskb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len);\ndrivers/net/wireless/realtek/rtw89/fw.c-7846-\tif (!skb) {\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=8043=int rtw89_fw_h2c_trx_protect(struct rtw89_dev *rtwdev,\n--\n\n" }
47/3	2026/08/26 06:51	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 51478 output: 38 thoughts: 61 Thoughts: Okay, here's my interpretation of those thoughts, presented as a first-person expert summary: Digging into H2C Memory Allocation Right, so `rtw89_fw_h2c_alloc_skb_with_hdr`... that thing is everywhere in this codebase. It's clearly a fundamental function for allocating those Host-to-Controller (H2C) command buffers. I need to understand what's happening at a foundational level. The critical question here is whether this function itself is handling any memory initialization. Is it zeroing out the buffer, setting up headers, or leaving that responsibility to the callers? I need to meticulously examine `rtw89_fw_h2c_alloc_skb_with_hdr` directly. That's the key to understanding the potential for unexpected behavior, or even critical security flaws if data isn't properly handled.
48/3	2026/08/26 06:51	tool	grepper	0m Args: { "Expression": "struct sk_buff \\rtw89_fw_h2c_alloc_skb_with_hdr" } Results:* { "Output": "drivers/net/wireless/realtek/rtw89/fw.c=77=static struct sk_buff rtw89_fw_h2c_alloc_skb(struct rtw89_dev rtwdev, u32 len,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-95-\ndrivers/net/wireless/realtek/rtw89/fw.c:96:struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len)\ndrivers/net/wireless/realtek/rtw89/fw.c-97-{\n--\ndrivers/net/wireless/realtek/rtw89/fw.h=5577=int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev);\ndrivers/net/wireless/realtek/rtw89/fw.h:5578:struct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len);\ndrivers/net/wireless/realtek/rtw89/fw.h-5579-struct sk_buff rtw89_fw_h2c_alloc_skb_no_hdr(struct rtw89_dev *rtwdev, u32 len);\n" }
49/3	2026/08/26 06:51	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 52146 output: 44 thoughts: 45 Thoughts: Okay, let's dive into this. I'm going to pull up `rtw89_fw_h2c_alloc_skb_with_hdr` within the `drivers/net/wireless/realtek/rtw89/fw.c` file. I'm keen to understand how this particular function handles the allocation of SKBs, specifically with a header, within the Realtek wireless driver framework. This suggests an interesting point of analysis. I need to see how the driver manages its communication with the firmware in regards to these SKBs. This is going to give me some insight into their H2C (Host to Controller) communication mechanisms, and ultimately the efficiency of their data transfer.
50/3	2026/08/26 06:51	tool	read-file	0m Args: { "File": "drivers/net/wireless/realtek/rtw89/fw.c", "FirstLine": 77, "LineCount": 30 } Results: { "Contents": " 77:\tstatic struct sk_buff rtw89_fw_h2c_alloc_skb(struct rtw89_dev rtwdev, u32 len,\n 78:\t\t\t\t\t\t bool header)\n 79:\t{\n 80:\t\tstruct sk_buff skb;\n 81:\t\tu32 header_len = 0;\n 82:\t\tu32 h2c_desc_size = rtwdev-\u003echip-\u003eh2c_desc_size;\n 83:\t\n 84:\t\tif (header)\n 85:\t\t\theader_len = H2C_HEADER_LEN;\n 86:\t\n 87:\t\tskb = dev_alloc_skb(len + header_len + h2c_desc_size);\n 88:\t\tif (!skb)\n 89:\t\t\treturn NULL;\n 90:\t\tskb_reserve(skb, header_len + h2c_desc_size);\n 91:\t\tmemset(skb-\u003edata, 0, len);\n 92:\t\n 93:\t\treturn skb;\n 94:\t}\n 95:\t\n 96:\tstruct sk_buff rtw89_fw_h2c_alloc_skb_with_hdr(struct rtw89_dev rtwdev, u32 len)\n 97:\t{\n 98:\t\treturn rtw89_fw_h2c_alloc_skb(rtwdev, len, true);\n 99:\t}\n 100:\t\n 101:\tstruct sk_buff rtw89_fw_h2c_alloc_skb_no_hdr(struct rtw89_dev rtwdev, u32 len)\n 102:\t{\n 103:\t\treturn rtw89_fw_h2c_alloc_skb(rtwdev, len, false);\n 104:\t}\n 105:\t\n 106:\tint rtw89_fw_check_rdy(struct rtw89_dev rtwdev, enum rtw89_fwdl_check_type type)\n" }
51/3	2026/08/26 06:51	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 52934 output: 20 thoughts: 1261 Thoughts: Uninitialized Memory Inspection Okay, let's break this down systematically. First, `rtw89_fw_h2c_alloc_skb` uses `memset(skb->data, 0, len)`. That's good; it means the allocated `skb` is zeroed. Then, looking at `rtw89_fw_h2c_phy_rfe_type`, after the allocation, `skb_put` is called and the `h2c` struct is populated. ```c skb = rtw89_fw_h2c_alloc_skb_with_hdr(rtwdev, len); if (!skb) { rtw89_err(rtwdev, "failed to alloc skb for h2c phy_rfe_type\n"); return -ENOMEM; } skb_put(skb, len); h2c = (struct rtw89_h2c_phy_rfe_type )skb->data; h2c->rfe_type = efuse->rfe_type; ``` Since the data buffer `skb->data` was zeroed, and `len` bytes were allocated, the `h2c->rsvd` fields are necessarily zeroed as well. This eliminates the possibility of any uninitialized memory leaks there. Now, let's double-check the structure definition: ```c struct rtw89_h2c_phy_rfe_type { u8 rfe_type; u8 rsvd[3]; } __packed; ``` `len` is set to `sizeof(h2c)`, which is 4 bytes. `memset(skb->data, 0, 4)` is called. Then `skb_put(skb, 4)` advances the `tail` pointer by 4 bytes. Next `h2c->rfe_type` is assigned and the remaining three bytes `h2c->rsvd` remain zero. Still no uninitialized memory problems in that specific function. Alright, moving on to `rtw89_phy_c2h_rfk_rpt_log`. Let's see what's happening in there. ```c @@ -3574,6 +3575,8 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev, "[IQK] iqk->fwk_status = %x\n", iqk->fwk_status); for (i = 0; i < 2; i++) { + struct rtw89_iqk_info iqk_info = &rtwdev->iqk; + rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] ======== Path %x ========\n", i); rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->iqk_band[%d] = %x\n", @@ -3592,6 +3595,9 @@ static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev *rtwdev, i, iqk->iqk_tx_fail[i]); rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->iqk_rx_fail[%d] = %x\n", i, iqk->iqk_rx_fail[i]); + + iqk_info->iqk_rx_fail[0][i] = iqk->iqk_rx_fail[i]; + for (j = 0; j < 6; j++) rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK] iqk->rftxgain[%d][%d] = %x\n", ``` This code snippet is taking a value read from a C2H event and assigning it into `iqk_info->iqk_rx_fail[0][i]`. Let's see where that's subsequently used: ```c +static void __rtw892
52/3	2026/08/26 06:51	tool	grepper	0m Args: { "Expression": "iqk_rx_fail" } Results: { "Output": "drivers/net/wireless/realtek/rtw89/core.h=6665=struct rtw89_iqk_info {\n--\ndrivers/net/wireless/realtek/rtw89/core.h-6669-\tbool iqk_tx_fail[RTW89_IQK_CHS_NR][RTW89_IQK_PATH_NR];\ndrivers/net/wireless/realtek/rtw89/core.h:6670:\tbool iqk_rx_fail[RTW89_IQK_CHS_NR][RTW89_IQK_PATH_NR];\ndrivers/net/wireless/realtek/rtw89/core.h-6671-\tu32 iqk_fail_cnt;\n--\ndrivers/net/wireless/realtek/rtw89/fw.h=5179=struct rtw89_c2h_rf_iqk_rpt_log {\ndrivers/net/wireless/realtek/rtw89/fw.h-5180-\tbool iqk_tx_fail[2];\ndrivers/net/wireless/realtek/rtw89/fw.h:5181:\tbool iqk_rx_fail[2];\ndrivers/net/wireless/realtek/rtw89/fw.h-5182-\tbool is_iqk_init;\n--\ndrivers/net/wireless/realtek/rtw89/phy.c=3524=static void rtw89_phy_c2h_rfk_rpt_log(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/phy.c-3595-\t\t\t\t i, iqk-\u003eiqk_tx_fail[i]);\ndrivers/net/wireless/realtek/rtw89/phy.c:3596:\t\t\trtw89_debug(rtwdev, RTW89_DBG_RFK, \"[IQK] iqk-\u003eiqk_rx_fail[%d] = %x\\n\",\ndrivers/net/wireless/realtek/rtw89/phy.c:3597:\t\t\t\t i, iqk-\u003eiqk_rx_fail[i]);\ndrivers/net/wireless/realtek/rtw89/phy.c-3598-\ndrivers/net/wireless/realtek/rtw89/phy.c:3599:\t\t\tiqk_info-\u003eiqk_rx_fail[0][i] = iqk-\u003eiqk_rx_fail[i];\ndrivers/net/wireless/realtek/rtw89/phy.c-3600-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c=1500=static void _iqk_by_path(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1541-\t\tif (iqk_info-\u003eiqk_band[path] == RTW89_BAND_2G)\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c:1542:\t\t\tiqk_info-\u003eiqk_rx_fail[0][path] =\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1543-\t\t\t\t_iqk_2g_nbrxk(rtwdev, phy_idx, path);\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1544-\t\telse\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c:1545:\t\t\tiqk_info-\u003eiqk_rx_fail[0][path] =\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1546-\t\t\t\t_iqk_5g_nbrxk(rtwdev, phy_idx, path);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1548-\t\tif (iqk_info-\u003eiqk_band[path] == RTW89_BAND_2G)\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c:1549:\t\t\tiqk_info-\u003eiqk_rx_fail[0][path] =\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1550-\t\t\t\t_rxk_2g_group_sel(rtwdev, phy_idx, path);\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1551-\t\telse\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c:1552:\t\t\tiqk_info-\u003eiqk_rx_fail[0][path] =\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1553-\t\t\t\t_rxk_5g_group_sel(rtwdev, phy_idx, path);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c=1697=static void _iqk_init(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1720-\t\t\tiqk_info-\u003eiqk_tx_fail[idx][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c:1721:\t\t\tiqk_info-\u003eiqk_rx_fail[idx][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c-1722-\t\t\tiqk_info-\u003eiqk_table_idx[path] = 0x0;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c=1287=static void _iqk_info_iqk(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1302-\trtw89_debug(rtwdev, RTW89_DBG_RFK, \"[IQK]S%d_RXIQK_fail= %d,\\n\", path,\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:1303:\t\t iqk_info-\u003eiqk_rx_fail[0][path]);\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1304-\tflag = iqk_info-\u003elok_cor_fail[0][path];\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1309-\trtw89_phy_write32_mask(rtwdev, R_IQKINF, BIT(2) \u003c\u003c (path * 4), flag);\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:1310:\tflag = iqk_info-\u003eiqk_rx_fail[0][path];\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1311-\trtw89_phy_write32_mask(rtwdev, R_IQKINF, BIT(3) \u003c\u003c (path * 4), flag);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c=1331=void _iqk_by_path(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx, u8 path,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1357-\tif (iqk_info-\u003eis_nbiqk \|\| rtwdev-\u003edbcc_en \|\| iqk_info-\u003eiqk_band[path] == RTW89_BAND_2G)\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:1358:\t\tiqk_info-\u003eiqk_rx_fail[0][path] = _iqk_nbrxk(rtwdev, phy_idx, path,\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1359-\t\t\t\t\t\t\t chanctx_idx);\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1360-\telse\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:1361:\t\tiqk_info-\u003eiqk_rx_fail[0][path] = _rxk_group_sel(rtwdev, phy_idx, path,\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1362-\t\t\t\t\t\t\t\tchanctx_idx);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c=1592=static void _iqk_init(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1615-\t\t\tiqk_info-\u003eiqk_tx_fail[ch][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c:1616:\t\t\tiqk_info-\u003eiqk_rx_fail[ch][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852a_rfk.c-1617-\t\t\tiqk_info-\u003eiqk_mcc_ch[ch][path] = 0x0;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c=1316=static void _iqk_info_iqk(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx, u8 path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1327-\trtw89_phy_write32_mask(rtwdev, R_IQKINF, B_IQKINF_FTX \u003c\u003c (path 4), flag);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c:1328:\tflag = iqk_info-\u003eiqk_rx_fail[0][path];\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1329-\trtw89_phy_write32_mask(rtwdev, R_IQKINF, B_IQKINF_F_RX \u003c\u003c (path * 4), flag);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c=1347=static void _iqk_by_path(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx, u8 path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1378-\tif (iqk_info-\u003eis_nbiqk)\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c:1379:\t\tiqk_info-\u003eiqk_rx_fail[0][path] = _iqk_nbrxk(rtwdev, phy_idx, path);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1380-\telse\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c:1381:\t\tiqk_info-\u003eiqk_rx_fail[0][path] = _rxk_group_sel(rtwdev, phy_idx, path);\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1382-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c=1538=static void _iqk_init(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1561-\t\t\tiqk_info-\u003eiqk_tx_fail[idx][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c:1562:\t\t\tiqk_info-\u003eiqk_rx_fail[idx][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c-1563-\t\t\tiqk_info-\u003eiqk_mcc_ch[idx][path] = 0x0;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852bt_rfk.c=1686=static void _iqk_init(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852bt_rfk.c-1710-\t\t\tiqk_info-\u003eiqk_tx_fail[idx][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852bt_rfk.c:1711:\t\t\tiqk_info-\u003eiqk_rx_fail[idx][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852bt_rfk.c-1712-\t\t\tiqk_info-\u003eiqk_mcc_ch[idx][path] = 0x0;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c=1260=static void _iqk_info_iqk(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1275-\trtw89_debug(rtwdev, RTW89_DBG_RFK, \"[IQK]S%d_RXIQK_fail= %d,\\n\", path,\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c:1276:\t\t iqk_info-\u003eiqk_rx_fail[0][path]);\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1277-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1283-\trtw89_phy_write32_mask(rtwdev, R_IQKINF, B_IQKINF_FTX \u003c\u003c (path * 4), flag);\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c:1284:\tflag = iqk_info-\u003eiqk_rx_fail[0][path];\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1285-\trtw89_phy_write32_mask(rtwdev, R_IQKINF, B_IQKINF_F_RX \u003c\u003c (path * 4), flag);\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c=1304=static void _iqk_by_path(struct rtw89_dev rtwdev, enum rtw89_phy_idx phy_idx, u8 path)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1317-\tif (iqk_info-\u003eis_nbiqk)\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c:1318:\t\tiqk_info-\u003eiqk_rx_fail[0][path] = _iqk_nbrxk(rtwdev, phy_idx, path);\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1319-\telse\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c:1320:\t\tiqk_info-\u003eiqk_rx_fail[0][path] = _rxk_group_sel(rtwdev, phy_idx, path);\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1321-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c=1490=static void _iqk_init(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1513-\t\t\tiqk_info-\u003eiqk_tx_fail[ch][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c:1514:\t\t\tiqk_info-\u003eiqk_rx_fail[ch][path] = false;\ndrivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c-1515-\t\t\tiqk_info-\u003eiqk_mcc_ch[ch][path] = 0x0;\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c=2895=static void __rtw8922d_rxiqk_enable(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2901-\tfor (path = RF_PATH_A; path \u003c= RF_PATH_B; path++) {\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c:2902:\t\tif (iqk_info-\u003eiqk_rx_fail[0][path])\ndrivers/net/wireless/realtek/rtw89/rtw8922d.c-2903-\t\t\tcontinue;\n" }
53/3	2026/08/26 06:51	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 60094 output: 28 thoughts: 2924 Thoughts: Analyzing Potential Data Races and Uninitialized Memory Accesses Okay, let's break this down systematically. My initial concern was about potential data races or uninitialized memory, particularly related to the `iqk_info` structure and data passed to the firmware via H2C commands. First, I confirmed that `iqk_info->iqk_rx_fail` is properly initialized to 0 in `_iqk_init` and that `iqk_info` itself is allocated and zeroed using `devm_kzalloc`. This eliminates a possible race or uninitialized read. Next, I looked into the functions called by `rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan`. These primarily read from `rtwdev->phy_info.bb_wrap_data`. The `bb_wrap_data` is initialized in `rtw8922d_data_setup` based on the chip's revision and RFE type. The data source, which is one of the `rtw8922d_bb_wrap_data__default` structs, are statically defined and, therefore, initialized at compile time. This means there's no risk of reading uninitialized memory there. I then examined `rtw89_phy_trig_spect_tx_shape_disabled`. This function has a guard that returns if `d` is NULL. Furthermore, if the code reaches the write operation, it only writes constants to registers. So this is safe. I briefly considered `rtw89_for_each_active_rtwvif` and `rtw89_chanctx_paused`, but these just iterate over lists and check boolean state flags. They aren't writing any data or allocating memory, so they are not an area of concern. `rtw89_vif_type_mapping` only assigns enum values, so there is no issue here. `rtw89_core_register_hw` is similarly safe because it adds a bit to `interface_modes`. Finally, I got to `rtw89_fw_h2c_phy_rfe_type`. This looked more interesting because it involves allocating an `sk_buff` and passing a structure to the firmware. The `skb` is allocated via `rtw89_fw_h2c_alloc_skb` which uses `dev_alloc_skb` and `memset(skb->data, 0, len)` to zero out the data section. The structure `h2c` is then initialized and sent via the firmware. After a careful inspection of how `skb_put` and `skb_push` manipulate the data pointers, I was able to confirm that the relevant data section is* zeroed and that the `h2c` struct members are properly populated, including the part that is reserved. This confirms that all data written to the `skb` is initialized before being sent.
54/3	2026/08/26 06:52	tool	grepper	0m Args: { "Expression": "rtw89_h2c_pkt_set_hdr" } Results: { "Output": "\nFull output is too long, showing 500 out of 803 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtw89/cam.c=52=static int rtw89_cam_send_sec_key_cmd(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/cam.c-63-\ndrivers/net/wireless/realtek/rtw89/cam.c:64:\trtw89_h2c_pkt_set_hdr(rtwdev, skb,\ndrivers/net/wireless/realtek/rtw89/cam.c-65-\t\t\t FWCMD_TYPE_H2C,\n--\ndrivers/net/wireless/realtek/rtw89/cam.c-85-\ndrivers/net/wireless/realtek/rtw89/cam.c:86:\trtw89_h2c_pkt_set_hdr(rtwdev, ext_skb,\ndrivers/net/wireless/realtek/rtw89/cam.c-87-\t\t\t FWCMD_TYPE_H2C,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=1560=int rtw89_fw_recognize_elements(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-1631-\ndrivers/net/wireless/realtek/rtw89/fw.c:1632:void rtw89_h2c_pkt_set_hdr(struct rtw89_dev rtwdev, struct sk_buff skb,\ndrivers/net/wireless/realtek/rtw89/fw.c-1633-\t\t\t u8 type, u8 cat, u8 class, u8 func,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-1656-\ndrivers/net/wireless/realtek/rtw89/fw.c:1657:static void rtw89_h2c_pkt_set_hdr_fwdl(struct rtw89_dev rtwdev,\ndrivers/net/wireless/realtek/rtw89/fw.c-1658-\t\t\t\t struct sk_buff skb,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=1729=static int __rtw89_fw_download_hdr(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-1767-\ndrivers/net/wireless/realtek/rtw89/fw.c:1768:\trtw89_h2c_pkt_set_hdr_fwdl(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-1769-\t\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FWDL,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2290=int rtw89_fw_h2c_cam(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2326-hdr:\ndrivers/net/wireless/realtek/rtw89/fw.c:2327:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2328-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2346=int rtw89_fw_h2c_dctl_sec_cam_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2364-\ndrivers/net/wireless/realtek/rtw89/fw.c:2365:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2366-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2385=int rtw89_fw_h2c_dctl_sec_cam_v2(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2403-\ndrivers/net/wireless/realtek/rtw89/fw.c:2404:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2405-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2424=int rtw89_fw_h2c_dctl_sec_cam_v3(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2442-\ndrivers/net/wireless/realtek/rtw89/fw.c:2443:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2444-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2463=int rtw89_fw_h2c_default_dmac_tbl_v2(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2497-\ndrivers/net/wireless/realtek/rtw89/fw.c:2498:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2499-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2518=int rtw89_fw_h2c_default_dmac_tbl_v3(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2553-\ndrivers/net/wireless/realtek/rtw89/fw.c:2554:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2555-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2574=int rtw89_fw_h2c_ba_cam(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2633-end:\ndrivers/net/wireless/realtek/rtw89/fw.c:2634:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2635-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2654=static int rtw89_fw_h2c_init_ba_cam_v0_ext(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2675-\ndrivers/net/wireless/realtek/rtw89/fw.c:2676:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2677-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2709=int rtw89_fw_h2c_ba_cam_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2767-\ndrivers/net/wireless/realtek/rtw89/fw.c:2768:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2769-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2788=int rtw89_fw_h2c_init_ba_cam_users(struct rtw89_dev rtwdev, u8 users,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2807-\ndrivers/net/wireless/realtek/rtw89/fw.c:2808:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2809-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=2828=int rtw89_fw_h2c_fw_log(struct rtw89_dev rtwdev, bool enable)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-2850-\ndrivers/net/wireless/realtek/rtw89/fw.c:2851:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-2852-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3114=int rtw89_fw_h2c_general_pkt(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3142-\ndrivers/net/wireless/realtek/rtw89/fw.c:3143:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3144-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3163=int rtw89_fw_h2c_lps_parm(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3192-\ndrivers/net/wireless/realtek/rtw89/fw.c:3193:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3194-\t\t\t H2C_CAT_MAC,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3212=int rtw89_fw_h2c_lps_ch_info(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3258-\ndrivers/net/wireless/realtek/rtw89/fw.c:3259:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3260-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3282=int rtw89_fw_h2c_lps_ml_cmn_info(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3359-\ndrivers/net/wireless/realtek/rtw89/fw.c:3360:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3361-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3454=int rtw89_fw_h2c_lps_ml_cmn_info_v1(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3514-\ndrivers/net/wireless/realtek/rtw89/fw.c:3515:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3516-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3538=int rtw89_fw_h2c_phy_rfe_type(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3559-\ndrivers/net/wireless/realtek/rtw89/fw.c:3560:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3561-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_DM,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3579=int rtw89_fw_h2c_p2p_act(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3610-\ndrivers/net/wireless/realtek/rtw89/fw.c:3611:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3612-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_PS,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3653=int rtw89_fw_h2c_default_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3683-\ndrivers/net/wireless/realtek/rtw89/fw.c:3684:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3685-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3703=int rtw89_fw_h2c_default_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3768-\ndrivers/net/wireless/realtek/rtw89/fw.c:3769:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3770-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3788=int rtw89_fw_h2c_default_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3854-\ndrivers/net/wireless/realtek/rtw89/fw.c:3855:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-3856-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=3929=int rtw89_fw_h2c_assoc_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-3998-\ndrivers/net/wireless/realtek/rtw89/fw.c:3999:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4000-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4076=int rtw89_fw_h2c_assoc_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4184-\ndrivers/net/wireless/realtek/rtw89/fw.c:4185:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4186-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4204=int rtw89_fw_h2c_assoc_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4312-\ndrivers/net/wireless/realtek/rtw89/fw.c:4313:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4314-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4332=int rtw89_fw_h2c_ampdu_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4378-\ndrivers/net/wireless/realtek/rtw89/fw.c:4379:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4380-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4398=int rtw89_fw_h2c_ampdu_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4444-\ndrivers/net/wireless/realtek/rtw89/fw.c:4445:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4446-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4464=int rtw89_fw_h2c_txtime_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4487-\ndrivers/net/wireless/realtek/rtw89/fw.c:4488:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4489-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4507=int rtw89_fw_h2c_txtime_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4541-\ndrivers/net/wireless/realtek/rtw89/fw.c:4542:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4543-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4561=int rtw89_fw_h2c_txtime_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4595-\ndrivers/net/wireless/realtek/rtw89/fw.c:4596:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4597-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4615=int rtw89_fw_h2c_punctured_cmac_tbl_g7(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4638-\ndrivers/net/wireless/realtek/rtw89/fw.c:4639:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4640-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4658=int rtw89_fw_h2c_punctured_cmac_tbl_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4680-\ndrivers/net/wireless/realtek/rtw89/fw.c:4681:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4682-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4700=int rtw89_fw_h2c_txpath_cmac_tbl(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4720-\ndrivers/net/wireless/realtek/rtw89/fw.c:4721:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4722-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4739=int rtw89_fw_h2c_update_beacon(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4802-\ndrivers/net/wireless/realtek/rtw89/fw.c:4803:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4804-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4819=int rtw89_fw_h2c_update_beacon_be(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4881-\ndrivers/net/wireless/realtek/rtw89/fw.c:4882:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4883-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FR_EXCHG,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4902=int rtw89_fw_h2c_tbtt_tuning(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4921-\ndrivers/net/wireless/realtek/rtw89/fw.c:4922:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4923-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_PS,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4940=int rtw89_fw_h2c_pwr_lvl(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-4970-\ndrivers/net/wireless/realtek/rtw89/fw.c:4971:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-4972-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_PS,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=4989=int rtw89_fw_h2c_role_maintain(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5026-\ndrivers/net/wireless/realtek/rtw89/fw.c:5027:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5028-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5085=int rtw89_fw_h2c_join_info(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5166-done:\ndrivers/net/wireless/realtek/rtw89/fw.c:5167:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5168-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5185=int rtw89_fw_h2c_notify_dbcc(struct rtw89_dev rtwdev, bool en)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5201-\ndrivers/net/wireless/realtek/rtw89/fw.c:5202:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5203-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_MEDIA_RPT,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5220=int rtw89_fw_h2c_macid_pause(struct rtw89_dev rtwdev, u8 sh, u8 grp,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5262-\ndrivers/net/wireless/realtek/rtw89/fw.c:5263:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5264-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5282=int rtw89_fw_h2c_set_edca(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5299-\ndrivers/net/wireless/realtek/rtw89/fw.c:5300:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5301-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5319=int rtw89_fw_h2c_tsf32_toggle(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5340-\ndrivers/net/wireless/realtek/rtw89/fw.c:5341:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5342-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5360=int rtw89_fw_h2c_set_ofld_cfg(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5372-\ndrivers/net/wireless/realtek/rtw89/fw.c:5373:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5374-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5391=int rtw89_fw_h2c_tx_duty(struct rtw89_dev rtwdev, u8 lv)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5419-\ndrivers/net/wireless/realtek/rtw89/fw.c:5420:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5421-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5437=int rtw89_fw_h2c_set_bcn_fltr_cfg(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5494-\ndrivers/net/wireless/realtek/rtw89/fw.c:5495:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5496-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5512=int rtw89_fw_h2c_rssi_offload(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5540-\ndrivers/net/wireless/realtek/rtw89/fw.c:5541:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5542-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5558=int rtw89_fw_h2c_tp_offload(struct rtw89_dev rtwdev, struct rtw89_vif_link rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5582-\ndrivers/net/wireless/realtek/rtw89/fw.c:5583:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5584-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5600=int rtw89_fw_h2c_ra(struct rtw89_dev rtwdev, struct rtw89_ra_info ra, bool csi)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5672-done:\ndrivers/net/wireless/realtek/rtw89/fw.c:5673:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5674-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RA,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5691=int rtw89_fw_h2c_tx_history(struct rtw89_dev rtwdev, u16 mac_id)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5714-\ndrivers/net/wireless/realtek/rtw89/fw.c:5715:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5716-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RA,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5734=int rtw89_fw_h2c_phy_ch_rpt(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5755-\ndrivers/net/wireless/realtek/rtw89/fw.c:5756:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5757-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RA,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5773=int rtw89_fw_h2c_drv_ctrl_fw(struct rtw89_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5794-\ndrivers/net/wireless/realtek/rtw89/fw.c:5795:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5796-\t\t\t H2C_CAT_OUTSRC, H2C_CL_OUTSRC_RA,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5812=int rtw89_fw_h2c_cxdrv_init(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5860-\ndrivers/net/wireless/realtek/rtw89/fw.c:5861:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5862-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5879=int rtw89_fw_h2c_cxdrv_init_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5927-\ndrivers/net/wireless/realtek/rtw89/fw.c:5928:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-5929-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=5946=int rtw89_fw_h2c_cxdrv_init_v10(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-5999-\ndrivers/net/wireless/realtek/rtw89/fw.c:6000:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6001-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6018=int rtw89_fw_h2c_cxdrv_init_v11(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6074-\ndrivers/net/wireless/realtek/rtw89/fw.c:6075:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6076-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6098=int rtw89_fw_h2c_cxdrv_role(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6158-\ndrivers/net/wireless/realtek/rtw89/fw.c:6159:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6160-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6180=int rtw89_fw_h2c_cxdrv_role_v1(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6250-\ndrivers/net/wireless/realtek/rtw89/fw.c:6251:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6252-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6269=int rtw89_fw_h2c_cxdrv_role_v101(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6332-\ndrivers/net/wireless/realtek/rtw89/fw.c:6333:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6334-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6354=int rtw89_fw_h2c_cxdrv_role_v2(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6420-\ndrivers/net/wireless/realtek/rtw89/fw.c:6421:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6422-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6439=int rtw89_fw_h2c_cxdrv_role_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6491-\ndrivers/net/wireless/realtek/rtw89/fw.c:6492:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6493-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6510=int rtw89_fw_h2c_cxdrv_role_v8(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6565-\ndrivers/net/wireless/realtek/rtw89/fw.c:6566:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6567-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6584=int rtw89_fw_h2c_cxdrv_role_v10(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6642-\ndrivers/net/wireless/realtek/rtw89/fw.c:6643:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6644-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6661=int rtw89_fw_h2c_cxdrv_mlo_v2(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6700-\ndrivers/net/wireless/realtek/rtw89/fw.c:6701:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6702-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6719=int rtw89_fw_h2c_cxdrv_osi_info(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6767-\ndrivers/net/wireless/realtek/rtw89/fw.c:6768:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6769-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6786=int rtw89_fw_h2c_cxdrv_osi_info_v6(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6839-\ndrivers/net/wireless/realtek/rtw89/fw.c:6840:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6841-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6859=int rtw89_fw_h2c_cxdrv_ctrl(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6884-\ndrivers/net/wireless/realtek/rtw89/fw.c:6885:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6886-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6903=int rtw89_fw_h2c_cxdrv_ctrl_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6927-\ndrivers/net/wireless/realtek/rtw89/fw.c:6928:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6929-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=6945=int rtw89_fw_h2c_cxdrv_ctrl_v9(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-6981-\ndrivers/net/wireless/realtek/rtw89/fw.c:6982:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-6983-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7034=int rtw89_fw_h2c_cxdrv_trx_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7076-\ndrivers/net/wireless/realtek/rtw89/fw.c:7077:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7078-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7094=int rtw89_fw_h2c_cxdrv_trx_v9(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7143-\ndrivers/net/wireless/realtek/rtw89/fw.c:7144:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7145-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7161=int rtw89_fw_h2c_cxdrv_trx_v107(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7201-\ndrivers/net/wireless/realtek/rtw89/fw.c:7202:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7203-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7220=int rtw89_fw_h2c_cxdrv_rfk(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7245-\ndrivers/net/wireless/realtek/rtw89/fw.c:7246:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7247-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7264=int rtw89_fw_h2c_cxtxpwr_v7(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7286-\ndrivers/net/wireless/realtek/rtw89/fw.c:7287:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7288-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7304=int rtw89_fw_h2c_cxtxpwr_v9(struct rtw89_dev rtwdev, u8 type)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7330-\ndrivers/net/wireless/realtek/rtw89/fw.c:7331:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7332-\t\t\t H2C_CAT_OUTSRC, BTFC_SET,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7349=int rtw89_fw_h2c_del_pkt_offload(struct rtw89_dev rtwdev, u8 id)\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7367-\ndrivers/net/wireless/realtek/rtw89/fw.c:7368:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7369-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7387=static int __rtw89_fw_h2c_add_pkt_offload(struct rtw89_dev rtwdev, u8 id,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7417-\ndrivers/net/wireless/realtek/rtw89/fw.c:7418:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7419-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7458=int rtw89_fw_h2c_scan_list_offload_ax(struct rtw89_dev rtwdev, int ch_num,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7518-\ndrivers/net/wireless/realtek/rtw89/fw.c:7519:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7520-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7535=int rtw89_fw_h2c_scan_list_offload_be(struct rtw89_dev rtwdev, int ch_num,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7633-\ndrivers/net/wireless/realtek/rtw89/fw.c:7634:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7635-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c=7649=int rtw89_fw_h2c_scan_offload_ax(struct rtw89_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/fw.c-7717-\ndrivers/net/wireless/realtek/rtw89/fw.c:7718:\trtw89_h2c_pkt_set_hdr(rtwdev, skb, FWCMD_TYPE_H2C,\ndrivers/net/wireless/realtek/rtw89/fw.c-7719-\t\t\t H2C_CAT_MAC, H2C_CL_MAC_FW_OFLD,\n--\n\n" }
55/3	2026/08/26 06:52	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 79135 output: 46 thoughts: 45 Thoughts: Here's my take on those thoughts: Analyzing the `rtw89_h2c_pkt_set_hdr` Function Okay, so I'm looking at `drivers/net/wireless/realtek/rtw89/fw.c`. I need to understand how this `rtw89_h2c_pkt_set_hdr` function works. Let's dig into that source file and see what's going on. I'm assuming it has something to do with setting up the header of a host-to-controller packet, based on the function name. This is probably a crucial part of the firmware interaction within the Realtek wireless driver. Let's see what the implementation reveals.
56/3	2026/08/26 06:52	tool	read-file	0m Args: { "File": "drivers/net/wireless/realtek/rtw89/fw.c", "FirstLine": 1632, "LineCount": 30 } Results: { "Contents": "1632:\tvoid rtw89_h2c_pkt_set_hdr(struct rtw89_dev rtwdev, struct sk_buff skb,\n1633:\t\t\t\t u8 type, u8 cat, u8 class, u8 func,\n1634:\t\t\t\t bool rack, bool dack, u32 len)\n1635:\t{\n1636:\t\tconst struct rtw89_chip_info chip = rtwdev-\u003echip;\n1637:\t\tstruct fwcmd_hdr hdr;\n1638:\t\n1639:\t\thdr = (struct fwcmd_hdr )skb_push(skb, 8);\n1640:\t\n1641:\t\tif (chip-\u003echip_gen == RTW89_CHIP_AX \u0026\u0026 !(rtwdev-\u003efw.h2c_seq % 4))\n1642:\t\t\track = true;\n1643:\t\thdr-\u003ehdr0 = cpu_to_le32(FIELD_PREP(H2C_HDR_DEL_TYPE, type) \|\n1644:\t\t\t\t\tFIELD_PREP(H2C_HDR_CAT, cat) \|\n1645:\t\t\t\t\tFIELD_PREP(H2C_HDR_CLASS, class) \|\n1646:\t\t\t\t\tFIELD_PREP(H2C_HDR_FUNC, func) \|\n1647:\t\t\t\t\tFIELD_PREP(H2C_HDR_H2C_SEQ, rtwdev-\u003efw.h2c_seq));\n1648:\t\n1649:\t\thdr-\u003ehdr1 = cpu_to_le32(FIELD_PREP(H2C_HDR_TOTAL_LEN,\n1650:\t\t\t\t\t\t len + H2C_HEADER_LEN) \|\n1651:\t\t\t\t\t(rack ? H2C_HDR_REC_ACK : 0) \|\n1652:\t\t\t\t\t(dack ? H2C_HDR_DONE_ACK : 0));\n1653:\t\n1654:\t\trtwdev-\u003efw.h2c_seq++;\n1655:\t}\n1656:\t\n1657:\tstatic void rtw89_h2c_pkt_set_hdr_fwdl(struct rtw89_dev rtwdev,\n1658:\t\t\t\t\t struct sk_buff *skb,\n1659:\t\t\t\t\t u8 type, u8 cat, u8 class, u8 func,\n1660:\t\t\t\t\t u32 len)\n1661:\t{\n" }
57/3	2026/08/26 06:52	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 80018 output: 385 thoughts: 821 Thoughts: My Assessment of the Patch's Memory Safety Okay, let's break this down. From what I see, we're using `skb_push` to add headers to the packet buffer. The allocation and initialization sequence looks solid: 1. We allocate the `skb` with `dev_alloc_skb`, accounting for payload, header, and descriptor sizes. 2. We then reserve space with `skb_reserve`. 3. Critically, the payload area is zeroed using `memset`. 4. Then, we "put" the payload using `skb_put`. 5. A pointer, `h2c`, now points to the zeroed memory, where the `rtw89_h2c_phy_rfe_type` structure will be. 6. The first byte of that structure is set with a value. 7. The `rtw89_h2c_pkt_set_hdr` function then calls `skb_push`, adding the header. 8. Finally, we get a header pointer `hdr` that points to the data area, including the header. So, the payload itself is fully initialized, with the `memset` clearing out the unused memory. No uninitialized data should be reaching the firmware. I double-checked `rtw89_h2c_phy_rfe_type` to confirm: ```c +struct rtw89_h2c_phy_rfe_type { + u8 rfe_type; + u8 rsvd[3]; +} __packed; ``` Yes, it's correct. The reserved bytes are zeroed via `memset`. Let's look at the other changes: * `rtw89_for_each_active_rtwvif` is a macro change; no memory concerns there. * `rtw89_chanctx_paused` is a boolean check; trivial. * `NL80211_IFTYPE_P2P_DEVICE` support is simple, just adding a bit and handling it in existing functions; nothing new in memory usage. * The `rtw89_phy_bb_wrap_tx_rfsi_ctrl_init_by_chan` and related functions are reading `const struct rtw89_bb_wrap_data` and writing to registers. No dynamic allocation or uninitialized memory use. * `__rtw8922d_rxiqk_disable` and `__rtw8922d_rxiqk_enable` are reading from `iqk_info` and writing to registers; also safe. * The `RTW89_QUIRK_THERMAL_PROT_VCORE` and `RTW89_QUIRK_LOW_LATENCY` are just quirks. No effect on memory initialization. I've carefully examined all the added and modified structures, and everything appears to be properly initialized. The `skb` used for H2C commands are explicitly zeroed. The `iqk_info->iqk_rx_fail` array is initialized to zero and updated from the C2H event. The `bb_wrap_data` structs are defined as `const`. Therefore, I'm confident that this patch doesn't introduce any uninitialized memory risks. KASAN and other standard memory error detectors should be sufficient to catch any memory corruption bugs like out-of-bounds access. We don't need KMSAN here. I'll set `NeedsKMSAN=false` and include this detailed reasoning in the commit message.
58/3	2026/08/26 06:52	tool	set-results	0m Args: { "KMSANReasoning": "The patch modifies the rtw89 driver to add support for P2P_DEVICE interface type, introduces new PHY BB wrap configuration logic, adds a new firmware H2C command (rtw89_fw_h2c_phy_rfe_type), and adds some quirks. \n\nA careful review of the changes shows no uninitialized memory risks:\n1. The new H2C command `rtw89_fw_h2c_phy_rfe_type` allocates an skb using `rtw89_fw_h2c_alloc_skb_with_hdr`. This function internally calls `memset(skb-\u003edata, 0, len)`, ensuring the entire payload buffer is zeroed. The code then sets the `rfe_type` field, leaving the `rsvd` padding bytes safely zeroed before sending it to the firmware.\n2. The new `iqk_info-\u003eiqk_rx_fail` array is properly initialized to false in `_iqk_init` and updated from parsed C2H events.\n3. The new `rtw89_bb_wrap_data` structures are statically defined `const` data, so they are fully initialized at compile time.\n4. Other changes involve control flow updates, macro replacements (`rtw89_for_each_active_rtwvif`), and register writes, none of which expose uninitialized stack or heap memory.\n\nAny potential out-of-bounds accesses or use-after-free bugs in the modified logic would be caught by standard KASAN. There are no uninitialized memory reads or info-leaks that would require a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false } Results: { "KMSANReasoning": "The patch modifies the rtw89 driver to add support for P2P_DEVICE interface type, introduces new PHY BB wrap configuration logic, adds a new firmware H2C command (rtw89_fw_h2c_phy_rfe_type), and adds some quirks. \n\nA careful review of the changes shows no uninitialized memory risks:\n1. The new H2C command `rtw89_fw_h2c_phy_rfe_type` allocates an skb using `rtw89_fw_h2c_alloc_skb_with_hdr`. This function internally calls `memset(skb-\u003edata, 0, len)`, ensuring the entire payload buffer is zeroed. The code then sets the `rfe_type` field, leaving the `rsvd` padding bytes safely zeroed before sending it to the firmware.\n2. The new `iqk_info-\u003eiqk_rx_fail` array is properly initialized to false in `_iqk_init` and updated from parsed C2H events.\n3. The new `rtw89_bb_wrap_data` structures are statically defined `const` data, so they are fully initialized at compile time.\n4. Other changes involve control flow updates, macro replacements (`rtw89_for_each_active_rtwvif`), and register writes, none of which expose uninitialized stack or heap memory.\n\nAny potential out-of-bounds accesses or use-after-free bugs in the modified logic would be caught by standard KASAN. There are no uninitialized memory reads or info-leaks that would require a dedicated KMSAN fuzzing session.", "NeedsKMSAN": false }

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)