<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/net/wireless/realtek, branch v6.11</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>wifi: rtlwifi: rtl8192du: Initialise value32 in _rtl92du_init_queue_reserved_page</title>
<updated>2024-08-07T17:11:36+00:00</updated>
<author>
<name>Bitterblue Smith</name>
<email>rtl8821cerfe2@gmail.com</email>
</author>
<published>2024-08-06T16:20:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f1cb9d5aefba07fc52b06b7bd5fdcd9ef91157b4'/>
<id>f1cb9d5aefba07fc52b06b7bd5fdcd9ef91157b4</id>
<content type='text'>
GCC complains:

   In file included from include/linux/ieee80211.h:21,
                    from include/net/mac80211.h:20,
                    from drivers/net/wireless/realtek/rtlwifi/rtl8192du/../wifi.h:14,
                    from drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c:4:
   In function 'u32p_replace_bits',
       inlined from '_rtl92du_init_queue_reserved_page.isra' at drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c:225:2:
&gt;&gt; include/linux/bitfield.h:189:18: warning: 'value32' is used uninitialized [-Wuninitialized]

Part of the variable is indeed left uninitialised.

Reported-by: kernel test robot &lt;lkp@intel.com&gt;
Closes: https://lore.kernel.org/oe-kbuild-all/202408062100.DWhN0CYH-lkp@intel.com/
Fixes: e769c67105d3 ("wifi: rtlwifi: Add rtl8192du/hw.{c,h}")
Signed-off-by: Bitterblue Smith &lt;rtl8821cerfe2@gmail.com&gt;
Acked-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Signed-off-by: Kalle Valo &lt;kvalo@kernel.org&gt;
Link: https://patch.msgid.link/2a808244-93d0-492c-b304-ae1974df5df9@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
GCC complains:

   In file included from include/linux/ieee80211.h:21,
                    from include/net/mac80211.h:20,
                    from drivers/net/wireless/realtek/rtlwifi/rtl8192du/../wifi.h:14,
                    from drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c:4:
   In function 'u32p_replace_bits',
       inlined from '_rtl92du_init_queue_reserved_page.isra' at drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c:225:2:
&gt;&gt; include/linux/bitfield.h:189:18: warning: 'value32' is used uninitialized [-Wuninitialized]

Part of the variable is indeed left uninitialised.

Reported-by: kernel test robot &lt;lkp@intel.com&gt;
Closes: https://lore.kernel.org/oe-kbuild-all/202408062100.DWhN0CYH-lkp@intel.com/
Fixes: e769c67105d3 ("wifi: rtlwifi: Add rtl8192du/hw.{c,h}")
Signed-off-by: Bitterblue Smith &lt;rtl8821cerfe2@gmail.com&gt;
Acked-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Signed-off-by: Kalle Valo &lt;kvalo@kernel.org&gt;
Link: https://patch.msgid.link/2a808244-93d0-492c-b304-ae1974df5df9@gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'rtw-next-2024-07-05' of https://github.com/pkshih/rtw</title>
<updated>2024-07-09T10:17:09+00:00</updated>
<author>
<name>Kalle Valo</name>
<email>kvalo@kernel.org</email>
</author>
<published>2024-07-09T10:17:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=0321e45737b8a1a7571edad9b4173fbb7b86c0ed'/>
<id>0321e45737b8a1a7571edad9b4173fbb7b86c0ed</id>
<content type='text'>
rtw-next patches for v6.11

Some cleanups of rtl8xxxu and rtlwifi, and some fixes of rtw88. The major
change is to develop WoWLAN and preparation of RTL8852BE-VT listed below:

rtw89:
  - preparation of RTL8852BE-VT
    * add RF calibration code
    * move shared code with RTL8852BE to common module
  - add WoWLAN for WiFi 6 chips
  - support 36-bit PCI DMA
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
rtw-next patches for v6.11

Some cleanups of rtl8xxxu and rtlwifi, and some fixes of rtw88. The major
change is to develop WoWLAN and preparation of RTL8852BE-VT listed below:

rtw89:
  - preparation of RTL8852BE-VT
    * add RF calibration code
    * move shared code with RTL8852BE to common module
  - add WoWLAN for WiFi 6 chips
  - support 36-bit PCI DMA
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()</title>
<updated>2024-07-05T02:03:48+00:00</updated>
<author>
<name>Aleksandr Mishin</name>
<email>amishin@t-argos.ru</email>
</author>
<published>2024-07-03T21:05:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=85099c7ce4f9e64c66aa397cd9a37473637ab891'/>
<id>85099c7ce4f9e64c66aa397cd9a37473637ab891</id>
<content type='text'>
In rtw89_sta_info_get_iter() 'status-&gt;he_gi' is compared to array size.
But then 'rate-&gt;he_gi' is used as array index instead of 'status-&gt;he_gi'.
This can lead to go beyond array boundaries in case of 'rate-&gt;he_gi' is
not equal to 'status-&gt;he_gi' and is bigger than array size. Looks like
"copy-paste" mistake.

Fix this mistake by replacing 'rate-&gt;he_gi' with 'status-&gt;he_gi'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Signed-off-by: Aleksandr Mishin &lt;amishin@t-argos.ru&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240703210510.11089-1-amishin@t-argos.ru
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In rtw89_sta_info_get_iter() 'status-&gt;he_gi' is compared to array size.
But then 'rate-&gt;he_gi' is used as array index instead of 'status-&gt;he_gi'.
This can lead to go beyond array boundaries in case of 'rate-&gt;he_gi' is
not equal to 'status-&gt;he_gi' and is bigger than array size. Looks like
"copy-paste" mistake.

Fix this mistake by replacing 'rate-&gt;he_gi' with 'status-&gt;he_gi'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Signed-off-by: Aleksandr Mishin &lt;amishin@t-argos.ru&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240703210510.11089-1-amishin@t-argos.ru
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtlwifi: fix default typo</title>
<updated>2024-07-05T01:59:46+00:00</updated>
<author>
<name>Fredrik Lönnegren</name>
<email>fredrik@frelon.se</email>
</author>
<published>2024-07-03T07:06:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=a1e7eafd12c415a6ac2a65d8ddf32569acd1ecf0'/>
<id>a1e7eafd12c415a6ac2a65d8ddf32569acd1ecf0</id>
<content type='text'>
Change 'defult' to 'default' in comments in several rtlwifi drivers.

Signed-off-by: Fredrik Lönnegren &lt;fredrik@frelon.se&gt;
Acked-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240703070627.135328-1-fredrik@frelon.se
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Change 'defult' to 'default' in comments in several rtlwifi drivers.

Signed-off-by: Fredrik Lönnegren &lt;fredrik@frelon.se&gt;
Acked-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240703070627.135328-1-fredrik@frelon.se
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw89: unify the selection logic of RFK table when MCC</title>
<updated>2024-07-05T01:51:34+00:00</updated>
<author>
<name>Zong-Zhe Yang</name>
<email>kevin_yang@realtek.com</email>
</author>
<published>2024-07-02T12:44:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=8095364696d38092f34bbd3989b1a73b180a3aaf'/>
<id>8095364696d38092f34bbd3989b1a73b180a3aaf</id>
<content type='text'>
Driver will notify FW the target index of RFK table to use at some
moments. When MCC (multi-channel concurrent), the correctness of the
notification is especially important.

We now unify the selection logic of RFK table as below among chips.
1. check each table if it matches target channel
2. check all tables if any is idle by iterating active channels
3. replace the first table if all are busy unexpectedly

Signed-off-by: Zong-Zhe Yang &lt;kevin_yang@realtek.com&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240702124452.18747-2-pkshih@realtek.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Driver will notify FW the target index of RFK table to use at some
moments. When MCC (multi-channel concurrent), the correctness of the
notification is especially important.

We now unify the selection logic of RFK table as below among chips.
1. check each table if it matches target channel
2. check all tables if any is idle by iterating active channels
3. replace the first table if all are busy unexpectedly

Signed-off-by: Zong-Zhe Yang &lt;kevin_yang@realtek.com&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240702124452.18747-2-pkshih@realtek.com
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw89: mac: parse MRC C2H failure report</title>
<updated>2024-07-05T01:50:44+00:00</updated>
<author>
<name>Zong-Zhe Yang</name>
<email>kevin_yang@realtek.com</email>
</author>
<published>2024-07-02T12:44:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=1e71be6a344628d3a6041dfcf26220ad5d66e699'/>
<id>1e71be6a344628d3a6041dfcf26220ad5d66e699</id>
<content type='text'>
MRC (multi-role concurrency) has a C2H event for status report. Newer
FW will report some kinds of failures. We parse them now and show by
debug log.

Signed-off-by: Zong-Zhe Yang &lt;kevin_yang@realtek.com&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240702124452.18747-1-pkshih@realtek.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
MRC (multi-role concurrency) has a C2H event for status report. Newer
FW will report some kinds of failures. We parse them now and show by
debug log.

Signed-off-by: Zong-Zhe Yang &lt;kevin_yang@realtek.com&gt;
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240702124452.18747-1-pkshih@realtek.com
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw89: 8852bx: add extra handles of BTC for 8852BT in 8852b_common</title>
<updated>2024-07-05T01:48:10+00:00</updated>
<author>
<name>Ping-Ke Shih</name>
<email>pkshih@realtek.com</email>
</author>
<published>2024-07-01T01:46:19+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=52bc83ad2ed5b115c33e3acc19cbf636dd2f37c9'/>
<id>52bc83ad2ed5b115c33e3acc19cbf636dd2f37c9</id>
<content type='text'>
For 8852BT, the initial settings of BT-coexistence is a little bit
different, so add the extra handles.

Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240701014619.7300-2-pkshih@realtek.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For 8852BT, the initial settings of BT-coexistence is a little bit
different, so add the extra handles.

Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240701014619.7300-2-pkshih@realtek.com
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw89: 8852bx: move BTC common code from 8852b to 8852b_common</title>
<updated>2024-07-05T01:47:57+00:00</updated>
<author>
<name>Ping-Ke Shih</name>
<email>pkshih@realtek.com</email>
</author>
<published>2024-07-01T01:46:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=0e557c5c1a61ff4d896a21b00e4e7397e3c123b5'/>
<id>0e557c5c1a61ff4d896a21b00e4e7397e3c123b5</id>
<content type='text'>
The BT coexistence part of 8852B and 8852BT are similar, so move shared
code into common module.

Don't change logic for existing RTL8852BE.

Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240701014619.7300-1-pkshih@realtek.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The BT coexistence part of 8852B and 8852BT are similar, so move shared
code into common module.

Don't change logic for existing RTL8852BE.

Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240701014619.7300-1-pkshih@realtek.com
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw88: usb: schedule rx work after everything is set up</title>
<updated>2024-07-05T01:38:18+00:00</updated>
<author>
<name>Marcin Ślusarz</name>
<email>mslusarz@renau.com</email>
</author>
<published>2024-05-28T11:02:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=adc539784c98a7cc602cbf557debfc2e7b9be8b3'/>
<id>adc539784c98a7cc602cbf557debfc2e7b9be8b3</id>
<content type='text'>
Right now it's possible to hit NULL pointer dereference in
rtw_rx_fill_rx_status on hw object and/or its fields because
initialization routine can start getting USB replies before
rtw_dev is fully setup.

The stack trace looks like this:

rtw_rx_fill_rx_status
rtw8821c_query_rx_desc
rtw_usb_rx_handler
...
queue_work
rtw_usb_read_port_complete
...
usb_submit_urb
rtw_usb_rx_resubmit
rtw_usb_init_rx
rtw_usb_probe

So while we do the async stuff rtw_usb_probe continues and calls
rtw_register_hw, which does all kinds of initialization (e.g.
via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.

Fix this by moving the first usb_submit_urb after everything
is set up.

For me, this bug manifested as:
[    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
[    8.910904] rtw_8821cu 1-1:1.2: hw-&gt;conf.chandef.chan NULL in rtw_rx_fill_rx_status
because I'm using Larry's backport of rtw88 driver with the NULL
checks in rtw_rx_fill_rx_status.

Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@mail.gmail.com/
Signed-off-by: Marcin Ślusarz &lt;mslusarz@renau.com&gt;
Cc: Tim K &lt;tpkuester@gmail.com&gt;
Cc: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Cc: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Kalle Valo &lt;kvalo@kernel.org&gt;
Cc: linux-wireless@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240528110246.477321-1-marcin.slusarz@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Right now it's possible to hit NULL pointer dereference in
rtw_rx_fill_rx_status on hw object and/or its fields because
initialization routine can start getting USB replies before
rtw_dev is fully setup.

The stack trace looks like this:

rtw_rx_fill_rx_status
rtw8821c_query_rx_desc
rtw_usb_rx_handler
...
queue_work
rtw_usb_read_port_complete
...
usb_submit_urb
rtw_usb_rx_resubmit
rtw_usb_init_rx
rtw_usb_probe

So while we do the async stuff rtw_usb_probe continues and calls
rtw_register_hw, which does all kinds of initialization (e.g.
via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.

Fix this by moving the first usb_submit_urb after everything
is set up.

For me, this bug manifested as:
[    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
[    8.910904] rtw_8821cu 1-1:1.2: hw-&gt;conf.chandef.chan NULL in rtw_rx_fill_rx_status
because I'm using Larry's backport of rtw88 driver with the NULL
checks in rtw_rx_fill_rx_status.

Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa--NiVVx494WcuQw@mail.gmail.com/
Signed-off-by: Marcin Ślusarz &lt;mslusarz@renau.com&gt;
Cc: Tim K &lt;tpkuester@gmail.com&gt;
Cc: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Cc: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Kalle Valo &lt;kvalo@kernel.org&gt;
Cc: linux-wireless@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240528110246.477321-1-marcin.slusarz@gmail.com
</pre>
</div>
</content>
</entry>
<entry>
<title>wifi: rtw89: 8852bt: rfk: add RCK</title>
<updated>2024-07-02T11:43:54+00:00</updated>
<author>
<name>Ping-Ke Shih</name>
<email>pkshih@realtek.com</email>
</author>
<published>2024-06-27T02:58:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=746f4ae52a38459dbed792adb58cadaed370dcc2'/>
<id>746f4ae52a38459dbed792adb58cadaed370dcc2</id>
<content type='text'>
RCK is synchronize RC calibration. Driver triggers this calibration and
writes the result to registers.

Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240627025849.25198-5-pkshih@realtek.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
RCK is synchronize RC calibration. Driver triggers this calibration and
writes the result to registers.

Signed-off-by: Ping-Ke Shih &lt;pkshih@realtek.com&gt;
Link: https://patch.msgid.link/20240627025849.25198-5-pkshih@realtek.com
</pre>
</div>
</content>
</entry>
</feed>
