summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-04-29drm/amd/display: Read EDID from VBIOS embedded panel infoTimur Kristóf
Some board manufacturers hardcode the EDID for the embedded panel in the VBIOS. This EDID should be used when the panel doesn't have a DDC. For reference, see the legacy non-DC display code: amdgpu_atombios_encoder_get_lcd_info() This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit eb105e63b474c11ef6a84a1c6b18100d851ff364)
2026-04-29drm/amd/display: Allow constructing DCE8 link encoder without DDCTimur Kristóf
When the DDC channel ID is set to CHANNEL_ID_UNKNOWN, pass NULL to the AUX regs array. This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 155baf3038c1af50b602723022ed869b38e86a99)
2026-04-29drm/amd/display: Allow constructing DCE6 link encoder without DDCTimur Kristóf
When the DDC channel ID is set to CHANNEL_ID_UNKNOWN, pass NULL to the AUX regs array. This is necessary to support embedded connectors without DDC. Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 38a70e50b22a188ff601740d64dd75f46213121f)
2026-04-29drm/amd/display: Allow DCE link encoder without AUX registersTimur Kristóf
Allow constructing the DCE link encoder without DDC, which means the AUX registers array will be NULL. This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 87f30b101af62590faf6020d106da07efdda199b)
2026-04-29drm/amd/display: Allow embedded connectors without DDCTimur Kristóf
On some laptops, the embedded panel may not have a DDC (display data channel) available. On these, the EDID may be hardcoded in ACPI or the VBIOS. In this case, use GPIO_DDC_LINE_UNKNOWN and don't fail. Fixes: def3488eb0fd ("drm/amd/display: refactor HPD to increase flexibility") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 75b8a6ca0e8bc3ce24572f854e95f8721b321179)
2026-04-29drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUsLeo Li
[Why] Rapid vblank off is causing flip-done timeouts for NV3x and newer family of GPUs that support more idle optimization features. A proper fix requires further investigation. In lieu of it, let's workaround it for now. [How] For NV3x and newer family of DGPUs, restore the old 5s vblank off timer. Fixes: 9b47278cec98 ("drm/amd/display: temp w/a for dGPU to enter idle optimizations") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3787 Link: https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/ Tested-by: Michele Palazzi <sysdadmin@m1k.cloud> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit df482c2d441b090161633566b7a0755f1bbd55c2)
2026-04-29drm/amd/display: Use EDID from VBIOS embedded panel infoTimur Kristóf
When an embedded panel has no DDC, read the EDID from the VBIOS embedded panel info and use that. Fixes: 7c7f5b15be65 ("drm/amd/display: Refactor edid read.") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29drm/amd/display: Read EDID from VBIOS embedded panel infoTimur Kristóf
Some board manufacturers hardcode the EDID for the embedded panel in the VBIOS. This EDID should be used when the panel doesn't have a DDC. For reference, see the legacy non-DC display code: amdgpu_atombios_encoder_get_lcd_info() This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29drm/amd/display: Allow constructing DCE8 link encoder without DDCTimur Kristóf
When the DDC channel ID is set to CHANNEL_ID_UNKNOWN, pass NULL to the AUX regs array. This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29drm/amd/display: Allow constructing DCE6 link encoder without DDCTimur Kristóf
When the DDC channel ID is set to CHANNEL_ID_UNKNOWN, pass NULL to the AUX regs array. This is necessary to support embedded connectors without DDC. Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29drm/amd/display: Allow DCE link encoder without AUX registersTimur Kristóf
Allow constructing the DCE link encoder without DDC, which means the AUX registers array will be NULL. This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29drm/amd/display: Allow embedded connectors without DDCTimur Kristóf
On some laptops, the embedded panel may not have a DDC (display data channel) available. On these, the EDID may be hardcoded in ACPI or the VBIOS. In this case, use GPIO_DDC_LINE_UNKNOWN and don't fail. Fixes: def3488eb0fd ("drm/amd/display: refactor HPD to increase flexibility") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUsLeo Li
[Why] Rapid vblank off is causing flip-done timeouts for NV3x and newer family of GPUs that support more idle optimization features. A proper fix requires further investigation. In lieu of it, let's workaround it for now. [How] For NV3x and newer family of DGPUs, restore the old 5s vblank off timer. Fixes: 9b47278cec98 ("drm/amd/display: temp w/a for dGPU to enter idle optimizations") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3787 Link: https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/ Tested-by: Michele Palazzi <sysdadmin@m1k.cloud> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-29gpiolib: acpi: Only trigger ActiveBoth interrupts on bootMario Limonciello
Commit ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events at least once on boot") introduced logic to trigger edge-based GPIO interrupts during initialization to ensure proper initial state setup when firmware doesn't initialize it. However, according to the Microsoft GPIO documentation, triggering GPIO interrupts during initialization should only happen for interrupts marked as ActiveBoth (both IRQF_TRIGGER_RISING and IRQF_TRIGGER_FALLING) and only when the associated GPIO line is already asserted (logic level low). The current implementation incorrectly triggers: 1. Any edge-triggered interrupt (RISING-only or FALLING-only) 2. RISING interrupts when value is high and FALLING when value is low This causes problems at bootup for single-edge interrupts that don't follow the ActiveBoth pattern. Fix this by: - Only triggering when BOTH rising and falling edges are configured - Only triggering when the GPIO line is asserted (value == 0) Reported-by: Francesco Lauritano <francesco.lauritano1@protonmail.com> Closes: https://lore.kernel.org/all/6iFCwGH2vssb7NRUTWGpkubGMNbgIlBHSz40z8ZsezjxngXpoiiRiJaijviNvhiDAGIr43bfUmdxLmxYoHDjyft4DgwFc3Pnu5hzPguTa0s=@protonmail.com/ Tested-by: Marco Scardovi <mscardovi95@gmail.com> Fixes: ca876c7483b69 ("gpiolib-acpi: make sure we trigger edge events at least once on boot") Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/general-purpose-i-o--gpio- Suggested-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2026-04-29firewire: core: code cleanup for iso resource auto creationTakashi Sakamoto
The init_iso_resource function is only called by ioctl_allocate_iso_resource(), thus no need to be unique. This commit unifies them with minor code refactoring. Link: https://lore.kernel.org/r/20260429093449.160545-8-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29firewire: core: append _auto suffix for non-once iso resource operationsTakashi Sakamoto
The functions for iso_resource once operations are carefully split from another type of operation. This commit adds _auto suffix to functions for the another type so that it is easily to distinguish them. Link: https://lore.kernel.org/r/20260429093449.160545-7-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29firewire: core: code cleanup to remove old implementations for once operationTakashi Sakamoto
The helper functions for iso_resource allocation and work item still include codes for once operation. This commit refactors them to remove the old implementations. Link: https://lore.kernel.org/r/20260429093449.160545-6-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29firewire: core: split functions for iso_resource once operationTakashi Sakamoto
Unlike FW_CDEV_IOC_ALLOCATE_ISO_RESOURCE operation, the operations of FW_CDEV_IOC_[DE]ALLOCATE_ISO_RESOURCE_ONCE require no client resource, thus they keeps no handle value. This commit adds the series of functions to separate these operations, according to divide-and-conquer methodology. Link: https://lore.kernel.org/r/20260429093449.160545-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29firewire: core: code refactoring for helper function to fill iso_resource ↵Takashi Sakamoto
parameters This change is a preparation for future changes. The added helper function will be reused in the changes to fill iso_resource parameters according to the users' request. Link: https://lore.kernel.org/r/20260429093449.160545-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29firewire: core: code refactoring to queue work item for iso_resourceTakashi Sakamoto
The add_client_resource() function checks the type of client resource every time to be called. If the type is for iso_resource, it schedules work item. However, the iso_resource client resource is only added by the call of init_iso_resource(). There is no need to check the type every time adding any client resource. Link: https://lore.kernel.org/r/20260429093449.160545-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29firewire: core: code refactoring for early return at client resource allocationTakashi Sakamoto
The add_client_resource() function returns zero at success or negative value at error. The critical section is already protected by scoped_guard() macro. In this case, the programming pattern of early return improves code readability. Link: https://lore.kernel.org/r/20260429093449.160545-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-04-29drm/i915/display: Use ceiling division for NV12 UV surface offset calculationVidya Srinivas
For LNL+, odd source size and panning for YUV 422/420 surfaces is supported. However, it requires the UV (chroma) surface Start X/Y and width/height to be calculated as ceiling(half of Y plane value) rather than floor. The current code uses (>> 17) which combines the U16.16 fixed-point to integer conversion (>> 16) with a divide-by-2 for chroma subsampling (>> 1) into a single floor division. For odd Y plane values this produces an off-by-one error in the UV plane offset. On Android systems we see PLANE ATS fault when NV12 overlays are used with odd source dimensions: [ 126.854200] xe 0000:00:02.0: [drm:intel_atomic_setup_scaler [xe]] [CRTC:148:pipe A] attached scaler id 0.0 to PLANE:33 [ 126.854617] xe 0000:00:02.0: [drm:skl_update_scaler [xe]] [CRTC:148:pipe A] scaler_user index 0.0: staged scaling request for 1279x719->1340x753 [ 126.854837] xe 0000:00:02.0: [drm:intel_plane_atomic_check [xe]] UV plane [PLANE:33:plane 1A] using Y plane [PLANE:123:plane 4A] [ 126.854926] xe 0000:00:02.0: [drm] *ERROR* [CRTC:148:pipe A] PLANE ATS fault With Y plane width 1279: floor(1279/2) = 639 (current) ceil(1279/2) = 640 (required) Introduce fp_16_16_div2() and fp_16_16_to_int_ceil() helpers to cleanly separate the two operations: first halve the U16.16 fixed-point value for chroma subsampling (staying in fixed-point domain), then convert to integer with ceiling rounding. v2: Use DIV_ROUND_UP(value, 1 << 17) to preserve sub-pixel precision while making the ceiling division readable (Jani, Uma) v3: Split into two helpers - fp_16_16_div2() for fixed-point division by 2 and fp_16_16_to_int_ceil() for ceiling conversion to integer, cleanly separating chroma subsampling from fixed-point to integer conversion (Jani) Signed-off-by: Vidya Srinivas <vidya.srinivas@intel.com> Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com> Signed-off-by: Mika Kahola <mika.kahola@intel.com> Link: https://patch.msgid.link/20260415165849.187693-1-vidya.srinivas@intel.com
2026-04-29drm/i915/display: enable ccs modifiers on dg2Juha-Pekka Heikkila
Since Xe driver aux ccs enablement dg2 ccs modifiers have been disabled on i915 driver. Here allow dg2 to use ccs again for framebuffers. Fixes: 6a99e91a6ca8 ("drm/i915/display: Detect AuxCCS support via display parent interface") Signed-off-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Mika Kahola <mika.kahola@intel.com> Link: https://patch.msgid.link/20260427165715.864721-1-juhapekka.heikkila@gmail.com
2026-04-29drm/bridge: prefer drm_printf_indent() over inline \tJani Nikula
We have a helper drm_printf_indent() for tab indenting the prints. It makes the actual strings more readable, and highlights the indented parts better in source. Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Link: https://patch.msgid.link/20260408082211.3040194-2-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-29drm/atomic: prefer drm_printf_indent() over inline \tJani Nikula
We have a helper drm_printf_indent() for tab indenting the prints. It makes the actual strings more readable, and highlights the indented parts better in source. Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Link: https://patch.msgid.link/20260408082211.3040194-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-29gpio: sim: Replace sprintf() with sysfs_emit()Maxwell Doose
Replace sprintf() function calls with sysfs_emit() in the configfs show callbacks. This will help harden the driver and will bring the driver up-to-date with more modern functions. Suggested-by: Bartosz Golaszewski <brgl@kernel.org> Signed-off-by: Maxwell Doose <m32285159@gmail.com> Link: https://patch.msgid.link/20260428113439.9783-1-m32285159@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-04-29accel/ivpu: Add support for limiting NPU frequencyAndrzej Kacprowski
Add configurable frequency limits to allow users to constrain the NPU operating frequency range for power and thermal management. This support requires firmware API version 3.34.0 or newer. New sysfs interface: The freq/ subdirectory contains the following attributes: - hw_min_freq: Minimum frequency supported by hardware (read-only) - hw_max_freq: Maximum frequency supported by hardware (read-only) - hw_efficient_freq: Hardware's optimal operating frequency (read-only) - current_freq: Current NPU frequency in MHz (read-only) - set_min_freq: Configure minimum operating frequency (50XX+ devices) - set_max_freq: Configure maximum operating frequency (50XX+ devices) Legacy attributes npu_max_frequency_mhz and npu_current_frequency_mhz are maintained for backward compatibility. Implementation details: - Frequency configuration is communicated to firmware via JSM messages - User-specified frequency values are clamped to hardware limits - Power-efficient frequency (pn_ratio) is adjusted dynamically to stay within the configured range - Frequency configuration is initialized during device boot - The JSM API header is updated to version 3.34.0 to support the new VPU_JSM_MSG_FREQ_CONFIG firmware message Added description for the sysfs attributes in the Documentation/ABI. Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Link: https://patch.msgid.link/20260408150152.2093638-1-andrzej.kacprowski@linux.intel.com
2026-04-29efi/libstub: Synchronize instruction cache after kernel relocationWANG Rui
The relocated kernel image is copied to its new location using memcpy(). On architectures with separate instruction and data caches, the copied instructions may remain stale in the instruction cache, leading to the execution of outdated contents. Call efi_cache_sync_image() after the relocation copy to ensure the instruction cache is synchronized with the updated memory contents before control is transferred to the relocated kernel. Signed-off-by: WANG Rui <r@hev.cc> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-29efi/loongarch: Implement efi_cache_sync_image()WANG Rui
Provide a LoongArch implementation of efi_cache_sync_image() to ensure instruction cache coherency after the kernel image is relocated. Signed-off-by: WANG Rui <r@hev.cc> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-29efi/libstub: Move efi_relocate_kernel() into its only remaining userArd Biesheuvel
LoongArch is the only arch that still uses efi_relocate_kernel(), so before making changes to it that LoongArch needs, turn it into a private function. Move efi_low_alloc_above() into mem.c while at it, and drop the relocate.c source file altogether. Tested-by: WANG Rui <wangrui@loongson.cn> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-29wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptorBitterblue Smith
Bit 28 of double word 2 in the RX descriptor indicates if the packet is a normal 802.11 frame, or a message from the wifi firmware to the driver (Card 2 Host). Commit f5678bfe1cdc ("rtlwifi: rtl8821ae: Replace local bit manipulation macros") mistakenly made the driver look for this bit in double word 1, causing packet loss and Bluetooth coexistence problems. Fixes: f5678bfe1cdc ("rtlwifi: rtl8821ae: Replace local bit manipulation macros") Cc: <stable@vger.kernel.org> Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/04da7398-cedb-425a-a810-5772ab10139d@gmail.com
2026-04-29wifi: rtw89: disable CSI STBC for VHT 160MHzDian-Syuan Yang
Fix interoperability problem where CSI feedback with STBC enabled at VHT 160MHz BW cannot be properly decoded by certain APs, causing CSI reports to be rejected. This problem is specific to Wi-Fi 7 chips, as Wi-Fi 6 defaults to 20MHz CSI BW. Therefore, disable STBC encoding for CSI transmission in VHT 160MHz mode to ensure CSI feedback is accepted by these APs and maintain smooth throughput. Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260424072552.59220-4-pkshih@realtek.com
2026-04-29wifi: rtw89: disable HTC field in AP modeDian-Syuan Yang
Disable HE QoS HTC field when operating in AP mode to resolve interoperability issues with some stations. Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260424072552.59220-3-pkshih@realtek.com
2026-04-29wifi: rtw89: pci: no need to wait CLK ready for RTL8922DEPing-Ke Shih
The bit is to wait for CLK ready when entering PCIE L1SS. However, a certain host might not enable CLK for a situation, causing device state stuck and trigger PCIE SER. Unset this bit as default like earlier chips. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260424072552.59220-2-pkshih@realtek.com
2026-04-29wifi: rtw89: add bounds check on firmware mac_id in link lookupTristan Madani
The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference() to guard against out-of-range firmware values. Fixes: 144c6cd24b35 ("wifi: rtw89: 8922a: configure AP_LINK_PS if FW supports") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260421111442.3395411-1-tristmd@gmail.com
2026-04-29wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA bufferTristan Madani
In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478), causing an out-of-bounds read from the pre-allocated DMA buffer when skb_put_data copies new_len bytes. The USB transport already validates this (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the PCIe path does not. Add a check that new_len does not exceed the DMA buffer size. Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260421111434.3389674-1-tristmd@gmail.com
2026-04-29wifi: rtw89: 8922d: update RF calibration flow for MLDZong-Zhe Yang
RF calibration (RFK) will record the results in HW RFK tables. SW can select and configure the target HW RFK table to reuse the RFK result on the target channel. Though the above can work as before, when MLD runs eMLSR mode, a faster switching between links than SW is needed. So, introduce a new working flow for MLD. With the new settings, HW can easily switch RFK results between links during eMLSR mode. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-17-pkshih@realtek.com
2026-04-29wifi: rtw89: chan: introduce new helper to get entity current configurationZong-Zhe Yang
The original helper can only queries target channel, but cannot determine current role's status, e.g. is it MLD or not. These things should be a set. Adding more and more helpers to query them individually without synchronous doesn't seem right. Introduce a new helper to query current channel set and role status. Besides, when single channel, e.g. MLO_2_PLUS_0_1RF and MLO_0_PLUS_2_1RF, the target channel pointer will be duplicated to fill the returned channel set. So, some callers can save trivial things for these cases. The returned channels will be non-NULL, so callers don't need trivial NULL check either. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-16-pkshih@realtek.com
2026-04-29wifi: rtw89: suspend DIG when remain-on-channelChih-Kang Chang
The PD (Packet Detection) lower bound is set after the STA interface connects. When the P2P interface attempts to find peers, it enters the remain-on-channel flow to listen for probe requests. However, if the RSSI of the connected AP is too high, the P2P interface fails to receive it. To resolve this, suspend the DIG during the remain-on-channel period. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-15-pkshih@realtek.com
2026-04-29wifi: rtw89: check scan C2H event recv ack instead of C2H event done ackChih-Kang Chang
The original flow checks the scan offload C2H event done ack to increase the scan sequence. However, the scan offload response C2H event may be received earlier than the scan offload C2H event done ack, which causes these C2H event to be dropped by rtw89_fw_c2h_purge_obsoleted_scan_events() check because the scan sequence of the scan offload response C2H event is less than the scan offload C2H event done ack. Therefore, checking the scan offload C2H event recv ack instead of C2H event done ack to fix this issue. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-14-pkshih@realtek.com
2026-04-29wifi: rtw89: use struct to fill C2H recv ackChih-Kang Chang
This C2H packet is used to indicate that FW has received the corresponding H2C command. No logic is changed. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-13-pkshih@realtek.com
2026-04-29wifi: rtw89: 8832cu: Add ID 2c7c:8206 for RTL8832CUJohnson Tsai
This ID is used by RTL8832CU-based Quectel USB dongle devices. Signed-off-by: Johnson Tsai <wenjie.tsai@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-12-pkshih@realtek.com
2026-04-29wifi: rtw89: use firmware offload for PHY and RF batch register writesEric Huang
Use firmware offload to perform batch register writes for PHY and RF. This reduces I/O operations, improves bus transfer efficiency, and decreases hardware initialization time. Performance improvement on USB 2.0 HCI: - rtw89_phy_init_bb_reg: 61 ms -> 5 ms - rtw89_phy_init_rf_reg: 587 ms -> 106 ms Use offload-aware delay functions (do_udelay and do_mdelay) for the delay calls in rtw89_phy_init_reg, rtw89_phy_config_rf_reg, and rtw89_phy_config_rf_reg_v1 to ensure compatibility with batch register writes. Signed-off-by: Eric Huang <echuang@realtek.com> Signed-off-by: Johnson Tsai <wenjie.tsai@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-11-pkshih@realtek.com
2026-04-29wifi: rtw89: offload DMAC and CMAC init IO to firmwareChia-Yuan Li
During the initialization of DMAC and CMAC, the driver performs a large number of consecutive register writes. Sending these I/O requests individually over the host interface introduces significant latency and delays the device bring-up process. Optimize the initialization flow by wrapping the register write sequences in mac.c and mac_be.c with rtw89_io_pack() and rtw89_io_unpack(). This batches the operations and offloads them to the firmware via H2C commands, which significantly accelerates the overall initialization time. (8852C USB2.0 AMD B450 1379 ms -> 1273 ms) Signed-off-by: Chia-Yuan Li <leo.li@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-10-pkshih@realtek.com
2026-04-29wifi: rtw89: add IO offload support via firmwareChia-Yuan Li
Offload register write operations to the firmware to improve IO efficiency. Instead of the host performing direct bus access for every register, the operations are now encapsulated into firmware commands. This implementation allows the host to aggregate multiple register write actions into a single command buffer. By batching these operations, we reduce the number of individual transactions on the bus and minimize per-transfer overhead, leading to faster overall IO performance. Add a support_fw_cmd_ofld field to the chip_info structure to control whether firmware-offloaded batch writes are enabled. Enable it by default for RTL8832CU. Co-developed-by: Eric Huang <echuang@realtek.com> Signed-off-by: Eric Huang <echuang@realtek.com> Co-developed-by: Johnson Tsai <wenjie.tsai@realtek.com> Signed-off-by: Johnson Tsai <wenjie.tsai@realtek.com> Signed-off-by: Chia-Yuan Li <leo.li@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-9-pkshih@realtek.com
2026-04-29wifi: rtw89: 8852bt: configure support_noise field explicitlyZong-Zhe Yang
RTL8852BT missed to configure support_noise field in chip_info. Although RTL8852BT doesn't support that, add the configuration to make things clear. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-8-pkshih@realtek.com
2026-04-29wifi: rtw89: Correct data type for scan index to avoid infinite loopShin-Yi Lin
A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic. RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends the low 8 bits of RBX into RAX. RBX (the counter i) has reached a huge value: 0x137466a1. watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124] Workqueue: events_unbound cfg80211_wiphy_work [cfg80211] RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core] Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 c3 01 <0f> b6 c3 41 3b 44 24 74 0f 83 0b 02 00 00 0f b6 c3 48 8d 14 80 49 RSP: 0018:ffffcb48cbaa39f8 EFLAGS: 00000202 RAX: 0000000000000005 RBX: 00000000137466a1 RCX: 0000000000000000 RDX: ffff89ffc9d851a8 RSI: 0000000000004f0d RDI: 0000000096af0130 RBP: ffffcb48cbaa3a60 R08: 0000000000000000 R09: ffff8a00b7502080 R10: ffff8a00b75ff600 R11: 0000000000000000 R12: ffff89ffc7553870 R13: ffff8a00b7ac8f19 R14: ffff8a00b75020d8 R15: ffff89ffc3d54d80 FS: 0000000000000000(0000) GS:ffff8a014f962000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007558d7f9f4c4 CR3: 0000000178040001 CR4: 00000000001706f0 Call Trace: <TASK> rtw89_hw_scan_prep_chan_list_ax+0x8a/0x400 [rtw89_core] rtw89_hw_scan_start+0x546/0x8a0 [rtw89_core] ? rtw89_fw_h2c_default_cmac_tbl+0x13c/0x1f0 [rtw89_core] rtw89_ops_hw_scan+0xae/0x120 [rtw89_core] drv_hw_scan+0xbb/0x180 [mac80211] __ieee80211_start_scan+0x2fc/0x750 [mac80211] ieee80211_request_scan+0xe/0x20 [mac80211] ieee80211_scan+0x123/0x190 [mac80211] rdev_scan+0x40/0x110 [cfg80211] cfg80211_scan_6ghz+0x5a1/0xa30 [cfg80211] By objdump with source: for (i = 0; i < req->n_6ghz_params; i++) { 5fbc0: 83 c3 01 add $0x1,%ebx --> i++ 5fbc3: 0f b6 c3 movzbl %bl,%eax --> get counter fbc6: 41 3b 44 24 74 cmp 0x74(%r12),%eax * RBX: 00000000137466a1 -> %bl = a1 -> EAX = 000000a1 (161) Fixes: c6aa9a9c4725 ("wifi: rtw89: add RNR support for 6 GHz scan") Signed-off-by: Shin-Yi Lin <isaiah@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-7-pkshih@realtek.com
2026-04-29wifi: rtw89: phy: support static PD level settingEric Huang
PD (Packet Detection) threshold is a key parameter in the DIG (Dynamic Initial Gain) algorithm that determines the sensitivity of packet detection. Current implementation only supports dynamic PD adjustment based on environment. This patch adds support for static PD threshold via debugfs allowing users to set a fixed PD value for testing or specific scenarios. Signed-off-by: Eric Huang <echuang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-6-pkshih@realtek.com
2026-04-29wifi: rtw89: debug: disable inactive power save to reduce bus overheadJohnson Tsai
This helps avoid excessive bus traffic and I/O overhead on slower HCIs (e.g., USB, SDIO) caused by frequent power state transitions. Add RTW89_DM_INACTIVE_PS to the disabled_dm bitmap via debugfs and check it in the rtw89_enter_ips path. When set, the driver skips entering inactive power save and returns immediately. Signed-off-by: Johnson Tsai <wenjie.tsai@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-5-pkshih@realtek.com
2026-04-29wifi: rtw89: debug: disable hw_scan for latency-sensitive scenariosJohnson Tsai
This helps avoid scan-triggered off-channel activity during latency-sensitive scenarios. Add RTW89_DM_HW_SCAN to the disabled_dm bitmap via debugfs and check it in the hw_scan path. When set, the driver rejects hw_scan requests and returns -EBUSY. Signed-off-by: Johnson Tsai <wenjie.tsai@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260420034051.17666-4-pkshih@realtek.com