From nobody Fri Nov 6 06:27:48 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=119.15.109.137 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793847439; b=l6XxHMjY7ax7o+4i7XJyJno4Np3NL7j7jdxIqIcYAe89fBv0dvTzsJZjb0xmLuzUZ0+E RlsApM0cGDivVLcvlrutwa4xpxFUsp5vMU/fwU7DxC6J0fjAjpMj/FP7f67OBrDUQmVTM BWVgZDsMkxSizaXhZFlA6i7FcJiejFxaugShoMRsx8rQ3LQXXYcIkbqdJD8VJ/MEYAZhb RUzWyqhPyNtCqWEodA3Qqa2hpavQW7A2KPRO3LSneVxToezmny5bvbUEbHmFXiT1pHkp2 7yajw8dLnRFIHoJz0UYlnqMtt7oQ+SFdjiWGxNOXglSLwAsSLg5dWalIr2ZOttIUXaA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793847439; h=DMARC-Filter:Received:DKIM-Signature:X-GPT-Reason:From:To:Cc:Subject: Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=jq9t4i4p9xF2mSol4zZx3RitgWvrWh8XynSKXKryK9o=; b=nWNs9hdNPRGEYethIl/yUMpX+Xrz07mpx/5RwEPpn+e00/wDbioxI879fKQOdIFtlNgg bu7QbB50Gfrgy4izd6lbIIZVTKS+IBS3lQzTaHLJK1DhlgNoXTC8YpHRoYHxi/8TTc8AR 7WZHZb8XszUPU7l4oDWwqI30rY3zLFUt1dzheqO/UY976QPZJ03XbKhZaRL+WpVFnksdv jUZQo1TgcG1wVED5DVPIAHegPJbEI7RPjxpjUMq7vgbpC2D0vxFfce8LSpxnu07sC7oqF 7ecVGmqwFpcuOY3psVRGfn0Ns064TdEw9MzDJBm/PlBbt1Njnz82MQ5YzV8dMsiifzQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=d-silva.org; spf=pass smtp.mailfrom=d-silva.org; dkim=pass header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=RpmkdZsZ; arc=none smtp.remote-ip=119.15.109.137 Received: from www.nmnhosting.com (watt.d-silva.org [119.15.109.137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA2A8606A328; Thu, 5 Nov 2026 02:57:17 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org CA2A8606A328 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=d-silva.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=d-silva.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=RpmkdZsZ Received: from Hawking.lan (hawking.lan [10.0.1.4]) by www.nmnhosting.com (Postfix) with ESMTP id B2C4C41A1E; Thu, 5 Nov 2026 13:57:08 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=d-silva.org; s=2025a; t=1793847428; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jq9t4i4p9xF2mSol4zZx3RitgWvrWh8XynSKXKryK9o=; b=RpmkdZsZgbcqwmyzDPOHCYuMU0SBv/jUzTl1QoMHcQVeo0u/j6SGGCqv+w/ndAa13kSVAA wo6WG8mTHMZG74TD2ywRBD3jGdpSMVQrhsFyD8F+t0NxR/0xBn6bkv0XOij2z5Qx9WvqvO 9WhaIKy8AkqL6NBL8xJN92IVkOaOYfpz3l2dUaIA0aVQWOtlldR6aIdg1T2H35mfznO9FT lCx2BAR2LN2km3Xa2GYIw3X2F7wlT603IOdoJa0kFWsmh6fs6UYXkCLhv7ekwlmESQXeiN Woma5LxrMLM2EUHmpQGEoqkhl/6ZqiHZ7pcAIgWErjpBbJgIdInm0tjQPbWDSQ== X-GPT-Reason: This email is classified as legitimate personal/professional communication. The content is a technical kernel patch description regarding a wifi driver (rtw88), which aligns perfectly with the personal mailbox of alastair@d-silva.org. The sender domain (d-silva.org) matches the recipient domain, the "Cc" and "Reviewed-by" headers reference known Linux kernel development entities (vger.kernel.org, linux.dev), and there are no indicators of marketing, phishing, or urgency. From: Alastair D'Silva To: linux-wireless@vger.kernel.org, Ping-Ke Shih , Kalle Valo Cc: Luka Gejak , Martin Blumenstingl , Jernej Skrabec , Ulf Hansson , linux-kernel@vger.kernel.org, Alastair D'Silva , stable@vger.kernel.org Subject: [PATCH rtw-next v8 1/4] wifi: rtw88: sdio: Handle allocation and read errors in rtw_sdio_rxfifo_recv Date: Thu, 5 Nov 2026 13:56:57 +1100 Message-ID: <20261105025700.1655219-2-alastair@d-silva.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261105025700.1655219-1-alastair@d-silva.org> References: <20261105025700.1655219-1-alastair@d-silva.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When dev_alloc_skb() or rtw_sdio_read_port() fails, rtw_sdio_rxfifo_recv() returns without reading data. Because it returned void, the caller still counted rx_len against the loop budget while leaving data stranded in the FIFO. Return an error code from rtw_sdio_rxfifo_recv() on failure and break out of the receive loop in the caller immediately. Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO ba= sed chipsets") Cc: stable@vger.kernel.org Assisted-by: LLM Acked-by: Ping-Ke Shih Reviewed-by: Luka Gejak Signed-off-by: Alastair D'Silva --- drivers/net/wireless/realtek/rtw88/sdio.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wirele= ss/realtek/rtw88/sdio.c index ecd4d751c05a5..172aa7ad4732a 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.c +++ b/drivers/net/wireless/realtek/rtw88/sdio.c @@ -1348,7 +1348,7 @@ static void rtw_sdio_rx_skb(struct rtw_dev *rtwdev, s= truct sk_buff *skb, ieee80211_rx_irqsafe(rtwdev->hw, skb); } =20 -static void rtw_sdio_rxfifo_recv(struct rtw_dev *rtwdev, u32 rx_len) +static int rtw_sdio_rxfifo_recv(struct rtw_dev *rtwdev, u32 rx_len) { struct rtw_sdio *rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; const struct rtw_chip_info *chip =3D rtwdev->chip; @@ -1365,12 +1365,12 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rt= wdev, u32 rx_len) =20 skb =3D dev_alloc_skb(bufsz); if (!skb) - return; + return -ENOMEM; =20 ret =3D rtw_sdio_read_port(rtwdev, skb->data, bufsz); if (ret) { dev_kfree_skb_any(skb); - return; + return ret; } =20 while (true) { @@ -1379,7 +1379,7 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rtwd= ev, u32 rx_len) &pkt_stat, &rx_status); if (ret) { dev_kfree_skb_any(skb); - return; + return ret; } =20 pkt_offset =3D pkt_desc_sz + pkt_stat.drv_info_sz + @@ -1393,7 +1393,7 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rtwd= ev, u32 rx_len) "oversized RX packet: %u, %u bytes left\n", pkt_offset + pkt_stat.pkt_len, rx_len); dev_kfree_skb_any(skb); - return; + return -EINVAL; } =20 if ((curr_pkt_len + pkt_desc_sz) >=3D rx_len) { @@ -1423,11 +1423,14 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rt= wdev, u32 rx_len) skb_reserve(skb, curr_pkt_len); rx_len -=3D curr_pkt_len; } + + return 0; } =20 static void rtw_sdio_rx_isr(struct rtw_dev *rtwdev) { u32 rx_len, hisr, total_rx_bytes =3D 0; + int ret; =20 do { if (rtw_chip_wcpu_8051(rtwdev)) @@ -1438,7 +1441,9 @@ static void rtw_sdio_rx_isr(struct rtw_dev *rtwdev) if (!rx_len) break; =20 - rtw_sdio_rxfifo_recv(rtwdev, rx_len); + ret =3D rtw_sdio_rxfifo_recv(rtwdev, rx_len); + if (ret) + break; =20 total_rx_bytes +=3D rx_len; =20 --=20 2.53.0 From nobody Fri Nov 6 06:27:48 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=119.15.109.137 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793847445; b=zdMj8Sa+pjjdhqi9Wv15Igt6mCtCD2muNLdCDaKJJzAwHneP9cF8Dy05IOX88ShBTMfg fv1xDi/xR43+YdCPc4NQWU+T3Ah2ddUpJjps8T4yLHM6KnxjqsOxngsQwtR/Thr8Rck7x fwztwthCWw0/hiW6tGB8Oks9o5E01UIMNiRoBrdDKCtm/JbGCjaSSuj+Jl6aUnfm+N4pW JwEhkADeMwlz8T6ka4KAIyjGZICc/dKW5MK71eEcpVxtnSNyZEplCLuf71mfcLcwuFyET YK52Sgo5r+gwqlRlIR7EKVNNYoJZFu1ZHnl9UDIgTtt+RHAeJGpPOS9FihwRo6YnVWQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793847445; h=DMARC-Filter:Received:DKIM-Signature:X-GPT-Reason:From:To:Cc:Subject: Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=kFn1OX+6FsSsT47EB9T1OrR6/BEpjvhs9/Zdbykf1/M=; b=E09a7aaD/IqHom3g5MlptkJmS6qUAHTpZElx0dt09G2gCKqGa85IIIOdTomF9P3pznHv 3a41hide0gt8XHag1GYSNykbwWcU1q77lAD1wMhvQVYvNJ1bVVzw94ZafPjZ0lVDj5WqP WYnRwm73Ab2bvti3Grb/KsZ9RUMuqtE0rFTre8kdaWd4zlBAEhRXnkYVLP3v3oiqHd82W mPa5qxoI/XS1JDDMXYtVa3f94fiVb31U0PECAmY2Mbusgi4sXzYbqexjahWNybTQoSTJY 0ElyLxQPJ31S281ukyoDg2qn2Vy1+d5JdjZMLg7HmJOhDNIRnG/SHowQmQxe8CLxK3w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=d-silva.org; spf=pass smtp.mailfrom=d-silva.org; dkim=pass header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=xNfkzy28; arc=none smtp.remote-ip=119.15.109.137 Received: from www.nmnhosting.com (watt.d-silva.org [119.15.109.137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8EE6606A337; Thu, 5 Nov 2026 02:57:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A8EE6606A337 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=d-silva.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=d-silva.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=xNfkzy28 Received: from Hawking.lan (hawking.lan [10.0.1.4]) by www.nmnhosting.com (Postfix) with ESMTP id 0B16541A46; Thu, 5 Nov 2026 13:57:16 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=d-silva.org; s=2025a; t=1793847436; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kFn1OX+6FsSsT47EB9T1OrR6/BEpjvhs9/Zdbykf1/M=; b=xNfkzy281D829mYDxvBFa+soMiVZpjigiKe7X9l056CEDOfpWTp7ORxfFP28wAa+k2225K EEJpqdP8x72dvYpAFce6v4gNSRegffkC4ff62NNdcLPFcBYCROtuXd11KcI+owhVpVu0QY J29TWomxagGwRXqD41WCrc0bPdYPsoXyuzrSsRhTP8w3trh9aUdYNWotiY8aGHSpVAVH+T i9NZjVrN65bHQWjghKHkEX9ZHnYsyCL6tcm+alwM7e/Jb2ByNoPLWve3o6vArl8ZEOq6AR WqpP4dJFjmt6FsKPwaApSEKkupErRXfAYA6mUEUgMXvv8f/aQ3ZpybrgWfRRJQ== X-GPT-Reason: This is a legitimate personal/professional communication. The mailbox (alastair@d-silva.org) is a personal address that aligns with the sender's identity (Alastair D'Silva ), and the content is a technical Linux kernel patch description regarding "rtw88: sdio" drivers. There are no phishing red flags, no marketing elements, no suspicious links, and the technical nature of the "Signed-off-by" and "Fixes" lines confirms it is a standard software development workflow. From: Alastair D'Silva To: linux-wireless@vger.kernel.org, Ping-Ke Shih , Kalle Valo Cc: Luka Gejak , Martin Blumenstingl , Jernej Skrabec , Ulf Hansson , linux-kernel@vger.kernel.org, Alastair D'Silva , stable@vger.kernel.org Subject: [PATCH rtw-next v8 2/4] wifi: rtw88: sdio: Track running state and cancel TX worker on stop Date: Thu, 5 Nov 2026 13:56:58 +1100 Message-ID: <20261105025700.1655219-3-alastair@d-silva.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261105025700.1655219-1-alastair@d-silva.org> References: <20261105025700.1655219-1-alastair@d-silva.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When rtw_sdio_stop() disables interrupts, in-flight interrupt handlers or delayed TX work may still run against a powered-down device. Track the operational state in rtwsdio->running with an irq_lock mutex (similar to PCI), check it at the entry of rtw_sdio_handle_interrupt() and rtw_sdio_tx_handler(), serialize state transitions in rtw_sdio_start() and rtw_sdio_stop() under sdio_claim_host() and irq_lock, cancel the TX worker synchronously in rtw_sdio_stop(), and purge any remaining frames in rtwsdio->tx_queue[] while waking any stopped AC queues. Fixes: 28eaf7971a20 ("wifi: rtw88: sdio: add TX back-pressure and retry on = page starvation") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Alastair D'Silva --- drivers/net/wireless/realtek/rtw88/sdio.c | 46 ++++++++++++++++++++++- drivers/net/wireless/realtek/rtw88/sdio.h | 3 ++ 2 files changed, 47 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wirele= ss/realtek/rtw88/sdio.c index 172aa7ad4732a..e318fefe5b5e7 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.c +++ b/drivers/net/wireless/realtek/rtw88/sdio.c @@ -941,6 +941,8 @@ static void rtw_sdio_init(struct rtw_dev *rtwdev) { struct rtw_sdio *rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; =20 + mutex_init(&rtwsdio->irq_lock); + if (rtw_is_8723bs(rtwdev)) rtwsdio->irq_mask =3D REG_SDIO_HIMR_RX_REQUEST; else @@ -1054,6 +1056,7 @@ static int rtw_sdio_8723bs_check_rqpn(struct rtw_dev = *rtwdev) =20 static int rtw_sdio_start(struct rtw_dev *rtwdev) { + struct rtw_sdio *rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; u32 clear; =20 if (rtw_is_8723bs(rtwdev)) { @@ -1069,20 +1072,49 @@ static int rtw_sdio_start(struct rtw_dev *rtwdev) =20 rtw_sdio_enable_rx_aggregation(rtwdev); =20 + sdio_claim_host(rtwsdio->sdio_func); + if (rtw_is_8723bs(rtwdev)) { clear =3D rtw_read32(rtwdev, REG_SDIO_HISR) & RTW_SDIO_HISR_CLEAR_MASK; if (clear) rtw_write32(rtwdev, REG_SDIO_HISR, clear); } =20 - rtw_sdio_enable_interrupt(rtwdev); + scoped_guard(mutex, &rtwsdio->irq_lock) { + rtwsdio->running =3D true; + rtw_sdio_enable_interrupt(rtwdev); + } + + sdio_release_host(rtwsdio->sdio_func); =20 return 0; } =20 static void rtw_sdio_stop(struct rtw_dev *rtwdev) { - rtw_sdio_disable_interrupt(rtwdev); + struct rtw_sdio *rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; + enum rtw_tx_queue_type queue; + int i; + + sdio_claim_host(rtwsdio->sdio_func); + scoped_guard(mutex, &rtwsdio->irq_lock) { + rtwsdio->running =3D false; + rtw_sdio_disable_interrupt(rtwdev); + } + sdio_release_host(rtwsdio->sdio_func); + + cancel_delayed_work_sync(&rtwsdio->tx_handler_data->work); + + for (i =3D 0; i < RTK_MAX_TX_QUEUE_NUM; i++) + ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]); + + for (i =3D 0; i < IEEE80211_NUM_ACS; i++) { + queue =3D rtw_tx_ac_to_hwq(i); + if (rtwsdio->tx_queue_stopped[queue]) { + rtwsdio->tx_queue_stopped[queue] =3D false; + ieee80211_wake_queue(rtwdev->hw, i); + } + } } =20 static void rtw_sdio_deep_ps_enter(struct rtw_dev *rtwdev) @@ -1477,6 +1509,11 @@ static void rtw_sdio_handle_interrupt(struct sdio_fu= nc *sdio_func) rtwdev =3D hw->priv; rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; =20 + scoped_guard(mutex, &rtwsdio->irq_lock) { + if (!rtwsdio->running) + return; + } + rtwsdio->irq_thread =3D current; =20 hisr =3D rtw_read32(rtwdev, REG_SDIO_HISR); @@ -1710,6 +1747,11 @@ static void rtw_sdio_tx_handler(struct work_struct *= work) rtwdev =3D work_data->rtwdev; rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; =20 + scoped_guard(mutex, &rtwsdio->irq_lock) { + if (!rtwsdio->running) + return; + } + if (!rtw_fw_feature_check(&rtwdev->fw, FW_FEATURE_TX_WAKE)) rtw_sdio_deep_ps_leave(rtwdev); =20 diff --git a/drivers/net/wireless/realtek/rtw88/sdio.h b/drivers/net/wirele= ss/realtek/rtw88/sdio.h index 6e7e6009744b0..64266b54f595d 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.h +++ b/drivers/net/wireless/realtek/rtw88/sdio.h @@ -168,6 +168,9 @@ struct rtw_sdio { bool sdio3_bus_mode; =20 void *irq_thread; + bool running; + /* protect running state and enabling interrupts */ + struct mutex irq_lock; =20 struct workqueue_struct *txwq; struct rtw_sdio_work_data *tx_handler_data; --=20 2.53.0 From nobody Fri Nov 6 06:27:48 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=119.15.109.137 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793847451; b=bJolhl6SIUsscwjIhh972XKouj9SA+pxZL+Z5ZPHhcl/YcQKXfdvoErA6jxAR3JK8eSF 52SHO/iTpf1ocbqvpKW+Sw2JcnAtt6+v9qrDHi0CM61aOIPNlI7LjQl25uJ1fOo+o/Yqc CnfuGM9qmnl+DnZzi7IzoA+1LfFP5subXxRXXffKDs4Wj6QD/r8qmCJjunvjZMpBdydSM eiUlYey5ndEflVhABwCF+ZtWsuplrmTfcOhvrKCztr5YLrRjCuA3tIDLFS5fxwjbLOAj3 IX9T7uQ6qaJiF+AjO1Oh+Fh9/W/2xJ6aKd3PBikFUGh7aHj1jTCsvaEhkQZpLJA4U8A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793847451; h=DMARC-Filter:Received:DKIM-Signature:X-GPT-Reason:From:To:Cc:Subject: Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=yQF0ffGJFOq7JhhFUuyQIQNgwNgKhrnm79lPGkhe6es=; b=trYDa+4OEW4kpqg6QLQZALw7Mx5JB64WvGIhUobphgNUjmx8gAF+JXr9zwxBT5fyZoO/ gJoXXWSzS23dQc3/3EdOzpj63yERDV9dtAu3loXFkWPYtrKwklvK7pXv3FpyC+gkVsCDI hg3GvAmXt2wIOIIQZIz0TtiZdaC9u9E6BJt4AGoV+D/4O3Ht8+Wfw1CKLmn9oRk2lqOCR LOibLQf4l8EKy1+GWpnYjs5nmxThRS0O+xamJEgoO/OC8983zuoA0WDNPMemKRkFwocoI lHzXSqMSCJcRdhlGPBiH/27sgc/kZKrGboyu3hCZOzQF5dmSdkK5yoLQ0tVuXYgQV6w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=d-silva.org; spf=pass smtp.mailfrom=d-silva.org; dkim=pass header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=urTc34L1; arc=none smtp.remote-ip=119.15.109.137 Received: from www.nmnhosting.com (watt.d-silva.org [119.15.109.137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB06F606A336; Thu, 5 Nov 2026 02:57:30 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org CB06F606A336 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=d-silva.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=d-silva.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=urTc34L1 Received: from Hawking.lan (hawking.lan [10.0.1.4]) by www.nmnhosting.com (Postfix) with ESMTP id 8F70B41A47; Thu, 5 Nov 2026 13:57:22 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=d-silva.org; s=2025a; t=1793847442; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yQF0ffGJFOq7JhhFUuyQIQNgwNgKhrnm79lPGkhe6es=; b=urTc34L1zMpApIctSqltdLU1vOzti9r/5DvCPv0LiXEuqj7pGgMTCY8Mi3XYGDX+Py1daL n6PLxKLEEKxpU2NIgf7Y6stIxttCHne7kfPhGHMA4sPUbKL0qF/TzpuGKI4JfQTRVXnN9p 8lOHRhojk1MlOEMirdIuUiLrk4vBmQC9tTajsWJOVGkXimhQXMkqjhvXPrO0JpyhIG+0tG JUoBOWvPUiir3PyktA9kkWClfpFaYNT6j9nH4Jv/kaSO9geLW93wf9ktV7hsU73poN4L/z wmJnNf7N4g6E9tyWPp7Wi8Zxpr+RWyJDanMNboaDe8nVLlch3VIj9A5XgL0/Dg== X-GPT-Reason: legitimate; the email is a technical kernel patch submission (linux kernel style) that aligns perfectly with the personal mailbox of alastair@d-silva.org; the From domain (d-silva.org) matches the recipient's domain; the content is highly specific technical documentation regarding "rtw88" wifi drivers and "sdio" interrupt handling without any marketing, phishing, or urgency tactics; authentication is implicitly supported by the consistent use of the sender's personal domain across the From and Signed-off-by headers. From: Alastair D'Silva To: linux-wireless@vger.kernel.org, Ping-Ke Shih , Kalle Valo Cc: Luka Gejak , Martin Blumenstingl , Jernej Skrabec , Ulf Hansson , linux-kernel@vger.kernel.org, Alastair D'Silva , stable@vger.kernel.org Subject: [PATCH rtw-next v8 3/4] wifi: rtw88: sdio: Fix unhandled RX request interrupt storm Date: Thu, 5 Nov 2026 13:56:59 +1100 Message-ID: <20261105025700.1655219-4-alastair@d-silva.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261105025700.1655219-1-alastair@d-silva.org> References: <20261105025700.1655219-1-alastair@d-silva.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On 3081-based SDIO chips (observed on RTL8821CS; RTL8822BS and RTL8822CS are inferred to be affected as they share the 3081 architecture), clearing REG_SDIO_HISR_RX_REQUEST requires both a software W1C acknowledge and an empty RX FIFO. Masking this bit out before writing back to HISR prevents the software acknowledge from happening, leaving the bit asserted even after the FIFO is drained and causing an infinite interrupt storm loop that locks up the system. 8051-based chips instead clear this bit in hardware once the RX buffer is empty without a W1C writeback, and software must not clear it. Split rtw_sdio_handle_interrupt() into separate 8051 and 3081 handlers. For 3081, disable interrupts via HIMR, acknowledge all pending status bits via W1C writeback (preserving the existing full status word writeback used on non-RTL8723BS chips, now including REG_SDIO_HISR_RX_REQUEST), service pending events, and re-enable interrupts under irq_lock if still running. If unread packets remain in the FIFO when interrupts are re-enabled (or if new packets arrived), REG_SDIO_HISR_RX_REQUEST remains asserted and re-triggers the IRQ line. For 8051 chips, preserve the existing behavior. Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO ba= sed chipsets") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Alastair D'Silva --- drivers/net/wireless/realtek/rtw88/sdio.c | 73 ++++++++++++++++++----- 1 file changed, 57 insertions(+), 16 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wirele= ss/realtek/rtw88/sdio.c index e318fefe5b5e7..eb1b60a517fb4 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.c +++ b/drivers/net/wireless/realtek/rtw88/sdio.c @@ -1499,6 +1499,58 @@ static void rtw_sdio_rx_isr(struct rtw_dev *rtwdev) } while (total_rx_bytes < SZ_64K && hisr & REG_SDIO_HISR_RX_REQUEST); } =20 +static void rtw_sdio_handle_interrupt_8051(struct rtw_dev *rtwdev, u32 his= r) +{ + if (hisr & REG_SDIO_HISR_TXERR) + rtw_sdio_tx_err_isr(rtwdev); + if (hisr & REG_SDIO_HISR_RX_REQUEST) { + hisr &=3D ~REG_SDIO_HISR_RX_REQUEST; + rtw_sdio_rx_isr(rtwdev); + } + + /* + * RTL8723BS keeps raising the interrupt after resume if undefined + * status bits are written back, so acknowledge only the bits this + * driver defines. Other chips keep the existing behaviour. + */ + if (rtw_is_8723bs(rtwdev)) + hisr &=3D RTW_SDIO_HISR_CLEAR_MASK; + + rtw_write32(rtwdev, REG_SDIO_HISR, hisr); +} + +static void rtw_sdio_handle_interrupt_3081(struct rtw_dev *rtwdev, u32 his= r) +{ + struct rtw_sdio *rtwsdio =3D (struct rtw_sdio *)rtwdev->priv; + + rtw_sdio_disable_interrupt(rtwdev); + + /* + * Acknowledge all pending status bits via W1C writeback. Unlike 8051, + * 3081 requires REG_SDIO_HISR_RX_REQUEST to be explicitly cleared by + * software. + */ + rtw_write32(rtwdev, REG_SDIO_HISR, hisr); + + if (hisr & REG_SDIO_HISR_TXERR) + rtw_sdio_tx_err_isr(rtwdev); + if (hisr & REG_SDIO_HISR_RX_REQUEST) + rtw_sdio_rx_isr(rtwdev); + + /* + * Unmasking HIMR re-asserts the IRQ line if new packets arrived or if + * unread data remains in the RX FIFO (e.g. if the 64KB budget was + * reached or an RX error occurred). On 3081 hardware, clearing + * REG_SDIO_HISR_RX_REQUEST requires both the W1C writeback above and + * an empty RX FIFO, so the bit remains asserted as long as unread + * data is in the buffer and re-triggers the interrupt when unmasked. + */ + scoped_guard(mutex, &rtwsdio->irq_lock) { + if (rtwsdio->running) + rtw_sdio_enable_interrupt(rtwdev); + } +} + static void rtw_sdio_handle_interrupt(struct sdio_func *sdio_func) { struct ieee80211_hw *hw =3D sdio_get_drvdata(sdio_func); @@ -1517,24 +1569,13 @@ static void rtw_sdio_handle_interrupt(struct sdio_f= unc *sdio_func) rtwsdio->irq_thread =3D current; =20 hisr =3D rtw_read32(rtwdev, REG_SDIO_HISR); - - if (hisr & REG_SDIO_HISR_TXERR) - rtw_sdio_tx_err_isr(rtwdev); - if (hisr & REG_SDIO_HISR_RX_REQUEST) { - hisr &=3D ~REG_SDIO_HISR_RX_REQUEST; - rtw_sdio_rx_isr(rtwdev); + if (hisr) { + if (rtw_chip_wcpu_8051(rtwdev)) + rtw_sdio_handle_interrupt_8051(rtwdev, hisr); + else + rtw_sdio_handle_interrupt_3081(rtwdev, hisr); } =20 - /* - * RTL8723BS keeps raising the interrupt after resume if undefined - * status bits are written back, so acknowledge only the bits this - * driver defines. Other chips keep the existing behaviour. - */ - if (rtw_is_8723bs(rtwdev)) - hisr &=3D RTW_SDIO_HISR_CLEAR_MASK; - - rtw_write32(rtwdev, REG_SDIO_HISR, hisr); - rtwsdio->irq_thread =3D NULL; } =20 --=20 2.53.0 From nobody Fri Nov 6 06:27:48 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=119.15.109.137 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793847457; b=4ey9XuYcHupBe4Q3B42ZEqzclW4SrbRS2pk4oQf8CKlT/N9nd4edu2q/b2NT5NjB/Oj5 rxqcsH0MMJuST2iSruWAU6Qf2JAZBNGVStvgNS6hFXJpyZGL8zP16jJEUDM07lCP2oS6E Q/FZ/qE9l1vZz7c8Zc2egp8QmDFQDpov987C4tdC8ebGY366zReKWZms3YqTkCwlsUqPL KYLpyHXB6ioXwdw9OeEmgoqGsG+rXHnNOi5kkQKy+Yzu+CdSQZpYTVWgiPvBOr3R4L7Td UG9cRvailS639umbDOQuNlLqoEysxNdrBtzHh+f8ac6qToO9IR0iG4oEq49z2UlA9Aw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793847457; h=DMARC-Filter:Received:DKIM-Signature:X-GPT-Reason:From:To:Cc:Subject: Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=GHVzZzSaSALrH85AAvCPrCKNFWtUKfUMPlV5DCMbabU=; b=QV06X2vSNe3c2AQIK5FeYl+bSIYP/JO74NZQif5qsAvzKsYLYWWmqoa7i/RbLVDqbNVp kgeYl4EBR8Ionch3rLSy0OEtDz6ZZVZiKF46roAb9bw5BiR+f5Q8jhrNjNcKIMsf/eHBY 8IzGn/nK+RshVP2chKEzcfa41G2BqvqNbVpMu6frsDZGHHSPHtI3hxEbACKlavOVzoyOU X0YKyBb0cnnWkFYVxER4kW1dcYzsMcNA1eqD1hF6x+uj08nn5jBM3DLTx6d3WmctFhYsG IRKzF5WFHKQf16WBHXUAenHFjp9miux+u7Ru46ZhO24f2xYRq1TFnqS1O5YoFsISTcg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=d-silva.org; spf=pass smtp.mailfrom=d-silva.org; dkim=pass header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=hWAJVVP2; arc=none smtp.remote-ip=119.15.109.137 Received: from www.nmnhosting.com (watt.d-silva.org [119.15.109.137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68852606A33A; Thu, 5 Nov 2026 02:57:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 68852606A33A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=d-silva.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=d-silva.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=d-silva.org header.i=@d-silva.org header.a=rsa-sha256 header.s=2025a header.b=hWAJVVP2 Received: from Hawking.lan (hawking.lan [10.0.1.4]) by www.nmnhosting.com (Postfix) with ESMTP id 2A94B41A53; Thu, 5 Nov 2026 13:57:29 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=d-silva.org; s=2025a; t=1793847449; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GHVzZzSaSALrH85AAvCPrCKNFWtUKfUMPlV5DCMbabU=; b=hWAJVVP24JIwgcu1UZ6lnVK37J+8N2MBiWjw7HErrMpqknma72wbXgHBSmZ6qyyxVNrqDr /NnknnNJQN+Qxw84MnMZcUaWNa4KOBsXnQjCce1MmCcQUDsZspeVADLmIuMXPO/yRzCp8e lY5tj7OjGt5s2J9cegHoPsaMubsoOpl+2rnDlJ/0C3cOKI0zRXyAmZKAqyE1zp4Vc4FwLd dOMvhsiSBSJXJbyercvLvtnzqiaEf6BP3ZrHOClwhwqncY5n1xMM9ri5cfHiUarEUSboP1 jB+JAPSzluqw5iODNOg9pbpGPmtn9TMQeOHW4IjTOrW+IgIR4PPRDYfnogXE0g== X-GPT-Reason: This is a legitimate technical communication regarding a Linux kernel patch. The message content perfectly aligns with the personal mailbox of alastair@d-silva.org, follows standard open-source development formatting (signed-off-by, acked-by, and specific technical refactoring details), and contains no marketing, phishing, or scam indicators. The sender domain matches the recipient domain, and there are no suspicious links or urgency tactics. From: Alastair D'Silva To: linux-wireless@vger.kernel.org, Ping-Ke Shih , Kalle Valo Cc: Luka Gejak , Martin Blumenstingl , Jernej Skrabec , Ulf Hansson , linux-kernel@vger.kernel.org, Alastair D'Silva Subject: [PATCH rtw-next v8 4/4] wifi: rtw88: sdio: Split rtw_sdio_rx_isr into 8051 and 3081 variants Date: Thu, 5 Nov 2026 13:57:00 +1100 Message-ID: <20261105025700.1655219-5-alastair@d-silva.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261105025700.1655219-1-alastair@d-silva.org> References: <20261105025700.1655219-1-alastair@d-silva.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Split rtw_sdio_rx_isr() into separate 8051 and 3081 variants to be clear. The two differences between the architectures are: - Register size: REG_SDIO_RX0_REQ_LEN is 16-bit on 8051, 32-bit on 3081. - HISR behavior: 8051 re-reads REG_SDIO_HISR on each iteration, while 3081 drains based on rx_len without re-reading HISR. This is a refactoring without any logic changes. Assisted-by: LLM Acked-by: Ping-Ke Shih Reviewed-by: Luka Gejak Signed-off-by: Alastair D'Silva --- drivers/net/wireless/realtek/rtw88/sdio.c | 58 +++++++++++++---------- 1 file changed, 33 insertions(+), 25 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wirele= ss/realtek/rtw88/sdio.c index eb1b60a517fb4..64d9f6a41660a 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.c +++ b/drivers/net/wireless/realtek/rtw88/sdio.c @@ -1459,17 +1459,13 @@ static int rtw_sdio_rxfifo_recv(struct rtw_dev *rtw= dev, u32 rx_len) return 0; } =20 -static void rtw_sdio_rx_isr(struct rtw_dev *rtwdev) +static void rtw_sdio_rx_isr_8051(struct rtw_dev *rtwdev) { u32 rx_len, hisr, total_rx_bytes =3D 0; int ret; =20 do { - if (rtw_chip_wcpu_8051(rtwdev)) - rx_len =3D rtw_read16(rtwdev, REG_SDIO_RX0_REQ_LEN); - else - rx_len =3D rtw_read32(rtwdev, REG_SDIO_RX0_REQ_LEN); - + rx_len =3D rtw_read16(rtwdev, REG_SDIO_RX0_REQ_LEN); if (!rx_len) break; =20 @@ -1479,33 +1475,45 @@ static void rtw_sdio_rx_isr(struct rtw_dev *rtwdev) =20 total_rx_bytes +=3D rx_len; =20 - if (rtw_chip_wcpu_8051(rtwdev)) { - /* Stop if no more RX requests are pending, even if - * rx_len could be greater than zero in the next - * iteration. This is needed because the RX buffer may - * already contain data while either HW or FW are not - * done filling that buffer yet. Still reading the - * buffer can result in packets where - * rtw_rx_pkt_stat.pkt_len is zero or points beyond the - * end of the buffer. - */ - hisr =3D rtw_read32(rtwdev, REG_SDIO_HISR); - } else { - /* RTW_WCPU_3081 chips have improved hardware or - * firmware and can use rx_len unconditionally. - */ - hisr =3D REG_SDIO_HISR_RX_REQUEST; - } + /* + * Stop if no more RX requests are pending, even if + * rx_len could be greater than zero in the next + * iteration. This is needed because the RX buffer may + * already contain data while either HW or FW are not + * done filling that buffer yet. Still reading the + * buffer can result in packets where + * rtw_rx_pkt_stat.pkt_len is zero or points beyond the + * end of the buffer. + */ + hisr =3D rtw_read32(rtwdev, REG_SDIO_HISR); } while (total_rx_bytes < SZ_64K && hisr & REG_SDIO_HISR_RX_REQUEST); } =20 +static void rtw_sdio_rx_isr_3081(struct rtw_dev *rtwdev) +{ + u32 rx_len, total_rx_bytes =3D 0; + int ret; + + do { + rx_len =3D rtw_read32(rtwdev, REG_SDIO_RX0_REQ_LEN); + if (!rx_len) + break; + + ret =3D rtw_sdio_rxfifo_recv(rtwdev, rx_len); + if (ret) + break; + + total_rx_bytes +=3D rx_len; + } while (total_rx_bytes < SZ_64K); +} + static void rtw_sdio_handle_interrupt_8051(struct rtw_dev *rtwdev, u32 his= r) { if (hisr & REG_SDIO_HISR_TXERR) rtw_sdio_tx_err_isr(rtwdev); if (hisr & REG_SDIO_HISR_RX_REQUEST) { hisr &=3D ~REG_SDIO_HISR_RX_REQUEST; - rtw_sdio_rx_isr(rtwdev); + rtw_sdio_rx_isr_8051(rtwdev); } =20 /* @@ -1535,7 +1543,7 @@ static void rtw_sdio_handle_interrupt_3081(struct rtw= _dev *rtwdev, u32 hisr) if (hisr & REG_SDIO_HISR_TXERR) rtw_sdio_tx_err_isr(rtwdev); if (hisr & REG_SDIO_HISR_RX_REQUEST) - rtw_sdio_rx_isr(rtwdev); + rtw_sdio_rx_isr_3081(rtwdev); =20 /* * Unmasking HIMR re-asserts the IRQ line if new packets arrived or if --=20 2.53.0