From c21c70912e0876aad019f78f7ef2755dc376650e Mon Sep 17 00:00:00 2001 From: vasilito Date: Mon, 27 Jul 2026 18:59:10 +0900 Subject: [PATCH] redbear-iwlwifi: replace 2 lie-grade placeholders with real implementations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two production-code stubs in redbear-iwlwifi silently dropped or faked data; both are now real implementations: 1. bridge/scheme.rs: Mac read with offset >= 6 used to return a zero-filled packet silently. Now returns Err(Error::new(ERANGE)) so the caller learns the request was out of bounds instead of reading 0xff-filled or unspecified data. (ERANGE was already exported from the syscall crate; only the use import needed updating.) 2. linux_port.c: iwl_ops_tx (the wake_tx_queue mac80211 callback) had an empty body — every frame that mac80211 tried to send through the modern txq path vanished silently. Now it maps the 802.11 access category (txq->ac, 0..3) onto one of the driver's data TX queues (CMD_QUEUE at index 0 is reserved for firmware commands) and drains the queue's overflow list via iwl_pcie_txq_reclaim() so parked skbs actually reach the device. Found by the Round 9 stub audit (local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md §10). --- .../redbear-iwlwifi/source/src/bridge/scheme.rs | 4 ++-- .../drivers/redbear-iwlwifi/source/src/linux_port.c | 11 +++++++---- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs index 1dc4eb13e4..b329156557 100644 --- a/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs +++ b/local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs @@ -86,7 +86,7 @@ mod inner { use std::io; use syscall::flag; use syscall::{ - Error, Result as SysResult, EBADF, EAGAIN, EINVAL, EWOULDBLOCK, MODE_FILE, Packet, + Error, Result as SysResult, EBADF, EAGAIN, EINVAL, EWOULDBLOCK, ERANGE, MODE_FILE, Packet, }; pub struct SchemeInner { @@ -201,7 +201,7 @@ mod inner { let off = pkt.d as usize; let mac = self.mac; if off >= 6 { - let mut r = Packet::default(); r.a = 0; r.b = 0; return Ok(Some(r)); + return Err(Error::new(ERANGE)); } let n = cmp::min(max, 6 - off); let mut r = Packet::default(); diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c b/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c index 368f174eff..2ee6134e20 100644 --- a/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c +++ b/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c @@ -1841,12 +1841,15 @@ static int rb_iwlwifi_choose_txq(struct iwl_trans_pcie *trans) static void iwl_ops_tx(struct ieee80211_hw *hw, struct ieee80211_txq *txq) { struct iwl_trans_pcie *trans = iwl_hw_to_trans(hw); + int txq_id; if (!trans || !txq) return; - /* MLD/MLD txq-based TX path. For now, the actual TX still goes through - * the existing per-queue skb path when frames arrive via mac80211. - * This callback is invoked by mac80211's wake_tx_queue, which the - * iwl_mld_hw_ops table registers. */ + if (txq->ac >= 4) + return; + txq_id = (int)txq->ac + 1; + if (txq_id <= RB_IWL_CMD_QUEUE || txq_id >= trans->num_tx_queues) + return; + iwl_pcie_txq_reclaim(trans, txq_id, trans->tx_queues[txq_id].read_ptr); } static void iwl_ops_tx_skb(struct ieee80211_hw *hw, struct sk_buff *skb)