Merge pull request #99 from lucaskawatoko/fix/rwnx-close-spurious-warn

fix: avoid spurious WARN in rwnx_close during USB teardown

OPENWRT.md

@@ -0,0 +1,67 @@
+# Building with OpenWrt backports
+
+OpenWrt's target kernel and wireless stack can have different versions.
+For example, [issue #94](https://github.com/shenmintao/aic8800d80/issues/94)
+uses Linux **6.12.94** with **backports 6.18.26** on OpenWrt 25.12.5.
+The Ubuntu build host's kernel version is not used to select these APIs.
+
+## Package Makefile
+
+Pass `CFG80211_VERSION=6.18.26` to the kernel make invocation for that
+combination. Use the `PKG_VERSION` from your OpenWrt
+`package/kernel/mac80211/Makefile`, in `major.minor.patch` format. Keep the
+backports include paths and symbol versions from the same build:
+
+```make
+NOSTDINC_FLAGS := \
+	$(KERNEL_NOSTDINC_FLAGS) \
+	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
+	-I$(STAGING_DIR)/usr/include/mac80211-backport \
+	-I$(STAGING_DIR)/usr/include/mac80211/uapi \
+	-I$(STAGING_DIR)/usr/include/mac80211 \
+	-include backport/backport.h
+
+define Build/Compile
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
+		M="$(PKG_BUILD_DIR)/drivers/aic8800" \
+		KBUILD_EXTRA_SYMBOLS="$(LINUX_DIR)/../symvers/mac80211.symvers" \
+		NOSTDINC_FLAGS="$(NOSTDINC_FLAGS)" \
+		CFG80211_VERSION=6.18.26 \
+		modules
+endef
+```
+
+The package must depend on `kmod-cfg80211` so its headers and symbol versions
+are staged before this driver is built. Keep any additional dependencies,
+firmware installation rules and module packaging rules your device needs.
+Update the package's pinned source revision to one containing this fix, or
+apply the fix as an OpenWrt package patch, then clean and rebuild the package:
+
+```sh
+make package/kernel/aic8800d80/clean
+make package/kernel/aic8800d80/compile V=sc -j1
+```
+
+Changing `CFG80211_VERSION` alone does not update the driver source or the
+wireless headers. The value must match the actual wireless stack; do not set
+it to the host kernel version or redefine `LINUX_VERSION_CODE`.
+
+## Compatibility scope
+
+The override selects the wireless API changes since Linux 6.12, including
+monitor-channel callbacks, radio/link arguments, radar notifications and
+newer cfg80211 callbacks. Timer, USB, memory-management and module namespace
+checks continue to use the target kernel version. Older target kernels with
+newer backports may need additional wireless API adaptations.
+
+Leave `CFG80211_VERSION` unset when building against the kernel's own wireless
+stack, as on a regular Ubuntu/Debian installation. The driver then uses the
+kernel version as before. Hardware revision still determines whether to use
+`main` or `legacy-mcu1`; a wireless API mismatch does not change that choice.
+
+The feeds/Kconfig duplicate definitions and recursive dependencies also
+reported in issue #94 belong to the OpenWrt build configuration and require
+separate investigation.
+
+See the [build regression recipe](tests/openwrt-backports/README.md) for
+the tested kernel/backports combinations and a script to repeat the build.

README.md

@@ -21,13 +21,11 @@ Added support for devices with Vendor ID 368B (tested).
 Tested on Linux kernel 6.16 with Ubuntu 25.04 and 6.1.0.27 with Debian 12.
 
 > [!NOTE]
-> **Bluetooth branch retirement:** The separate
+> **Maintained branches:** This repository now maintains two hardware branches:
-> [`bluetooth`](https://github.com/shenmintao/aic8800d80/tree/bluetooth) branch
+> `main` for `chip_mcu_id=0` or an unknown MCU revision, and `legacy-mcu1` for
-> is deprecated and is being kept only during the migration period. This
+> `chip_mcu_id=1`. Wi-Fi, the kernel's standard `btusb` Bluetooth path, and the
-> branch is the unified candidate for promotion to `main` in
+> device-scoped ZLP support are integrated into both branches. The former
-> [PR #73](https://github.com/shenmintao/aic8800d80/pull/73). After hardware
+> separate `bluetooth` branch is retired and should no longer be used.
-> validation and promotion, the separate `bluetooth` branch will be removed.
-> MCU1 hardware must use `legacy-mcu1`.
 
 The same driver supports Wi-Fi-only adapters and Wi-Fi/Bluetooth combo
 adapters. On combo devices, `aic_load_fw` uploads the AIC firmware and the
@@ -47,8 +45,32 @@ I did not develop this software, The code is sourced from the Tenda U11 driver.
 ### Attention
 Before installing the driver, delete all aic8800-related folders under /lib/firmware. Using an incorrect firmware version may cause the system to freeze.
 
+#### Pandora 88M80 mode switching
+
+Pandora 88M80 adapters that initially appear as USB device `1111:1111` are
+automatically switched to `a69c:8d80` by sending the required `F3` then `F2`
+commands. Existing users must rerun `sudo ./install.sh` to replace the installed
+usb_modeswitch configuration, then unplug the adapter completely and plug it
+back in.
+
+If automatic switching does not occur, try the same sequence manually:
+
+```bash
+sudo usb_modeswitch -v 1111 -p 1111 \
+  -M "555342438765432100000000000010fd0000000000000000000000000000f3" \
+  -2 "555342438765432100000000000010fd0000000000000000000000000000f2"
+```
+
+This only addresses switching from `1111:1111` to `a69c:8d80`. If the device
+has reached `a69c:8d80` but firmware startup still fails, see
+[issue #79](https://github.com/shenmintao/aic8800d80/issues/79).
+
 ### Installation Steps
 
+For OpenWrt SDK/buildroot builds, see [OpenWrt build notes](OPENWRT.md).
+OpenWrt can use a newer cfg80211 backport than its target kernel; these builds
+must pass the wireless stack version separately.
+
 #### Method 1: [Quick Installation](INSTALL_SCRIPT.md) (Recommended)
 
 #### Method 2: Manual Installation

aic.rules

@@ -1,5 +1,6 @@
 # AIC8800 USB mass-storage mode switch rules
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5721",  SYMLINK+="aicudisk", RUN+="/usr/bin/eject /dev/%k"
+KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5722",  SYMLINK+="aicudisk", RUN+="/usr/bin/eject /dev/%k"
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5723",  SYMLINK+="tendaudisk", RUN+="/usr/bin/eject /dev/%k"
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5724",  SYMLINK+="ugreenax900", RUN+="/usr/bin/eject /dev/%k"
 KERNEL=="sd*", ATTRS{idVendor}=="a69c", ATTRS{idProduct}=="5725",  SYMLINK+="tendaudiskv2", RUN+="/usr/bin/eject /dev/%k"

bazzite/aic8800d80.spec

@@ -1,9 +1,14 @@
-%global commit 13baa9b0b1692f94233bcf6e752060b408062026
+%global commit 3e9a02549bc98d350bff1e0fb0501f841f9d8e55
 %global shortcommit %(echo %{commit} | cut -c1-7)
+%global snapdate 20260924
+%global debug_package %{nil}
 %{!?kver:%global kver %(uname -r)}
 
 Name:           aic8800d80
-Version:        %{shortcommit}
+# Versions before 2026-09-24 were bare commit hashes, which rpm does not
+# order by commit history. Epoch 1 sorts every snapshot version after them.
+Epoch:          1
+Version:        1.0.0^%{snapdate}git%{shortcommit}
 Release:        1%{?dist}
 Summary:        AIC8800 USB Wi-Fi, Bluetooth firmware, and ZLP quirk driver
 
@@ -17,7 +22,7 @@ BuildRequires:  kernel-devel-uname-r = %{kver}
 
 Requires:       kernel-uname-r = %{kver}
 Requires:       /usr/bin/eject
-Requires:       /usr/sbin/usb_modeswitch
+Requires:       usb_modeswitch
 Requires(post): /usr/sbin/depmod
 Requires(postun): /usr/sbin/depmod
 
@@ -77,6 +82,25 @@ cp -a fw/aic8800* %{buildroot}/usr/lib/firmware/
 /usr/lib/firmware/aic8800*
 
 %changelog
+* Thu Sep 24 2026 Shen Mintao <shenmintao@gmail.com> - 1:1.0.0^20260924git3e9a025-1
+- Version snapshots as 1.0.0^<date>git<commit> with Epoch 1. The previous
+  commit-hash versions do not sort in commit order, so rpm could treat a
+  newer snapshot as an older package.
+
+* Thu Sep 24 2026 Shen Mintao <shenmintao@gmail.com> - 3e9a025-1
+- Build the current main branch, which adds the Linux 7.1+ TDLS discovery
+  response length fix, the SUN60IW2P1 USB transfer settings, OpenWrt
+  cfg80211 backport version handling and the 6.12 stable
+  set_monitor_channel() fix.
+
+* Fri Aug 21 2026 Heyde Moura <moura.heyde@gmail.com> - e93a7d2-1
+- Build the current main branch, which carries the Linux 7.2 cfg80211 and
+  strncpy() fixes needed to compile on Bazzite 44.
+
+* Tue Jul 28 2026 ccyuen1 - 13baa9b-2
+- Disable automatic creation of debuginfo packages to fix issue #77.
+- Require usb_modeswitch as package dependency instead of file dependency to fix issue #77.
+
 * Sat Jul 25 2026 Shen Mintao <shenmintao@gmail.com> - 13baa9b-1
 - Unify Wi-Fi and standard-btusb Bluetooth support in one package.
 - Add the device-scoped 368b:8d81 ACL bulk TX ZLP companion module.

drivers/aic8800/Makefile

@@ -61,8 +61,6 @@ endif
 
 ###########################################
 
-MAKEFLAGS +=-j$(shell nproc)
-
 KERNEL_AUTOCONF := $(KDIR)/include/config/auto.conf
 KERNEL_CONFIG := $(KDIR)/.config
 KERNEL_CC_IS_CLANG := $(shell if [ -r "$(KERNEL_AUTOCONF)" ] && grep -q '^CONFIG_CC_IS_CLANG=y' "$(KERNEL_AUTOCONF)"; then echo y; elif [ -r "$(KERNEL_CONFIG)" ] && grep -q '^CONFIG_CC_IS_CLANG=y' "$(KERNEL_CONFIG)"; then echo y; fi)

drivers/aic8800/aic8800_fdrv/Makefile

@@ -2,6 +2,16 @@ EXTRA_CFLAGS += $(USER_EXTRA_CFLAGS)
 EXTRA_CFLAGS += -Wno-implicit-fallthrough
 #EXTRA_CFLAGS += -Wno-unused-variable
 
+# OpenWrt may build a newer cfg80211 backport on an older kernel.
+# Set this to the wireless stack's version, e.g. CFG80211_VERSION=6.18.26.
+ifneq ($(strip $(CFG80211_VERSION)),)
+aicwf_cfg80211_version := $(subst ., ,$(CFG80211_VERSION))
+ifneq ($(words $(aicwf_cfg80211_version)),3)
+$(error CFG80211_VERSION must have the form major.minor.patch)
+endif
+ccflags-y += '-DAICWF_CFG80211_VERSION_CODE=KERNEL_VERSION($(word 1,$(aicwf_cfg80211_version)),$(word 2,$(aicwf_cfg80211_version)),$(word 3,$(aicwf_cfg80211_version)))'
+endif
+
 RWNX_VERS_NUM := 6.4.3.0
 
 CONFIG_AIC8800_WLAN_SUPPORT = m
@@ -74,7 +84,11 @@ CONFIG_VHT_FOR_OLD_KERNEL = n
 CONFIG_COEX = y
 CONFIG_ALIGN_8BYTES = y
 CONFIG_TXRX_THREAD_PRIO = y
+ifdef CONFIG_ARCH_SUN60IW2P1
+CONFIG_USB_ALIGN_DATA = n
+else
 CONFIG_USB_ALIGN_DATA = y
+endif
 CONFIG_RX_TASKLET = n
 CONFIG_TX_TASKLET = n
 CONFIG_RX_NETIF_RECV_SKB = y
@@ -88,7 +102,11 @@ CONFIG_WOWLAN ?= n
 CONFIG_USB_RX_AGGR = n
 CONFIG_USB_TX_AGGR = n
 
+ifdef CONFIG_ARCH_SUN60IW2P1
+CONFIG_USB_NO_TRANS_DMA_MAP = y
+else
 CONFIG_USB_NO_TRANS_DMA_MAP = n
+endif
 CONFIG_GPIO_WAKEUP = n
 CONFIG_CREATE_TRACE_POINTS = n
 CONFIG_SUPPORT_REALTIME_CHANGE_MAC = y
@@ -154,7 +172,7 @@ CONFIG_RWNX_BCMC ?= y
 
 # Enable Monitor+Data interface support (need FW support)
 CONFIG_RWNX_MON_DATA =n
-CONFIG_RWNX_MON_XMIT ?= n
+CONFIG_RWNX_MON_XMIT ?= y
 CONFIG_RWNX_MON_RXFILTER ?= n
 
 CONFIG_FILTER_TCP_ACK =y
@@ -349,8 +367,6 @@ ccflags-$(CONFIG_TEMP_CONTROL) += -DCONFIG_TEMP_CONTROL
 ccflags-$(CONFIG_POWER_LIMIT) += -DCONFIG_POWER_LIMIT
 ccflags-$(CONFIG_EXT_FEM_8800DCDW) += -DCONFIG_EXT_FEM_8800DCDW
 ccflags-$(CONFIG_WOWLAN) += -DCONFIG_WOWLAN
-MAKEFLAGS +=-j$(shell nproc)
-
 # Platform support list
 CONFIG_PLATFORM_ROCKCHIP ?= n
 CONFIG_PLATFORM_ALLWINNER ?= n

drivers/aic8800/aic8800_fdrv/aic_priv_cmd.c

@@ -1832,7 +1832,7 @@ void set_vendor_extension_ie(char *command){
 
 }
 #endif//CONFIG_SET_VENDOR_EXTENSION_IE
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy, struct net_device *dev,
                                              struct cfg80211_chan_def *chandef);
 #else
@@ -1840,7 +1840,7 @@ int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                              struct cfg80211_chan_def *chandef);
 #endif
 int rwnx_atoi2(char *value, int c_len);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 void set_mon_chan(struct rwnx_vif *vif, struct net_device *dev, char *parameter)
 #else
 void set_mon_chan(struct rwnx_vif *vif, char *parameter)
@@ -1867,7 +1867,7 @@ void set_mon_chan(struct rwnx_vif *vif, char *parameter)
     chandef->center_freq1 = chandef->chan->center_freq;
     chandef->center_freq2 = 0;
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
     rwnx_cfg80211_set_monitor_channel_(vif->rwnx_hw->wiphy, dev, chandef);
 #else
     rwnx_cfg80211_set_monitor_channel_(vif->rwnx_hw->wiphy, chandef);
@@ -2136,7 +2136,7 @@ int android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
 	    char *set_parameter;
         skip = strlen(CMD_SET_MON_FREQ) + 1;
 		set_parameter = command + skip;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 	    set_mon_chan(vif, net, set_parameter);
 #else
 	    set_mon_chan(vif, set_parameter);

drivers/aic8800/aic8800_fdrv/aic_priv_cmd.h

@@ -62,7 +62,7 @@ int get_cs_info(struct rwnx_vif *vif, u8 *mac_addr, u8 *val);
 unsigned int command_strtoul(const char *cp, char **endp, unsigned int base);
 int str_starts(const char *str, const char *start);
 int handle_private_cmd(struct net_device *net, char *command, u32 cmd_len);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 void set_mon_chan(struct rwnx_vif *vif, struct net_device *dev, char *parameter);
 #else
 void set_mon_chan(struct rwnx_vif *vif, char *parameter);

drivers/aic8800/aic8800_fdrv/aicwf_compat_8800d80.c

@@ -40,7 +40,8 @@ int	rwnx_plat_userconfig_load_8800d80(struct rwnx_hw *rwnx_hw){
     char *filename = FW_USERCONFIG_NAME_8800D80;
 
 #ifndef ANDROID_PLATFORM
-            sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800D80");
+            if (strlcat(aic_fw_path, "/aic8800D80", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+                return -ENAMETOOLONG;
 #endif
 
     AICWFDBG(LOGINFO, "userconfig file path:%s \r\n", filename);

drivers/aic8800/aic8800_fdrv/aicwf_compat_8800d80x2.c

@@ -41,7 +41,8 @@ int	rwnx_plat_userconfig_load_8800d80x2(struct rwnx_hw *rwnx_hw){
     char *filename = FW_USERCONFIG_NAME_8800D80X2;
 
 #ifndef ANDROID_PLATFORM
-    sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800D80X2");
+    if (strlcat(aic_fw_path, "/aic8800D80X2", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+        return -ENAMETOOLONG;
 #endif
 
     AICWFDBG(LOGINFO, "userconfig file path:%s \r\n", filename);

drivers/aic8800/aic8800_fdrv/aicwf_usb.c

@@ -297,18 +297,6 @@ static void aicwf_usb_rx_complete(struct urb *urb)
         aicwf_usb_rx_buf_put(usb_dev, usb_buf);
         if(urb->status < 0){
             AICWFDBG(LOGDEBUG, "%s urb->status:%d \r\n", __func__, urb->status);
-
-            if(g_rwnx_plat->wait_disconnect_cb == false){
-                g_rwnx_plat->wait_disconnect_cb = true;
-                if(atomic_read(&aicwf_deinit_atomic) > 0){
-                    atomic_set(&aicwf_deinit_atomic, 0);
-                    down(&aicwf_deinit_sem);
-                    AICWFDBG(LOGINFO, "%s need to wait for disconnect callback \r\n", __func__);
-                }else{
-                    g_rwnx_plat->wait_disconnect_cb = false;
-                }
-            }
-
             return;
         }else{
             //schedule_work(&usb_dev->rx_urb_work);
@@ -385,18 +373,6 @@ static void aicwf_usb_rx_complete(struct urb *urb)
         aicwf_usb_rx_buf_put(usb_dev, usb_buf);
 		if(urb->status < 0){
 			AICWFDBG(LOGDEBUG, "%s urb->status:%d \r\n", __func__, urb->status);
-
-			if(g_rwnx_plat->wait_disconnect_cb == false){
-				g_rwnx_plat->wait_disconnect_cb = true;
-				if(atomic_read(&aicwf_deinit_atomic) > 0){
-					atomic_set(&aicwf_deinit_atomic, 0);
-					down(&aicwf_deinit_sem);
-					AICWFDBG(LOGINFO, "%s need to wait for disconnect callback \r\n", __func__);
-				}else{
-					g_rwnx_plat->wait_disconnect_cb = false;
-				}
-			}
-
 			return;
 		}else{
 			//schedule_work(&usb_dev->rx_urb_work);
@@ -1979,10 +1955,6 @@ static void aicwf_usb_bus_stop(struct device *dev)
     if (usb_dev->state == USB_DOWN_ST)
         return;
 
-    if(g_rwnx_plat && g_rwnx_plat->wait_disconnect_cb == true){
-        atomic_set(&aicwf_deinit_atomic, 1);
-        up(&aicwf_deinit_sem);
-    }
     aicwf_usb_state_change(usb_dev, USB_DOWN_ST);
     //aicwf_usb_cancel_all_urbs(usb_dev);//AIDEN
 }
@@ -2341,7 +2313,8 @@ static int aicwf_usb_chipmatch(struct aic_usb_dev *usb_dev, u16_l vid, u16_l pid
 		usb_dev->chipid = PRODUCT_ID_AIC8801;
 		AICWFDBG(LOGINFO, "%s USE AIC8801\r\n", __func__);
 		return 0;
-	}else if(pid == USB_PRODUCT_ID_AIC8800DC || pid == USB_PRODUCT_ID_TENDA
+	}else if(pid == USB_PRODUCT_ID_AIC8800DC || pid == USB_PRODUCT_ID_AIC8800DE
+		|| pid == USB_PRODUCT_ID_TENDA
 		|| pid == USB_PRODUCT_ID_TENDA_U2  || pid == USB_PRODUCT_ID_AIC8800FC_CUS1
 		|| pid == USB_PRODUCT_ID_AIC8800FC_CUS2 || pid == USB_PRODUCT_ID_AIC8800FC_CUS3
 		|| pid == USB_PRODUCT_ID_AIC8800FC_CUS4 || pid == USB_PRODUCT_ID_AIC8800FC_CUS5
@@ -2360,7 +2333,8 @@ static int aicwf_usb_chipmatch(struct aic_usb_dev *usb_dev, u16_l vid, u16_l pid
 		|| pid == USB_PRODUCT_ID_AIC8800M80_CUS3 || pid == USB_PRODUCT_ID_AIC8800M80_CUS4
 		|| pid == USB_PRODUCT_ID_AIC8800M80_CUS5 || pid == USB_PRODUCT_ID_AIC8800M80_CUS6
 		|| pid == USB_PRODUCT_ID_AIC8800M80_CUS7 || pid == USB_PRODUCT_ID_AIC8800M80_CUS8
-        || pid == USB_PRODUCT_ID_AIC8800D80_UGREEN || pid == USB_PRODUCT_ID_MERCURY){
+        || pid == USB_PRODUCT_ID_AIC8800D80_UGREEN || pid == USB_PRODUCT_ID_MERCURY
+        || pid == USB_PRODUCT_ID_TP){
         usb_dev->chipid = PRODUCT_ID_AIC8800D81;
         aicwf_usb_rx_aggr = true;
         AICWFDBG(LOGINFO, "%s USE AIC8800D81\r\n", __func__);
@@ -2670,6 +2644,7 @@ static struct usb_device_id aicwf_usb_id_table[] = {
     {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800D81, 0xff, 0xff, 0xff)},
     {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800D41, 0xff, 0xff, 0xff)},
     {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800DC, 0xff, 0xff, 0xff)},
+    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800DE, 0xff, 0xff, 0xff)},
     {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_TENDA_V2, USB_PRODUCT_ID_TENDA_TX1U_NANO, 0xff, 0xff, 0xff)},
     {USB_DEVICE(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800DW)},
     {USB_DEVICE(USB_VENDOR_ID_AIC, USB_PRODUCT_ID_AIC8800M80_CUS1)},
@@ -2705,6 +2680,7 @@ static struct usb_device_id aicwf_usb_id_table[] = {
     {USB_DEVICE(USB_VENDOR_ID_AIC_V2, USB_PRODUCT_ID_AIC8800M80_CUS8)},
     {USB_DEVICE(USB_VENDOR_ID_AIC_V2, USB_PRODUCT_ID_AIC8800D80_UGREEN)},
     {USB_DEVICE(USB_VENDOR_ID_TP, USB_PRODUCT_ID_MERCURY)},
+    {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_TP, USB_PRODUCT_ID_TP, 0xff, 0xff, 0xff)},
 #endif
     {}
 };

drivers/aic8800/aic8800_fdrv/aicwf_usb.h

@@ -38,6 +38,7 @@
 #else
 #define USB_PRODUCT_ID_AIC8801          0x8801
 #define USB_PRODUCT_ID_AIC8800DC        0x88dc
+#define USB_PRODUCT_ID_AIC8800DE        0x88de
 #define USB_PRODUCT_ID_AIC8800DW        0x88dd
 #define USB_PRODUCT_ID_AIC8800D81       0x8d81
 #define USB_PRODUCT_ID_AIC8800D41       0x8d41

drivers/aic8800/aic8800_fdrv/rwnx_compat.h

@@ -23,6 +23,33 @@
 #define _RWNX_COMPAT_H_
 #include <linux/version.h>
 
+/* Keep wireless API checks separate from timer, USB and other kernel APIs. */
+#ifndef AICWF_CFG80211_VERSION_CODE
+#define AICWF_CFG80211_VERSION_CODE LINUX_VERSION_CODE
+#endif
+
+/*
+ * cfg80211_ops.set_monitor_channel() gained a "struct net_device *dev"
+ * parameter. The change went into mainline 6.13, but it was also
+ * backported to the 6.12 stable series starting with 6.12.101, so a
+ * plain ">= 6.13.0" test misses 6.12.101 and later. Those kernels then
+ * compile against the old prototype, which is fatal with
+ * -Wincompatible-pointer-types:
+ *
+ *   rwnx_main.c: error: initialization of
+ *     'int (*)(struct wiphy *, struct net_device *, struct cfg80211_chan_def *)'
+ *     from incompatible pointer type
+ *     'int (*)(struct wiphy *, struct cfg80211_chan_def *)'
+ *
+ * Debian 13 (6.12.107) is one such kernel. The 6.12.101 threshold
+ * covers both the backport and mainline, and leaves 6.11 and earlier
+ * 6.12.x on the old prototype. Keep the check in one place so every
+ * consumer stays in sync.
+ */
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 101)
+#define AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
+#endif
+
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
 #error "Minimum kernel version supported is 3.10"
 #endif

drivers/aic8800/aic8800_fdrv/rwnx_defs.h

@@ -335,6 +335,12 @@ struct apm_probe_sta {
        u8 sta_mac_addr[6];
        u8 vif_idx;
        u64 probe_id;
+       /*
+        * 7.3+ only: the cookie cfg80211_ops::probe_peer() was called with,
+        * echoed back via cfg80211_probe_status() once the probe completes.
+        * See rwnx_cfg80211_probe_client().
+        */
+       u64 cookie;
        struct work_struct apmprobestaWork;
        struct workqueue_struct *apmprobesta_wq;
 };
@@ -675,6 +681,16 @@ struct rwnx_roc_elem {
     bool mgmt_roc;
     /* Indicate if we have switch on the RoC channel */
     bool on_chan;
+    /*
+     * The cookie reported to cfg80211 for this RoC, via
+     * cfg80211_ready_on_channel() / cfg80211_remain_on_channel_expired().
+     * On 7.3+, for a RoC started directly by cfg80211_ops::remain_on_channel(),
+     * this is the cookie cfg80211 pre-assigned; on every older kernel, and
+     * always for the purely-internal RoC started from inside mgmt_tx, it is
+     * rwnx_hw->roc_cookie_cnt at RoC-start time. See
+     * rwnx_cfg80211_remain_on_channel_().
+     */
+    u64 cookie;
 };
 
 /* Structure containing channel survey information received from MAC */

drivers/aic8800/aic8800_fdrv/rwnx_main.c

@@ -1518,6 +1518,17 @@ static int rwnx_close(struct net_device *dev)
 
     RWNX_DBG(RWNX_FN_ENTRY_STR);
 
+    /*
+     * A CONNECTING/DISCONNECTING state is only left when the firmware answers
+     * the pending request. If the bus is already down the answer can never
+     * arrive: rwnx_send_msg() silently drops the message and returns 0
+     * (rwnx_msg_tx.c), so the wait below would always run its full timeout and
+     * fire the spurious WARN_ON() during USB teardown. Skip the wait when the
+     * bus is down, using the same condition the vif_started path uses below.
+     */
+    if (bus_if &&
+        (usbdev == NULL || (usbdev->bus_if->state != BUS_DOWN_ST &&
+                            usbdev->state != USB_DOWN_ST))) {
         test_counter = waiting_counter;
         while(atomic_read(&rwnx_vif->drv_conn_state) == (int)RWNX_DRV_STATUS_DISCONNECTING||
             atomic_read(&rwnx_vif->drv_conn_state) == (int)RWNX_DRV_STATUS_CONNECTING){
@@ -1530,6 +1541,7 @@ static int rwnx_close(struct net_device *dev)
                 break;
             }
         }
+    }
 
 #if defined(AICWF_USB_SUPPORT) || defined(AICWF_SDIO_SUPPORT)
     if (rwnx_hw->scanning){
@@ -1587,6 +1599,10 @@ static int rwnx_close(struct net_device *dev)
 			test_counter = waiting_counter;
 			if(atomic_read(&rwnx_vif->drv_conn_state) == (int)RWNX_DRV_STATUS_CONNECTED){
 				rwnx_set_conn_state(rwnx_vif, &rwnx_vif->drv_conn_state, RWNX_DRV_STATUS_DISCONNECTING);
+				/* Same reasoning as above: with the bus down the disconnect
+				 * confirmation cannot arrive, so do not wait for it. */
+				if (usbdev->bus_if->state != BUS_DOWN_ST &&
+				    usbdev->state != USB_DOWN_ST) {
 					rwnx_send_sm_disconnect_req(rwnx_hw, rwnx_vif, 3);
 					while (atomic_read(&rwnx_vif->drv_conn_state) == (int)RWNX_DRV_STATUS_DISCONNECTING) {
 						AICWFDBG(LOGDEBUG, "%s wifi is disconnecting, waiting 100ms for state to stable\r\n", __func__);
@@ -1597,6 +1613,7 @@ static int rwnx_close(struct net_device *dev)
 					}
 				}
 			}
+		}
 #ifdef CONFIG_USE_P2P0
         if(!rwnx_vif->is_p2p_vif || ( rwnx_vif->is_p2p_vif && rwnx_hw->is_p2p_alive)){
 			if (rwnx_vif->is_p2p_vif)
@@ -2942,7 +2959,7 @@ bool key_flag = false;
  *	when adding a group key.
  */
 static int rwnx_cfg80211_add_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                  struct wireless_dev *wdev,
 #else
                                  struct net_device *netdev,
@@ -2954,7 +2971,7 @@ static int rwnx_cfg80211_add_key(struct wiphy *wiphy,
                                  struct key_params *params)
 {
     struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *vif = netdev_priv(netdev);
@@ -3066,7 +3083,7 @@ static int rwnx_cfg80211_add_key(struct wiphy *wiphy,
  *
  */
 static int rwnx_cfg80211_get_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                  struct wireless_dev *wdev,
 #else
                                  struct net_device *netdev,
@@ -3090,7 +3107,7 @@ static int rwnx_cfg80211_get_key(struct wiphy *wiphy,
  *	and @key_index, return -ENOENT if the key doesn't exist.
  */
 static int rwnx_cfg80211_del_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                  struct wireless_dev *wdev,
 #else
                                  struct net_device *netdev,
@@ -3102,7 +3119,7 @@ static int rwnx_cfg80211_del_key(struct wiphy *wiphy,
                                  u8 key_index, bool pairwise, const u8 *mac_addr)
 {
     struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *vif = netdev_priv(netdev);
@@ -3154,7 +3171,7 @@ static int rwnx_cfg80211_set_default_key(struct wiphy *wiphy,
  * @set_default_mgmt_key: set the default management frame key on an interface
  */
 static int rwnx_cfg80211_set_default_mgmt_key(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                               struct wireless_dev *wdev,
 #else
                                               struct net_device *netdev,
@@ -3249,7 +3266,7 @@ static int rwnx_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
         key_params.seq_len = 0;
         key_params.cipher = sme->crypto.cipher_group;
         rwnx_cfg80211_add_key(wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                               &rwnx_vif->wdev,
 #else
                               dev,
@@ -3480,7 +3497,7 @@ static int rwnx_cfg80211_external_auth(struct wiphy *wiphy, struct net_device *d
  * @add_station: Add a new station.
  */
 static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct wireless_dev *wdev,
 #else
 	struct net_device *dev,
@@ -3493,7 +3510,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
 	struct station_parameters *params)
 {
     struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -3589,7 +3606,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
                 sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
                 #endif
 		        cfg80211_new_sta(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                         &rwnx_vif->wdev,
 #else
                         rwnx_vif->ndev,
@@ -3620,7 +3637,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
                 (params->sta_flags_set & BIT(NL80211_STA_FLAG_##f) ? "["#f"]" : "")
 
             netdev_info(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                         wdev->netdev,
 #else
                         dev,
@@ -3651,7 +3668,7 @@ static int rwnx_cfg80211_add_station(struct wiphy *wiphy,
  * @del_station: Remove a station
  */
 static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                             struct wireless_dev *wdev,
 #else
                                             struct net_device *dev,
@@ -3666,7 +3683,7 @@ static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
 )
 {
     struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -3711,7 +3728,7 @@ static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
 
 		if(found) {
 			netdev_info(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                     wdev->netdev,
 #else
                     dev,
@@ -3731,7 +3748,7 @@ static int rwnx_cfg80211_del_station_compat(struct wiphy *wiphy,
 			}
 			if (rwnx_vif->wdev.iftype == NL80211_IFTYPE_AP || rwnx_vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) {
 				cfg80211_del_sta(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
 						&rwnx_vif->wdev,
 #else
 						rwnx_vif->ndev,
@@ -3940,7 +3957,21 @@ void apm_probe_sta_work_process(struct work_struct *work)
 	   spin_unlock_bh(&rwnx_vif->rwnx_hw->cb_lock);
 
        printk("sta %pM found = %d\n", mac, found);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+       /*
+        * 7.3 added an MLO link_id parameter between cookie and acked. This
+        * driver has no MLO support, and -1 is the documented value for
+        * "non-MLO" (see the cfg80211_probe_status() kerneldoc). The cookie
+        * source also changes here: sta_probe.cookie is the value cfg80211
+        * pre-assigned via probe_peer(), which now must be echoed back
+        * instead of the driver's own probe_id counter -- see
+        * rwnx_cfg80211_probe_client().
+        */
+       if(found)
+               cfg80211_probe_status(rwnx_vif->ndev, mac, (u64)rwnx_vif->sta_probe.cookie, -1, 1, 0, false, GFP_ATOMIC);
+       else
+               cfg80211_probe_status(rwnx_vif->ndev, mac, (u64)rwnx_vif->sta_probe.cookie, -1, 0, 0, false, GFP_ATOMIC);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 17, 0)
        if(found)
                cfg80211_probe_status(rwnx_vif->ndev, mac, (u64)rwnx_vif->sta_probe.probe_id, 1, 0, false, GFP_ATOMIC);
        else
@@ -3962,7 +3993,7 @@ void apm_probe_sta_work_process(struct work_struct *work)
  *	cfg80211_check_station_change() to validate the information.
  */
 static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                         struct wireless_dev *wdev,
 #else
                                         struct net_device *dev,
@@ -3975,7 +4006,7 @@ static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
 	struct station_parameters *params)
 {
     struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *vif = netdev_priv(dev);
@@ -3988,7 +4019,7 @@ static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
         /* Add the TDLS station */
         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
         {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
             struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
             struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -4064,7 +4095,7 @@ static int rwnx_cfg80211_change_station(struct wiphy *wiphy,
                         (params->sta_flags_set & BIT(NL80211_STA_FLAG_##f) ? "["#f"]" : "")
 
                     netdev_info(
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                 wdev->netdev,
 #else
                                 dev,
@@ -4353,7 +4384,7 @@ static int rwnx_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
     /* delete any remaining STA*/
     while (!list_empty(&rwnx_vif->ap.sta_list)) {
         rwnx_cfg80211_del_station_compat(wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                          &rwnx_vif->wdev,
 #else
                                          dev,
@@ -4420,7 +4451,7 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
 }
 #endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 static int rwnx_cfg80211_set_monitor_channel(struct wiphy *wiphy, struct net_device *dev,
                                              struct cfg80211_chan_def *chandef)
 #else
@@ -4480,7 +4511,7 @@ static int rwnx_cfg80211_set_monitor_channel(struct wiphy *wiphy,
 }
 
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                              struct net_device *dev,
                                              struct cfg80211_chan_def *chandef)
@@ -4497,11 +4528,20 @@ int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
 
 
 /**
- * @probe_client: probe an associated client, must return a cookie that it
+ * @probe_peer: probe an associated client. Before 7.3 the driver returns a
- *	later passes to cfg80211_probe_status().
+ *	cookie of its own and passes the same value to cfg80211_probe_status()
+ *	later; from 7.3 the cookie is assigned by cfg80211, passed in, and must
+ *	be echoed back unchanged. Renamed from @probe_client upstream; kept as
+ *	rwnx_cfg80211_probe_client() here since only the cfg80211_ops field
+ *	name changed, not this driver's own naming.
  */
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+int rwnx_cfg80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
+            const u8 *peer, u64 cookie)
+#else
 int rwnx_cfg80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
             const u8 *peer, u64 *cookie)
+#endif
 {
     //struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
     struct rwnx_vif *vif = netdev_priv(dev);
@@ -4525,9 +4565,21 @@ int rwnx_cfg80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
 
 
     memcpy(vif->sta_probe.sta_mac_addr, peer, 6);
-    queue_work(vif->sta_probe.apmprobesta_wq, &vif->sta_probe.apmprobestaWork);
 
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+    /*
+     * 7.3 made this an input parameter: cfg80211 pre-assigns the cookie
+     * before calling us instead of us inventing one and returning it. Save
+     * it before queueing the work: the worker may run on another CPU as
+     * soon as it is queued, and it echoes this value back via
+     * cfg80211_probe_status() once the probe completes.
+     */
+    vif->sta_probe.cookie = cookie;
+#else
     *cookie = vif->sta_probe.probe_id;
+#endif
+
+    queue_work(vif->sta_probe.apmprobesta_wq, &vif->sta_probe.apmprobestaWork);
 
     return 0;
 }
@@ -4553,7 +4605,7 @@ void rwnx_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
  *	have changed. The actual parameter values are available in
  *	struct wiphy. If returning an error, no value should be changed.
  */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
 static int rwnx_cfg80211_set_wiphy_params(struct wiphy *wiphy, int radio_idx, u32 changed)
 #else
 static int rwnx_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
@@ -4574,7 +4626,7 @@ static int rwnx_cfg80211_set_tx_power(struct wiphy *wiphy,
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
  struct wireless_dev *wdev,
 #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
 int radio_idx,
 #endif
                                       enum nl80211_tx_power_setting type, int mbm)
@@ -4611,10 +4663,10 @@ static int rwnx_cfg80211_get_tx_power(struct wiphy *wiphy,
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
  struct wireless_dev *wdev,
 #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
 int radio_idx,
 #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 14, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 14, 0)
 unsigned int link_id,
 #endif
 	int *mbm)
@@ -4728,6 +4780,7 @@ rwnx_cfg80211_remain_on_channel_(struct wiphy *wiphy,
     struct wireless_dev *wdev = &rwnx_vif->wdev;
 #endif
     struct rwnx_roc_elem *roc_elem;
+    u64 roc_cookie;
     struct mm_add_if_cfm add_if_cfm;
     struct mm_remain_on_channel_cfm roc_cfm;
     int error;
@@ -4819,6 +4872,34 @@ rwnx_cfg80211_remain_on_channel_(struct wiphy *wiphy,
     /* Initialize the OFFCHAN TX queue to allow off-channel transmissions */
     rwnx_txq_offchan_init(rwnx_vif);
 
+    /*
+     * Decide the cookie before the element is published and the request
+     * sent: the RX path can deliver the channel-switch indication and
+     * call cfg80211_ready_on_channel() with roc_elem->cookie before this
+     * thread resumes, so it must already be the final value by then.
+     * Taking one snapshot here also keeps that value and the one reported
+     * back to the caller below identical: rwnx_send_roc() sleeps, and the
+     * RoC expiry handler increments roc_cookie_cnt, so re-reading the
+     * counter afterwards could return a different value than the one
+     * already reported to cfg80211.
+     */
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+    /*
+     * mgmt_roc_flag is false only for the direct cfg80211
+     * .remain_on_channel call path (see rwnx_cfg80211_remain_on_channel()
+     * below), where on 7.3+ *cookie already holds the value cfg80211
+     * pre-assigned and must be honored rather than overwritten. The
+     * purely-internal RoC this function also serves (started from
+     * inside mgmt_tx, mgmt_roc_flag true) never goes through that
+     * cfg80211 op, so there is no pre-assigned value to honor there --
+     * keep inventing one, exactly as on every older kernel.
+     */
+    roc_cookie = mgmt_roc_flag ? (u64)(rwnx_hw->roc_cookie_cnt) : *cookie;
+#else
+    roc_cookie = (u64)(rwnx_hw->roc_cookie_cnt);
+#endif
+    roc_elem->cookie = roc_cookie;
+
     /* Forward the information to the FMAC */
     rwnx_hw->roc_elem = roc_elem;
     error = rwnx_send_roc(rwnx_hw, rwnx_vif, chan, duration, &roc_cfm);
@@ -4827,7 +4908,12 @@ rwnx_cfg80211_remain_on_channel_(struct wiphy *wiphy,
     if (error == 0) {
 
         /* Set the cookie value */
-        *cookie = (u64)(rwnx_hw->roc_cookie_cnt);
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+        if (mgmt_roc_flag)
+            *cookie = roc_cookie;
+#else
+        *cookie = roc_cookie;
+#endif
         if(roc_cfm.status) {
             // failed to roc
             rwnx_hw->roc_elem = NULL;
@@ -4857,8 +4943,42 @@ rwnx_cfg80211_remain_on_channel(struct wiphy *wiphy,
                             #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
                                 enum nl80211_channel_type channel_type,
                             #endif
-                                unsigned int duration, u64 *cookie)
+                                unsigned int duration,
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+                                /*
+                                 * 7.3 made this cookie an input parameter: cfg80211
+                                 * pre-assigns it before calling us instead of us
+                                 * inventing one and returning it. See
+                                 * rwnx_cfg80211_remain_on_channel_(). rx_addr is
+                                 * unused for the reason given in the 7.2 arm below:
+                                 * it is always NULL for this driver.
+                                 */
+                                u64 cookie, const u8 *rx_addr
+#elif AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 2, 0)
+                                /*
+                                 * 7.2 added an optional receive address filter for the off-channel
+                                 * period. cfg80211 refuses a non-NULL one unless the driver sets
+                                 * NL80211_EXT_FEATURE_ROC_ADDR_FILTER, which this one does not, so it
+                                 * is always NULL here. mac80211 ignores it in the same way.
+                                 */
+                                u64 *cookie, const u8 *rx_addr
+#else
+                                u64 *cookie
+#endif
+                                )
 {
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+    /*
+     * 7.3 passes the cookie by value, while the shared helper still takes a
+     * pointer because its internal caller invents one. Only the argument
+     * differs, so pick it here and leave the call itself alone.
+     */
+    u64 local_cookie = cookie;
+    u64 *cookie_ptr = &local_cookie;
+#else
+    u64 *cookie_ptr = cookie;
+#endif
+
 	return rwnx_cfg80211_remain_on_channel_(wiphy,
                             #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
                                 wdev,
@@ -4869,7 +4989,7 @@ rwnx_cfg80211_remain_on_channel(struct wiphy *wiphy,
                             #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
                                 channel_type,
                             #endif
-                                duration, cookie, false);
+                                duration, cookie_ptr, false);
 }
 
 /**
@@ -4999,7 +5119,7 @@ static int rwnx_cfg80211_get_channel(struct wiphy *wiphy,
     if (rwnx_vif->vif_index == rwnx_hw->monitor_vif)
     {
         //retrieve channel from firmware
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
         rwnx_cfg80211_set_monitor_channel(wiphy, wdev->netdev, NULL);
 #else
         rwnx_cfg80211_set_monitor_channel(wiphy, NULL);
@@ -5047,7 +5167,17 @@ struct ieee80211_channel *rwnx_cfg80211_get_channel(struct wiphy *wiphy)
 /**
  * @mgmt_tx: Transmit a management frame.
  */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+#if (AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0))
+static int rwnx_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+                                 struct cfg80211_mgmt_tx_params *params,
+                                 /*
+                                  * 7.3 made this cookie an input parameter: cfg80211
+                                  * pre-assigns it before calling us instead of us
+                                  * inventing one and returning it. See
+                                  * rwnx_start_mgmt_xmit().
+                                  */
+                                 u64 cookie)
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
 static int rwnx_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                                  struct cfg80211_mgmt_tx_params *params,
                                  u64 *cookie)
@@ -5062,7 +5192,7 @@ static int rwnx_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                                  bool dont_wait_for_ack,
                             #endif
                                  u64 *cookie)
-#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+#endif /* AICWF_CFG80211_VERSION_CODE >= 7.3 / LINUX_VERSION_CODE >= 3.14 */
 {
     struct rwnx_hw *rwnx_hw = wiphy_priv(wiphy);
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
@@ -5149,7 +5279,8 @@ static int rwnx_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
             return -EINVAL;
         }
     } else {
-        u64 cookie;
+        /* The internal RoC's own cookie; deliberately not the mgmt_tx one. */
+        u64 roc_cookie;
         int error;
 
 		AICWFDBG(LOGINFO, "mgmt rx remain on chan\n");
@@ -5157,13 +5288,13 @@ static int rwnx_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         /* Start a ROC procedure for 30ms */
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
         error = rwnx_cfg80211_remain_on_channel_(wiphy, wdev, channel,
-                                                30, &cookie, true);
+                                                30, &roc_cookie, true);
 #elif (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
         error = rwnx_cfg80211_remain_on_channel_(wiphy, wdev, channel, NL80211_CHAN_NO_HT,
-                                                30, &cookie, true);
+                                                30, &roc_cookie, true);
 #else
         error = rwnx_cfg80211_remain_on_channel_(wiphy, dev, channel, NL80211_CHAN_NO_HT,
-                                                30, &cookie, true);
+                                                30, &roc_cookie, true);
 #endif
 
         if (error) {
@@ -5180,11 +5311,16 @@ static int rwnx_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
     #endif
 
 send_frame:
-    #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+    #if (AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0))
-    return rwnx_start_mgmt_xmit(rwnx_vif, rwnx_sta, params, offchan, cookie);
+    {
+        u64 local_cookie = cookie;
+        return rwnx_start_mgmt_xmit(rwnx_vif, rwnx_sta, params, offchan, &local_cookie, true);
+    }
+    #elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+    return rwnx_start_mgmt_xmit(rwnx_vif, rwnx_sta, params, offchan, cookie, false);
     #else
-    return rwnx_start_mgmt_xmit(rwnx_vif, rwnx_sta, channel, offchan, wait, buf, len, no_cck, dont_wait_for_ack, cookie);
+    return rwnx_start_mgmt_xmit(rwnx_vif, rwnx_sta, channel, offchan, wait, buf, len, no_cck, dont_wait_for_ack, cookie, false);
-    #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+    #endif /* AICWF_CFG80211_VERSION_CODE >= 7.3 / LINUX_VERSION_CODE >= 3.14 */
 }
 
 /**
@@ -5197,7 +5333,7 @@ int rwnx_cfg80211_start_radar_detection(struct wiphy *wiphy,
                                     #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
                                         , u32 cac_time_ms
                                     #endif
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
+#if (AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
                                         , int link_id
 #endif
                                         )
@@ -5981,7 +6117,7 @@ int rwnx_fill_station_info(struct rwnx_sta *sta, struct rwnx_vif *vif,
  * @get_station: get station information for the station identified by @mac
  */
 static int rwnx_cfg80211_get_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct wireless_dev *wdev,
 #else
 	struct net_device *dev,
@@ -5993,7 +6129,7 @@ static int rwnx_cfg80211_get_station(struct wiphy *wiphy,
 #endif
 	struct station_info *sinfo)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *vif = netdev_priv(dev);
@@ -6031,14 +6167,14 @@ static int rwnx_cfg80211_get_station(struct wiphy *wiphy,
  * @dump_station: dump station callback -- resume dump at index @idx
  */
 static int rwnx_cfg80211_dump_station(struct wiphy *wiphy,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
                                       struct wireless_dev *wdev,
 #else
                                       struct net_device *dev,
 #endif
                                       int idx, u8 *mac, struct station_info *sinfo)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
     struct rwnx_vif *rwnx_vif = netdev_priv(wdev->netdev);
 #else
     struct rwnx_vif *rwnx_vif = netdev_priv(dev);
@@ -6542,7 +6678,11 @@ static struct cfg80211_ops rwnx_cfg80211_ops = {
     .change_beacon = rwnx_cfg80211_change_beacon,
     .stop_ap = rwnx_cfg80211_stop_ap,
     .set_monitor_channel = rwnx_cfg80211_set_monitor_channel,
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+    .probe_peer = rwnx_cfg80211_probe_client,
+#else
     .probe_client = rwnx_cfg80211_probe_client,
+#endif
 //    .mgmt_frame_register = rwnx_cfg80211_mgmt_frame_register,
     .set_wiphy_params = rwnx_cfg80211_set_wiphy_params,
     .set_txq_params = rwnx_cfg80211_set_txq_params,

drivers/aic8800/aic8800_fdrv/rwnx_main.h

@@ -91,7 +91,7 @@ void aicwf_p2p_alive_timeout(struct timer_list *t);
 int rwnx_send_check_p2p(struct cfg80211_scan_request *param);
 void apm_staloss_work_process(struct work_struct *work);
 void apm_probe_sta_work_process(struct work_struct *work);
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+#ifdef AICWF_CFG80211_SET_MONITOR_CHANNEL_HAS_DEV
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                              struct net_device *dev,
                                              struct cfg80211_chan_def *chandef);
@@ -99,8 +99,13 @@ int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
 int rwnx_cfg80211_set_monitor_channel_(struct wiphy *wiphy,
                                              struct cfg80211_chan_def *chandef);
 #endif
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 3, 0)
+int rwnx_cfg80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
+            const u8 *peer, u64 cookie);
+#else
 int rwnx_cfg80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
             const u8 *peer, u64 *cookie);
+#endif
 void rwnx_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
                    struct net_device *dev,

drivers/aic8800/aic8800_fdrv/rwnx_msg_rx.c

@@ -123,13 +123,13 @@ static inline int rwnx_rx_chan_switch_ind(struct rwnx_hw *rwnx_hw,
             if (!roc_elem->mgmt_roc) {
                 /* Inform the host that we have switch on the indicated off-channel */
                 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
-                cfg80211_ready_on_channel(roc_elem->wdev->netdev, (u64)(rwnx_hw->roc_cookie_cnt),
+                cfg80211_ready_on_channel(roc_elem->wdev->netdev, roc_elem->cookie,
                                         roc_elem->chan, NL80211_CHAN_HT20, roc_elem->duration, GFP_ATOMIC);
                 #elif LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-                cfg80211_ready_on_channel(roc_elem->wdev, (u64)(rwnx_hw->roc_cookie_cnt),
+                cfg80211_ready_on_channel(roc_elem->wdev, roc_elem->cookie,
                                         roc_elem->chan, NL80211_CHAN_HT20, roc_elem->duration, GFP_ATOMIC);
                 #else
-                cfg80211_ready_on_channel(roc_elem->wdev, (u64)(rwnx_hw->roc_cookie_cnt),
+                cfg80211_ready_on_channel(roc_elem->wdev, roc_elem->cookie,
                                         roc_elem->chan, roc_elem->duration, GFP_ATOMIC);
                 #endif
             }
@@ -245,13 +245,13 @@ static inline int rwnx_rx_remain_on_channel_exp_ind(struct rwnx_hw *rwnx_hw,
         /* Inform the host that off-channel period has expired */
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
-	cfg80211_remain_on_channel_expired(roc_elem->wdev->netdev, (u64)(rwnx_hw->roc_cookie_cnt),
+	cfg80211_remain_on_channel_expired(roc_elem->wdev->netdev, roc_elem->cookie,
                                            roc_elem->chan, NL80211_CHAN_HT20, GFP_ATOMIC);
 #elif LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-	cfg80211_remain_on_channel_expired(roc_elem->wdev, (u64)(rwnx_hw->roc_cookie_cnt),
+	cfg80211_remain_on_channel_expired(roc_elem->wdev, roc_elem->cookie,
                                            roc_elem->chan, NL80211_CHAN_HT20, GFP_ATOMIC);
 #else
-        cfg80211_remain_on_channel_expired(roc_elem->wdev, (u64)(rwnx_hw->roc_cookie_cnt),
+        cfg80211_remain_on_channel_expired(roc_elem->wdev, roc_elem->cookie,
                                            roc_elem->chan, GFP_ATOMIC);
 #endif
     }
@@ -825,7 +825,9 @@ static inline int rwnx_rx_scanu_result_ind(struct rwnx_hw *rwnx_hw,
 #endif
 
     }
+#ifdef CONFIG_USE_WIRELESS_EXT
 putbss:
+#endif
     if (bss != NULL)
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
 	cfg80211_put_bss(bss);

drivers/aic8800/aic8800_fdrv/rwnx_msg_tx.c

@@ -4849,7 +4849,13 @@ int rwnx_send_dbg_trigger_req(struct rwnx_hw *rwnx_hw, char *msg)
         return -ENOMEM;
 
     /* Set parameters for the MM_DBG_TRIGGER_REQ message */
-    strncpy(req->error, msg, sizeof(req->error));
+    /*
+     * strncpy() is gone in 7.2. req->error is a fixed 64-byte field of a
+     * firmware message that is not NUL-terminated, and the message came
+     * from kzalloc(), so copying at most the field size is all strncpy()
+     * did here.
+     */
+    memcpy(req->error, msg, strnlen(msg, sizeof(req->error)));
 
     /* Send the MM_DBG_TRIGGER_REQ message to LMAC FW */
     return rwnx_send_msg(rwnx_hw, req, 0, -1, NULL);

drivers/aic8800/aic8800_fdrv/rwnx_platform.c

@@ -1669,7 +1669,8 @@ static int rwnx_plat_patch_load(struct rwnx_hw *rwnx_hw)
     if(rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800DC ||
         rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800DW){
 #ifndef ANDROID_PLATFORM
-        sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800DC");
+        if (strlcat(aic_fw_path, "/aic8800DC", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+            return -ENAMETOOLONG;
 #endif
         AICWFDBG(LOGINFO, "testmode=%d\n", testmode);
         if (chip_sub_id == 0) {
@@ -1808,7 +1809,8 @@ static int rwnx_plat_patch_load(struct rwnx_hw *rwnx_hw)
         }
     } else if(rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800D80N) {
 #ifndef ANDROID_PLATFORM
-        sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800D80N");
+        if (strlcat(aic_fw_path, "/aic8800D80N", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+            return -ENAMETOOLONG;
 #endif
         if (testmode == FW_NORMAL_MODE) {
             ret = aicwf_plat_patch_load_8800d80n(rwnx_hw);
@@ -1838,7 +1840,8 @@ static int rwnx_plat_patch_load(struct rwnx_hw *rwnx_hw)
     }
     else if(rwnx_hw->usbdev->chipid == PRODUCT_ID_AIC8800DLN) {
 #ifndef ANDROID_PLATFORM
-        sprintf(aic_fw_path, "%s/%s", aic_fw_path, "aic8800DLN");
+        if (strlcat(aic_fw_path, "/aic8800DLN", sizeof(aic_fw_path)) >= sizeof(aic_fw_path))
+            return -ENAMETOOLONG;
 #endif
         if (testmode == FW_NORMAL_MODE) {
             aicwf_patch_config_8800dln(rwnx_hw);

drivers/aic8800/aic8800_fdrv/rwnx_radar.c

@@ -1475,7 +1475,7 @@ static void rwnx_radar_cac_work(struct work_struct *ws)
                     #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
                        &ctxt->chan_def,
                     #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
                        NL80211_RADAR_CAC_FINISHED, GFP_KERNEL, 0);
 #else
                        NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
@@ -1617,7 +1617,7 @@ void rwnx_radar_cancel_cac(struct rwnx_radar *radar)
                         #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
                            &ctxt->chan_def,
                         #endif
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
                            NL80211_RADAR_CAC_FINISHED, GFP_KERNEL, 0);
 #else
                            NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);

drivers/aic8800/aic8800_fdrv/rwnx_rx.c

@@ -2283,6 +2283,11 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv)
     if(hw_rxhdr->flags_upload)
         status |= RX_STAT_FORWARD;
 
+#ifndef CONFIG_RWNX_MON_DATA
+    if (status & RX_STAT_MONITOR)
+        status &= ~RX_STAT_FORWARD;
+#endif
+
     /* Check if we need to delete the buffer */
     if (status & RX_STAT_DELETE) {
         /* Remove the SK buffer from the rxbuf_elems table */
@@ -2345,13 +2350,24 @@ u8 rwnx_rxdataind_aicwf(struct rwnx_hw *rwnx_hw, void *hostid, void *rx_priv)
         } else {
         #ifdef CONFIG_RWNX_MON_DATA
         skb_monitor = skb_copy_expand(skb, rtap_len, 0, GFP_ATOMIC);
+        if (skb_monitor) {
             skb_monitor->data += (msdu_offset + 2); //sdio/usb word allign
 
             //Save frame length
             frm_len = le32_to_cpu(hw_rxhdr->hwvect.len);
+        }
         #endif
         }
 
+        if (!skb_monitor) {
+            if (status == RX_STAT_MONITOR) {
+                dev_kfree_skb(skb);
+                goto end;
+            }
+
+            goto check_len_update;
+        }
+
         //skb_reset_tail_pointer(skb);
         //skb->len = 0;
         skb_reset_tail_pointer(skb_monitor);
@@ -2394,7 +2410,7 @@ check_len_update:
         hdr = (struct ieee80211_hdr *)(skb->data + msdu_offset);
         rwnx_vif = rwnx_rx_get_vif(rwnx_hw, hw_rxhdr->flags_vif_idx);
         if (rwnx_vif) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
             cfg80211_rx_spurious_frame(rwnx_vif->ndev, hdr->addr2, -1, GFP_ATOMIC);
 #else
             cfg80211_rx_spurious_frame(rwnx_vif->ndev, hdr->addr2, GFP_ATOMIC);
@@ -2741,7 +2757,7 @@ check_len_update:
 
                 if (hw_rxhdr->flags_is_4addr && !rwnx_vif->use_4addr) {
 					printk("aicwf: 4addr flag error\n");
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 17, 0)
                     cfg80211_rx_unexpected_4addr_frame(rwnx_vif->ndev,
                                                        sta->mac_addr, -1, GFP_ATOMIC);
 #else

drivers/aic8800/aic8800_fdrv/rwnx_tdls.c

@@ -115,8 +115,8 @@ rwnx_prep_tdls_direct(struct rwnx_hw *rwnx_hw, struct rwnx_vif *rwnx_vif,
 
     switch (action_code) {
     case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
+#if AICWF_CFG80211_VERSION_CODE >= KERNEL_VERSION(7, 1, 0)
-        skb_put(skb, 1 + sizeof(mgmt->u.action.tdls_discover_resp));
+        skb_put(skb, 2 + sizeof(mgmt->u.action.tdls_discover_resp));
         mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
         mgmt->u.action.action_code = WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
         mgmt->u.action.tdls_discover_resp.dialog_token = dialog_token;
@@ -775,9 +775,9 @@ rwnx_tdls_send_mgmt_packet_data(struct rwnx_hw *rwnx_hw, struct rwnx_vif *rwnx_v
 
         params.len = skb->len;
         params.buf = skb->data;
-        ret = rwnx_start_mgmt_xmit(rwnx_vif, NULL, &params, false, &cookie);
+        ret = rwnx_start_mgmt_xmit(rwnx_vif, NULL, &params, false, &cookie, false);
         #else
-        ret = rwnx_start_mgmt_xmit(rwnx_vif, NULL, NULL, false, 0, skb->data, skb->len, false, false, &cookie);
+        ret = rwnx_start_mgmt_xmit(rwnx_vif, NULL, NULL, false, 0, skb->data, skb->len, false, false, &cookie, false);
         #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
 
         return ret;

drivers/aic8800/aic8800_fdrv/rwnx_tx.c

@@ -1325,6 +1325,7 @@ int intf_tx(struct rwnx_hw *priv,struct msg_buf *msg)
 	sw_txhdr->rwnx_sta	= sta;
 	sw_txhdr->rwnx_vif	= rwnx_vif;
 	sw_txhdr->skb		= skb;
+	sw_txhdr->cookie	= (unsigned long)skb;
 	sw_txhdr->headroom	= headroom;
 	sw_txhdr->map_len	= skb->len - offsetof(struct rwnx_txhdr, hw_hdr);
 
@@ -1541,6 +1542,7 @@ netdev_tx_t rwnx_start_xmit(struct sk_buff *skb, struct net_device *dev)
     sw_txhdr->rwnx_sta  = sta;
     sw_txhdr->rwnx_vif  = rwnx_vif;
     sw_txhdr->skb       = skb;
+    sw_txhdr->cookie    = (unsigned long)skb;
     sw_txhdr->headroom  = headroom;
     sw_txhdr->map_len   = skb->len - offsetof(struct rwnx_txhdr, hw_hdr);
 
@@ -1630,7 +1632,12 @@ free:
  * @params: Mgmt frame parameters
  * @offchan: Indicate whether the frame must be send via the offchan TXQ.
  *           (is is redundant with params->offchan ?)
- * @cookie: updated with a unique value to identify the frame with upper layer
+ * @cookie: on return, the value cfg80211_mgmt_tx_status() will report for
+ *          this frame: invented here (the skb pointer) unless
+ *          @use_given_cookie is set, in which case *@cookie is kept.
+ * @use_given_cookie: *@cookie already holds the cookie cfg80211 assigned
+ *          (7.3+, the direct .mgmt_tx path only); honour it instead of
+ *          inventing one. Every other caller passes false.
  *
  */
 
@@ -1638,7 +1645,7 @@ free:
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
 int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                          struct cfg80211_mgmt_tx_params *params, bool offchan,
-                         u64 *cookie)
+                         u64 *cookie, bool use_given_cookie)
 #else
 int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                          struct ieee80211_channel *channel, bool offchan,
@@ -1649,7 +1656,7 @@ int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                     #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
                          bool dont_wait_for_ack,
                     #endif
-                         u64 *cookie)
+                         u64 *cookie, bool use_given_cookie)
 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
 {
     struct rwnx_hw *rwnx_hw = vif->rwnx_hw;
@@ -1703,6 +1710,17 @@ int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
         return -ENOMEM;
     }
 
+    /*
+     * use_given_cookie is true only for the direct cfg80211 .mgmt_tx call
+     * path on 7.3+, where *cookie already holds the value cfg80211
+     * pre-assigned and must be echoed back via cfg80211_mgmt_tx_status()
+     * later -- see rwnx_cfg80211_mgmt_tx(). TDLS's internal reuse of this
+     * function (use_given_cookie == false) never goes through that cfg80211
+     * op, so it still gets an invented, locally-unique cookie exactly as
+     * before this fix, and on every kernel older than 7.3 every caller
+     * passes use_given_cookie == false, also leaving this unchanged.
+     */
+    if (!use_given_cookie)
         *cookie = (unsigned long)skb;
 
     /*
@@ -1773,6 +1791,7 @@ int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
     sw_txhdr->rwnx_sta = sta;
     sw_txhdr->rwnx_vif = vif;
     sw_txhdr->skb = skb;
+    sw_txhdr->cookie = *cookie;
     sw_txhdr->headroom = headroom;
     sw_txhdr->map_len = skb->len - offsetof(struct rwnx_txhdr, hw_hdr);
 #ifdef CONFIG_RWNX_AMSDUS_TX
@@ -1924,6 +1943,7 @@ void rwnx_probersp_work(struct work_struct *work)
 	sw_txhdr->rwnx_sta = sta;
 	sw_txhdr->rwnx_vif = rwnx_vif;
 	sw_txhdr->skb = skb;
+	sw_txhdr->cookie = (unsigned long)skb;
 	sw_txhdr->headroom = headroom;
 	sw_txhdr->map_len = skb->len - offsetof(struct rwnx_txhdr, hw_hdr);
 #ifdef CONFIG_RWNX_AMSDUS_TX
@@ -1991,7 +2011,7 @@ free_use:
 
 netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-    int rtap_len, ret, idx, tmp_len;
+    int rtap_len, ret, idx;
     struct ieee80211_radiotap_header *rtap_hdr; // net/ieee80211_radiotap.h
     struct ieee80211_radiotap_iterator iterator; // net/cfg80211.h
     u8_l *rtap_buf = (u8_l *)skb->data;
@@ -2012,10 +2032,30 @@ netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *d
     bool offchan = false;
     int nx_off_chan_txq_idx = NX_OFF_CHAN_TXQ_IDX;
 
-    rtap_hdr = (struct ieee80211_radiotap_header*)(rtap_buf);
-    rtap_len = ieee80211_get_radiotap_len(rtap_buf);//max_length
     frame_len = skb->len;
 
+    if (unlikely(skb->len < sizeof(*rtap_hdr))) {
+        AICWFDBG(LOGERROR, "%s radiotap header is truncated\n", __func__);
+        goto free_tag;
+    }
+
+    rtap_hdr = (struct ieee80211_radiotap_header*)(rtap_buf);
+    if (unlikely(rtap_hdr->it_version)) {
+        AICWFDBG(LOGERROR, "%s itv \r\n", __func__);
+        goto free_tag;
+    }
+
+    rtap_len = ieee80211_get_radiotap_len(rtap_buf);//max_length
+    if (unlikely(rtap_len < sizeof(*rtap_hdr))) {
+        AICWFDBG(LOGERROR, "%s rtap_len < sizeof(struct ieee80211_radiotap_header) \r\n", __func__);
+        goto free_tag;
+    }
+
+    if (unlikely(skb->len < rtap_len)) {
+        AICWFDBG(LOGERROR, "%s skb->len < rtap_len \r\n", __func__);
+        goto free_tag;
+    }
+
     AICWFDBG(LOGINFO, "rwnx_start_monitor_if_xmit, skb_len=%d, rtap_len=%d\n", skb->len, rtap_len);
 //rwnx_data_dump((char*)__func__, skb->data, skb->len);
     if((g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8801) ||
@@ -2023,23 +2063,6 @@ netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *d
         g_rwnx_plat->usbdev->chipid == PRODUCT_ID_AIC8800DW) && chip_id < 3)){
             nx_off_chan_txq_idx = NX_OFF_CHAN_TXQ_IDX_FOR_OLD_IC;
     }
-
-
-    if (unlikely(rtap_hdr->it_version)){
-        AICWFDBG(LOGERROR, "%s itv \r\n", __func__);
-        goto free_tag;
-        }
-
-    if (unlikely(skb->len < rtap_len)){
-        AICWFDBG(LOGERROR, "%s skb->len < rtap_len \r\n", __func__);
-        goto free_tag;
-        }
-
-    if (unlikely(rtap_len < sizeof(struct ieee80211_radiotap_header))){
-        AICWFDBG(LOGERROR, "%s rtap_len < sizeof(struct ieee80211_radiotap_header) \r\n", __func__);
-        goto free_tag;
-        }
-
     frame_len -= rtap_len;
     pframe = rtap_buf + rtap_len;
 
@@ -2275,6 +2298,15 @@ netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *d
     sw_txhdr->rwnx_sta = sta;
     sw_txhdr->rwnx_vif = vif;
     sw_txhdr->skb = skb_mgmt;
+    /*
+     * Injected frames are flagged TXU_CNTRL_MGMT below and complete through
+     * the same path as management frames, which reports sw_txhdr->cookie to
+     * cfg80211_mgmt_tx_status(). There is no cfg80211-assigned cookie for an
+     * injected frame, so this is the skb-derived value that path reported
+     * before the field existed. Not gated on 7.3: this path runs on every
+     * kernel with CONFIG_RWNX_MON_XMIT.
+     */
+    sw_txhdr->cookie = (unsigned long)skb_mgmt;
     sw_txhdr->headroom = headroom;
     sw_txhdr->map_len = skb_mgmt->len - offsetof(struct rwnx_txhdr, hw_hdr);
     sw_txhdr->raw_frame = 1;
@@ -2386,7 +2418,7 @@ int rwnx_txdatacfm(void *pthis, void *host_id)
 #endif
         /* Confirm transmission to CFG80211 */
         cfg80211_mgmt_tx_status(&sw_txhdr->rwnx_vif->wdev,
-                                (unsigned long)skb,
+                                sw_txhdr->cookie,
                                 (skb->data + sw_txhdr->headroom),
                                 sw_txhdr->frame_len,
                                 rwnx_txst.acknowledged,

drivers/aic8800/aic8800_fdrv/rwnx_tx.h

@@ -130,6 +130,17 @@ struct rwnx_sw_txhdr {
 #endif
 	u32 need_cfm;
     struct sk_buff *skb;
+    /*
+     * The cookie cfg80211_mgmt_tx_status() reports for this frame. sw_txhdr
+     * comes from a kmem_cache and is never zeroed, so every allocation site
+     * sets this: (unsigned long)skb, which is what the completion path
+     * reported before the field existed, except in rwnx_start_mgmt_xmit(),
+     * which stores the cfg80211-assigned cookie it was handed on 7.3+ (see
+     * use_given_cookie there). Only frames flagged TXU_CNTRL_MGMT are ever
+     * reported, but the field is initialised unconditionally so that filter
+     * is not what keeps it safe.
+     */
+    u64 cookie;
 
     size_t map_len;
     dma_addr_t dma_addr;
@@ -158,7 +169,7 @@ netdev_tx_t rwnx_start_xmit(struct sk_buff *skb, struct net_device *dev);
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
 int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                          struct cfg80211_mgmt_tx_params *params, bool offchan,
-                         u64 *cookie);
+                         u64 *cookie, bool use_given_cookie);
 #else
 int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                          struct ieee80211_channel *channel, bool offchan,
@@ -169,10 +180,11 @@ int rwnx_start_mgmt_xmit(struct rwnx_vif *vif, struct rwnx_sta *sta,
                     #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
                          bool dont_wait_for_ack,
                     #endif
-                         u64 *cookie);
+                         u64 *cookie, bool use_given_cookie);
 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
 #ifdef CONFIG_RWNX_MON_XMIT
-int rwnx_start_monitor_if_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t rwnx_start_monitor_if_xmit(struct sk_buff *skb,
+                                       struct net_device *dev);
 #endif
 int rwnx_txdatacfm(void *pthis, void *host_id);
 

drivers/aic8800/aic_zlp_quirk/aic_zlp_quirk.c

@@ -149,7 +149,11 @@ static int usb_submit_urb_pre_handler(struct kprobe *p, struct pt_regs *regs)
 
 	(void)p;
 
+#if defined(CONFIG_ARM)
+	urb = (struct urb *)regs->ARM_r0;
+#else
 	urb = (struct urb *)regs_get_kernel_argument(regs, 0);
+#endif
 	if (is_bluetooth_acl_endpoint(urb))
 		enable_zlp(urb);
 

tests/openwrt-backports/README.md

@@ -0,0 +1,44 @@
+# OpenWrt backports build regression
+
+This checks complete module compilation and MODPOST against real kernel and
+wireless-stack headers. It requires an already prepared SDK/buildroot with
+cfg80211/mac80211 headers and `mac80211.symvers` staged. It does not install
+packages or load modules.
+
+For the x86_64 SDK used in issue #94:
+
+```sh
+sdk=/path/to/openwrt-sdk
+kernel="$sdk/build_dir/target-x86_64_musl/linux-x86_64/linux-6.12.94"
+export STAGING_DIR="$sdk/staging_dir/target-x86_64_musl"
+export PATH="$sdk/staging_dir/toolchain-x86_64_gcc-14.3.0_musl/bin:$PATH"
+
+bash tests/openwrt-backports/build.sh \
+    "$kernel" "$STAGING_DIR/usr/include" \
+    "$kernel/../symvers/mac80211.symvers" 6.18.26 \
+    ARCH=x86_64 CROSS_COMPILE=x86_64-openwrt-linux-musl-
+```
+
+The script copies the current driver into a fresh temporary directory and
+checks that all three `.ko` files are produced. Additional make arguments
+can select a compiler or architecture. Use matching headers, configuration
+and symbol versions throughout; changing only the version argument is not
+a substitute for the matching wireless stack.
+
+## Verified on 2026-09-17
+
+- OpenWrt 25.12.5 x86_64 SDK: Linux 6.12.94, GCC 14.3.0, backports 6.18.26
+  with the mac80211 patches from OpenWrt revision `f5dae5ece4` applied:
+  all three modules compile and pass MODPOST with the kernel's `-Werror`.
+- Original driver revision `9594c5c`, on the same kernel/backports combination:
+  reproduces both RX argument-count errors and the four incompatible
+  `set_monitor_channel`, `set_wiphy_params`, `set_tx_power`, `get_tx_power`
+  callbacks. This comparison uses `-Wno-error=unused-label`, as the issue's
+  log does, to reach those failures. The fixed build needs no such override.
+- Native kernel headers 6.11.0-17, 6.17.0-14 and 7.2.0-070200, with
+  `CFG80211_VERSION` unset: all three modules compile and pass MODPOST.
+  The 7.2 check uses GCC 14 and reports compiler/attribute warnings because
+  those headers were built with GCC 15.
+
+These are build checks. They do not validate an installable OpenWrt package,
+firmware loading, Wi-Fi connectivity or Bluetooth operation on hardware.

tests/openwrt-backports/build.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Compile a source copy against a prepared kernel and staged wireless backport.
+# Leaves the build directory for inspection; does not install or load modules.
+set -euo pipefail
+
+if [ "$#" -lt 4 ]; then
+    echo "Usage: $0 KERNEL_BUILD_DIR STAGED_INCLUDE_DIR MAC80211_SYMVERS CFG80211_VERSION [make arguments...]" >&2
+    exit 2
+fi
+
+kernel_dir=$(realpath "$1")
+include_dir=$(realpath "$2")
+symvers=$(realpath "$3")
+wireless_version=$4
+shift 4
+
+for required in "$kernel_dir/Makefile" "$kernel_dir/Module.symvers" \
+    "$include_dir/mac80211/net/cfg80211.h" \
+    "$include_dir/mac80211-backport/backport/autoconf.h" "$symvers"; do
+    if [ ! -f "$required" ]; then
+        echo "Missing build input: $required" >&2
+        exit 2
+    fi
+done
+
+repo_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+build_dir=$(mktemp -d "${TMPDIR:-/tmp}/aic8800-backports.XXXXXX")
+cp -a "$repo_dir/drivers/aic8800/." "$build_dir/"
+echo "Build directory: $build_dir"
+
+make -C "$kernel_dir" M="$build_dir" \
+    NOSTDINC_FLAGS="-I$include_dir/mac80211-backport/uapi -I$include_dir/mac80211-backport -I$include_dir/mac80211/uapi -I$include_dir/mac80211 -include backport/backport.h" \
+    KBUILD_EXTRA_SYMBOLS="$symvers" \
+    CFG80211_VERSION="$wireless_version" \
+    -j"${JOBS:-2}" "$@" modules
+
+for module in aic_load_fw/aic_load_fw.ko aic8800_fdrv/aic8800_fdrv.ko \
+    aic_zlp_quirk/aic_zlp_quirk.ko; do
+    test -s "$build_dir/$module"
+done
+echo "All three modules built successfully in $build_dir"

usb_modeswitch/1111_1111

@@ -2,8 +2,8 @@
 # Sends vendor-specific SCSI CDB to trigger mode switch from
 # USB Mass Storage to WiFi+BT mode.
 #
-# The 16-byte CDB is: FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F2
+# The two 16-byte CDBs end in F3 and F2 respectively. Each is wrapped in a
-# Wrapped in a standard 31-byte SCSI CBW (Command Block Wrapper).
+# standard 31-byte SCSI CBW (Command Block Wrapper), and must be sent in order.
 #
 # Install as: /etc/usb_modeswitch.d/1111:1111
 # (The filename must contain a colon on Linux; this file is named
@@ -13,4 +13,6 @@ DefaultVendor=0x1111
 DefaultProduct=0x1111
 TargetVendor=0xa69c
 TargetProduct=0x8d80
-MessageContent="555342438765432100000000000010fd0000000000000000000000000000f2"
+MessageContent="555342438765432100000000000010fd0000000000000000000000000000f3"
+MessageContent2="555342438765432100000000000010fd0000000000000000000000000000f2"
+NeedResponse=1