From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f49.google.com (mail-ed1-f49.google.com [209.85.208.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E92941A574 for ; Wed, 5 Aug 2026 19:23:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785957792; cv=none; b=kNJeaQIBrZIf09heBu3txZh1YMAFdgGMW/jBZ/27P6lCKcn/HYOiyrwAsMOsIgkJclGE91dayxEha4vUBexJsychaFy0/Xha3zT7bOzovLFypd4loaVj3RSPh/UG/aNdQapBoq3rd02qT8mLhU6fj3y2/xOrlT/VvC4i/e8+Vgk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785957792; c=relaxed/simple; bh=xJ1s7r38HIwv4XJzwXlsQBj8krthuIXQuGjxORyM9IU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XntO88qWAdc2h2sbjLs+aZh5wo8KFqQQ6DM/0MTjihJRCtfa7mEJNpj64pyp2DbJEouzIhKx9SqsabzEclDYUd16A7LpdnTKdPoRZfRMpRcd4d0oKqsT/xnys9ZeRvxbJWrKhMN9c/ELq/xSQ4AcsUzxUf2LOBrejvRdOSU4IeQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bairaktaris.de; spf=pass smtp.mailfrom=bairaktaris.de; dkim=pass (2048-bit key) header.d=bairaktaris.de header.i=@bairaktaris.de header.b=XM2sJk95; arc=none smtp.client-ip=209.85.208.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bairaktaris.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bairaktaris.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bairaktaris.de header.i=@bairaktaris.de header.b="XM2sJk95" Received: by mail-ed1-f49.google.com with SMTP id 4fb4d7f45d1cf-6a051b737d8so1478684a12.1 for ; Wed, 05 Aug 2026 12:23:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bairaktaris.de; s=google; t=1785957779; x=1786562579; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lTF4WLzFw0fB3oAy0Rqnuzx+Ko8HpiZOmOtSBbcLZxo=; b=XM2sJk95e0Mv4Fc9G0XKRW57O6mv2xuOXdVj4NrYyeSdltnQcDCRwu8YDuw97tJ8D2 HArirS7cg52qqCIe6VOld+D6sxBHzK+rIq6aGy8pqUCkIb2Iv5wrrFCR4UH3bXcRoxss VVavHeURUZxFsTzwpSAcxDW6fRVu0Rbk1HA72cEXaHIFcXK+6NHqI15huQHphuHPnAIN SlAu/FfaR14sT1GqI83QCnDkwD3DnsfZCPDdq2Q9NAoIjFy6cgOie+oQlAbvFR4bel5G wWwuPvZEH3ETwdFRVIrFBnv4Ni59UG6R+WpW24LnKvXgALtfPDwfwnZZ4NgHmVRrfGiF FNdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785957779; x=1786562579; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=lTF4WLzFw0fB3oAy0Rqnuzx+Ko8HpiZOmOtSBbcLZxo=; b=oiyTcqpNsbUGfPn/qvOakgyJRhVbV8xSxE4Arygi25apkoacjhCxQhu2+erMR2DbNn ElzydV0ZEGLpWBSVwyhEtVVHTYP0x+nOykC89LpAQn48YeU3TuhTgGjEOFI21yevJ9Ed 6P2VR9zbGehCxjoYDSky/LZ5inuZyH1yTGa/KOwDmZc/bG8/NZ/82H0veMvnEEAn7g9k LfXCnQPAlvcXCYUraQvsvQbTDiRg2bOZj8MFFIT9Og26Wx2Gg5tqsihW+VTH8IVz9unP qUm82NDHa6YTcvQXYn5WS5g+cvMXSgr9z5yau0+JXmDrGyFu/m9LjV6T1UlhAk5qqYU3 ktiw== X-Forwarded-Encrypted: i=1; AHgh+RpBhvGPS2JNfrHaLV2wjS76DOuZffGnBJ9oW+tY5HkBG3wcmkucOzvugoOI394/JWEPDZvajFQnaYfUg00=@vger.kernel.org X-Gm-Message-State: AOJu0YyMt+ResmrKKDVB8Qe8kFAkSm3mburFuKCJHGbMuHki817eXO2Y KcjcfkN30cpm6sETt8mYd6JAhzoyZY+aLIC1GoRpdMgIW+Ab4ajC2FBN8uj/c12m3A== X-Gm-Gg: AR+sD13Sol4/XeNZtvuqmUjvWkeqFmjTHVZm+sy6yPCk0fbrtU4E4oS/TjkD+2DvBtT ay3M1iu7Wu7vJSrkmWn070ocorhcOxTc/1TQmMTFV+hghGYsSlZ3g1BzdVBBVM4KZF9DH0tX/QD 3sZ92bcJK2ft0sshEOLhVCsRuDl9tN+QAvrRzwKA/DiiJIewGn3dveH5Sn25fVVnh7qskFULbLx VDs+wmJYOxpRZ3MY5KrC5jZ7YITpNbjDTeHO93rHzrG2yd19vAxzGJnB0LDZpK3pBi6TEAKeLYn 9yOQWqC1E1wiP2eOd/Lx6PxJ0mV0EFEjmWglrDDJ1DcQkNhjbWZ/lKzkA4evJTaYAMyw66xY7F1 M8PCVKYiSpzpphnCtWmFiCdBIExjaHl16o2Xpf8va4vPRzEnkmVffwE2XuHiDJLKJDChQrCaY2z dNeae/9QMQJ7UCPSfRy6gjEGFfAWQ+m+nRujz3ghWIG/uEE0T1ngrv3ls1p0ch8dopFSVrEaFvi sXEv7Wc1yMuI+ON7BFBC8ZOiFh76se12ltykQLvbR99hWVQRyRFdhcgdA29xXJNlQbJVr925qhq C5vchMPY9Dq+wCjJ+9oOOdDTiZzH+DN5Ah+V/YFyilueS8r50OSXScsnABaMYRIDcBJMsmCpQeN jI9yNHE9ixyqVgruXbe3qkdHhMgi/KLF7NpH4zljf8hi64K93rqinaGh55vbP7Z7JtFlOVNvSLz i/f7+cA54EMG3utTST+NvgwVku X-Received: by 2002:a05:6402:51cf:b0:6a1:4458:7f2d with SMTP id 4fb4d7f45d1cf-6a14f0a65d2mr4988463a12.5.1785957773983; Wed, 05 Aug 2026 12:22:53 -0700 (PDT) Received: from Desktop (pd9513cee.dip0.t-ipconnect.de. [217.81.60.238]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6a17d6216cesm1180713a12.31.2026.08.05.12.22.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Aug 2026 12:22:52 -0700 (PDT) From: Julius Bairaktaris To: jjohnson@kernel.org Cc: ath11k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, baochen.qiang@oss.qualcomm.com, vasanthakumar.thiagarajan@oss.qualcomm.com, rameshkumar.sundaram@oss.qualcomm.com Subject: [PATCH ath-next 2/2] wifi: ath11k: initialise the CE descriptor waitqueue once per device Date: Wed, 5 Aug 2026 21:21:29 +0200 Message-ID: <20260805192129.61113-2-julius@bairaktaris.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260805192129.61113-1-julius@bairaktaris.de> References: <20260805192129.61113-1-julius@bairaktaris.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ath11k_wmi_pdev_attach() runs init_waitqueue_head() on the pdev's tx_ce_desc_wq. It is called from ath11k_wmi_attach() -> ath11k_core_start(), which firmware crash recovery re-runs through ath11k_core_qmi_firmware_ready(), so the head is reinitialised on every recovery - including while a task is still queued on it. Parts with hw_params.credit_flow clear - ipq8074, ipq6018, ipq5018, wcn6750 - take the else branch of ath11k_wmi_cmd_send() and sleep there in wait_event_timeout() for up to WMI_SEND_TIMEOUT_HZ. That is longer than a recovery takes, so an ordinary WMI command issued from userspace just before the crash is still on the queue when the head is cleared under it, and finish_wait() then deletes the entry from a list head that no longer refers to it: WARNING: CPU: 1 PID: 1861 at lib/list_debug.c:62 __list_del_entry_valid_or_report+0x110/0x154 CPU: 0 UID: 101 Comm: hostapd Call trace: __list_del_entry_valid_or_report+0x110/0x154 (P) finish_wait+0xcc/0xd0 ath11k_wmi_cmd_send+0x150/0x2f4 [ath11k] ath11k_wmi_vdev_set_param_cmd+0x64/0xd8 [ath11k] ath11k_mac_op_bss_info_changed+0xe8/0xf60 [ath11k] drv_link_info_changed+0x118/0x160 [mac80211] ieee80211_link_info_change_notify+0xe0/0x100 [mac80211] ieee80211_change_bss+0x1c8/0x250 [mac80211] nl80211_set_bss+0x1a0/0x330 [cfg80211] Initialise it where its credit-flow sibling ab->wmi_ab.tx_credits_wq is already initialised, in ath11k_core_alloc(), which runs once per device. The array is fixed size, so all of it can be set up before any pdev is attached, and nothing on the recovery path touches the head again. Reproduced on a Xiaomi AX3600 (IPQ8074 hw2.0) with a userspace loop pushing beacon updates while the firmware is asserted through the debugfs simulate_fw_crash 'assert' trigger, on a stock ath11k with no out-of-tree modules loaded: one warning per recovery, on all eleven recoveries observed across two builds, and none at all over six recoveries with this applied. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.12-01460-QCAHKSWPL_SILICONZ-1 Fixes: f951380a6022 ("ath11k: Disabling credit flow for WMI path") Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris --- drivers/net/wireless/ath/ath11k/core.c | 5 +++++ drivers/net/wireless/ath/ath11k/wmi.c | 1 - 2 files changed, 5 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath11k/core.c +++ b/drivers/net/wireless/ath/ath11k/core.c @@ -2746,6 +2746,7 @@ enum ath11k_bus bus) { struct ath11k_base *ab; + int i; ab = kzalloc(sizeof(*ab) + priv_size, GFP_KERNEL); if (!ab) @@ -2772,6 +2773,10 @@ INIT_LIST_HEAD(&ab->peers); init_waitqueue_head(&ab->peer_mapping_wq); init_waitqueue_head(&ab->wmi_ab.tx_credits_wq); + + for (i = 0; i < ARRAY_SIZE(ab->wmi_ab.wmi); i++) + init_waitqueue_head(&ab->wmi_ab.wmi[i].tx_ce_desc_wq); + init_waitqueue_head(&ab->qmi.cold_boot_waitq); INIT_WORK(&ab->restart_work, ath11k_core_restart); INIT_WORK(&ab->update_11d_work, ath11k_update_11d); --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -9064,7 +9064,6 @@ ab->wmi_ab.wmi_endpoint_id[pdev_idx] = conn_resp.eid; ab->wmi_ab.wmi[pdev_idx].eid = conn_resp.eid; ab->wmi_ab.max_msg_len[pdev_idx] = conn_resp.max_msg_len; - init_waitqueue_head(&ab->wmi_ab.wmi[pdev_idx].tx_ce_desc_wq); return 0; }