git.openwrt.org Git - openwrt/openwrt.git/blob

   1 From 16872194c80f2724472fc207991712895ac8a230 Mon Sep 17 00:00:00 2001
   2 From: Sergey Senozhatsky <senozhatsky@chromium.org>
   3 Date: Thu, 12 Jun 2025 17:45:06 +0900
   4 Subject: wifi: ath11k: clear initialized flag for deinit-ed srng lists
   5
   6 [ Upstream commit a5b46aa7cf5f05c213316a018e49a8e086efd98e ]
   7
   8 In a number of cases we see kernel panics on resume due
   9 to ath11k kernel page fault, which happens under the
  10 following circumstances:
  11
  12 1) First ath11k_hal_dump_srng_stats() call
  13
  14  Last interrupt received for each group:
  15  ath11k_pci 0000:01:00.0: group_id 0 22511ms before
  16  ath11k_pci 0000:01:00.0: group_id 1 14440788ms before
  17  [..]
  18  ath11k_pci 0000:01:00.0: failed to receive control response completion, polling..
  19  ath11k_pci 0000:01:00.0: Service connect timeout
  20  ath11k_pci 0000:01:00.0: failed to connect to HTT: -110
  21  ath11k_pci 0000:01:00.0: failed to start core: -110
  22  ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM
  23  ath11k_pci 0000:01:00.0: already resetting count 2
  24  ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110
  25  ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110
  26  ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery
  27  [..]
  28
  29 2) At this point reconfiguration fails (we have 2 resets) and
  30   ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit()
  31   which destroys srng lists.  However, it does not reset per-list
  32   ->initialized flag.
  33
  34 3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized
  35   flag and attempts to dump srng stats:
  36
  37  Last interrupt received for each group:
  38  ath11k_pci 0000:01:00.0: group_id 0 66785ms before
  39  ath11k_pci 0000:01:00.0: group_id 1 14485062ms before
  40  ath11k_pci 0000:01:00.0: group_id 2 14485062ms before
  41  ath11k_pci 0000:01:00.0: group_id 3 14485062ms before
  42  ath11k_pci 0000:01:00.0: group_id 4 14780845ms before
  43  ath11k_pci 0000:01:00.0: group_id 5 14780845ms before
  44  ath11k_pci 0000:01:00.0: group_id 6 14485062ms before
  45  ath11k_pci 0000:01:00.0: group_id 7 66814ms before
  46  ath11k_pci 0000:01:00.0: group_id 8 68997ms before
  47  ath11k_pci 0000:01:00.0: group_id 9 67588ms before
  48  ath11k_pci 0000:01:00.0: group_id 10 69511ms before
  49  BUG: unable to handle page fault for address: ffffa007404eb010
  50  #PF: supervisor read access in kernel mode
  51  #PF: error_code(0x0000) - not-present page
  52  PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0
  53  Oops: 0000 [#1] PREEMPT SMP NOPTI
  54  RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k]
  55  Call Trace:
  56  <TASK>
  57  ? __die_body+0xae/0xb0
  58  ? page_fault_oops+0x381/0x3e0
  59  ? exc_page_fault+0x69/0xa0
  60  ? asm_exc_page_fault+0x22/0x30
  61  ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)]
  62  ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)]
  63  worker_thread+0x389/0x930
  64  kthread+0x149/0x170
  65
  66 Clear per-list ->initialized flag in ath11k_hal_srng_deinit().
  67
  68 Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
  69 Reviewed-by: Baochen Qiang <quic_bqiang@quicinc.com>
  70 Fixes: 5118935b1bc2 ("ath11k: dump SRNG stats during FW assert")
  71 Link: https://patch.msgid.link/20250612084551.702803-1-senozhatsky@chromium.org
  72 Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
  73 Signed-off-by: Sasha Levin <sashal@kernel.org>
  74 ---
  75  drivers/net/wireless/ath/ath11k/hal.c | 4 ++++
  76  1 file changed, 4 insertions(+)
  77
  78 (limited to 'drivers/net/wireless/ath/ath11k')
  79
  80 --- a/drivers/net/wireless/ath/ath11k/hal.c
  81 +++ b/drivers/net/wireless/ath/ath11k/hal.c
  82 @@ -1341,6 +1341,10 @@ EXPORT_SYMBOL(ath11k_hal_srng_init);
  83  void ath11k_hal_srng_deinit(struct ath11k_base *ab)
  84  {
  85         struct ath11k_hal *hal = &ab->hal;
  86 +       int i;
  87 +
  88 +       for (i = 0; i < HAL_SRNG_RING_ID_MAX; i++)
  89 +               ab->hal.srng_list[i].initialized = 0;
  90
  91         ath11k_hal_unregister_srng_key(ab);
  92         ath11k_hal_free_cont_rdp(ab);