linux-kernel - Re: [REGRESSION] ath10k fails initialization, bisected to "wifi: ath10k: avoid unnecessary wait for service ready message"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5466e122-9143-482e-a9ab-7f956e19bf86@oss.qualcomm.com>
Date: Wed, 22 Oct 2025 16:00:20 +0800
From: Baochen Qiang <baochen.qiang@....qualcomm.com>
To: Klaus Kudielka <klaus.kudielka@...il.com>,
        Jeff Johnson <jeff.johnson@....qualcomm.com>,
        Jeff Johnson <jjohnson@...nel.org>, Kalle Valo <kvalo@...nel.org>,
        Baochen Qiang <quic_bqiang@...cinc.com>
Cc: linux-wireless@...r.kernel.org, ath10k@...ts.infradead.org,
        linux-kernel@...r.kernel.org, Paul Menzel <pmenzel@...gen.mpg.de>,
        regressions@...ts.linux.dev
Subject: Re: [REGRESSION] ath10k fails initialization, bisected to "wifi:
 ath10k: avoid unnecessary wait for service ready message"



On 10/18/2025 9:50 PM, Klaus Kudielka wrote:
> On Fri, 2025-10-17 at 08:57 -0700, Jeff Johnson wrote:
>> On 10/17/2025 8:37 AM, Klaus Kudielka wrote:
>>> Unfortunately, this particular commit completely breaks the ath10k driver in my setup.
>>>
>>>
>>> Hardware:
>>> - Turris Omnia (arch/arm/boot/dts/marvell/armada-385-turris-omnia.dts)
>>> - Wifi card (output from lspci): Network controller: Qualcomm Atheros QCA986x/988x 802.11ac Wireless Network Adapter
>>
>> This issue was previously reported with that particular chipset.
>> This is currently being tracked at:
>> https://bugzilla.kernel.org/show_bug.cgi?id=220671
>>
>> It may be useful to supply your information as a separate record to that bug.
>>
>> /jeff
> 
> Some more observations on that topic with the hardware shown above.
> 
> ath10k_core_start() calls ath10k_wmi_wait_for_service_ready(), and later ath10k_wmi_wait_for_unified_ready().
> 
> The now *unconditional* call to ath10k_hif_send_complete_check() inside ath10k_wmi_wait_for_service_ready()
> makes the later call to ath10k_wmi_wait_for_unified_ready() fail.
> 
> If I call and handle wait_for_completion_timeout() first (as it was before the patch),
> ath10k_hif_send_complete_check() is *not* called, and both ath10k_wmi_wait_for_service_ready() and
> ath10k_wmi_wait_for_unified_ready() succeed. Everything is back to normal.
> 
> Side note:
> ath10k_wmi_wait_for_service_ready() succeeds in both cases with time_left == WMI_SERVICE_READY_TIMEOUT_HZ.
> 
> 
> #regzbot monitor: https://bugzilla.kernel.org/show_bug.cgi?id=220671

Thank you Klaus, can you please try if below diff can fix this regression?

diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index 7bbda46cfd93..1a981d333b5c 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1256,6 +1256,19 @@ void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int
ce_id)
 }
 EXPORT_SYMBOL(ath10k_ce_per_engine_service);

+void ath10k_ce_per_engine_check(struct ath10k *ar, unsigned int ce_id)
+{
+       struct ath10k_ce *ce = ath10k_ce_priv(ar);
+       struct ath10k_ce_pipe *ce_state = &ce->ce_states[ce_id];
+
+       if (ce_state->recv_cb)
+               ce_state->recv_cb(ce_state);
+
+       if (ce_state->send_cb)
+               ce_state->send_cb(ce_state);
+}
+EXPORT_SYMBOL(ath10k_ce_per_engine_check);
+
 /*
  * Handler for per-engine interrupts on ALL active CEs.
  * This is used in cases where the system is sharing a
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 27367bd64e95..9923530e51eb 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -255,6 +255,7 @@ int ath10k_ce_cancel_send_next(struct ath10k_ce_pipe *ce_state,
 /*==================CE Interrupt Handlers====================*/
 void ath10k_ce_per_engine_service_any(struct ath10k *ar);
 void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id);
+void ath10k_ce_per_engine_check(struct ath10k *ar, unsigned int ce_id);
 void ath10k_ce_disable_interrupt(struct ath10k *ar, int ce_id);
 void ath10k_ce_disable_interrupts(struct ath10k *ar);
 void ath10k_ce_enable_interrupt(struct ath10k *ar, int ce_id);
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 97b49bf4ad80..ce8e0c2fb975 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1812,7 +1812,7 @@ void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
                if (resources > (ar_pci->attr[pipe].src_nentries >> 1))
                        return;
        }
-       ath10k_ce_per_engine_service(ar, pipe);
+       ath10k_ce_per_engine_check(ar, pipe);
 }

 static void ath10k_pci_rx_retry_sync(struct ath10k *ar)