wifi: ath11k: fix QRTR readiness related WLAN initialization failures - #878
Open
miaoqing-quic wants to merge 3 commits into
Open
wifi: ath11k: fix QRTR readiness related WLAN initialization failures#878miaoqing-quic wants to merge 3 commits into
miaoqing-quic wants to merge 3 commits into
Conversation
On WCN6750 platforms, reboot stress testing occasionally results in WLAN initialization failures after boot. The WPSS firmware reaches the running state successfully, but no WLAN interface is created. Analysis shows that ath11k_ahb depends on the QRTR SMD transport for QMI communication with WPSS firmware. However, this dependency is not currently expressed in Kconfig, allowing qrtr_smd and ath11k_ahb to load in either order when built as modules. If ath11k_ahb is loaded before qrtr_smd becomes available, WLAN initialization may not complete successfully. Make the QRTR and QRTR_SMD dependencies explicit and add a soft dependency to ensure qrtr_smd is loaded before ath11k_ahb. Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 Fixes: 00402f4 ("ath11k: Add support for WCN6750 device") Link: https://lore.kernel.org/linux-wireless/20260730010505.143458-2-miaoqing.pan@oss.qualcomm.com/ Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
…nit incomplete On WCN6750, if QMI messages never arrive (for example when qrtr_smd is not ready), WLAN initialization stops before the device is fully registered. In this case ATH11K_FLAG_QMI_FAIL is not set because no QMI event handler is executed. When the driver is removed, ath11k_ahb_remove() still calls ath11k_core_deinit(), which eventually triggers ath11k_ce_cleanup_pipes() on uninitialized CE pipes and results in a NULL pointer dereference in ath11k_hal_srng_access_begin(): ath11k_hal_srng_access_begin+0x14/0x68 [ath11k] ath11k_ce_cleanup_pipes+0x184/0x190 [ath11k] ath11k_pcic_stop+0x24/0x38 [ath11k] ath11k_core_deinit+0xfc/0x1c0 [ath11k] ath11k_ahb_remove+0x38/0xa0 [ath11k_ahb] Fix this by invoking ath11k_ahb_remove_prepare() before the state check and skipping ath11k_core_deinit() when either QMI initialization failed or the device was never registered. If ATH11K_FLAG_REGISTERED is not set, core initialization did not complete and CE pipes may remain uninitialized, making ath11k_core_deinit() unsafe. Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 Fixes: 00402f4 ("ath11k: Add support for WCN6750 device") Link: https://lore.kernel.org/linux-wireless/20260730010505.143458-3-miaoqing.pan@oss.qualcomm.com/ Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
ath11k_core_init() registers a PM notifier before the QMI server becomes available. If the QMI server never arrives, the device remove() path can take the early-exit path introduced for QMI initialization failures, skipping ath11k_core_deinit(). As a result, the PM notifier remains registered after the ath11k base object has been freed. A subsequent suspend or resume event may invoke the stale notifier and trigger a use-after-free. Fix this by explicitly unregistering the PM notifier in the QMI failure cleanup path before releasing ath11k resources. Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 Fixes: 32d93b5 ("wifi: ath11k: choose default PM policy for hibernation") Link: https://lore.kernel.org/linux-wireless/20260730010505.143458-4-miaoqing.pan@oss.qualcomm.com/ Signed-off-by: Miaoqing Pan <miaoqing.pan@oss.qualcomm.com>
miaoqing-quic
requested review from
a team,
Dmitry Baryshkov (lumag),
Ricardo Salveti (ricardosalveti) and
Shiraz Hashim (shashim-quic)
July 30, 2026 01:59
|
Merge Check Failed: No Change Task Found No associated change tasks found for CR 4601257 on any of the following entities: Entities:
CR: 4601257 Please ensure the CR has a change task associated with at least one of the entities for this branch. |
Shiraz Hashim (shashim-quic)
approved these changes
Jul 31, 2026
Test Matrix
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On WCN6750 platforms, reboot stress testing occasionally results in WLAN
initialization failures after boot. The WPSS firmware reaches the running
state successfully, but no WLAN interface is created.
Analysis shows that ath11k_ahb depends on the QRTR SMD transport for QMI
communication with WPSS firmware. However, this dependency is not
currently expressed in Kconfig, allowing qrtr_smd and ath11k_ahb to load
in either order when built as modules.
If ath11k_ahb is loaded before qrtr_smd becomes available, WLAN
initialization may not complete successfully.
Make the QRTR and QRTR_SMD dependencies explicit and add a soft
dependency to ensure qrtr_smd is loaded before ath11k_ahb.
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
Fixes: qualcomm-linux/kernel-topics@00402f4 ("ath11k: Add support for WCN6750 device")
CRs-Fixed: 4601257