From nobody Sat Jul 25 03:03:37 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6117D3AFD00 for ; Mon, 20 Jul 2026 07:09:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531356; cv=none; b=XhYOjtaCVy41Usq5S7wk5YV3U9T9Dn9hHu+7sbOU4E0e3kg3i5CpkAPum+t0AVnDz9rbL07K5sg1D1oh2EyEcyC4tEiqY4Aj4zQOdXW1+juOhKDoW5Cq+KjnsCMzwiNNg8L0eRVtnopVEYiO+sKj4ljrYTNzaOBeVwqoWttMEN4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531356; c=relaxed/simple; bh=lU5XdN+Z+fIhyxORcq1+yYr903O+u/Ar8alvznAu4CU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Y7bJrBg7fsbN/rrRmx8UV/pN2U28HdgC4xWpT9nPeqfv6TKy8kKImNb3fs3vaeBv/L49jR48mw7VinmUQOHLMrw6L4YNocdoruoJJBc7+6j+M887Ucm7JORQPgIpe6242gdHlbpeuW6o8gn7C/RaN/78JqdyjirJCyFtCTP7OFo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=dG4uWqcc; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="dG4uWqcc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784531354; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=twTRlkMXD/z1Gr2vCEQL+bD8mFIwWASPUQB9fXMASFg=; b=dG4uWqcc8onotCAbVpLv/BTJ9q9w1F0bc8ltBvAZe64GFc5B0Z2DAorOLXF/w+oA1ltfT0 VWyO4l2Z+Ll5K1kJG/1A3yrudoAQHmVbHHB6tBV9EkFuYF8dFvEZSUUJUAz/HB0BhxHhbe 5jiWAE/zUNfjsQR31HIVp8NlYp9cij4= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-341-oBNwQL9iNnGKbuYFahqJ_g-1; Mon, 20 Jul 2026 03:09:11 -0400 X-MC-Unique: oBNwQL9iNnGKbuYFahqJ_g-1 X-Mimecast-MFC-AGG-ID: oBNwQL9iNnGKbuYFahqJ_g_1784531350 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9616E1802174; Mon, 20 Jul 2026 07:09:09 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.44.48.69]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DBB6F180058C; Mon, 20 Jul 2026 07:09:06 +0000 (UTC) From: Jose Ignacio Tornos Martinez To: jjohnson@kernel.org Cc: ath11k@lists.infradead.org, ath12k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Jose Ignacio Tornos Martinez Subject: [PATCH v3 1/3] wifi: mac80211: add ieee80211_tx_peek API Date: Mon, 20 Jul 2026 09:08:49 +0200 Message-ID: <20260720070852.206495-2-jtornosm@redhat.com> In-Reply-To: <20260720070852.206495-1-jtornosm@redhat.com> References: <20260720070852.206495-1-jtornosm@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Add ieee80211_tx_peek() to allow drivers to inspect the next frame in a TXQ without removing it. Drivers implementing custom wake_tx_queue operations may need to determine which hardware TX ring to use before dequeuing a packet, using properties like the skb hash or queue mapping that are only available from the skb itself. The function checks pending fragments first, then iterates through all fair-queue flows (new_flows and old_flows) to find the first queued frame, matching the iteration behavior of fq_tin_dequeue. It also pre-caches the skb hash via skb_get_hash() so that hash-based ring selectors see a stable value through the subsequent dequeue and TX path. Signed-off-by: Jose Ignacio Tornos Martinez --- v3: no modification v2: https://lore.kernel.org/all/20260715125017.277242-2-jtornosm@redhat.com/ include/net/mac80211.h | 20 ++++++++++++++++++++ net/mac80211/tx.c | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 4f95da023746..9289b8dca972 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -7742,6 +7742,26 @@ void ieee80211_unreserve_tid(struct ieee80211_sta *s= ta, u8 tid); struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, struct ieee80211_txq *txq); =20 +/** + * ieee80211_tx_peek - peek at the next packet in a software tx queue + * + * @hw: pointer as obtained from ieee80211_alloc_hw() + * @txq: pointer obtained from station or virtual interface, or from + * ieee80211_next_txq() + * + * Return: the next skb without dequeuing it, or %NULL if the queue is emp= ty. + * The returned pointer is const =E2=80=94 the caller must not modify or f= ree the skb. + * The skb remains queued and will be returned by a subsequent + * ieee80211_tx_dequeue() call. + * + * This is useful for drivers that need to inspect the next frame (e.g. to + * determine the target TX ring) before deciding whether to dequeue. + * + * Must be called in the same context as ieee80211_tx_dequeue(). + */ +const struct sk_buff *ieee80211_tx_peek(struct ieee80211_hw *hw, + struct ieee80211_txq *txq); + /** * ieee80211_tx_dequeue_ni - dequeue a packet from a software tx queue * (in process context) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index c13b209fad47..91bfd8ef9428 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3857,6 +3857,45 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub= _if_data *sdata, return true; } =20 +const struct sk_buff *ieee80211_tx_peek(struct ieee80211_hw *hw, + struct ieee80211_txq *txq) +{ + struct txq_info *txqi =3D container_of(txq, struct txq_info, txq); + struct ieee80211_local *local =3D hw_to_local(hw); + struct fq_tin *tin =3D &txqi->tin; + struct fq *fq =3D &local->fq; + struct sk_buff *skb =3D NULL; + struct fq_flow *flow; + + WARN_ON_ONCE(softirq_count() =3D=3D 0); + + spin_lock_bh(&fq->lock); + + skb =3D skb_peek(&txqi->frags); + if (skb) + goto out; + + list_for_each_entry(flow, &tin->new_flows, flowchain) { + skb =3D skb_peek(&flow->queue); + if (skb) + goto out; + } + + list_for_each_entry(flow, &tin->old_flows, flowchain) { + skb =3D skb_peek(&flow->queue); + if (skb) + goto out; + } + +out: + if (skb) + skb_get_hash(skb); + + spin_unlock_bh(&fq->lock); + return skb; +} +EXPORT_SYMBOL_GPL(ieee80211_tx_peek); + struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, struct ieee80211_txq *txq) { --=20 2.54.0 From nobody Sat Jul 25 03:03:37 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 56CE33B71C5 for ; Mon, 20 Jul 2026 07:09:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531361; cv=none; b=H5I7oAkHP6QWAd6o6yeZDwvoOekcB7nEe5rH+mjvIhV0/5cpt+cOodCvLmdmYaBbacre1nWDH3aLnB/Rp32pXCDiHMiFX7lV6pE9U8RoG4OOuZyG7Qh3iKx7Io/2Dcgm2AOC9d/dhKqhsaabAUe0MUeaKoe2gTMCgGEiiYnm82M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531361; c=relaxed/simple; bh=qCZYdt2Fpv0bYeGUs7urqVS70LiOaGHYaleh4hPBm8M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EfjNvK+P1DVENK+25J4cHg+brszFJvPA9w1P7Gs6BcK1E3uJEf0O0BI2zVJute8TVrcIuXDFNwsLXSJfrnM5cfgY5C8QueWhLxMOZDtMCH10q0fJCLUbX1uI4A3pmgy8qbLg5g33Uuu2QxFFFPJgVzwgjkZRmoNAtq8UYCUlXT4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=XYbJkZSB; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="XYbJkZSB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784531359; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=76WUS4y9G8N+M15DI58hZKJO0HW9L3tuGSU3+bl3J/4=; b=XYbJkZSBh5kdSrMsVk7NIpKzV4iQzduGZ91X9bZNs46syNwx7f31W0qLsJxLyCYFw/6ES6 jzxX26BB8nqFijrmqhPPtK0e/WgwQemxwyTi+LpjFBW7vkjZX9IDhNwmKIi4OOH6JHI+jv 8ZeH/PkM6HVXax4ZWZkKedUvJM2nD5Q= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-445-A46j4p8jNL-wo8oCJ2WW4g-1; Mon, 20 Jul 2026 03:09:15 -0400 X-MC-Unique: A46j4p8jNL-wo8oCJ2WW4g-1 X-Mimecast-MFC-AGG-ID: A46j4p8jNL-wo8oCJ2WW4g_1784531354 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DA7D31944B2E; Mon, 20 Jul 2026 07:09:13 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.44.48.69]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A8A9A180034F; Mon, 20 Jul 2026 07:09:11 +0000 (UTC) From: Jose Ignacio Tornos Martinez To: jjohnson@kernel.org Cc: ath11k@lists.infradead.org, ath12k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Jose Ignacio Tornos Martinez Subject: [PATCH v3 2/3] wifi: ath11k: implement custom wake_tx_queue with flow control Date: Mon, 20 Jul 2026 09:08:50 +0200 Message-ID: <20260720070852.206495-3-jtornosm@redhat.com> In-Reply-To: <20260720070852.206495-1-jtornosm@redhat.com> References: <20260720070852.206495-1-jtornosm@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Under heavy traffic, ath11k experiences frequent -ENOMEM errors ("failed to transmit frame -12") when the hardware TCL ring fills up. This issue is more commonly observed in VMs with PCIe passthrough but also occurs on bare metal systems. It is particularly problematic on devices with a single shared TCL ring where all traffic classes compete for the same 512 descriptor slots. Implement a custom wake_tx_queue operation that: 1. Checks hardware ring space before dequeuing packets from mac80211 2. Uses per-txq locking via txq->drv_priv to serialize peek and dequeue operations for the same txq, preventing use-after-free races between ieee80211_tx_peek() and ieee80211_tx_dequeue() when multiple CPUs process the same txq concurrently, while keeping different txqs fully parallel 3. Syncs with hardware state to get accurate free slot count 4. Uses ieee80211_tx_peek() to determine the exact target ring via get_ring_selector(), matching dp_tx on all platforms 5. Returns early during firmware crash in the same way as other tx paths This approach follows the pattern used in the iwlwifi driver, adapted for ath11k's hardware ring architecture. This eliminates -ENOMEM errors and improves throughput by optimizing resource usage and preventing unnecessary packet drops. Signed-off-by: Jose Ignacio Tornos Martinez --- v3: Address the review comments from Tamizh Raja: - Replace per-ring wake_tx_lock with per-txq spinlock via txq->drv_priv to fix race condition between ieee80211_tx_peek() and ieee80211_tx_dequeue() when multiple CPUs process the same txq v2: https://lore.kernel.org/all/20260715125017.277242-3-jtornosm@redhat.com/ drivers/net/wireless/ath/ath11k/mac.c | 80 ++++++++++++++++++++++++++- drivers/net/wireless/ath/ath11k/mac.h | 5 ++ 2 files changed, 84 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/a= th/ath11k/mac.c index 2d55cdc4d165..1eb5edca4ee6 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -7079,6 +7079,7 @@ static int ath11k_mac_op_add_interface(struct ieee802= 11_hw *hw, struct vdev_create_params vdev_param =3D {}; struct peer_create_params peer_param; u32 param_id, param_value; + struct ath11k_txq *atxq; u16 nss; int i; int ret, fbret; @@ -7112,6 +7113,11 @@ static int ath11k_mac_op_add_interface(struct ieee80= 211_hw *hw, INIT_DELAYED_WORK(&arvif->connection_loss_work, ath11k_mac_vif_sta_connection_loss_work); =20 + if (vif->txq) { + atxq =3D (void *)vif->txq->drv_priv; + spin_lock_init(&atxq->lock); + } + for (i =3D 0; i < ARRAY_SIZE(arvif->bitrate_mask.control); i++) { arvif->bitrate_mask.control[i].legacy =3D 0xffffffff; arvif->bitrate_mask.control[i].gi =3D NL80211_TXRATE_FORCE_SGI; @@ -9938,7 +9944,9 @@ static int ath11k_mac_op_sta_state(struct ieee80211_h= w *hw, enum ieee80211_ap_reg_power power_type; struct cur_regulatory_info *reg_info; struct ath11k_peer *peer; + struct ath11k_txq *atxq; int ret =3D 0; + int tid; =20 /* cancel must be done outside the mutex to avoid deadlock */ if ((old_state =3D=3D IEEE80211_STA_NONE && @@ -9957,6 +9965,14 @@ static int ath11k_mac_op_sta_state(struct ieee80211_= hw *hw, INIT_WORK(&arsta->update_wk, ath11k_sta_rc_update_wk); INIT_WORK(&arsta->set_4addr_wk, ath11k_sta_set_4addr_wk); =20 + for (tid =3D 0; tid < ARRAY_SIZE(sta->txq); tid++) { + if (!sta->txq[tid]) + continue; + + atxq =3D (void *)sta->txq[tid]->drv_priv; + spin_lock_init(&atxq->lock); + } + ret =3D ath11k_mac_station_add(ar, vif, sta); if (ret) ath11k_warn(ar->ab, "Failed to add station: %pM for VDEV: %d\n", @@ -10065,9 +10081,70 @@ static int ath11k_mac_op_sta_state(struct ieee8021= 1_hw *hw, return ret; } =20 +static void ath11k_mac_op_wake_tx_queue(struct ieee80211_hw *hw, + struct ieee80211_txq *txq) +{ + struct ath11k_txq *atxq =3D (void *)txq->drv_priv; + struct ieee80211_tx_control control =3D { + .sta =3D txq->sta, + }; + const struct ath11k_hw_ops *ops; + const struct sk_buff *peek_skb; + struct ath11k *ar =3D hw->priv; + struct dp_tx_ring *tx_ring; + struct hal_srng *tcl_ring; + struct sk_buff *skb; + u32 ring_selector; + int num_free; + u8 ring_id; + + if (!ar) + return; + + while (1) { + if (unlikely(test_bit(ATH11K_FLAG_CRASH_FLUSH, + &ar->ab->dev_flags))) + break; + + spin_lock_bh(&atxq->lock); + + peek_skb =3D ieee80211_tx_peek(hw, txq); + if (!peek_skb) { + spin_unlock_bh(&atxq->lock); + break; + } + + ops =3D ar->ab->hw_params.hw_ops; + ring_selector =3D ops->get_ring_selector((struct sk_buff *)peek_skb); + ring_id =3D ring_selector % + ar->ab->hw_params.hal_params->num_tx_rings; + + tx_ring =3D &ar->ab->dp.tx_ring[ring_id]; + tcl_ring =3D &ar->ab->hal.srng_list[tx_ring->tcl_data_ring.ring_id]; + + spin_lock(&tcl_ring->lock); + num_free =3D ath11k_hal_srng_src_num_free(ar->ab, tcl_ring, true); + spin_unlock(&tcl_ring->lock); + + if (num_free =3D=3D 0) { + spin_unlock_bh(&atxq->lock); + break; + } + + skb =3D ieee80211_tx_dequeue(hw, txq); + + spin_unlock_bh(&atxq->lock); + + if (!skb) + break; + + ath11k_mac_op_tx(hw, &control, skb); + } +} + static const struct ieee80211_ops ath11k_ops =3D { .tx =3D ath11k_mac_op_tx, - .wake_tx_queue =3D ieee80211_handle_wake_tx_queue, + .wake_tx_queue =3D ath11k_mac_op_wake_tx_queue, .start =3D ath11k_mac_op_start, .stop =3D ath11k_mac_op_stop, .reconfig_complete =3D ath11k_mac_op_reconfig_complete, @@ -10590,6 +10667,7 @@ static int __ath11k_mac_register(struct ath11k *ar) =20 ar->hw->vif_data_size =3D sizeof(struct ath11k_vif); ar->hw->sta_data_size =3D sizeof(struct ath11k_sta); + ar->hw->txq_data_size =3D sizeof(struct ath11k_txq); =20 wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST); wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_STA_TX_PWR); diff --git a/drivers/net/wireless/ath/ath11k/mac.h b/drivers/net/wireless/a= th/ath11k/mac.h index 59f83c7175fd..b0116ced9c67 100644 --- a/drivers/net/wireless/ath/ath11k/mac.h +++ b/drivers/net/wireless/ath/ath11k/mac.h @@ -14,6 +14,11 @@ struct ath11k; struct ath11k_base; =20 +struct ath11k_txq { + /* protects ieee80211_tx_peek/dequeue serialization per txq */ + spinlock_t lock; +}; + struct ath11k_generic_iter { struct ath11k *ar; int ret; --=20 2.54.0 From nobody Sat Jul 25 03:03:37 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A57C23B6C11 for ; Mon, 20 Jul 2026 07:09:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531366; cv=none; b=R+A+avwEbejI4M6DCh7yFCUiOsZInBqUGkBh0CZgW0aSGvgTeAyXBezUirI/eayDAQQVWeS2rtDPlJpRMfeq4b78jV5IIj6saTF+EIVLLDtS8aGhdo74aTL16BIZ4ReSMAdUZkRipnzkyphD5fALVarBpE4MmBIK1S6OwYVFxpU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784531366; c=relaxed/simple; bh=PCt2uuCyK/gIRYFPGgmteAhY0F6S4OPMSLaGabX0acc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fcTp9XGNUUeVn0hW/32rqLzhRIBNaSvXOhOmGDHHgx91qsOh1iVJZ8hsbzEEArPGYuyfr/WvaI8Kvw75nbDYLD12Lc1sd5pNjvW7nIjowhqJ3HSa2Z+KvFrqNHSQ3rIVTEN4lRKRhJdJao/W7JVgJbWb2/L5JT8hE3f+YtouNA4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=CIPOZ1si; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="CIPOZ1si" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784531363; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ItVte48j2cfPO1m44LhBPhM+Ix/JT2D7ZKzubkk1kfg=; b=CIPOZ1si9+4lg0o3Ss7szieosT1Pfh4ZgCai/mqPYbZcchV0Nk1GZRZEQrT9ekvSAgELMP X3KDK3KTVc4oLbjsDjGbtaXREGTGXtt2GV9yMs5MqPIA3KBxecMpgsNyLwpk1XT7MicfTS TyKzAb2U+7ka2E79wOVAnblLo31EPnM= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-457-d72ivhm9POeYtwKMbp4s_w-1; Mon, 20 Jul 2026 03:09:20 -0400 X-MC-Unique: d72ivhm9POeYtwKMbp4s_w-1 X-Mimecast-MFC-AGG-ID: d72ivhm9POeYtwKMbp4s_w_1784531359 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 14D5A1953961; Mon, 20 Jul 2026 07:09:18 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.44.48.69]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id ADC06180034F; Mon, 20 Jul 2026 07:09:15 +0000 (UTC) From: Jose Ignacio Tornos Martinez To: jjohnson@kernel.org Cc: ath11k@lists.infradead.org, ath12k@lists.infradead.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Jose Ignacio Tornos Martinez Subject: [PATCH v3 3/3] wifi: ath12k: implement custom wake_tx_queue with flow control Date: Mon, 20 Jul 2026 09:08:51 +0200 Message-ID: <20260720070852.206495-4-jtornosm@redhat.com> In-Reply-To: <20260720070852.206495-1-jtornosm@redhat.com> References: <20260720070852.206495-1-jtornosm@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Under heavy traffic, ath12k can hang and experiences -ENOMEM errors ("failed to transmit frame -12") when the hardware TCL ring fills up. This issue is more commonly observed in VMs with PCIe passthrough but also occurs on bare metal systems. Implement a custom wake_tx_queue operation that: 1. Checks hardware ring space before dequeuing packets from mac80211 2. Uses per-txq locking via txq->drv_priv to serialize peek and dequeue operations for the same txq, preventing use-after-free races between ieee80211_tx_peek() and ieee80211_tx_dequeue() when multiple CPUs process the same txq concurrently, while keeping different txqs fully parallel 3. Syncs with hardware state to get accurate free slot count 4. Uses ieee80211_tx_peek() to determine the exact target ring via get_ring_selector(), matching dp_tx on all platforms 5. Returns early during firmware crash in the same way as other tx paths This approach follows the pattern used in the iwlwifi driver, adapted for ath12k's hardware ring architecture. This prevents hangs, eliminates -ENOMEM errors, and improves throughput by optimizing resource usage and preventing unnecessary packet drops. Signed-off-by: Jose Ignacio Tornos Martinez --- v3: Address the review comments from Tamizh Raja: - Replace per-ring wake_tx_lock with per-txq spinlock via txq->drv_priv to fix race condition between ieee80211_tx_peek() and ieee80211_tx_dequeue() when multiple CPUs process the same txq - Fix MLO link selection in wake_tx_queue to use rcu_dereference(ahvif->link[link_id]) instead of deflink, matching the link selection logic in op_tx v2: https://lore.kernel.org/all/20260715125017.277242-4-jtornosm@redhat.com/ drivers/net/wireless/ath/ath12k/hal.c | 1 + drivers/net/wireless/ath/ath12k/mac.c | 17 +++++ drivers/net/wireless/ath/ath12k/mac.h | 5 ++ drivers/net/wireless/ath/ath12k/wifi7/hw.c | 87 +++++++++++++++++++++- 4 files changed, 109 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/a= th/ath12k/hal.c index a164563fff28..c1c656e4550b 100644 --- a/drivers/net/wireless/ath/ath12k/hal.c +++ b/drivers/net/wireless/ath/ath12k/hal.c @@ -390,6 +390,7 @@ int ath12k_hal_srng_src_num_free(struct ath12k_base *ab= , struct hal_srng *srng, else return ((srng->ring_size - hp + tp) / srng->entry_size) - 1; } +EXPORT_SYMBOL_GPL(ath12k_hal_srng_src_num_free); =20 void *ath12k_hal_srng_src_next_peek(struct ath12k_base *ab, struct hal_srng *srng) diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/a= th/ath12k/mac.c index 51c4df32e716..03618a8d3e65 100644 --- a/drivers/net/wireless/ath/ath12k/mac.c +++ b/drivers/net/wireless/ath/ath12k/mac.c @@ -7705,10 +7705,12 @@ int ath12k_mac_op_sta_state(struct ieee80211_hw *hw, struct ath12k_link_vif *arvif; struct ath12k_link_sta *arsta; unsigned long valid_links; + struct ath12k_txq *atxq; u16 selected_links =3D 0; u8 link_id =3D 0, i; struct ath12k *ar; int ret =3D -EINVAL; + int tid; struct ath12k_dp_peer_create_params dp_params =3D {}; =20 lockdep_assert_wiphy(hw->wiphy); @@ -7728,6 +7730,14 @@ int ath12k_mac_op_sta_state(struct ieee80211_hw *hw, memset(ahsta, 0, sizeof(*ahsta)); ahsta->free_logical_link_idx_map =3D U16_MAX; =20 + for (tid =3D 0; tid < ARRAY_SIZE(sta->txq); tid++) { + if (!sta->txq[tid]) + continue; + + atxq =3D (void *)sta->txq[tid]->drv_priv; + spin_lock_init(&atxq->lock); + } + arsta =3D &ahsta->deflink; =20 /* ML sta */ @@ -10790,6 +10800,7 @@ int ath12k_mac_op_add_interface(struct ieee80211_hw= *hw, struct ath12k_vif *ahvif =3D ath12k_vif_to_ahvif(vif); struct ath12k_reg_info *reg_info; struct ath12k_link_vif *arvif; + struct ath12k_txq *atxq; struct ath12k_base *ab; struct ath12k *ar; int i; @@ -10802,6 +10813,11 @@ int ath12k_mac_op_add_interface(struct ieee80211_h= w *hw, ahvif->vif =3D vif; arvif =3D &ahvif->deflink; =20 + if (vif->txq) { + atxq =3D (void *)vif->txq->drv_priv; + spin_lock_init(&atxq->lock); + } + ath12k_mac_init_arvif(ahvif, arvif, -1); =20 /* Allocate Default Queue now and reassign during actual vdev create */ @@ -14899,6 +14915,7 @@ static int ath12k_mac_hw_register(struct ath12k_hw = *ah) =20 hw->vif_data_size =3D sizeof(struct ath12k_vif); hw->sta_data_size =3D sizeof(struct ath12k_sta); + hw->txq_data_size =3D sizeof(struct ath12k_txq); hw->extra_tx_headroom =3D ab->hw_params->iova_mask; =20 wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST); diff --git a/drivers/net/wireless/ath/ath12k/mac.h b/drivers/net/wireless/a= th/ath12k/mac.h index aba98afd4365..2855d8fdb99d 100644 --- a/drivers/net/wireless/ath/ath12k/mac.h +++ b/drivers/net/wireless/ath/ath12k/mac.h @@ -17,6 +17,11 @@ struct ath12k_hw; struct ath12k_hw_group; struct ath12k_pdev_map; =20 +struct ath12k_txq { + /* protects ieee80211_tx_peek/dequeue serialization per txq */ + spinlock_t lock; +}; + struct ath12k_generic_iter { struct ath12k *ar; int ret; diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wirel= ess/ath/ath12k/wifi7/hw.c index d9fdd2fc8298..86c3e9a8b87c 100644 --- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c +++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c @@ -1100,9 +1100,94 @@ static void ath12k_wifi7_mac_op_tx(struct ieee80211_= hw *hw, } } =20 +static void ath12k_wifi7_mac_op_wake_tx_queue(struct ieee80211_hw *hw, + struct ieee80211_txq *txq) +{ + struct ath12k_vif *ahvif =3D ath12k_vif_to_ahvif(txq->vif); + struct ath12k_txq *atxq =3D (void *)txq->drv_priv; + struct ath12k_hw *ah =3D ath12k_hw_to_ah(hw); + struct ieee80211_tx_control control =3D { + .sta =3D txq->sta, + }; + struct ieee80211_vif *vif =3D txq->vif; + const struct ath12k_hw_ops *ops; + const struct sk_buff *peek_skb; + struct ath12k_link_vif *arvif; + struct dp_tx_ring *tx_ring; + struct hal_srng *tcl_ring; + struct ath12k_sta *ahsta; + struct ath12k_dp *dp; + struct sk_buff *skb; + struct ath12k *ar; + u32 ring_selector; + int num_free; + u8 ring_id; + u8 link_id; + + while (1) { + if (unlikely(test_bit(ATH12K_FLAG_CRASH_FLUSH, + &ah->radio[0].ab->dev_flags))) + break; + + spin_lock_bh(&atxq->lock); + + peek_skb =3D ieee80211_tx_peek(hw, txq); + if (!peek_skb) { + spin_unlock_bh(&atxq->lock); + break; + } + + if (ieee80211_vif_is_mld(vif) && txq->sta) { + ahsta =3D ath12k_sta_to_ahsta(txq->sta); + link_id =3D ahsta->assoc_link_id; + } else { + link_id =3D ahvif->deflink.link_id; + } + + rcu_read_lock(); + + arvif =3D rcu_dereference(ahvif->link[link_id]); + if (!arvif || !arvif->ar) { + rcu_read_unlock(); + spin_unlock_bh(&atxq->lock); + break; + } + + ar =3D arvif->ar; + dp =3D ar->ab->dp; + + ops =3D dp->hw_params->hw_ops; + ring_selector =3D ops->get_ring_selector((struct sk_buff *)peek_skb); + ring_id =3D ring_selector % dp->hw_params->max_tx_ring; + + tx_ring =3D &dp->tx_ring[ring_id]; + tcl_ring =3D &dp->hal->srng_list[tx_ring->tcl_data_ring.ring_id]; + + spin_lock(&tcl_ring->lock); + num_free =3D ath12k_hal_srng_src_num_free(ar->ab, tcl_ring, true); + spin_unlock(&tcl_ring->lock); + + if (num_free =3D=3D 0) { + rcu_read_unlock(); + spin_unlock_bh(&atxq->lock); + break; + } + + skb =3D ieee80211_tx_dequeue(hw, txq); + + rcu_read_unlock(); + spin_unlock_bh(&atxq->lock); + + if (!skb) + break; + + ath12k_wifi7_mac_op_tx(hw, &control, skb); + } +} + static const struct ieee80211_ops ath12k_ops_wifi7 =3D { .tx =3D ath12k_wifi7_mac_op_tx, - .wake_tx_queue =3D ieee80211_handle_wake_tx_queue, + .wake_tx_queue =3D ath12k_wifi7_mac_op_wake_tx_queue, .start =3D ath12k_mac_op_start, .stop =3D ath12k_mac_op_stop, .reconfig_complete =3D ath12k_mac_op_reconfig_complete, --=20 2.54.0