From nobody Tue Sep 29 06:59:15 2026 Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F071B411661 for ; Tue, 11 Aug 2026 08:27:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786436836; cv=none; b=t7ySsSQd9f5O6Ha7GumxmedZukVUj9q4N9xiw/Z1bECU+9DVtyTrg0XGkm7fG2z+Qnw20dik89DNu0DIS3W/Ui9jgh+NPoccNB88wevGeIxdCszZZ3kwgqvYAwahm3z2FJ8hkK6+daX9mvOFfuswHA+iRIXN/UG2FVWnFcT60oU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786436836; c=relaxed/simple; bh=ok4xpuQbwDIqZ3qpbUpj7vT70ITusOHkGyK7XwCc8+w=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=CebShgG/lsjakXnW46XSVmzz1DUWQBj56BHw47rKNaZ0WQpchd+LgUUoFXCnGZJl8+dJ6cP81K91WGPprlSaKZ5cfFURwaaNobs7qZPpvohQ4L7SZh6eDe/BSRx3NZUDS6b7GyLuhnEz/z5nShrqiN8ZrBX/HXgWESfD+eCNfz4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ohm9RiNb; arc=none smtp.client-ip=209.85.221.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ohm9RiNb" Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-47f3b39f2a1so2300553f8f.2 for ; Tue, 11 Aug 2026 01:27:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786436832; x=1787041632; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3WNN0jBnqjNkMd8rlfEtTd2nbjLXRpa7uvLdlshlheE=; b=Ohm9RiNb9d7EF0IcEz4SKAyDBFnJEB/RbFNtXxK+Ed2mlDkTStJaW2WQJvgUjX6Xv0 MXnB7MJ6/+LdrSXesd7kVUT4znetD2PVjac3c7KFupKgUfKqNPJmmm3QoVugnvuxfn5P CEDFG/Sim2KdANFd+fllqz9ClQZuqwW9Rwr86mWy2xaChysP8DrNvELRJL7o2O6w0Rpd sWs5iVReC/cjkldMLZS41f6iwXPZTvB0mDpEhZD5HjATJ0kYjOCPpjQ7IXvOwrxUspOy lSa0eVxtwzWVf+l15EyvI4xFV/9Uw5nsrCTAhKwrtRUUxwUkL5B81XNmS1S1+qaULR4a uRVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786436832; x=1787041632; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3WNN0jBnqjNkMd8rlfEtTd2nbjLXRpa7uvLdlshlheE=; b=S9rz511rdF5v6/wjXqvCwPpyEUvOYdKtLKV58qYG+uOrsyxyIRs0hgR4PUKyfDI0N4 qIz2PiQPKPXNDvuoZYx4hxCBaZXN+qiZVyZOJL0e5sYMR8RJi+jI3xNtFWjuVVFG2u01 2bRnv2FT5893/hV8mSbgDyTvQjCnw+2kME6Rbwe3omPKE5DxOQv3TfpIgM0qL5bAZmmZ HLq8VAzQMKcAMhjSN8XWfyQS67Lx12TEf8dRnMozMa8QCbuNZKhdpyLbVcSY+vo47MBn lUhRzD6DftlO4/sHAASsAV1Cx9ua9oNWsEaFZHWECzGsOAhTZYtGAnEr7G+qPRmzp5Mi 0Qlw== X-Forwarded-Encrypted: i=1; AHgh+Rq3Heu9pRFde2yMAoo5JKswptw1oyUpDXJAY9oruyeReSAFGYt0Xfa+1kqLrdfwGDcFWkc2l17wbYe+/3Y=@vger.kernel.org X-Gm-Message-State: AOJu0YxUMVMWmHVm5hvyqpZbC+LkOpVrpfE69x+Frs4lS7khwg0yOagy OXmRMnkI1AhXcDuXi3s/oaVeYAmM5Y3nqGMAa5DttRvv0EVJDANyrFjV X-Gm-Gg: AR+sD11SIXpu9ObdhuY1yCh7ki0jhCvACJt79QqyMQ21J1dFVFk9m+kQeH4NyD5JU88 QetjWHUbgLIK57kPkXw3/sjZyoEPPNnDNao80poWJV8Uo0/EbarFCY+UT7DefaBsovMN0XJzxoM HrdMGycrd/bb4M59vzA3kVk67mD+upbxj4qSdp51WJDonGWZyA4vIi6Y0UBNyd4Y0ZyU/pZRVgI BwClinFsWWA8Z4UApCSY00cnmQ0mO30XnAUdTrNk/dDrZ3yUGbtmvKqqGxV90BuYaE6rl+hyYE7 8aeFr6nYmBRgvq/Q4000ApKMTc7ecr1kGlEq6umhepx71sNRiQ0QG+Ic7G3+qHC4Cf+G3hQAM4Q 9oN/4nfB1H4rHTrS+v2egJP8p4Oks915hvm8k+ynemw5Hu2bm78792ySf1IJbH3gL8MpvV1MZvB DRj2apk4KVxti6VdiR6OAxyiXzp5+fde98kQz4RC/xBfsfY2HlFA+2VkuNQfqnUAD/VID01bcgu R3M7BZ28mwjV5599f7xHXky3fbIznrDdEGCRawiNsWW1HpYONTzq9/VHen5oZJUJkXEpyXmIlOz 8FPSOf6QkBtI8ApVYMXEmg9v8a2PSzocaRRjKm469Zhdp283xbTSOB7girGW/YnRj1A9 X-Received: by 2002:a05:600c:4f49:b0:499:726c:d658 with SMTP id 5b1f17b1804b1-4997913bf43mr15555825e9.19.1786436831868; Tue, 11 Aug 2026 01:27:11 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a133-e401-bc8e-d36c-2d08-c5e0.310.pool.telefonica.de. [2a02:3100:a133:e401:bc8e:d36c:2d08:c5e0]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49977e89d68sm21853155e9.3.2026.08.11.01.27.10 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 11 Aug 2026 01:27:11 -0700 (PDT) From: Karl Mehltretter To: Arend van Spriel , linux-wireless@vger.kernel.org Cc: Karl Mehltretter , Hante Meuleman , "John W. Linville" , Franky Lin , Pieter-Paul Giesberts , brcm80211@lists.linux.dev, brcm80211-dev-list.pdl@broadcom.com, linux-kernel@vger.kernel.org Subject: [PATCH] wifi: brcmfmac: fix lost 802.1x TX completion wakeup Date: Tue, 11 Aug 2026 10:27:02 +0200 Message-Id: <20260811082702.44521-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" brcmf_txfinalize() decrements pend_8021x_cnt before a lockless waitqueue_active() check. atomic_dec() does not order the decrement against the check. The waiter can therefore observe a nonzero count while the waker observes an empty queue, losing the final wakeup and delaying key installation until the 950 ms timeout. Add smp_mb__after_atomic() to order the decrement before the queue check. wait_event_timeout() provides the matching barrier. LKMM confirms that this forbids the lost-wakeup outcome. Fixes: 21fff75d2fb6 ("brcmfmac: use wait_event_timeout for 8021x pending co= unt") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Acked-by: Arend van Spriel --- LKMM results with herdtools7 7.58: C brcmf-wakeup-buggy { atomic_t cnt =3D ATOMIC_INIT(1); } P0(atomic_t *cnt, int *wq) { int r0; atomic_dec(cnt); r0 =3D READ_ONCE(*wq); } P1(atomic_t *cnt, int *wq) { int r1; WRITE_ONCE(*wq, 1); smp_mb(); r1 =3D atomic_read(cnt); } exists (0:r0=3D0 /\ 1:r1=3D1) The fixed variant adds smp_mb__after_atomic() immediately after atomic_dec(). Observation brcmf-wakeup-buggy Sometimes 1 3 Observation brcmf-wakeup-fixed Never 0 3 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/driv= ers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index dad6f4563d146..b192947ab4735 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -555,6 +555,8 @@ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_b= uff *txp, bool success) if (type =3D=3D ETH_P_PAE) { atomic_dec(&ifp->pend_8021x_cnt); + /* Order the decrement before waitqueue_active() */ + smp_mb__after_atomic(); if (waitqueue_active(&ifp->pend_8021x_wait)) wake_up(&ifp->pend_8021x_wait); } -- 2.53.0