[PATCH 2/2] wifi: ath9k_htc: count WMI timeouts and length-discarded frames

From: Nerijus Bendžiūnas

Date: Thu Sep 03 2026 - 14:02:58 EST


A WMI command that times out is invisible unless CONFIG_ATH_DEBUG is on
and the WMI debug bit is set, yet it is the event behind every register
read that came back as -1. Likewise the receive path discards short and
zero-length frames with nothing but a debug message, although a burst of
them is what strong interference looks like from the host. Keep a count
of commands sent and timed out in a new debugfs file, wmi, and count the
length discards in the existing LENGTH-ERR line of recv, so both can be
watched on a stock kernel.

Signed-off-by: Nerijus Bendžiūnas <nerijus.bendziunas@xxxxxxxxx>
---
drivers/net/wireless/ath/ath9k/htc.h | 2 ++
.../net/wireless/ath/ath9k/htc_drv_debug.c | 25 +++++++++++++++++++
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 3 +++
drivers/net/wireless/ath/ath9k/wmi.c | 2 ++
drivers/net/wireless/ath/ath9k/wmi.h | 2 ++
5 files changed, 34 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 6c33e898b300..0bdb300f0ad7 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -328,6 +328,7 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
#ifdef CONFIG_ATH9K_HTC_DEBUGFS
#define __STAT_SAFE(hif_dev, expr) do { ((hif_dev)->htc_handle->drv_priv ? (expr) : 0); } while (0)
#define CAB_STAT_INC(priv) do { ((priv)->debug.tx_stats.cab_queued++); } while (0)
+#define RX_LEN_ERR_INC(priv) ((priv)->debug.rx_stats.rx_len_err++)
#define TX_QSTAT_INC(priv, q) do { ((priv)->debug.tx_stats.queue_stats[q]++); } while (0)

#define TX_STAT_INC(hif_dev, c) \
@@ -383,6 +384,7 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
#define RX_STAT_ADD(hif_dev, c, a) do { } while (0)

#define CAB_STAT_INC(priv)
+#define RX_LEN_ERR_INC(priv)
#define TX_QSTAT_INC(priv, c)

static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index 9437d69877cc..f1bf8cc90d3a 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -310,6 +310,29 @@ static const struct file_operations fops_slot = {
.llseek = default_llseek,
};

+static ssize_t read_file_wmi(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ struct ath9k_htc_priv *priv = file->private_data;
+ char buf[128];
+ unsigned int len;
+
+ len = scnprintf(buf, sizeof(buf),
+ "%20s : %10u\n"
+ "%20s : %10u\n",
+ "Commands", priv->wmi->cmds_sent,
+ "Timeouts", priv->wmi->cmds_timed_out);
+
+ return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_wmi = {
+ .read = read_file_wmi,
+ .open = simple_open,
+ .owner = THIS_MODULE,
+ .llseek = default_llseek,
+};
+
static ssize_t read_file_queue(struct file *file, char __user *user_buf,
size_t count, loff_t *ppos)
{
@@ -505,6 +528,8 @@ int ath9k_htc_init_debug(struct ath_hw *ah)

debugfs_create_file("slot", 0400, priv->debug.debugfs_phy,
priv, &fops_slot);
+ debugfs_create_file("wmi", 0400, priv->debug.debugfs_phy,
+ priv, &fops_wmi);
debugfs_create_file("queue", 0400, priv->debug.debugfs_phy,
priv, &fops_queue);
debugfs_create_file("debug", 0600, priv->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 299064a7fa49..aa4c8beb10d5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -986,6 +986,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",
skb->len);
+ RX_LEN_ERR_INC(priv);
goto rx_next;
}

@@ -997,6 +998,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
ath_err(common,
"Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n",
rs_datalen, skb->len);
+ RX_LEN_ERR_INC(priv);
goto rx_next;
}

@@ -1009,6 +1011,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
ath_dbg(common, ANY,
"Short RX data len, dropping (dlen: %d)\n",
rs_datalen);
+ RX_LEN_ERR_INC(priv);
goto rx_next;
}

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 284e8c13b043..d293f3adc214 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -345,8 +345,10 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
if (ret)
goto out;

+ wmi->cmds_sent++;
time_left = wait_for_completion_timeout(&wmi->cmd_wait, timeout);
if (!time_left) {
+ wmi->cmds_timed_out++;
ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
wmi_cmd_to_name(cmd_id));
spin_lock_irqsave(&wmi->wmi_lock, flags);
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index 5c3b710b8f31..9dc5deffcdfe 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -158,6 +158,8 @@ struct wmi {
u8 *cmd_rsp_buf;
u32 cmd_rsp_len;
bool stopped;
+ u32 cmds_sent;
+ u32 cmds_timed_out;

struct list_head pending_tx_events;
spinlock_t event_lock;
--
2.55.0