Re: [PATCH ath-next v2 0/5] wifi: ath11k: firmware crash recovery fixes

From: Julius Bairaktaris

Date: Sun Nov 01 2026 - 11:52:01 EST


Hi Florian,

Thanks for the testing and for your three patches.

> That recovery fails after ath11k_hal_srng_clear() but before
> ath11k_ce_init_pipes(). The next recovery then tears down the CE pipes
> on the cleared rings and hits a NULL pointer with BHs disabled (under
> ce_lock):

My v3 covers this case in 3/5 and 4/5. In 3/5,
ath11k_ce_completed_send_next() returns -EIO for a ring without a tail
pointer before it takes srng->lock, since ath11k_hal_srng_clear()
zeroes the lock with the ring, and ath11k_ce_send() tests CRASH_FLUSH
before it reaps. In 4/5, ath11k_core_qmi_firmware_ready() clears
CRASH_FLUSH once the rings are rebuilt and sets it again on its error
path before ath11k_dp_free().

> I can try that if you don't plan to cover it in a v3.

I will run your crash 10-20 ms after "is now up" against v3 on my
AX3600 and post it with your three patches on top as one series, with
your From: and Signed-off-by kept and your Tested-by on my five. Is
that fine with you?

Thanks,
Julius