Bug 218623 - ath11k: WCN6855: possible ring buffer corruption
Summary: ath11k: WCN6855: possible ring buffer corruption
Status: NEW
Alias: None
Product: Drivers
Classification: Unclassified
Component: network-wireless (show other bugs)
Hardware: ARM Linux
: P3 normal
Assignee: drivers_network-wireless@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-21 10:11 UTC by Johan Hovold
Modified: 2024-04-15 08:08 UTC (History)
1 user (show)

See Also:
Kernel Version:
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Johan Hovold 2024-03-21 10:11:15 UTC
Over the past year I've received occasional reports from users of the Lenovo ThinkPad X13s that the wifi sometimes stops working. When this happens the kernel log is filled with errors like:

[ 1164.962227] ath11k_warn: 222 callbacks suppressed
[ 1164.962238] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1484, expected 1492
[ 1164.962309] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1484
[ 1164.962994] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1476, expected 1484
[ 1164.963405] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1484, expected 1488
[ 1164.963701] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1480, expected 1484
[ 1164.963852] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1468, expected 1480
[ 1164.964491] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1484, expected 1492
[ 1164.964733] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1488, expected 1492
[ 1165.198329] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1488
[ 1165.198470] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1476
[ 1166.266513] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 2699 at byte 348 (1132 bytes left, 64788 expected)
[ 1166.542803] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 4270 at byte 348 (1128 bytes left, 63772 expected)
[ 1166.768238] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 0 at byte 376 (1112 bytes left, 11730 expected)
[ 1166.900152] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 3 at byte 790 (694 bytes left, 16256 expected)
[ 1168.499073] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 1 at byte 62 (1426 bytes left, 3089 expected)
[ 1168.818086] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 63063 at byte 1466 (10 bytes left, 50467 expected)
[ 1169.032885] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 0 at byte 364 (1120 bytes left, 12483 expected)
[ 1169.308546] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 3092 at byte 348 (1128 bytes left, 64780 expected)
[ 1169.563928] ath11k_pci 0006:01:00.0: wmi tlv parse failure of tag 1 at byte 348 (1124 bytes left, 44062 expected)

which after a quick look at the driver seems to suggest that we may be hitting some kind of ring buffer corruption.

Rebinding the driver supposedly sometimes make things work again, but not always.

The issue has been confirmed with the 6.8 kernel and the latest firmware WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37.

I've triggered this issue twice myself with 6.6 and .23 firmware, but the reports date back to at least 6.2 and likely when using even older firmware.

An unconfirmed hypothesis is that we may be hitting this more often when enabling the GIC ITS so that the interrupt processing is spread out over all cores (unlike when using the DWC controller's internal MSI implementation). This change is now merged for 6.10.
Comment 1 Vadim Likholetov 2024-04-15 08:08:11 UTC
I'm expecting the same problems -- 
[19653.033501] wlan0: disconnect from AP e8:ed:d6:44:df:81 for new auth to e8:ed:d6:44:dd:11
[19653.238739] wlan0: authenticate with e8:ed:d6:44:dd:11 (local address=00:03:7f:12:7d:a0)
[19653.238750] wlan0: send auth to e8:ed:d6:44:dd:11 (try 1/3)
[19653.243206] wlan0: authenticated
[19653.248442] wlan0: associate with e8:ed:d6:44:dd:11 (try 1/3)
[19653.261187] wlan0: RX ReassocResp from e8:ed:d6:44:dd:11 (capab=0x411 status=0 aid=8)
[19653.273616] wlan0: associated
[19701.008210] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1488, expected 1492
[19701.008511] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1484, expected 1488
[19701.008571] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1476, expected 1492
[19701.008901] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1480, expected 1492
[19701.009173] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1480, expected 1484
[19701.009180] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1464, expected 1480
[19701.009611] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1492
[19701.009654] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1476
[19701.509526] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1472, expected 1476
[19701.509635] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1492
[19706.365617] ath11k_warn: 90 callbacks suppressed
[19706.365629] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1488, expected 1492
[19706.365645] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1480, expected 1488
[19706.365862] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1452, expected 1480
[19706.367046] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1464, expected 1488
[19706.367666] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1468, expected 1476
[19706.367967] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1476, expected 1480
[19706.368397] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1464, expected 1492
[19706.368618] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1456, expected 1484
[19706.847596] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1472, expected 1476
[19706.848069] ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1480, expected 1492
[19711.450744] ath11k_warn: 106 callbacks suppressed

also with latest .37 firmware, kernel 6.7.5 on Lenovo x13s.
from my point of view this happens when device is roaming from one AP to another. 
If I go from one room to another with laptop sleeping (lid closed) -- everything is OK. If laptop is running -- this may happen.

Note You need to log in before you can comment on or make changes to this bug.