Ping-Ke Shih <pkshih@xxxxxxxxxxx> wrote:
> From: Zong-Zhe Yang <kevin_yang@xxxxxxxxxxx>
>
> When starting/proceeding MCC, it will abort an ongoing hw scan process.
> In the proceeding cases, it unexpectedly tries to abort a non-exist hw
> scan process. Then, a trace shown at the bottom will happen. This problem
> is caused by a previous commit which changed some call sequence inside
> rtw89_hw_scan_complete() to fix some coex problems. These changes lead
> to our scanning flag was not cleared when proceeding MCC. To keep the
> fixes on coex, and resolve the problem here, re-consider the related
> call sequence.
>
> The known sequence requirements are listed below.
>
> * the old sequence:
> A. notify coex
> B. clear scanning flag
> C. proceed chanctx
> C-1. set channel
> C-2. proceed MCC
> (the problem: A needs to be after C-1)
>
> * the current sequence:
> C. proceed chanctx
> C-1. set channel
> C-2. proceed MCC
> A. notify coex
> B. clear scanning flag
> (the problem: C-2 needs to be after B)
>
> So, now let hw scan caller pass a callback to proceed chanctx if needed.
> Then, the new sequence will be like the below.
> C-1. set channel
> A. notify coex
> B. clear scanning flag
> C-2. proceed MCC
>
> The following is the kernel log for the problem in current sequence.
>
> rtw89_8852be 0000:04:00.0: rtw89_hw_scan_offload failed ret -110
> ------------[ cut here ]------------
> [...]
> CPU: 2 PID: 3991 Comm: kworker/u16:0 Tainted: G OE 6.6.17 #3
> Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB3WW (2.73 ) 11/28/2018
> Workqueue: events_unbound wiphy_work_cancel [cfg80211]
> RIP: 0010:ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211]
> Code: 9c 24 d0 11 00 00 49 39 dd 0f 85 46 ff ff ff 4c 89 e7 e8 09 2d
> RSP: 0018:ffffb27783643d48 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: ffff8a2280964bc0 RSI: 0000000000000000 RDI: ffff8a23df580900
> RBP: ffffb27783643d88 R08: 0000000000000001 R09: 0000000000000400
> R10: 0000000000000000 R11: 0000000000008268 R12: ffff8a23df580900
> R13: ffff8a23df581b00 R14: 0000000000000000 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff8a258e680000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f26a0654000 CR3: 000000002ea2e002 CR4: 00000000001706e0
> Call Trace:
> <TASK>
> ? show_regs+0x68/0x70
> ? ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211]
> ? __warn+0x8f/0x150
> ? ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211]
> ? report_bug+0x1f5/0x200
> ? handle_bug+0x46/0x80
> ? exc_invalid_op+0x19/0x70
> ? asm_exc_invalid_op+0x1b/0x20
> ? ieee80211_sched_scan_stopped+0xaea/0xd80 [mac80211]
> ieee80211_scan_work+0x14a/0x650 [mac80211]
> ? __queue_work+0x10f/0x410
> wiphy_work_cancel+0x2fb/0x310 [cfg80211]
> process_scheduled_works+0x9d/0x390
> ? __pfx_worker_thread+0x10/0x10
> worker_thread+0x15b/0x2d0
> ? __pfx_worker_thread+0x10/0x10
> kthread+0x108/0x140
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x3c/0x60
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1b/0x30
> </TASK>
> ---[ end trace 0000000000000000 ]---
>
> Fixes: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
> Signed-off-by: Zong-Zhe Yang <kevin_yang@xxxxxxxxxxx>
> Signed-off-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
3 patch(es) applied to rtw-next branch of rtw.git, thanks.
e47f0a589854 wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes
e4790b3e314a wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()
b2658bf4d7f2 wifi: rtw89: correct header conversion rule for MLO only
---
https://github.com/pkshih/rtw.git
