Re: [PATCH v3 3/3] wifi: iwlwifi: mld: skip TX when firmware is dead

[Minxi Hou <houminxi@gmail.com>]

On Mon, 20 Apr 2026 10:44:06 -0700, Cole Leavitt wrote:
> When firmware encounters an error, STATUS_FW_ERROR is set but the
> mac80211 TX path continues pulling frames from TXQs. Each frame
> fails at iwl_trans_tx() which checks STATUS_FW_ERROR and returns
> -EIO, but iwl_mld_tx_from_txq() keeps looping over every queued
> frame. This burns CPU in a tight loop on dead firmware and can
> cause soft lockups during firmware error recovery.

I can confirm this on BE200 with a tproxy VPN daemon that keeps many
concurrent TCP flows open.  A firmware NMI causes 22-30 second
system-wide soft lockups affecting 11-34 CPUs.

Setup:
  Intel BE200 Wi-Fi 7 [8086:272b] rev 1a
  Firmware 101.6e695a70.0 (gl-c0-fm-c0-c101.ucode)
  Kernel 6.19.12-200.fc43.x86_64 (Fedora 43)
  Driver: iwlmld
  Workload: tproxy daemon (Go, ~50 goroutines doing TCP write())

Reproducer:
  echo 1 > /sys/kernel/debug/ieee80211/phy0/iwlwifi/iwlmld/fw_nmi

The call trace consistently shows goroutines spinning in:

  write() -> tcp_sendmsg -> __dev_queue_xmit -> ... ->
  iwl_mld_tx_from_txq -> iwl_mld_tx_skb

carrier stays 1 throughout the entire crash, so mac80211 never
stops queuing frames.  The lockup resolves only after iwlwifi
completes the firmware SW reset (~22-30s).  Firmware occasionally
crashes again within 15 seconds of restart, causing cascading
lockups.

This matches exactly what your patch addresses.

Regards,
Minxi Hou