Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Larry Finger <larry.finger@gmail.com>
Message-ID: <77bdcc7b-c3b2-7c3b-5146-9b7f8c3ae5a7@lwfinger.net>
Date:   Tue, 9 May 2023 17:02:51 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.1
Subject: Re: Driver for rtw8723ds
To:     Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc:     =?UTF-8?Q?Jernej_=c5=a0krabec?= <jernej.skrabec@gmail.com>,
        linux-wireless <linux-wireless@vger.kernel.org>
References: <72a8eeb1-c91c-80a7-5a09-1b7963e0996b@lwfinger.net>
 <5930608.lOV4Wx5bFT@jernej-laptop>
 <813d74b8-6d9f-c7b0-40b4-c661fca13002@lwfinger.net>
 <CAFBinCB3xnCrLvEvqsFMQuDxL+xC9tkxnwubfC+xEMP3-ZXqSg@mail.gmail.com>
 <527585e5-9cdd-66ed-c3af-6da162f4b720@lwfinger.net>
 <CAFBinCCdbt0OAHMnGPYA+xH8WC1nWqJPP5aBU48R=LHRu_xuew@mail.gmail.com>
Content-Language: en-US
From:   Larry Finger <Larry.Finger@lwfinger.net>
In-Reply-To: <CAFBinCCdbt0OAHMnGPYA+xH8WC1nWqJPP5aBU48R=LHRu_xuew@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 5/8/23 15:16, Martin Blumenstingl wrote:
> This looks like an issue with the Allwinner SDIO controller. We can
> try to work around this with the attached patch.
> Please note that I've only compile-tested that patch.
> In theory it can hurt 16-bit register access (read/write) performance
> a bit (since we now require two MMC commands instead of one). Whether
> this can be measured in the real world is unknown to me. Let's see if
> it fixes the observed issue first.
> 

Martin,

I added that patch to the driver. The user reports that he was able to do a ping 
and an nslookup before it crashed with the following in the log:

[    8.700626] skbuff: skb_over_panic: text:ffff8000011924ac len:3341 put:3341 
head:ffff000003b3c000 data:ffff000003b3c040 tail:0xd4d end:0x2c0 dev:<NULL>
[    8.714254] ------------[ cut here ]------------
[    8.718867] kernel BUG at net/core/skbuff.c:200!
[    8.723481] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[    8.730261] Modules linked in: rtw_8723ds rtw_8723d rtw_sdio rtw_core 
mac80211 libarc4 cfg80211 rfkill ipv6
[    8.740024] CPU: 1 PID: 222 Comm: ksdioirqd/mmc1 Not tainted 6.4.0-rc1-dirty #1
[    8.747327] Hardware name: MangoPi MQ Quad (DT)
[    8.751852] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    8.758808] pc : skb_panic+0x58/0x5c
[    8.762391] lr : skb_panic+0x58/0x5c
[    8.765964] sp : ffff80000aa3bc20
[    8.769274] x29: ffff80000aa3bc30 x28: ffff000003e16dd8 x27: 0000000000000055
[    8.776409] x26: 000000000000e001 x25: ffff000003e94200 x24: ffff80000119f408
[    8.783543] x23: 0000000000000018 x22: ffff000003e12060 x21: ffff80000aa3bd28
[    8.790677] x20: 000000000000003a x19: ffff000003e94200 x18: 0000000000000000
[    8.797811] x17: 010006000cc00100 x16: ffff80000a22ffc0 x15: 0000000000000030
[    8.804945] x14: ffff80000a241b20 x13: 0000000000000339 x12: 0000000000000113
[    8.812079] x11: 7265766f5f626b73 x10: ffff80000a299b20 x9 : 00000000fffff000
[    8.819212] x8 : ffff80000a241b20 x7 : ffff80000a299b20 x6 : 0000000000000000
[    8.826346] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
[    8.833479] x2 : 0000000000000000 x1 : ffff000003d6d880 x0 : 000000000000008b
[    8.840614] Call trace:
[    8.843057]  skb_panic+0x58/0x5c
[    8.846286]  skb_find_text+0x0/0xc4
[    8.849773]  rtw_sdio_rx_skb+0x50/0xc8 [rtw_sdio]
[    8.854488]  rtw_sdio_rxfifo_recv+0x1a0/0x24c [rtw_sdio]
[    8.859803]  rtw_sdio_handle_interrupt+0xf0/0x124 [rtw_sdio]
[    8.865465]  process_sdio_pending_irqs+0x5c/0x1c4
[    8.870169]  sdio_irq_thread+0x84/0x178
[    8.874003]  kthread+0x118/0x11c
[    8.877231]  ret_from_fork+0x10/0x20
[    8.880814] Code: f90007e9 b940b108 f90003e8 97cb9ac2 (d4210000)
[    8.886903] ---[ end trace 0000000000000000 ]---
[    8.891515] note: ksdioirqd/mmc1[222] exited with irqs disabled
[    8.897478] note: ksdioirqd/mmc1[222] exited with preempt_count 1
[    8.903732] ------------[ cut here ]------------
[    8.908348] WARNING: CPU: 1 PID: 0 at kernel/context_tracking.c:128 
ct_kernel_exit.constprop.0+0x98/0xa0
[    8.917828] Modules linked in: rtw_8723ds rtw_8723d rtw_sdio rtw_core 
mac80211 libarc4 cfg80211 rfkill ipv6
[    8.927590] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G      D 
6.4.0-rc1-dirty #1
[    8.935758] Hardware name: MangoPi MQ Quad (DT)
[    8.940282] pstate: 200003c5 (nzCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    8.947237] pc : ct_kernel_exit.constprop.0+0x98/0xa0
[    8.952285] lr : ct_idle_enter+0x10/0x1c
[    8.956206] sp : ffff80000a76bdd0
[    8.959516] x29: ffff80000a76bdd0 x28: 0000000000000000 x27: 0000000000000000
[    8.966650] x26: 0000000000000000 x25: ffff000002d68000 x24: 0000000000000000
[    8.973784] x23: 0000000000000000 x22: ffff80000a229b48 x21: ffff800009b8daf8
[    8.980917] x20: ffff80000a229a40 x19: ffff00003fd95a20 x18: 0000000000000000
[    8.988051] x17: 3830303030303030 x16: 3030303030303020 x15: 0000000000000001
[    8.995185] x14: 00000000000000cb x13: 0000000000000000 x12: 0000000000000001
[    9.002317] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80000a76bd30
[    9.009452] x8 : ffff000002d68ac0 x7 : 0000000000000000 x6 : 00000000106f30a4
[    9.016584] x5 : 00ffffffffffffff x4 : 4000000000000002 x3 : ffff80000a76bdd0
[    9.023717] x2 : 4000000000000000 x1 : ffff800009b8ba20 x0 : ffff800009b8ba20
[    9.030851] Call trace:
[    9.033295]  ct_kernel_exit.constprop.0+0x98/0xa0
[    9.037998]  ct_idle_enter+0x10/0x1c
[    9.041572]  default_idle_call+0x1c/0x3c
[    9.045494]  do_idle+0x214/0x270
[    9.048724]  cpu_startup_entry+0x24/0x2c
[    9.052646]  secondary_start_kernel+0x130/0x154
[    9.057179]  __secondary_switched+0xb8/0xbc
[    9.061363] ---[ end trace 0000000000000000 ]---
[   14.048126] platform leds: deferred probe pending

Somehow skb->tail was greater than skb->end. Unfortunately I do not have access 
to gdb to tell you what line corresponds to rtw_sdio_rx_skb+0x50 on the MangoPi 
MQ Quad.

Larry