Re: Driver for rtw8723ds

Larry Finger
2023-05-09T22:02:57Z

On 5/8/23 15:16, Martin Blumenstingl wrote:
> This looks like an issue with the Allwinner SDIO controller. We can
> try to work around this with the attached patch.
> Please note that I've only compile-tested that patch.
> In theory it can hurt 16-bit register access (read/write) performance
> a bit (since we now require two MMC commands instead of one). Whether
> this can be measured in the real world is unknown to me. Let's see if
> it fixes the observed issue first.
>

Martin,

I added that patch to the driver. The user reports that he was able to do a ping
and an nslookup before it crashed with the following in the log:

[ 8.700626] skbuff: skb_over_panic: text:ffff8000011924ac len:3341 put:3341
head:ffff000003b3c000 data:ffff000003b3c040 tail:0xd4d end:0x2c0 dev:<NULL>
[ 8.714254] ------------[ cut here ]------------
[ 8.718867] kernel BUG at net/core/skbuff.c:200!
[ 8.723481] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[ 8.730261] Modules linked in: rtw_8723ds rtw_8723d rtw_sdio rtw_core
mac80211 libarc4 cfg80211 rfkill ipv6
[ 8.740024] CPU: 1 PID: 222 Comm: ksdioirqd/mmc1 Not tainted 6.4.0-rc1-dirty #1
[ 8.747327] Hardware name: MangoPi MQ Quad (DT)
[ 8.751852] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 8.758808] pc : skb_panic+0x58/0x5c
[ 8.762391] lr : skb_panic+0x58/0x5c
[ 8.765964] sp : ffff80000aa3bc20
[ 8.769274] x29: ffff80000aa3bc30 x28: ffff000003e16dd8 x27: 0000000000000055
[ 8.776409] x26: 000000000000e001 x25: ffff000003e94200 x24: ffff80000119f408
[ 8.783543] x23: 0000000000000018 x22: ffff000003e12060 x21: ffff80000aa3bd28
[ 8.790677] x20: 000000000000003a x19: ffff000003e94200 x18: 0000000000000000
[ 8.797811] x17: 010006000cc00100 x16: ffff80000a22ffc0 x15: 0000000000000030
[ 8.804945] x14: ffff80000a241b20 x13: 0000000000000339 x12: 0000000000000113
[ 8.812079] x11: 7265766f5f626b73 x10: ffff80000a299b20 x9 : 00000000fffff000
[ 8.819212] x8 : ffff80000a241b20 x7 : ffff80000a299b20 x6 : 0000000000000000
[ 8.826346] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
[ 8.833479] x2 : 0000000000000000 x1 : ffff000003d6d880 x0 : 000000000000008b
[ 8.840614] Call trace:
[ 8.843057] skb_panic+0x58/0x5c
[ 8.846286] skb_find_text+0x0/0xc4
[ 8.849773] rtw_sdio_rx_skb+0x50/0xc8 [rtw_sdio]
[ 8.854488] rtw_sdio_rxfifo_recv+0x1a0/0x24c [rtw_sdio]
[ 8.859803] rtw_sdio_handle_interrupt+0xf0/0x124 [rtw_sdio]
[ 8.865465] process_sdio_pending_irqs+0x5c/0x1c4
[ 8.870169] sdio_irq_thread+0x84/0x178
[ 8.874003] kthread+0x118/0x11c
[ 8.877231] ret_from_fork+0x10/0x20
[ 8.880814] Code: f90007e9 b940b108 f90003e8 97cb9ac2 (d4210000)
[ 8.886903] ---[ end trace 0000000000000000 ]---
[ 8.891515] note: ksdioirqd/mmc1[222] exited with irqs disabled
[ 8.897478] note: ksdioirqd/mmc1[222] exited with preempt_count 1
[ 8.903732] ------------[ cut here ]------------
[ 8.908348] WARNING: CPU: 1 PID: 0 at kernel/context_tracking.c:128
ct_kernel_exit.constprop.0+0x98/0xa0
[ 8.917828] Modules linked in: rtw_8723ds rtw_8723d rtw_sdio rtw_core
mac80211 libarc4 cfg80211 rfkill ipv6
[ 8.927590] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D
6.4.0-rc1-dirty #1
[ 8.935758] Hardware name: MangoPi MQ Quad (DT)
[ 8.940282] pstate: 200003c5 (nzCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 8.947237] pc : ct_kernel_exit.constprop.0+0x98/0xa0
[ 8.952285] lr : ct_idle_enter+0x10/0x1c
[ 8.956206] sp : ffff80000a76bdd0
[ 8.959516] x29: ffff80000a76bdd0 x28: 0000000000000000 x27: 0000000000000000
[ 8.966650] x26: 0000000000000000 x25: ffff000002d68000 x24: 0000000000000000
[ 8.973784] x23: 0000000000000000 x22: ffff80000a229b48 x21: ffff800009b8daf8
[ 8.980917] x20: ffff80000a229a40 x19: ffff00003fd95a20 x18: 0000000000000000
[ 8.988051] x17: 3830303030303030 x16: 3030303030303020 x15: 0000000000000001
[ 8.995185] x14: 00000000000000cb x13: 0000000000000000 x12: 0000000000000001
[ 9.002317] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80000a76bd30
[ 9.009452] x8 : ffff000002d68ac0 x7 : 0000000000000000 x6 : 00000000106f30a4
[ 9.016584] x5 : 00ffffffffffffff x4 : 4000000000000002 x3 : ffff80000a76bdd0
[ 9.023717] x2 : 4000000000000000 x1 : ffff800009b8ba20 x0 : ffff800009b8ba20
[ 9.030851] Call trace:
[ 9.033295] ct_kernel_exit.constprop.0+0x98/0xa0
[ 9.037998] ct_idle_enter+0x10/0x1c
[ 9.041572] default_idle_call+0x1c/0x3c
[ 9.045494] do_idle+0x214/0x270
[ 9.048724] cpu_startup_entry+0x24/0x2c
[ 9.052646] secondary_start_kernel+0x130/0x154
[ 9.057179] __secondary_switched+0xb8/0xbc
[ 9.061363] ---[ end trace 0000000000000000 ]---
[ 14.048126] platform leds: deferred probe pending

Somehow skb->tail was greater than skb->end. Unfortunately I do not have access
to gdb to tell you what line corresponds to rtw_sdio_rx_skb+0x50 on the MangoPi
MQ Quad.

Larry