rtw88: The debugfs interface reads registers from the wrong device

rtw88: The debugfs interface reads registers from the wrong device

[Bitterblue Smith]

Hi,

To reproduce the problem, you need a computer with two wifi
devices supported by rtw88. It's especially easy to notice
the problem if one of the devices is USB and the other is PCI,
because the PCI device will have various values in the
registers 0x300..0x3ff, but the USB device will have all
0xeaeaeaea there.

1. Let's assume the driver for the PCI device is already loaded.
   I have RTL8822CE.

2. Mount debugfs:

   # mount -t debugfs none /sys/kernel/debug

3. Check page 0x300:

   # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
     00000300  f7138000    33330000    ffffb000    00000000
     .....

4. Plug the USB device. I used RTL8811CU.

5. Check page 0x300 again:

   # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
     00000300  eaeaeaea    eaeaeaea    eaeaeaea    eaeaeaea
     .....

6. Bonus: unload rtw88_8821cu and check page 0x300 again to get
   a null pointer dereference:

   # rmmod rtw88_8821cu
   # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3

Re: rtw88: The debugfs interface reads registers from the wrong device

[Bitterblue Smith]

On 15/07/2024 14:05, Bitterblue Smith wrote:
> Hi,
> 
> To reproduce the problem, you need a computer with two wifi
> devices supported by rtw88. It's especially easy to notice
> the problem if one of the devices is USB and the other is PCI,
> because the PCI device will have various values in the
> registers 0x300..0x3ff, but the USB device will have all
> 0xeaeaeaea there.
> 
> 1. Let's assume the driver for the PCI device is already loaded.
>    I have RTL8822CE.
> 
> 2. Mount debugfs:
> 
>    # mount -t debugfs none /sys/kernel/debug
> 
> 3. Check page 0x300:
> 
>    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
>      00000300  f7138000    33330000    ffffb000    00000000
>      .....
> 
> 4. Plug the USB device. I used RTL8811CU.
> 
> 5. Check page 0x300 again:
> 
>    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
>      00000300  eaeaeaea    eaeaeaea    eaeaeaea    eaeaeaea
>      .....
> 
> 6. Bonus: unload rtw88_8821cu and check page 0x300 again to get
>    a null pointer dereference:
> 
>    # rmmod rtw88_8821cu
>    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3

I forgot to say: my kernel is 6.9.8-arch1-1 from Arch Linux.
The problem also happens with kernel 6.9.8 plus rtw88 from
rtw-next.

Re: rtw88: The debugfs interface reads registers from the wrong device

[Ping-Ke Shih]

On Mon, 2024-07-15 at 14:26 +0300, Bitterblue Smith wrote:
> 
> On 15/07/2024 14:05, Bitterblue Smith wrote:
> > Hi,
> > 
> > To reproduce the problem, you need a computer with two wifi
> > devices supported by rtw88. It's especially easy to notice
> > the problem if one of the devices is USB and the other is PCI,
> > because the PCI device will have various values in the
> > registers 0x300..0x3ff, but the USB device will have all
> > 0xeaeaeaea there.
> > 
> > 1. Let's assume the driver for the PCI device is already loaded.
> >    I have RTL8822CE.
> > 
> > 2. Mount debugfs:
> > 
> >    # mount -t debugfs none /sys/kernel/debug
> > 
> > 3. Check page 0x300:
> > 
> >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
> >      00000300  f7138000    33330000    ffffb000    00000000
> >      .....
> > 
> > 4. Plug the USB device. I used RTL8811CU.
> > 
> > 5. Check page 0x300 again:
> > 
> >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
> >      00000300  eaeaeaea    eaeaeaea    eaeaeaea    eaeaeaea
> >      .....
> > 
> > 6. Bonus: unload rtw88_8821cu and check page 0x300 again to get
> >    a null pointer dereference:
> > 
> >    # rmmod rtw88_8821cu
> >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
> 
> I forgot to say: my kernel is 6.9.8-arch1-1 from Arch Linux.
> The problem also happens with kernel 6.9.8 plus rtw88 from
> rtw-next.

This limitation is existing since initial driver.

To read a range of large registers area, for example, we need to
a range via write operation and store as a private data, and
then use read operation with private data to read registers.

The limitation is because the private data is static variable.
A possible solution is to duplicate static variable into rtwdev.
Not sure if it is worth to adjust codes for debug purpose only.

Another easier solution is to avoid creating debugfs for second
adapter. How do you think?

Re: rtw88: The debugfs interface reads registers from the wrong device

[Ping-Ke Shih]

On Tue, 2024-07-16 at 01:19 +0000, Ping-Ke Shih wrote:
> On Mon, 2024-07-15 at 14:26 +0300, Bitterblue Smith wrote:
> > On 15/07/2024 14:05, Bitterblue Smith wrote:
> > > Hi,
> > > 
> > > To reproduce the problem, you need a computer with two wifi
> > > devices supported by rtw88. It's especially easy to notice
> > > the problem if one of the devices is USB and the other is PCI,
> > > because the PCI device will have various values in the
> > > registers 0x300..0x3ff, but the USB device will have all
> > > 0xeaeaeaea there.
> > > 
> > > 1. Let's assume the driver for the PCI device is already loaded.
> > >    I have RTL8822CE.
> > > 
> > > 2. Mount debugfs:
> > > 
> > >    # mount -t debugfs none /sys/kernel/debug
> > > 
> > > 3. Check page 0x300:
> > > 
> > >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
> > >      00000300  f7138000    33330000    ffffb000    00000000
> > >      .....
> > > 
> > > 4. Plug the USB device. I used RTL8811CU.
> > > 
> > > 5. Check page 0x300 again:
> > > 
> > >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
> > >      00000300  eaeaeaea    eaeaeaea    eaeaeaea    eaeaeaea
> > >      .....
> > > 
> > > 6. Bonus: unload rtw88_8821cu and check page 0x300 again to get
> > >    a null pointer dereference:
> > > 
> > >    # rmmod rtw88_8821cu
> > >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
> > 
> > I forgot to say: my kernel is 6.9.8-arch1-1 from Arch Linux.
> > The problem also happens with kernel 6.9.8 plus rtw88 from
> > rtw-next.
> 
> This limitation is existing since initial driver.
> 
> To read a range of large registers area, for example, we need to
> a range via write operation and store as a private data, and
> then use read operation with private data to read registers.
> 
> The limitation is because the private data is static variable.
> A possible solution is to duplicate static variable into rtwdev.
> Not sure if it is worth to adjust codes for debug purpose only.
> 
> Another easier solution is to avoid creating debugfs for second
> adapter. How do you think?
> 

Think a little bit further. I will try to duplicate static variables
to support multiple adapters. 

RE: rtw88: The debugfs interface reads registers from the wrong device

[Ping-Ke Shih]

> 
> Think a little bit further. I will try to duplicate static variables
> to support multiple adapters.
> 

I sent a patch [1]. Please help to test if it can work in your side.

[1] https://lore.kernel.org/linux-wireless/20240718064155.38955-1-pkshih@realtek.com/T/#u

Re: rtw88: The debugfs interface reads registers from the wrong device

[Kalle Valo]

Ping-Ke Shih <pkshih@realtek.com> writes:

> On Tue, 2024-07-16 at 01:19 +0000, Ping-Ke Shih wrote:
>
>> On Mon, 2024-07-15 at 14:26 +0300, Bitterblue Smith wrote:
>> > On 15/07/2024 14:05, Bitterblue Smith wrote:
>> > > Hi,
>> > > 
>> > > To reproduce the problem, you need a computer with two wifi
>> > > devices supported by rtw88. It's especially easy to notice
>> > > the problem if one of the devices is USB and the other is PCI,
>> > > because the PCI device will have various values in the
>> > > registers 0x300..0x3ff, but the USB device will have all
>> > > 0xeaeaeaea there.
>> > > 
>> > > 1. Let's assume the driver for the PCI device is already loaded.
>> > >    I have RTL8822CE.
>> > > 
>> > > 2. Mount debugfs:
>> > > 
>> > >    # mount -t debugfs none /sys/kernel/debug
>> > > 
>> > > 3. Check page 0x300:
>> > > 
>> > >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
>> > >      00000300  f7138000    33330000    ffffb000    00000000
>> > >      .....
>> > > 
>> > > 4. Plug the USB device. I used RTL8811CU.
>> > > 
>> > > 5. Check page 0x300 again:
>> > > 
>> > >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
>> > >      00000300  eaeaeaea    eaeaeaea    eaeaeaea    eaeaeaea
>> > >      .....
>> > > 
>> > > 6. Bonus: unload rtw88_8821cu and check page 0x300 again to get
>> > >    a null pointer dereference:
>> > > 
>> > >    # rmmod rtw88_8821cu
>> > >    # cat /sys/kernel/debug/ieee80211/phy0/rtw88/mac_3
>> > 
>> > I forgot to say: my kernel is 6.9.8-arch1-1 from Arch Linux.
>> > The problem also happens with kernel 6.9.8 plus rtw88 from
>> > rtw-next.
>> 
>> This limitation is existing since initial driver.
>> 
>> To read a range of large registers area, for example, we need to
>> a range via write operation and store as a private data, and
>> then use read operation with private data to read registers.
>> 
>> The limitation is because the private data is static variable.
>> A possible solution is to duplicate static variable into rtwdev.
>> Not sure if it is worth to adjust codes for debug purpose only.
>> 
>> Another easier solution is to avoid creating debugfs for second
>> adapter. How do you think?
>> 
>
> Think a little bit further. I will try to duplicate static variables
> to support multiple adapters. 

BTW in drivers all static variables need to be const just because of
issues like this. Static non-const variables are a big no.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches