mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 13:26:48 +00:00
When an AER error occurs and the bus is hung, the register reads return
0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in
an invalid memory access when accessing q->desc[] or q->entry[].
Unable to handle kernel paging request at virtual address
ffffffc01099eac0
pc : mt76_dma_add_buf+0x124/0x188 [mt76]
lr : mt76_dma_rx_fill+0x11c/0x1d8 [mt76]
sp : ffffffc016d9bbf0
x29: ffffffc016d9bc10 x28: 0000000000000000
x27: 0000000000000000 x26: ffffffb7855e50b8
x25: ffffffb80d04f000 x24: 0000000000000000
x23: 0000000000000ec0 x22: ffffffb796803648
x21: ffffffb796801f80 x20: ffffffb7968035f8
x19: 0000000000000ec0 x18: 0000000000000000
x17: 000000004ec00000 x16: 000000000ec00000
x15: ffffffc01099eac0 x14: 000000004ec00000
x13: 00000000ffc5a000 x12: ffffffc016d9bc32
x11: 00000000ffffffff x10: 0000000000000002
x9 : 0000000000000000 x8 : 000000000000b4ac
x7 : 0000000000000a20 x6 : ffffffb6c1806400
x5 : 0000000000000000 x4 : ffffffb80d04f000
x3 : 0000000000000000 x2 : 0000000000000001
x1 : 000000000ec04000 x0 : ffffffb7968035f8
Call trace:
mt76_dma_add_buf+0x124/0x188 [mt76 (HASH:1029 4)]
mt76_dma_rx_reset+0xe8/0xfc [mt76 (HASH:1029 4)]
mt7921_wpdma_reset+0x188/0x1b0 [mt7921e (HASH:ee48 5)]
mt7921e_mac_reset+0x128/0x418 [mt7921e (HASH:ee48 5)]
mt7921_mac_reset_work+0xac/0x1a8 [mt7921_common (HASH:f721 6)]
process_one_work+0x188/0x514
worker_thread+0x12c/0x300
kthread+0x140/0x1fc
ret_from_fork+0x10/0x30
Fix the invalid memory access by validating the DMA index read from the
hardware before it is used as a queue index. An out-of-range value, such
as the 0xFFFFFFFF returned while the bus is hung, is now clamped so it can
no longer corrupt q->head or q->tail. In addition, check the bus_hung flag
in mt7921_mac_reset_work() before attempting the reset sequence, reject MCU
messages while the bus is hung, and install no-op bus operations when an
unrecoverable AER error is detected, preventing further invalid hardware
accesses.
Due to hardware limitations - such as the lack of a connected hardware
reset pin or the absence of host re-probe functionality - affected Wi-Fi
devices may not fully recover to a normal operational state after
certain errors, even with AER enabled.
Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets")
Co-developed-by: Sean Wang <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
Co-developed-by: Jeff Hsu <[email protected]>
Signed-off-by: Jeff Hsu <[email protected]>
Signed-off-by: Eason Lai <[email protected]>
Co-developed-by: Michael Lo <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Felix Fietkau <[email protected]>
166 lines
3.7 KiB
C
166 lines
3.7 KiB
C
// SPDX-License-Identifier: BSD-3-Clause-Clear
|
|
/*
|
|
* Copyright (C) 2019 Lorenzo Bianconi <[email protected]>
|
|
*/
|
|
|
|
#include "mt76.h"
|
|
|
|
struct sk_buff *
|
|
__mt76_mcu_msg_alloc(struct mt76_dev *dev, const void *data,
|
|
int len, int data_len, gfp_t gfp)
|
|
{
|
|
const struct mt76_mcu_ops *ops = dev->mcu_ops;
|
|
struct sk_buff *skb;
|
|
|
|
len = max_t(int, len, data_len);
|
|
len = ops->headroom + len + ops->tailroom;
|
|
|
|
skb = alloc_skb(len, gfp);
|
|
if (!skb)
|
|
return NULL;
|
|
|
|
memset(skb->head, 0, len);
|
|
skb_reserve(skb, ops->headroom);
|
|
|
|
if (data && data_len)
|
|
skb_put_data(skb, data, data_len);
|
|
|
|
return skb;
|
|
}
|
|
EXPORT_SYMBOL_GPL(__mt76_mcu_msg_alloc);
|
|
|
|
struct sk_buff *mt76_mcu_get_response(struct mt76_dev *dev,
|
|
unsigned long expires)
|
|
{
|
|
unsigned long timeout;
|
|
|
|
if (!time_is_after_jiffies(expires))
|
|
return NULL;
|
|
|
|
timeout = expires - jiffies;
|
|
wait_event_timeout(dev->mcu.wait,
|
|
(!skb_queue_empty(&dev->mcu.res_q) ||
|
|
test_bit(MT76_MCU_RESET, &dev->phy.state)),
|
|
timeout);
|
|
return skb_dequeue(&dev->mcu.res_q);
|
|
}
|
|
EXPORT_SYMBOL_GPL(mt76_mcu_get_response);
|
|
|
|
void mt76_mcu_rx_event(struct mt76_dev *dev, struct sk_buff *skb)
|
|
{
|
|
skb_queue_tail(&dev->mcu.res_q, skb);
|
|
wake_up(&dev->mcu.wait);
|
|
}
|
|
EXPORT_SYMBOL_GPL(mt76_mcu_rx_event);
|
|
|
|
int mt76_mcu_send_and_get_msg(struct mt76_dev *dev, int cmd, const void *data,
|
|
int len, bool wait_resp, struct sk_buff **ret_skb)
|
|
{
|
|
struct sk_buff *skb;
|
|
|
|
if (dev->mcu_ops->mcu_send_msg)
|
|
return dev->mcu_ops->mcu_send_msg(dev, cmd, data, len, wait_resp);
|
|
|
|
skb = mt76_mcu_msg_alloc(dev, data, len);
|
|
if (!skb)
|
|
return -ENOMEM;
|
|
|
|
return mt76_mcu_skb_send_and_get_msg(dev, skb, cmd, wait_resp, ret_skb);
|
|
}
|
|
EXPORT_SYMBOL_GPL(mt76_mcu_send_and_get_msg);
|
|
|
|
int mt76_mcu_skb_send_and_get_msg(struct mt76_dev *dev, struct sk_buff *skb,
|
|
int cmd, bool wait_resp,
|
|
struct sk_buff **ret_skb)
|
|
{
|
|
unsigned int retry = 0;
|
|
struct sk_buff *orig_skb = NULL;
|
|
unsigned long expires;
|
|
int ret, seq;
|
|
|
|
if (ret_skb)
|
|
*ret_skb = NULL;
|
|
|
|
mutex_lock(&dev->mcu.mutex);
|
|
|
|
if ((mt76_is_mmio(dev) && atomic_read(&dev->bus_hung)) ||
|
|
(mt76_is_sdio(dev) && test_bit(MT76_RESET, &dev->phy.state) &&
|
|
atomic_read(&dev->bus_hung))) {
|
|
orig_skb = skb;
|
|
ret = -EIO;
|
|
goto out;
|
|
}
|
|
|
|
if (dev->mcu_ops->mcu_skb_prepare_msg) {
|
|
orig_skb = skb;
|
|
ret = dev->mcu_ops->mcu_skb_prepare_msg(dev, skb, cmd, &seq);
|
|
if (ret < 0)
|
|
goto out;
|
|
}
|
|
|
|
retry:
|
|
/* orig skb might be needed for retry, mcu_skb_send_msg consumes it */
|
|
if (orig_skb)
|
|
skb_get(orig_skb);
|
|
ret = dev->mcu_ops->mcu_skb_send_msg(dev, skb, cmd, wait_resp ? &seq : NULL);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
if (!wait_resp) {
|
|
ret = 0;
|
|
goto out;
|
|
}
|
|
|
|
expires = jiffies + dev->mcu.timeout;
|
|
|
|
do {
|
|
skb = mt76_mcu_get_response(dev, expires);
|
|
if (!skb && !test_bit(MT76_MCU_RESET, &dev->phy.state) &&
|
|
orig_skb && retry++ < dev->mcu_ops->max_retry) {
|
|
dev_err(dev->dev, "Retry message %08x (seq %d)\n",
|
|
cmd, seq);
|
|
skb = orig_skb;
|
|
goto retry;
|
|
}
|
|
|
|
ret = dev->mcu_ops->mcu_parse_response(dev, cmd, skb, seq);
|
|
if (!ret && ret_skb)
|
|
*ret_skb = skb;
|
|
else
|
|
dev_kfree_skb(skb);
|
|
} while (ret == -EAGAIN);
|
|
|
|
|
|
out:
|
|
dev_kfree_skb(orig_skb);
|
|
mutex_unlock(&dev->mcu.mutex);
|
|
|
|
return ret;
|
|
}
|
|
EXPORT_SYMBOL_GPL(mt76_mcu_skb_send_and_get_msg);
|
|
|
|
int __mt76_mcu_send_firmware(struct mt76_dev *dev, int cmd, const void *data,
|
|
int len, int max_len)
|
|
{
|
|
int err, cur_len;
|
|
|
|
while (len > 0) {
|
|
cur_len = min_t(int, max_len, len);
|
|
|
|
err = mt76_mcu_send_msg(dev, cmd, data, cur_len, false);
|
|
if (err)
|
|
return err;
|
|
|
|
data += cur_len;
|
|
len -= cur_len;
|
|
|
|
if (dev->queue_ops->tx_cleanup)
|
|
dev->queue_ops->tx_cleanup(dev,
|
|
dev->q_mcu[MT_MCUQ_FWDL],
|
|
false);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(__mt76_mcu_send_firmware);
|