On 5/8/23 15:16, Martin Blumenstingl wrote:
This looks like an issue with the Allwinner SDIO controller. We can
try to work around this with the attached patch.
Please note that I've only compile-tested that patch.
In theory it can hurt 16-bit register access (read/write) performance
a bit (since we now require two MMC commands instead of one). Whether
this can be measured in the real world is unknown to me. Let's see if
it fixes the observed issue first.
Martin,
I added that patch to the driver. The user reports that he was able to do a ping
and an nslookup before it crashed with the following in the log:
[ 8.700626] skbuff: skb_over_panic: text:ffff8000011924ac len:3341 put:3341
head:ffff000003b3c000 data:ffff000003b3c040 tail:0xd4d end:0x2c0 dev:<NULL>
[ 8.714254] ------------[ cut here ]------------
[ 8.718867] kernel BUG at net/core/skbuff.c:200!
[ 8.723481] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[ 8.730261] Modules linked in: rtw_8723ds rtw_8723d rtw_sdio rtw_core
mac80211 libarc4 cfg80211 rfkill ipv6
[ 8.740024] CPU: 1 PID: 222 Comm: ksdioirqd/mmc1 Not tainted 6.4.0-rc1-dirty #1
[ 8.747327] Hardware name: MangoPi MQ Quad (DT)
[ 8.751852] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 8.758808] pc : skb_panic+0x58/0x5c
[ 8.762391] lr : skb_panic+0x58/0x5c
[ 8.765964] sp : ffff80000aa3bc20
[ 8.769274] x29: ffff80000aa3bc30 x28: ffff000003e16dd8 x27: 0000000000000055
[ 8.776409] x26: 000000000000e001 x25: ffff000003e94200 x24: ffff80000119f408
[ 8.783543] x23: 0000000000000018 x22: ffff000003e12060 x21: ffff80000aa3bd28
[ 8.790677] x20: 000000000000003a x19: ffff000003e94200 x18: 0000000000000000
[ 8.797811] x17: 010006000cc00100 x16: ffff80000a22ffc0 x15: 0000000000000030
[ 8.804945] x14: ffff80000a241b20 x13: 0000000000000339 x12: 0000000000000113
[ 8.812079] x11: 7265766f5f626b73 x10: ffff80000a299b20 x9 : 00000000fffff000
[ 8.819212] x8 : ffff80000a241b20 x7 : ffff80000a299b20 x6 : 0000000000000000
[ 8.826346] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
[ 8.833479] x2 : 0000000000000000 x1 : ffff000003d6d880 x0 : 000000000000008b
[ 8.840614] Call trace:
[ 8.843057] skb_panic+0x58/0x5c
[ 8.846286] skb_find_text+0x0/0xc4
[ 8.849773] rtw_sdio_rx_skb+0x50/0xc8 [rtw_sdio]
[ 8.854488] rtw_sdio_rxfifo_recv+0x1a0/0x24c [rtw_sdio]
[ 8.859803] rtw_sdio_handle_interrupt+0xf0/0x124 [rtw_sdio]
[ 8.865465] process_sdio_pending_irqs+0x5c/0x1c4
[ 8.870169] sdio_irq_thread+0x84/0x178
[ 8.874003] kthread+0x118/0x11c
[ 8.877231] ret_from_fork+0x10/0x20
[ 8.880814] Code: f90007e9 b940b108 f90003e8 97cb9ac2 (d4210000)
[ 8.886903] ---[ end trace 0000000000000000 ]---
[ 8.891515] note: ksdioirqd/mmc1[222] exited with irqs disabled
[ 8.897478] note: ksdioirqd/mmc1[222] exited with preempt_count 1
[ 8.903732] ------------[ cut here ]------------
[ 8.908348] WARNING: CPU: 1 PID: 0 at kernel/context_tracking.c:128
ct_kernel_exit.constprop.0+0x98/0xa0
[ 8.917828] Modules linked in: rtw_8723ds rtw_8723d rtw_sdio rtw_core
mac80211 libarc4 cfg80211 rfkill ipv6
[ 8.927590] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D
6.4.0-rc1-dirty #1
[ 8.935758] Hardware name: MangoPi MQ Quad (DT)
[ 8.940282] pstate: 200003c5 (nzCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 8.947237] pc : ct_kernel_exit.constprop.0+0x98/0xa0
[ 8.952285] lr : ct_idle_enter+0x10/0x1c
[ 8.956206] sp : ffff80000a76bdd0
[ 8.959516] x29: ffff80000a76bdd0 x28: 0000000000000000 x27: 0000000000000000
[ 8.966650] x26: 0000000000000000 x25: ffff000002d68000 x24: 0000000000000000
[ 8.973784] x23: 0000000000000000 x22: ffff80000a229b48 x21: ffff800009b8daf8
[ 8.980917] x20: ffff80000a229a40 x19: ffff00003fd95a20 x18: 0000000000000000
[ 8.988051] x17: 3830303030303030 x16: 3030303030303020 x15: 0000000000000001
[ 8.995185] x14: 00000000000000cb x13: 0000000000000000 x12: 0000000000000001
[ 9.002317] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80000a76bd30
[ 9.009452] x8 : ffff000002d68ac0 x7 : 0000000000000000 x6 : 00000000106f30a4
[ 9.016584] x5 : 00ffffffffffffff x4 : 4000000000000002 x3 : ffff80000a76bdd0
[ 9.023717] x2 : 4000000000000000 x1 : ffff800009b8ba20 x0 : ffff800009b8ba20
[ 9.030851] Call trace:
[ 9.033295] ct_kernel_exit.constprop.0+0x98/0xa0
[ 9.037998] ct_idle_enter+0x10/0x1c
[ 9.041572] default_idle_call+0x1c/0x3c
[ 9.045494] do_idle+0x214/0x270
[ 9.048724] cpu_startup_entry+0x24/0x2c
[ 9.052646] secondary_start_kernel+0x130/0x154
[ 9.057179] __secondary_switched+0xb8/0xbc
[ 9.061363] ---[ end trace 0000000000000000 ]---
[ 14.048126] platform leds: deferred probe pending
Somehow skb->tail was greater than skb->end. Unfortunately I do not have access
to gdb to tell you what line corresponds to rtw_sdio_rx_skb+0x50 on the MangoPi
MQ Quad.
Larry
