Hello Yi-Chia Hsieh,
The patch 2461599f835e: "wifi: mt76: mt7996: get tx_retries and
tx_failed from txfree" from Sep 21, 2023 (linux-next), leads to the
following Smatch static checker warning:
drivers/net/wireless/mediatek/mt76/mt7996/mac.c:1130 mt7996_mac_tx_free()
error: uninitialized symbol 'wcid'.
drivers/net/wireless/mediatek/mt76/mt7996/mac.c
1068 static void
1069 mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
1070 {
1071 __le32 *tx_free = (__le32 *)data, *cur_info;
1072 struct mt76_dev *mdev = &dev->mt76;
1073 struct mt76_phy *phy2 = mdev->phys[MT_BAND1];
1074 struct mt76_phy *phy3 = mdev->phys[MT_BAND2];
1075 struct mt76_txwi_cache *txwi;
1076 struct ieee80211_sta *sta = NULL;
1077 struct mt76_wcid *wcid;
1078 LIST_HEAD(free_list);
1079 struct sk_buff *skb, *tmp;
1080 void *end = data + len;
1081 bool wake = false;
1082 u16 total, count = 0;
1083
1084 /* clean DMA queues and unmap buffers first */
1085 mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_PSD], false);
1086 mt76_queue_tx_cleanup(dev, dev->mphy.q_tx[MT_TXQ_BE], false);
1087 if (phy2) {
1088 mt76_queue_tx_cleanup(dev, phy2->q_tx[MT_TXQ_PSD], false);
1089 mt76_queue_tx_cleanup(dev, phy2->q_tx[MT_TXQ_BE], false);
1090 }
1091 if (phy3) {
1092 mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_PSD], false);
1093 mt76_queue_tx_cleanup(dev, phy3->q_tx[MT_TXQ_BE], false);
1094 }
1095
1096 if (WARN_ON_ONCE(le32_get_bits(tx_free[1], MT_TXFREE1_VER) < 5))
1097 return;
1098
1099 total = le32_get_bits(tx_free[0], MT_TXFREE0_MSDU_CNT);
1100 for (cur_info = &tx_free[2]; count < total; cur_info++) {
1101 u32 msdu, info;
1102 u8 i;
1103
1104 if (WARN_ON_ONCE((void *)cur_info >= end))
1105 return;
1106 /* 1'b1: new wcid pair.
1107 * 1'b0: msdu_id with the same 'wcid pair' as above.
1108 */
1109 info = le32_to_cpu(*cur_info);
1110 if (info & MT_TXFREE_INFO_PAIR) {
1111 struct mt7996_sta *msta;
1112 u16 idx;
1113
1114 idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
1115 wcid = rcu_dereference(dev->mt76.wcid[idx]);
Initialized here
1116 sta = wcid_to_sta(wcid);
1117 if (!sta)
1118 continue;
1119
1120 msta = container_of(wcid, struct mt7996_sta, wcid);
1121 spin_lock_bh(&mdev->sta_poll_lock);
1122 if (list_empty(&msta->wcid.poll_list))
1123 list_add_tail(&msta->wcid.poll_list,
1124 &mdev->sta_poll_list);
1125 spin_unlock_bh(&mdev->sta_poll_lock);
1126 continue;
1127 } else if (info & MT_TXFREE_INFO_HEADER) {
1128 u32 tx_retries = 0, tx_failed = 0;
1129
--> 1130 if (!wcid)
Uninitialized on first iteration
1131 continue;
1132
1133 tx_retries =
1134 FIELD_GET(MT_TXFREE_INFO_COUNT, info) - 1;
1135 tx_failed = tx_retries +
1136 !!FIELD_GET(MT_TXFREE_INFO_STAT, info);
1137
1138 wcid->stats.tx_retries += tx_retries;
1139 wcid->stats.tx_failed += tx_failed;
1140 continue;
1141 }
1142
1143 for (i = 0; i < 2; i++) {
1144 msdu = (info >> (15 * i)) & MT_TXFREE_INFO_MSDU_ID;
1145 if (msdu == MT_TXFREE_INFO_MSDU_ID)
1146 continue;
1147
1148 count++;
1149 txwi = mt76_token_release(mdev, msdu, &wake);
1150 if (!txwi)
1151 continue;
1152
1153 mt7996_txwi_free(dev, txwi, sta, &free_list);
1154 }
1155 }
1156
1157 mt7996_mac_sta_poll(dev);
1158
1159 if (wake)
1160 mt76_set_tx_blocked(&dev->mt76, false);
1161
1162 mt76_worker_schedule(&dev->mt76.tx_worker);
1163
1164 list_for_each_entry_safe(skb, tmp, &free_list, list) {
1165 skb_list_del_init(skb);
1166 napi_consume_skb(skb, 1);
1167 }
1168 }
regards,
dan carpenter
