Commit 39d501d9 authored by Stanislaw Gruszka's avatar Stanislaw Gruszka Committed by Felix Fietkau
Browse files

mt76usb: fix tx/rx stop 



Disabling tasklets on stopping rx/tx is wrong. If blocked tasklet
is scheduled and we remove device we will get 100% cpu usage:

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
    9 root      20   0       0      0      0 R  93.8   0.0   1:47.19 ksoftirqd/0

by infinite loop in tasklet_action_common() and eventuall crash on next
mt76usb module load:

[ 2068.591964] RIP: 0010:tasklet_action_common.isra.17+0x66/0x100
[ 2068.591966] Code: 41 89 f5 eb 25 f0 48 0f ba 33 00 0f 83 b1 00 00 00 48 8b 7a 20 48 8b 42 18 e8 56 a3 b5 00 f0 80 23 fd 48 89 ea 48 85 ed 74 53 <48> 8b 2a 48 8d 5a 08 f0 48 0f ba 6a 08 01 72 0b 8b 42 10 85 c0 74
[ 2068.591968] RSP: 0018:ffff98758c34be58 EFLAGS: 00010206
[ 2068.591969] RAX: ffff98758e6966d0 RBX: ffff98756e69aef8 RCX: 0000000000000006
[ 2068.591970] RDX: 01060a053d060305 RSI: 0000000000000006 RDI: ffff98758e6966d0
[ 2068.591971] RBP: 01060a053d060305 R08: 0000000000000000 R09: 00000000000203c0
[ 2068.591971] R10: 000003ff65b34f08 R11: 0000000000000001 R12: ffff98758e6966d0
[ 2068.591972] R13: 0000000000000006 R14: 0000000000000040 R15: 0000000000000006
[ 2068.591974] FS:  0000000000000000(0000) GS:ffff98758e680000(0000) knlGS:0000000000000000
[ 2068.591975] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2068.591975] CR2: 00002c5f73a6cc20 CR3: 00000002f920a001 CR4: 00000000003606e0
[ 2068.591977] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2068.591978] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2068.591978] Call Trace:
[ 2068.591985]  __do_softirq+0xe3/0x30a
[ 2068.591989]  ? sort_range+0x20/0x20
[ 2068.591990]  run_ksoftirqd+0x26/0x40
[ 2068.591992]  smpboot_thread_fn+0xc5/0x160
[ 2068.591995]  kthread+0x112/0x130
[ 2068.591997]  ? kthread_create_on_node+0x40/0x40
[ 2068.591998]  ret_from_fork+0x35/0x40
[ 2068.591999] Modules linked in: ccm arc4 fuse rfcomm cmac bnep sunrpc snd_hda_codec_hdmi snd_soc_skl snd_soc_core snd_soc_acpi_intel_match snd_hda_codec_realtek snd_soc_acpi snd_hda_codec_generic snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core iTCO_wdt snd_hda_intel intel_rapl iTCO_vendor_support x86_pkg_temp_thermal intel_powerclamp btusb mei_wdt coretemp btrtl snd_hda_codec btbcm btintel intel_cstate snd_hwdep intel_uncore uvcvideo snd_hda_core videobuf2_vmalloc videobuf2_memops intel_rapl_perf wmi_bmof videobuf2_v4l2 intel_wmi_thunderbolt snd_seq bluetooth joydev videobuf2_common snd_seq_device snd_pcm videodev media i2c_i801 snd_timer idma64 ecdh_generic intel_lpss_pci intel_lpss mei_me mei ucsi_acpi typec_ucsi processor_thermal_device intel_soc_dts_iosf intel_pch_thermal typec thinkpad_acpi wmi snd soundcore rfkill int3403_thermal int340x_thermal_zone int3400_thermal acpi_thermal_rel acpi_pad pcc_cpufreq uas usb_storage crc32c_intel i915 i2c_algo_bit nvme serio_raw
[ 2068.592033]  drm_kms_helper e1000e nvme_core drm video ipv6 [last unloaded: cfg80211]

Fortunate thing is that this not happen frequently, as scheduling
tasklet on blocked state is very exceptional, though might happen.

Due to different RX/TX tasklet processing fix is different for those.

For RX we have to assure rx_tasklet do fail to resubmit buffers
by poisoning urb's and kill the tasklet.

For TX we need to handle all stop cases properly (suspend, module
unload, device removal).

Signed-off-by: default avatarStanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 1fb869a2

drivers/net/wireless/mediatek/mt76/mac80211.c

+2 −1
Original line number Diff line number Diff line
@@ -390,7 +390,7 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb) 
}

EXPORT_SYMBOL_GPL(mt76_rx);



static bool mt76_has_tx_pending(struct mt76_dev *dev)

bool mt76_has_tx_pending(struct mt76_dev *dev)

{

	struct mt76_queue *q;

	int i;
@@ -403,6 +403,7 @@ static bool mt76_has_tx_pending(struct mt76_dev *dev) 


	return false;

}

EXPORT_SYMBOL_GPL(mt76_has_tx_pending);



void mt76_set_channel(struct mt76_dev *dev)

{

drivers/net/wireless/mediatek/mt76/mt76.h

+4 −3
Original line number Diff line number Diff line
@@ -696,6 +696,7 @@ void mt76_release_buffered_frames(struct ieee80211_hw *hw, 
				  u16 tids, int nframes,

				  enum ieee80211_frame_release_type reason,

				  bool more_data);

bool mt76_has_tx_pending(struct mt76_dev *dev);

void mt76_set_channel(struct mt76_dev *dev);

int mt76_get_survey(struct ieee80211_hw *hw, int idx,

		    struct survey_info *survey);
@@ -790,10 +791,10 @@ int mt76u_vendor_request(struct mt76_dev *dev, u8 req, 
void mt76u_single_wr(struct mt76_dev *dev, const u8 req,

		     const u16 offset, const u32 val);

int mt76u_init(struct mt76_dev *dev, struct usb_interface *intf);

int mt76u_submit_rx_buffers(struct mt76_dev *dev);

int mt76u_alloc_queues(struct mt76_dev *dev);

void mt76u_stop_queues(struct mt76_dev *dev);

void mt76u_stop_stat_wk(struct mt76_dev *dev);

void mt76u_stop_tx(struct mt76_dev *dev);

void mt76u_stop_rx(struct mt76_dev *dev);

int mt76u_resume_rx(struct mt76_dev *dev);

void mt76u_queues_deinit(struct mt76_dev *dev);



struct sk_buff *

drivers/net/wireless/mediatek/mt76/mt76x0/usb.c

+3 −7
Original line number Diff line number Diff line
@@ -86,7 +86,7 @@ static void mt76x0u_mac_stop(struct mt76x02_dev *dev) 
	clear_bit(MT76_STATE_RUNNING, &dev->mt76.state);

	cancel_delayed_work_sync(&dev->cal_work);

	cancel_delayed_work_sync(&dev->mt76.mac_work);

	mt76u_stop_stat_wk(&dev->mt76);

	mt76u_stop_tx(&dev->mt76);

	mt76x02u_exit_beacon_config(dev);



	if (test_bit(MT76_REMOVED, &dev->mt76.state))
@@ -313,7 +313,7 @@ static int __maybe_unused mt76x0_suspend(struct usb_interface *usb_intf, 
{

	struct mt76x02_dev *dev = usb_get_intfdata(usb_intf);



	mt76u_stop_queues(&dev->mt76);

	mt76u_stop_rx(&dev->mt76);

	clear_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state);

	mt76x0_chip_onoff(dev, false, false);
@@ -323,16 +323,12 @@ static int __maybe_unused mt76x0_suspend(struct usb_interface *usb_intf, 
static int __maybe_unused mt76x0_resume(struct usb_interface *usb_intf)

{

	struct mt76x02_dev *dev = usb_get_intfdata(usb_intf);

	struct mt76_usb *usb = &dev->mt76.usb;

	int ret;



	ret = mt76u_submit_rx_buffers(&dev->mt76);

	ret = mt76u_resume_rx(&dev->mt76);

	if (ret < 0)

		goto err;



	tasklet_enable(&usb->rx_tasklet);

	tasklet_enable(&dev->mt76.tx_tasklet);



	ret = mt76x0u_init_hardware(dev);

	if (ret)

		goto err;

drivers/net/wireless/mediatek/mt76/mt76x2/usb.c

+2 −6
Original line number Diff line number Diff line
@@ -107,7 +107,7 @@ static int __maybe_unused mt76x2u_suspend(struct usb_interface *intf, 
{

	struct mt76x02_dev *dev = usb_get_intfdata(intf);



	mt76u_stop_queues(&dev->mt76);

	mt76u_stop_rx(&dev->mt76);



	return 0;

}
@@ -115,16 +115,12 @@ static int __maybe_unused mt76x2u_suspend(struct usb_interface *intf, 
static int __maybe_unused mt76x2u_resume(struct usb_interface *intf)

{

	struct mt76x02_dev *dev = usb_get_intfdata(intf);

	struct mt76_usb *usb = &dev->mt76.usb;

	int err;



	err = mt76u_submit_rx_buffers(&dev->mt76);

	err = mt76u_resume_rx(&dev->mt76);

	if (err < 0)

		goto err;



	tasklet_enable(&usb->rx_tasklet);

	tasklet_enable(&dev->mt76.tx_tasklet);



	err = mt76x2u_init_hardware(dev);

	if (err < 0)

		goto err;

drivers/net/wireless/mediatek/mt76/mt76x2/usb_init.c

+0 −1
Original line number Diff line number Diff line
@@ -244,7 +244,6 @@ fail: 


void mt76x2u_stop_hw(struct mt76x02_dev *dev)

{

	mt76u_stop_stat_wk(&dev->mt76);

	cancel_delayed_work_sync(&dev->cal_work);

	cancel_delayed_work_sync(&dev->mt76.mac_work);

	mt76x2u_mac_stop(dev);

CRA Git | Maintained and supported by SUSTech CRA and CCSE