From nobody Fri Sep 25 12:04:12 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9501F3955FF; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; cv=none; b=J5okoGDcbgp7a4pDMMJv08I0lm5zL4WxmVXPhro5e/7Nq/P3LbsSc3Mm8N08yOsXOxZjNBhsIBljzlT2OBes32BK+kt9bkTkiYZRrvgRtMaDhfjNMF+6nxdduUAsnfozMsd1L84ywyrS62XRyvZOudHPtilIHdjGasqRRS3vV5g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; c=relaxed/simple; bh=KZjnPZfSPxxQqYle0vt9ysc31pC8OUpHmTU8dUYagTc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=H8PmHSTojc4TejxDQBpCqTK1eNYMEx8OPbnFhldXLBH//5ryNGVekDZDzlI67zIJtoiqynAjCcY4MUjvqT/i9AK5ZEhm9ZHO7dBqfsdvN7OJ5Yaq6yzHlr9Rn6vcnk6i/FJjJGW+iNgOtvhf8S3wfKl+/YdaqylvWlMvzKazVVk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HO4DOkBK; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HO4DOkBK" Received: by smtp.kernel.org (Postfix) with ESMTPS id 30EE5C2BCFB; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789284812; bh=KZjnPZfSPxxQqYle0vt9ysc31pC8OUpHmTU8dUYagTc=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=HO4DOkBKQcY3c09JsvIbq7z0uWGPHdGp3LFe2S8lMx3TxmQnuZRkOIszJMfMhMXL8 sprZRXhrl0b48qnMerYBae86B2Byg8HLGTsb9rZP7xbEKraK7uNZyAYSAcCUwgu7cu sMiJdQghiFNi3GvpBsfKWnE7DPETm3hvnIYHtqCGiyRiF+Vfyty9JYyrT21q8k8cd2 ycVAfMhnfzFpc/tWoCjhHp0z9DIHyGORjUd0CXJJ/k3cSFH1clJrzOBzyOFXn7l+lk eHJ5jd4/4hMr3j8RNaRZjipeETfhROgAhPKO/IHS8HQtu90L9dqMU9jLoeOwwwkOfr 41oM1Znf893uA== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E8C2C88E40; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) From: kimwooseok via B4 Relay Date: Sun, 13 Sep 2026 16:33:19 +0900 Subject: [PATCH rtw-next v2 1/4] wifi: rtl8xxxu: free RX skb when URB submission fails Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260913-codex-rtw-rx-v2-v2-1-f09c964e0b96@khu.ac.kr> References: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> In-Reply-To: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> To: linux-wireless@vger.kernel.org Cc: Ping-Ke Shih , Jes Sorensen , linux-kernel@vger.kernel.org, kimwooseok <5mghybrid@khu.ac.kr> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789284810; l=3091; i=5mghybrid@khu.ac.kr; s=kernel-20260913; h=from:subject:message-id; bh=att+fRGHRDjKAGrEwD6lJWxhFqTMBbHhK5UA95dqBLI=; b=l4wXlY9AF1apx7M9CnnrUPfyJENk6cDjKw+elyDFUgY/do+ILtOb+wu1k2a9tqziQjleZ3w/u S3C6J9TXs6EC5+li2VEYkwPk0rlfEiltvL9gFTd2tE4ikpsv+r1sn/l X-Developer-Key: i=5mghybrid@khu.ac.kr; a=ed25519; pk=1az/6lC8Tmd6BcvyarPc8FWoSxsV/WRr5NLs1v+kjlE= X-Endpoint-Received: by B4 Relay for 5mghybrid@khu.ac.kr/kernel-20260913 with auth_id=1028 X-Original-From: kimwooseok <5mghybrid@khu.ac.kr> Reply-To: 5mghybrid@khu.ac.kr From: kimwooseok <5mghybrid@khu.ac.kr> A failed RX URB submission can leak the skb allocated for that attempt. rtl8xxxu_submit_rx_urb() allocates the buffer and stores it in urb.context, but if usb_submit_urb() fails, it only unanchors the URB. The RX worker queues ENOMEM/EAGAIN failures for retry with that buffer still attached. On the next attempt, rtl8xxxu_submit_rx_urb() allocates another skb and overwrites urb.context, losing the reference to the previous buffer. Stopping before the retry also leaks the buffer because pending-request cleanup frees only the URB. Fix the leak at the submission failure by making rtl8xxxu_submit_rx_urb() responsible for both allocating the skb and releasing it when submission fails. Free the newly allocated skb and clear urb.context before returning the error, so neither retry nor stop receives a pending URB that still owns a buffer. Remove the caller-side skb cleanup from start and the RX worker; those callers now handle only whether to retry or release the URB. Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") Assisted-by: GPT-6 Astra Signed-off-by: kimwooseok <5mghybrid@khu.ac.kr> Reviewed-by: Ping-Ke Shih --- drivers/net/wireless/realtek/rtl8xxxu/core.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wir= eless/realtek/rtl8xxxu/core.c index bddbd0990de72..795a5ec2f8cd4 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c @@ -5864,7 +5864,6 @@ static void rtl8xxxu_rx_urb_work(struct work_struct *= work) struct rtl8xxxu_priv *priv; struct rtl8xxxu_rx_urb *rx_urb, *tmp; struct list_head local; - struct sk_buff *skb; unsigned long flags; int ret; =20 @@ -5896,8 +5895,6 @@ static void rtl8xxxu_rx_urb_work(struct work_struct *= work) default: dev_warn(&priv->udev->dev, "failed to requeue urb with error %i\n", ret); - skb =3D (struct sk_buff *)rx_urb->urb.context; - dev_kfree_skb(skb); usb_free_urb(&rx_urb->urb); } } @@ -6596,8 +6593,11 @@ static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_pr= iv *priv, skb_size, rtl8xxxu_rx_complete, skb); usb_anchor_urb(&rx_urb->urb, &priv->rx_anchor); ret =3D usb_submit_urb(&rx_urb->urb, GFP_ATOMIC); - if (ret) + if (ret) { usb_unanchor_urb(&rx_urb->urb); + dev_kfree_skb(skb); + rx_urb->urb.context =3D NULL; + } return ret; } =20 @@ -7410,7 +7410,6 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) struct rtl8xxxu_priv *priv =3D hw->priv; struct rtl8xxxu_rx_urb *rx_urb; struct rtl8xxxu_tx_urb *tx_urb; - struct sk_buff *skb; unsigned long flags; int ret, i; =20 @@ -7461,13 +7460,8 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) rx_urb->hw =3D hw; =20 ret =3D rtl8xxxu_submit_rx_urb(priv, rx_urb); - if (ret) { - if (ret !=3D -ENOMEM) { - skb =3D (struct sk_buff *)rx_urb->urb.context; - dev_kfree_skb(skb); - } + if (ret) rtl8xxxu_queue_rx_urb(priv, rx_urb); - } } =20 schedule_delayed_work(&priv->ra_watchdog, 2 * HZ); --=20 2.48.1 From nobody Fri Sep 25 12:04:12 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94F7838656D; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; cv=none; b=gmVq4g/42VAeA4OPVxH6C9xyiTXI5fguKjSFra+9v27xe1pFH8n+0NHD+Uam2fR2h51qytVy/tPZXjfYoBLS95+jTV+YzQskLJsUyno3sWT6MaranTIhMyP8tc+i23r6kTJmjrJuLEtwWG/m6+LZLJCE1Cjo4ye72OuDcQF00Zk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; c=relaxed/simple; bh=aKV60C/fq6tIKDwWhdZqx473UAKuuq700goUpnuUo10=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WyS4d+CTi1N/mbrqO7N63lbclZFyxGC+/tOF58qf7WOFiOm6nYLRGsmcwQqHwt0OHStG1KyebrhcL+rRRzDbKiO/e4y6E+PT8hPuPzypOsK5ks+ZGT3011FnU+TRZjX9T3XrLkn7w1nP9tVtzbWaXsgBm8qrVXeMxof2WmjcEIE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YLCSgfLA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YLCSgfLA" Received: by smtp.kernel.org (Postfix) with ESMTPS id 3F6FBC2BCF5; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789284812; bh=aKV60C/fq6tIKDwWhdZqx473UAKuuq700goUpnuUo10=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=YLCSgfLAFuRfjIc/FStMqKLjNYc+0DLbiKRDUenkWr4OymrD4OBgmTiITUKlgdPGR h6PxwX2HwZLzDTF4VwauBDwrCupPQZXAgZVDdx9N+aAv7WvPp89rIVhnGonuKGSzIu PpaeQiXamugglDuac+T9lhL24gejXFleJ8LXbZndk3Un2OlWwTveYYBLJrPm+RS1OH SKZmm5bunnFYEwa24xIDrRjFOlfidMq5r1faVSs1Czp5KLcXT/K7vlveh2jIllqKfI RPbpQSAiY4+UFaRkP+kVpNzGQmhihYuAaKL+WVZbFQiLJCEU759NKe0Dh0rxT2ThRb /YAA4wENm9Mqg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F5E1C88E56; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) From: kimwooseok via B4 Relay Date: Sun, 13 Sep 2026 16:33:20 +0900 Subject: [PATCH rtw-next v2 2/4] wifi: rtl8xxxu: unwind incomplete receive startup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260913-codex-rtw-rx-v2-v2-2-f09c964e0b96@khu.ac.kr> References: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> In-Reply-To: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> To: linux-wireless@vger.kernel.org Cc: Ping-Ke Shih , Jes Sorensen , linux-kernel@vger.kernel.org, kimwooseok <5mghybrid@khu.ac.kr> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789284810; l=6426; i=5mghybrid@khu.ac.kr; s=kernel-20260913; h=from:subject:message-id; bh=F/UxAv0n5pFiROLUYSSO2c5d/aOGmW1/ktprFN1Zdro=; b=X2LxbCIAG5geqCIpfTjGjsOqhZRCqDz16bMC7jEUWwcWPRHZ3O4xud0/e+SQJnmBIbywsEDkv z3yhGB+ZfOQDFAy6yRTbQUePG6XcC0/dBf1vkmwB0HDX1DzfwetFizu X-Developer-Key: i=5mghybrid@khu.ac.kr; a=ed25519; pk=1az/6lC8Tmd6BcvyarPc8FWoSxsV/WRr5NLs1v+kjlE= X-Endpoint-Received: by B4 Relay for 5mghybrid@khu.ac.kr/kernel-20260913 with auth_id=1028 X-Original-From: kimwooseok <5mghybrid@khu.ac.kr> Reply-To: 5mghybrid@khu.ac.kr From: kimwooseok <5mghybrid@khu.ac.kr> rtl8xxxu_start() allocates and submits RX URBs one at a time. If a later allocation fails, earlier requests may already be active. After a successful submission, that allocation failure can also leave ret set to zero. The error path then frees TX resources and disables RX filters without draining the earlier RX requests, yet reports startup success. Separate pool allocation from submission so an allocation failure can be handled before any RX request is active. Introduce rtl8xxxu_alloc_rx_urbs() to allocate all 32 wrappers, then rtl8xxxu_start_rx() to submit the completed pool. Return ENOMEM for every RX or TX URB pool allocation failure so a partial allocation is reported as an error. Once submission begins, keep ENOMEM/EAGAIN failures queued for retry. For other submission errors, rtl8xxxu_start_rx() frees the unsubmitted requests and returns the error. Since earlier submissions may already be active at that point, route the outer start failure through the existing rtl8xxxu_stop() path. This drains queued work and active requests and cleans up RF state and TX resources together. Interrupt URB submission failure uses the same cleanup path. Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") Assisted-by: GPT-6 Astra Signed-off-by: kimwooseok <5mghybrid@khu.ac.kr> --- drivers/net/wireless/realtek/rtl8xxxu/core.c | 99 ++++++++++++++++++++----= ---- 1 file changed, 71 insertions(+), 28 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wir= eless/realtek/rtl8xxxu/core.c index 795a5ec2f8cd4..1932a9ec1970c 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c @@ -58,6 +58,7 @@ MODULE_PARM_DESC(dma_agg_pages, "Set DMA aggregation page= s (range 1-127, 0 to di #define RTL8XXXU_TX_URB_LOW_WATER 25 #define RTL8XXXU_TX_URB_HIGH_WATER 32 =20 +static void rtl8xxxu_stop(struct ieee80211_hw *hw, bool suspend); static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, struct rtl8xxxu_rx_urb *rx_urb); =20 @@ -5832,6 +5833,27 @@ static void rtl8xxxu_free_rx_resources(struct rtl8xx= xu_priv *priv) spin_unlock_irqrestore(&priv->rx_urb_lock, flags); } =20 +static int rtl8xxxu_alloc_rx_urbs(struct rtl8xxxu_priv *priv) +{ + struct rtl8xxxu_rx_urb *rx_urb; + int i; + + /* No RX work is active until the complete pool has been allocated. */ + for (i =3D 0; i < RTL8XXXU_RX_URBS; i++) { + rx_urb =3D kmalloc_obj(struct rtl8xxxu_rx_urb); + if (!rx_urb) + return -ENOMEM; + + usb_init_urb(&rx_urb->urb); + INIT_LIST_HEAD(&rx_urb->list); + rx_urb->hw =3D priv->hw; + list_add_tail(&rx_urb->list, &priv->rx_urb_pending_list); + priv->rx_urb_pending_count++; + } + + return 0; +} + static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, struct rtl8xxxu_rx_urb *rx_urb) { @@ -5900,6 +5922,44 @@ static void rtl8xxxu_rx_urb_work(struct work_struct = *work) } } =20 +static int rtl8xxxu_start_rx(struct rtl8xxxu_priv *priv) +{ + struct rtl8xxxu_rx_urb *rx_urb, *tmp; + unsigned long flags; + LIST_HEAD(local); + int ret; + + spin_lock_irqsave(&priv->rx_urb_lock, flags); + list_splice_init(&priv->rx_urb_pending_list, &local); + priv->rx_urb_pending_count =3D 0; + spin_unlock_irqrestore(&priv->rx_urb_lock, flags); + + list_for_each_entry_safe(rx_urb, tmp, &local, list) { + list_del_init(&rx_urb->list); + ret =3D rtl8xxxu_submit_rx_urb(priv, rx_urb); + switch (ret) { + case 0: + break; + case -ENOMEM: + case -EAGAIN: + rtl8xxxu_queue_rx_urb(priv, rx_urb); + break; + default: + usb_free_urb(&rx_urb->urb); + goto free_remaining; + } + } + + return 0; + +free_remaining: + list_for_each_entry_safe(rx_urb, tmp, &local, list) { + list_del(&rx_urb->list); + usb_free_urb(&rx_urb->urb); + } + return ret; +} + /* * The RTL8723BU/RTL8192EU vendor driver use coexistence table type * 0-7 to represent writing different combinations of register values @@ -7408,7 +7468,6 @@ static void rtl8xxxu_watchdog_callback(struct work_st= ruct *work) static int rtl8xxxu_start(struct ieee80211_hw *hw) { struct rtl8xxxu_priv *priv =3D hw->priv; - struct rtl8xxxu_rx_urb *rx_urb; struct rtl8xxxu_tx_urb *tx_urb; unsigned long flags; int ret, i; @@ -7423,14 +7482,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) if (priv->usb_interrupts) { ret =3D rtl8xxxu_submit_int_urb(hw); if (ret) - goto exit; + goto error_out; } =20 for (i =3D 0; i < RTL8XXXU_TX_URBS; i++) { tx_urb =3D kmalloc_obj(struct rtl8xxxu_tx_urb); if (!tx_urb) { - if (!i) - ret =3D -ENOMEM; + ret =3D -ENOMEM; =20 goto error_out; } @@ -7441,31 +7499,21 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) priv->tx_urb_free_count++; } =20 + ret =3D rtl8xxxu_alloc_rx_urbs(priv); + if (ret) + goto error_out; + priv->tx_stopped =3D false; =20 spin_lock_irqsave(&priv->rx_urb_lock, flags); priv->shutdown =3D false; spin_unlock_irqrestore(&priv->rx_urb_lock, flags); =20 - for (i =3D 0; i < RTL8XXXU_RX_URBS; i++) { - rx_urb =3D kmalloc_obj(struct rtl8xxxu_rx_urb); - if (!rx_urb) { - if (!i) - ret =3D -ENOMEM; - - goto error_out; - } - usb_init_urb(&rx_urb->urb); - INIT_LIST_HEAD(&rx_urb->list); - rx_urb->hw =3D hw; - - ret =3D rtl8xxxu_submit_rx_urb(priv, rx_urb); - if (ret) - rtl8xxxu_queue_rx_urb(priv, rx_urb); - } + ret =3D rtl8xxxu_start_rx(priv); + if (ret) + goto error_out; =20 schedule_delayed_work(&priv->ra_watchdog, 2 * HZ); -exit: /* * Accept all data and mgmt frames */ @@ -7478,13 +7526,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) return ret; =20 error_out: - rtl8xxxu_free_tx_resources(priv); - /* - * Disable all data and mgmt frames - */ - rtl8xxxu_write16(priv, REG_RXFLTMAP2, 0x0000); - rtl8xxxu_write16(priv, REG_RXFLTMAP0, 0x0000); - + rtl8xxxu_stop(hw, false); return ret; } =20 @@ -7820,6 +7862,7 @@ static int rtl8xxxu_probe(struct usb_interface *inter= face, spin_lock_init(&priv->tx_urb_lock); INIT_LIST_HEAD(&priv->rx_urb_pending_list); spin_lock_init(&priv->rx_urb_lock); + priv->shutdown =3D true; INIT_WORK(&priv->rx_urb_wq, rtl8xxxu_rx_urb_work); INIT_DELAYED_WORK(&priv->ra_watchdog, rtl8xxxu_watchdog_callback); INIT_DELAYED_WORK(&priv->update_beacon_work, rtl8xxxu_update_beacon_work_= callback); --=20 2.48.1 From nobody Fri Sep 25 12:04:12 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 950B03A6B82; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; cv=none; b=feHMo9W9yMTORLsGLX4BLx/2ZrAIzPht9sOCd9giQ6HKsi345ovgiMM8fFGds9UVFC9lEZhduDSSIzwkPecbSAAoFbuFZLlqTdVEPQrmVa2e+9D+lHiRIw0sMRqwGn9/0Rl4egxRr2lgtW2lN8+J1IdMxJPTzJV0omc16j8EYZs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; c=relaxed/simple; bh=Hw9qx0Nd46rzbMCw6YeXgIfT3N7/HLNV81Ua1C3BcDo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=iisYhSSA3af2kaBBAR9E5cWttNOjD1wVfBfGLlneviNgd3QvEyNZb4FwOB0qoAh1OOytUTvKUTQU84oOZSnZPxCqVfDl++VAJv2P1q9tDUXEvp+bkJJMTsOHibqV/kR20Ax/ilUFsNOAbIttsl4EPWYLSkhfcODNUtPS9Z6Jjtk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ocVc3d3h; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ocVc3d3h" Received: by smtp.kernel.org (Postfix) with ESMTPS id 4E990C2BCFD; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789284812; bh=Hw9qx0Nd46rzbMCw6YeXgIfT3N7/HLNV81Ua1C3BcDo=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=ocVc3d3hm2AUzp4kGjmEdDKYjQhbLxemnHFSC68rUf2Kwou+3viMvmgxKiNbgiHDo HdNFJguckyeay9gofHpiv4RrDKCKUWk8Ij+PNu3UzGCdm9ZuZi/L38yrBFWFIGJ51n Jiji0d+t+L1HOfisNH5ucOl5ytQa7NORQcUWsLXNFaP+V5YZp2DTuHpT/iL0T6Y4jV Iqf44P3G4Oe1UmxQ9AGO8KFKobKzxtLrN4ZKxxMZoaesNrABi1tcNuGQEKlsiQ1JTX BsHUmVOWs8uAAyXSOrre6iIrk2jzDTteDq2YkDuM5O1744e2hkEvh3Li/A+ljpwZmo 3AhYJZdBJD73g== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FF98C88E64; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) From: kimwooseok via B4 Relay Date: Sun, 13 Sep 2026 16:33:21 +0900 Subject: [PATCH rtw-next v2 3/4] wifi: rtl8xxxu: preserve RX requests across recoverable transfer errors Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260913-codex-rtw-rx-v2-v2-3-f09c964e0b96@khu.ac.kr> References: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> In-Reply-To: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> To: linux-wireless@vger.kernel.org Cc: Ping-Ke Shih , Jes Sorensen , linux-kernel@vger.kernel.org, kimwooseok <5mghybrid@khu.ac.kr> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789284810; l=8145; i=5mghybrid@khu.ac.kr; s=kernel-20260913; h=from:subject:message-id; bh=+/zGgRa8bRXkzCc+9fmK19RDy2tNnvAqH9wctpfXaos=; b=1KZzBtdRrt0SLZBVpDU88xMUgzreaWqbLsoxWty17dUB50ybOy+NvIpNYdHbXaeFkW3eq3Qr3 dHcEcuhrXAuDgcuinN8chXDAw57mPiqLs4WprTFYVB53jINQrz1Hb5X X-Developer-Key: i=5mghybrid@khu.ac.kr; a=ed25519; pk=1az/6lC8Tmd6BcvyarPc8FWoSxsV/WRr5NLs1v+kjlE= X-Endpoint-Received: by B4 Relay for 5mghybrid@khu.ac.kr/kernel-20260913 with auth_id=1028 X-Original-From: kimwooseok <5mghybrid@khu.ac.kr> Reply-To: 5mghybrid@khu.ac.kr From: kimwooseok <5mghybrid@khu.ac.kr> rtl8xxxu normally reuses 32 RX URBs, scheduling the submission worker when more than eight completed requests have accumulated on the pending list. Completion errors free URBs instead. A finite error burst can therefore leave eight or fewer requests, which cannot reach that threshold after they all complete. With no request in flight and no worker pending or running, RX stays stopped even after the errors cease. To prevent these errors from shrinking the pool below the number needed for normal resubmission, retain URBs after EPROTO, EILSEQ, ETIME, EOVERFLOW, ECOMM and ENOSR completions. EHCI can report ENOSR for IN data-buffer errors, and FHCI maps RX buffer overrun to ECOMM. Free the failed transfer's skb and keep its URB on a separate retry list. Keeping the URBs is only part of the fix: the driver must also submit them again without waiting for nine requests to accumulate. When the first failed request enters the retry list, schedule delayed work for 100 ms. Further failures join that list while the work is pending. When it runs, move the collected requests to normal pending and schedule the submission worker even if only one request is waiting. Keeping failed requests separate until then prevents normal completions from triggering an immediate retry; successful RX keeps its existing batching. A retry can itself fail with ENOMEM/EAGAIN. Returning that request to normal pending would bring back the same threshold problem, so route temporary submission failures from both start and the RX worker through the delayed retry list as well. Serialize retry insertion and scheduling with shutdown so late completions cannot schedule fresh retries during stop. Cancel retry work first, then wait for submission work before killing active URBs, so a running worker cannot submit a request after the active requests have been drained. Cancellation and removal keep their release behavior. EPIPE endpoint-halt recovery remains outside this change because it requires quiescing requests and distinguishing recovery cancellation from shutdown. Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") Assisted-by: GPT-6 Astra Signed-off-by: kimwooseok <5mghybrid@khu.ac.kr> --- drivers/net/wireless/realtek/rtl8xxxu/core.c | 71 ++++++++++++++++++++= ++-- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 3 + 2 files changed, 70 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wir= eless/realtek/rtl8xxxu/core.c index 1932a9ec1970c..883c9a56f52a4 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c @@ -54,6 +54,7 @@ MODULE_PARM_DESC(dma_agg_pages, "Set DMA aggregation page= s (range 1-127, 0 to di #define USB_VENDOR_ID_REALTEK 0x0bda #define RTL8XXXU_RX_URBS 32 #define RTL8XXXU_RX_URB_PENDING_WATER 8 +#define RTL8XXXU_RX_URB_RETRY_DELAY_MS 100 #define RTL8XXXU_TX_URBS 64 #define RTL8XXXU_TX_URB_LOW_WATER 25 #define RTL8XXXU_TX_URB_HIGH_WATER 32 @@ -5823,6 +5824,11 @@ static void rtl8xxxu_free_rx_resources(struct rtl8xx= xu_priv *priv) =20 spin_lock_irqsave(&priv->rx_urb_lock, flags); =20 + list_splice_tail_init(&priv->rx_urb_retry_list, + &priv->rx_urb_pending_list); + priv->rx_urb_pending_count +=3D priv->rx_urb_retry_count; + priv->rx_urb_retry_count =3D 0; + list_for_each_entry_safe(rx_urb, tmp, &priv->rx_urb_pending_list, list) { list_del(&rx_urb->list); @@ -5881,6 +5887,47 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_pr= iv *priv, spin_unlock_irqrestore(&priv->rx_urb_lock, flags); } =20 +static void rtl8xxxu_rx_urb_retry_work(struct work_struct *work) +{ + struct rtl8xxxu_priv *priv =3D container_of(to_delayed_work(work), + struct rtl8xxxu_priv, + rx_urb_retry_wq); + unsigned long flags; + + spin_lock_irqsave(&priv->rx_urb_lock, flags); + + if (!priv->shutdown && priv->rx_urb_retry_count) { + list_splice_tail_init(&priv->rx_urb_retry_list, + &priv->rx_urb_pending_list); + priv->rx_urb_pending_count +=3D priv->rx_urb_retry_count; + priv->rx_urb_retry_count =3D 0; + /* An error must not leave a small batch waiting indefinitely. */ + schedule_work(&priv->rx_urb_wq); + } + + spin_unlock_irqrestore(&priv->rx_urb_lock, flags); +} + +static void rtl8xxxu_queue_rx_urb_retry(struct rtl8xxxu_priv *priv, + struct rtl8xxxu_rx_urb *rx_urb) +{ + unsigned long flags; + + spin_lock_irqsave(&priv->rx_urb_lock, flags); + + if (!priv->shutdown) { + list_add_tail(&rx_urb->list, &priv->rx_urb_retry_list); + priv->rx_urb_retry_count++; + /* Keep normal completions from bypassing the error backoff. */ + queue_delayed_work(system_wq, &priv->rx_urb_retry_wq, + msecs_to_jiffies(RTL8XXXU_RX_URB_RETRY_DELAY_MS)); + } else { + usb_free_urb(&rx_urb->urb); + } + + spin_unlock_irqrestore(&priv->rx_urb_lock, flags); +} + static void rtl8xxxu_rx_urb_work(struct work_struct *work) { struct rtl8xxxu_priv *priv; @@ -5904,7 +5951,7 @@ static void rtl8xxxu_rx_urb_work(struct work_struct *= work) ret =3D rtl8xxxu_submit_rx_urb(priv, rx_urb); /* * If out of memory or temporary error, put it back on the - * queue and try again. Otherwise the device is dead/gone + * delayed queue and try again. Otherwise the device is dead/gone * and we should drop it. */ switch (ret) { @@ -5912,7 +5959,7 @@ static void rtl8xxxu_rx_urb_work(struct work_struct *= work) break; case -ENOMEM: case -EAGAIN: - rtl8xxxu_queue_rx_urb(priv, rx_urb); + rtl8xxxu_queue_rx_urb_retry(priv, rx_urb); break; default: dev_warn(&priv->udev->dev, @@ -5942,7 +5989,7 @@ static int rtl8xxxu_start_rx(struct rtl8xxxu_priv *pr= iv) break; case -ENOMEM: case -EAGAIN: - rtl8xxxu_queue_rx_urb(priv, rx_urb); + rtl8xxxu_queue_rx_urb_retry(priv, rx_urb); break; default: usb_free_urb(&rx_urb->urb); @@ -6618,7 +6665,20 @@ static void rtl8xxxu_rx_complete(struct urb *urb) rtl8xxxu_queue_rx_urb(priv, rx_urb); } else { dev_dbg(dev, "%s: status %i\n", __func__, urb->status); - goto cleanup; + switch (urb->status) { + case -EPROTO: + case -EILSEQ: + case -ETIME: + case -EOVERFLOW: + case -ECOMM: + case -ENOSR: + dev_kfree_skb(skb); + urb->context =3D NULL; + rtl8xxxu_queue_rx_urb_retry(priv, rx_urb); + return; + default: + goto cleanup; + } } return; =20 @@ -7549,6 +7609,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw, bo= ol suspend) * it drained via rtl8xxxu_submit_rx_urb(), so a worker still running * after the kill could submit a URB that escapes it. */ + cancel_delayed_work_sync(&priv->rx_urb_retry_wq); cancel_work_sync(&priv->rx_urb_wq); =20 usb_kill_anchored_urbs(&priv->rx_anchor); @@ -7861,9 +7922,11 @@ static int rtl8xxxu_probe(struct usb_interface *inte= rface, INIT_LIST_HEAD(&priv->tx_urb_free_list); spin_lock_init(&priv->tx_urb_lock); INIT_LIST_HEAD(&priv->rx_urb_pending_list); + INIT_LIST_HEAD(&priv->rx_urb_retry_list); spin_lock_init(&priv->rx_urb_lock); priv->shutdown =3D true; INIT_WORK(&priv->rx_urb_wq, rtl8xxxu_rx_urb_work); + INIT_DELAYED_WORK(&priv->rx_urb_retry_wq, rtl8xxxu_rx_urb_retry_work); INIT_DELAYED_WORK(&priv->ra_watchdog, rtl8xxxu_watchdog_callback); INIT_DELAYED_WORK(&priv->update_beacon_work, rtl8xxxu_update_beacon_work_= callback); skb_queue_head_init(&priv->c2hcmd_queue); diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net= /wireless/realtek/rtl8xxxu/rtl8xxxu.h index eeb18eb0e4c0f..ee55f6cc7f012 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h @@ -1808,8 +1808,11 @@ struct rtl8xxxu_priv { spinlock_t rx_urb_lock; struct list_head rx_urb_pending_list; int rx_urb_pending_count; + struct list_head rx_urb_retry_list; + int rx_urb_retry_count; bool shutdown; struct work_struct rx_urb_wq; + struct delayed_work rx_urb_retry_wq; =20 u8 mac_addr[ETH_ALEN]; char chip_name[8]; --=20 2.48.1 From nobody Fri Sep 25 12:04:12 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94EE7384CE9; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; cv=none; b=KIzJYgowD5CDWVXPOlLMUSqPeCzZL1+9FIhv982CVM7xdhhALQNBq+9UYmOcfU1uZteMCYzkUQEiLuRLZUVQIVIYg/fAC6IJ6OoLreED/e7UCViosA0d9KoQKNSdJj8M2mHLBXNcfozbn9FFFDhsMauOHivcLXsTjnmBgR6+QYM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789284812; c=relaxed/simple; bh=8P66mAH/RdTXfC4MznyebqGFTfG4A0Xk/6F9dwSDUC0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=aO1bZOCeS2KjnE4ke9pzlSElLcCjAEpLVF4FqSz+vXY3jY5k/XTc5Cw1BuWJljZ0Mgy9uPG9hBq+hodtSSTC+Z8wT1WFA/uzD0UGXguFMV7yxvpCHN/kcF8psaSiHBhPFomxfidu1YrCsDiJ6fTG3UXgSRCSq/nDjY/7PnxBVOQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=C9NOebcl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="C9NOebcl" Received: by smtp.kernel.org (Postfix) with ESMTPS id 565AFC2BCFC; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789284812; bh=8P66mAH/RdTXfC4MznyebqGFTfG4A0Xk/6F9dwSDUC0=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=C9NOebclOYZAAyKdmmOwQ4MX/B1p45V3vYMRa7zxmNuR3vD7LXkmWujeG2acPuwuy t8tYdyooyowgtdXcI9qN0gqkOqs48ypKD5ekLZrj939xMpT01kc20e99lZV2aRL9Dy D24hPE12DZhWCzG4XgY3zblLrnseInfrjn6GHhF414evW4J2WMY1bYJ/ZfLsdt3H3l LTx2VRbOLvXgnwnAhE8e6pzZ+KLuAYxi6eXdxDQeb//Zl6AhlKaNpXuc8/TzK5axsi N3dmu1Put/GEHCFKsNMWJ3Dpj8+W3ir7leArbgkpRZbOtqktOmsnSNgiXDBJmqy1t4 I6cmnZ+qHAQdA== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43455C88E63; Sun, 13 Sep 2026 07:33:32 +0000 (UTC) From: kimwooseok via B4 Relay Date: Sun, 13 Sep 2026 16:33:22 +0900 Subject: [PATCH rtw-next v2 4/4] wifi: rtl8xxxu: test RX ownership and recovery across failures Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260913-codex-rtw-rx-v2-v2-4-f09c964e0b96@khu.ac.kr> References: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> In-Reply-To: <20260913-codex-rtw-rx-v2-v2-0-f09c964e0b96@khu.ac.kr> To: linux-wireless@vger.kernel.org Cc: Ping-Ke Shih , Jes Sorensen , linux-kernel@vger.kernel.org, kimwooseok <5mghybrid@khu.ac.kr> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789284810; l=25836; i=5mghybrid@khu.ac.kr; s=kernel-20260913; h=from:subject:message-id; bh=Erw0UBHjIqZun9gdOYJ4NKEMuM8dxfGVdztYUIogd9w=; b=lumH2COzbqkjDC5YDPgFc9uf6dTEgDdMkIMw+LQKTDSXMvyl124PHbilXU2WXZoTMvKJL5SFX A7qgosoV6KNDpZHEsDWq42Xm9IJYEzdvGeA6FmrnSgyyvcaeknpodGI X-Developer-Key: i=5mghybrid@khu.ac.kr; a=ed25519; pk=1az/6lC8Tmd6BcvyarPc8FWoSxsV/WRr5NLs1v+kjlE= X-Endpoint-Received: by B4 Relay for 5mghybrid@khu.ac.kr/kernel-20260913 with auth_id=1028 X-Original-From: kimwooseok <5mghybrid@khu.ac.kr> Reply-To: 5mghybrid@khu.ac.kr From: kimwooseok <5mghybrid@khu.ac.kr> Add 11 KUnit cases for the RX allocation, submission, completion and retry paths. Cover each retryable completion followed by ENOMEM/EAGAIN, batch sizes 1, 8, 9 and 32, skb allocation failure, startup failure positions, cancellation and shutdown. Run the actual RX helpers and worker with task-scoped stubs for allocation and USB submission. Observer references check that the driver releases its URB and skb references. A delayed-work case checks that one retry request schedules the submission worker. Assisted-by: GPT-6 Astra Signed-off-by: kimwooseok <5mghybrid@khu.ac.kr> --- drivers/net/wireless/realtek/rtl8xxxu/.kunitconfig | 16 + drivers/net/wireless/realtek/rtl8xxxu/Kconfig | 11 + drivers/net/wireless/realtek/rtl8xxxu/Makefile | 3 + drivers/net/wireless/realtek/rtl8xxxu/core.c | 66 ++- drivers/net/wireless/realtek/rtl8xxxu/rx-test.c | 461 +++++++++++++++++= ++++ drivers/net/wireless/realtek/rtl8xxxu/rx-test.h | 27 ++ 6 files changed, 569 insertions(+), 15 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/.kunitconfig b/drivers/n= et/wireless/realtek/rtl8xxxu/.kunitconfig new file mode 100644 index 0000000000000..decf383c3d51e --- /dev/null +++ b/drivers/net/wireless/realtek/rtl8xxxu/.kunitconfig @@ -0,0 +1,16 @@ +CONFIG_MODULES=3Dy +CONFIG_KUNIT=3Dy +CONFIG_KUNIT_ALL_TESTS=3Dn +CONFIG_NET=3Dy +CONFIG_NETDEVICES=3Dy +CONFIG_WIRELESS=3Dy +CONFIG_CFG80211=3Dy +CONFIG_MAC80211=3Dy +CONFIG_WLAN=3Dy +CONFIG_WLAN_VENDOR_REALTEK=3Dy +CONFIG_USB_SUPPORT=3Dy +CONFIG_USB=3Dy +CONFIG_NEW_LEDS=3Dy +CONFIG_LEDS_CLASS=3Dy +CONFIG_RTL8XXXU=3Dy +CONFIG_RTL8XXXU_KUNIT_TEST=3Dy diff --git a/drivers/net/wireless/realtek/rtl8xxxu/Kconfig b/drivers/net/wi= reless/realtek/rtl8xxxu/Kconfig index 14d0343368ac0..e2c16d62293a4 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/Kconfig +++ b/drivers/net/wireless/realtek/rtl8xxxu/Kconfig @@ -35,3 +35,14 @@ config RTL8XXXU_UNTESTED author or reported to be working by third parties. =20 Please report your results! + +config RTL8XXXU_KUNIT_TEST + tristate "KUnit tests for rtl8xxxu RX recovery" if !KUNIT_ALL_TESTS + depends on KUNIT && RTL8XXXU + default KUNIT_ALL_TESTS + help + Exercise RX buffer ownership, startup and recovery with the real + driver functions and controlled allocation and USB submission results. + These tests do not require a USB adapter. + + If unsure, say N. diff --git a/drivers/net/wireless/realtek/rtl8xxxu/Makefile b/drivers/net/w= ireless/realtek/rtl8xxxu/Makefile index 580a2fa675ee2..a592a81197857 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/Makefile +++ b/drivers/net/wireless/realtek/rtl8xxxu/Makefile @@ -4,3 +4,6 @@ obj-$(CONFIG_RTL8XXXU) +=3D rtl8xxxu.o rtl8xxxu-y :=3D core.o 8192e.o 8723b.o \ 8723a.o 8192c.o 8188f.o \ 8188e.o 8710b.o 8192f.o + +obj-$(CONFIG_RTL8XXXU_KUNIT_TEST) +=3D rtl8xxxu-rx-test.o +rtl8xxxu-rx-test-y :=3D rx-test.o diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wir= eless/realtek/rtl8xxxu/core.c index 883c9a56f52a4..323411e7f5e3b 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c @@ -17,6 +17,8 @@ #include #include "regs.h" #include "rtl8xxxu.h" +#include "rx-test.h" +#include =20 #define DRIVER_NAME "rtl8xxxu" =20 @@ -60,8 +62,7 @@ MODULE_PARM_DESC(dma_agg_pages, "Set DMA aggregation page= s (range 1-127, 0 to di #define RTL8XXXU_TX_URB_HIGH_WATER 32 =20 static void rtl8xxxu_stop(struct ieee80211_hw *hw, bool suspend); -static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, - struct rtl8xxxu_rx_urb *rx_urb); + =20 static struct ieee80211_rate rtl8xxxu_rates[] =3D { { .bitrate =3D 10, .hw_value =3D DESC_RATE_1M, .flags =3D 0 }, @@ -5817,7 +5818,36 @@ void jaguar2_rx_parse_phystats(struct rtl8xxxu_priv = *priv, } } =20 -static void rtl8xxxu_free_rx_resources(struct rtl8xxxu_priv *priv) +VISIBLE_IF_KUNIT struct rtl8xxxu_rx_urb *rtl8xxxu_alloc_rx_urb(void) +{ + KUNIT_STATIC_STUB_REDIRECT(rtl8xxxu_alloc_rx_urb); + return kmalloc_obj(struct rtl8xxxu_rx_urb); +} +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_alloc_rx_urb); + +VISIBLE_IF_KUNIT struct sk_buff *rtl8xxxu_alloc_rx_skb(unsigned int size) +{ + KUNIT_STATIC_STUB_REDIRECT(rtl8xxxu_alloc_rx_skb, size); + return __netdev_alloc_skb(NULL, size, GFP_KERNEL); +} +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_alloc_rx_skb); + +VISIBLE_IF_KUNIT int rtl8xxxu_rx_usb_submit(struct urb *urb, gfp_t flags) +{ + KUNIT_STATIC_STUB_REDIRECT(rtl8xxxu_rx_usb_submit, urb, flags); + return usb_submit_urb(urb, flags); +} +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_rx_usb_submit); + +VISIBLE_IF_KUNIT void rtl8xxxu_schedule_rx_retry(struct rtl8xxxu_priv *pri= v) +{ + KUNIT_STATIC_STUB_REDIRECT(rtl8xxxu_schedule_rx_retry, priv); + queue_delayed_work(system_wq, &priv->rx_urb_retry_wq, + msecs_to_jiffies(RTL8XXXU_RX_URB_RETRY_DELAY_MS)); +} +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_schedule_rx_retry); + +VISIBLE_IF_KUNIT void rtl8xxxu_free_rx_resources(struct rtl8xxxu_priv *pri= v) { struct rtl8xxxu_rx_urb *rx_urb, *tmp; unsigned long flags; @@ -5838,15 +5868,16 @@ static void rtl8xxxu_free_rx_resources(struct rtl8x= xxu_priv *priv) =20 spin_unlock_irqrestore(&priv->rx_urb_lock, flags); } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_free_rx_resources); =20 -static int rtl8xxxu_alloc_rx_urbs(struct rtl8xxxu_priv *priv) +VISIBLE_IF_KUNIT int rtl8xxxu_alloc_rx_urbs(struct rtl8xxxu_priv *priv) { struct rtl8xxxu_rx_urb *rx_urb; int i; =20 /* No RX work is active until the complete pool has been allocated. */ for (i =3D 0; i < RTL8XXXU_RX_URBS; i++) { - rx_urb =3D kmalloc_obj(struct rtl8xxxu_rx_urb); + rx_urb =3D rtl8xxxu_alloc_rx_urb(); if (!rx_urb) return -ENOMEM; =20 @@ -5859,6 +5890,7 @@ static int rtl8xxxu_alloc_rx_urbs(struct rtl8xxxu_pri= v *priv) =20 return 0; } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_alloc_rx_urbs); =20 static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, struct rtl8xxxu_rx_urb *rx_urb) @@ -5887,7 +5919,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_pri= v *priv, spin_unlock_irqrestore(&priv->rx_urb_lock, flags); } =20 -static void rtl8xxxu_rx_urb_retry_work(struct work_struct *work) +VISIBLE_IF_KUNIT void rtl8xxxu_rx_urb_retry_work(struct work_struct *work) { struct rtl8xxxu_priv *priv =3D container_of(to_delayed_work(work), struct rtl8xxxu_priv, @@ -5907,6 +5939,7 @@ static void rtl8xxxu_rx_urb_retry_work(struct work_st= ruct *work) =20 spin_unlock_irqrestore(&priv->rx_urb_lock, flags); } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_rx_urb_retry_work); =20 static void rtl8xxxu_queue_rx_urb_retry(struct rtl8xxxu_priv *priv, struct rtl8xxxu_rx_urb *rx_urb) @@ -5919,8 +5952,7 @@ static void rtl8xxxu_queue_rx_urb_retry(struct rtl8xx= xu_priv *priv, list_add_tail(&rx_urb->list, &priv->rx_urb_retry_list); priv->rx_urb_retry_count++; /* Keep normal completions from bypassing the error backoff. */ - queue_delayed_work(system_wq, &priv->rx_urb_retry_wq, - msecs_to_jiffies(RTL8XXXU_RX_URB_RETRY_DELAY_MS)); + rtl8xxxu_schedule_rx_retry(priv); } else { usb_free_urb(&rx_urb->urb); } @@ -5928,7 +5960,7 @@ static void rtl8xxxu_queue_rx_urb_retry(struct rtl8xx= xu_priv *priv, spin_unlock_irqrestore(&priv->rx_urb_lock, flags); } =20 -static void rtl8xxxu_rx_urb_work(struct work_struct *work) +VISIBLE_IF_KUNIT void rtl8xxxu_rx_urb_work(struct work_struct *work) { struct rtl8xxxu_priv *priv; struct rtl8xxxu_rx_urb *rx_urb, *tmp; @@ -5968,8 +6000,9 @@ static void rtl8xxxu_rx_urb_work(struct work_struct *= work) } } } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_rx_urb_work); =20 -static int rtl8xxxu_start_rx(struct rtl8xxxu_priv *priv) +VISIBLE_IF_KUNIT int rtl8xxxu_start_rx(struct rtl8xxxu_priv *priv) { struct rtl8xxxu_rx_urb *rx_urb, *tmp; unsigned long flags; @@ -6006,6 +6039,7 @@ static int rtl8xxxu_start_rx(struct rtl8xxxu_priv *pr= iv) } return ret; } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_start_rx); =20 /* * The RTL8723BU/RTL8192EU vendor driver use coexistence table type @@ -6646,7 +6680,7 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *pri= v, struct sk_buff *skb) return RX_TYPE_DATA_PKT; } =20 -static void rtl8xxxu_rx_complete(struct urb *urb) +VISIBLE_IF_KUNIT void rtl8xxxu_rx_complete(struct urb *urb) { struct rtl8xxxu_rx_urb *rx_urb =3D container_of(urb, struct rtl8xxxu_rx_urb, urb); @@ -6686,9 +6720,10 @@ static void rtl8xxxu_rx_complete(struct urb *urb) usb_free_urb(urb); dev_kfree_skb(skb); } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_rx_complete); =20 -static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, - struct rtl8xxxu_rx_urb *rx_urb) +VISIBLE_IF_KUNIT int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, + struct rtl8xxxu_rx_urb *rx_urb) { struct rtl8xxxu_fileops *fops =3D priv->fops; struct sk_buff *skb; @@ -6704,7 +6739,7 @@ static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_pri= v *priv, skb_size =3D IEEE80211_MAX_FRAME_LEN + rx_desc_sz; } =20 - skb =3D __netdev_alloc_skb(NULL, skb_size, GFP_KERNEL); + skb =3D rtl8xxxu_alloc_rx_skb(skb_size); if (!skb) return -ENOMEM; =20 @@ -6712,7 +6747,7 @@ static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_pri= v *priv, usb_fill_bulk_urb(&rx_urb->urb, priv->udev, priv->pipe_in, skb->data, skb_size, rtl8xxxu_rx_complete, skb); usb_anchor_urb(&rx_urb->urb, &priv->rx_anchor); - ret =3D usb_submit_urb(&rx_urb->urb, GFP_ATOMIC); + ret =3D rtl8xxxu_rx_usb_submit(&rx_urb->urb, GFP_ATOMIC); if (ret) { usb_unanchor_urb(&rx_urb->urb); dev_kfree_skb(skb); @@ -6720,6 +6755,7 @@ static int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_pri= v *priv, } return ret; } +EXPORT_SYMBOL_IF_KUNIT(rtl8xxxu_submit_rx_urb); =20 static void rtl8xxxu_int_complete(struct urb *urb) { diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rx-test.c b/drivers/net/= wireless/realtek/rtl8xxxu/rx-test.c new file mode 100644 index 0000000000000..aedddcb049cdf --- /dev/null +++ b/drivers/net/wireless/realtek/rtl8xxxu/rx-test.c @@ -0,0 +1,461 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include +#include +#include + +#include "rtl8xxxu.h" +#include "rx-test.h" + +#define RX_TEST_URBS 32 +#define RX_TEST_SKBS 512 + +struct rx_test { + struct rtl8xxxu_priv priv; + struct ieee80211_hw hw; + struct rtl8xxxu_fileops fops; + struct usb_device udev; + struct rtl8xxxu_rx_urb *urbs[RX_TEST_URBS]; + struct sk_buff *skbs[RX_TEST_SKBS]; + unsigned int allocated; + unsigned int buffers; + unsigned int alloc_calls; + unsigned int alloc_fail_at; + unsigned int submit_calls; + unsigned int submit_fail_at; + int submit_error; + bool fail_skb; + bool retry_pending; + unsigned int retry_arms; + atomic_t normal_runs; +}; + +static struct rx_test *rx_current(void) +{ + return kunit_get_current_test()->priv; +} + +static struct rtl8xxxu_rx_urb *rx_alloc_object(void) +{ + struct rx_test *ctx =3D rx_current(); + struct rtl8xxxu_rx_urb *rx; + + ctx->alloc_calls++; + if (ctx->alloc_calls =3D=3D ctx->alloc_fail_at) + return NULL; + rx =3D kmalloc_obj(struct rtl8xxxu_rx_urb); + if (rx) + ctx->urbs[ctx->allocated++] =3D rx; + return rx; +} + +static struct sk_buff *rx_alloc_buffer(unsigned int size) +{ + struct rx_test *ctx =3D rx_current(); + struct sk_buff *skb; + + if (ctx->fail_skb) + return NULL; + skb =3D alloc_skb(size, GFP_KERNEL); + if (skb) { + /* Retain an observer reference to detect a lost driver reference. */ + skb_get(skb); + ctx->skbs[ctx->buffers++] =3D skb; + } + return skb; +} + +static int rx_submit(struct urb *urb, gfp_t flags) +{ + struct rx_test *ctx =3D rx_current(); + + ctx->submit_calls++; + if (!ctx->submit_fail_at || + ctx->submit_calls =3D=3D ctx->submit_fail_at) + return ctx->submit_error; + return 0; +} + +static void rx_schedule_retry(struct rtl8xxxu_priv *priv) +{ + struct rx_test *ctx =3D rx_current(); + + /* Model the single pending delayed-work ticket, not a submission. */ + if (!ctx->retry_pending) { + ctx->retry_pending =3D true; + ctx->retry_arms++; + } +} + +static void rx_observe_work(struct work_struct *work) +{ + struct rtl8xxxu_priv *priv; + struct rx_test *ctx; + + priv =3D container_of(work, struct rtl8xxxu_priv, rx_urb_wq); + ctx =3D container_of(priv, struct rx_test, priv); + atomic_inc(&ctx->normal_runs); +} + +static struct rx_test *rx_init(struct kunit *test, bool fake_timer) +{ + struct rx_test *ctx; + + ctx =3D kunit_kzalloc(test, sizeof(*ctx), GFP_KERNEL); + if (!ctx) + return NULL; + test->priv =3D ctx; + ctx->hw.priv =3D &ctx->priv; + ctx->priv.hw =3D &ctx->hw; + ctx->priv.udev =3D &ctx->udev; + ctx->priv.fops =3D &ctx->fops; + ctx->fops.rx_desc_size =3D sizeof(struct rtl8xxxu_rxdesc16); + spin_lock_init(&ctx->priv.rx_urb_lock); + INIT_LIST_HEAD(&ctx->priv.rx_urb_pending_list); + INIT_LIST_HEAD(&ctx->priv.rx_urb_retry_list); + init_usb_anchor(&ctx->priv.rx_anchor); + INIT_WORK(&ctx->priv.rx_urb_wq, rx_observe_work); + INIT_DELAYED_WORK(&ctx->priv.rx_urb_retry_wq, + rtl8xxxu_rx_urb_retry_work); + atomic_set(&ctx->normal_runs, 0); + + kunit_activate_static_stub(test, rtl8xxxu_alloc_rx_urb, rx_alloc_object); + kunit_activate_static_stub(test, rtl8xxxu_alloc_rx_skb, rx_alloc_buffer); + kunit_activate_static_stub(test, rtl8xxxu_rx_usb_submit, rx_submit); + if (fake_timer) + kunit_activate_static_stub(test, rtl8xxxu_schedule_rx_retry, + rx_schedule_retry); + return ctx; +} + +static void rx_get_observers(struct rx_test *ctx) +{ + unsigned int i; + + for (i =3D 0; i < ctx->allocated; i++) + usb_get_urb(&ctx->urbs[i]->urb); +} + +static int rx_pool(struct rx_test *ctx, unsigned int count) +{ + struct rtl8xxxu_rx_urb *rx; + unsigned int i; + int ret; + + ret =3D rtl8xxxu_alloc_rx_urbs(&ctx->priv); + rx_get_observers(ctx); + if (ret) + return ret; + + /* A reduced pool also tests recovery without the normal watermark. */ + for (i =3D count; i < ctx->allocated; i++) { + rx =3D ctx->urbs[i]; + list_del_init(&rx->list); + ctx->priv.rx_urb_pending_count--; + usb_free_urb(&rx->urb); + } + return 0; +} + +static void rx_giveback(struct rx_test *ctx, unsigned int i, int status) +{ + struct urb *urb =3D &ctx->urbs[i]->urb; + + /* The fake USB boundary does not emulate HCD giveback. */ + usb_unanchor_urb(urb); + urb->status =3D status; + urb->actual_length =3D 0; + rtl8xxxu_rx_complete(urb); +} + +static void rx_finish(struct kunit *test, struct rx_test *ctx) +{ + struct urb *urb; + unsigned int i; + + ctx->priv.shutdown =3D true; + cancel_delayed_work_sync(&ctx->priv.rx_urb_retry_wq); + cancel_work_sync(&ctx->priv.rx_urb_wq); + for (i =3D 0; i < ctx->allocated; i++) { + urb =3D &ctx->urbs[i]->urb; + if (urb->anchor) + rx_giveback(ctx, i, -ENOENT); + } + rtl8xxxu_free_rx_resources(&ctx->priv); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_pending_count, 0); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + KUNIT_EXPECT_TRUE(test, usb_anchor_empty(&ctx->priv.rx_anchor)); + for (i =3D 0; i < ctx->allocated; i++) { + urb =3D &ctx->urbs[i]->urb; + KUNIT_EXPECT_EQ(test, refcount_read(&urb->kref.refcount), 1); + usb_free_urb(urb); + } + for (i =3D 0; i < ctx->buffers; i++) { + KUNIT_EXPECT_EQ(test, refcount_read(&ctx->skbs[i]->users), 1); + kfree_skb(ctx->skbs[i]); + } +} + +static void rx_retry_step(struct kunit *test, struct rx_test *ctx) +{ + KUNIT_ASSERT_TRUE(test, ctx->retry_pending); + ctx->retry_pending =3D false; + rtl8xxxu_rx_urb_retry_work(&ctx->priv.rx_urb_retry_wq.work); + flush_work(&ctx->priv.rx_urb_wq); + /* Execute the actual worker in the test task so boundary stubs apply. */ + rtl8xxxu_rx_urb_work(&ctx->priv.rx_urb_wq); +} + +static void rx_completion_submit_chain(struct kunit *test) +{ + static const int errors[] =3D { + -EPROTO, -EILSEQ, -ETIME, -EOVERFLOW, -ECOMM, -ENOSR, + }; + static const int submissions[] =3D { -ENOMEM, -EAGAIN }; + struct rx_test *ctx; + unsigned int e, f, i; + int runs; + + for (e =3D 0; e < ARRAY_SIZE(errors); e++) { + for (f =3D 0; f < ARRAY_SIZE(submissions); f++) { + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, RX_TEST_URBS), 0); + KUNIT_ASSERT_EQ(test, rtl8xxxu_start_rx(&ctx->priv), 0); + for (i =3D 0; i < RX_TEST_URBS; i++) + rx_giveback(ctx, i, errors[e]); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 32); + ctx->submit_error =3D submissions[f]; + rx_retry_step(test, ctx); + runs =3D atomic_read(&ctx->normal_runs); + flush_work(&ctx->priv.rx_urb_wq); + KUNIT_EXPECT_EQ(test, atomic_read(&ctx->normal_runs), runs); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_pending_count, 0); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 32); + KUNIT_EXPECT_TRUE(test, ctx->retry_pending); + for (i =3D 0; i < ctx->buffers; i++) + KUNIT_EXPECT_EQ(test, + refcount_read(&ctx->skbs[i]->users), 1); + ctx->submit_error =3D 0; + rx_retry_step(test, ctx); + KUNIT_EXPECT_FALSE(test, ctx->retry_pending); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + KUNIT_EXPECT_FALSE(test, usb_anchor_empty(&ctx->priv.rx_anchor)); + rx_finish(test, ctx); + } + } +} + +static void rx_worker_batch_sizes(struct kunit *test) +{ + static const unsigned int sizes[] =3D { 1, 8, 9, 32 }; + struct rx_test *ctx; + unsigned int n, pass; + int runs; + + for (n =3D 0; n < ARRAY_SIZE(sizes); n++) { + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, sizes[n]), 0); + ctx->submit_error =3D -EAGAIN; + rtl8xxxu_rx_urb_work(&ctx->priv.rx_urb_wq); + for (pass =3D 0; pass < 3; pass++) { + runs =3D atomic_read(&ctx->normal_runs); + flush_work(&ctx->priv.rx_urb_wq); + KUNIT_EXPECT_EQ(test, atomic_read(&ctx->normal_runs), runs); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, sizes[n]); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_pending_count, 0); + rx_retry_step(test, ctx); + } + ctx->submit_error =3D 0; + rx_retry_step(test, ctx); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + rx_finish(test, ctx); + } +} + +static void rx_skb_allocation_failure(struct kunit *test) +{ + struct rx_test *ctx; + + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 8), 0); + ctx->fail_skb =3D true; + rtl8xxxu_rx_urb_work(&ctx->priv.rx_urb_wq); + KUNIT_EXPECT_EQ(test, ctx->submit_calls, 0); + KUNIT_EXPECT_EQ(test, ctx->buffers, 0); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 8); + ctx->fail_skb =3D false; + rx_retry_step(test, ctx); + KUNIT_EXPECT_EQ(test, ctx->submit_calls, 8); + rx_finish(test, ctx); +} + +static void rx_start_allocation_failure(struct kunit *test) +{ + static const unsigned int positions[] =3D { 1, 8, 32 }; + struct rx_test *ctx; + unsigned int i; + + for (i =3D 0; i < ARRAY_SIZE(positions); i++) { + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + ctx->alloc_fail_at =3D positions[i]; + KUNIT_EXPECT_EQ(test, rtl8xxxu_alloc_rx_urbs(&ctx->priv), -ENOMEM); + rx_get_observers(ctx); + KUNIT_EXPECT_EQ(test, ctx->allocated, positions[i] - 1); + KUNIT_EXPECT_EQ(test, ctx->submit_calls, 0); + KUNIT_EXPECT_FALSE(test, ctx->retry_pending); + rx_finish(test, ctx); + } +} + +static void rx_start_temporary_failure(struct kunit *test) +{ + static const int errors[] =3D { -ENOMEM, -EAGAIN }; + struct rx_test *ctx; + unsigned int i; + + for (i =3D 0; i < ARRAY_SIZE(errors); i++) { + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 32), 0); + ctx->submit_error =3D errors[i]; + KUNIT_EXPECT_EQ(test, rtl8xxxu_start_rx(&ctx->priv), 0); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 32); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_pending_count, 0); + KUNIT_EXPECT_TRUE(test, ctx->retry_pending); + ctx->submit_error =3D 0; + rx_retry_step(test, ctx); + rx_finish(test, ctx); + } +} + +static void rx_start_fatal_failure(struct kunit *test) +{ + static const unsigned int positions[] =3D { 1, 8, 32 }; + struct rx_test *ctx; + unsigned int i; + + for (i =3D 0; i < ARRAY_SIZE(positions); i++) { + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 32), 0); + ctx->submit_fail_at =3D positions[i]; + ctx->submit_error =3D -ENODEV; + KUNIT_EXPECT_EQ(test, rtl8xxxu_start_rx(&ctx->priv), -ENODEV); + KUNIT_EXPECT_EQ(test, ctx->submit_calls, positions[i]); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_pending_count, 0); + KUNIT_EXPECT_FALSE(test, ctx->retry_pending); + rx_finish(test, ctx); + } +} + +static void rx_terminal_completion(struct kunit *test) +{ + static const int errors[] =3D { + -ENOENT, -ECONNRESET, -ENODEV, -ESHUTDOWN, -EPIPE, + }; + struct rx_test *ctx; + unsigned int i; + + for (i =3D 0; i < ARRAY_SIZE(errors); i++) { + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 1), 0); + KUNIT_ASSERT_EQ(test, rtl8xxxu_start_rx(&ctx->priv), 0); + rx_giveback(ctx, 0, errors[i]); + KUNIT_EXPECT_FALSE(test, ctx->retry_pending); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + rx_finish(test, ctx); + } +} + +static void rx_shutdown_completion(struct kunit *test) +{ + struct rx_test *ctx; + + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 1), 0); + KUNIT_ASSERT_EQ(test, rtl8xxxu_start_rx(&ctx->priv), 0); + ctx->priv.shutdown =3D true; + rx_giveback(ctx, 0, -EPROTO); + KUNIT_EXPECT_FALSE(test, ctx->retry_pending); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + rx_finish(test, ctx); +} + +static void rx_shutdown_pending_retry(struct kunit *test) +{ + struct rx_test *ctx; + + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 8), 0); + ctx->submit_error =3D -ENOMEM; + rtl8xxxu_rx_urb_work(&ctx->priv.rx_urb_wq); + ctx->priv.shutdown =3D true; + rtl8xxxu_rx_urb_retry_work(&ctx->priv.rx_urb_retry_wq.work); + flush_work(&ctx->priv.rx_urb_wq); + KUNIT_EXPECT_EQ(test, atomic_read(&ctx->normal_runs), 0); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 8); + rx_finish(test, ctx); +} + +static void rx_shutdown_submission_failure(struct kunit *test) +{ + struct rx_test *ctx; + + ctx =3D rx_init(test, true); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 8), 0); + ctx->priv.shutdown =3D true; + ctx->submit_error =3D -ENOMEM; + rtl8xxxu_rx_urb_work(&ctx->priv.rx_urb_wq); + KUNIT_EXPECT_FALSE(test, ctx->retry_pending); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + rx_finish(test, ctx); +} + +static void rx_real_delayed_bridge(struct kunit *test) +{ + struct rx_test *ctx; + + ctx =3D rx_init(test, false); + KUNIT_ASSERT_NOT_NULL(test, ctx); + KUNIT_ASSERT_EQ(test, rx_pool(ctx, 1), 0); + KUNIT_ASSERT_EQ(test, rtl8xxxu_start_rx(&ctx->priv), 0); + rx_giveback(ctx, 0, -EPROTO); + flush_delayed_work(&ctx->priv.rx_urb_retry_wq); + flush_work(&ctx->priv.rx_urb_wq); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_retry_count, 0); + KUNIT_EXPECT_EQ(test, ctx->priv.rx_urb_pending_count, 1); + KUNIT_EXPECT_EQ(test, atomic_read(&ctx->normal_runs), 1); + rx_finish(test, ctx); +} + +static struct kunit_case rx_cases[] =3D { + KUNIT_CASE(rx_completion_submit_chain), + KUNIT_CASE(rx_worker_batch_sizes), + KUNIT_CASE(rx_skb_allocation_failure), + KUNIT_CASE(rx_start_allocation_failure), + KUNIT_CASE(rx_start_temporary_failure), + KUNIT_CASE(rx_start_fatal_failure), + KUNIT_CASE(rx_terminal_completion), + KUNIT_CASE(rx_shutdown_completion), + KUNIT_CASE(rx_shutdown_pending_retry), + KUNIT_CASE(rx_shutdown_submission_failure), + KUNIT_CASE(rx_real_delayed_bridge), + {} +}; + +static struct kunit_suite rx_suite =3D { + .name =3D "rtl8xxxu-rx", + .test_cases =3D rx_cases, +}; + +kunit_test_suite(rx_suite); +MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING"); +MODULE_DESCRIPTION("rtl8xxxu RX recovery KUnit tests"); +MODULE_LICENSE("GPL"); diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rx-test.h b/drivers/net/= wireless/realtek/rtl8xxxu/rx-test.h new file mode 100644 index 0000000000000..295befdfe8144 --- /dev/null +++ b/drivers/net/wireless/realtek/rtl8xxxu/rx-test.h @@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef RTL8XXXU_RX_TEST_H +#define RTL8XXXU_RX_TEST_H + +#include +#include + +struct rtl8xxxu_priv; +struct rtl8xxxu_rx_urb; +struct sk_buff; +struct urb; +struct work_struct; + +VISIBLE_IF_KUNIT struct rtl8xxxu_rx_urb *rtl8xxxu_alloc_rx_urb(void); +VISIBLE_IF_KUNIT struct sk_buff *rtl8xxxu_alloc_rx_skb(unsigned int size); +VISIBLE_IF_KUNIT int rtl8xxxu_rx_usb_submit(struct urb *urb, gfp_t flags); +VISIBLE_IF_KUNIT void rtl8xxxu_schedule_rx_retry(struct rtl8xxxu_priv *pri= v); +VISIBLE_IF_KUNIT int rtl8xxxu_alloc_rx_urbs(struct rtl8xxxu_priv *priv); +VISIBLE_IF_KUNIT int rtl8xxxu_start_rx(struct rtl8xxxu_priv *priv); +VISIBLE_IF_KUNIT int rtl8xxxu_submit_rx_urb(struct rtl8xxxu_priv *priv, + struct rtl8xxxu_rx_urb *rx_urb); +VISIBLE_IF_KUNIT void rtl8xxxu_free_rx_resources(struct rtl8xxxu_priv *pri= v); +VISIBLE_IF_KUNIT void rtl8xxxu_rx_complete(struct urb *urb); +VISIBLE_IF_KUNIT void rtl8xxxu_rx_urb_work(struct work_struct *work); +VISIBLE_IF_KUNIT void rtl8xxxu_rx_urb_retry_work(struct work_struct *work); + +#endif --=20 2.48.1