From patchwork Mon May 26 11:51:36 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 892915 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCC611F7904; Mon, 26 May 2025 11:52:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260336; cv=none; b=CafvVxSKKOL5opjhRGnnG4N10rQE4OieBH9oJGj3viPbzoqxFbo6CnpP+Yk9aiRfRNUmzTvqSmDfj1QKC4r2vQlsSTmbvrJr5C82fudYTx+e+nf25C7IiJOdhO8irsYvT3b3gPMwwdlXPqhicC6Ovjuqca0ZVCiN8U3RTFEdvq4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260336; c=relaxed/simple; bh=PerCT+iLxD5zsw5LMxLFNaQeXnIW4oHIuRshGvuczYo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NdIY8AMKwHZKFVAasqRM1jwaW29gPwtfdRFk3fyCbqkB0n57DnxTKbRACC+Sp+Gh0jpeK9pg4QsTmGK11LxWM2zMmDusGmSjBDwE9/Cl+edU0KgIx9eBeBeQ3ie7YbFvDLbqB/bnfnPBIt+fCYVXeMixF80diqHmlTikX5esDqo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OdRUSMXv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OdRUSMXv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5701AC4CEEF; Mon, 26 May 2025 11:52:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748260336; bh=PerCT+iLxD5zsw5LMxLFNaQeXnIW4oHIuRshGvuczYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OdRUSMXv6KQLm9B35acLeX2FNOh3q2aBIQYLdcSP9kM0HRmMdLdcPLev302MCgbea XY0dPc9kuLMHPDIg0MxLjyVurTAdwG81Wn8NId9xd6as8/NZZIq7x359PIzHiJJsBB 4oPxmlKiM8zOwnNwiz8Gkgba5Ufj3t/WlpiNxTzk+v/UK2f7UJOPjiGqfs6hsX7qbl TqIKzeskWILxkW0MxIHzOUA+9bGuT35AY1bzHRG5l87TX5hpweGSAe0TpRHTnuyYG9 LyAJ7sMducBK9TV8anKItVGYHDLuNXGyk3YxAlhXNs5qJNVL4G6m/eoKy1amWMBvmz CFYLg+uozcg6Q== Received: from johan by xi.lan with local (Exim 4.97.1) (envelope-from ) id 1uJWNN-000000000fG-3sio; Mon, 26 May 2025 13:52:17 +0200 From: Johan Hovold To: Jeff Johnson Cc: Miaoqing Pan , Remi Pommarel , linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 1/2] wifi: ath12k: fix dest ring-buffer corruption Date: Mon, 26 May 2025 13:51:36 +0200 Message-ID: <20250526115137.2490-2-johan+linaro@kernel.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250526115137.2490-1-johan+linaro@kernel.org> References: <20250526115137.2490-1-johan+linaro@kernel.org> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Add the missing memory barriers to make sure that destination ring descriptors are read after the head pointers to avoid using stale data on weakly ordered architectures like aarch64. Note that this may fix the empty descriptor issue recently worked around by commit 51ad34a47e9f ("wifi: ath12k: Add drop descriptor handling for monitor ring"). Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # 6.3 Signed-off-by: Johan Hovold --- drivers/net/wireless/ath/ath12k/dp_mon.c | 3 +++ drivers/net/wireless/ath/ath12k/dp_rx.c | 12 ++++++++++++ drivers/net/wireless/ath/ath12k/dp_tx.c | 3 +++ 3 files changed, 18 insertions(+) diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c index d22800e89485..90a7763502c8 100644 --- a/drivers/net/wireless/ath/ath12k/dp_mon.c +++ b/drivers/net/wireless/ath/ath12k/dp_mon.c @@ -3258,6 +3258,9 @@ int ath12k_dp_mon_srng_process(struct ath12k *ar, int *budget, spin_lock_bh(&srng->lock); ath12k_hal_srng_access_begin(ab, srng); + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (likely(*budget)) { *budget -= 1; mon_dst_desc = ath12k_hal_srng_dst_peek(ab, srng); diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c index 75bf4211ad42..68fceb4201d7 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2753,6 +2753,9 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id, try_again: ath12k_hal_srng_access_begin(ab, srng); + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while ((desc = ath12k_hal_srng_dst_get_next_entry(ab, srng))) { struct rx_mpdu_desc *mpdu_info; struct rx_msdu_desc *msdu_info; @@ -3599,6 +3602,9 @@ int ath12k_dp_rx_process_err(struct ath12k_base *ab, struct napi_struct *napi, ath12k_hal_srng_access_begin(ab, srng); + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (budget && (reo_desc = ath12k_hal_srng_dst_get_next_entry(ab, srng))) { drop = false; @@ -3941,6 +3947,9 @@ int ath12k_dp_rx_process_wbm_err(struct ath12k_base *ab, ath12k_hal_srng_access_begin(ab, srng); + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (budget) { rx_desc = ath12k_hal_srng_dst_get_next_entry(ab, srng); if (!rx_desc) @@ -4122,6 +4131,9 @@ void ath12k_dp_rx_process_reo_status(struct ath12k_base *ab) ath12k_hal_srng_access_begin(ab, srng); + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while ((hdr = ath12k_hal_srng_dst_get_next_entry(ab, srng))) { tag = le64_get_bits(hdr->tl, HAL_SRNG_TLV_HDR_TAG); diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c index ced232bf4aed..3124eafa0201 100644 --- a/drivers/net/wireless/ath/ath12k/dp_tx.c +++ b/drivers/net/wireless/ath/ath12k/dp_tx.c @@ -853,6 +853,9 @@ void ath12k_dp_tx_completion_handler(struct ath12k_base *ab, int ring_id) ath12k_hal_srng_access_begin(ab, status_ring); + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (ATH12K_TX_COMPL_NEXT(tx_ring->tx_status_head) != tx_ring->tx_status_tail) { desc = ath12k_hal_srng_dst_get_next_entry(ab, status_ring); if (!desc) From patchwork Mon May 26 11:51:37 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 892728 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D3CAB1F8ADD; Mon, 26 May 2025 11:52:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260336; cv=none; b=DUIAhkwqm4l8gb3VEKCkGuAntvpAZBvoOERsrQ6rkfaHywhE+yICm7JKTYDaOCc4fLcrOp5Jnk8aOC5YvvPkInHoNbmQe+DL4VTTaq63cDUOXOt4tXVDZSiUxqCRWW7I87XabeQX8j5jEYnaD+U/b4Tnw7mSJ4XmdrmWRvfmgYU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260336; c=relaxed/simple; bh=m/OPqTtOeOWGN0cjMWn0CbNb8uPAv1c+dguTeasO26A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YismrGv/mqw6Wk0Fn3iQ8G8ZsR8ona7jqcOZPOAOCU/kRWpfaLfFGsDvfX9E8eEgK+sJ1KKeJ7E+q+1FX9wHrqFngWhbS/Hwzz1O9R4RHRVZThDEq8ZEnUK59cwC5zesyWRkO2QyXrZ40jJiZJ3Af+FD0pggf3GQmTxJvHhdmi4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JDoL/kKK; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JDoL/kKK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F34DC4CEE9; Mon, 26 May 2025 11:52:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748260336; bh=m/OPqTtOeOWGN0cjMWn0CbNb8uPAv1c+dguTeasO26A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JDoL/kKKaSk9jl3zUPXAyhGbkth+ySalJ+cLkSgCVOQu1TIsK4btml/Xtl3SunHfd BPuvVTG1m4unmBGKsfSoFpOxSI1ddjqcB/oyUBaRJQjXN/KDpA/Scd5uUdh01+A+ko tUBMkrVPPVHz/21W70lBgvMu8Z8WMRhPiIblJXQdefwUs19mYV1vnWb6ajAkn/Ihkt HjlVa63ASsR1/lnGo4bYB3cQRiA3rVP9T5wX7pZSzjJ6v0+sAhPt49f5BVfwsJHtnM V7dJVgR4xludzUG/HvdM60YvYPeungx0ok1hvMS6jFPclrZKxPIj/pp/4djzBCOzEn JawGvZHhFp02Q== Received: from johan by xi.lan with local (Exim 4.97.1) (envelope-from ) id 1uJWNO-000000000fI-054Q; Mon, 26 May 2025 13:52:18 +0200 From: Johan Hovold To: Jeff Johnson Cc: Miaoqing Pan , Remi Pommarel , linux-wireless@vger.kernel.org, ath12k@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH 2/2] wifi: ath12k: use plain access for descriptor length Date: Mon, 26 May 2025 13:51:37 +0200 Message-ID: <20250526115137.2490-3-johan+linaro@kernel.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250526115137.2490-1-johan+linaro@kernel.org> References: <20250526115137.2490-1-johan+linaro@kernel.org> Precedence: bulk X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The read memory barrier added by commit 6b67d2cf14ea ("wifi: ath12k: fix ring-buffer corruption") is enough to guarantee ordering also for plain descriptor accesses if the length helper is ever inlined so drop the unnecessary READ_ONCE(). Signed-off-by: Johan Hovold --- drivers/net/wireless/ath/ath12k/hal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c index 91d5126ca149..962111c66a3e 100644 --- a/drivers/net/wireless/ath/ath12k/hal.c +++ b/drivers/net/wireless/ath/ath12k/hal.c @@ -1962,7 +1962,7 @@ u32 ath12k_hal_ce_dst_status_get_length(struct hal_ce_srng_dst_status_desc *desc { u32 len; - len = le32_get_bits(READ_ONCE(desc->flags), HAL_CE_DST_STATUS_DESC_FLAGS_LEN); + len = le32_get_bits(desc->flags, HAL_CE_DST_STATUS_DESC_FLAGS_LEN); desc->flags &= ~cpu_to_le32(HAL_CE_DST_STATUS_DESC_FLAGS_LEN); return len;