Commit 8157ce53 authored by Johan Hovold's avatar Johan Hovold Committed by Jeff Johnson
Browse files

wifi: ath12k: fix dest ring-buffer corruption 



Add the missing memory barrier to make sure that destination ring
descriptors are read after the head pointers to avoid using stale data
on weakly ordered architectures like aarch64.

The barrier is added to the ath12k_hal_srng_access_begin() helper for
symmetry with follow-on fixes for source ring buffer corruption which
will add barriers to ath12k_hal_srng_access_end().

Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Fixes: d8899132 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Cc: stable@vger.kernel.org	# 6.3
Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
Reviewed-by: default avatarBaochen Qiang <quic_bqiang@quicinc.com>
Link: https://patch.msgid.link/20250617084402.14475-2-johan+linaro@kernel.org


Signed-off-by: default avatarJeff Johnson <jeff.johnson@oss.qualcomm.com>
parent aa695615

drivers/net/wireless/ath/ath12k/ce.c

+0 −3
Original line number Diff line number Diff line
@@ -433,9 +433,6 @@ static int ath12k_ce_completed_recv_next(struct ath12k_ce_pipe *pipe, 
		goto err;

	}



	/* Make sure descriptor is read after the head pointer. */

	dma_rmb();



	*nbytes = ath12k_hal_ce_dst_status_get_length(desc);



	*skb = pipe->dest_ring->skb[sw_index];

drivers/net/wireless/ath/ath12k/hal.c

+14 −3
Original line number Diff line number Diff line
@@ -2143,13 +2143,24 @@ void *ath12k_hal_srng_src_get_next_reaped(struct ath12k_base *ab, 


void ath12k_hal_srng_access_begin(struct ath12k_base *ab, struct hal_srng *srng)

{

	u32 hp;



	lockdep_assert_held(&srng->lock);



	if (srng->ring_dir == HAL_SRNG_DIR_SRC)

	if (srng->ring_dir == HAL_SRNG_DIR_SRC) {

		srng->u.src_ring.cached_tp =

			*(volatile u32 *)srng->u.src_ring.tp_addr;

	else

		srng->u.dst_ring.cached_hp = READ_ONCE(*srng->u.dst_ring.hp_addr);

	} else {

		hp = READ_ONCE(*srng->u.dst_ring.hp_addr);



		if (hp != srng->u.dst_ring.cached_hp) {

			srng->u.dst_ring.cached_hp = hp;

			/* Make sure descriptor is read after the head

			 * pointer.

			 */

			dma_rmb();

		}

	}

}



/* Update cached ring head/tail pointers to HW. ath12k_hal_srng_access_begin()