From nobody Tue Feb 10 18:36:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6586D1F429C; Mon, 26 May 2025 11:48:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260104; cv=none; b=HGHIaz5NYcPA0u/S7Zx83EBQlHFTxnZoJwzs1OXFnl9CjWAC96oL9xDmRJhJf1pHGEt2Zl0XEnljHZ5Mbrf3xbYa/lnZeghUWO5EYfF92302PirQPYE263PrPYyfdWb998pTkIyTq6PU7iUJtUVT4rcgt3jD2q0JUIkozNL3nog= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260104; c=relaxed/simple; bh=QrLLMqTyR7YAQGK5tv4IbrNqrw7xUDpHrWfnkyxz8Jk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s/ANxR8o6bXB1LpiWpBdMULT8q6f7XDiw3ObPpr5uSI8PuadK3DmwXx72ZvbJv5772h9XBr1bDXWD58HHVCinYhiJLC7z/0z8ZJOKNZAYd74aA/bIrnL9v5FnFDISdd0GSVW1EfXVYxS6EG7GbwG1HllDX10FmbXTnm6P8r9oIk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=q0Yv09b1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="q0Yv09b1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2A2BC4CEF2; Mon, 26 May 2025 11:48:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748260103; bh=QrLLMqTyR7YAQGK5tv4IbrNqrw7xUDpHrWfnkyxz8Jk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q0Yv09b1t3/ZqYFbSGFyWxqb4yX1hzYNHC6UhOKAH0c8RoDKbXWE88Rx5pbWmGjWf WhvmkZCFNUsyr6AjaVxxi/SmlASjcdk/Zog4xv2na2waXB6kMHGcrISziYu1xvdC2x nu/PtKEJ7sAXCAREZSWoQoQBzS+Ea2dExfKJdxJNOBIYb8KzRdC0Oz+5H6Lwo5NN/V 3shvvaiJ0eZmGhFVbw/T4KmlqjZr6EboW+ouyVzDGoqKWLa9P/vzEX73MHRDl8Wu+4 scIvfvLn+duOjrB/beWDW7I1mkDn+GGsESp4adlsjzCfW80OAQTA+Nd916TUW7VTuL Mld4ZEL+Axdnw== Received: from johan by xi.lan with local (Exim 4.97.1) (envelope-from ) id 1uJWJd-000000000Ys-1KI0; Mon, 26 May 2025 13:48:25 +0200 From: Johan Hovold To: Jeff Johnson Cc: Miaoqing Pan , linux-wireless@vger.kernel.org, ath11k@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 1/3] wifi: ath11k: fix dest ring-buffer corruption Date: Mon, 26 May 2025 13:48:01 +0200 Message-ID: <20250526114803.2122-2-johan+linaro@kernel.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250526114803.2122-1-johan+linaro@kernel.org> References: <20250526114803.2122-1-johan+linaro@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add the missing memory barriers to make sure that destination ring descriptors are read after the head pointers to avoid using stale data on weakly ordered architectures like aarch64. Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-= 3.6510.41 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Signed-off-by: Johan Hovold Reviewed-by: Miaoqing Pan --- drivers/net/wireless/ath/ath11k/dp_rx.c | 19 +++++++++++++++++++ drivers/net/wireless/ath/ath11k/dp_tx.c | 3 +++ 2 files changed, 22 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless= /ath/ath11k/dp_rx.c index ea2959305dec..dfe2d889c20f 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -3851,6 +3851,9 @@ int ath11k_dp_process_rx_err(struct ath11k_base *ab, = struct napi_struct *napi, =20 ath11k_hal_srng_access_begin(ab, srng); =20 + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (budget && (desc =3D ath11k_hal_srng_dst_get_next_entry(ab, srng))) { struct hal_reo_dest_ring *reo_desc =3D (struct hal_reo_dest_ring *)desc; @@ -4154,6 +4157,9 @@ int ath11k_dp_rx_process_wbm_err(struct ath11k_base *= ab, =20 ath11k_hal_srng_access_begin(ab, srng); =20 + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (budget) { rx_desc =3D ath11k_hal_srng_dst_get_next_entry(ab, srng); if (!rx_desc) @@ -4280,6 +4286,9 @@ int ath11k_dp_process_rxdma_err(struct ath11k_base *a= b, int mac_id, int budget) =20 ath11k_hal_srng_access_begin(ab, srng); =20 + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while (quota-- && (desc =3D ath11k_hal_srng_dst_get_next_entry(ab, srng))) { ath11k_hal_rx_reo_ent_paddr_get(ab, desc, &paddr, &desc_bank); @@ -4353,6 +4362,9 @@ void ath11k_dp_process_reo_status(struct ath11k_base = *ab) =20 ath11k_hal_srng_access_begin(ab, srng); =20 + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while ((reo_desc =3D ath11k_hal_srng_dst_get_next_entry(ab, srng))) { tag =3D FIELD_GET(HAL_SRNG_TLV_HDR_TAG, *reo_desc); =20 @@ -5168,6 +5180,9 @@ static void ath11k_dp_rx_mon_dest_process(struct ath1= 1k *ar, int mac_id, rx_bufs_used =3D 0; rx_mon_stats =3D &pmon->rx_mon_stats; =20 + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while ((ring_entry =3D ath11k_hal_srng_dst_peek(ar->ab, mon_dst_srng))) { struct sk_buff *head_msdu, *tail_msdu; =20 @@ -5630,6 +5645,10 @@ static int ath11k_dp_full_mon_process_rx(struct ath1= 1k_base *ab, int mac_id, spin_lock_bh(&mon_dst_srng->lock); =20 ath11k_hal_srng_access_begin(ar->ab, mon_dst_srng); + + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while ((ring_entry =3D ath11k_hal_srng_dst_peek(ar->ab, mon_dst_srng))) { head_msdu =3D NULL; tail_msdu =3D NULL; diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless= /ath/ath11k/dp_tx.c index 8522c67baabf..549d17d90503 100644 --- a/drivers/net/wireless/ath/ath11k/dp_tx.c +++ b/drivers/net/wireless/ath/ath11k/dp_tx.c @@ -700,6 +700,9 @@ void ath11k_dp_tx_completion_handler(struct ath11k_base= *ab, int ring_id) =20 ath11k_hal_srng_access_begin(ab, status_ring); =20 + /* Make sure descriptor is read after the head pointer. */ + dma_rmb(); + while ((ATH11K_TX_COMPL_NEXT(tx_ring->tx_status_head) !=3D tx_ring->tx_status_tail) && (desc =3D ath11k_hal_srng_dst_get_next_entry(ab, status_ring))) { --=20 2.49.0 From nobody Tue Feb 10 18:36:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 658C61F4725; Mon, 26 May 2025 11:48:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260104; cv=none; b=TE3BKmp5OnIR9hjwSCMHNTRrVaLPq8ZjBNv28sSgRHWAUsPJmvXKIy7YJNxwo1xjDqka5H+20sSqVDVsXhvgQTbzzegU0iywOb/WMRoCRXWJ5rzNZSS0XJtHgADIhYay1XrSIDCLnssR+N/HoTD2cpvxlfvMWlm+S6QYBkYnG5c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260104; c=relaxed/simple; bh=Z5e7LYUJWrN8Oqgcyb4aHiiFK/LIDVnO1Tn4lc/8a7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rx6TqHVwv4UYf6SlhFP1wyvvsDvML7uEvhioVD48EzzX7YVzlUszFrzwRQjfMpnoSB4bQFCqOjwlwrcJxcvWerfKdy7m3Ht9sd3atSXK5eyHMhWP0Yzzuf/sgNZuga2RBuxGG4aOyc3ob3g0tW+ubWtbGj6Wq5vESTJgZM5f3A8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Ye30ttZA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Ye30ttZA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD50FC4CEF3; Mon, 26 May 2025 11:48:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748260103; bh=Z5e7LYUJWrN8Oqgcyb4aHiiFK/LIDVnO1Tn4lc/8a7Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ye30ttZAMlNo34zgpSRrajqfBM4RbPOWOy6A87yyedXcwhwZ7mpVd59AFImhQJhTo UBmLp43z0ow17lrUxBqfGK4Cf6/rm13cDeWu9wWfUncSU6ZzmP77EaI24KIM1Rzhx4 1f/io6bV48+6kFYvZsueZPywJLRLP+gva1yW+oQS0TuvcXxL5sXU2qSxJDrRnp94v5 eCQZCWGuV/txZb8XSueafxQx5FK9yRaEofsu8tbwX8p87I80dvcFCBOwZV2PfNlX/5 4PugJNjgKi2RueB0IA8QjcVcAcK5oXnqY5hOL1ftnXetSrw0a3YupEDAJgCth2FBzQ xepCCq71VjhQA== Received: from johan by xi.lan with local (Exim 4.97.1) (envelope-from ) id 1uJWJd-000000000Yu-1hee; Mon, 26 May 2025 13:48:25 +0200 From: Johan Hovold To: Jeff Johnson Cc: Miaoqing Pan , linux-wireless@vger.kernel.org, ath11k@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH 2/3] wifi: ath11k: use plain access for descriptor length Date: Mon, 26 May 2025 13:48:02 +0200 Message-ID: <20250526114803.2122-3-johan+linaro@kernel.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250526114803.2122-1-johan+linaro@kernel.org> References: <20250526114803.2122-1-johan+linaro@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The read memory barrier added by commit 6d037a372f81 ("wifi: ath11k: fix ring-buffer corruption") is enough to guarantee ordering also for plain descriptor accesses if the length helper is ever inlined so drop the unnecessary READ_ONCE(). Signed-off-by: Johan Hovold --- drivers/net/wireless/ath/ath11k/hal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/a= th/ath11k/hal.c index 8cb1505a5a0c..1ea7c494f387 100644 --- a/drivers/net/wireless/ath/ath11k/hal.c +++ b/drivers/net/wireless/ath/ath11k/hal.c @@ -599,7 +599,7 @@ u32 ath11k_hal_ce_dst_status_get_length(void *buf) struct hal_ce_srng_dst_status_desc *desc =3D buf; u32 len; =20 - len =3D FIELD_GET(HAL_CE_DST_STATUS_DESC_FLAGS_LEN, READ_ONCE(desc->flags= )); + len =3D FIELD_GET(HAL_CE_DST_STATUS_DESC_FLAGS_LEN, desc->flags); desc->flags &=3D ~HAL_CE_DST_STATUS_DESC_FLAGS_LEN; =20 return len; --=20 2.49.0 From nobody Tue Feb 10 18:36:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 729B31F7580; Mon, 26 May 2025 11:48:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260104; cv=none; b=J2MUx9iExj774LZjP1PLfI3uuBLnS4SSQKaVufJb7DETqjN5yRBdYs0LYijPbJeMgIjhHT4e9pxe3ofRKgo9oXT1Asy2gubUs8zCiTLazQN7OBMcQJn/FO0uaKKbhBR4h2oj9/4lxBHI9gcf1eHJzcinnqWsTA/it7ttO2xVweY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748260104; c=relaxed/simple; bh=GjZfpYND9lP/NheppZ2lHvUCIf1VyizdpRiD68UpiOI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e228Wl/wyY+CLpRcAY50TYbo9sDKpeNADyE8FAoPUo71OscX1Cl1GfF8ZYRVEOAmxeYIjjKgE4k3TFbIqVh02uGDa9Chduofz/imHQbPpjH5zhyNqoSNWzJPPxdhPDgVTjlyS7ppCzT0GkSxAP9A7f5/HWYd6pbWspRN2zgFjCw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XR4tx5/2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XR4tx5/2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16835C4CEFE; Mon, 26 May 2025 11:48:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748260104; bh=GjZfpYND9lP/NheppZ2lHvUCIf1VyizdpRiD68UpiOI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XR4tx5/2x0yVOR3cjvylsRGD7k6Q8GxVxFExDUx+6osaICv6NL6PoaEEw9QeCmUqi 31dOHd1Q2vN0P8Wz1NaGGeu3JxBpAqaEyeHMVu+ueQ/dJK+Qm1CkKDWpyC+ZL8gxQX HauUfCoxha2Q4FRxfrhwoS3gLN/I6ID65pibWoJK35I7hc8WKrrCkrM6FhF7/IzcTO tqHm7+11nM1hVb+M9Nf6Blj+Ce2OrTm2CepLIaoOi93hWKgjekKCLnC2ZtuYRpg2/u VE1ALIbicFD6M2IOK3hYeV496k+it1TbgK4Zw1sOFOqLKEi1mhMNJeuzWUydCsSkHZ t0TjOOsIp5NHQ== Received: from johan by xi.lan with local (Exim 4.97.1) (envelope-from ) id 1uJWJd-000000000Yx-252S; Mon, 26 May 2025 13:48:25 +0200 From: Johan Hovold To: Jeff Johnson Cc: Miaoqing Pan , linux-wireless@vger.kernel.org, ath11k@lists.infradead.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH 3/3] wifi: ath11k: use plain accesses for monitor descriptor Date: Mon, 26 May 2025 13:48:03 +0200 Message-ID: <20250526114803.2122-4-johan+linaro@kernel.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250526114803.2122-1-johan+linaro@kernel.org> References: <20250526114803.2122-1-johan+linaro@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The read memory barrier added by commit ab52e3e44fe9 ("wifi: ath11k: fix rx completion meta data corruption") is enough to guarantee ordering also for plain descriptor accesses so drop the unnecessary READ_ONCE(). Signed-off-by: Johan Hovold --- drivers/net/wireless/ath/ath11k/dp_rx.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless= /ath/ath11k/dp_rx.c index dfe2d889c20f..37deb78044c8 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2637,7 +2637,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int = ring_id, struct ath11k *ar; struct hal_reo_dest_ring *desc; enum hal_reo_dest_ring_push_reason push_reason; - u32 cookie, info0, rx_msdu_info0, rx_mpdu_info0; + u32 cookie; int i; =20 for (i =3D 0; i < MAX_RADIOS; i++) @@ -2657,7 +2657,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int = ring_id, (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab, srng))) { cookie =3D FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE, - READ_ONCE(desc->buf_addr_info.info1)); + desc->buf_addr_info.info1); buf_id =3D FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID, cookie); mac_id =3D FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie); @@ -2686,9 +2686,8 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int = ring_id, =20 num_buffs_reaped[mac_id]++; =20 - info0 =3D READ_ONCE(desc->info0); push_reason =3D FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON, - info0); + desc->info0); if (unlikely(push_reason !=3D HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION)) { dev_kfree_skb_any(msdu); @@ -2696,21 +2695,18 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, in= t ring_id, continue; } =20 - rx_msdu_info0 =3D READ_ONCE(desc->rx_msdu_info.info0); - rx_mpdu_info0 =3D READ_ONCE(desc->rx_mpdu_info.info0); - - rxcb->is_first_msdu =3D !!(rx_msdu_info0 & + rxcb->is_first_msdu =3D !!(desc->rx_msdu_info.info0 & RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU); - rxcb->is_last_msdu =3D !!(rx_msdu_info0 & + rxcb->is_last_msdu =3D !!(desc->rx_msdu_info.info0 & RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU); - rxcb->is_continuation =3D !!(rx_msdu_info0 & + rxcb->is_continuation =3D !!(desc->rx_msdu_info.info0 & RX_MSDU_DESC_INFO0_MSDU_CONTINUATION); rxcb->peer_id =3D FIELD_GET(RX_MPDU_DESC_META_DATA_PEER_ID, - READ_ONCE(desc->rx_mpdu_info.meta_data)); + desc->rx_mpdu_info.meta_data); rxcb->seq_no =3D FIELD_GET(RX_MPDU_DESC_INFO0_SEQ_NUM, - rx_mpdu_info0); + desc->rx_mpdu_info.info0); rxcb->tid =3D FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM, - info0); + desc->info0); =20 rxcb->mac_id =3D mac_id; __skb_queue_tail(&msdu_list[mac_id], msdu); --=20 2.49.0