samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix REO entry potential overwrite issue

Browse Source 
Host SW should not update the cached TP pointer to HW register before
current cached TP REO entry finishes processing, otherwise there is
risk if HW HP catches up to this cached TP, but HW TP value has been
updated to (cached TP + one entry size) now, this TP REO entry might
be overwritten.

Refine it and only update TP pointer to HW when entry processing has done.

Change-Id: I54df3247745717855a67649f440c606c518efd61
CRs-Fixed: 2391658
This commit is contained in:
Jinwei Chen
2019-02-12 12:36:10 +08:00
committed by nshrivas
parent 0c6d9b91f7
commit 1cb78177e6
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
dp/wifi3.0/dp_rx.c
View File

@@ -1396,6 +1396,7 @@ uint32_t dp_rx_process(struct dp_intr *int_ctx, void *hal_ring,
qdf_nbuf_t deliver_list_head = NULL;
qdf_nbuf_t deliver_list_tail = NULL;
int32_t tid = 0;
uint32_t dst_num_valid = 0;
DP_HIST_INIT();
/* Debug -- Remove later */
@@ -1443,16 +1444,17 @@ uint32_t dp_rx_process(struct dp_intr *int_ctx, void *hal_ring,
* complete mpdu in one reap.
*/
if (qdf_unlikely(!ring_desc)) {
hal_srng_access_start_unlocked(hal_soc, hal_ring);
ring_desc = hal_srng_dst_get_next(hal_soc, hal_ring);
if (!ring_desc)
break;
dst_num_valid = hal_srng_dst_num_valid(hal_soc,
hal_ring,
true);
if (dst_num_valid) {
DP_STATS_INC(soc, rx.hp_oos, 1);
/*
* update TP here in case loop takes long,
* then the ring is easily full.
*/
hal_srng_access_end_unlocked(hal_soc, hal_ring);
hal_srng_access_end_unlocked(hal_soc,
hal_ring);
continue;
} else {
break;
}
}
error = HAL_RX_ERROR_STATUS_GET(ring_desc);

2
hal/wifi3.0/hal_api.h
View File

@@ -651,7 +651,7 @@ static inline uint32_t hal_srng_dst_num_valid(void *hal_soc, void *hal_ring,
uint32_t tp = srng->u.dst_ring.tp;
if (sync_hw_ptr) {
hp = *(srng->u.dst_ring.hp_addr);
hp = *(volatile uint32_t *)(srng->u.dst_ring.hp_addr);
srng->u.dst_ring.cached_hp = hp;
} else {
hp = srng->u.dst_ring.cached_hp;