samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Debug patch for delay reg queue corrupt

Browse Source 
Add ring_id check for potential srng pointer corruption.

Change-Id:Ib14634fe31bfdae86aac6c89e5d65618ae5c753e
CRs-Fixed: 3549490
This commit is contained in:
Yu Tian
2023-07-10 00:48:04 -07:00
committed by Rahul Choudhary
parent 7709435525
commit f2211bb521
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
hal/wifi3.0/hal_internal.h
View File

@@ -497,6 +497,7 @@ typedef struct hal_ring_handle *hal_ring_handle_t;
* @work_scheduled_time: work scheduled time (qdf_log_timestamp)
* @dequeue_time: dequeue time (qdf_log_timestamp)
* @cpu_id: record cpuid when schedule work
* @ring_id: record srng id
*/
struct hal_reg_write_q_elem {
struct hal_srng *srng;
@@ -508,6 +509,7 @@ struct hal_reg_write_q_elem {
qdf_time_t work_scheduled_time;
qdf_time_t dequeue_time;
int cpu_id;
int ring_id;
};
/**
@@ -517,6 +519,7 @@ struct hal_reg_write_q_elem {
* @coalesces: writes not enqueued since srng is already queued up
* @direct: writes not enqueued and written to register directly
* @dequeue_delay: dequeue operation be delayed
* @pending: number of buffers pending in delay reg write
*/
struct hal_reg_write_srng_stats {
uint32_t enqueues;
@@ -524,6 +527,7 @@ struct hal_reg_write_srng_stats {
uint32_t coalesces;
uint32_t direct;
uint32_t dequeue_delay;
qdf_atomic_t pending;
};
/**

6
hal/wifi3.0/hal_srng.c
View File

@@ -687,6 +687,8 @@ hal_process_reg_write_q_elem(struct hal_soc *hal,
struct hal_srng *srng = q_elem->srng;
uint32_t write_val;
QDF_BUG(q_elem->ring_id == srng->ring_id);
SRNG_LOCK(&srng->lock);
srng->reg_write_in_progress = false;
@@ -709,6 +711,7 @@ hal_process_reg_write_q_elem(struct hal_soc *hal,
q_elem->valid = 0;
srng->last_dequeue_time = q_elem->dequeue_time;
qdf_atomic_set(&srng->wstats.pending, 0);
SRNG_UNLOCK(&srng->lock);
return write_val;
@@ -911,6 +914,7 @@ static void hal_reg_write_enqueue(struct hal_soc *hal_soc,
hal_verbose_debug("Already in progress srng ring id 0x%x addr 0x%pK val %u",
srng->ring_id, addr, value);
qdf_atomic_inc(&hal_soc->stats.wstats.coalesces);
qdf_atomic_inc(&srng->wstats.pending);
srng->wstats.coalesces++;
return;
}
@@ -945,7 +949,7 @@ static void hal_reg_write_enqueue(struct hal_soc *hal_soc,
*/
qdf_wmb();
q_elem->valid = true;
q_elem->ring_id = srng->ring_id;
/*
* After all other fields in the q_elem has been updated
* in memory successfully, the valid flag needs to be updated