* [PATCH] wcn36xx: add proper DMA memory barriers in rx path
@ 2021-10-23 0:15 Benjamin Li
2021-10-27 7:44 ` Kalle Valo
0 siblings, 1 reply; 2+ messages in thread
From: Benjamin Li @ 2021-10-23 0:15 UTC (permalink / raw)
To: Kalle Valo
Cc: Bryan O'Donoghue, Loic Poulain, linux-arm-msm, Benjamin Li,
David S. Miller, Jakub Kicinski, John W. Linville,
Eugene Krasnikov, wcn36xx, linux-wireless, netdev, linux-kernel
This is essentially exactly following the dma_wmb()/dma_rmb() usage
instructions in Documentation/memory-barriers.txt.
The theoretical races here are:
1. DXE (the DMA Transfer Engine in the Wi-Fi subsystem) seeing the
dxe->ctrl & WCN36xx_DXE_CTRL_VLD write before the dxe->dst_addr_l
write, thus performing DMA into the wrong address.
2. CPU reading dxe->dst_addr_l before DXE unsets dxe->ctrl &
WCN36xx_DXE_CTRL_VLD. This should generally be harmless since DXE
doesn't write dxe->dst_addr_l (no risk of freeing the wrong skb).
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Benjamin Li <benl@squareup.com>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 8e1dbfda6538..93994b2e8e03 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -613,6 +613,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
dxe = ctl->desc;
while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) {
+ /* do not read until we own DMA descriptor */
+ dma_rmb();
+
+ /* read/modify DMA descriptor */
skb = ctl->skb;
dma_addr = dxe->dst_addr_l;
ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC);
@@ -623,9 +627,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE,
DMA_FROM_DEVICE);
wcn36xx_rx_skb(wcn, skb);
- } /* else keep old skb not submitted and use it for rx DMA */
+ }
+ /* else keep old skb not submitted and reuse it for rx DMA
+ * (dropping the packet that it contained)
+ */
+ /* flush descriptor changes before re-marking as valid */
+ dma_wmb();
dxe->ctrl = ctrl;
+
ctl = ctl->next;
dxe = ctl->desc;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] wcn36xx: add proper DMA memory barriers in rx path
2021-10-23 0:15 [PATCH] wcn36xx: add proper DMA memory barriers in rx path Benjamin Li
@ 2021-10-27 7:44 ` Kalle Valo
0 siblings, 0 replies; 2+ messages in thread
From: Kalle Valo @ 2021-10-27 7:44 UTC (permalink / raw)
To: Benjamin Li
Cc: Bryan O'Donoghue, Loic Poulain, linux-arm-msm, Benjamin Li,
David S. Miller, Jakub Kicinski, John W. Linville,
Eugene Krasnikov, wcn36xx, linux-wireless, netdev, linux-kernel
Benjamin Li <benl@squareup.com> wrote:
> This is essentially exactly following the dma_wmb()/dma_rmb() usage
> instructions in Documentation/memory-barriers.txt.
>
> The theoretical races here are:
>
> 1. DXE (the DMA Transfer Engine in the Wi-Fi subsystem) seeing the
> dxe->ctrl & WCN36xx_DXE_CTRL_VLD write before the dxe->dst_addr_l
> write, thus performing DMA into the wrong address.
>
> 2. CPU reading dxe->dst_addr_l before DXE unsets dxe->ctrl &
> WCN36xx_DXE_CTRL_VLD. This should generally be harmless since DXE
> doesn't write dxe->dst_addr_l (no risk of freeing the wrong skb).
>
> Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
> Signed-off-by: Benjamin Li <benl@squareup.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
9bfe38e064af wcn36xx: add proper DMA memory barriers in rx path
--
https://patchwork.kernel.org/project/linux-wireless/patch/20211023001528.3077822-1-benl@squareup.com/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-10-27 7:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-23 0:15 [PATCH] wcn36xx: add proper DMA memory barriers in rx path Benjamin Li
2021-10-27 7:44 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).