| From e93de3c12f75743dc17bd48f6bb8fe37f87b9ecf Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 4 Mar 2021 21:25:23 +0800 |
| Subject: mt76: mt7663s: fix the possible device hang in high traffic |
| |
| From: Sean Wang <sean.wang@mediatek.com> |
| |
| [ Upstream commit 45247a85614b49b07b9dc59a4e6783b17e766ff2 ] |
| |
| Use the additional memory barrier to ensure the skb list up-to-date |
| between the skb producer and consumer to avoid the invalid skb content |
| written into sdio controller and then cause device hang due to mcu assert |
| caught by WR_TIMEOUT_INT. |
| |
| Fixes: 1522ff731f84 ("mt76: mt7663s: introduce sdio tx aggregation") |
| Signed-off-by: Sean Wang <sean.wang@mediatek.com> |
| Signed-off-by: Felix Fietkau <nbd@nbd.name> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 2 ++ |
| drivers/net/wireless/mediatek/mt76/sdio.c | 3 +++ |
| 2 files changed, 5 insertions(+) |
| |
| diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c |
| index 37fe65ced4fd..4393dd21ebbb 100644 |
| --- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c |
| +++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c |
| @@ -225,6 +225,8 @@ static int mt7663s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q) |
| struct mt76_queue_entry *e = &q->entry[q->first]; |
| struct sk_buff *iter; |
| |
| + smp_rmb(); |
| + |
| if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->phy.state)) { |
| __skb_put_zero(e->skb, 4); |
| err = __mt7663s_xmit_queue(dev, e->skb->data, |
| diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c |
| index 0b6facb17ff7..a18d2896ee1f 100644 |
| --- a/drivers/net/wireless/mediatek/mt76/sdio.c |
| +++ b/drivers/net/wireless/mediatek/mt76/sdio.c |
| @@ -256,6 +256,9 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q, |
| |
| q->entry[q->head].skb = tx_info.skb; |
| q->entry[q->head].buf_sz = len; |
| + |
| + smp_wmb(); |
| + |
| q->head = (q->head + 1) % q->ndesc; |
| q->queued++; |
| |
| -- |
| 2.30.2 |
| |