Re: [PATCH v2 4/4] wifi: ath12k: fix dest ring-buffer corruption when ring is full

[Johan Hovold <johan@kernel.org>]

On Fri, Jun 06, 2025 at 11:19:16AM +0200, Johan Hovold wrote:
> On Fri, Jun 06, 2025 at 03:27:04PM +0800, Miaoqing Pan wrote:
> > On 6/4/2025 10:45 PM, Johan Hovold wrote:
> > > Add the missing memory barriers to make sure that destination ring
> > > descriptors are read before updating the tail pointer (and passing
> > > ownership to the device) to avoid memory corruption on weakly ordered
> > > architectures like aarch64 when the ring is full.
> 
> > > @@ -2184,6 +2187,10 @@ void ath12k_hal_srng_access_end(struct ath12k_base *ab, struct hal_srng *srng)
> > >   					   srng->u.src_ring.hp);
> > >   		} else {
> > >   			srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr;
> > > +			/* Make sure descriptor is read before updating the
> > > +			 * tail pointer.
> > > +			 */
> > > +			mb();
> > 
> > Is rmb() sufficient, since MMIO write already includes wmb()?
> 
> No, rmb() only orders reads against later reads.
> 
> [ The wmb() itself orders reads against later writes on aarch64, but
> that's not generally guaranteed and hence should not be relied on in
> driver code. ]

Sorry, I meant to say: an rmb() would order reads against later writes
on aarch64 (but that's not generally guaranteed and hence should not be
relied on in driver code).

Johan