提交 452133a7 编写于 作者: M Maya Erez 提交者: Kalle Valo

wil6210: prevent external wmi commands during suspend flow

In __wmi_send we check if fw is ready at the beginning of the function.
While we wait for the completion of the previous command, system suspend
can be invoked and reset the HW, causing __wmi_send to read from HW
registers while it is not ready.
Taking the wmi_mutex in the reset flow when setting the FW ready bit
to zero will prevent the above race condition.
Signed-off-by: NMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: NKalle Valo <kvalo@qca.qualcomm.com>
上级 410d13a6
...@@ -781,8 +781,10 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw) ...@@ -781,8 +781,10 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw)
wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false); wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
wil_bcast_fini(wil); wil_bcast_fini(wil);
/* prevent NAPI from being scheduled */ /* prevent NAPI from being scheduled and prevent wmi commands */
mutex_lock(&wil->wmi_mutex);
bitmap_zero(wil->status, wil_status_last); bitmap_zero(wil->status, wil_status_last);
mutex_unlock(&wil->wmi_mutex);
if (wil->scan_request) { if (wil->scan_request) {
wil_dbg_misc(wil, "Abort scan_request 0x%p\n", wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
......
...@@ -228,6 +228,10 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len) ...@@ -228,6 +228,10 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
wil_dbg_wmi(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head); wil_dbg_wmi(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
/* wait till FW finish with previous command */ /* wait till FW finish with previous command */
for (retry = 5; retry > 0; retry--) { for (retry = 5; retry > 0; retry--) {
if (!test_bit(wil_status_fwready, wil->status)) {
wil_err(wil, "WMI: cannot send command while FW not ready\n");
return -EAGAIN;
}
r->tail = wil_r(wil, RGF_MBOX + r->tail = wil_r(wil, RGF_MBOX +
offsetof(struct wil6210_mbox_ctl, tx.tail)); offsetof(struct wil6210_mbox_ctl, tx.tail));
if (next_head != r->tail) if (next_head != r->tail)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册