Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51966cf9 authored by Yeshwanth Sriram Guntuka's avatar Yeshwanth Sriram Guntuka Committed by snandini
Browse files

qcacmn: Set invalid bit in cookie for exception ring descriptor 

On returning the msdu link descriptor to HW via WBM
release ring, the rx exception ring contents are not
zeroed. This could result in host reading stale ring
descriptor content in the scenario when HP is updated
even before the latest values are reflected in the ring
descriptor.

Fix is to set invalid bit in cookie for exception ring
descriptor and add cookie sanity check.

Change-Id: I01a294c92b260ebe8e584ef20e9550b1febec913
CRs-Fixed: 2730759
parent 5b2d83d5

dp/wifi3.0/dp_rx_err.c

+58 −8
Original line number Diff line number Diff line
@@ -1343,6 +1343,46 @@ void dp_rx_process_mic_error(struct dp_soc *soc, qdf_nbuf_t nbuf, 
	return;

}



#ifdef DP_RX_DESC_COOKIE_INVALIDATE

/**

 * dp_rx_link_cookie_check() - Validate link desc cookie

 * @ring_desc: ring descriptor

 *

 * Return: qdf status

 */

static inline QDF_STATUS

dp_rx_link_cookie_check(hal_ring_desc_t ring_desc)

{

	if (qdf_unlikely(HAL_RX_REO_BUF_LINK_COOKIE_INVALID_GET(ring_desc)))

		return QDF_STATUS_E_FAILURE;



	return QDF_STATUS_SUCCESS;

}



/**

 * dp_rx_link_cookie_invalidate() - Invalidate link desc cookie

 * @ring_desc: ring descriptor

 *

 * Return: None

 */

static inline void

dp_rx_link_cookie_invalidate(hal_ring_desc_t ring_desc)

{

	HAL_RX_REO_BUF_LINK_COOKIE_INVALID_SET(ring_desc);

}

#else

static inline QDF_STATUS

dp_rx_link_cookie_check(hal_ring_desc_t ring_desc)

{

	return QDF_STATUS_SUCCESS;

}



static inline void

dp_rx_link_cookie_invalidate(hal_ring_desc_t ring_desc)

{

}

#endif



uint32_t

dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,

		  hal_ring_handle_t hal_ring_hdl, uint32_t quota)
@@ -1365,6 +1405,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
	struct hal_rx_msdu_list msdu_list; /* MSDU's per MPDU */

	uint16_t num_msdus;

	struct dp_rx_desc *rx_desc = NULL;

	QDF_STATUS status;



	/* Debug -- Remove later */

	qdf_assert(soc && hal_ring_hdl);
@@ -1388,7 +1429,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
	}



	while (qdf_likely(quota-- && (ring_desc =

				hal_srng_dst_get_next(hal_soc,

				hal_srng_dst_peek(hal_soc,

						  hal_ring_hdl)))) {



		DP_STATS_INC(soc, rx.err_ring_pkts, 1);
@@ -1410,6 +1451,12 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
		qdf_assert_always((cookie >> LINK_DESC_ID_SHIFT) &

							LINK_DESC_ID_START);



		status = dp_rx_link_cookie_check(ring_desc);

		if (qdf_unlikely(QDF_IS_STATUS_ERROR(status))) {

			DP_STATS_INC(soc, rx.err.invalid_link_cookie, 1);

			break;

		}



		/*

		 * Check if the buffer is to be processed on this processor

		 */
@@ -1437,7 +1484,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
			/* Return link descriptor through WBM ring (SW2WBM)*/

			dp_rx_link_desc_return(soc, ring_desc,

					HAL_BM_ACTION_RELEASE_MSDU_LIST);

			continue;

			goto next_entry;

		}



		rx_desc = dp_rx_cookie_2_va_rxdma_buf(soc,
@@ -1460,7 +1507,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
							 &mpdu_desc_info,

							 &mac_id, quota);

				rx_bufs_reaped[mac_id] += count;

				continue;

				goto next_entry;

			}



			count = dp_rx_frag_handle(soc,
@@ -1469,7 +1516,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 


			rx_bufs_reaped[mac_id] += count;

			DP_STATS_INC(soc, rx.rx_frags, 1);

			continue;

			goto next_entry;

		}



		if (hal_rx_reo_is_pn_error(ring_desc)) {
@@ -1488,7 +1535,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
						      quota);



			rx_bufs_reaped[mac_id] += count;

			continue;

			goto next_entry;

		}



		if (hal_rx_reo_is_2k_jump(ring_desc)) {
@@ -1510,7 +1557,7 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
					HAL_REO_ERR_REGULAR_FRAME_2K_JUMP);



			rx_bufs_reaped[mac_id] += count;

			continue;

			goto next_entry;

		}



		if (hal_rx_reo_is_oor_error(ring_desc)) {
@@ -1531,8 +1578,11 @@ dp_rx_err_process(struct dp_intr *int_ctx, struct dp_soc *soc, 
					HAL_REO_ERR_REGULAR_FRAME_OOR);



			rx_bufs_reaped[mac_id] += count;

			continue;

			goto next_entry;

		}

next_entry:

		dp_rx_link_cookie_invalidate(ring_desc);

		hal_srng_dst_get_next(hal_soc, hal_ring_hdl);

	}



done:

dp/wifi3.0/dp_stats.c

+5 −0
Original line number Diff line number Diff line
@@ -5553,6 +5553,8 @@ void dp_txrx_path_stats(struct dp_soc *soc) 
			       soc->stats.rx.err.rejected);

		DP_PRINT_STATS("Rx raw frame dropped: %d",

			       soc->stats.rx.err.raw_frm_drop);

		DP_PRINT_STATS("Rx stale link desc cookie: %d",

			       pdev->soc->stats.rx.err.invalid_link_cookie);



		DP_PRINT_STATS("Reo Statistics");

		DP_PRINT_STATS("near_full: %u ", soc->stats.rx.near_full);
@@ -6084,6 +6086,9 @@ dp_print_soc_rx_stats(struct dp_soc *soc) 
	DP_PRINT_STATS("Rx err msdu rejected: %d",

		       soc->stats.rx.err.rejected);



	DP_PRINT_STATS("Rx stale link desc cookie: %d",

		       soc->stats.rx.err.invalid_link_cookie);



	for (i = 0; i < HAL_RXDMA_ERR_MAX; i++) {

		index += qdf_snprint(&rxdma_error[index],

				DP_RXDMA_ERR_LENGTH - index,

dp/wifi3.0/dp_types.h

+2 −0
Original line number Diff line number Diff line
@@ -810,6 +810,8 @@ struct dp_soc_stats { 
			uint32_t msdu_count_mismatch;

			/* RX raw frame dropped count */

			uint32_t raw_frm_drop;

			/* Stale link desc cookie count*/

			uint32_t invalid_link_cookie;

		} err;



		/* packet count per core - per ring */

hal/wifi3.0/hal_rx.h

+22 −0
Original line number Diff line number Diff line
@@ -299,6 +299,28 @@ enum hal_rx_ret_buf_manager { 
		BUFFER_ADDR_INFO_1_RETURN_BUFFER_MANAGER_MASK,	\

		BUFFER_ADDR_INFO_1_RETURN_BUFFER_MANAGER_LSB))



#define HAL_RX_LINK_COOKIE_INVALID_MASK 0x40000000



#define HAL_RX_BUF_LINK_COOKIE_INVALID_GET(buff_addr_info) \

		((*(((unsigned int *)buff_addr_info) + \

		(BUFFER_ADDR_INFO_1_SW_BUFFER_COOKIE_OFFSET >> 2))) & \

		HAL_RX_LINK_COOKIE_INVALID_MASK)



#define HAL_RX_BUF_LINK_COOKIE_INVALID_SET(buff_addr_info) \

		((*(((unsigned int *)buff_addr_info) + \

		(BUFFER_ADDR_INFO_1_SW_BUFFER_COOKIE_OFFSET >> 2))) |= \

		HAL_RX_LINK_COOKIE_INVALID_MASK)



#define HAL_RX_REO_BUF_LINK_COOKIE_INVALID_GET(reo_desc)	\

		(HAL_RX_BUF_LINK_COOKIE_INVALID_GET(&		\

		(((struct reo_destination_ring *)	\

			reo_desc)->buf_or_link_desc_addr_info)))



#define HAL_RX_REO_BUF_LINK_COOKIE_INVALID_SET(reo_desc)	\

		(HAL_RX_BUF_LINK_COOKIE_INVALID_SET(&		\

		(((struct reo_destination_ring *)	\

			reo_desc)->buf_or_link_desc_addr_info)))



/* TODO: Convert the following structure fields accesseses to offsets */



#define HAL_RX_REO_BUFFER_ADDR_39_32_GET(reo_desc)	\