Received-SPF: pass (google.com: domain of linux-wireless+bounces-7878-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Tue, 21 May 2024 10:50:42 +0200
Message-Id: <D1F6ZU89YWPF.X1SZ9JNQNPFC@gmail.com>
Cc: <linux-wireless@vger.kernel.org>
Subject: Re: [PATCH 3/3] wifi: ath12k: fix firmware crash during reo
 reinject
From: "Nicolas Escande" <nico.escande@gmail.com>
To: "P Praneesh" <quic_ppranees@quicinc.com>, <ath12k@lists.infradead.org>
References: <20240520070045.631029-1-quic_ppranees@quicinc.com>
 <20240520070045.631029-4-quic_ppranees@quicinc.com>
In-Reply-To: <20240520070045.631029-4-quic_ppranees@quicinc.com>

On Mon May 20, 2024 at 9:00 AM CEST, P Praneesh wrote:
> When handling fragmented packets, the ath12k driver reassembles each
> fragment into a normal packet and then reinjects it into the HW ring.
> However, a firmware crash occurs during this reinjection process.
> The issue arises because the driver populates peer metadata in
> reo_ent_ring->queue_addr_lo, while the firmware expects the physical
> address obtained from the corresponding peer=E2=80=99s queue descriptor. =
Fix it
> by filling peer's queue descriptor's physical address in queue_addr_lo.
>
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
>
> Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
> Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
> ---
>  drivers/net/wireless/ath/ath12k/dp_rx.c | 14 ++++++--------
>  1 file changed, 6 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wirele=
ss/ath/ath12k/dp_rx.c
> index 2bfcc19d15ea..2adb6c7d4a42 100644
> --- a/drivers/net/wireless/ath/ath12k/dp_rx.c
> +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
> @@ -2967,7 +2967,7 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struc=
t ath12k *ar,
>  	struct hal_srng *srng;
>  	dma_addr_t link_paddr, buf_paddr;
>  	u32 desc_bank, msdu_info, msdu_ext_info, mpdu_info;
> -	u32 cookie, hal_rx_desc_sz, dest_ring_info0;
> +	u32 cookie, hal_rx_desc_sz, dest_ring_info0, queue_addr_hi;
>  	int ret;
>  	struct ath12k_rx_desc_info *desc_info;
>  	enum hal_rx_buf_return_buf_manager idle_link_rbm =3D dp->idle_link_rbm;
> @@ -3060,13 +3060,11 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(str=
uct ath12k *ar,
>  	reo_ent_ring->rx_mpdu_info.peer_meta_data =3D
>  		reo_dest_ring->rx_mpdu_info.peer_meta_data;
> =20
> -	/* Firmware expects physical address to be filled in queue_addr_lo in
> -	 * the MLO scenario and in case of non MLO peer meta data needs to be
> -	 * filled.
> -	 * TODO: Need to handle for MLO scenario.
> -	 */
> -	reo_ent_ring->queue_addr_lo =3D reo_dest_ring->rx_mpdu_info.peer_meta_d=
ata;
> -	reo_ent_ring->info0 =3D le32_encode_bits(dst_ind,
> +	reo_ent_ring->queue_addr_lo =3D cpu_to_le32(lower_32_bits(rx_tid->paddr=
));
> +	queue_addr_hi =3D upper_32_bits(rx_tid->paddr);
Shouldn't there be a cpu_to_le32 somewhere here ? It just seems asymetrical
between the two values extracted from rx_tid->paddr
> +	reo_ent_ring->info0 =3D le32_encode_bits(queue_addr_hi,
> +					       HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI) |
> +			      le32_encode_bits(dst_ind,
>  					       HAL_REO_ENTR_RING_INFO0_DEST_IND);
> =20
>  	reo_ent_ring->info1 =3D le32_encode_bits(rx_tid->cur_sn,