qcacmn: Add poisoning support for DBR buffers

Improper/incomplete DMA by the target affects the functionality of modules
that are using DBR framework. Add debug infrastructure to poison DBR
buffers with a given poison value before handing buffers over to
the target. Buffer owner modules can explicitly check for the poison
value in order to detect the improper DMA.
All modules that use DBR framework can use this debug infrastructure.

Change-Id: Ib3923c13202990e0f1198645b680c44a20736167
CRs-Fixed: 2466518

target_if/direct_buf_rx/src/target_if_direct_buf_rx_api.c

@@ -172,6 +172,10 @@ target_if_direct_buf_rx_debug_register_tx_ops(
 				target_if_dbr_start_ring_debug;
 	tx_ops->dbr_tx_ops.direct_buf_rx_stop_ring_debug =
 				target_if_dbr_stop_ring_debug;
+	tx_ops->dbr_tx_ops.direct_buf_rx_start_buffer_poisoning =
+				target_if_dbr_start_buffer_poisoning;
+	tx_ops->dbr_tx_ops.direct_buf_rx_stop_buffer_poisoning =
+				target_if_dbr_stop_buffer_poisoning;
 }
 #else
 static inline void

target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.c

@@ -472,6 +472,104 @@ QDF_STATUS target_if_dbr_start_ring_debug(struct wlan_objmgr_pdev *pdev,
 	}
 	return QDF_STATUS_SUCCESS;
 }
+
+QDF_STATUS target_if_dbr_start_buffer_poisoning(struct wlan_objmgr_pdev *pdev,
+						uint8_t mod_id, uint32_t value)
+{
+	struct direct_buf_rx_module_debug *mod_debug;
+
+	mod_debug = target_if_get_dbr_mod_debug(pdev, mod_id);
+
+	if (!mod_debug)
+		return QDF_STATUS_E_INVAL;
+
+	mod_debug->poisoning_enabled = true;
+	mod_debug->poison_value = value; /* Save the poison value */
+
+	direct_buf_rx_debug("DBR buffer poisoning for module %d is now started",
+			    mod_id);
+	return QDF_STATUS_SUCCESS;
+}
+
+QDF_STATUS target_if_dbr_stop_buffer_poisoning(
+	struct wlan_objmgr_pdev *pdev,
+	uint8_t mod_id)
+{
+	struct direct_buf_rx_module_debug *mod_debug;
+
+	mod_debug = target_if_get_dbr_mod_debug(pdev, mod_id);
+
+	if (!mod_debug)
+		return QDF_STATUS_E_INVAL;
+
+	mod_debug->poisoning_enabled = false;
+	mod_debug->poison_value = 0;
+
+	direct_buf_rx_debug("DBR buffer poisoning for module %d is now stopped",
+			    mod_id);
+	return QDF_STATUS_SUCCESS;
+}
+
+/**
+ * target_if_dbr_fill_buffer_u32() - Fill buffer with an unsigned 32-bit value
+ * @buffer: pointer to the buffer
+ * @num_bytes: Size of the destination buffer in bytes
+ * @value: Unsigned 32-bit value to be copied
+ *
+ * Return : void
+ */
+static void
+target_if_dbr_fill_buffer_u32(uint8_t *buffer, uint32_t num_bytes,
+			      uint32_t value)
+{
+	uint32_t *bufp;
+	uint32_t idx;
+	uint32_t size = (num_bytes >> 2);
+
+	if (!buffer) {
+		direct_buf_rx_err("buffer empty");
+		return;
+	}
+
+	bufp = (uint32_t *)buffer;
+
+	for (idx = 0; idx < size; ++idx) {
+		*bufp = value;
+		++bufp;
+	}
+}
+
+/**
+ * target_if_dbr_debug_poison_buffer() - Poison a given DBR buffer
+ * @pdev: pointer to pdev object
+ * @mod_id: Module ID of the owner of the buffer
+ * @aligned_vaddr: Virtual address(aligned) of the buffer
+ * @size: Size of the buffer
+ *
+ * Value with which the buffers will be poisoned would have been saved
+ * while starting the buffer poisoning for the module, use that value.
+ *
+ * Return : QDF status of operation
+ */
+static QDF_STATUS target_if_dbr_debug_poison_buffer(
+	struct wlan_objmgr_pdev *pdev,
+	uint32_t mod_id, void *aligned_vaddr, uint32_t size)
+{
+	struct direct_buf_rx_module_debug *mod_debug;
+
+	mod_debug = target_if_get_dbr_mod_debug(pdev, mod_id);
+
+	if (!mod_debug)
+		return QDF_STATUS_E_INVAL;
+
+	if (mod_debug->poisoning_enabled) {
+		target_if_dbr_fill_buffer_u32(aligned_vaddr, size,
+					      mod_debug->poison_value);
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+
 #else
 QDF_STATUS target_if_dbr_stop_ring_debug(struct wlan_objmgr_pdev *pdev,
 					 uint8_t mod_id)
@@ -485,6 +583,26 @@ QDF_STATUS target_if_dbr_start_ring_debug(struct wlan_objmgr_pdev *pdev,
 {
 	return QDF_STATUS_SUCCESS;
 }
+
+QDF_STATUS target_if_dbr_start_buffer_poisoning(struct wlan_objmgr_pdev *pdev,
+						uint8_t mod_id, uint32_t value)
+{
+	return QDF_STATUS_SUCCESS;
+}
+
+QDF_STATUS target_if_dbr_stop_buffer_poisoning(
+		struct wlan_objmgr_pdev *pdev,
+		uint8_t mod_id)
+{
+	return QDF_STATUS_SUCCESS;
+}
+
+static QDF_STATUS target_if_dbr_debug_poison_buffer(
+	struct wlan_objmgr_pdev *pdev,
+	uint32_t mod_id, void *aligned_vaddr, uint32_t size)
+{
+	return QDF_STATUS_SUCCESS;
+}
 #endif /* DIRECT_BUF_RX_DEBUG */
 
 static QDF_STATUS target_if_dbr_replenish_ring(struct wlan_objmgr_pdev *pdev,
@@ -527,6 +645,10 @@ static QDF_STATUS target_if_dbr_replenish_ring(struct wlan_objmgr_pdev *pdev,
 		return QDF_STATUS_SUCCESS;
 	}
 
+	target_if_dbr_debug_poison_buffer(
+			pdev, mod_param->mod_id, aligned_vaddr,
+			dbr_ring_cap->min_buf_size);
+
 	map_status = qdf_mem_map_nbytes_single(dbr_psoc_obj->osdev,
 					       aligned_vaddr,
 					       QDF_DMA_FROM_DEVICE,
@@ -1226,6 +1348,7 @@ static void target_if_dbr_add_ring_debug_entry(
 			ring_debug->ring_debug_idx = 0;
 	}
 }
+
 #else
 static void target_if_dbr_add_ring_debug_entry(
 	struct wlan_objmgr_pdev *pdev,

target_if/direct_buf_rx/src/target_if_direct_buf_rx_main.h

@@ -133,9 +133,13 @@ struct direct_buf_rx_ring_debug {
 /**
  * struct direct_buf_rx_module_debug - Debug of a module subscribed to DBR
  * @dbr_ring_debug: Array of ring debug structers corresponding to each srng
+ * @poisoning_enabled: Whether buffer poisoning is enabled for this module
+ * @poison_value: Value with which buffers should be poisoned
  */
 struct direct_buf_rx_module_debug {
 	struct direct_buf_rx_ring_debug dbr_ring_debug[DBR_SRNG_NUM];
+	bool poisoning_enabled;
+	uint32_t poison_value;
 };
 
 /**
@@ -342,4 +346,27 @@ QDF_STATUS target_if_dbr_start_ring_debug(struct wlan_objmgr_pdev *pdev,
  */
 QDF_STATUS target_if_dbr_stop_ring_debug(struct wlan_objmgr_pdev *pdev,
 					 uint8_t mod_id);
+
+/**
+ * target_if_dbr_start_buffer_poisoning() - Start DBR buffer poisoning
+ * @pdev: pointer to pdev object
+ * @mod_id: module ID indicating the module using direct buffer rx framework
+ * @value: Value with which buffers should be poisoned
+ *
+ * Only those buffers which are going to be mapped to the device after this
+ * API call are guaranteed to be poisoned. If user wants all the buffers in
+ * the ring to be poisoned from their creation time then this API should be
+ * called before module's registration to the DBR.
+ *
+ */
+QDF_STATUS target_if_dbr_start_buffer_poisoning(struct wlan_objmgr_pdev *pdev,
+						uint8_t mod_id, uint32_t value);
+
+/**
+ * target_if_dbr_stop_buffer_poisoning() - Stop DBR buffer poisoning
+ * @pdev: pointer to pdev object
+ * @mod_id: module ID indicating the module using direct buffer rx framework
+ */
+QDF_STATUS target_if_dbr_stop_buffer_poisoning(struct wlan_objmgr_pdev *pdev,
+					       uint8_t mod_id);
 #endif /* _TARGET_IF_DIRECT_BUF_RX_MAIN_H_ */

umac/global_umac_dispatcher/lmac_if/inc/wlan_lmac_if_def.h

@@ -599,6 +599,8 @@ struct wlan_lmac_if_wifi_pos_tx_ops {
  * @direct_buf_rx_get_ring_params: Get ring parameters for module_id
  * @direct_buf_rx_start_ring_debug: Start DBR ring debug
  * @direct_buf_rx_stop_ring_debug: Stop DBR ring debug
+ * @direct_buf_rx_start_buffer_poisoning: Start DBR buffer poisoning
+ * @direct_buf_rx_stop_buffer_poisoning: Stop DBR buffer poisoning
  */
 struct wlan_lmac_if_direct_buf_rx_tx_ops {
 	QDF_STATUS (*direct_buf_rx_module_register)(
@@ -624,6 +626,10 @@ struct wlan_lmac_if_direct_buf_rx_tx_ops {
 		uint32_t num_ring_debug_entries);
 	QDF_STATUS (*direct_buf_rx_stop_ring_debug)(
 		struct wlan_objmgr_pdev *pdev, uint8_t mod_id);
+	QDF_STATUS (*direct_buf_rx_start_buffer_poisoning)(
+		struct wlan_objmgr_pdev *pdev, uint8_t mod_id, uint32_t value);
+	QDF_STATUS (*direct_buf_rx_stop_buffer_poisoning)(
+		struct wlan_objmgr_pdev *pdev, uint8_t mod_id);
 };
 #endif