qcacmn: Sanity check for phy addr in cb against ring_desc

Check phy addr in cb against ring_desc for sanity
in wbm rx path

Change-Id: I40dd2949993129d1da548da45160f9eace094bff

dp/wifi3.0/dp_rx_err.c

@@ -2501,6 +2501,41 @@ static inline void dp_rx_wbm_sg_list_last_msdu_war(struct dp_soc *soc)
 	}
 }
 
+#ifdef RX_DESC_DEBUG_CHECK
+/**
+ * dp_rx_wbm_desc_nbuf_sanity_check - Add sanity check to for WBM rx_desc paddr
+ *					corruption
+ *
+ * @ring_desc: REO ring descriptor
+ * @rx_desc: Rx descriptor
+ *
+ * Return: NONE
+ */
+static
+QDF_STATUS dp_rx_wbm_desc_nbuf_sanity_check(struct dp_soc *soc,
+					    hal_ring_desc_t ring_desc,
+					    struct dp_rx_desc *rx_desc)
+{
+	struct hal_buf_info hbi;
+
+	hal_rx_wbm_rel_buf_paddr_get(soc->hal_soc, ring_desc, &hbi);
+	/* Sanity check for possible buffer paddr corruption */
+	if (dp_rx_desc_paddr_sanity_check(rx_desc, (&hbi)->paddr))
+		return QDF_STATUS_SUCCESS;
+
+	return QDF_STATUS_E_FAILURE;
+}
+
+#else
+static
+QDF_STATUS dp_rx_wbm_desc_nbuf_sanity_check(struct dp_soc *soc,
+					    hal_ring_desc_t ring_desc,
+					    struct dp_rx_desc *rx_desc)
+{
+	return QDF_STATUS_SUCCESS;
+}
+#endif
+
 static inline bool
 dp_rx_is_sg_formation_required(struct hal_wbm_err_desc_info *info)
 {
@@ -2543,6 +2578,7 @@ dp_rx_wbm_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,
 	uint8_t msdu_continuation = 0;
 	bool process_sg_buf = false;
 	uint32_t wbm_err_src;
+	QDF_STATUS status;
 
 	/* Debug -- Remove later */
 	qdf_assert(soc && hal_ring_hdl);
@@ -2612,6 +2648,22 @@ dp_rx_wbm_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,
 
 		hal_rx_wbm_err_info_get(ring_desc, &wbm_err_info, hal_soc);
 		nbuf = rx_desc->nbuf;
+
+		status = dp_rx_wbm_desc_nbuf_sanity_check(soc, ring_desc,
+							  rx_desc);
+		if (qdf_likely(QDF_IS_STATUS_ERROR(status))) {
+			DP_STATS_INC(soc, rx.err.nbuf_sanity_fail, 1);
+			dp_info_rl("Rx error Nbuf sanity check failure!");
+			rx_desc->in_err_state = 1;
+			rx_desc->unmapped = 1;
+			rx_bufs_reaped[rx_desc->pool_id]++;
+			dp_rx_add_to_free_desc_list(&head[rx_desc->pool_id],
+						    &tail[rx_desc->pool_id],
+						    rx_desc);
+
+			continue;
+		}
+
 		rx_desc_pool = &soc->rx_desc_buf[rx_desc->pool_id];
 		dp_ipa_rx_buf_smmu_mapping_lock(soc);
 		dp_rx_nbuf_unmap_pool(soc, rx_desc_pool, nbuf);

hal/wifi3.0/be/hal_be_generic_api.c

@@ -993,6 +993,20 @@ uint8_t hal_get_idle_link_bm_id_be(uint8_t chip_id)
 	return (WBM_IDLE_DESC_LIST + chip_id);
 }
 
+static inline void
+hal_rx_wbm_rel_buf_paddr_get_be(hal_ring_desc_t rx_desc,
+				struct hal_buf_info *buf_info)
+{
+	struct wbm_release_ring *wbm_rel_ring =
+		 (struct wbm_release_ring *)rx_desc;
+
+	buf_info->paddr =
+	 (HAL_RX_WBM_BUF_ADDR_31_0_GET(wbm_rel_ring) |
+	  ((uint64_t)(HAL_RX_WBM_BUF_ADDR_39_32_GET(wbm_rel_ring)) << 32));
+
+	buf_info->sw_cookie = HAL_RX_WBM_BUF_COOKIE_GET(wbm_rel_ring);
+}
+
 /**
  * hal_hw_txrx_default_ops_attach_be() - Attach the default hal ops for
  *		beryllium chipsets.
@@ -1036,6 +1050,8 @@ void hal_hw_txrx_default_ops_attach_be(struct hal_soc *hal_soc)
 	hal_soc->ops->hal_rx_err_status_get = hal_rx_err_status_get_be;
 	hal_soc->ops->hal_rx_reo_buf_type_get = hal_rx_reo_buf_type_get_be;
 	hal_soc->ops->hal_rx_wbm_err_src_get = hal_rx_wbm_err_src_get_be;
+	hal_soc->ops->hal_rx_wbm_rel_buf_paddr_get =
+					hal_rx_wbm_rel_buf_paddr_get_be;
 
 	hal_soc->ops->hal_reo_send_cmd = hal_reo_send_cmd_be;
 	hal_soc->ops->hal_reo_qdesc_setup = hal_reo_qdesc_setup_be;

hal/wifi3.0/be/hal_be_rx.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -357,6 +357,16 @@ static inline uintptr_t hal_rx_wbm_get_desc_va(void *hal_desc)
 	WBM_RELEASE_RING_LAST_MSDU_MASK) >>		\
 	WBM_RELEASE_RING_LAST_MSDU_LSB)
 
+#define HAL_RX_WBM_BUF_ADDR_39_32_GET(wbm_desc)	\
+	(HAL_RX_BUFFER_ADDR_39_32_GET(&			\
+	(((struct wbm_release_ring *) \
+	wbm_desc)->released_buff_or_desc_addr_info)))
+
+#define HAL_RX_WBM_BUF_ADDR_31_0_GET(wbm_desc)	\
+	(HAL_RX_BUFFER_ADDR_31_0_GET(&			\
+	(((struct wbm_release_ring *) \
+	wbm_desc)->released_buff_or_desc_addr_info)))
+
 #define HAL_RX_WBM_BUF_COOKIE_GET(wbm_desc) \
 	HAL_RX_BUF_COOKIE_GET(&((struct wbm_release_ring *) \
 	wbm_desc)->released_buff_or_desc_addr_info)

hal/wifi3.0/hal_internal.h

@@ -801,6 +801,10 @@ struct hal_hw_txrx_ops {
 					       void *ppdu_info,
 					       hal_soc_handle_t hal_soc_hdl,
 					       qdf_nbuf_t nbuf);
+
+	void (*hal_rx_wbm_rel_buf_paddr_get)(hal_ring_desc_t rx_desc,
+					     struct hal_buf_info *buf_info);
+
 	void (*hal_rx_wbm_err_info_get)(void *wbm_desc,
 				void *wbm_er_info);
 	void (*hal_rx_dump_mpdu_start_tlv)(void *mpdustart,

hal/wifi3.0/hal_rx.h

@@ -1243,6 +1243,27 @@ void hal_rx_reo_buf_paddr_get(hal_soc_handle_t hal_soc_hdl,
 
 }
 
+/**
+ * hal_rx_wbm_rel_buf_paddr_get: Gets the physical address and
+ * cookie from the WBM release ring element
+ *
+ * @ hal_rx_desc_cookie: Opaque cookie pointer used by HAL to get to
+ * the current descriptor
+ * @ buf_info: structure to return the buffer information
+ * Return: void
+ */
+static inline
+void hal_rx_wbm_rel_buf_paddr_get(hal_soc_handle_t hal_soc_hdl,
+				  hal_ring_desc_t rx_desc,
+				  struct hal_buf_info *buf_info)
+{
+	struct hal_soc *hal_soc = (struct hal_soc *)hal_soc_hdl;
+
+	if (hal_soc->ops->hal_rx_wbm_rel_buf_paddr_get)
+		return hal_soc->ops->hal_rx_wbm_rel_buf_paddr_get(rx_desc,
+								  buf_info);
+}
+
 /**
  * hal_rx_buf_cookie_rbm_get: Gets the physical address and
  * cookie from the REO entrance ring element

hal/wifi3.0/li/hal_li_generic_api.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -1070,6 +1070,20 @@ void hal_set_reo_ent_desc_reo_dest_ind_li(uint8_t *desc, uint32_t dst_ind)
 		       REO_DESTINATION_INDICATION, dst_ind);
 }
 
+static inline void
+hal_rx_wbm_rel_buf_paddr_get_li(hal_ring_desc_t rx_desc,
+				struct hal_buf_info *buf_info)
+{
+	struct wbm_release_ring *wbm_rel_ring =
+		 (struct wbm_release_ring *)rx_desc;
+
+	buf_info->paddr =
+	 (HAL_RX_WBM_BUF_ADDR_31_0_GET(wbm_rel_ring) |
+	  ((uint64_t)(HAL_RX_WBM_BUF_ADDR_39_32_GET(wbm_rel_ring)) << 32));
+
+	buf_info->sw_cookie = HAL_RX_WBM_BUF_COOKIE_GET(wbm_rel_ring);
+}
+
 static QDF_STATUS hal_reo_status_update_li(hal_soc_handle_t hal_soc_hdl,
 					   hal_ring_desc_t reo_desc,
 					   void *st_handle,
@@ -1199,6 +1213,8 @@ void hal_hw_txrx_default_ops_attach_li(struct hal_soc *hal_soc)
 	hal_soc->ops->hal_rx_reo_buf_type_get = hal_rx_reo_buf_type_get_li;
 	hal_soc->ops->hal_rx_pkt_hdr_get = hal_rx_pkt_hdr_get_li;
 	hal_soc->ops->hal_rx_wbm_err_src_get = hal_rx_wbm_err_src_get_li;
+	hal_soc->ops->hal_rx_wbm_rel_buf_paddr_get =
+					hal_rx_wbm_rel_buf_paddr_get_li;
 	hal_soc->ops->hal_rx_priv_info_set_in_tlv =
 					hal_rx_priv_info_set_in_tlv_li;
 	hal_soc->ops->hal_rx_priv_info_get_from_tlv =

hal/wifi3.0/li/hal_li_rx.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2016-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -800,6 +800,16 @@ void hal_rx_msdu_link_desc_reinject(struct hal_soc *soc,
 	HAL_RX_BUF_COOKIE_GET(&((struct wbm_release_ring *) \
 	wbm_desc)->released_buff_or_desc_addr_info)
 
+#define HAL_RX_WBM_BUF_ADDR_39_32_GET(wbm_desc)	\
+	(HAL_RX_BUFFER_ADDR_39_32_GET(&			\
+	(((struct wbm_release_ring *) \
+	wbm_desc)->released_buff_or_desc_addr_info)))
+
+#define HAL_RX_WBM_BUF_ADDR_31_0_GET(wbm_desc)	\
+	(HAL_RX_BUFFER_ADDR_31_0_GET(&			\
+	(((struct wbm_release_ring *) \
+	wbm_desc)->released_buff_or_desc_addr_info)))
+
 static inline
 uint32_t
 HAL_RX_DESC_GET_DECAP_FORMAT(void *hw_desc_addr) {