wifi: ath12k: fix firmware crash during reo reinject

When handling fragmented packets, the ath12k driver reassembles each
fragment into a normal packet and then reinjects it into the HW ring.
However, a firmware crash occurs during this reinjection process.
The issue arises because the driver populates peer metadata in
reo_ent_ring->queue_addr_lo, while the firmware expects the physical
address obtained from the corresponding peer’s queue descriptor. Fix it
by filling peer's queue descriptor's physical address in queue_addr_lo.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://msgid.link/20240520070045.631029-4-quic_ppranees@quicinc.com

diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index ffd3f003d0037a4cc3d383f0fb9de094d2dd658f..a52b7b273540f4a90c56dd3cdbbcce09678849c5 100644 (file)
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -2971,7 +2971,7 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar,
        struct hal_srng *srng;
        dma_addr_t link_paddr, buf_paddr;
        u32 desc_bank, msdu_info, msdu_ext_info, mpdu_info;
-       u32 cookie, hal_rx_desc_sz, dest_ring_info0;
+       u32 cookie, hal_rx_desc_sz, dest_ring_info0, queue_addr_hi;
        int ret;
        struct ath12k_rx_desc_info *desc_info;
        enum hal_rx_buf_return_buf_manager idle_link_rbm = dp->idle_link_rbm;
@@ -3064,13 +3064,11 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar,
        reo_ent_ring->rx_mpdu_info.peer_meta_data =
                reo_dest_ring->rx_mpdu_info.peer_meta_data;
 
-       /* Firmware expects physical address to be filled in queue_addr_lo in
-        * the MLO scenario and in case of non MLO peer meta data needs to be
-        * filled.
-        * TODO: Need to handle for MLO scenario.
-        */
-       reo_ent_ring->queue_addr_lo = reo_dest_ring->rx_mpdu_info.peer_meta_data;
-       reo_ent_ring->info0 = le32_encode_bits(dst_ind,
+       reo_ent_ring->queue_addr_lo = cpu_to_le32(lower_32_bits(rx_tid->paddr));
+       queue_addr_hi = upper_32_bits(rx_tid->paddr);
+       reo_ent_ring->info0 = le32_encode_bits(queue_addr_hi,
+                                              HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI) |
+                             le32_encode_bits(dst_ind,
                                               HAL_REO_ENTR_RING_INFO0_DEST_IND);
 
        reo_ent_ring->info1 = le32_encode_bits(rx_tid->cur_sn,