Merge branch 'android-msm-pixel-4.19-rvc-security' into android-msm-pixel-4.19-rvc-qpr3android-11.0.0_r0.115android-11.0.0_r0.105android-msm-redbull-4.19-android11-qpr3

Sep 2021.1

Bug: 192411697
Change-Id: I189118f0e3889120068f48c5dde4f8e337a3e2a2

6 files changed, 49 insertions, 17 deletions

diff --git a/dp/wifi3.0/dp_ipa.c b/dp/wifi3.0/dp_ipa.c
index 6a9d28259..19bde45b9 100644
--- a/dp/wifi3.0/dp_ipa.c
+++ b/dp/wifi3.0/dp_ipa.c
@@ -93,13 +93,14 @@ static void dp_ipa_reo_remap_history_add(uint32_t ix0_val, uint32_t ix2_val,
 
 static QDF_STATUS __dp_ipa_handle_buf_smmu_mapping(struct dp_soc *soc,
 						   qdf_nbuf_t nbuf,
+						   uint32_t size,
 						   bool create)
 {
 	qdf_mem_info_t mem_map_table = {0};
 
 	qdf_update_mem_map_table(soc->osdev, &mem_map_table,
 				 qdf_nbuf_get_frag_paddr(nbuf, 0),
-				 skb_end_pointer(nbuf) - nbuf->data);
+				 size);
 
 	if (create)
 		qdf_ipa_wdi_create_smmu_mapping(1, &mem_map_table);
@@ -111,6 +112,7 @@ static QDF_STATUS __dp_ipa_handle_buf_smmu_mapping(struct dp_soc *soc,
 
 QDF_STATUS dp_ipa_handle_rx_buf_smmu_mapping(struct dp_soc *soc,
 					     qdf_nbuf_t nbuf,
+					     uint32_t size,
 					     bool create)
 {
 	struct dp_pdev *pdev;
@@ -129,7 +131,7 @@ QDF_STATUS dp_ipa_handle_rx_buf_smmu_mapping(struct dp_soc *soc,
 	if (!qdf_atomic_read(&soc->ipa_pipes_enabled))
 		return QDF_STATUS_SUCCESS;
 
-	return __dp_ipa_handle_buf_smmu_mapping(soc, nbuf, create);
+	return __dp_ipa_handle_buf_smmu_mapping(soc, nbuf, size, create);
 }
 
 #ifdef RX_DESC_MULTI_PAGE_ALLOC
@@ -165,7 +167,8 @@ static QDF_STATUS dp_ipa_handle_rx_buf_pool_smmu_mapping(struct dp_soc *soc,
 			continue;
 		nbuf = rx_desc->nbuf;
 
-		__dp_ipa_handle_buf_smmu_mapping(soc, nbuf, create);
+		__dp_ipa_handle_buf_smmu_mapping(soc, nbuf,
+						 RX_BUFFER_SIZE, create);
 	}
 	qdf_spin_unlock_bh(&rx_pool->lock);
 
@@ -195,7 +198,8 @@ static QDF_STATUS dp_ipa_handle_rx_buf_pool_smmu_mapping(struct dp_soc *soc,
 
 		nbuf = rx_pool->array[i].rx_desc.nbuf;
 
-		__dp_ipa_handle_buf_smmu_mapping(soc, nbuf, create);
+		__dp_ipa_handle_buf_smmu_mapping(soc, nbuf,
+						 RX_BUFFER_SIZE, create);
 	}
 	qdf_spin_unlock_bh(&rx_pool->lock);
 
@@ -225,7 +229,10 @@ static void dp_tx_ipa_uc_detach(struct dp_soc *soc, struct dp_pdev *pdev)
 			continue;
 
 		if (qdf_mem_smmu_s1_enabled(soc->osdev))
-			__dp_ipa_handle_buf_smmu_mapping(soc, nbuf, false);
+			__dp_ipa_handle_buf_smmu_mapping(
+					soc, nbuf,
+					skb_end_pointer(nbuf) - nbuf->data,
+					false);
 
 		qdf_nbuf_unmap_single(soc->osdev, nbuf, QDF_DMA_BIDIRECTIONAL);
 		qdf_nbuf_free(nbuf);
@@ -370,7 +377,10 @@ static int dp_tx_ipa_uc_attach(struct dp_soc *soc, struct dp_pdev *pdev)
 			= (void *)nbuf;
 
 		if (qdf_mem_smmu_s1_enabled(soc->osdev))
-			__dp_ipa_handle_buf_smmu_mapping(soc, nbuf, true);
+			__dp_ipa_handle_buf_smmu_mapping(
+					soc, nbuf,
+					skb_end_pointer(nbuf) - nbuf->data,
+					true);
 	}
 
 	hal_srng_access_end_unlocked(soc->hal_soc, wbm_srng);
diff --git a/dp/wifi3.0/dp_ipa.h b/dp/wifi3.0/dp_ipa.h
index 48b071a8c..ad82f247c 100644
--- a/dp/wifi3.0/dp_ipa.h
+++ b/dp/wifi3.0/dp_ipa.h
@@ -107,6 +107,7 @@ int dp_ipa_ring_resource_setup(struct dp_soc *soc,
 		struct dp_pdev *pdev);
 QDF_STATUS dp_ipa_handle_rx_buf_smmu_mapping(struct dp_soc *soc,
 					     qdf_nbuf_t nbuf,
+					     uint32_t size,
 					     bool create);
 
 bool dp_reo_remap_config(struct dp_soc *soc, uint32_t *remap1,
@@ -134,6 +135,7 @@ static inline int dp_ipa_ring_resource_setup(struct dp_soc *soc,
 
 static inline QDF_STATUS dp_ipa_handle_rx_buf_smmu_mapping(struct dp_soc *soc,
 							   qdf_nbuf_t nbuf,
+							   uint32_t size,
 							   bool create)
 {
 	return QDF_STATUS_SUCCESS;
diff --git a/dp/wifi3.0/dp_rx.c b/dp/wifi3.0/dp_rx.c
index 5fe9cfb67..13a9cc5e0 100644
--- a/dp/wifi3.0/dp_rx.c
+++ b/dp/wifi3.0/dp_rx.c
@@ -219,7 +219,8 @@ QDF_STATUS __dp_rx_buffers_replenish(struct dp_soc *dp_soc, uint32_t mac_id,
 
 		paddr = qdf_nbuf_get_frag_paddr(rx_netbuf, 0);
 
-		dp_ipa_handle_rx_buf_smmu_mapping(dp_soc, rx_netbuf, true);
+		dp_ipa_handle_rx_buf_smmu_mapping(dp_soc, rx_netbuf,
+						  RX_BUFFER_SIZE, true);
 		/*
 		 * check if the physical address of nbuf->data is
 		 * less then 0x50000000 then free the nbuf and try
@@ -1931,8 +1932,11 @@ more_data:
 		 * move unmap after scattered msdu waiting break logic
 		 * in case double skb unmap happened.
 		 */
+		dp_ipa_handle_rx_buf_smmu_mapping(soc, rx_desc->nbuf,
+						  RX_BUFFER_SIZE, false);
 		qdf_nbuf_unmap_single(soc->osdev, rx_desc->nbuf,
 				      QDF_DMA_FROM_DEVICE);
+
 		rx_desc->unmapped = 1;
 
 		core_id = smp_processor_id();
@@ -2519,7 +2523,8 @@ dp_pdev_rx_buffers_attach(struct dp_soc *dp_soc, uint32_t mac_id,
 						     desc_list->rx_desc.cookie,
 						     rx_desc_pool->owner);
 
-			dp_ipa_handle_rx_buf_smmu_mapping(dp_soc, nbuf, true);
+			dp_ipa_handle_rx_buf_smmu_mapping(dp_soc, nbuf,
+							  RX_BUFFER_SIZE, true);
 
 			desc_list = next;
 		}
diff --git a/dp/wifi3.0/dp_rx_defrag.c b/dp/wifi3.0/dp_rx_defrag.c
index 4526ba20f..030f89aa1 100644
--- a/dp/wifi3.0/dp_rx_defrag.c
+++ b/dp/wifi3.0/dp_rx_defrag.c
@@ -1076,8 +1076,8 @@ static QDF_STATUS dp_rx_defrag_reo_reinject(struct dp_peer *peer,
 	cookie = HAL_RX_BUF_COOKIE_GET(msdu0);
 
 	/* map the nbuf before reinject it into HW */
-	ret = qdf_nbuf_map_single(soc->osdev, head,
-				  QDF_DMA_FROM_DEVICE);
+	ret = qdf_nbuf_map_nbytes_single(soc->osdev, head,
+				  QDF_DMA_FROM_DEVICE, RX_BUFFER_SIZE);
 	if (qdf_unlikely(ret == QDF_STATUS_E_FAILURE)) {
 		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
 				"%s: nbuf map failed !", __func__);
@@ -1091,7 +1091,7 @@ static QDF_STATUS dp_rx_defrag_reo_reinject(struct dp_peer *peer,
 	 */
 	rx_desc->unmapped = 0;
 
-	dp_ipa_handle_rx_buf_smmu_mapping(soc, head, true);
+	dp_ipa_handle_rx_buf_smmu_mapping(soc, head, RX_BUFFER_SIZE, true);
 
 	paddr = qdf_nbuf_get_frag_paddr(head, 0);
 
@@ -1704,6 +1704,8 @@ uint32_t dp_rx_frag_handle(struct dp_soc *soc, void *ring_desc,
 
 	msdu = rx_desc->nbuf;
 
+	dp_ipa_handle_rx_buf_smmu_mapping(soc, msdu,
+					  RX_BUFFER_SIZE, false);
 	qdf_nbuf_unmap_single(soc->osdev, msdu,	QDF_DMA_FROM_DEVICE);
 	rx_desc->unmapped = 1;
 
diff --git a/dp/wifi3.0/dp_rx_desc.c b/dp/wifi3.0/dp_rx_desc.c
index 55654b526..1db4b68fc 100644
--- a/dp/wifi3.0/dp_rx_desc.c
+++ b/dp/wifi3.0/dp_rx_desc.c
@@ -123,7 +123,7 @@ static QDF_STATUS __dp_rx_desc_nbuf_free(struct dp_soc *soc,
 			nbuf = rx_desc->nbuf;
 			if (!rx_desc->unmapped) {
 				dp_ipa_handle_rx_buf_smmu_mapping(soc, nbuf,
-								  false);
+							RX_BUFFER_SIZE, false);
 				qdf_nbuf_unmap_single(soc->osdev, nbuf,
 						      QDF_DMA_BIDIRECTIONAL);
 			}
@@ -221,7 +221,7 @@ void dp_rx_desc_nbuf_and_pool_free(struct dp_soc *soc, uint32_t pool_id,
 
 			if (!(rx_desc_pool->array[i].rx_desc.unmapped)) {
 				dp_ipa_handle_rx_buf_smmu_mapping(soc, nbuf,
-								  false);
+							RX_BUFFER_SIZE, false);
 
 				qdf_nbuf_unmap_single(soc->osdev, nbuf,
 						      QDF_DMA_FROM_DEVICE);
@@ -247,7 +247,7 @@ void dp_rx_desc_nbuf_free(struct dp_soc *soc,
 
 			if (!(rx_desc_pool->array[i].rx_desc.unmapped)) {
 				dp_ipa_handle_rx_buf_smmu_mapping(soc, nbuf,
-								  false);
+							RX_BUFFER_SIZE, false);
 
 				qdf_nbuf_unmap_single(soc->osdev, nbuf,
 						      QDF_DMA_FROM_DEVICE);
diff --git a/dp/wifi3.0/dp_rx_err.c b/dp/wifi3.0/dp_rx_err.c
index ce1484504..61697c517 100644
--- a/dp/wifi3.0/dp_rx_err.c
+++ b/dp/wifi3.0/dp_rx_err.c
@@ -28,6 +28,7 @@
 #include <cds_ieee80211_common.h>
 #endif
 #include "dp_rx_defrag.h"
+#include "dp_ipa.h"
 #ifdef FEATURE_WDS
 #include "dp_txrx_wds.h"
 #endif
@@ -288,7 +289,8 @@ static uint32_t dp_rx_msdus_drop(struct dp_soc *soc, void *ring_desc,
 					msdu_list.sw_cookie[i]);
 			return rx_bufs_used;
 		}
-
+		dp_ipa_handle_rx_buf_smmu_mapping(soc, rx_desc->nbuf,
+						  RX_BUFFER_SIZE, false);
 		qdf_nbuf_unmap_single(soc->osdev,
 				      rx_desc->nbuf, QDF_DMA_FROM_DEVICE);
 
@@ -480,6 +482,8 @@ more_msdu_link_desc:
 		pdev = soc->pdev_list[rx_desc->pool_id];
 
 		nbuf = rx_desc->nbuf;
+		dp_ipa_handle_rx_buf_smmu_mapping(soc, nbuf,
+						  RX_BUFFER_SIZE, false);
 		qdf_nbuf_unmap_single(soc->osdev,
 				      nbuf, QDF_DMA_FROM_DEVICE);
 
@@ -1630,6 +1634,8 @@ dp_rx_wbm_err_process(struct dp_intr *int_ctx, struct dp_soc *soc,
 		}
 
 		nbuf = rx_desc->nbuf;
+		dp_ipa_handle_rx_buf_smmu_mapping(soc, nbuf,
+						  RX_BUFFER_SIZE, false);
 		qdf_nbuf_unmap_single(soc->osdev, nbuf,	QDF_DMA_FROM_DEVICE);
 
 		/*
@@ -1949,8 +1955,15 @@ dp_rx_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
 						continue;
 					}
 
-					qdf_nbuf_unmap_single(soc->osdev, msdu,
-						QDF_DMA_FROM_DEVICE);
+					dp_ipa_handle_rx_buf_smmu_mapping(
+							soc, msdu,
+							RX_BUFFER_SIZE,
+							false);
+					qdf_nbuf_unmap_nbytes_single(
+						soc->osdev, msdu,
+						QDF_DMA_FROM_DEVICE,
+						RX_BUFFER_SIZE);
+					rx_desc->unmapped = 1;
 
 					QDF_TRACE(QDF_MODULE_ID_DP,
 						QDF_TRACE_LEVEL_DEBUG,