[PATCH v3 ath-next 2/2] wifi: ath11k: fix HTC rx insufficient length

Miaoqing Pan
2025-03-14T06:14:16Z

A relatively unusual race condition occurs between host software
and hardware, where the host sees the updated destination ring head
pointer before the hardware updates the corresponding descriptor.
When this situation occurs, the length of the descriptor returns 0.

The current error handling method is to increment descriptor tail
pointer by 1, but 'sw_index' is not updated, causing descriptor and
skb to not correspond one-to-one, resulting in the following error:

ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1488, expected 1492
ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1484

To address this problem and work around the broken hardware,
temporarily skip processing the current descriptor and handle it
again next time. However, to prevent this descriptor from
continuously returning 0, use the skb control block (cb) to set
a flag. If the length returns 0 again, this descriptor will be
discarded.

Tested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04546-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218623
Signed-off-by: Miaoqing Pan <quic_miaoqing@quicinc.com>
---
drivers/net/wireless/ath/ath11k/ce.c | 38 ++++++++++++++++++++------
drivers/net/wireless/ath/ath11k/core.h | 1 +
2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/ce.c b/drivers/net/wireless/ath/ath11k/ce.c
index e66e86bdec20..ccaf9b7a6857 100644
--- a/drivers/net/wireless/ath/ath11k/ce.c
+++ b/drivers/net/wireless/ath/ath11k/ce.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2023, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
*/

#include "dp_rx.h"
@@ -387,18 +387,36 @@ static int ath11k_ce_completed_recv_next(struct ath11k_ce_pipe *pipe,

ath11k_hal_srng_access_begin(ab, srng);

- desc = ath11k_hal_srng_dst_get_next_entry(ab, srng);
+ desc = ath11k_hal_srng_dst_peek(ab, srng);
if (!desc) {
ret = -EIO;
goto err;
}

*nbytes = ath11k_hal_ce_dst_status_get_length(desc);
- if (*nbytes == 0) {
- ret = -EIO;
- goto err;
+ if (unlikely(*nbytes == 0)) {
+ struct ath11k_skb_rxcb *rxcb =
+ ATH11K_SKB_RXCB(pipe->dest_ring->skb[sw_index]);
+
+ /* A relatively unusual race condition occurs between host
+ * software and hardware, where the host sees the updated
+ * destination ring head pointer before the hardware updates
+ * the corresponding descriptor.
+ *
+ * Temporarily skip processing the current descriptor and handle
+ * it again next time. However, to prevent this descriptor from
+ * continuously returning 0, set 'is_desc_len0' flag. If the
+ * length returns 0 again, this descriptor will be discarded.
+ */
+ if (!rxcb->is_desc_len0) {
+ rxcb->is_desc_len0 = true;
+ ret = -EIO;
+ goto err;
+ }
}

+ ath11k_hal_srng_dst_next(ab, srng);
+
*skb = pipe->dest_ring->skb[sw_index];
pipe->dest_ring->skb[sw_index] = NULL;

@@ -430,9 +448,13 @@ static void ath11k_ce_recv_process_cb(struct ath11k_ce_pipe *pipe)
dma_unmap_single(ab->dev, ATH11K_SKB_RXCB(skb)->paddr,
max_nbytes, DMA_FROM_DEVICE);

- if (unlikely(max_nbytes < nbytes)) {
- ath11k_warn(ab, "rxed more than expected (nbytes %d, max %d)",
- nbytes, max_nbytes);
+ if (unlikely(max_nbytes < nbytes || !nbytes)) {
+ if (nbytes)
+ ath11k_warn(ab, "rxed more than expected (nbytes %d, max %d)\n",
+ nbytes, max_nbytes);
+ else
+ ath11k_dbg(ab, ATH11K_DBG_CE, "rxed zero-length\n");
+
dev_kfree_skb_any(skb);
continue;
}
diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
index 1a3d0de4afde..c8614c5c6493 100644
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -128,6 +128,7 @@ struct ath11k_skb_rxcb {
bool is_continuation;
bool is_mcbc;
bool is_eapol;
+ bool is_desc_len0;
struct hal_rx_desc *rx_desc;
u8 err_rel_src;
u8 err_code;
--
2.25.1