Re: [PATCH ath-next 2/2] wifi: ath11k: fix HTC rx insufficient length

[Miaoqing Pan]

On 3/7/2025 4:51 PM, Johan Hovold wrote:
> Hi Miaoqing,
>
> and thanks a lot for looking into this.
>
> On Fri, Mar 07, 2025 at 12:08:48PM +0800, Miaoqing Pan wrote:
> > A relatively unusual race condition occurs between host software
> > and hardware, where the host sees the updated destination ring head
> > pointer before the hardware updates the corresponding descriptor.
> > When this situation occurs, the length of the descriptor returns 0.
>
> Can you explain how this race comes about?
>
> I worry that you may just be papering over a driver or firmware bug here
> so it would be good to understand how the host can see the updated
> pointer before the descriptor.
The entire process is handled by hardware, and host software just to 
read the status, so it should be a limitation of the hardware.

> Also do you have any suggestions for how to reproduce this more easily?
> Some users of the X13s (aarch64) hit this very frequently, while I've
> only seen it a few times. At least one user hit this consistently when
> roaming, and another mentioned seeing this while driving his car with
> the laptop on (and presumably seeing a lot of APs go by).

We reproduced with below setup on IoT device, usually takes a few hours 
to several days to reproduce it.
 - Run TCP downlink traffic (iperf)
 - Run bluetooth bredr scan (bluetoothctl/power on/scan bredr)


> > The current error handling method is to increment descriptor tail
> > pointer by 1, but 'sw_index' is not updated, causing descriptor and
> > skb to not correspond one-to-one, resulting in the following error:
> >
> > ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1488, expected 1492
> > ath11k_pci 0006:01:00.0: HTC Rx: insufficient length, got 1460, expected 1484
> >
> > To address this problem, temporarily skip processing the current
> > descriptor and handle it again next time. However, to prevent this
> > descriptor from continuously returning 0, use skb cb to set a flag.
> > If the length returns 0 again, this descriptor will be discarded.
> >
> > Tested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04546-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
>
> Please also include:
>
> Reported-by: Johan Hovold <johan+linaro@xxxxxxxxxx>
>
> > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218623
> > Signed-off-by: Miaoqing Pan <quic_miaoqing@xxxxxxxxxxx>
>
> Johan

Thanks for reporting, will update in next version.