Add net buff pop fail counter which helps to debug issues
related to scenario when RX ring fill count exceeds the fill
level.
Change-Id: I00f4a4e245e0732ef04518e4c1db95999edc6687
CRs-Fixed: 2106523
HTT_RX_HOST_LATENCY_WORST_LIKELY_MS is changed from 10 to 20
for Helium support. But 20 is aggressive for Rome and traffic
hang is seen.
Fix is to define HTT_RX_HOST_LATENCY_WORST_LIKELY_MS as 10
for Rome support.
Change-Id: Iaaa86ed70d145ac9898300e9b678008781215617
CRs-Fixed: 2050912
Currently ol_rx_data_cb() calls cds_get_global_context() but then
doesn't do anything with the context other than verify it is not
NULL. Since the context itself is unused, remove the unnecessary call
to cds_get_global_context().
Change-Id: I42a0aa1adba5ba25a95cf22523153356e3976b47
CRs-Fixed: 2115512
ARP/NS/NA packets will not get chance to be transmitted if
netif queues are paused due to low tx descriptor availability.
Send ARP/NS/NA packets from HI PRIO queue so that it can be transmitted
in noisy environment.
Change-Id: Ibb414463d1471c19d5db99e12517c77b02564318
CRs-Fixed: 2081348
Clear the tx desc ref_cnt in ol_tx_desc_free_common as
ol_tx_desc_free independently get called from some places
during failure cases.
Change-Id: I705061558a0419785091e0e1d0605e317e479188
CRs-Fixed: 2071116
Make the following changes to fix the issue:
- Wrap TSO seg unmap code inside a spinlock
- Add TSO descriptor DUP detection logic before unmapping TSO segs
- De-initialize TSO seg freepool after in-use Tx descriptors have been
de-inited
Change-Id: I63b100879b302e4919c2952143509e76c14b36ec
CRs-Fixed: 2018317
Stats printing with excessive loops should not go to the console.
Avoids watch-dog bites.
Change-Id: I2ff67827d8bb975bc4ddbb4d70c88283e8ea231e
CRs-Fixed: 2088027
qcacld-2.0 to qcacld-3.0 propagation
The txrx_fw_stats cmd will allocate a req object before sending the cmd
to the firmware, this memory is only freed when get response from firmware.
The memory leak will appear if the firmware doesn't response in time before
the driver unloading.
This fix will add a pending queue to trace this req object in the pdev.
when pdev is detaching, it will clean up this queue to avoid memory leak.
Change-Id: I35f6216d35befbab978bba161252b305488bd34c
CRs-Fixed: 2116408
At IPA UC detach after free IPA TX resource TX comp
ring and TX CE index pointers reset them to NULL.
Change-Id: If6a1b2857d14f5fff2f47e541156ce2c27fb33a3
CRs-Fixed: 2111959
Recovery is triggered if rx hash table look up fails due to invalid
physical address. Since netbuf is not found in this case and null
netbuf is de-referenced after recovery is completed and this leads
to null pointer exception.
Exit gracefully if netbuf pop fails from rx hash table.
Change-Id: I66b3d1cf9aa05da235212923a551e58d86153e55
CRs-Fixed: 2094521
When system is under low memory condition and skb allocation fails,
RX ring msdu is not attached in ring replenish logic and Ring refill retry
timer refills the ring debt at the interval of 50 ms.
If refill retry fails to allocate the memory, refill debt is not updated and
this is resulting in retry logic failure.
Update refill debt when retry allocation fails to allocate
rx ring msdu.
Change-Id: I4d2230e4984e26b44db663e7e7f20c73ae90b0f0
Do memzero of htt_frag_desc inside HELIUMPLUS flag as
htt_frag_desc is defined only for HELIUMPLUS.
Change-Id: Ie738881c5330956b24376f145f03dd977bf88f7b
CRs-Fixed: 2096935
Presently, htt_frag_desc is not getting zeroed out explicitly.
So fw can take the invalid/garbage data in the frag information
and treat it as a valid address which may lead to crash.
Memzero htt_frag_desc before use.
Change-Id: I9dadcb883a65c43f96e810a12b4fb491c3a2e734
CRs-Fixed: 2088448
Add logic to mark first wakeup packet even if offload bit is not set in
the htt rx indication message sent by fw.
Change-Id: Ide50dcfcf88ecd0c71b32b0e746742dc49d08567
CRs-Fixed: 2110627
Currently, in monitor mode, beacon frames are showing an incorrect phy
rate (0). This is because the values in the RX descriptor for
interpreting the legacy rates have changed in ihelium.
Make changes in host to interpret the new values into data rates correctly.
Change-Id: Ibf845666943fd718b657c0128758dabfb64a38ef
CRs-Fixed: 2082456
As WAPI spec, once USK rekey, PN need reset to 0x5c37, but IWNCOM AP
will send 1st packet with old PN larger than 0x5c37 after rekey, So PN
check failed for later packets.
Fix: Don't update Last_PN when receive the 1st packet from AP after USK
rekey, Last_PN keeps 0x5c37.
Analysis:
1. Host installed new unicast key after rekey handshake with AP.
2. Host Last_PN was updated to 0x5c37 as spec (expect PN of next
packet from AP is: 0x5c39)
3. Host received ping request from AP with old PN 0x5cb9
4. Host PN checked passed, driver Last_PN was updated as 0x5cb9
5. Host received ping request from AP with new PN 0x5c39
6. Host PN checked failed since 0x5c39 < 0x5cb9, ping request
dropped, no response.
Change-Id: Ifd0269193ffbe53889191269a0e985d13ea2ecf7
CRs-Fixed: 2101217
* Log EAPOL, ARP, DHCP, MGMT, ROAM Events, ICMP, Data packets,
TX-Completions by default.
* Set default verbosity as low (existing is high)
* Throttle ICMP and Data packets if threshold exceeds.
* Enable live mode by default. Added ini entry to disable
it and configure high throughput thresh - gDptraceConfig
* Log only SA and DA for proto packets (and not 32 bytes)
* Format prints to fit in 1 line.
CRs-Fixed: 2051134
Change-Id: Ia94732e49023950f458a7402650d4b8f5e1d5563
The cdp_peer_ops register_ocb_peer() method currently takes a cds_ctx
parameter. Converged datapath APIs should not require the MCL-specific
CDS context, and in fact it is not required by the MCL implementation,
so remove it from all OCB peer registration APIs.
Change-Id: I873eeb472f463ac76f30de5a9013783565be916d
CRs-Fixed: 2103451
Currently ol_rx_pkt_dump_call() calls cds_get_global_context() to get
the global context. At one time this was necessary since the global
context was required to get the module-specific context. However the
global context is no longer required, so remove the unnecessary
retrieval of the global context.
Change-Id: I8a2e66252bfd445151575502b06b132866a286fe
CRs-Fixed: 2102494
Pointer head_buf returned from call to function
htt_rx_offload_paddr_msdu_pop_ll may be NULL and will be
dereferenced
Change-Id: I6e1db520d525a42d59ebfb675325e37c4097ad71
CRs-Fixed: 2085696
1) pdev pointer should be checked to make sure it's not NULLed before
it is dereferenced in the ll_pause timer function.
2) Add a flag to prevent the ll_pause timer from being started again
when txrx vdev is being detached.
3) Timer object should be freed synchronously without any locks
being held.
Change-Id: I6f0f675442b1d75f0a67a55d51c9ecec9a1cd9ae
CRs-fixed: 2092945
RX hash lock is not unlocked in case hash_table is
NULL and context is returned immediately without
unlocking the rx hash lock.
Unlock the rx hash lock before returning from the context.
Change-Id: I4ec2c272ac92cf5c0e93c64e34ce96cafe5cc11c
CRs-Fixed: 2104297
When DUT connects to specific AP, it receives the frame whose
SA is self MAC and MIC failure flag is set at the same time.
This will cause disconnection with the AP because MIC failure.
To fix this unexpected disconnection issue, do not check MIC
failure if discard flag is set by fw.
Change-Id: I9029da9d329679bf0fd61be234690c764cceb57c
CRs-Fixed: 2090575
Tx descriptors' state info, such as vdev pointer, vdev ID and
ref_cnt, are protected by a spin lock during freeing, but not
protected by the same lock during allocation. Correct the
discrepancies to avoid a NULL pointer dereference issue
Change-Id: Ie0fb634a893a8d33888f7f1f6685a4fb7219e308
CRs-Fixed: 2091379
In the case of low memory allocation failures, the system should be able to
continue functioning after the connect_service failure.
Change-Id: Icd054d541aa95dbf4099426cf73f3dfe6c2c4565
CRs-Fixed: 2097391
Currently, cds_trigger_recovery is unconditional. Instead, avoid
triggering recovery if recovery is already in progress.
Change-Id: I5c77048701930591e0e520e07275e6f8631108a0
CRs-Fixed: 2070845
In SAP mode, during data transfer, ifconfig down, then up in 1-5s,
Tx queue is enabled before SAP reconnect. can't find peer in
hdd_softap_hard_start_xmit, much following log in prink will lead
to watchdog timeout.
R0: wlan: [0:E :TRX] PEER [1] not found
R0: wlan: [0:E :TRX] ol_txrx_get_tx_resource: Invalid sta_id 1
Change-Id: I4b6635ac71f3bff95db67791e557cafd539f9ca4
CRS-Fixed: 2088402
During target attach procedure, there are a number of messages sent
to the FW. Some of these sends did not check return codes. Add
return code checks and treat the codes accordingly.
Change-Id: Ib515e040b6c7e2ecc23d2d422bb359e83342fcfa
CRs-Fixed: 2064904
Reduce log flooding in __hdd_tx_timeout. The single __hdd_tx_timeout
error log printed by TX_TIMEOUT_TRACE should be sufficient to
identify the error. The debugging effort should use the driver logs.
This will ease debugging of other subsystems in the case that
the root cause is a system instability.
Change-Id: Iee3ba3c7d8d7dcd72a3a71ea4f8e4ae8d3bc17b6
CRs-Fixed: 2092183
When hdd_get_tx_resource is called, if free Tx desc is lower than low water
mark, vdev->os_q_paused will be set as 1 and WLAN_STOP_ALL_NETIF_QUEUE will
be triggered after a while. Before WLAN_STOP_ALL_NETIF_QUEUE is triggered,
if ol_tx_flow_ct_unpause_os_q is called, WLAN_WAKE_ALL_NETIF_QUEUE will be
triggered and vdev->os_q_paused will be set as 0. In such case There will
be no flow control unpaused forever.
Tx should be paused by flow control when Tx desc is lower than low water
mark, and unpaused when Tx desc is bigger than high water mark or Tx is
already paused by flow control.
Change-Id: Ib60139fd94a4fb88c92a7f8aaf886ae9d3ca4c75
CRs-Fixed: 2089149
When replenishing Rx buffers driver updates the address of the
buffer and the index of rx buffer in rx ring to the firmware.
Make sure alloc index write is reflected in the memory before
FW polls the remote ring write index as compiler can reorder
the instructions based on optimizations.
Disable compile time reorder by adding a write memory barrier.
Change-Id: Icb37598e6c36b4a128b1bcd91bfb9d643bf083e2
CRs-Fixed: 2084210
While processing of frames received before peer is registered in process
context, tcp_v4_rcv() is called which takes a spinlock and in between the
processing before spinlock can be released, it is getting preempted by
hif_napi_poll() as it gets executed in softirq context. It tries to take
the same spinlock in tcp_v4_rcv() resulting in deadlock.
Do netif_rx_ni() for frames received before peer is registered.
Change-Id: I6228984f209bb9312ed9d8f3937d6036918ff750
CRs-Fixed: 2034244
It is reported by Static Analyze tool as buffer overflow when call
into function ol_txrx_bad_peer_txctl_update_threshold, because
WLAN_WMA_IEEE80211_MAX_LEVEL is defined as 5 but TXRX_IEEE11_MAX
defined as 4, so level 4 will pass as max index value which is buffer
overflow.
Add TXRX_IEEE11_AX so TXRX_IEEE11_MAX aligns with
WLAN_WMA_IEEE80211_MAX_LEVEL.
Change-Id: I49fe348f1071648d86e456c6df63738ec507dd6c
CRs-Fixed: 2058227
The target_delta and bus_delta combined with target_tx_credit
to fulfil the credit function of host.
A global lock is needed to ensure reenterable.
Change-Id: I71c006ccfe05b442706283490cd7bba4cc8a6f5f
CRs-Fixed: 964530
qcacld-2.0 to qcacld-3.0 propagation
Currently for SDIO implementation, tx comp indication is
suppressed and tx_desc is freed when htt download is done.
This leads to invalid tx_desc being referenced when pktlog
indication handler wants to collect TX-ed tx_desc information.
Fix consists of two parts:
1. When pktlog is enabled in ini, enable tx comp indication
handler just like PCIe and USB. tx_desc is still valid when
pktlog indication comes.
2. Check vdev pointer embedded in tx_desc structure. vdev
pointer is set when tx_desc is allocated and set to NULL when
tx_desc is freed. This guards against invalid tx_desc_id
from firmware.
Note that performance drops should be expected when
pktlog is enabled on HL platforms.
Change-Id: Iba9b8323b4a6e2ae17e36768bda3511f52236a2c
CRs-Fixed: 2034996
Run through the entire peer_id_to_obj_map array and if any peer_id's
peer entry points to a particular peer, change it to NULL. Calling
this routine before deleting the peer ensures that subsequent peer_unmap
events will not access a peer object that is deleted.
CRs-Fixed: 2027846
Change-Id: I05089bece20ea070694f243feb06d222f8e50ac6
When HTT attached, driver allocates DMA buffer to record each RX ring
entry, with element size - target_paddr_t, which is bus size, and may be
different from kernel's physical address size.
While in htt_rx_detach, size of qdf_dma_addr_t used for buffer free.
In case kernel built as 64-bit, and bus size as default 32-bit,
it will crash when free.
Use same element size to avoid it.
CRs-Fixed: 2087592
Change-Id: Iabe95f92ea82b736213a8b81453163229b2a3a3b
Wrong to pass parameter by value so caller doesn't get the real allocated
tx_desc. The fix is to let ol_tx_prepare_ll return the allocated tx_desc
or NULL if fail.
Change-Id: Ic3910e45c02290ebd74766aa8f88902044decaa6
CRs-Fixed: 2084824
Data path may be processing received packets while the peer is being
deleted. It may create an extra reference to peer. As a protection,
decrement peer->ref_cnt by the exact number of peer_id_ref_cnt
instead of resetting it to hardcoded value of 1. Peer object will be
freed only after the last reference count is decremented.
CRs-Fixed: 2023550
Change-Id: I457a0fdd9d0bea86d22139090afbd33bdc34f2ed
We have race condition between lro flush of hif_napi_poll and MC thread
lro flush while flushing the ol_txrx_cached_bufq packets for peer. Avoid
the situation by simply marking the all the Rx packets as LRO ineligible
while enqueuing packets to ol_rx_cached_buf.
Change-Id: Ief0d7dd6c25cf45912820f0e237fd1179a57a5c7
CRs-Fixed: 2032674
warning: implicit conversion from enumeration type
'qdf_nbuf_l4_rx_cksum_result_t' to different enumeration
type 'qdf_nbuf_l4_rx_cksum_type_t
Change-Id: If2b7ee179fa260c14cde450cc72272c41a9f4adb
CRs-Fixed: 2055487
In module exit context, vdev handle could be destroyed but still we
need to free pending completion tx_desc. And accessing vdev handle
of tx_desc will lead to null pointer derefernce.
Fix is to check vdev handle against null pointer.
Change-Id: Ib4e3127803f7bb0035466ec639401d7f8163598e
CRs-Fixed: 2074184
