1) Populate legacy flow control ops 'cdp_lflowctl_ops'
for HL netdev flow control.
2) Also call cdp_hl_fc_register() to register HL flow control
callback.
3) Increase number of netdev queues to 5
Change-Id: I6bdb015b3325e54386f2aad093c89f6f782c24ed
CRs-fixed: 2236321
During hard_start_xmit, set a flag in SKB CB to indicate DHCP ACK
packet, and a callback gets called on TX completion.
Change-Id: I4e11b2c35b4747c7af35a387b404e3ccb1e8e8e4
CRs-Fixed: 2253557
Implement API to set dp trace params debugfs which
sets proto bitmap, num of records and verbosity
in the same order. API expects exactly 3 params to be
passed in the same order.
CRs-Fixed: 2184740
Change-Id: Ia802243bbd2e9d985a58ccf913d9cfbe3d71c8a8
Add support for HTT_T2H_MSG_TYPE_FLOW_POOL_RESIZE
command from firmware to resize flow pool and call appropriate
function to handle it.
Change-Id: I7d2ca6ed459383ec5c456b15a71290264d5d2408
CRs-Fixed: 2261265
IPA SMMU mapping for RX buffers is needed only when IPA offload
and IPA pipes are enabled. Currently in STA only case where IPA
is not enabled SMMU map/unmap is done for RX buffers. So enable
SMMU mapping only when IPA pipes are enabled.
Change-Id: I88db2cc8606bdf4586644a7ffccd0415f85c8241
CRs-Fixed: 2213795
Currently, in ol_txrx_is_peer_eligible_for_deletion(), invalid
dereferencing of peer_id_to_obj_map[0xFFFF] to get peer_ref while
processing VDEV stop response handler may occur.
Revert the changes introduced by
Change-Id: Icf252612081a41f94db6df4684348f2962b2da9d and
Change-Id: I743e2e2c83c3e07e5d5ec4fde7fc3b098766ca96
Change-Id: I7aa104f69a5665f0e08314fb0a273e077f562939
CRs-Fixed: 2261088
Fix overrunning callee's array of size 19 by evaluating argument tid
not to pass the maximum number.
Change-Id: I993339f4b9aea51e9566d213c9828825c5f2bf66
CRs-Fixed: 2232744
In case the current selected txq group, does not have enough credits,
try to borrow credits from the other txq group.
Change-Id: I86fbe990853d90598f6e09b13f7061e4ba1a78ae
CRs-fixed: 2246206
1) When a group is created i.e. the first vdev is added to it,
assign all the credits to it.
2) When the second group is created, transfer some minimum credits
to it.
3) When a group is deleted, transfer its credits to the other group.
Change-Id: I0c5532033718b250ab0633b4da4e219c0315cac9
CRs-fixed: 2246206
1) Add function: ol_tx_update_grp_frm_count() to maintain count of frames
per group.
2) Call ol_tx_update_grp_frm_count() from ol_tx_enqueue(),
ol_tx_dequeue() and ol_tx_queue_free().
Change-Id: If1b07ea5bbdcbc6ad6d0c91e6b2060c4264b9472
CRs-fixed: 2246206
When DUT P2P Go/SAP deauth ref STA, in race condition, scheduler
thread may try to clear peer data and drop pending rx packets
after peer freed in peer unmap handler in soft irq context,
use after free issue will happen.
Error log:
BUG: spinlock bad magic on CPU#1, scheduler_threa/28550
Unable to handle kernel paging request at virtual address
6b6b6b6b6b715b
Stackframe:
do_raw_spin_lock+0x34/0x154
_raw_spin_lock_bh+0x24/0x30
ol_txrx_clear_peer_internal+0x68/0xb0 [wlan]
ol_txrx_clear_peer+0x78/0xa0 [wlan]
hdd_softap_deregister_sta+0xd0/0x200 [wlan]
hdd_hostapd_sap_event_cb+0xca8/0x20b8 [wlan]
Change-Id: Ib8d133528f5ff22125218861206d241f96eaf0da
CRs-Fixed: 2247334
Separate out QCA_LL_LEGACY_TX_FLOW_CONTROL
and QCA_LL_TX_FLOW_CONTROL_V2 flow control implementation
in different files to compile out features cleanly.
Change-Id: I5d6ddf9ea61b409b25d242852ed1f0102e94ad88
CRs-Fixed: 2228902
Introducing integer overflow checks in htt_t2h_tx_ppdu_log_print()
contained use of %p which violates security guidelines.
Change %p to %pK.
Change-Id: I9e886e9b065ea6902aeedc3d9c25aac76a07d6de
CRs-Fixed: 2252217
ol_tx_update_connectivity_stats() in tx completion
path updates connectivity stats referenced from tx_desc.
In cases when vdev has gone down and tx completion are received
leads to NULL vdev access. So, add check before accessing vdev.
Change-Id: I402d740ab3ecd923aa1b632bd0c59447599c17df
CRs-Fixed: 2225053
ol_tx_update_arp_stats() in tx completion path updates the per vdev
arp statistics. vdev is referenced from tx_desc.
In cases when vdev has gone down and tx completion are received leads
to NULL vdev access. So clear reference to vdev inside tx_descs when
vdev goes down.
Change-Id: Ic8c854b42ece41489f71e1374e5e72580308e9fe
CRs-Fixed: 2215312
Currently in htt_t2h_msg_handler_fast, msg_len, which is in number of
bytes, is directly compared with pdev->rx_mpdu_range_offset_words,
which is in number of words. Thus their comparison becomes invalid.
In htt_t2h_msg_handler, in addition to similar issue as above, the
checks for message offset validations do not consider integer overflows
occurring.
In htt_t2h_msg_handler_fast, the check condition involving
pdev_rx_mpdu_range_offset_words were corrected to work with bytes,
and in htt_t2h_msg_handler checks for integer overflow were also
added.
Change-Id: I9ec7d30cc24d288ddcabd3bb30674a2ca21f2251
CRs-Fixed: 2248069
During peer deletion, ol_txrx_is_peer_eligible_for_deletion() is
called to check if peer is eligible for deletion. Inside function,
vdev is dereferenced to extract pdev but due to race conditon peer
may get freed from the list and this may lead to NULL pointer
derefencing of vdev.
Avoid dereferencing of vdev and pass pdev itself as an argument to
ol_txrx_is_peer_eligible_for_deletion()
Change-Id: I743e2e2c83c3e07e5d5ec4fde7fc3b098766ca96
CRs-Fixed: 2252243
Peer get deleted during ol_txrx_peer_detach_force_delete when
WMA_ROAM_OFFLOAD_SYNCH_IND is received. As peer deletion is
happening in different context and ol_rx_send_pktlog_event is
accessing the peer in different context, a possible race condition
has occurred which leads to NULL pointer dereferencing of peer.
Ignore the peer deletion during ol_txrx_peer_detach_force_delete and
delete it during ol_rx_peer_unmap_handler.
Change-Id: Icf252612081a41f94db6df4684348f2962b2da9d
CRs-Fixed: 2238214
Featurize fastpath feature cleanly and
also disable unused code when Fastpath
is enabled.
Change-Id: I3922af873ef32544fdca37be0b110ebbc2abc45a
CRs-Fixed: 2226918
Remove incorrect check for WLAN_MAX_STA_COUNT. The callee
ol_txrx_get_vdev_by_local_id would do the correct check for
OL_TXRX_NUM_LOCAL_PEER_IDS.
Change-Id: I74f9996316cead165f40454c75145515e9c86a04
CRs-Fixed: 2247595
Currently, the message type HTT_T2H_MSG_TYPE_RX_ADDBA and
HTT_T2H_MSG_TYPE_RX_DELBA is not supported as firmware is
no more sending this message to host.
Clean up the unreachable code for HTT_T2H_MSG_TYPE_RX_ADDBA
and HTT_T2H_MSG_TYPE_RX_DELBA message type.
Change-Id: I7a32fb53fec00e0507ef32d29494968188c98bfd
CRs-Fixed: 2226328
Fix a few things in one shot.
- clean up some code to avoid potential NULL pointer dereference.
- add a helper function - wlan_ipa_free_tx_desc_list() to
avoid duplication.
- rearrage wlan_ipa_teardown_sys_pipe() to allow others' reference
Change-Id: I9d6391a7f20ae427bf59f07958bd13f349e61d83
CRs-Fixed: 2233867
Currently SMMU mem map table allocation size is very high and may
lead to allocation failure if system memory is fragmented or in low
memory cases. Do not allocate SMMU mem table buffer instead update
for each rx nbuff.
Change-Id: Ib48199387abc942980cef1ef57a00e44c729e95f
CRs-Fixed: 2238629
Do not unmap the skb_buf if the owner is the ipa module when doing the
ol_txrx_vdev_flush.
For WDI 1.0 MCC TX, the IPA driver will push skb to wlan for transmission.
The skb_buffer has been mapped in the IPA driver before sending to wlan.
So no need to do unmap the skb_buf again in the wlan driver.
Change-Id: I2c1f8e916aca12f3efa73e3540e3d27c434617a1
CRs-Fixed: 2244442
Fix compilation issue seen in ol layer functions
due to mismatch between callback pointer type and
callback function signature.
Change-Id: I46bdf88c0d3e367e15e2a54229b237e2c9416319
CRs-Fixed: 2245498
There is a chance that cumulative peer_id_ref_cnt of different
peers can exceed peer ref cnt. This can result in use after free
issue during peer unref delete in ol_txrx_peer_remove_obj_map_
entries. Add QDF_BUG to catch such case and avoid access of peer
after delete.
Change-Id: I5a3cecc6a20747fce2fbf36a5ae733c42a3bc88b
CRs-Fixed: 2206589
Flow control resize implementaion as part of
Genoa enhancements to reduce total desc requirement
from 3600 to 2000.
Change-Id: Iee5d3ff08dcea13c11632cd29e6edba0dc3e979f
CRs-Fixed: 2223553
mpdu_bytes_array_len, mpdu_msdus_array_len, and msdu_bytes_array_len
are used to calculate the record size, as well as used as
buffer offset, without any verification. This can cause to multiple
overflows and underflow leading to OOB reads.
Add checks for each arithmetic operation with these variables.
Change-Id: Ib6ec6ac6932eb8c541bc2357d45d3feaf39fdb7d
CRs-Fixed: 2226125
Address the following issues in the core/dp folder:
CHECK: 'accomodate' may be misspelled - perhaps 'accommodate'?
CHECK: 'acess' may be misspelled - perhaps 'access'?
CHECK: 'bahavior' may be misspelled - perhaps 'behavior'?
CHECK: 'catagory' may be misspelled - perhaps 'category'?
CHECK: 'continous' may be misspelled - perhaps 'continuous'?
CHECK: 'controler' may be misspelled - perhaps 'controller'?
CHECK: 'curently' may be misspelled - perhaps 'currently'?
CHECK: 'defintion' may be misspelled - perhaps 'definition'?
CHECK: 'Defintions' may be misspelled - perhaps 'Definitions'?
CHECK: 'desriptor' may be misspelled - perhaps 'descriptor'?
CHECK: 'extention' may be misspelled - perhaps 'extension'?
CHECK: 'informations' may be misspelled - perhaps 'information'?
CHECK: 'lenght' may be misspelled - perhaps 'length'?
CHECK: 'managment' may be misspelled - perhaps 'management'?
CHECK: 'messsage' may be misspelled - perhaps 'message'?
CHECK: 'neccessary' may be misspelled - perhaps 'necessary'?
CHECK: 'recieved' may be misspelled - perhaps 'received'?
CHECK: 'Recieve' may be misspelled - perhaps 'Receive'?
Change-Id: Ib8c1b94b5bb3bb5798e41dbb4c1461be80fd1398
CRs-Fixed: 2241941
Currently, "channel_freq" is declared as uint16_t. But
htt_get_channel_freq returns "int" which is assigned to
"channel_freq". So, channel_freq != -1 is always true
regardless of the values of its operands.
Declare "channel_freq" as int and add the check if
channel_freq is positive.
Change-Id: I13ae35c1bee3cdf293227e320ede8d8cd2e968fe
CRs-Fixed: 2233556
Currently tid is extracted from HTT message and it is used without
check. This may cause possible OOB array read. To address this add
check for valid tid.
Change-Id: Idb03236e05fe43326f9ab46ae8368adc9a92d92a
CRs-Fixed: 2225497
Currently tx desc id is extracted from HTT message and it is used
without check. This may cause possible OOB array read. To address
this add check for valid tx desc id.
Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af
CRs-Fixed: 2225461
__hdd_tx_timeout passes cdp_soc context dump_flow_pool_info callback
function. Lithium_dp interchangeably use cdp_soc and dp_soc as cdp_soc is
first element of dp_soc.
Same is not valid for iHelium datapath, do not expect caller to pass
the txrx_pdev context, instead get it from global cds_context.
Change-Id: I64932fefd1294275608258df49544135d3a0562c
CRs-Fixed: 2240099
The use TAILQ_FOREACH for freeing the fw_stats list during
pdev detach causes a use-after-free condition, which can lead
to unexpected behavior during the driver load or unload.
Fix the possible Use-after-free condition in pdev detach, by
using TAILQ_FOREACH_SAFE instead of TAILQ_FOREACH for freeing
the fw_stats list.
CRs-Fixed: 2214520
Change-Id: I5dfcc5e3f0d2e77a5f6226eca06bc6ab1af4e643
DPT_DEBUGFS_PERMS macro has been defined inside
ifdef QCA_SUPPORT_TXRX_LOCAL_PEER_ID. Since this can cause problems
when the above config is not set, defining it outside.
Change-Id: Ibf02f692ddaf0b5de17d647cce27a6e093f7b7df
CRs-Fixed: 2238106
