Race condition is happening when tx traffic is running and simulataneously
suspend is going on. hdd_hard_start_xmit() is called under txq->__xmit_lock
and in case of low descriptor scenario, it goes to pause the netif queues
and trying to take adapter->pause_map_lock for doing so which is already
acquired by another thread. In another thread, suspend indication is being
preocessed and as a result is trying to pause netif queues with
netif_action WLAN_NETIF_TX_DISABLE which takes adapter->pause_map_lock and
then calls netif_tx_disable() which is trying to take txq->__xmit_lock
already taken by the thread executing hdd_hard_start_xmit(). This leads to
a deadlock situation.
Replace netif_tx_disable() with netif_tx_stop_all_queues() as
netif_tx_stop_all_queues() is doing the same thing as netif_tx_disable()
only without taking the txq->__xmit_lock which prevents this deadlock.
Change-Id: I5afafe6435707bd8f0e87972a740f908d06ce847
CRs-Fixed: 2030933
Add structure changes for querying WDI-stats, register the callback
functions for IPA to query WDI stats and sets the quota limit
Change-Id: I05d9d50fad735fa0a57c4de23c81461f6e12b648
CRs-Fixed: 1095710
Return failure if ce_send_fast fails and let caller, HDD free the Tx msdu.
If it happens to be TSO segment then free the to be trasmited TSO segments.
Change-Id: If3a16ca841e63e7941fe732013d3b3c351a4a286
CRs-Fixed: 2004780
Add ref_cnt implementation for flow pool to synchronize
usage and deletion of flow pool.
Change-Id: Idb52c74df6a771b776e3df6bf4aea5c150b5fc7a
CRs-Fixed: 2025757
Introduce different ol_trxrx print apis based on log levels.
Move the logs to appropriate log levels to reduce
the log spam in kmsg.
CRs-Fixed: 2019261
Change-Id: I14dfedb1a71b10043571112f05965935dd91a90e
2048 packets could be pending in the ce and the tx_queue
depth could be pending in the htc queue.
Change-Id: I2eedd9dd7300058a4b3024dd97c826c08f8c44bd
CRs-Fixed: 2019589
In one version of ol_tx_ll_fast a null tx_desc will be dereferenced.
ol_tx_desc_vdev_update is called when tx_desc is guaranteed to not
be null. Move the vdev_id assignment into ol_tx_desc_vdev_update
to simplify the code and fix the null pointer dereference.
Change-Id: I01b2e81ee3f19cdf3f2f74ccc575df767891f472
CRs-Fixed: 2020708
Reduce the logging level to info so to reduce the spamming of kmsg and
avoid watchdog bite due to this.
Change-Id: I26ef04f7a82fc2e2a59da67a28dba2cf152ca251
CRs-Fixed: 2024738
In one of the recent fixes, we are setting the TSO seg contents to zero
when the segment is added back to the free list. The segment cookie is
not re-initalized at this point. Hence, when this segment is
re-allocated, it fails the cookie check and there is a system crash.
Fix the issue by reinitializing the segment cookie after zero-ing out
its contents.
Change-Id: I7947e3ce4f80f1b19ebf5ef73ff75dee19ec7364
CRs-Fixed: 2011786
On stability test bed a double free of TSO segment is reported via the
TX completion path. Made following changes -
- Check for duplicate TX completions before freeing TSO segments.
- Add debug logs to check if TX descriptors are being freed from the
control path.
Change-Id: I30178de90cd0161001ded70adc26066adc9cbcb3
CRs-Fixed: 2006868
Currently NAPI stats are retrieved as a part of iwpriv getStats command.
The buffer available for this command is limited and NAPI stats get
truncated.
Add a new dumpStats parameter (9) to dump NAPI stats.
The following command will dump NAPI Stats into kmsg.
>iwpriv wlan0 dumpStats 9
Cleanup existing getStats
Change-Id: I0d804295d96a495b4afa576c8258f08c9c2b9bbb
CRs-Fixed: 1076563
Rx buffer hash table memory is not freed in htt_rx_attach
when target index allocation fails.
Fix is to free memory in failure case.
CRs-Fixed: 2025050
Change-Id: Ibbe238dc7d2f6dc2c31fe94569c9aa744714e930
The dump_tx_desc function is called to report the number of freed and used
tx descriptors when a suspend is rejected by data path. The debug code
was directly referencing a data field whereas the code to check the freed
and used descriptors used a function that reports a different number under
certain compilation flags. Use the function in the debug statement such that
the value checked is the value printed.
Change-Id: Iad3f519dc88319c7a421f77376dd43e15e6eaf09
CRs-Fixed: 1113880
When flow pool is created, pool status is set to FLOW_POOL_ACTIVE_UNPAUSED
irrespective of whether netif queues are paused or not.
Also, when descriptors are transferred from invalid pool to deficient pool,
pool status is not checked. So, if deficient pool is paused, then even
after receiving required descriptors from invalid pool, its status and
netif queues will still remain paused due to which traffic will not be able
to resume ever.
Sync pool status with netif queue status by:
1) Unpausing netif queues as well when pool is created.
2) If deficient pool is paused and on receiving descriptors from invalid
pool, no. of descriptors goes beyond start threshold, unpause the
queues and set the pool status to FLOW_POOL_ACTIVE_UNPAUSED.
Change-Id: I69390e40130892d218372e4a8a0ab4b0c7b94b7e
CRs-Fixed: 2025759
Replace policy manager header file include as part of policy manager
moving to host common.
Change-Id: Ie1f9d6675cc373c3325c9e76514f48299932cdda
CRs-Fixed: 2009818
Free memory allocated in ol_tx_desc_dup_detect_init() and spinlock
created in ol_txrx_pdev_post_attach() in case of failure condiiton.
Change-Id: I7e3909622e5b63af2d20c2c8cc0a8cc4350e4085
CRs-Fixed: 2024377
Refactor flush rx queue function call based on soc by adding an
interface to CDP funtion indirection table.
Change-Id: I2d05acd023baf156c5b0752447d76d0e9e92ff53
CRs-fixed: 2023399
qcacld-2.0 to qcacld-3.0 propagation
With ATH_11AC_TXCOMPACT defined, host to target message send-completion
won't be called and messages are stored in htt_htc_pkt_misclist after
sending to HTC layer which will be freed upon htt_detach. This list
doesn't have a size limit and outgrow with more messages.
Add a fix to limit the size of this list which gives enough time for
firmware to process these messages before releasing it.
Change-Id: I6feb2d5700abe81a21dd93303163202616c739f5
CRs-Fixed: 902909
Some of the packets like configuration messages and ipa stat
messages to fw are added in htt misc list. If these packets
fail to be transmitted, they are added in endpoint tx queue as well.
When driver is unloaded, as these packets are present in misc list
as well as in endpoint tx queue, double free will happen and crash
will be observed.
Use magic pattern to distinguish the packets that are stored in
endpoint tx queue as well.
Change-Id: I5d327049d0a2a1598f55ef3ec8a5628f9a01ccee
CRs-Fixed: 2016412
Separate out pdev detach processing as ol_txrx_pdev_detach()
and ol_txrx_pdev_pre_detach() corresponding to pdev attach
functions ol_txrx_pdev_attach() and ol_txrx_pdev_post_attach()
respectively.
Change-Id: I7fdbe70ad8262a57b61a742fcfb2779e323172af
CRs-Fixed: 2010653
Automated code style checker detected multiple instance of "no space
before tabs," so fix those issues.
Change-Id: I93248e3cfafa047c4fa8c9553769f9457086d01a
CRs-Fixed: 2021507
Change the return type to QDF_STATUS of htt_tx_desc_init function
to handle dma map and other error condition.
Free the tx descriptor if this function returns error.
CRs-Fixed: 2021634
Change-Id: Ib9154de308154c43c202ad8a88ecdfff04be47a2
When a packet is generated internally, host adds a debug
node entry to the table and deletes the entry once received
tx completion for that packet by calling qdf_nbuf_free.
But when a packet is coming from network stack, host doesn’t
add any debug entry to the table and on receiving tx completion,
it calls qdf_nbuf_tx_free which will simply free the skb.
In case of P2P GO mode where packets are forwarded internally,
host creates a private copy of skb and add debug node entry in
the table. But when receiving a tx completion for the same packet
host calls qdf_nbuf_tx_free which will free the skb but will not
remove this node entry from the table. Currently, this api is common
for all data tx completion packets.
Add an extra flag in control block to differentiate whether skb is
generated by driver or come from network stack. If flag is true,
that means generated internally and need to remove the entry from
debug node table.
CRs-Fixed: 2021277
Change-Id: I07c12b5bf134a3e56d13005dbe03778781cdf176
qcacld-2.0 to qcacld-3.0 propagation
tx_msdu_info.peer should be reset to NULL for
each MSDU. Each MSDU will be classified by
ol_tx_classify to get peer.
Change-Id: I68fe619435a6edfdd82fa083ad9cb81251705ad5
CRs-Fixed: 1109984
qcacld-2.0 to qcacld-3.0 propagation
Add below four keys to allow user to tune WRR TX scheduler params.
Each key is mapping to one AC defined in data path module through
OL_TX_SCHED_WRR_ADV_CAT_CFG_SPEC.
gEnableTxSchedWrrBE
gEnableTxSchedWrrBK
gEnableTxSchedWrrVI
gEnableTxSchedWrrVO
Change-Id: I5c34b604297d83673ea065243cc58c3f2180ff3e
CRs-Fixed: 1020141
qcacld-2.0 to qcacld-3.0 propagation
After calling ol_tx_msdu_complete, it will reset the tx desc's pakcet
type to ol_tx_frm_freed state. So there might be a race condition
if there is another thread try to allocate this tx description between
these two operations.
The ol_tx_msdu_complete doesn't always free the tx_desc according to the
tx desc type. So need to reset the tx desc's packet type only when the
ol_tx_msdu_complete hasn't freed it.
Change-Id: I0d96ef60d10048c524e93209469e8cdf20ce22c6
CRs-Fixed: 1087688
qcacld-2.0 to qcacld-3.0 propagation
The ol_tx_desc_free might access the invalid content of vdev referred by tx
desc, since this vdev might be detached in another thread asynchronous.
Go through tx desc pool to set corresponding tx desc's vdev to NULL
when detach this vdev, and add vdev checking in the ol_tx_desc_free to
avoid crash.
Change-Id: I3afa63659e047bbbf008440335fb71c8295ca353
CRs-Fixed: 1087690
Avoid NULL pointer dereferencing of mpdu_buf by putting NULL
check before using it in htt_rx_restitch_mpdu_from_msdus func.
Change-Id: I726891d4fc1f6928cbda911932dbbcd2ec681b63
CRs-Fixed: 2008901
For HL target, CONFIG_HL_SUPPORT is enabled, which
cause sevaral compilation errors.
1. Couldn't find the definition of adf_xxx APIs.
Replace adf_xxx APIs with qdf_xxx APIs.
2. ol_tx_msdu_id_storage() return a wrong value,
implementation and definition mismatch.
Correct the return value to: pointer to tx desc_id.
3. Some of CONFIG_HL_SUPPORT/FEATURE_WLAN_TDLS feature
related code are not embraced by the macro properly.
Embrace the code with right macro for each feature.
Change-Id: Ibf09fd78f85327200dede8c32bc215208e54b798
CRs-Fixed: 2004340
De-reference tso list element in ol_tso_seg_list_init and
ol_tso_num_seg_list_init functions after NULL check.
Change-Id: I89581e5c57275804d967ab734d6bcc714b6745e4
CRs-Fixed: 2004503
Access to TSO stats related parameters are not protected by spinlock.
Due to this, race condition is happening in concurrency scenario where
processing of 2 packets is going on simultaneously and crash is happening
as we are writing in out of bound memory and then tries to access it.
Use spinlock and local variable store to avoid race condition.
Change-Id: I37413ab7ccf6bd5171815af0038401925aa7831b
CRs-Fixed: 1114150
pktlog deinit should not use cds_get_context.
Using cds_get_context for the txrx context was
causing the device to crash on the next insmod
because the deinit is happenning durring the deinitialization
of the txrx context after it has allready been unlinked from
as a global context.
Change-Id: I487951a6dd50680884223e7027e5bce1c8ddfa07
CRs-Fixed: 2004404
Use functions directly for cloning instead of a func. pointer as
qdf_nbuf_clone API has different signature when MEMORY_DEBUG is
enabled and when it is not.
Change-Id: I95fa6e7b2789dd97c0c500d0854210240feaac17
CRs-Fixed: 1114632
rx_buff_list_lock, hdd_roc_req_q_lock, lim_frame_register_lock.
Adding lock stats print upon spinlock & mutex destroy. Without
the destroy api invoked the lock stats are not printed.
Change-Id: I26cad72e3f55b9ff5f1383d617859ff2b30d74f7
CRs-Fixed: 1100552
Fix to avoid deinit of tso seg list and tso num seg list
during pdev detach if the lists are not initialized during
pdev post attach.
Currently, if htt_attach() fails as part of ol_txrx_post_pdev_attach(),
then it immediately returns from the function and not initializes
tso seg lists and during pdev_detach(), host tries to de-initialize
tso seg list and end up in a crash.
CRs-Fixed: 1113347
Change-Id: I91e077496a15a69edb9d41574f846bc3d1b73b31
Converged pdev_detach is responsible for freeing the context.
Legacy api needs to conform. Now the removal of the pdev from
the cds context needs to be done with the api that does not free
the context.
Change-Id: I4430a3bae1658e4e1accc457a572c67c9ce6f58f
CRs-Fixed: 2000089
Add support to unmap tso segment when host receives
ol_tx_comletion_handler for a particular tso segment.
Host unmap all the fragments of corresponding tso segment
except 0th fragment.
0th fragment of each tso segment now points to EIT header
which is common across all the segments. So 0th fragment cannot
be unmapped until host receives tx completion for last tso segment.
Also, now with introduction of tso, skb map-unmap is not required
anymore for tcp packets as host anyway does map-unmap of each
tso segment before sending it.
CRs-Fixed: 1106688
Change-Id: I572c7dcd2d29cb19b398e13e0fe7ce6f88ee1641
