Currently, the message type HTT_T2H_MSG_TYPE_RX_ADDBA and
HTT_T2H_MSG_TYPE_RX_DELBA is not supported as firmware is
no more sending this message to host.
Clean up the unreachable code for HTT_T2H_MSG_TYPE_RX_ADDBA
and HTT_T2H_MSG_TYPE_RX_DELBA message type.
Change-Id: I7a32fb53fec00e0507ef32d29494968188c98bfd
CRs-Fixed: 2226328
Fix a few things in one shot.
- clean up some code to avoid potential NULL pointer dereference.
- add a helper function - wlan_ipa_free_tx_desc_list() to
avoid duplication.
- rearrage wlan_ipa_teardown_sys_pipe() to allow others' reference
Change-Id: I9d6391a7f20ae427bf59f07958bd13f349e61d83
CRs-Fixed: 2233867
Currently SMMU mem map table allocation size is very high and may
lead to allocation failure if system memory is fragmented or in low
memory cases. Do not allocate SMMU mem table buffer instead update
for each rx nbuff.
Change-Id: Ib48199387abc942980cef1ef57a00e44c729e95f
CRs-Fixed: 2238629
Do not unmap the skb_buf if the owner is the ipa module when doing the
ol_txrx_vdev_flush.
For WDI 1.0 MCC TX, the IPA driver will push skb to wlan for transmission.
The skb_buffer has been mapped in the IPA driver before sending to wlan.
So no need to do unmap the skb_buf again in the wlan driver.
Change-Id: I2c1f8e916aca12f3efa73e3540e3d27c434617a1
CRs-Fixed: 2244442
Fix compilation issue seen in ol layer functions
due to mismatch between callback pointer type and
callback function signature.
Change-Id: I46bdf88c0d3e367e15e2a54229b237e2c9416319
CRs-Fixed: 2245498
There is a chance that cumulative peer_id_ref_cnt of different
peers can exceed peer ref cnt. This can result in use after free
issue during peer unref delete in ol_txrx_peer_remove_obj_map_
entries. Add QDF_BUG to catch such case and avoid access of peer
after delete.
Change-Id: I5a3cecc6a20747fce2fbf36a5ae733c42a3bc88b
CRs-Fixed: 2206589
Flow control resize implementaion as part of
Genoa enhancements to reduce total desc requirement
from 3600 to 2000.
Change-Id: Iee5d3ff08dcea13c11632cd29e6edba0dc3e979f
CRs-Fixed: 2223553
mpdu_bytes_array_len, mpdu_msdus_array_len, and msdu_bytes_array_len
are used to calculate the record size, as well as used as
buffer offset, without any verification. This can cause to multiple
overflows and underflow leading to OOB reads.
Add checks for each arithmetic operation with these variables.
Change-Id: Ib6ec6ac6932eb8c541bc2357d45d3feaf39fdb7d
CRs-Fixed: 2226125
Address the following issues in the core/dp folder:
CHECK: 'accomodate' may be misspelled - perhaps 'accommodate'?
CHECK: 'acess' may be misspelled - perhaps 'access'?
CHECK: 'bahavior' may be misspelled - perhaps 'behavior'?
CHECK: 'catagory' may be misspelled - perhaps 'category'?
CHECK: 'continous' may be misspelled - perhaps 'continuous'?
CHECK: 'controler' may be misspelled - perhaps 'controller'?
CHECK: 'curently' may be misspelled - perhaps 'currently'?
CHECK: 'defintion' may be misspelled - perhaps 'definition'?
CHECK: 'Defintions' may be misspelled - perhaps 'Definitions'?
CHECK: 'desriptor' may be misspelled - perhaps 'descriptor'?
CHECK: 'extention' may be misspelled - perhaps 'extension'?
CHECK: 'informations' may be misspelled - perhaps 'information'?
CHECK: 'lenght' may be misspelled - perhaps 'length'?
CHECK: 'managment' may be misspelled - perhaps 'management'?
CHECK: 'messsage' may be misspelled - perhaps 'message'?
CHECK: 'neccessary' may be misspelled - perhaps 'necessary'?
CHECK: 'recieved' may be misspelled - perhaps 'received'?
CHECK: 'Recieve' may be misspelled - perhaps 'Receive'?
Change-Id: Ib8c1b94b5bb3bb5798e41dbb4c1461be80fd1398
CRs-Fixed: 2241941
Currently, "channel_freq" is declared as uint16_t. But
htt_get_channel_freq returns "int" which is assigned to
"channel_freq". So, channel_freq != -1 is always true
regardless of the values of its operands.
Declare "channel_freq" as int and add the check if
channel_freq is positive.
Change-Id: I13ae35c1bee3cdf293227e320ede8d8cd2e968fe
CRs-Fixed: 2233556
Currently tid is extracted from HTT message and it is used without
check. This may cause possible OOB array read. To address this add
check for valid tid.
Change-Id: Idb03236e05fe43326f9ab46ae8368adc9a92d92a
CRs-Fixed: 2225497
Currently tx desc id is extracted from HTT message and it is used
without check. This may cause possible OOB array read. To address
this add check for valid tx desc id.
Change-Id: I121fc4d550aa587f00ec315e3a20dfb136f4d7af
CRs-Fixed: 2225461
__hdd_tx_timeout passes cdp_soc context dump_flow_pool_info callback
function. Lithium_dp interchangeably use cdp_soc and dp_soc as cdp_soc is
first element of dp_soc.
Same is not valid for iHelium datapath, do not expect caller to pass
the txrx_pdev context, instead get it from global cds_context.
Change-Id: I64932fefd1294275608258df49544135d3a0562c
CRs-Fixed: 2240099
The use TAILQ_FOREACH for freeing the fw_stats list during
pdev detach causes a use-after-free condition, which can lead
to unexpected behavior during the driver load or unload.
Fix the possible Use-after-free condition in pdev detach, by
using TAILQ_FOREACH_SAFE instead of TAILQ_FOREACH for freeing
the fw_stats list.
CRs-Fixed: 2214520
Change-Id: I5dfcc5e3f0d2e77a5f6226eca06bc6ab1af4e643
DPT_DEBUGFS_PERMS macro has been defined inside
ifdef QCA_SUPPORT_TXRX_LOCAL_PEER_ID. Since this can cause problems
when the above config is not set, defining it outside.
Change-Id: Ibf02f692ddaf0b5de17d647cce27a6e093f7b7df
CRs-Fixed: 2238106
Apparently netbufs_ring is initialized only when reordering is not fully
offloaded. When a message of type HTT_T2H_MSG_TYPE_RX_OFFLOAD_DELIVER_IND
is sent, the driver does not check if reordering is offloaded.
Add a check, if reordering is offloaded, when a message of type
HTT_T2H_MSG_TYPE_RX_OFFLOAD_DELIVER_IND is sent.
Change-Id: I303b52182d97aa8185c23ccd99c37a97fb75a3d2
CRs-Fixed: 2213216
Replace typos "sucess" and "sucessful" with correct spellings
"success" and "successful"
Change-Id: I30746cbab4533da9b052261fa9bb87214188138b
CRs-Fixed: 2237724
To avoid out-of-bounds access of mem_map_table from htt_rx_hash_deinit
, allocate mem_map_table size the same as maximum number of hash
entries, which is RX_NUM_HASH_BUCKETS * RX_ENTRIES_SIZE.
Change-Id: If25f97b47350196ceb2e8c60e7d5430a1484a01d
CRs-Fixed: 2214158
GRO aggregations are hanging out of NAPI instance and We cannot use the
hif NAPI instance in Rx thread as gro_list inside NAPI is flushed out
at the start and end of NAPI poll, this will corrupt the gro_list on
which rx_thread is working. Address this concern by creating dummy
NAPI instances mapping to each hif NAPI and not scheduling them.
Change-Id: I6e1de57a669c56206a7863e86c3840bd0a9eabc1
CRs-Fixed: 2128450
Change data packets printing to one line
Add msdu-id to TX packets
Increase data packets size to include the complete IP packets
Indication/print when the throttling occurs
Change-Id: I4831c517b41f81003b8d28448a3093d911ac978c
CRs-Fixed: 2157768
Add Unified WDI API support for ol_txrx_ipa_set_perf_level and fix
client parameter for ipa_wdi_set_perf_profile.
Change-Id: Ieaaf7cf5231f74cd6ba358c02032ae173d9618f0
CRs-Fixed: 2211504
Add GRO support and make it configurable through INI(GROEnable).
GRO and LRO are mutually exclusive. Only one of them can be enabled.
And disable GRO during following conditions
1) Low TPUT scenario
2) Concurrency cases
3) For Rx packets when Peer is not connected
Change-Id: I15535827a03953231670d4138235c4876b16e045
CRs-Fixed: 2098772
Currently variable "num_mpdu_ranges" is from message, which is used
directly without any validation which causes buffer over-write.
To avoid buffer over-write add check for the valid num_mpdu_ranges
Change-Id: I54e138d4bd63cbe7a0ae4faf0fe9d8e59ca92c71
CRs-Fixed: 2213655
Some of the platforms delivers the msdu with skb head and skb data
pointing to same address, in such cases do skb pull to create a room
for radiotap hdr and let qdf_nbuf_update_radiotap() API handle creating
room for radiotap header.
Note: When skb head and skb data pointer points to same
address, it indicates that radiotap size is already considered in
headroom.
CRs-Fixed: 2230412
Change-Id: Ide49544873554ae38a49af1511fd5bafd0d25102
Tx context is holding on to reference to msdu, meanwhile Tx completion
freed the msdu, remove redundent qdf_nbuf_reset_num_frags(msdu)
Change-Id: I4c51f6e61c19147d2d4dafbd19bdfc3029a872ab
CRs-Fixed: 2222024
wdi2.0 feature adds extra 2 bytes to frag_header and thus hdr_len
to IPA HW also adds 2 bytes. This change breaks pre-wdi2.0 platform
with WiFi FW discarding all TX traffic since packet payload is
with an extra 2-byte offset.
Fix is to add frag_header structure with pre-wdi2.0 pattern.
Change-Id: I467a05bab4111a305ae23250c61cecc050821611
CRs-Fixed: 2047714
While handling a multi-segment TSO packet, there is a race condition
where, if tx complete arrives fast enough, the un-sent TSO segments
may be lost forever and a previously sent segment would be attempted
to be sent over.
Fix the race condition. Dont use the segment after send to go to the
next one.
Change-Id: I4abd9d26f50c749141925894a8845cf82df4d222
CRs-Fixed: 2168778
Currently pdev pointer is freed prematurely in ol_txrx_pdev_pre_detach
but the same pointer is used when ol_txrx_pdev_detach is called. This
may lead to invalid pointer dereference issue.
To fix this issue, free pdev pointer in ol_txrx_pdev_detach after
ol_txrx_pdev_pre_detach is called.
Change-Id: I089d70842b90b568ee8a38c6ed56f5418df7303d
CRs-Fixed: 2207417
Several packets are sent to firmware in htt_htc_attach_all(), back to
back. However, if one of the latter packets fails to send for some
reason, the previous packets are not flushed. This leads to a number of
leaks under error conditions.
If a packet fails to send in htt_htc_attach_all(), flush the endpoint
before returning failure to the upper layers.
Change-Id: If9b33a645f7bcc77442e18566525ae57b544f1a0
CRs-Fixed: 2219137
ol_txrx_stats_callback is not implemented as it is not required, fix
the calling function argument type to match the prototype.
Change-Id: I8a976737af8f226a1774950170f445c93ebf683b
CRs-Fixed: 2216859
typedef wmi_unified_t is redefined in
qcacld-3.0/core/dp/ol/inc/ol_defines.h previous definition is here
qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h, remove redefinition.
Change-Id: I2c2af59d8b24360cd09efeb12ea19c0340771bb8
CRs-Fixed: 2216859
Currently %p is used in ol_txrx_peer_release_ref function in
ol_txrx.c which violates security guidelines
To address this issue change %p to %pK.
Change-Id: I06fd9eb260d1c53e4de235b710cd0ea05125b976
CRs-Fixed: 2170905
When debug traffic stall issues, target credit number is also one
key point to trace beside status of TX queues. So add such info
in TX_QUEUE_STATS.
Change-Id: I2615545c1e041af920a4d0d6d0a8e3990768b762
CRs-Fixed: 2060945
