Add debug logs to capture htt rx_ring info during data stall
detection for FW_RX_REFILL failure reason.
Change-Id: I6733a37677ebccfef5096ac38858c4505e8665b6
CRs-Fixed: 2121686
Add ini param 'gtsf_ptp_options' to control
PTP options, it's a bitmap:
bit0 - PTP_OPT_RX(0x1)
set this bit to enable RX time stamping
bit1 - PTP_OPT_TX(0x2)
set this bit to enable TX time stamping
bit2 - PTP_OPT_RAW(0x4)
set this bit to use raw time as timestamp
bit3 - TSF_DBG_FS(0x8)
set this bit to add device attriubte 'tsf' for iface
The default value of gtsf_ptp_options is 0xf
Propagated from qcacld-2.0.
Change-Id: Ie53d503bdd2e85790502583a238ee138f4bcf6c6
CRs-Fixed: 2079466
Add support to post data stall event to sys message queue
to handle it in data detection module and finally post
diag event to QXDM. Add support to send NUD failure
diag event.
CRs-Fixed: 2086176
Change-Id: I72ba36d4c2f6ef2eb495ad1586f74af0f3c69254
Add data stall detection module in hdd which handles data
stall reported by host or fw and take necessary recovery
steps based on the data stall type.
Change-Id: Idf6c43f55d1bc115a0c06b4c6ef766ff3ed09bee
CRs-Fixed: 2090643
Add Vendor Event to get the driver hang reason indicating to the
user space that the driver has detected an internal failure.
This event carries the information indicating the reason that triggered
this detection.
Change-Id: I3934f2a18c796ed3b53175dcbe7efd7f4d1409b9
CRs-fixed: 2098498
Currently ol_rx_data_cb() calls cds_get_global_context() but then
doesn't do anything with the context other than verify it is not
NULL. Since the context itself is unused, remove the unnecessary call
to cds_get_global_context().
Change-Id: I42a0aa1adba5ba25a95cf22523153356e3976b47
CRs-Fixed: 2115512
ARP/NS/NA packets will not get chance to be transmitted if
netif queues are paused due to low tx descriptor availability.
Send ARP/NS/NA packets from HI PRIO queue so that it can be transmitted
in noisy environment.
Change-Id: Ibb414463d1471c19d5db99e12517c77b02564318
CRs-Fixed: 2081348
Clear the tx desc ref_cnt in ol_tx_desc_free_common as
ol_tx_desc_free independently get called from some places
during failure cases.
Change-Id: I705061558a0419785091e0e1d0605e317e479188
CRs-Fixed: 2071116
Make the following changes to fix the issue:
- Wrap TSO seg unmap code inside a spinlock
- Add TSO descriptor DUP detection logic before unmapping TSO segs
- De-initialize TSO seg freepool after in-use Tx descriptors have been
de-inited
Change-Id: I63b100879b302e4919c2952143509e76c14b36ec
CRs-Fixed: 2018317
Stats printing with excessive loops should not go to the console.
Avoids watch-dog bites.
Change-Id: I2ff67827d8bb975bc4ddbb4d70c88283e8ea231e
CRs-Fixed: 2088027
qcacld-2.0 to qcacld-3.0 propagation
The txrx_fw_stats cmd will allocate a req object before sending the cmd
to the firmware, this memory is only freed when get response from firmware.
The memory leak will appear if the firmware doesn't response in time before
the driver unloading.
This fix will add a pending queue to trace this req object in the pdev.
when pdev is detaching, it will clean up this queue to avoid memory leak.
Change-Id: I35f6216d35befbab978bba161252b305488bd34c
CRs-Fixed: 2116408
Recovery is triggered if rx hash table look up fails due to invalid
physical address. Since netbuf is not found in this case and null
netbuf is de-referenced after recovery is completed and this leads
to null pointer exception.
Exit gracefully if netbuf pop fails from rx hash table.
Change-Id: I66b3d1cf9aa05da235212923a551e58d86153e55
CRs-Fixed: 2094521
Do memzero of htt_frag_desc inside HELIUMPLUS flag as
htt_frag_desc is defined only for HELIUMPLUS.
Change-Id: Ie738881c5330956b24376f145f03dd977bf88f7b
CRs-Fixed: 2096935
Presently, htt_frag_desc is not getting zeroed out explicitly.
So fw can take the invalid/garbage data in the frag information
and treat it as a valid address which may lead to crash.
Memzero htt_frag_desc before use.
Change-Id: I9dadcb883a65c43f96e810a12b4fb491c3a2e734
CRs-Fixed: 2088448
Currently, in monitor mode, beacon frames are showing an incorrect phy
rate (0). This is because the values in the RX descriptor for
interpreting the legacy rates have changed in ihelium.
Make changes in host to interpret the new values into data rates correctly.
Change-Id: Ibf845666943fd718b657c0128758dabfb64a38ef
CRs-Fixed: 2082456
As WAPI spec, once USK rekey, PN need reset to 0x5c37, but IWNCOM AP
will send 1st packet with old PN larger than 0x5c37 after rekey, So PN
check failed for later packets.
Fix: Don't update Last_PN when receive the 1st packet from AP after USK
rekey, Last_PN keeps 0x5c37.
Analysis:
1. Host installed new unicast key after rekey handshake with AP.
2. Host Last_PN was updated to 0x5c37 as spec (expect PN of next
packet from AP is: 0x5c39)
3. Host received ping request from AP with old PN 0x5cb9
4. Host PN checked passed, driver Last_PN was updated as 0x5cb9
5. Host received ping request from AP with new PN 0x5c39
6. Host PN checked failed since 0x5c39 < 0x5cb9, ping request
dropped, no response.
Change-Id: Ifd0269193ffbe53889191269a0e985d13ea2ecf7
CRs-Fixed: 2101217
* Log EAPOL, ARP, DHCP, MGMT, ROAM Events, ICMP, Data packets,
TX-Completions by default.
* Set default verbosity as low (existing is high)
* Throttle ICMP and Data packets if threshold exceeds.
* Enable live mode by default. Added ini entry to disable
it and configure high throughput thresh - gDptraceConfig
* Log only SA and DA for proto packets (and not 32 bytes)
* Format prints to fit in 1 line.
CRs-Fixed: 2051134
Change-Id: Ia94732e49023950f458a7402650d4b8f5e1d5563
The cdp_peer_ops register_ocb_peer() method currently takes a cds_ctx
parameter. Converged datapath APIs should not require the MCL-specific
CDS context, and in fact it is not required by the MCL implementation,
so remove it from all OCB peer registration APIs.
Change-Id: I873eeb472f463ac76f30de5a9013783565be916d
CRs-Fixed: 2103451
Currently ol_rx_pkt_dump_call() calls cds_get_global_context() to get
the global context. At one time this was necessary since the global
context was required to get the module-specific context. However the
global context is no longer required, so remove the unnecessary
retrieval of the global context.
Change-Id: I8a2e66252bfd445151575502b06b132866a286fe
CRs-Fixed: 2102494
Pointer head_buf returned from call to function
htt_rx_offload_paddr_msdu_pop_ll may be NULL and will be
dereferenced
Change-Id: I6e1db520d525a42d59ebfb675325e37c4097ad71
CRs-Fixed: 2085696
1) pdev pointer should be checked to make sure it's not NULLed before
it is dereferenced in the ll_pause timer function.
2) Add a flag to prevent the ll_pause timer from being started again
when txrx vdev is being detached.
3) Timer object should be freed synchronously without any locks
being held.
Change-Id: I6f0f675442b1d75f0a67a55d51c9ecec9a1cd9ae
CRs-fixed: 2092945
Tx descriptors' state info, such as vdev pointer, vdev ID and
ref_cnt, are protected by a spin lock during freeing, but not
protected by the same lock during allocation. Correct the
discrepancies to avoid a NULL pointer dereference issue
Change-Id: Ie0fb634a893a8d33888f7f1f6685a4fb7219e308
CRs-Fixed: 2091379
Currently, cds_trigger_recovery is unconditional. Instead, avoid
triggering recovery if recovery is already in progress.
Change-Id: I5c77048701930591e0e520e07275e6f8631108a0
CRs-Fixed: 2070845
In SAP mode, during data transfer, ifconfig down, then up in 1-5s,
Tx queue is enabled before SAP reconnect. can't find peer in
hdd_softap_hard_start_xmit, much following log in prink will lead
to watchdog timeout.
R0: wlan: [0:E :TRX] PEER [1] not found
R0: wlan: [0:E :TRX] ol_txrx_get_tx_resource: Invalid sta_id 1
Change-Id: I4b6635ac71f3bff95db67791e557cafd539f9ca4
CRS-Fixed: 2088402
Reduce log flooding in __hdd_tx_timeout. The single __hdd_tx_timeout
error log printed by TX_TIMEOUT_TRACE should be sufficient to
identify the error. The debugging effort should use the driver logs.
This will ease debugging of other subsystems in the case that
the root cause is a system instability.
Change-Id: Iee3ba3c7d8d7dcd72a3a71ea4f8e4ae8d3bc17b6
CRs-Fixed: 2092183
When hdd_get_tx_resource is called, if free Tx desc is lower than low water
mark, vdev->os_q_paused will be set as 1 and WLAN_STOP_ALL_NETIF_QUEUE will
be triggered after a while. Before WLAN_STOP_ALL_NETIF_QUEUE is triggered,
if ol_tx_flow_ct_unpause_os_q is called, WLAN_WAKE_ALL_NETIF_QUEUE will be
triggered and vdev->os_q_paused will be set as 0. In such case There will
be no flow control unpaused forever.
Tx should be paused by flow control when Tx desc is lower than low water
mark, and unpaused when Tx desc is bigger than high water mark or Tx is
already paused by flow control.
Change-Id: Ib60139fd94a4fb88c92a7f8aaf886ae9d3ca4c75
CRs-Fixed: 2089149
While processing of frames received before peer is registered in process
context, tcp_v4_rcv() is called which takes a spinlock and in between the
processing before spinlock can be released, it is getting preempted by
hif_napi_poll() as it gets executed in softirq context. It tries to take
the same spinlock in tcp_v4_rcv() resulting in deadlock.
Do netif_rx_ni() for frames received before peer is registered.
Change-Id: I6228984f209bb9312ed9d8f3937d6036918ff750
CRs-Fixed: 2034244
It is reported by Static Analyze tool as buffer overflow when call
into function ol_txrx_bad_peer_txctl_update_threshold, because
WLAN_WMA_IEEE80211_MAX_LEVEL is defined as 5 but TXRX_IEEE11_MAX
defined as 4, so level 4 will pass as max index value which is buffer
overflow.
Add TXRX_IEEE11_AX so TXRX_IEEE11_MAX aligns with
WLAN_WMA_IEEE80211_MAX_LEVEL.
Change-Id: I49fe348f1071648d86e456c6df63738ec507dd6c
CRs-Fixed: 2058227
qcacld-2.0 to qcacld-3.0 propagation
Currently for SDIO implementation, tx comp indication is
suppressed and tx_desc is freed when htt download is done.
This leads to invalid tx_desc being referenced when pktlog
indication handler wants to collect TX-ed tx_desc information.
Fix consists of two parts:
1. When pktlog is enabled in ini, enable tx comp indication
handler just like PCIe and USB. tx_desc is still valid when
pktlog indication comes.
2. Check vdev pointer embedded in tx_desc structure. vdev
pointer is set when tx_desc is allocated and set to NULL when
tx_desc is freed. This guards against invalid tx_desc_id
from firmware.
Note that performance drops should be expected when
pktlog is enabled on HL platforms.
Change-Id: Iba9b8323b4a6e2ae17e36768bda3511f52236a2c
CRs-Fixed: 2034996
Run through the entire peer_id_to_obj_map array and if any peer_id's
peer entry points to a particular peer, change it to NULL. Calling
this routine before deleting the peer ensures that subsequent peer_unmap
events will not access a peer object that is deleted.
CRs-Fixed: 2027846
Change-Id: I05089bece20ea070694f243feb06d222f8e50ac6
Wrong to pass parameter by value so caller doesn't get the real allocated
tx_desc. The fix is to let ol_tx_prepare_ll return the allocated tx_desc
or NULL if fail.
Change-Id: Ic3910e45c02290ebd74766aa8f88902044decaa6
CRs-Fixed: 2084824
Data path may be processing received packets while the peer is being
deleted. It may create an extra reference to peer. As a protection,
decrement peer->ref_cnt by the exact number of peer_id_ref_cnt
instead of resetting it to hardcoded value of 1. Peer object will be
freed only after the last reference count is decremented.
CRs-Fixed: 2023550
Change-Id: I457a0fdd9d0bea86d22139090afbd33bdc34f2ed
We have race condition between lro flush of hif_napi_poll and MC thread
lro flush while flushing the ol_txrx_cached_bufq packets for peer. Avoid
the situation by simply marking the all the Rx packets as LRO ineligible
while enqueuing packets to ol_rx_cached_buf.
Change-Id: Ief0d7dd6c25cf45912820f0e237fd1179a57a5c7
CRs-Fixed: 2032674
In module exit context, vdev handle could be destroyed but still we
need to free pending completion tx_desc. And accessing vdev handle
of tx_desc will lead to null pointer derefernce.
Fix is to check vdev handle against null pointer.
Change-Id: Ib4e3127803f7bb0035466ec639401d7f8163598e
CRs-Fixed: 2074184
There can be a race condition happening where frames are being
enqueued in cached buf queue for a peer in one thread whereas
cached buf queue for that same peer is being flushed in another
thread at the same time. This could result in memory leak in buf
queue.
Check for peer validity before enqueueing frames in peer cached
buf queue.
Change-Id: Idfb190def2aabc4439cd551c50aa811bae818ea3
CRs-fixed: 2038457
During peer detach, driver starts a timer to track unmap events
when the sta peer gets deleted. During this duration SSR occurs
and BUG_ON or cds recovery is triggered. This should only happen
in non-recoverable situation, so this scenario should be avoided.
Allow driver to recover from the SSR by checking FW_DOWN bit.
Change-Id: Ieca407e5c9c30f3c4716b7d158a903add46b8bd6
CRs-Fixed: 2078395
Currently if the peer is not registered, we add packets to a cached_bufq
(within a peer). In case the peer is not registered for quite a long
time, or if the vdev->rx pointer is somehow not set (when the vdev is
associated), this will lead to large number of nbufs from the FW being
added to this list. Eventually, we will run out of memory trying to add
nbufs to this list.
Keep an upper threshold on the number of elements in the cached_bufq.
Drop elements once the threshold is reached.
Change-Id: I02db9347addd77976f1d84897eee20d1e6f9c4ec
CRs-Fixed: 2026991
QCA_WIFI_3_0_EMU flag is introduced for IHelium emulation
platform, where wait/error timeouts are kept for larger values.
Remove this flag for production target.
Increase tx completion drain delay to 1sec from 500ms to avoid
unwanted suspend abort.
Change-Id: Ie0633b3a2bbc9e2237039311af7417952961aada
CRs-Fixed: 2047750
In the existing impementation, once wma_is_pkt_drop_candidate gets a
peer from ol_txrx_find_peer_by_addr, the peer can be deleted in the
SOFTIRQ path from the unmap handler. This would make the peer pointer
'stale' resulting in access to already freed memory.
- Use standard API OL_TXRX_PEER_UNREF_DELETE to decrement peer->ref_cnt
instead of directly referencing it.
- Add a new API - ol_txrx_find_peer_by_addr_inc_ref which does not
decrement the peer->ref_cnt until the usage of peer in the caller
function is finished. The existing API ol_txrx_find_peer_by_addr
can be replaced by the new API as and when the issues are seen.
Sample usage:
{
peer = ol_txrx_find_peer_by_addr_inc_ref
/* This API gets the peer and increments its ref_cnt */
...
...
/* Once peer usage is done */
OL_TXRX_PEER_UNREF_DELETE(peer);
/*
* This API deletes the reference to the peer or the peer itself
* if the peer->ref_cnt is 0. This way we no longer depend on
* peer unmaps to delete the peer.
*/
}
Change-Id: I69fb67a4b4c9e26344d2ed1a72c383be7ac62414
CRs-Fixed: 2008583
