Crash scenario:
(1) frag data A is dropped and related RX desc A is replenished
and reused, but pdev->free_list_tail is still pointed to RX desc A.
(2) frag data B/C is coming, defrag fails then pdev->free_list_head
will point to B-->C RX desc, but pdev->free_list_tail still point to A.
(3) for defrag failing case, host only will replenish 1 RX buffer for
current case, RX desc B is replenished, while C will be free back to
RX desc pool.
(4) dp_rx_add_desc_list_to_free_list will set RX desc A-->next =
free_list, free_list point to C insted.
(5) when step (1) RX desc A replenished buffer indicated to host by
REO2Dst ring, RX desc A -->nbuf actually is pointed to another RX
desc, invalid skb accessing will happen.
Solution:
a. reset tail pointer in dp_rx_add_desc_list_to_free_list at last.
b. reset tail pointer same as head in dp_rx_add_to_free_desc_list
if head->next is NULL.
c. set correct rx_bufs number for replenish when dp_rx_defrag fails.
Change-Id: Ib297baea3605a09dd7d85d1f5ceb95db48a2e1f1
CRs-Fixed: 2603676
With current implementation in_use bit for last descriptor is not
getting set as 0. Removing redundant code and setting in_use bit
for last descriptor as 0.
Change-Id: Ia1945fcb814136128d18a8aec473ed1b4786dd9e
Allocate memory in multiple smaller chunks for dp_rx_desc_pool_alloc,
and link the pages instead of allocating one big contiguous memory to
avoid memory allocation failures.
Change-Id: Id81de10727555c4ca78963a6f01ed3b992ce9924
CRs-Fixed: 2443999
In Rx path, We really don't need to flush data and invalidate.
Hence replacing map/unmap flag to QDF_DMA_FROM_DEVICE.
Change-Id: I3de0c73e11a08a875114167a55fe9fe4432f1dd4
CRs-fixed: 2449712
Support WLAN IPA WDI 3.0 with SMMU-S1 enabled. Key design
considerations are captured below.
- ring base addresses are passed as struct sg_table and IPA
driver will do the IOVA mapping to IPA domain.
- ring doorbell addresses are passed as physical address and
IPA driver will do the IOVA mapping to IPA domain.
- TX/RX buffers need to be mapped to IPA domain by WLAN driver
via ipa_wdi_create|release_smmu_mapping API.
- IPA doorbell addresses returned from ipa_wdi_conn_pipes are
DDR addresses and WLAN driver needs to do the IOVA mapping
to WLAN domain.
Change-Id: I2398df58c9a9d002af7035f239eda37a86f5d00f
CRs-Fixed: 2422155
Rx desc pools are reused across wifi up
and wifi down, only nbufs part of these
pools are free during down
Free Rx desc pools during WiFi Unload
CRs-Fixed: 2418941
Change-Id: I5cc3a82d99efd84f51f9eb048cf06da5a4495e55
wifi up/down will cause soc stop and soc
start which will allocate rx desc pool
array memory for each wifi up
This creates memory fragmentation issue
hence reuse Rx descriptor pool array
across wifi up/down and free only nbufs
CRs-Fixed: 2394666
Change-Id: Ic897c733dfba3d8829e2f2f51099cd615b8a7ea2
During dp_rx_pdev_attach and dp_rx_pdev_mon_buf_attach we are allocating
three times as many rx descriptors as there are entries in the ring for
AP usecase. This is not needed for MCL and may need to kmalloc
failures for allocating that much contiguous memory
Allocate only as many RX descriptors as there are ring entries for MCL
usecase.
Change-Id: I8b559a85c3899bcbdc520e71ba5da409314db160
CRs-Fixed: 2342957
Clean up datapath component prints by correcting trace levels for
regularly occurring prints and removing newlines from converged
print APIs since qdf_trace_msh appends them by default.
Change-Id: Ie8fe319fcb737720f7400a165e134b6a18bd15b5
CRs-Fixed: 2243843
Create a lock for protecting rx descriptor
pool allocation during initialization and destroy it
during unloading the driver.
Change-Id: Icd489e400dab9bb648709134dcaa24c4d7724aa6
CRs-Fixed: 2215430
In dp_rx_get_free_desc_list() corrected the
return value in case when the number of requested
rx_desc are not available in the pool
Change-Id: I3de026726e885b8fe707f7c7318cc1936be73e65
CRs-Fixed: 2202247
When reaping rx monitor msdu in dp_rx_mon_mpdu_pop, if msdu_ppdu_id >
ppdu_id, then the corresbonding dp_rx_desc will not be added to free list,
and in_use flag still is 1 but it has done nbuf unmap which linked
to this rx desc. meantime, if rmmod triggered then it will go through the
rx desc pool and unmap the linked nbuf that in_use flag is 1, panic
happened. add unmapped flag checking to avoid double unmap.
CRs-fixed: 2201071
Change-Id: Idead32b189f513897deebf646b72585b257151c2
In attach and replenish path, nbuf maps a DMA region for device access.
But the DMA region mapped is not unmapped in detach path.
Fix is to unmap the DMA region when rx_desc_pool is freed.
Change-Id: If3e93113e59c7eec4419cb1d9228ee95c5b74b39
CRs-Fixed: 2149014
Replenish buffers in RXDMA refill ring based on low threshold
interrupts in addition to regular Rx processing. Also increased
RXDMA refill ring size to 4096.
Change-Id: If1f4592c815fe2404c4952a96b721cb6d4fdfcd0
Add a in_use flag to identify if a rx desc is associated
with a valid nbuf and use this flag while freeing the nbuf.
Change-Id: Iace002ecadfd95ce60b7d1eaebc42194a433963b
CRs-fixed: 2044907
Remove the statement nbuf pointing to NULL
during allocation of descriptors as nbuf in rx_desc and next
pointer in dp_rx_desc_list_elem_t share the same address
space and pointing to NULL will not allocate the
rx descriptors.
Change-Id: If4c35202c2489aed1711173b37192f565f7c3d7b
CRs-Fixed: 2061564
This change is for supporting monitor mode VAP. All the monitor mode ring
is configured. The related monitor mode ring includes:
-monitor mode buffer ring
-monitor mode destination ring
-monitor mode status ring
-monitor mode link descriptor ring
The packet is not sent to monitor mode ring unless the monitor mode VAP is
configured. This release support Multiple VAP - AP/STA VAP plus Monitor
VAP configuration. The status ring is not used in this release. However,
the ring is tested and the ring is moving and there are TLV's in the ring.
Change-Id: I782ee0c3b998d8b3bbac79b5e7fdecdbff15fa93
CRs-Fixed: 2013049
Add support for replenishing the rx buffers using the host to
firmware buffer ring.
This includes adding a flag QCA_HOST2FW_RXBUF_RING:
When QCA_HOST2FW_RXBUF_RING is enabled the host will do the following:
- Allocate the refill buffer ring (HTT_HOST1_TO_FW_RXBUF_RING) and
populate it with
rx buffers
- Send the refill buffer ring configuration to the firmware
- Allocate the rx DMA ring (HTT_RXDMA_HOST_BUF_RING), leave it empty.
- Send the rx DMA ring configuration to the firmware
When QCA_HOST2FW_RXBUF_RING is disabled, the host will do the following:
- Allocate the rx DMA ring (HTT_RXDMA_HOST_BUF_RING), and populate it with
rx buffers
- Send the rx DMA ring configuration to the firmware
CRs-Fixed: 1074199
Change-Id: Iec05a973cd9d628c742e3aaa16b8dabc7797625d
