Change data packets printing to one line
Add msdu-id to TX packets
Increase data packets size to include the complete IP packets
Indication/print when the throttling occurs
Change-Id: I4831c517b41f81003b8d28448a3093d911ac978c
CRs-Fixed: 2157768
Add Unified WDI API support for ol_txrx_ipa_set_perf_level and fix
client parameter for ipa_wdi_set_perf_profile.
Change-Id: Ieaaf7cf5231f74cd6ba358c02032ae173d9618f0
CRs-Fixed: 2211504
Add GRO support and make it configurable through INI(GROEnable).
GRO and LRO are mutually exclusive. Only one of them can be enabled.
And disable GRO during following conditions
1) Low TPUT scenario
2) Concurrency cases
3) For Rx packets when Peer is not connected
Change-Id: I15535827a03953231670d4138235c4876b16e045
CRs-Fixed: 2098772
Currently variable "num_mpdu_ranges" is from message, which is used
directly without any validation which causes buffer over-write.
To avoid buffer over-write add check for the valid num_mpdu_ranges
Change-Id: I54e138d4bd63cbe7a0ae4faf0fe9d8e59ca92c71
CRs-Fixed: 2213655
Some of the platforms delivers the msdu with skb head and skb data
pointing to same address, in such cases do skb pull to create a room
for radiotap hdr and let qdf_nbuf_update_radiotap() API handle creating
room for radiotap header.
Note: When skb head and skb data pointer points to same
address, it indicates that radiotap size is already considered in
headroom.
CRs-Fixed: 2230412
Change-Id: Ide49544873554ae38a49af1511fd5bafd0d25102
Tx context is holding on to reference to msdu, meanwhile Tx completion
freed the msdu, remove redundent qdf_nbuf_reset_num_frags(msdu)
Change-Id: I4c51f6e61c19147d2d4dafbd19bdfc3029a872ab
CRs-Fixed: 2222024
wdi2.0 feature adds extra 2 bytes to frag_header and thus hdr_len
to IPA HW also adds 2 bytes. This change breaks pre-wdi2.0 platform
with WiFi FW discarding all TX traffic since packet payload is
with an extra 2-byte offset.
Fix is to add frag_header structure with pre-wdi2.0 pattern.
Change-Id: I467a05bab4111a305ae23250c61cecc050821611
CRs-Fixed: 2047714
While handling a multi-segment TSO packet, there is a race condition
where, if tx complete arrives fast enough, the un-sent TSO segments
may be lost forever and a previously sent segment would be attempted
to be sent over.
Fix the race condition. Dont use the segment after send to go to the
next one.
Change-Id: I4abd9d26f50c749141925894a8845cf82df4d222
CRs-Fixed: 2168778
Currently pdev pointer is freed prematurely in ol_txrx_pdev_pre_detach
but the same pointer is used when ol_txrx_pdev_detach is called. This
may lead to invalid pointer dereference issue.
To fix this issue, free pdev pointer in ol_txrx_pdev_detach after
ol_txrx_pdev_pre_detach is called.
Change-Id: I089d70842b90b568ee8a38c6ed56f5418df7303d
CRs-Fixed: 2207417
Several packets are sent to firmware in htt_htc_attach_all(), back to
back. However, if one of the latter packets fails to send for some
reason, the previous packets are not flushed. This leads to a number of
leaks under error conditions.
If a packet fails to send in htt_htc_attach_all(), flush the endpoint
before returning failure to the upper layers.
Change-Id: If9b33a645f7bcc77442e18566525ae57b544f1a0
CRs-Fixed: 2219137
ol_txrx_stats_callback is not implemented as it is not required, fix
the calling function argument type to match the prototype.
Change-Id: I8a976737af8f226a1774950170f445c93ebf683b
CRs-Fixed: 2216859
typedef wmi_unified_t is redefined in
qcacld-3.0/core/dp/ol/inc/ol_defines.h previous definition is here
qca-wifi-host-cmn/wmi/inc/wmi_unified_param.h, remove redefinition.
Change-Id: I2c2af59d8b24360cd09efeb12ea19c0340771bb8
CRs-Fixed: 2216859
Currently %p is used in ol_txrx_peer_release_ref function in
ol_txrx.c which violates security guidelines
To address this issue change %p to %pK.
Change-Id: I06fd9eb260d1c53e4de235b710cd0ea05125b976
CRs-Fixed: 2170905
When debug traffic stall issues, target credit number is also one
key point to trace beside status of TX queues. So add such info
in TX_QUEUE_STATS.
Change-Id: I2615545c1e041af920a4d0d6d0a8e3990768b762
CRs-Fixed: 2060945
Currently data in "pl_tgt_hdr" is used directly from firmware without
any length check which may cause buffer over-read.
To address this issue add length check before accessing data offset
Change-Id: Ic2930fdf7168b79a8522be282b0e1cd19214742a
CRs-Fixed: 2148631
Track connectivity stats for data rx packets through a
callback function hdd_tx_rx_collect_connectivity_stats_info().
Change-Id: I045ba694495876273691373a9d0a8995d4aa9c34
CRs-Fixed: 2161889
Extend to collect connectivity check stats other
than ARP such as DNS, TCP SYN/SYN-ACK/ACK, and Ipv4.
Add extra attributes in existing vendor command(set/reset
and get NUD debug stats) for above connectvitiy stats.
CRs-Fixed: 2161889
Change-Id: I037c4ec29b181a0b3117ae2abbc7a2229b373ac2
In htt_rx_ring_fill_n, when debt_served is non-zero,
mem_map_table is being updated for extra buffers even
though memory to store mem_info has not been allocated
for those buffers. As a result of this overflow, memory
corruption is happening.
Fix overflowing of mem_map_table array in htt_rx_ring_fill_n.
Change-Id: I3ff96f57baf07799fd69d7ba196e44e7819f58dc
CRS-Fixed: 2103792
Update WLAN-IPA WDI-2 datapath buffer sharing for SMMU Stage 1
translation support. When SMMU Stage 1 translation is enabled
DMA APIs return IO virtual address(IOVA) instead of physical
address. This IOVA need to mapped to physical address by IPA
module before accessing them
Change-Id: I969ad020d5b423c785539f346286b212ea5830a1
CRS-Fixed: 2072960
When get length by HTT_WDI_IPA_OP_RESPONSE_RSP_LEN_GET,
the input msg_word needs to shift 4Bytes.
Failure length check will cause ipa uc event without processing.
Regression cause Iddf2df0fd65f5b33b54f1a608cdd34e400c0e03c.
Change-Id: I41a44ae26f84d974cbd3242f4454ec6068d7b68b
CRs-Fixed: 2206296
The packets in the vdev ll_pause queue hasn't been doing the qdf_nbuf_map,
or they might be mapped by other module like ipa. So do not unmap in the
ol_txrx_vdev_detach to avoid the mis-match operation.
Change-Id: I498c09152be95464bc6343f2a48d63e13d621a82
CRs-Fixed: 2198903
One of the arrays defined in data-path's API is not initialized
and this API assumes that subsequent loop will fill up the array to
correct default value. This assumption is wrong.
Intialize the array "save_peer_id_ref_cnt" in API
"ol_txrx_peer_remove_obj_map_entries" to default value "0" to avoid
any issue.
CRs-Fixed: 2196084
Change-Id: If0080708662fc44e6583823717798a9f505ec1d0
In MCC tx path, skb is owned by IPA driver, where IPA driver provides
wlan driver directly DMA mapped address. Doing dma unmap of the skb
will lead to skb dma map check failure.
Fix is to skip dma unmap for IPA owned skb and let IPA driver handle
dma unmap.
Change-Id: Ib38ca949ba915785e460c05172b70088a3564b1c
CRs-Fixed: 2189889
Change to collect arp packet stats along with
existing hdd stats to debug arp packet related
issues.
Change-Id: Idce70799bd3698dc8a8ecd8cfc8ef7d9bf1f5764
CRs-Fixed: 2019787
Packetlog initialization is failing as txrx_get_pldev API is missing,
which returns paketlog object from the given pdev.
Add txrx_get_pldev API to get packet log object for the given pdev.
Change-Id: I2219a5c0964e76637ff8dbef92661b98cd22fb28
CRs-Fixed: 2189211
Size allocate with sizeof(target_paddr_t) which is following DMA
device, but free with sizeof(qdf_nbuf_t) which is a pointer following
system. Maybe not same size on some platform.
Fix it by using same type when allocate/free.
Change-Id: Iadcb68b05ca5798f38c4341323b9fd1e32f5d693
CRs-Fixed: 2189671
STA peer can be cleared from peer detach and HDD. If the
peer is cleared by peer detach, then return success to
HDD request.
Change-Id: I7aa564e7f2a1c9ce336ae96679d93a6e11703c37
CRs-Fixed: 2181163
The TX buffers in the vdev->ll_pause pending queue, which haven't mapped
the physical address.
Adding nbuf physical address checking to avoid the mis-matching unmap
especially when the MEMORY_DEBUG is enabled.
Change-Id: I6b0fcd1c7d07ca358d07b9931dea321ee8c6169a
CRs-Fixed: 2183678
Remove panic after peer_delete timeout and fail corresponding peer
operation. Peer reference count can be taken by kworker thread which
may get pre-empted by other higher priority threads or stuck, leading
to delay in releasing reference. This delay cannot be completely
removed, hence rather than panic after timeout, enhance logging and
fail corresponding peer operation.
Change-Id: I42c379c0cf91d29d293c3c53c3a378421aef07f9
CRs-Fixed: 2181097
Currently variable "num_flows" and "len" is used directly, from
message, without any validation which causes buffer over-write.
To address this issue add check for the num_flows and len
Change-Id: Iddf2df0fd65f5b33b54f1a608cdd34e400c0e03c
CRs-Fixed: 2148489
Currently type conversion issues are for variables compl_msg
and pool_numap_payload. This may cause potential buffer over-read.
To address this issue add check for structure size.
Change-Id: Id4804eeaf5e80a9045f1c057fa4cb9db15c1ab7d
CRs-Fixed: 2148306
Currently variable "num_mpdu_ranges" is from message, which is used
directly without any validation which causes buffer over-write.
To address this issue add check for the valid num_mpdu_ranges
Change-Id: I3f340b913f3063b24c14644ea723a99690e89dcf
CRs-Fixed: 2146934
Count of htt tx buffer pool should be power of 2 for fail case. For
Rome platform, it does not unmap nbuf when free htt tx buffer pool.
Change-Id: I85a9a1d02bf403f1be7289b1a0a89f86ef25f763
CRs-Fixed: 2179770
In ol_txrx_peer_release_ref, it is possible that this function is
scheduled out when just unlock peer_ref_mutex, unmap event will
come to decrease ref_cnt and free peer object, when
ol_txrx_peer_release_ref is scheduled back and access peer info,
it will cause use-after-free.
Get peer info in the protection of peer_ref_mutex.
Change-Id: Ic442f53e0993a931c4411d9dbc85f04d6a85dc46
CRs-Fixed: 2180584
When getting vdev by sta_id, peer could be deleted after retrieved,
so garbage vdev is returned.
To protect peer info, increase ref_cnt and delete peer when the ref
count is 0.
Change-Id: I850d38166d7c16d7f5e580baf3e0d17db22583f8
CRs-Fixed: 2171619
There is a very rare race condition between
ol_txrx_peer_find_by_local_id_inc_ref(running in OL RX
thread context) and ol_txrx_peer_detach(running in MC
thread context) where MC thread 1st got chance and cleared
the peer->valid flag before OL RX thread can increment the
ref count and this led to OL RX thread got a peer without
any ref count which was freed later while OL RX thread was
still using it.
Change:
1 Set peer to NULL if peer valid check fails in
ol_txrx_peer_find_by_local_id_inc_ref
2 release peer ref cnt for error case in ol_rx_data_cb
Change-Id: Id21350933386464e5814babcb078d9719572af86
CRs-Fixed: 2176704
Currently variable "tid" is from message, which is used directly
as array size which causes buffer over-write.
To address this issue add check for the array size.
Change-Id: I9b9d028ddb9566938f93ff8155284876c1ef9c03
CRs-Fixed: 2146949
