wlan: Brining back changes from 622403 - seems it was accidentaly reverted
When WDA times out waiting for the TX path to send out a management
frame it informs PE about the failure ; PE destroys the frame in the MC
thread context
In the mean while the frame can be anywhere in the TX data path
components and its deletion will cause an unexpected behavior that will
more often then not lead to a crash
The proposed fix prevents WDA from notifying failure to PE, instead it
tags the frame as timed out using the WDA user data id from the vos
packet
When frame completes tx it will end up in WDA marked appropriately - WDA
will just discard the packet at its level and it will not do anymore
processing as this isn't the current frame that it is trying to send out
Unblocking the MC thread before a frame has completed tx opens up the
possibility of UMAC sending another mgmt frame to TL while the 1st one
is still pending TX at TL level. In this case to eliminate any possible
race condition and not to introduce locks TL will just fail the TX
request.
In all customer reports the crash seems to happen when the frame was
already on its completion path and the time gap between the timeout and
crash is very small, reason for which I also increased the WDA timer
value to minimize the likelyhood of this occurance.
Change-Id: I8cee298eb200a2ca75a6127f7594bdccd607d08d
CR-Fixed: 339973
diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index bbd5fe7..caeb5d4 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -9114,6 +9114,7 @@
tWDA_CbContext *wdaContext= (tWDA_CbContext *)VOS_GET_WDA_CTXT(pVosContext);
tpAniSirGlobal pMac = (tpAniSirGlobal)VOS_GET_MAC_CTXT((void *)pVosContext) ;
+ tANI_U32 uUserData;
if(NULL == wdaContext)
{
@@ -9123,6 +9124,18 @@
VOS_ASSERT(0);
return VOS_STATUS_E_FAILURE;
}
+
+ /*Check if frame was timed out or not*/
+ vos_pkt_get_user_data_ptr( pData, VOS_PKT_USER_DATA_ID_WDA,
+ (v_PVOID_t)&uUserData);
+
+ if ( WDA_TL_TX_MGMT_TIMED_OUT == uUserData )
+ {
+ /*Discard frame - no further processing is needed*/
+ vos_pkt_return_packet(pData);
+ return VOS_STATUS_SUCCESS;
+ }
+
/*check whether the callback is null or not,made null during WDA_TL_TX_FRAME_TIMEOUT timeout*/
if( NULL!=wdaContext->pTxCbFunc)
{
@@ -9334,13 +9347,19 @@
pWDA->pTxCbFunc = NULL; /*To stop the limTxComplete being called again ,
after the packet gets completed(packet freed once)*/
+ /*Tag Frame as timed out for later deletion*/
+ vos_pkt_set_user_data_ptr( (vos_pkt_t *)pFrmBuf, VOS_PKT_USER_DATA_ID_WDA,
+ (v_PVOID_t)WDA_TL_TX_MGMT_TIMED_OUT);
+
/* check whether the packet was freed already,so need not free again when
* TL calls the WDA_Txcomplete routine
*/
- if(vos_atomic_set_U32(&pWDA->VosPacketToFree, (v_U32_t)WDA_TX_PACKET_FREED) == (v_U32_t)pFrmBuf)
+ vos_atomic_set_U32(&pWDA->VosPacketToFree, (v_U32_t)WDA_TX_PACKET_FREED);
+ /*if(vos_atomic_set_U32(&pWDA->VosPacketToFree, (v_U32_t)WDA_TX_PACKET_FREED) == (v_U32_t)pFrmBuf)
{
pCompFunc(VOS_GET_MAC_CTXT(pWDA->pVosContext), (vos_pkt_t *)pFrmBuf);
- }
+ } */
+
if( pAckTxComp )
{
pWDA->pAckTxCbFunc = NULL;