Pārlūkot izejas kodu

qcacmn: Fix bss peer leak for link switch when LL-SAP existed

Hit following issue of link switch when LL-SAP existed.
1. Link switch was received on VDEV-1 (partner link).
   a. Link switch cmd was added to serial active queue, existing peer
      was deleted as part of link switch disconnect.
   b. Link switch connect started but got deferred due to LL-SAP Bearer
      switch transition, when WLAN_CM_SM_EV_BEARER_SWITCH_COMPLETE
      received, a new connect cmd was added to serial pending queue,
      link switch was blocked here.

2. Disconnect from userspace was received
   a. The disconnect on VDEV-1 here notified MLO-manager to terminate
      ongoing link switch.
   b. Link switch confirmation was sent to F/W as failure.
   c. link switch cmd was removed from serial active queue.

3. Connect cmd queued in #1.b was activated and moved VDEV-1 state to
connecting.
   a. New peer got created but PE session wasn't yet created.
   b. Disconnect from #2.a changed the VDEV-1 state from connecting to
      disconnecting.
   c. While processing the disconnect in #3.b, peer delete for the peer
   created in #3.a didn’t happen as disconnect didn’t proceed when pe
   session not found.

To fix it, for link switch, don't add new connect cmd to serial queue
after LL-SAP Bearer switch since link switch cmd is queued already.

1. Link switch is received on VDEV-1 (partner link).
   a. links witch cmd was added serial active queue, existing peer
      gets deleted as part of link switch disconnect.
   b. Link switch connect starts but gets deferred due to LL-SAP Bearer
      switch transition, WLAN_CM_SM_EV_CONNECT_ACTIVE is sent after
      WLAN_CM_SM_EV_BEARER_SWITCH_COMPLETE received, bss peer creat cmd
      is sent to F/W.

2. Disconnect from userspace is received when link switch unfinished.
   a. The disconnect on VDEV-1 here notified MLO-manager to terminate
      ongoing link switch.
   b. If BSS peer created, mlme_cm_bss_peer_delete_req will be called to
	delete it.
   c. Link switch confirmation is sent to F/W as failure.
   d. link switch cmd is removed from serial active queue.

Change-Id: I13ba820bd0240d062c7cd47ec0e53ae1a27d5b58
CRs-Fixed: 3752437
Jianmin Zhu 1 gadu atpakaļ
vecāks
revīzija
8b53a70981
1 mainītis faili ar 12 papildinājumiem un 11 dzēšanām
  1. 12 11
      umac/mlme/connection_mgr/core/src/wlan_cm_connect.c

+ 12 - 11
umac/mlme/connection_mgr/core/src/wlan_cm_connect.c

@@ -249,6 +249,17 @@ static QDF_STATUS cm_ser_connect_req(struct wlan_objmgr_pdev *pdev,
 	QDF_STATUS status;
 	uint8_t vdev_id = wlan_vdev_get_id(cm_ctx->vdev);
 
+	if (cm_is_link_switch_connect_req(cm_req)) {
+		/*
+		 * For link switch, connect serialization is not required as
+		 * link switch is already serialized.
+		 */
+		return cm_sm_deliver_event_sync(cm_ctx,
+						WLAN_CM_SM_EV_CONNECT_ACTIVE,
+						sizeof(wlan_cm_id),
+						&cm_req->cm_id);
+	}
+
 	status = wlan_objmgr_vdev_try_get_ref(cm_ctx->vdev, WLAN_MLME_CM_ID);
 	if (QDF_IS_STATUS_ERROR(status)) {
 		mlme_err(CM_PREFIX_FMT "unable to get reference",
@@ -1937,17 +1948,7 @@ QDF_STATUS cm_connect_start(struct cnx_mgr *cm_ctx,
 		return QDF_STATUS_SUCCESS;
 	}
 
-	if (cm_is_link_switch_connect_req(cm_req)) {
-		/* The error handling has to be different here.not corresponds
-		 * to connect req serialization now.
-		 */
-		status = cm_sm_deliver_event_sync(cm_ctx,
-						  WLAN_CM_SM_EV_CONNECT_ACTIVE,
-						  sizeof(wlan_cm_id),
-						  &cm_req->cm_id);
-	} else {
-		status = cm_ser_connect_req(pdev, cm_ctx, cm_req);
-	}
+	status = cm_ser_connect_req(pdev, cm_ctx, cm_req);
 
 	if (QDF_IS_STATUS_ERROR(status)) {
 		reason = CM_SER_FAILURE;