qcacld-3.0: Release WM status change cmd after eWNI_SME_DISCONNECT_DONE_IND

When deauth is received from AP, while processing of deauth frame,
WM status change command is queued in SME command pending list with
priority set as true in which DEL_BSS and DEL_STA happens leading to
VDEV_STOP AND VDEV_DOWN correspondingly.

When disconnect is issued from upper layer, ROAM command with reason
eCsrForcedDisassoc gets queued in SME command pending list with priority
set as true which performs DEL_BSS nad DEL_STA and then
eSmeCommandDelStaSession SME command is queued with priority set as false
which performs DEL_SELF_STA.

If disconnect is issued from upper layer and deauth is received from AP at
the same time, it might happen that ROAM SME command and
eSmeCommandDelStaSession SME command gets queued in SME command pending
list but WM status change command gets queued on top of these as priority
is set to true before the former commands can be processed. While
processiing of WM status change command, eWNI_SME_DEAUTH_CNF msg gets
queued in SME message queue which queues WMA_DELETE_BSS_REQ in WMA msg
queue. If WM staus change command is released just after
eWNI_SME_DEAUTH_CNF is posted, it might happen that Roam and
eSmeCommandDelStaSession SME commands from SME command pending list gets
processed first which will queue WMA_DEL_STA_SELF_REQ in WMA msg queue
before eWNI_SME_DEAUTH_CNF gets processed and queue WMA_DELETE_BSS_REQ
in WMA msg queue. This leads to processing of WMA_DEL_STA_SELF_REQ before
WMA_DELETE_BSS_REQ causing assert as this is unexpected behaviour.

Release WM status change command only after eWNI_SME_DISCONNECT_DONE_IND
which happens after WMA_DELETE_BSS_REQ and WMA_DELETE_STA_REQ gets
processed so that ROAM and eSmeCommandDelStaSession SME commands gets to
process only after processing of DEL_BSS and DEL_STA and so
WMA_DEL_STA_SELF_REQ will always be processed after WMA_DELETE_BSS_REQ
avoidong system assert.

Change-Id: Iec0176fecf218e07f31b258c0dc52aefb480defe
CRs-Fixed: 2211622

core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -2291,11 +2291,16 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 				&sessionId);
 	if (psessionEntry == NULL) {
 		pe_err("session does not exist for given bssId");
+		lim_send_disconnect_done_ind(pMac, NULL, CSR_SESSION_ID_INVALID,
+					     eSIR_SME_INVALID_SESSION, NULL);
 		return;
 	}
 
 	if (!lim_is_sme_disassoc_cnf_valid(pMac, &smeDisassocCnf, psessionEntry)) {
 		pe_err("received invalid SME_DISASSOC_CNF message");
+		lim_send_disconnect_done_ind(pMac, psessionEntry, sessionId,
+					     eSIR_SME_INVALID_PARAMETERS,
+					     smeDisassocCnf.bssid.bytes);
 		return;
 	}
 #ifdef FEATURE_WLAN_DIAG_SUPPORT_LIM    /* FEATURE_WLAN_DIAG_SUPPORT */
@@ -2319,6 +2324,11 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 				psessionEntry->limSmeState);
 			lim_print_sme_state(pMac, LOGE,
 					    psessionEntry->limSmeState);
+			lim_send_disconnect_done_ind(pMac, psessionEntry,
+						     sessionId,
+						     eSIR_SME_INVALID_STATE,
+						     smeDisassocCnf.bssid.
+						     bytes);
 			return;
 		}
 		break;
@@ -2331,7 +2341,9 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 	default:                /* eLIM_UNKNOWN_ROLE */
 		pe_err("received unexpected SME_DISASSOC_CNF role %d",
 			GET_LIM_SYSTEM_ROLE(psessionEntry));
-
+		lim_send_disconnect_done_ind(pMac, psessionEntry, sessionId,
+					     eSIR_SME_INVALID_STATE,
+					     smeDisassocCnf.bssid.bytes);
 		return;
 	}
 
@@ -2345,6 +2357,10 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 			pe_err("DISASSOC_CNF for a STA with no context, addr= "
 				MAC_ADDRESS_STR,
 				MAC_ADDR_ARRAY(smeDisassocCnf.peer_macaddr.bytes));
+			lim_send_disconnect_done_ind(pMac, psessionEntry,
+						sessionId,
+						eSIR_SME_INVALID_PARAMETERS,
+						smeDisassocCnf.bssid.bytes);
 			return;
 		}
 
@@ -2355,6 +2371,9 @@ static void __lim_process_sme_disassoc_cnf(tpAniSirGlobal pMac, uint32_t *pMsgBu
 			pe_err("No need of cleanup for addr:" MAC_ADDRESS_STR "as MLM state is %d",
 				MAC_ADDR_ARRAY(smeDisassocCnf.peer_macaddr.bytes),
 				pStaDs->mlmStaContext.mlmState);
+			lim_send_disconnect_done_ind(pMac, NULL,
+						     CSR_SESSION_ID_INVALID,
+						     eSIR_SME_SUCCESS, NULL);
 			return;
 		}
 

core/mac/src/pe/lim/lim_send_sme_rsp_messages.c

@@ -806,7 +806,6 @@ lim_send_sme_disassoc_ntf(tpAniSirGlobal pMac,
 	tpPESession session = NULL;
 	uint16_t i, assoc_id;
 	tpDphHashNode sta_ds = NULL;
-	struct sir_sme_discon_done_ind *sir_sme_dis_ind;
 
 	pe_debug("Disassoc Ntf with trigger : %d reasonCode: %d",
 		disassocTrigger, reasonCode);
@@ -894,37 +893,9 @@ lim_send_sme_disassoc_ntf(tpAniSirGlobal pMac,
 
 	case eLIM_PEER_ENTITY_DISASSOC:
 	case eLIM_LINK_MONITORING_DISASSOC:
-		sir_sme_dis_ind =
-			qdf_mem_malloc(sizeof(*sir_sme_dis_ind));
-		if (!sir_sme_dis_ind) {
-			pe_err("call to AllocateMemory failed for disconnect indication");
-			return;
-		}
-
-		pe_debug("send  eWNI_SME_DISCONNECT_DONE_IND with retCode: %d",
-				reasonCode);
-
-		sir_sme_dis_ind->message_type =
-			eWNI_SME_DISCONNECT_DONE_IND;
-		sir_sme_dis_ind->length =
-			sizeof(*sir_sme_dis_ind);
-		qdf_mem_copy(sir_sme_dis_ind->peer_mac, peerMacAddr,
-			     sizeof(tSirMacAddr));
-		sir_sme_dis_ind->session_id   = smesessionId;
-		sir_sme_dis_ind->reason_code  = reasonCode;
-		/*
-		 * Instead of sending deauth reason code as 505 which is
-		 * internal value(eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
-		 * Send reason code as zero to Supplicant
-		 */
-		if (reasonCode == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
-			sir_sme_dis_ind->reason_code = 0;
-		else
-			sir_sme_dis_ind->reason_code = reasonCode;
-
-		pMsg = (uint32_t *)sir_sme_dis_ind;
-
-		break;
+		lim_send_disconnect_done_ind(pMac, psessionEntry, smesessionId,
+					     reasonCode, peerMacAddr);
+		return;
 
 	default:
 		/**
@@ -1191,6 +1162,51 @@ lim_send_sme_mgmt_tx_completion(tpAniSirGlobal pMac,
 
 #endif /* FEATURE_WLAN_TDLS */
 
+void lim_send_disconnect_done_ind(tpAniSirGlobal mac_ctx,
+				  tpPESession session_entry, uint8_t session_id,
+				  tSirResultCodes reason_code,
+				  tSirMacAddr peer_mac_addr)
+{
+	struct sir_sme_discon_done_ind *sir_sme_dis_ind;
+	uint32_t *msg;
+
+	sir_sme_dis_ind =
+		qdf_mem_malloc(sizeof(*sir_sme_dis_ind));
+	if (!sir_sme_dis_ind) {
+		pe_err("call to AllocateMemory failed for disconnect indication");
+		return;
+	}
+
+	pe_debug("send eWNI_SME_DISCONNECT_DONE_IND withretCode: %d",
+		 reason_code);
+
+	sir_sme_dis_ind->message_type =
+		eWNI_SME_DISCONNECT_DONE_IND;
+	sir_sme_dis_ind->length =
+		sizeof(*sir_sme_dis_ind);
+	sir_sme_dis_ind->session_id = session_id;
+	qdf_mem_copy(sir_sme_dis_ind->peer_mac, peer_mac_addr,
+		     ETH_ALEN);
+	/*
+	 * Instead of sending deauth reason code as 505 which is
+	 * internal value(eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
+	 * Send reason code as zero to Supplicant
+	 */
+	if (reason_code == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
+		sir_sme_dis_ind->reason_code = 0;
+	else
+		sir_sme_dis_ind->reason_code = reason_code;
+
+	msg = (uint32_t *)sir_sme_dis_ind;
+
+	/*Delete the PE session  created */
+	if (session_entry)
+		pe_delete_session(mac_ctx, session_entry);
+
+	lim_send_sme_disassoc_deauth_ntf(mac_ctx, QDF_STATUS_SUCCESS,
+					 (uint32_t *)msg);
+}
+
 /**
  * lim_send_sme_deauth_ntf()
  *
@@ -1230,7 +1246,6 @@ lim_send_sme_deauth_ntf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr,
 	tpPESession psessionEntry;
 	uint8_t sessionId;
 	uint32_t *pMsg;
-	struct sir_sme_discon_done_ind *sir_sme_dis_ind;
 
 	psessionEntry = pe_find_session_by_bssid(pMac, peerMacAddr, &sessionId);
 	switch (deauthTrigger) {
@@ -1266,38 +1281,9 @@ lim_send_sme_deauth_ntf(tpAniSirGlobal pMac, tSirMacAddr peerMacAddr,
 
 	case eLIM_PEER_ENTITY_DEAUTH:
 	case eLIM_LINK_MONITORING_DEAUTH:
-		sir_sme_dis_ind =
-			qdf_mem_malloc(sizeof(*sir_sme_dis_ind));
-		if (!sir_sme_dis_ind) {
-			pe_err("call to AllocateMemory failed for disconnect indication");
-			return;
-		}
-
-		pe_debug("send eWNI_SME_DISCONNECT_DONE_IND withretCode: %d",
-				reasonCode);
-
-		sir_sme_dis_ind->message_type =
-			eWNI_SME_DISCONNECT_DONE_IND;
-		sir_sme_dis_ind->length =
-			sizeof(*sir_sme_dis_ind);
-		sir_sme_dis_ind->session_id = smesessionId;
-		sir_sme_dis_ind->reason_code = reasonCode;
-		qdf_mem_copy(sir_sme_dis_ind->peer_mac, peerMacAddr,
-			 ETH_ALEN);
-		/*
-		 * Instead of sending deauth reason code as 505 which is
-		 * internal value(eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
-		 * Send reason code as zero to Supplicant
-		 */
-		if (reasonCode == eSIR_SME_LOST_LINK_WITH_PEER_RESULT_CODE)
-			sir_sme_dis_ind->reason_code = 0;
-		else
-			sir_sme_dis_ind->reason_code = reasonCode;
-
-		pMsg = (uint32_t *)sir_sme_dis_ind;
-
-		break;
-
+		lim_send_disconnect_done_ind(pMac, psessionEntry, smesessionId,
+					     reasonCode, peerMacAddr);
+		return;
 	default:
 		/**
 		 * Deauthentication indication due to Deauthentication

core/mac/src/pe/lim/lim_send_sme_rsp_messages.h

@@ -44,6 +44,10 @@ void lim_send_sme_start_bss_rsp(tpAniSirGlobal, uint16_t, tSirResultCodes,
 				tpPESession, uint8_t, uint16_t);
 void lim_send_sme_join_reassoc_rsp(tpAniSirGlobal, uint16_t, tSirResultCodes,
 				   uint16_t, tpPESession, uint8_t, uint16_t);
+void lim_send_disconnect_done_ind(tpAniSirGlobal mac_ctx,
+				  tpPESession session_entry, uint8_t session_id,
+				  tSirResultCodes reason_code,
+				  tSirMacAddr peer_mac_addr);
 void lim_send_sme_disassoc_ntf(tpAniSirGlobal, tSirMacAddr, tSirResultCodes,
 			       uint16_t, uint16_t, uint8_t, uint16_t, tpPESession);
 void lim_send_sme_deauth_ntf(tpAniSirGlobal, tSirMacAddr, tSirResultCodes, uint16_t,

core/sme/inc/sme_inside.h

@@ -199,6 +199,20 @@ bool qos_process_command(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 void qos_release_command(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 QDF_STATUS csr_process_scan_command(tpAniSirGlobal pMac, tSmeCmd *pCommand);
 QDF_STATUS csr_roam_process_command(tpAniSirGlobal pMac, tSmeCmd *pCommand);
+
+/**
+ * csr_roam_wm_status_change_complete() - Remove WM status change command
+ *                                        from SME active command list
+ * @mac_ctx: global mac context
+ * @session_id: session id
+ *
+ * This API removes WM status change command from SME active command list
+ * if present.
+ *
+ * Return: void
+ */
+void csr_roam_wm_status_change_complete(tpAniSirGlobal mac_ctx,
+					uint8_t session_id);
 void csr_roam_process_wm_status_change_command(tpAniSirGlobal pMac,
 		tSmeCmd *pCommand);
 void csr_reinit_roam_cmd(tpAniSirGlobal pMac, tSmeCmd *pCommand);

core/sme/src/csr/csr_api_roam.c

@@ -11724,6 +11724,12 @@ csr_roam_send_disconnect_done_indication(tpAniSirGlobal mac_ctx, tSirSmeRsp
 	} else
 		sme_err("Inactive session %d",
 			discon_ind->session_id);
+
+	/*
+	 * Release WM status change command as eWNI_SME_DISCONNECT_DONE_IND
+	 * has been sent to HDD and there is nothing else left to do.
+	 */
+	csr_roam_wm_status_change_complete(mac_ctx, discon_ind->session_id);
 }
 
 static void
@@ -13036,8 +13042,8 @@ QDF_STATUS csr_roam_lost_link(tpAniSirGlobal pMac, uint32_t sessionId,
 }
 
 
-static void csr_roam_wm_status_change_complete(tpAniSirGlobal pMac,
-						uint8_t session_id)
+void csr_roam_wm_status_change_complete(tpAniSirGlobal pMac,
+					uint8_t session_id)
 {
 	tListElem *pEntry;
 	tSmeCmd *pCommand;
@@ -13076,7 +13082,7 @@ void csr_roam_process_wm_status_change_command(
 
 	if (!pSession) {
 		sme_err("session %d not found", pCommand->sessionId);
-		return;
+		goto end;
 	}
 	sme_debug("session:%d, CmdType : %d",
 		pCommand->sessionId, pCommand->u.wmStatusChangeCmd.Type);
@@ -13103,10 +13109,15 @@ void csr_roam_process_wm_status_change_command(
 			pCommand->u.wmStatusChangeCmd.Type);
 		break;
 	}
-	/* Lost Link just triggers a roaming sequence.  We can complte the
-	 * Lost Link command here since there is nothing else to do.
-	 */
-	csr_roam_wm_status_change_complete(pMac, pCommand->sessionId);
+
+end:
+	if (status != QDF_STATUS_SUCCESS) {
+		/*
+		 * As status returned is not success, there is nothing else
+		 * left to do so release WM status change command here.
+		 */
+		csr_roam_wm_status_change_complete(pMac, pCommand->sessionId);
+	}
 }