The existing assertions for unmapped variable in
rx descriptor results in an undesired bug_on since
the unmapped value is 0 for active descriptors.
The fix is to modify this assertion so that bug_on will
be triggered only if the unmapped value is 1 in rx
desc.
Change-Id: I03b27e0e42ce3c42b9fa148da9258063b0209b08
CRs-Fixed: 2985248
Add CDP reason code support for sending DELBA request,
so protocol layer can make decisions for special cases.
Change-Id: I4e4b2e7f7232a8ab12d4c7838f97908f481dc787
CRs-Fixed: 2983553
When host receives BAR frames with OOR/2K jump in sequence
number it updates REO HW with new starting sequence number
and requests F.W to setup peer reorder queue. But REORDER_QUEUE_SETUP
is already requested to F.W as part of initial add BA in host.
So while handling OOR/2K jump BAR frames don't send
REORDER_QUEUE_SETUP to F.W
Change-Id: Idc3657e901dc792f699b53c45e4ae5133d286891
CRs-Fixed: 2981280
Error log peer not found is coming spurious in
dp_2k_jump_handle on continuous error pkts, so
rate limit the same.
Change-Id: If4b577a7759136ea824ca62b63ef91d102b8decb
CRs-Fixed: 2978939
For certain wlan chips, eg WCN7850, all the REO error
codes are routed to the APPS core and none are handled
by the firmware.
Add support to handle all the REO errors. Currently for
all the newly handled REO errors, the packet is dropped
and the corresponding link descriptor is returned to the WBM.
Change-Id: I94f3afcbfc129befcb94db2dea855151bf8114f1
CRs-Fixed: 2965087
Currently the detection of whether a frame arriving on the
rx-error ring is done via the flags in the ring descriptor.
For targets which support providing previous PN in the
rx-error ring descriptor, the flags indicating BAR frame
will not be present in the ring descriptor.
Add BAR frame check and handling in the OOR and 2K-jump
frame processing handlers.
Change-Id: Iaba763559a84f1c1f6a193e01945124f08c506f2
CRs-Fixed: 2965086
Currently the EAPOL/ARP/DHCP frames arriving as 2K-jump
or out-of-order frmaes are being delivered to the network
stack, without checking for the packet-number sequence.
WCN7850 has hardware support to provide the packet number
of the previous successful re-ordered packet from hardware.
Use this feature to check if the packet-number are in proper
sequence for these EAPOL/ARP/DHCP packets arriving as 2k-jump
or out-of-order packets before submitting it to the network
stack.
Change-Id: I1078452afce4bc00b2509436295e5bd80000feb4
CRs-Fixed: 2965086
Currently the error_code is not passed as an argument
for BAR frame handling. Due to this, if a BAR frame is
received which is OOR or 2K-jump frame, then the sequence
number from the BAR frame is not programmed to the REO.
This can eventually lead to failure in re-ordering of
the subsequent data frames.
Pass the proper error code for BAR frame handling.
Change-Id: I0ea01a3c9bb9c77923e88a5b742ff2dd974c8483
CRs-Fixed: 2965086
CVE-2020-26139
With the CCE changes, EAPOL frames now arrive at
the wbm error ring with the push reason as route.
These frames need to be indicated to the stack.
Any other incoming frame with this reason code
needs to dropped.
Change-Id: I66df0b53a36d99b3e9d9000e0bd93bf7677c221d
Currently dp_rx_err_process expects ring descriptor to be only
LINK_DESC_TYPE. In certain cases BUF_ADDR_TYPE ring descriptor is
observed in reo_exception ring. Add logic to handle the same.
Change-Id: I5baecc3f8eafc0830672b91bc9d9607b568a6cda
CRs-Fixed: 2954653
Revert "qcacmn: drop duplicated EAP frames from REO exception path",
allow all EAP frame delivering to stack including retried ones.
Change-Id: I73733841c1feb21d5b5fd160856a8fe9c21168fc
CRs-Fixed: 2959701
When handling RXDMA error marked frames that from MAC1,
wrong rx descriptor pool is referenced, so allocated
buffer length is incorrect and lead to skb crash. Make
changes to always uses mac0 rx descriptor pool for MCL
platform.
Change-Id: Ica01c3967d6248a23ea745da63149dae9cd56677
CRs-Fixed: 2945573
IPA unmapping is skipped for WBM internal error case,
do IPA unmapping for rx buffer received in WBM error case.
While reinjecting RX buffer back to REO, software rx desc
unmapped field is not set in sequence which may lead to
map without unmap error in IPA module. So reset the unmapped
filed after IPA mapping is complete.
Change-Id: I42c1eaa1620f975d47ce2938c95b6b89dbbd3eca
CRs-Fixed: 2952671
While Rx buffers are getting umapped from net rx context if IPA
pipes are enabled at same time from MC thread context this is
leading to race condition and IPA map/unmap is going out of sync.
To fix this introducing IPA mapping lock and IPA mapping need to
be handled with lock held.
Change-Id: I9fa71bdb6d4e4aa93fc795cc5dd472a181325991
CRs-Fixed: 2945063
add ssn_updates_count to dp_soc_stats rx err stats.
Also add bar fail count on rx tid update during
bar handling.
Change-Id: Ic9a963c8d29ace2087e63cba56bc0d7e40907e1a
CRs-Fixed: 2918806
Add iwpriv option 34 to dump the reo rx h/w descs
in DDR for debugging. This cmd will first send cache
flush cmd to REO for all rx tids and invalidate the h/w
cache. Henceforth ensuring that the reo status tlvs and
the DDR values are in sync.
iwpriv wlan0 txrx_stats 34 0
Add fix to ensure bar frame with 2k jump err code is
processed correctly using the REO error code instead of the
REO push reason.
Change-Id: Ia05be668343f3a5d4b3262b8d6a367a50875add5
CRs-Fixed: 2895965
Same cookie was provided in REO srng and REO exception
ring. As a result, NULL pointer dereference occurred in
dp_rx_reo_err_entry_process.
To fix this, adding nbuf paddr sanity check in
function dp_rx_reo_err_entry_process.
CRs-Fixed: 2892345
Change-Id: Ie359921d8a270a3428b8286792941e84b0c68425
The bridge forwards the multicast packets to all the
interfaces attached the bridge.
When the STA network interface receives such packets
from bridge and send it to the AP, it is echoed back
from the BSS.
These packets are not intended for the bridge as it
will lead to looping.
Add a check to detect and drop such packets when
received back from the BSS.
Refactor dp_rx_mcast_echo_check function to fix
compilation errors from the above change.
CRs-Fixed: 2894272
Change-Id: I3f9e92c3598af11d3ff4e6b9b8afbc4110a926fc
As a software WAR for hardware issue where we are
getting wrong cookie value for a buffer which is already
mapped to another rx_desc with different cookie id and
is already has in_use bit set, we will skip the
processing for the current rx_desc when in_use bit
is not set.
Change-Id: I9f469bf1f4b03e0fb9a6694d9445a0c690224ccb
CVE-2020-26139
With the CCE changes, EAPOL frames will now come in
wbm error ring as push reason route. These frames need to
be indicated to stack. Any other frame coming with this
reason code needs to dropped.
Change-Id: I66df0b53a36d99b3e9d9000e0bd93bf7677c221d
Low memory profiles like 256M and 16M profiles support
only NSS Wi-Fi offload mode and HOST data path APIs are
not used in NSS offload mode
Disable HOST data path APIs which are not used in both
NSS Wi-Fi offload mode and in HOST mode (in NSS offload mode)
CRs-Fixed: 2831478
Change-Id: I6895054a6c96bd446c2df7761ce65feef662a3cc
Add drop statistics for duplicate EAPOL frames received
in the REO exception ring as OOR frames. This will help
understand if EAPOL frames are getting dropped which could
cause connection issues.
Change-Id: Ib9d5a3c04ce6638c65166f02261af5c526cc47eb
CRs-Fixed: 2814633
If a continuation bit is set in msdu desc info and reported
length can fit in single buffer avoid SG processing
Change-Id: I6e8c3e1e657c372d5d915450dda20ba26bac495f
Only BAR frames with REO/RXDMA push reason as error are handled
in host. FP BAR frames without errors, are routed to host
via REO/RXDMA with push reason as route.
Instead of leaking the buffer, handle the routed BAR frames
gracefully. Free the buffer and log stats to detect such
cases.
Change-Id: I6e09e8b948d9b2d9d3de3b6558e54f0c70901c62
CRs-Fixed: 2814303
Due to recent FW changes not filtering out BAR frames, redirect these
frames to REO exception ring and handle as normal data packets.
Change-Id: I4540929fddab14de57a23f6364fc916a70057cbe
CRs-Fixed: 2795499
For REO error 7 OOR frame, if they are retry frame under BA
session, then they are likely SN duplicated frame. if deliver
EAPOL to stack in this case, sometimes it will fail to connect
AP as duplicated TX EAP response is seen.
Drop duplicated EAP frames in this case.
Change-Id: Iec0ba37548f2a83fe749f83ec904ec9bfdb306af
CRs-Fixed: 2796226
MSDU count is not reliable in all cases.Hence it is better
to check whether next_link_desc is valid or not and then
free the MSDUs in the next descriptor and subsequently
release both the current and next link descriptor back to HW.
Change-Id: Ie5ea3be547f9aed6673293221f6b47661cd92cce
Skip the recording of rx error ring and rx reinject
history if the memory allocation for the history
fails during the attach.
Change-Id: Ifa74937d0c37e6013ccaec851dab7d9e53057ac2
CRs-Fixed: 2767579
Remove the peer backpointer in ast entry and store
peer_id instead
Assign peer_id in AST entry in AST MAP event,
also add the ast entry to peers ast list
In AST map & AST unmap APIs use ast find by vdev_id
Change-Id: I74d9828dc309149d98f6f577b5c8304cb087fd76
Add support to get the peer reference with module id
To help debug the peer reference related issues
Change-Id: Ie20c7e710b9784b52f2e0f3d7488509282528a00
Use unified version of dp_peer_find_by_id API
which will take peer reference
Also use unified peer ref release API dp_peer_unref_delete
Change-Id: Ibb516a933020a42a5584dbbbba59f8d9b72dcaa4
We have come across scenarios where rxdma is pushing
a certain entry more than once to the reo exception
ring. In this scenario, when we try to unmap a buffer,
it can lead to multiple unmap of the same buffer.
Handle this case, by skipping the process of this
duplicate entry, if alrady unmapped, and proceed to the
next entry.
Change-Id: Iae66f27e432f795ba4730911029fa1d63a75cb06
CRs-Fixed: 2739176
Same back to back link descriptor address/cookie is observed in
WBM idle link desc ring.
add duplicate link desc check when host
refill link descriptor to WBM through SW2WBM release ring,
also REO reinject ring.
Change-Id: Iaf9defd87670776fa9488d7f650efa3c08fefa60
CRs-Fixed: 2739879
The rx rings are relatively of smaller size. Any
duplicate entry sent by hardware cannot be back-tracked
by just looking at the ring contents alone.
Hence add a history to track the entries for the
REO2SW, REO exception and SW2REO ring.
Change-Id: I9b0b311950d60a9421378ce0fcc0535be450f713
CRs-Fixed: 2739181
