Currently error BAR frames are routed to host, but host
doesn't have complete information to check whether these
frames are valid and really action need to be taken or not.
If host updates H.W without validating SSN it is causing
window movement and REO HW aging timeout happening for
next set of RX packets and delay is induced.
To avoid RX packets delay skipping BAR update to H.W
Change-Id: I92c1614993b6985218a453fe528fbd274fab254f
CRs-Fixed: 2995461
Add changes to register separate function pointer to receive EAPOL
frames instead of using regular RX path and adding export symbol
for __qdf_nbuf_data_get_eapol_subtype() to access in it multiple
modules
Change-Id: Id05b982d31a7e008536d10dd5281e88cceba96db
Host updates BAR info to H.W when out of order or 2K jump
BAR frame is received. But some AP's frequently transmitting
out of order BAR frames even before reception of all the
frames in the current window, if station updates window
and SSN based on BAR frame, RX frames sequence number in
older window range which are yet to be received suffers
REO aging timeout and causes RX packet delay to avoid
this skipping BAR update to H.W conditionally.
Change-Id: If56571ffc0dc0880d7104ea3bb193ed9766124dd
CRs-Fixed: 3015643
In WBM error path, add handling for packets received with
rxdma_psh_rsn as rxdma_rx_flush. Also add assert for packets
received with an invalid push reason.
Change-Id: I4e445d52f00bbbdca358225aef488da0e8dccaa7
CRs-Fixed: 2978262
PATCH[7/7]:
This patch consists following changes:
-Conditionally compile all monitor destination ring related code
Macro used QCA_MONITOR_PKT_SUPPORT
-Add QCA_ENHANCED_STATS_SUPPORT macro to conditionally compile
enhanced stats support
-Use QCA_MCOPY_SUPPORT and QCA_TX_CAPTURE_SUPPORT macros
to conditionally compile MCOPY and Tx capture features
respectively
-Use QCN_IE macro to conditionally compile BPR
feature
-Use QCA_ADVANCE_MON_FILTER_SUPPORT macro to conditionally
compile advance monitor filter feature
-Fix vdev attach issue for special and smart monitor vap
-Fix status ring initialization issue.
Change-Id: I0deaa28a9a54bf34b0f41e6dd510fdd8d4992db2
CRs-Fixed: 2983780
PATCH[6/7]:
This patch consists following changes:
-Move monitor related pdev variables to struct dp_mon_pdev
-Move monitor relted soc variables to struct dp_mon_soc
-Move cookie to monitor link desc va to monitor file
-Add APIs to access monitor related variables
-Add dummy APIs to build without monitor support.
Change-Id: I032a480b1383d061f984cee3ba6b10ac7a0ff350
CRs-Fixed: 2983781
The existing assertions for unmapped variable in
rx descriptor results in an undesired bug_on since
the unmapped value is 0 for active descriptors.
The fix is to modify this assertion so that bug_on will
be triggered only if the unmapped value is 1 in rx
desc.
Change-Id: I03b27e0e42ce3c42b9fa148da9258063b0209b08
CRs-Fixed: 2985248
Add CDP reason code support for sending DELBA request,
so protocol layer can make decisions for special cases.
Change-Id: I4e4b2e7f7232a8ab12d4c7838f97908f481dc787
CRs-Fixed: 2983553
When host receives BAR frames with OOR/2K jump in sequence
number it updates REO HW with new starting sequence number
and requests F.W to setup peer reorder queue. But REORDER_QUEUE_SETUP
is already requested to F.W as part of initial add BA in host.
So while handling OOR/2K jump BAR frames don't send
REORDER_QUEUE_SETUP to F.W
Change-Id: Idc3657e901dc792f699b53c45e4ae5133d286891
CRs-Fixed: 2981280
Error log peer not found is coming spurious in
dp_2k_jump_handle on continuous error pkts, so
rate limit the same.
Change-Id: If4b577a7759136ea824ca62b63ef91d102b8decb
CRs-Fixed: 2978939
For certain wlan chips, eg WCN7850, all the REO error
codes are routed to the APPS core and none are handled
by the firmware.
Add support to handle all the REO errors. Currently for
all the newly handled REO errors, the packet is dropped
and the corresponding link descriptor is returned to the WBM.
Change-Id: I94f3afcbfc129befcb94db2dea855151bf8114f1
CRs-Fixed: 2965087
Currently the detection of whether a frame arriving on the
rx-error ring is done via the flags in the ring descriptor.
For targets which support providing previous PN in the
rx-error ring descriptor, the flags indicating BAR frame
will not be present in the ring descriptor.
Add BAR frame check and handling in the OOR and 2K-jump
frame processing handlers.
Change-Id: Iaba763559a84f1c1f6a193e01945124f08c506f2
CRs-Fixed: 2965086
Currently the EAPOL/ARP/DHCP frames arriving as 2K-jump
or out-of-order frmaes are being delivered to the network
stack, without checking for the packet-number sequence.
WCN7850 has hardware support to provide the packet number
of the previous successful re-ordered packet from hardware.
Use this feature to check if the packet-number are in proper
sequence for these EAPOL/ARP/DHCP packets arriving as 2k-jump
or out-of-order packets before submitting it to the network
stack.
Change-Id: I1078452afce4bc00b2509436295e5bd80000feb4
CRs-Fixed: 2965086
Currently the error_code is not passed as an argument
for BAR frame handling. Due to this, if a BAR frame is
received which is OOR or 2K-jump frame, then the sequence
number from the BAR frame is not programmed to the REO.
This can eventually lead to failure in re-ordering of
the subsequent data frames.
Pass the proper error code for BAR frame handling.
Change-Id: I0ea01a3c9bb9c77923e88a5b742ff2dd974c8483
CRs-Fixed: 2965086
CVE-2020-26139
With the CCE changes, EAPOL frames now arrive at
the wbm error ring with the push reason as route.
These frames need to be indicated to the stack.
Any other incoming frame with this reason code
needs to dropped.
Change-Id: I66df0b53a36d99b3e9d9000e0bd93bf7677c221d
Currently dp_rx_err_process expects ring descriptor to be only
LINK_DESC_TYPE. In certain cases BUF_ADDR_TYPE ring descriptor is
observed in reo_exception ring. Add logic to handle the same.
Change-Id: I5baecc3f8eafc0830672b91bc9d9607b568a6cda
CRs-Fixed: 2954653
Revert "qcacmn: drop duplicated EAP frames from REO exception path",
allow all EAP frame delivering to stack including retried ones.
Change-Id: I73733841c1feb21d5b5fd160856a8fe9c21168fc
CRs-Fixed: 2959701
When handling RXDMA error marked frames that from MAC1,
wrong rx descriptor pool is referenced, so allocated
buffer length is incorrect and lead to skb crash. Make
changes to always uses mac0 rx descriptor pool for MCL
platform.
Change-Id: Ica01c3967d6248a23ea745da63149dae9cd56677
CRs-Fixed: 2945573
IPA unmapping is skipped for WBM internal error case,
do IPA unmapping for rx buffer received in WBM error case.
While reinjecting RX buffer back to REO, software rx desc
unmapped field is not set in sequence which may lead to
map without unmap error in IPA module. So reset the unmapped
filed after IPA mapping is complete.
Change-Id: I42c1eaa1620f975d47ce2938c95b6b89dbbd3eca
CRs-Fixed: 2952671
While Rx buffers are getting umapped from net rx context if IPA
pipes are enabled at same time from MC thread context this is
leading to race condition and IPA map/unmap is going out of sync.
To fix this introducing IPA mapping lock and IPA mapping need to
be handled with lock held.
Change-Id: I9fa71bdb6d4e4aa93fc795cc5dd472a181325991
CRs-Fixed: 2945063
add ssn_updates_count to dp_soc_stats rx err stats.
Also add bar fail count on rx tid update during
bar handling.
Change-Id: Ic9a963c8d29ace2087e63cba56bc0d7e40907e1a
CRs-Fixed: 2918806
Add iwpriv option 34 to dump the reo rx h/w descs
in DDR for debugging. This cmd will first send cache
flush cmd to REO for all rx tids and invalidate the h/w
cache. Henceforth ensuring that the reo status tlvs and
the DDR values are in sync.
iwpriv wlan0 txrx_stats 34 0
Add fix to ensure bar frame with 2k jump err code is
processed correctly using the REO error code instead of the
REO push reason.
Change-Id: Ia05be668343f3a5d4b3262b8d6a367a50875add5
CRs-Fixed: 2895965
Same cookie was provided in REO srng and REO exception
ring. As a result, NULL pointer dereference occurred in
dp_rx_reo_err_entry_process.
To fix this, adding nbuf paddr sanity check in
function dp_rx_reo_err_entry_process.
CRs-Fixed: 2892345
Change-Id: Ie359921d8a270a3428b8286792941e84b0c68425
The bridge forwards the multicast packets to all the
interfaces attached the bridge.
When the STA network interface receives such packets
from bridge and send it to the AP, it is echoed back
from the BSS.
These packets are not intended for the bridge as it
will lead to looping.
Add a check to detect and drop such packets when
received back from the BSS.
Refactor dp_rx_mcast_echo_check function to fix
compilation errors from the above change.
CRs-Fixed: 2894272
Change-Id: I3f9e92c3598af11d3ff4e6b9b8afbc4110a926fc
As a software WAR for hardware issue where we are
getting wrong cookie value for a buffer which is already
mapped to another rx_desc with different cookie id and
is already has in_use bit set, we will skip the
processing for the current rx_desc when in_use bit
is not set.
Change-Id: I9f469bf1f4b03e0fb9a6694d9445a0c690224ccb
CVE-2020-26139
With the CCE changes, EAPOL frames will now come in
wbm error ring as push reason route. These frames need to
be indicated to stack. Any other frame coming with this
reason code needs to dropped.
Change-Id: I66df0b53a36d99b3e9d9000e0bd93bf7677c221d
Low memory profiles like 256M and 16M profiles support
only NSS Wi-Fi offload mode and HOST data path APIs are
not used in NSS offload mode
Disable HOST data path APIs which are not used in both
NSS Wi-Fi offload mode and in HOST mode (in NSS offload mode)
CRs-Fixed: 2831478
Change-Id: I6895054a6c96bd446c2df7761ce65feef662a3cc
Add drop statistics for duplicate EAPOL frames received
in the REO exception ring as OOR frames. This will help
understand if EAPOL frames are getting dropped which could
cause connection issues.
Change-Id: Ib9d5a3c04ce6638c65166f02261af5c526cc47eb
CRs-Fixed: 2814633
If a continuation bit is set in msdu desc info and reported
length can fit in single buffer avoid SG processing
Change-Id: I6e8c3e1e657c372d5d915450dda20ba26bac495f
Only BAR frames with REO/RXDMA push reason as error are handled
in host. FP BAR frames without errors, are routed to host
via REO/RXDMA with push reason as route.
Instead of leaking the buffer, handle the routed BAR frames
gracefully. Free the buffer and log stats to detect such
cases.
Change-Id: I6e09e8b948d9b2d9d3de3b6558e54f0c70901c62
CRs-Fixed: 2814303
Due to recent FW changes not filtering out BAR frames, redirect these
frames to REO exception ring and handle as normal data packets.
Change-Id: I4540929fddab14de57a23f6364fc916a70057cbe
CRs-Fixed: 2795499
For REO error 7 OOR frame, if they are retry frame under BA
session, then they are likely SN duplicated frame. if deliver
EAPOL to stack in this case, sometimes it will fail to connect
AP as duplicated TX EAP response is seen.
Drop duplicated EAP frames in this case.
Change-Id: Iec0ba37548f2a83fe749f83ec904ec9bfdb306af
CRs-Fixed: 2796226
MSDU count is not reliable in all cases.Hence it is better
to check whether next_link_desc is valid or not and then
free the MSDUs in the next descriptor and subsequently
release both the current and next link descriptor back to HW.
Change-Id: Ie5ea3be547f9aed6673293221f6b47661cd92cce
