When handling RXDMA error marked frames that from MAC1,
wrong rx descriptor pool is referenced, so allocated
buffer length is incorrect and lead to skb crash. Make
changes to always uses mac0 rx descriptor pool for MCL
platform.
Change-Id: Ica01c3967d6248a23ea745da63149dae9cd56677
CRs-Fixed: 2945573
IPA unmapping is skipped for WBM internal error case,
do IPA unmapping for rx buffer received in WBM error case.
While reinjecting RX buffer back to REO, software rx desc
unmapped field is not set in sequence which may lead to
map without unmap error in IPA module. So reset the unmapped
filed after IPA mapping is complete.
Change-Id: I42c1eaa1620f975d47ce2938c95b6b89dbbd3eca
CRs-Fixed: 2952671
While Rx buffers are getting umapped from net rx context if IPA
pipes are enabled at same time from MC thread context this is
leading to race condition and IPA map/unmap is going out of sync.
To fix this introducing IPA mapping lock and IPA mapping need to
be handled with lock held.
Change-Id: I9fa71bdb6d4e4aa93fc795cc5dd472a181325991
CRs-Fixed: 2945063
add ssn_updates_count to dp_soc_stats rx err stats.
Also add bar fail count on rx tid update during
bar handling.
Change-Id: Ic9a963c8d29ace2087e63cba56bc0d7e40907e1a
CRs-Fixed: 2918806
Add iwpriv option 34 to dump the reo rx h/w descs
in DDR for debugging. This cmd will first send cache
flush cmd to REO for all rx tids and invalidate the h/w
cache. Henceforth ensuring that the reo status tlvs and
the DDR values are in sync.
iwpriv wlan0 txrx_stats 34 0
Add fix to ensure bar frame with 2k jump err code is
processed correctly using the REO error code instead of the
REO push reason.
Change-Id: Ia05be668343f3a5d4b3262b8d6a367a50875add5
CRs-Fixed: 2895965
Same cookie was provided in REO srng and REO exception
ring. As a result, NULL pointer dereference occurred in
dp_rx_reo_err_entry_process.
To fix this, adding nbuf paddr sanity check in
function dp_rx_reo_err_entry_process.
CRs-Fixed: 2892345
Change-Id: Ie359921d8a270a3428b8286792941e84b0c68425
The bridge forwards the multicast packets to all the
interfaces attached the bridge.
When the STA network interface receives such packets
from bridge and send it to the AP, it is echoed back
from the BSS.
These packets are not intended for the bridge as it
will lead to looping.
Add a check to detect and drop such packets when
received back from the BSS.
Refactor dp_rx_mcast_echo_check function to fix
compilation errors from the above change.
CRs-Fixed: 2894272
Change-Id: I3f9e92c3598af11d3ff4e6b9b8afbc4110a926fc
As a software WAR for hardware issue where we are
getting wrong cookie value for a buffer which is already
mapped to another rx_desc with different cookie id and
is already has in_use bit set, we will skip the
processing for the current rx_desc when in_use bit
is not set.
Change-Id: I9f469bf1f4b03e0fb9a6694d9445a0c690224ccb
CVE-2020-26139
With the CCE changes, EAPOL frames will now come in
wbm error ring as push reason route. These frames need to
be indicated to stack. Any other frame coming with this
reason code needs to dropped.
Change-Id: I66df0b53a36d99b3e9d9000e0bd93bf7677c221d
Low memory profiles like 256M and 16M profiles support
only NSS Wi-Fi offload mode and HOST data path APIs are
not used in NSS offload mode
Disable HOST data path APIs which are not used in both
NSS Wi-Fi offload mode and in HOST mode (in NSS offload mode)
CRs-Fixed: 2831478
Change-Id: I6895054a6c96bd446c2df7761ce65feef662a3cc
Add drop statistics for duplicate EAPOL frames received
in the REO exception ring as OOR frames. This will help
understand if EAPOL frames are getting dropped which could
cause connection issues.
Change-Id: Ib9d5a3c04ce6638c65166f02261af5c526cc47eb
CRs-Fixed: 2814633
If a continuation bit is set in msdu desc info and reported
length can fit in single buffer avoid SG processing
Change-Id: I6e8c3e1e657c372d5d915450dda20ba26bac495f
Only BAR frames with REO/RXDMA push reason as error are handled
in host. FP BAR frames without errors, are routed to host
via REO/RXDMA with push reason as route.
Instead of leaking the buffer, handle the routed BAR frames
gracefully. Free the buffer and log stats to detect such
cases.
Change-Id: I6e09e8b948d9b2d9d3de3b6558e54f0c70901c62
CRs-Fixed: 2814303
Due to recent FW changes not filtering out BAR frames, redirect these
frames to REO exception ring and handle as normal data packets.
Change-Id: I4540929fddab14de57a23f6364fc916a70057cbe
CRs-Fixed: 2795499
For REO error 7 OOR frame, if they are retry frame under BA
session, then they are likely SN duplicated frame. if deliver
EAPOL to stack in this case, sometimes it will fail to connect
AP as duplicated TX EAP response is seen.
Drop duplicated EAP frames in this case.
Change-Id: Iec0ba37548f2a83fe749f83ec904ec9bfdb306af
CRs-Fixed: 2796226
MSDU count is not reliable in all cases.Hence it is better
to check whether next_link_desc is valid or not and then
free the MSDUs in the next descriptor and subsequently
release both the current and next link descriptor back to HW.
Change-Id: Ie5ea3be547f9aed6673293221f6b47661cd92cce
Skip the recording of rx error ring and rx reinject
history if the memory allocation for the history
fails during the attach.
Change-Id: Ifa74937d0c37e6013ccaec851dab7d9e53057ac2
CRs-Fixed: 2767579
Remove the peer backpointer in ast entry and store
peer_id instead
Assign peer_id in AST entry in AST MAP event,
also add the ast entry to peers ast list
In AST map & AST unmap APIs use ast find by vdev_id
Change-Id: I74d9828dc309149d98f6f577b5c8304cb087fd76
Add support to get the peer reference with module id
To help debug the peer reference related issues
Change-Id: Ie20c7e710b9784b52f2e0f3d7488509282528a00
Use unified version of dp_peer_find_by_id API
which will take peer reference
Also use unified peer ref release API dp_peer_unref_delete
Change-Id: Ibb516a933020a42a5584dbbbba59f8d9b72dcaa4
We have come across scenarios where rxdma is pushing
a certain entry more than once to the reo exception
ring. In this scenario, when we try to unmap a buffer,
it can lead to multiple unmap of the same buffer.
Handle this case, by skipping the process of this
duplicate entry, if alrady unmapped, and proceed to the
next entry.
Change-Id: Iae66f27e432f795ba4730911029fa1d63a75cb06
CRs-Fixed: 2739176
Same back to back link descriptor address/cookie is observed in
WBM idle link desc ring.
add duplicate link desc check when host
refill link descriptor to WBM through SW2WBM release ring,
also REO reinject ring.
Change-Id: Iaf9defd87670776fa9488d7f650efa3c08fefa60
CRs-Fixed: 2739879
The rx rings are relatively of smaller size. Any
duplicate entry sent by hardware cannot be back-tracked
by just looking at the ring contents alone.
Hence add a history to track the entries for the
REO2SW, REO exception and SW2REO ring.
Change-Id: I9b0b311950d60a9421378ce0fcc0535be450f713
CRs-Fixed: 2739181
DP RX changes to support RX buffer pool, this is a pre-allocated pool
of buffers which will be utilized during low memory conditions.
Change-Id: I8d89a865f989d4e88c10390861e9d4be72ae0299
CRs-Fixed: 2731517
On returning the msdu link descriptor to HW via WBM
release ring, the rx exception ring contents are not
zeroed. This could result in host reading stale ring
descriptor content in the scenario when HP is updated
even before the latest values are reflected in the ring
descriptor.
Fix is to set invalid bit in cookie for exception ring
descriptor and add cookie sanity check.
Change-Id: I01a294c92b260ebe8e584ef20e9550b1febec913
CRs-Fixed: 2730759
Remove uncessary msdu count check against msdu count in
mpdu desc info while processing REO Rx err pkts.
As per h/w team msdu count can be obtained from msdu link
desc instead of mpdu desc info.
SOC level Rx err stat rx.err.msdu_count_mismatch is
incremented to log this condition.
Change-Id: I4f7d2df7335778f2f2d28e542da17fc7f6970009
CRs-Fixed: 2729693
remove additional reap logic for SG buffers, as we
are also maintaining a state for SG buffers in dp_soc
structure
CRs-Fixed: 2722245
Change-Id: Ibec3007036e78a2ec1c5055244b6518f889e16a4
Rxdma decrypt errors are observed when the association
is in progress as AP sends encrypted data packets to
DUT-STA. As part of the rxdma error handling, excessive
prints are logged to console resulting in an assert.
Fix is to rate limit rxdma decrypt error related log
Change-Id: I2ef28c635d77e3acafd067b921cdb13c277756c7
CRs-Fixed: 2725335
Fix static analysis issue of rx_refill_buf_ring buffer overflow.
rx_refill_buf_ring length is different for WIN/MCL. For MCL length is 1,
WIN is 3. So rx_refill_buf_ring should always use index pdev->lmac_id to
replenish rx buffer for different MACs under MCL.
Change-Id: I00af069c09c01a81ae4aa54bad5beb79dc6fcff5
CRs-Fixed: 2703683
The DMA Map/UnMap was restricted to buffer size in rx process.
But the Map/UnMap API was not changed in rx error process, apply
this change in the rx error data path. So that there will be no
paging request error when rx data error happen.
Change-Id: I690e902ef5c05f216b2eb87de977fd0b45ecadab
CRs-Fixed: 2702369
FISA RX aggregation is not necessary for non-regular RX delivery
as it requires extra FISA flush and also may impact regular
dp_rx_process() RX FISA aggregation.
Add exception frame flag for non-regular RX delivery, so that
FISA path can identify this frame and bypass FISA RX.
Change-Id: Ic06cb72b516221754b124a673ab6c4f392947897
CRs-Fixed: 2680255
Add check for sg formation.
Only enable chfrag_cont and msdu_continuation if reo
error code is HAL_RX_WBM_ERR_SRC_REO or rxdma_err_code
is HAL_RXDMA_ERR_UNENCRYPTED.
Also chain all nbuf in case of sg in separate buffer
and finally loop through that. This is added because
sometime we dont get desc in sync with hw.
To avoid such mismatch, this buffer is added.
We will process nbuf only when all msdus has been
received.
Change-Id: I3b154a68955db61f3acaa0cb8d130c8918a3d450
CRs-Fixed: 2672126
In OOR error handling scenario, msdu is spread across
two nbufs. Due to this, there is a mismatch between
msdu count fetched from MPDU desc detatils and count
fetched from rx link descriptor.
Fix is to create frag list for the case where msdu
is spread across multiple nbufs.
Change-Id: I1d600a0988b373e68aad6ef815fb2d775763b7cb
CRs-Fixed: 2665963
Invalid peer handler does double free of nbuf and leads to crash.
To avoid this make nbuf->next NULL before calling dp_rx_null_q_desc_handle.
Change-Id: Ia3f92cb5136dbdbfeb1e9cda8a52c474456a4e0c
CRs-Fixed: 2655792
Use QDF_BUG instead of the qdf_assert. Since the qdf_assert is not
defined anymore.
Change-Id: I2bd46def51823829604b699321f9a02fcd3b07c6
CRs-Fixed: 2658545
There might be aggressive error logging in the dmesg if wbm_desc_rel_ring
is hang. So use the dp_info_rl instead of QDF_TRACE to reduce aggressive
logging to avaoid spin lock huge delay when processing the
reo_exception_ring.
Change-Id: I4622f28cd6d8771cf27643a867892b62860d1ddc
CRs-Fixed: 2648149
Pointer rx_msdu_link_desc returned from call to function
dp_rx_cookie_2_mon_link_desc which may be NULL and may be
de-referenced latter
CR-Fixed: 2645199
Change-Id: I9ccba61df9571fcc99c5d5493194d5ae43a71a7f
