From 2f61669efca6ef9333491d21fcc4d50693d00378 Mon Sep 17 00:00:00 2001 From: wadesong Date: Wed, 26 Aug 2020 17:03:30 +0800 Subject: [PATCH] qcacld-3.0: Fix a beacon template update dead loop When sap is started, a dead loop for beacon template updating can happen due to the following conditions: 1) before vdev start happens for sap, he_ops will be retrieved from the ie buffer imposed by upper layer, and bss color initial setup will also be retrieved here and then updated to session->he_op; 2) and it happens at least in some cases, that session->he_op. bss_col_disabled will be set to true, but due to there is actually no bss color changing really happening here, no new color will be setup here; 3) later when sap is running and starts to do beaconing, it will start to check if session->he_op.bss_col_disabled is setup to true, and if yes, new beacon template will be issued to fw; 4) later on, fw finishes the beacon template setup and sends a notification to driver in beacon tx success event, and driver will go back to steps 3) to check session->he_op.bss_col_disabled again; If no real bss color change happens here, step 3) and 4) will loop forever. Fix the above dead loop by introducing check of session->he_bss_color_change.new_color before driver code starts to inspect the bss color change countdown value and updating beacon template to fw. Change-Id: I4a32ce9f547e988087c769ad8fab2973582ce6e4 CRs-Fixed: 2764896 --- .../src/pe/lim/lim_send_sme_rsp_messages.c | 37 ++++++++++--------- 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c index b91d6a7e87d0..f08caa45c8aa 100644 --- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c @@ -2067,30 +2067,31 @@ lim_handle_bss_color_change_ie(struct mac_context *mac_ctx, /* handle bss color change IE */ if (LIM_IS_AP_ROLE(session) && - session->he_op.bss_col_disabled) { + session->he_op.bss_col_disabled && + session->he_bss_color_change.new_color) { + pe_debug("countdown: %d, new_color: %d", + session->he_bss_color_change.countdown, + session->he_bss_color_change.new_color); if (session->he_bss_color_change.countdown > 0) { session->he_bss_color_change.countdown--; } else { session->bss_color_changing = 0; qdf_mem_zero(&beacon_params, sizeof(beacon_params)); - if (session->he_bss_color_change.new_color != 0) { - session->he_op.bss_col_disabled = 0; - session->he_op.bss_color = - session->he_bss_color_change.new_color; - beacon_params.paramChangeBitmap |= - PARAM_BSS_COLOR_CHANGED; - beacon_params.bss_color_disabled = 0; - beacon_params.bss_color = - session->he_op.bss_color; - lim_send_beacon_params(mac_ctx, - &beacon_params, - session); - lim_send_obss_color_collision_cfg(mac_ctx, - session, - OBSS_COLOR_COLLISION_DETECTION); - } + session->he_op.bss_col_disabled = 0; + session->he_op.bss_color = + session->he_bss_color_change.new_color; + session->he_bss_color_change.new_color = 0; + beacon_params.paramChangeBitmap |= + PARAM_BSS_COLOR_CHANGED; + beacon_params.bss_color_disabled = 0; + beacon_params.bss_color = session->he_op.bss_color; + lim_send_beacon_params(mac_ctx, + &beacon_params, + session); + lim_send_obss_color_collision_cfg( + mac_ctx, session, + OBSS_COLOR_COLLISION_DETECTION); } - lim_send_bss_color_change_ie_update(mac_ctx, session); } }