API "fw_diag_data_event_handler" is the handler of an event
WMI_DIAG_DATA_CONTAINER_EVENTID comes from FW. Arguments of
this handler function come from FW.
If num_data may be less than size of(struct wlan_diag_data),
possible OOB while extracting event data.
Fix is to add a sanity check for num_data to avoid the OOB
read.
Change-Id: Ia2eb62dbaa154936bdb4ea34065657d441f12810
CRs-Fixed: 3001178
API "target_if_wifi_pos_oem_rsp_ev_handler" is the handler for
the event with WMI_OEM_RESPONSE_EVENTID. Host receives
"rsp->dma_len" from fw. The integer overflow occurs if
"oem_rsp->dma_len" is big enough while calculating the total
length of the Oem Data response buffer.
Fix is to add a sanity check for rsp->dma_len to avoid integer
overflow.
Change-Id: Idfbd358f62534eae0147f03505ced5728877a269
CRs-Fixed: 3001191
During beacon or probe response, if channel is dfs && frame type
is MGMT_SUBTYPE_BEACON, it would call "util_scan_add_hidden_ssid"
to deal with the packet. If the ie id matches with SSID then OOB
read may occur in ie_len as it is validated with upper bound of
ie_ssid.
Validate the ie length first. If it is more than 0 then copy
memory to SSID which are equivalent to ie length.
Change-Id: Ib5e2ab7f6f3337d4c3e5c240e3133d8f276be50a
CRs-Fixed: 3007473
Add QCA new status vendor attribute
QCA_WLAN_VENDOR_TWT_STATUS_POWER_SAVE_EXIT_TERMINATE
to indicate the TWT session termination due to power save
exit request from userspace.
Change-Id: I515e4e8384b92b2556d72c4015252f075577f13c
CRs-Fixed: 3013360
Add new TWT teardown status code to indicate host teared
down the TWT session due to PS disable.
Change-Id: I49c2d7bb1abc4ceb4f79b833cbafcb44e8b936fe
CRs-Fixed: 3013358
In qdf_mem_multi_page_link, pages->cacheable_pages is array with elem num
pages->num_pages, but pages->cacheable_pages[pages->num_pages] is read,
out of bounds error will report if KASAN enabled.
When ini dp_tx_ext_desc is 6144 and DP_TX_DESC_POOL_SIZE is 6144,
Size in bytes of TX TSO Num Seg Desc is 16, page size is 4096, so TX TSO
Num Seq Desc need 24 pages (6144*16/4096), each address need 8 bytes,
so TSO Num Seq Desc need kmalloc 192 bytes to save address of 24 pages.
BUG: KASAN: slab-out-of-bounds in qdf_mem_multi_page_link+0x190/0x1f4
Read of size 8 at addr ffffff816b4d60c0 by task kworker/u16:0/8
CPU: 7 PID: 8 Comm: kworker/u16:0 Tainted: G S W O
Workqueue: cnss_driver_event cnss_driver_event_work
Call trace:
dump_backtrace+0x0/0x204
show_stack+0x18/0x24
dump_stack+0xcc/0x11c
print_address_description+0x88/0x578
__kasan_report+0x1ac/0x20c
kasan_report+0x14/0x20
__asan_load8+0x98/0x9c
qdf_mem_multi_page_link+0x190/0x1f4 [wlan]
dp_tx_tso_num_seg_pool_init+0x84/0x170 [wlan]
dp_soc_tx_desc_sw_pools_init+0xb4/0x128 [wlan]
dp_soc_init+0xf78/0x18c8 [wlan]
dp_soc_init_wifi3+0x14/0x20 [wlan]
cds_open+0x7e8/0x15fc [wlan]
hdd_wlan_start_modules+0x7d8/0xf10 [wlan]
hdd_wlan_startup+0x17c/0xbd4 [wlan]
wlan_hdd_pld_probe+0x234/0x370 [wlan]
pld_pcie_probe+0x6c/0x88 [wlan]
cnss_pci_call_driver_probe+0xd8/0x358
cnss_bus_call_driver_probe+0x38/0x6c
cnss_driver_event_work+0xf14/0x1188
process_one_work+0x53c/0x8b8
worker_thread+0x4f8/0x928
kthread+0x1e8/0x200
ret_from_fork+0x10/0x18
Allocated by task 8:
__kasan_kmalloc+0x100/0x1c0
kasan_kmalloc+0x10/0x1c
__kmalloc+0x130/0x448
kzalloc+0x14/0x20 [wlan]
__qdf_mem_malloc+0xcc/0x120 [wlan]
qdf_mem_multi_pages_alloc+0xc0/0x580 [wlan]
dp_prealloc_init+0x1b0/0x48c [wlan]
wlan_hdd_pld_probe+0x200/0x370 [wlan]
pld_pcie_probe+0x6c/0x88 [wlan]
cnss_pci_call_driver_probe+0xd8/0x358
cnss_bus_call_driver_probe+0x38/0x6c
cnss_driver_event_work+0xf14/0x1188
process_one_work+0x53c/0x8b8
worker_thread+0x4f8/0x928
kthread+0x1e8/0x200
ret_from_fork+0x10/0x18
The bad address belongs to the object
which belongs to the cache kmalloc-192 of size 192
The bad address is located 0 bytes to the right of
f816b4d60c0).
Change-Id: I6569c22bc8f900296f49a4426f085912a33aa452
CRs-Fixed: 3014390
Add CDP interface API support for pkt_log_exit,
to cleanup pkt_log_init on failure.
Change-Id: Ib50efaed5997d341d3e76c2e1dbe42856df40191
CRs-Fixed: 3012201
Currently in function wmi_extract_dbr_buf_release_entry,
num_buf_release_entry & num_meta_data_entry are copied
to direct_buf_rx_rsp structure without any validation which
may cause out of bound issue if num_buf_release_entry or
num_meta_data_entries provided in fixed param becomes greater
than actual number of entries.
Fix is to validate num_entries and num_meta_data before populating
param->num_buf_release_entry and param->num_meta_data_entry.
Change-Id: I18050fd4f90f8815d7eceb5f715fdbaa09130d3a
CRs-Fixed: 3000875
Define the new TWT attributes for configuring the broadcast TWT
parameters in enum qca_wlan_vendor_attr_twt_setup.
Change-Id: Ia7b0e1565cef3bfe5d213b783390c7231a1a8446
CRs-Fixed: 2924690
Currently, we are Flushing fragments for peer as part of rx defrag
clean up. There is the possibility that frag flush is called while
we are accessing frags in rx defrag store fragment path in parallel.
Which will cause access after the free issue.
Adding lock in rx defrag store fragment path to avoid any
parallel flush while accessing the frags.
Change-Id: Ic27caab58429d776449f4b774eb7163ffa6215ac
CRs-Fixed: 2995156
Currently, reg curr channel list contains dfs channels
but sap and p2p go can't enable on dfs channels if
dfs_master_mode ini is disabled. So, usable channel list
may contain some invalid channels in case of p2p go and sap.
Fix is to check dfs_master_mode ini and include/exculde sap and
p2p go channels based on dfs_master_mode.
Change-Id: If82d2feda78315ab53c5c7ed75f743c14186da98
CRs-Fixed: 2961435
Currently, host sends bw value to upper layer in response
of GET_USABLE_CHAN command. but upper layer requires bw
value in form of nl80211_chan_width enum and considering
bw value as invalid and resulting into 0 bw.
Fix is to populate bw value from ch_params.ch_width instead
of populating from curr channel list and then convert to
nl80211_chan_width from phy_ch_width in hdd.
Change-Id: I1937ac2b3282224861a200a5d956a6e92109328e
CRs-Fixed: 2957055
Fetch usable channels for NAN interface mode from
policy manager or reg current channel list based on
filter mask and Update res msg channel list.
Change-Id: Ifa4ad4c7c8479f4a0ecc7dbe101f6507ff1525dc
CRs-Fixed: 2949340
Currently sleep based wait is used for checking EP request/release
vote is taken effect or not. But once worker thread goes to sleep
it is taking in order of milli seconds to schedule back worker thread
this scheduling delay is causing srng HP/TP writes to be updated in
delayed manner.
To avoid this first try checking EP vote is taken affect by busy wait
then go for sleep based method.
Change-Id: I72e81941a23752a41c9b5307e82c2e971aee1ec8
CRs-Fixed: 2999541
Currently timeout for checking pld_is_pci_ep_awake in
hif_prevent_link_low_power_states might be higher than
the defined timeout depends on how long qdf_sleep takes
to get scheduled again, so avoid this uncertain timeout
adding reference to the system time.
Change-Id: I67a28d46c996ccc56680cf8e20c09a70729a33c5
CRs-Fixed: 2994746
In MISSION mode, MSI address and data are still
configured for monitor status rings even though MCC
uses only polling mode for this ring.
Fix is to skip MSI configuration for monitor sts
ring in MISSION mode for MCC.
Change-Id: If295a5afc6731bbec1ad7182590e0015f3a911ba
CRs-Fixed:
After reg work is complete there is possiblity EP vote reset
request still not processed by F.W. So wait till EP vote reset
is done after reg work completion.
Change-Id: I1f4e318ac96ba3a15c613c5faf5095d4be7c8e99
CRs-Fixed: 2994233
Add api to set intermediate EP vote access state.
Make sure reg work handler is complete before setting
intermediate vote access.
Change-Id: Ib229d9af8b1e58505a9ae5fbf39aa912ca21a3c3
CRs-Fixed: 2994040
Currently there is no synchronization for flush log completion
between fw and userspace. When host driver receives command to
flush logs, it sends the command to fw and releases the control
of the userspace thread, it does not wait for the flush log
completion event from the fw and because of which user space
does not know when the host and fw completes the log flush.
To address above issue add a logic to wait for fw event of
flush log completion before host returns control to userspace.
Change-Id: I04fa0aead146d2b7b8627e4101c6dcd99d3947e9
CRs-Fixed: 2983387
Currently for UK ETSI1 is mapped due
to which reg list may skip some valid
channel list for UK in case of MCC and DSRC.
Fix is to map MCC to ETSI13_WORLD and
DSRC to ETSI10_WORLD.
Change-Id: Ibcc09e2c45506ee5d4d1cbbaf5763d6056a8ff71
CRs-Fixed: 2953624
When vdev deleted and interface down, there are pending pkts in nbuf
queue of dp rx thread in cornel cases, when flush cmd comes, even vdev
is not found by vdev id, rx stack callback isn't set to NULL, pkts are
still delivered to kernel stack, but rx queue is invalid now, assert
will happen when GRO flush happens.
Fix by setting rx stack callback as NULL when vdev isn't found by vdev
id.
Change-Id: Iad3b71dbc86563a4f8b5369474b2a901cdf8b325
CRs-Fixed: 2995694
Mark vdev as delete in process after flush out the packets in rx thread
queue currently.
If rx packet received after flush and before mark vdev as delete in
process, the packet is enqueued into rx thread queue and not flushed after
vdev deleted physically and net interface down. After that, if flush
pkts after interface down, assert will happen.
Fix:
Mark vdev as delete in process before flush out the packets in the rx
thread queues.
If the vdev is marked as delete in progress, then the
packets received on that particular vdev should not be
enqueued to dp rx thread any more.
Change-Id: If651a9e97b8501efc26400079194570ba6407f13
CRs-Fixed: 2996534
skb_set_len and skb_pull operations are done in both
dp_rx_deliver_to_pkt_capture_no_peer and
dp_rx_deliver_to_stack_no_peer. Due to this, in the
issue scenario, EAPOL frame gets dropped in roaming
scenario since qdf_nbuf_is_ipv4_eapol_pkt returns
false.
Fix is to do a skb_push_head operation in
dp_rx_deliver_to_pkt_capture_no_peer API before
exiting.
Change-Id: I071a5248f9f8577c8a21547f67ec53d707dee0be
CRs-Fixed: 2982188
In WMI INIT, check whether firmware supports the ack event or
not. If it supports then enable driver support and send it to
firmware during WMI INIT.
Change-Id: Icfdee6bc06e6a393de880b87fdab70665ea7c8b4
CRs-Fixed: 2987898
In case if TWT command (i.e setup, terminate, pause, resume,
nudge) comes from userspace and if the firmware is in below mode
1. scan in progress
2. roam in progress
3. CSA is in progress or
4. Any other error
then the command needs to be rejected in userspace context.
Synchronize the TWT command so that whenever command goes from
driver to firmware, then driver will receive ack event first
followed by respective event (i.e add dialog, delete dialog,
pause, resume, nudge) with below condition
1. If driver receives the ack event as successful then driver
waits for this ack event, respective event with status of the
TWT action frame over the air is expected.
2. If driver receives the ack event as failure then it will
rejects the TWT command in userspace context.
Change-Id: Ie885d98ecf2dad98d34676d889fd70e4c84f0a05
CRs-Fixed: 2987904
Currently host is populating secondary channel list from master
channel list based on ap power type. In case fw doesn't support
extd cc event then secondary channel list will not have 6g freq,
which may break legacy 6g handling.
Fix is to add validation check for ext cc event support, copy
secondary channel list from ap power type in case ext cc event
is supported by fw else copy secondary channel list from reg
current channel list.
Change-Id: I2e13be2936b624ccbee5e8e426987355076a0062
CRs-Fixed: 2987951
Initialize the last_desc_cleared pointer to -1 not 0, and
also fix the check it should always behind tp.
Change-Id: I281e066d45a99ac99d4f3c4e0bcc3f65f14bb589
CRs-Fixed: 2987029
Add TWT service bit capability support to check whether firmware
supports ack event or not. If firmware does not support ack event
then service bit capability will become 0 and whenever TWT
command comes, host will not wait for ack event and sends command
in a legacy way.
This support is mainly added to handle new host and old firmware
combination.
Change-Id: I55d373c2e017130b58a4b332da16f0eda8f34eba
CRs-Fixed: 2987749
Add QCA vendor interface for userspace to get information of usable
channels for different interface types from the driver/firmware.
Change-Id: Ice662b9f14e95f32f853637e73bccd686678f278
CRs-Fixed: 2939047
The existing assertions for unmapped variable in
rx descriptor results in an undesired bug_on since
the unmapped value is 0 for active descriptors.
The fix is to modify this assertion so that bug_on will
be triggered only if the unmapped value is 1 in rx
desc.
Change-Id: I03b27e0e42ce3c42b9fa148da9258063b0209b08
CRs-Fixed: 2985248
Wake-IRQ can be received just before Kernel issuing
suspend_noirq callback, such wake-IRQ would not be
handled by Kernel. So check if any tasklet most likely
CE2 is pending and abort suspend_noirq if true.
Change-Id: Ie3d6de97179aa0d8f383a086f4f8df27d3fc5254
CRs-Fixed: 2981882
Add CDP reason code support for sending DELBA request,
so protocol layer can make decisions for special cases.
Change-Id: I4e4b2e7f7232a8ab12d4c7838f97908f481dc787
CRs-Fixed: 2983553
The earlier logic for scanning non-inheritance IE fails if
non transmitted bssid profile has any extension element
such as MU EDCA before the extension element with
non-inheritance IE.
Since MU EDCA is also an extension element and it does not
have noninheritance element id in it, the logic used to fail
as the driver does not check further for any other extension
element ID in non transmitted bssid profile. Because of this
the IEs part of non-inheritance list used to get inherited,
causing disconnection issue.
With current fix, the scanning for non-inheritance IE has been
taken care properly. Driver will go through the non transmitted
bssid profile until it finds the extension element with
non-inheritance element ID in it.
Change-Id: Ib4346600a880a8390c6d023cf403ed18c62406d2
CRs-Fixed: 2935065
When host receives BAR frames with OOR/2K jump in sequence
number it updates REO HW with new starting sequence number
and requests F.W to setup peer reorder queue. But REORDER_QUEUE_SETUP
is already requested to F.W as part of initial add BA in host.
So while handling OOR/2K jump BAR frames don't send
REORDER_QUEUE_SETUP to F.W
Change-Id: Idc3657e901dc792f699b53c45e4ae5133d286891
CRs-Fixed: 2981280
If there is any non-inheritance element present as part of the
nontransmitted BSSID profile then while generating scan entry
for that profile, driver need not inherit those list of
element IDs and list of element ID extensions from the
transmitted BSSID profile.
Since non-inheritance element is an element ID extension, it
should be part of extension element. So the logic we use over
here is to find if there are any extension element present in
the nontransmitted BSSID profile. if yes, then only go ahead
with below logic or else go with the normal flow.
Logic:
Mark and store the start of the list of element IDs and
list of Element ID extension.
While generating the new ie for the non transmitted BSSID
profile, do not inherit the IEs present in the above
mentioned lists.
Change-Id: I466afa8273e841b6f7656b1dc59342bc2d4f13bc
CRs-Fixed: 2883389
If any nontransmitted BSSID profile is fragmented across
multiple MBSSID elements, then it is called split profile.
For a split profile to exist we need to have at least two
MBSSID elements as part of the RX beacon or probe response
Hence, first we need to identify the next MBSSID element
and check for the 5th bit from the starting of next
MBSSID IE and if it does not have Nontransmitted BSSID
capability element, then it's a split profile case.
This change is responsible in accumulating the non
transmitted BSSID profile, fragmented across multiple
MBSSIDs, so that the scan entry will not miss any
information.
Change-Id: Ia78cc47d1ffd03ada659d257b83741e7ab921fa2
CRs-Fixed: 2883389
There is a time involved between the smmu fault initiated
and the eventual system panic. In this time there is a
possibility of the nbuf history being overwritten losing
the information on the nbuf which might has actually caused
the SMMU fault.
Set the ssmu state and dont track the nbuf's when the smmu
fault is detected.
Change-Id: I579da332766618161567764656005ef13667270e
CRs-Fixed: 2960070
Error log peer not found is coming spurious in
dp_2k_jump_handle on continuous error pkts, so
rate limit the same.
Change-Id: If4b577a7759136ea824ca62b63ef91d102b8decb
CRs-Fixed: 2978939
If an MSDU is scattered across multiple nbufs, rx
attention tlvs are only valid for the last nbuf for
this MSDU. MSDU len err field is fetched from rx
attention tlvs for all the nbufs which could result
in an incorrect drop of packets.
Fix is to check for msdu len err for nbufs with msdu
continuation bit set to 0.
Change-Id: I0ed5cbb37a2ba34a39328618e3f5e66d419d7cca
CRs-Fixed: 2982308
CE irqs affinity is set to gold cores, but affinity
hint is not removed while freeing irqs.
So remove CE irq affinity before freeing them.
Change-Id: If3822422f823cb3caa6e291387a2beadc62049b7
CRs-Fixed: 2975529
Add functions to parse and extract wmi smart monitor
event received from target.
Change-Id: Ic18e3134b684c5f8e12839e997d628909a7e27c9
CRs-Fixed: 2969247
