In current design, Host driver copies kck and kek from pmo_gtk_req
to kck and kek of WMI_GTK_OFFLOAD_CMD_fixed_param. Host tries
to copy PMO_KCK_LEN i.e 32 bytes to an array of length 16 bytes
which can lead to OOB.
Fix is to copy only 16 bytes of kck and kek. Copy the bytes
from pmo_gtk_req same as the size of cmd->kck and cmd->kek i.e
destination array size to avoid OOB.
Change-Id: I999add18e18bedc9cfa1a0cfa5c0dad781e8e13f
CRs-Fixed: 2470368
In case of SDIO/USB TX bundling if there is hif_send_head failure
packets are not added back to Endpoint tx queue and resulting in
packet drop.
Add packet back to tx queue if hif_send_head send failure
for bundled packet.
Change-Id: Id613a414f0caa71a33c79186ae726550cb710c4a
CRs-Fixed: 2468882
Add support for target_if timer restart when
vdev mgmt ops request is queued though the intended
response corresponding to request is not yet received.
Change-Id: I08e474ac66a0c399a93ffbc4a24aab78084072d2
CRs-Fixed: 2463180
Release mon_lock in dp_reset_monitor_mode function before returning
if status is not successful.
Change-Id: I321cd55225ed3cc5e5b4a752fb10604d05fb9a56
CRs-Fixed: 2462725
The driver uses a timer to check if there is a potential ref leak by
inducing assert if a given module does not release ref even when the
object is in L-state. But in case there is SSR/PDR, it might take more
time to clean up/release the refs. In this case, no assert should be
triggered.
Add a check in wlan_objmgr_iterate_log_del_obj_handler before calling
the assert API.
Change-Id: Ifb7568e11bff2b9fc610633af730461e33dc5539
CRs-Fixed: 2468301
Add enum for baseline radio level channel width. This is required for
some low level use cases which need the original width configured into
the radio when channel is configured, rather than per-VDEV protocol
level width which might vary.
Change-Id: I8215003774bc46403a038011e7581517d25b94f9
CRs-Fixed: 2474794
In dp_ipa_setup function, the function qdf_mem_zero is called
and should receive a pointer instead of address to a pointer for tx
and rx when they are called. These pointers are also initialized to
NULL when declared locally.
Change-Id: Iec9c76c63cc2ec00bdfb54497cca2f22fabff045
CRs-Fixed: 2469428
In dp_rx_process function, check if peer pointer is NULL
before using as argument when calling dp_rx_deliver_to_stack.
Change-Id: I6584c79047a809f28e65faad47d1c7220e7057bb
CRs-Fixed: 2470345
Currently qdf_print, qdf_alert, qdf_err, qdf_warn,
qdf_info, qdf_debug, qdf_nofl_print, qdf_nofl_alert,
qdf_nofl_err, qdf_nofl_warn, qdf_nofl_info, qdf_nofl_debug
macros are defined under CONFIG_MCL feature flag since
these trace prints are supposed to be used only for QDF
module with module ID as QDF_MODULE_ID_QDF, WIN is using
these definitions with module ID as QDF_MODULE_ID_ANY and
these are separated with feature flag CONFIG_MCL.
As a part of cleanup activity of CONFIG_MCL feature flag
move these WIN specific trace definitions under WIN
specific feature flag QDF_TRACE_PRINT_ENABLE.
Change-Id: I838f76f2e3f4c2dd28f0463fa6c9d981304b136e
CRs-Fixed: 2472021
Currently NBUFF related parameters are declared under CONFIG_MCL
feature flag and are getting used under
FEATURE_NBUFF_REPLENISH_TIMER feature flag.
As part of CONFIG_MCL cleanup, move NBUFF related parameters
under correct feature flag FEATURE_NBUFF_REPLENISH_TIMER.
Change-Id: I438f7dbc0c67343c94ad78ea4df4cfb1fd2f051b
CRs-Fixed: 2472011
Add feature flags DP_FLOW_CTL for DP flowctl ops,
DP_PEER_SUPPORT_OPS to support peer handling in DP,
DP_POWER_SAVE for power saving ops in DP, DP_CON_MON DP_MOB_DEFS
DP_INVALID_PEER_ASSERT DP_PRINT_NO_CONSOLE and DP_INTR_POLL_BOTH.
Change-Id: I01dafadf6578c0b5f36ab3ef56624912fb66b100
CRs-Fixed: 2467170
Change Spectral report processing logic to handle
Agile Spectral reports. 160 MHz state machine is not
affected by Agile Spectral reports.
CRs-Fixed: 2458359
Change-Id: Iead6427f57edddd61f7d64a961cc6d936d54ab9e
Reduce log level in tgt_mc_cp_stats_process_stats_event,
tgt_mc_cp_stats_update_peer_adv_stats &
tgt_mc_cp_stats_extract_peer_stats from error to debug because
a stats event can be received unsolicited.
Change-Id: I5ad216034eefd8197f80c2a50e8ae0833b149d06
CRs-Fixed: 2471465
1. Add config table to accommodate per ring type
configuration to have a finer control over the
ring.
2. Provide struct wlan_srng_cfg interface to add
more parameters to control the ring.
3. Add interrupt threshold configuration parameters
to wlan_srng_cfg structure.
4. Add WLAN_CFG_INT_TIMER_THRESHOLD_WBM_RELEASE_RING
and WLAN_CFG_INT_TIMER_THRESHOLD_REO_RING to have
different timer values for REO and WBM ring.
Change-Id: Ied50e3241ab2cc181ca4ed7f126959cd5d9d2de5
CRs-Fixed: 2455297
In send_roam_scan_offload_mode_cmd_tlv, psk_msk from incoming
roam request buffer is copied to destination roam_offload_11i->pmk.
The psk_msk is of size 48 bytes, while destination pmk is of 32
bytes. This could result in OOB.
Copy only 32 bytes for 11i pmk as 802.1x doesn't have PMK size
greater than 32. In future, if Suite-B roaming support is
required, interface changes are need to add new parameter to
copy the remaining 16 bytes.
Change-Id: I303fc15fc0f0169a049d0542674bd7add3cbb1a1
CRs-Fixed: 2470353
Currently the driver checks that DBS for connection
is allowed or not, and on that basis rejects the scan,
but it may happen that FW supports DBS, and DBS for
scan is enabled in the ini, but the DBS for connection
is disabled.
In that case the diver opts for non-dbs scan.
Fix is to allow DBS scan in case of DBS scan enabled in ini.
Change-Id: I080ba4e581a7f77e84a4364237621429bcf91710
CRs-Fixed: 2474580
Featurize PKTLOG cmd handle under feature flag FEATURE_PKTLOG
as part of CONFIG_MCL cleanup.
Change-Id: Iae8c7e7caad001d7d37a8e17c1eb892f96009066
CRs-Fixed: 2467198
Currently driver is using vmalloc to allocate the memory
inside dbglog_block_read api and this buffer is copied to
userspace buffer which may lead to use of uninitialized
buffer.
To avoid above issue use vzalloc to allocated the buffer
which initializes the memory to zero.
Change-Id: Iebc530b000c908231ef8718e79054801d294dd8f
CRs-Fixed: 2470385
The channel number is always 0 from HAL RX PPDU TLV, then monitor
mode frames radiotap channel frequency is always 2407, get the
correct channel number that we saved when set monitor channel.
Change-Id: Ib927fe9aca3a4c1f98845fe37c9b1d37d1d6cf5a
CRs-Fixed: 2471161
There are multiple definitions of __qdf_nbuf_free api based
on CONFIG_MCL feature flag.
As a part of cleanup activity remove multiple definitions
of __qdf_nbuf_free api.
Change-Id: Ib7fce54353561a45a4662c05d56d3af187a269e1
CRs-Fixed: 2472016
Use same stop_th and start_th as QCA_LL_TX_FLOW_CONTROL_V2 for
QCA_LL_PDEV_TX_FLOW_CONTROL which allows pausing/unpausing
netif queues to avoid frame drop in driver.
Change-Id: Ifa649e31a41d1bf89eadc8cc7e9520f0e27b9fe4
CRs-Fixed: 2466999
QDF_DEFAULT_TRACE_LEVEL macro is not getting used in case of
MCL, as part of cleanup of CONFIG_MCL macro dependency,
move this macro definition to correct WIN specific
feature flag.
Change-Id: I75cbfd856308f0027ecb805a41c15966528f314e
CRs-Fixed: 2468286
In srng setup, we set srng alloc size, and allocate memory
for srng buffers.
Even if allocation fails, srng alloc size is set,
which is done even before the allocation is attempted.
In srng clean up path, we attempt to free the memory,
since srng alloc size is set,
but for which allocation had failed,
Instead, when freeing srng buffers, check if we have
a valid address also for srng buffer and then free,
instead of checking srng alloc size only.
Change-Id: I1f2de526e27b7b8d97535bf4c2235c82ffd3ce5f
CRs-Fixed: 2452219
Fix memory allocation failure for nbuf pointers array in
dp_pdev_rx_buffers_attach(), by allocating a single page
of memory for the pointers and re-using them by iterating
in a loop until the total required nbuf's are traversed,
instead of allocating a huge contiguous memory for pointers
to store the address locations of all the nbuf's.
Change-Id: I47ca8f94405e44d6bdbc43129012df1b65b14ba6
CRs-Fixed: 2464598
Regulatory channel state is mistaken as chan_flags.
Set regulatory channel state to CHANNEL_STATE_DISABLE.
Change-Id: I72dd40bb3a7690e0156f72008ad29d209e93ce29
CRs-Fixed: 2461403
The current OSIF logging macros use a "cfg80211" prefix. This is
confusing because that prefix should only be used by the Linux
cfg80211 module. To avoid confusion rename the macros to use an
"osif" prefix.
Change-Id: Id3273498f623d04beec879aa9d77c1d33986357a
CRs-Fixed: 2469485
Currently, ucfg_scan_register_pno_cb and ucfg_scan_get_scan_id
do not do null validation for scan object which can lead to null
pointer dereference. wlan_psoc_get_scan_obj_fl returns null in case
of invalid component id or null psoc and that null scan object is
dereferenced due to missing null validation.
Add null pointer check for scan object in ucfg_scan_register_pno_cb
and ucfg_scan_get_scan_id. Return zero scan id from ucfg_scan_get_scan_id
in case of null scan object.
Change-Id: I1aa1bdee001cace34e22ca11014455a0c7bcc462
CRs-Fixed: 2468518
Currently, wakelock apis are in wma. Create vdev resp wakelock apis
in target_if. Plan is to remove it latter from wma.
Change-Id: Ib410ee2404751544db2f291b466ff0d6ff248e8f
CRs-Fixed: 2441245
Add support to log the important events in
datapath, which will help in debugging the
datapath issues.
IRQ handler, Napi poll and srng access start/end
are the events which are currently logged.
CRs-Fixed: 2457854
Change-Id: Iba105b0e79443b670a01a929f999f94e00ea92f2
Currently for WDI 3.0, IPA runtime enablement is done in the
way that dp_ipa_enable_pipes API is first invoked and followed
by dp_ipa_enable_autonomy API. With SMMU S1 enabled, RX buffers
are mapped to IPA domain in dp_ipa_enable_autonomy. However RX
buffers could be provided to IPA once after dp_ipa_enable_pipes
and this could lead to possible SMMU fault.
Fix is to map RX buffers to IPA domain before dp_ipa_enable_pipes
API.
Change-Id: Ifdad2db6fa26da06a91b84de8f8603cbc779dd67
CRs-Fixed: 2467966
The driver automatically starts beacon reporting if it pauses the beacon
reporting for any reason other than disconnection. In specific cases,
userspace may not want the beacon reporting to be automatically resumed
after a pause. Add interface support for userspace to specify driver not
to start beacon reporting automatically after a pause.
Change-Id: Ia649bc7c7bd7dfe2ae106daecfaf96368151f89b
CRs-Fixed: 2471641
Do not check for msdu Done bit for raw packets as HW
does not set this bit for msdus spread across nbufs.
Change-Id: I9c2af01c6b55600511abeec9ab6fc185fcc6ef36
Currenly this function, is_sa_da_idx_valid(), called from dp_rx_process
does not take MC/BC packets into account. For broadcast packets e.g.
DHCP offer packets from some APs, this check may fail (incorrectly).
Thus dropping the broadcast packet, when it should have been passed
on to the stack.
Fix is_sa_da_idx_valid function by taking MC/BC packets into account.
Change-Id: Ibbb34134e997e0d5394dfa654be84b9fa43434a3
CRs-Fixed: 2466839
currently we are not unmapping the nbuf which was
already mapped in dp_tx_raw_prepare in failure cases
We always need to unmap and free the nbuf if its mapped.
Change-Id: Ia5e6a31a7aac356a934ff2496d0542039bc3ece7
CRs-Fixed: 2462518
A random crash may be caused by out of range access. Add MU
user id check to prevent out of range access.
Change-Id: I531d6c03024c4a6af4e0db97ea00d0874aaef387
Currently when user request comes to populate oem
capabilities, driver is populating all the channels which
includes disabled channels also and the logic to populate
the channels is incorrect. This is resulting in invalid
channel configuration for user space command.
To avoid above issue, use correct api which returns only valid
channels and valid number of channels and populate the channels
correctly in the output buffer.
Change-Id: Ib239d5d869ca9d010c85f444b83751d2e121625d
CRs-fixed: 2470193
The current calculation of head/tail pointer for
srng gives an index in the array by skipping
entry_size dwords.
The head/tail pointers are preffered to be the
index values like in the srng registers, which
brings them in alignment with the other usage of
head/tail pointers.
Fix the calculation of head/tail pointers for srng
by avoiding the division by srng entry size.
CRs-Fixed: 2469332
Change-Id: If9a167f3fac3cb39ebe59618e9ad2224d9e54bcc
Currently the driver checks whether the DFS channel is
in the range of acs channel list given, i.e the start
and end channel, which is not always correct as the channel
range does not imply that all channels in that range are present.
Fix is to explicitly check for the number of channels, and
compare each channel in the acs channel list with the DFS
channel.
Change-Id: Ib17c5e549a2c62652a6333d5d13ca8ff5a7b1674
CRs-Fixed: 2466228
