When handling RXDMA error marked frames that from MAC1,
wrong rx descriptor pool is referenced, so allocated
buffer length is incorrect and lead to skb crash. Make
changes to always uses mac0 rx descriptor pool for MCL
platform.
Change-Id: Ica01c3967d6248a23ea745da63149dae9cd56677
CRs-Fixed: 2945573
Optimize refill buffer pool feature code to be
light weight on CPU, so that refill thread will
consume less CPU resources and also replenishing
RX buffers will be done faster.
Change-Id: I849ca60558c6197003d95e7d54fdb5f837cdc217
CRs-Fixed: 2950166
Host sets num_grp_tlvs based on modified_in_curr_session, which uses
default value - MAX_RESET_CFG_ENTRY. MAX ta ra entries changed from 16
to 4 for QCA6490 and QCA6750, so change MAX_RESET_CFG_ENTRY from
0xFFFF to 0xF here.
Change-Id: Ie057b8763c0126bd0cacab4fd21da9df0d5e71f2
CRs-Fixed: 2957324
Introduce intermediate EP voting state during this transition state
access the votes only if direct writes are not possible.
Change-Id: Ib4522aef2209b4797100ca84e4e230a00e14b654
CRs-Fixed: 2954903
As a part of this change, in SAP TWT mode this mac_addr
attribute is required in response for TWT setup, get_status,
pause, response and teardown. And is required in request
for TWT get_status and teardown.
Change-Id: I230047ac46181a6bfca054c610b96c054f5c303d
CRs-Fixed: 2952331
IPA unmapping is skipped for WBM internal error case,
do IPA unmapping for rx buffer received in WBM error case.
While reinjecting RX buffer back to REO, software rx desc
unmapped field is not set in sequence which may lead to
map without unmap error in IPA module. So reset the unmapped
filed after IPA mapping is complete.
Change-Id: I42c1eaa1620f975d47ce2938c95b6b89dbbd3eca
CRs-Fixed: 2952671
While Rx buffers are getting umapped from net rx context if IPA
pipes are enabled at same time from MC thread context this is
leading to race condition and IPA map/unmap is going out of sync.
To fix this introducing IPA mapping lock and IPA mapping need to
be handled with lock held.
Change-Id: I9fa71bdb6d4e4aa93fc795cc5dd472a181325991
CRs-Fixed: 2945063
As per current design, in failure path of hdd_wlan_start_modules,
mem_free of hif_ext_group is done (in cds_dp_close) before
free_irq (in hdd_hif_close), during next hdd_wlan_start_modules,
request_irq adds new handler entry to the list in irq_desc, this
leads to a crash on accessing older stale entry from irq handler,
so adding a bus_ops hif_grp_irq_deconfigure to free ext grp IRQs.
Change-Id: I4d0a2bee1fabee388cea8a85226fae641165a8d5
CRs-Fixed: 2949400
FW is not setting up any context for CE5 but host is still
configuring the dest and status ring for CE5. This can
result in CE5 HW to write to MSI iova address when PCIe is
in low power state.
Fix is to disable MSI intr configuration for CE5 on
Lithium based targets.
Change-Id: I964305ad1258d41d7afe6422f87286904c0a6739
CRs-Fixed: 2954723
Memory allocated for tx_hw_desc_history uses incorrect
size parameter resulting in much lower memory to get
assigned. This will result in OOB access and corruptions
in memory, regions post the trailing boundary when updating
tx hw desc events via dp_tx_hw_desc_update_evt.
Fix is to use the appropriate memory size for tx_hw_desc_history
and add NULL check in dp_tx_hw_desc_update_evt.
Change-Id: I97af7898cf8bf1b24978d559f84a2a3d00227ed8
CRs-Fixed: 2952859
In case the serialization command timeout happens, it queues a msg
with in schedular thread to process timeout and pass the active timer
as its context, but if before the timeout process is executed the
actual command completion can remove the command from serialization
and it will update the timer data to point to the newly activated
command.
Now when the timer msg is executed the timer is pointing to the newly
activated command instead of actual command which was timed out
and thus remove the new command instead of the original command.
This leads to an issue where the new active command removal is a
failure when its process is completed and thus action remains
incomplete. This can also lead to two commands getting processed at
the same time as the new command was forcefully removed.
To fix this instead of passing the timer context pass the copied
command in msg to scheduler thread and do not delete the command
from serialization if the command is not active.
Change-Id: I14b489172d0f22a9ed3b26b9c94226a4095f1dee
CRs-Fixed: 2950525
Add HI_TASKLET support for CE, to improve priority
of CE tasklet higher than softirq, since CPU hogging
caused by RT thread.
Change-Id: I88fe8c048e908b9780745bb26b177acd2baf6a5c
CRs-Fixed: 2948946
Add a new flag to indicate to fw that host will set the
nan_disable_flag for channels.
Change-Id: Ibf627bff77e1afb0849149a63981ca50476f6bfd
CRs-Fixed: 2949481
There is a timing race condition between RTPM suspend flow and
DP TX flow. When TX is queued during RTPM suspend flow. TX
ring update may be delayed. Add a force TX HP flush when RTPM
is rejected due to TX pending frame. This can help to improve
TX pending frames delay when race condition happens.
Change-Id: I6f60f2902dfda630f81528dcf978da6644d18ba7
CRs-Fixed: 2942744
Add new API reg_get_band_from_cur_chan_list to build a chan
list based on either primary/secondary current channel list
as per requirement.
The legacy API reg_get_band_channel_list uses primary
current chan list to build a channel list. SAP needs to use
a secondary current channel list. Add a new API for SAP,
reg_get_secondary_band_channel_list for the same. Both these
APIs will call new API reg_get_band_from_cur_chan_list
by passing primary/secondary current chan list respectively.
Change-Id: I1e5573ac9371fc3ce5dc2c387fbd1d47696a161a
CRs-Fixed: 2947516
Currently, in get_htc_send_packets() when the
hif_system_pm_state_check() fails, we are not doing a
runtime PM put operation for the corresponding get operation.
This imbalance will never make the system enter runtime suspend
state and also we do a BUG() when such imbalance is encountered
during runtime PM deinit. This change also fixes a potential
memory leak.
Change-Id: I3e5916005d583de42a49dd2dc0632bfcca1251e4
CRs-Fixed: 2947247
Current in wmi_rx_diag_event_work, rx diag event is processing
in a while loop, if there is continuous diag event comes from
fw, it is possible that it occupy the work queue, and other work
are not able to run.
Break the while loop so give a chance to other work.
Change-Id: I7af6d60aeb8c0524cc51d663658d5b17349daa60
CRs-Fixed: 2948839
The current limits of DP RX packet drop thresholds are huge;
In scenarios, where the processing of RX packets is slow, huge
number of packets will be held in the memory and could eventually
lead to out of memory issues. Reducing the thresholds to address
the problem.
Change-Id: I76a2622fb30cda615aeb27fcc9c8e548ffec3e51
CRs-Fixed: 2941885
AP sets multiple AKM suites in RSN information of beacon
or unicast probe response. In case if the invalid or
unsupported AKM/unicast cipher suite present in the AKM
suite list, the driver detects it as wrong RSN IE and
drops it. This results Device driver doesn't send
authentication to initiate a connection to that AP even
one or more than one valid AKM suites present in RSN IE.
Ideally, the driver should able to initiate connection if
at least one AKM/unicast cipher is valid and supported in
AKM suite list.
Change-Id: I8ed525e3945e4e437d15b496c80b1ad2aef4cb65
CRs-Fixed: 2948248
hal_get_entrysize_from_srng returns the entry size
in dwords but the caller expects in bytes. This results
in insufficient data to be recorded for CE event.
Fix is to left shift the entry size by two bits in
hal_get_entrysize_from_srng so that the entry size
value returned is in bytes.
Change-Id: If532da7abe5ce9c293969f0052455085f18b1926
CRs-Fixed: 2935196
This is about CFR feature, set max ta ra entries to 4 for QCA6490 and
QCA6750 base on HW design.
Change-Id: Ief62ac394e3991a896d9bb954289e63ac105e74e
CRs-Fixed: 2939149
In wlan suspend and resume cases it is seen that group
irqs are getting disabled multiple times without getting
enabled which is causing irqs to be disabled permenantly.
Track for unbalanced disabling/enabling group irqs which
helps to root cause the issue.
Change-Id: Ic1ef637c317f04b3299f17f19208df11ece3c013
CRs-Fixed: 2939809
Firmware sends control frames in same wmi path as mgmt
frames. Currently, these frames will be dropped by mgmt
txrx component, so add support to handle control frames
in mgmt txrx component.
Change-Id: Ia046c1b3b25d40429a859e9c2659126b3d5eb3c0
CRs-Fixed: 2932123
HTC buffer is freed in enqueue failure case. Then it is requeued to
htt_htc_pkt_misclist also. In deinit flow, misclist entry should be
cleared, so buffer double free is hit in this stage. Make a change
to not requeue this frame to misclist.
Change-Id: I0211c4b548d7df7176ee72a83e21f8fcf7fa464c
CRs-Fixed: 2942972
In some RX backpressure cases, we see the HW accessing REO
queue descriptors of a deleted peer(after the queue descriptors
are unmapped/freed), this is leading to SMMU faults. There are
cases where the HW is accessing the stale REO queue descriptors
after ~12seconds after the queue descriptors were freed.
In order to avoid the problem, HW team has suggested to defer
unmapping/free of REO Queue descriptors. Add the logic for the
same.
Change-Id: I5b1fb966dc75b963ccc9d22c40272c8d1d8d6026
CRs-Fixed: 2939223
For some concurrency scenarios, there is a need to have each session
operate in independent power modes. To achieve this, add a second
current channel list to store info for the secondary power mode.
Also add the APIs to read from the secondary channel list.
Change-Id: Ib1bd712645de05786ea6d4bbfe6163c385bdfeaa
CRs-fixed: 2944483
In monitor mode, when the channel is set to any 2G band channel
the mac_id passed to dp_mon_process API is 1. As part of
dp_rx_buffers_replenish, refill history is logged and the
mac_id is used to index into the history array. The array is
of size 1 and OOB access would happen when ring_num which
is the mac_id, passed in is 1.
Fix is to pass the pdev->lmac_id instead to
dp_rx_refill_ring_record_entry and add ring_num sanity check.
Change-Id: Id824ec8b01e7923ad74771d5f34a25f5fccb65f3
CRs-Fixed: 2939544
Modify check to ensure packet number is consecutive for
fragments and drop the fragments if the check fails.
Change-Id: I2ca0ef6211594ba35aae894e6a385d3d5778bff6
CRs-Fixed: 2874369
Register dp_peer_flush_frags API in dp peer ops
for flushing fragments for a particular peer.
Change-Id: Ia179d3160bdc306ec965c465134042c66a0c40a6
CRs-Fixed: 2874366
Drop non-EAPOL frames from unauthorized peer in security mode.
Enabling this feature by default with this change.
Change-Id: I9878b37088149e34f456a38a9c0f722e4c5ee49a
CRs-Fixed: 2943789
CVE-2020-26145
Broadcast and multicast frames should never be fragmented. Several devices
process broadcasted fragments as normal unfragmented frames. Moreover, some
devices accept plaintext fragmented broadcast or multicast frames in
protected Wi-Fi networks. An adversary can abuse this to inject packets
by encapsulating them in a fragmented plaintext broadcast frame. Even
unicast packets can be encapsulated in broadcast Wi-Fi frames and hence
be injected.
Change-Id: I3181a05e177cf9374a14edb748bc5001d058e0f3
CRs-Fixed: 2893212
For security cert TC, RSNIE length can be 1 but if the beacon is
dropped, old entry will remain in scan cache and cause cert TC
failure as connection with old entry with valid RSN IE will pass.
So instead of dropping the frame, do not store the RSN pointer so
that old entry is overwritten.
Change-Id: I2fe4d2dd2352be6850f7a18a2ec829733ded7ee8
CRs-Fixed: 2944120
Even though HP/TP updates are posted writes at CPU level, they
are getting blocked until soc comes out retention which is hogging
CPU
To avoid this if EP is in low power state update HP/TP writes from
delayed work context. In delayed work vote for EP awake wait till it
comes out low power state and then proceed to HP/TP update.
Change-Id: I61d5795f58f25f850b5a9ad4d30e3181dba23713
CRs-Fixed: 2913495
Some of the targets require more QDF nbuf history
size, so making the size configurable keeping
default same.
Change-Id: Ic4ac43a1eacb1e58c0a05b794349525d614d7fc8
CRs-Fixed: 2929968
Add new ini's for assoc active and passive dwell time
for 6g. These will be applied if STA is connected.
Change-Id: I680fbd3038968ecf6ff9920fff982456135bfd77
CRs-Fixed: 2941359
Firmware generates wmi Rx diag events every few milliseconds,
and processing the same in system shared work queue may lead to
work queue lock-up detection. Hence, move Rx diag event processing
to dedicated work queue.
Change-Id: I10cdde317794e35bc6d10677ab76ea24a66e1880
CRs-Fixed: 2941409
In some of the targets modulo operator assembly API's
are not defined causing compilation error.
To avoid this use qdf based API's for modulo operations.
Change-Id: Ibc69b69aa38cadff5daa8dee8b65ceaacfe997b7
CRs-Fixed: 2940281
Logs are printed inside a spinlock which was held for
losing more than 2 seconds.
To fix this, reducing log level so it is not printed
in the console and instead in driver logs.
Change-Id: Ib510ddc1b5bff63db012b45ffa0280eedc356cc6
CRs-Fixed: 2938590
Add the history support to log Tx descriptors programmed
in Tx and completion HW rings.
Change-Id: I60954c93e2595e7dad1251c459eed8afc761e917
CRs-Fixed: 2924614
When host failed to find out vaddr by paddr from FW, output more
information for debug further.
Change-Id: I65c4965c12c2ffa3fe2a26a82df01d1b91501c73
CRs-Fixed: 2925194
