For qdf_mtrace 15 bits are reserved for message id and currently
WMI message IDs are getting used as 32 bit IDs.
Write a wrapper function which accepts 32 bit message IDs and
converts this 32 bit message id to 15 bit by extracting
WMI_GRP_ID and WMI_MESSAGE_ID in that group. New 15 bit
message ID for qdf_mtrace will be constucted as 8 bits
(From LSB) specifies the WMI_GRP_ID and remaining 7 bits
specifies the actual WMI command. With this notation there
can be maximum 256 groups and each group can have max 128
commands which can be supported.
Change-Id: Ia5adfc079b63c2311bdc8ae4c73488d89afd462f
CRs-Fixed: 2298877
Currently qdf_mtrace is defined outside TRACE_RECORD macro which
is using qdf_trace api and this is defined inside TRACE_RECORD
macro for MCL. since qdf_trace is having different definitions
for MCL and WIN as for MCL it is defined as a function and for
WIN it is defined as a MACRO.
To resolve this put qdf_mtrace inside TRACE_RECORD macro
Change-Id: I5de2cdff3942ca10b6d5d562f28d359f7f655ed4
CRs-Fixed: 2310167
We are transitioning to new logging infrastructure
by using existing mtrace functionality.
Add new logging for complete P2P module.
Change-Id: I34b1f3b0db9e9b5cfd4ae779cca14584e9b68841
CRs-Fixed: 2308565
wlan_objmgr_insert_ld_obj_to_list is starting
the qdf_timer_start within locks when list is
empty and during new object is being inserted
wlan_objmgr_iterate_log_del_obj_handler was
also starting the timer with qdf_timer_mod
without locks
Both functions tried to modify/start timer
and there was already a pending timer running
due to race condition between the functions
Hence move qdf_timer_mod inside spinlock to
gain access to timers atomically
CRs-Fixed: 2437930
Change-Id: If7d0b4b56372e14b20768a9a7a6da3c3f5095d7d
Set monitor direct filter when smart monitor is
enabled. Deliver header from NAC if md bit is set
and smart mesh feature is used.
Change-Id: If1ef865e013c21bbb58bcb89a87856b12d6c7278
Crs-fixed: 2246660
1. Split the serialization API's into the following files
1. serialization_api.c : Serialization public API's.
2. serialization_internal.c : Serialization internal API's.
3. serialization_queue.c : Serialization pdev/vdev queues API's.
4. serialization_main.c : Serialization object manager related API's.
5. serialization_utils.c : Serialization low level primitive API's.
2. Following files are not not used with new serialization
1. serialization_enqueue.c
2. serialization_dequeue.c
3. Using the new queue objects for pdev/vdev and component specific.
4. Implemented Locks for request, release and cancel APIs.
5. Removed locks for the lowest primitive queue API's
6. Timers executed in mc thread from MCL and timer context for WIN.
7. Allow cmds from multiple vdevs in parallel in non blocking mode.
Change-Id: I3cabcf512225331db46956ffad4ddab581c7e52b
CRs-Fixed: 2304513
The function wlan_ftm_process_utf_event, is invoked upon the
reception of the WMI event WMI_PDEV_UTF_EVENTID. The event_buf
argument to it is fully FW controlled. There are two issues
here:
1. event.datalen of type uint32_t is assigned to utf_datalen of
type uint16_t which can lead to a possible integer underflow.
2. utf_datalen is calculated as the difference of event.datalen
and sizeof(seghdr_info), without validating if datalen is not
less than sizeof(seghdr_info). This could cause a potential OOB
write as utf_datalen is used as the size to copy utf_data to
ftm_pdev_obj->data.
Add fix to change the type of utf_datalen to uint32_t.
Change-Id: Ibd61b4ef8cd514d43f212174e745b1c76af1047d
CRs-Fixed: 2305477
Don't remove id tx action frame, since it will be removed when cleanup
related ROC. Limit the ROC duration if the original ROC duration is
very long.
Change-Id: I78e34710530a32f88e955471c974f7078df2e0a9
CRs-Fixed: 2302008
For a 2GHz pdev, dfs object is NULL and hence 'dfs is NULL' print is
always seen in some of the dfs functions when user enables the dfs
error logs.
To fix this, add non 5 GHz pdev check before dfs NULL check.
Change-Id: I4702d8c487d5533a2a99b4560471a38992ea9177
CRs-Fixed: 2296853
Avoid deadlocking by disabling bh while holding completion_freeq_lock
operating in process context.
Change-Id: I16b105f68e07939d340ccccfd96f81a37959d5bc
CRs-Fixed: 2308549
Add wmi layer support to get firmware roam scan statistics which includes
scoring of roam candidates, channels, old and new bssids etc.,
Change-Id: I3a0aafbe66d12eea40e71ceb4c7c3a60b9d6e04f
CRs-Fixed: 2203904
On NOL timer expiry, timer callback handler dfs_remove_from_nol is called.
It acquires dfs_nol_lock at various instances while accessing the elements
of NOL list like deleting an NOL element, printing or copying the elements
of NOL. Also, there is a thread scheduled in the callback handler
dfs_nol_elem_free_work to free the NOL element memory after all operations.
This thread does a del_timer_sync and hence waits for the timer handler to
complete operation before freeing the NOL timer element.
Consider a case where nol timer expires on channel (say chan 100) and
the timer handler is called on core1 of CPU. After all cleanup operations,
the thread to free NOL timer element is scheduled and acquires an NOL lock.
The lock will be released only after del_timer_sync succeeds in its
operation for which the handler (dfs_remove_from_nol) must have finished
executing on other CPUs.
While the Lock is held by Core1, nol timer expires on another channel
(say chan 120) and timer handler function dfs_remove_from_nol is called
from CPU Core0. In the handler, the same NOL lock is tried to be acquired.
Since it is already held by cleanup thread, it spins. del_timer_sync fails
to succeed in its timer cleanup as the handler function dfs_remove_from_nol
is executing on another CPU. It waits for the handler to finish execution
and handler waits for the lock acquired by the thread. It runs into
a deadlock.
Release the NOL lock before calling del_timer_sync. This will give a
chance for the handler to execute. Acquire the lock again when the next
element is removed from the free list.
CRs-Fixed: 2301063
Change-Id: I822714edee3269ccbb93838e3892796219e1b88e
Set the frag list of the nbuf of a RX defragmented pkt to NULL.
This list will be used to stich the fragmentation list.
Change-Id: I341b0085c123a72dcd74d7f76a4979286e75dc8e
CRs-Fixed: 2297483
The function extract_pdev_utf_event_tlv, is called when the WMI
event WMI_PDEV_UTF_EVENTID is received. The event_buf
argument to it is fully FW controlled. There is an assumption
that the WMI message is at least the size of struct
wmi_host_utf_seg_header_info which could lead to OOB read issues
when a shorter message is sent.
Add fix to validate the event->datalen passed against
sizeof(struct wmi_host_utf_seg_header_info) before copying to
seg_hdr.
Change-Id: I1a8313f11013722edb601c009e59b1509fda3280
CRs-Fixed: 2305465
There is possible to read buffer overflow. Since it don't check number
of NOA descriptor when handling WMI_P2P_NOA_EVENTID.
Change-Id: I08fc3ac429bc19a8df7ac429fbe779fa3b227318
CRs-Fixed: 2307321
Put the nbuf map/unmap code under NBUF_MAP_UNMAP_DEBUG.
nbuf map/unmap debug will be enabled on WIN once
the nbuf map/unmap related false positives are fixed.
Change-Id: I6b62539d39664db3ff62411fe8632633f53488c8
CRs-Fixed: 2284128
Validate type which is used as index of req array to avoid any
out of bond access issue.
Change-Id: I75d08054b94b7066f7bdc030cf9896469c923a65
CRs-Fixed: 2305555
Add implementation to enhance structure
corresponding to WMI_DCS_INTERFERENCE_EVENT_ID
handler in cp stats component which hold
secondary 40 and 80MHz utilization
which are required parameters of Extended BSS IE
Change-Id: I1c471608394d5c395632742098d2c92fc02ec238
CRs-Fixed: 2298073
In wmi_unified_cmd_send() function, pass function name and
line number of caller and log the same in case of failure,
this approach helps to remove error logs in caller function
there by reducing text segment.
Change-Id: Ib70d55959087021c4495c175d5363375037afe00
CRs-Fixed: 2281983
In qdf_nbuf_alloc() function, pass function name and
line number of caller and log the same in case of failure,
this approach helps to remove error logs in caller function
there by reducing text segment.
Also add qdf_rl and qdf_rl_nofl_* macros.
Change-Id: Ib8ce83335807cfbd2d83d1f165d6bec1dc1e4c94
CRs-Fixed: 2281983
In wmi_buf_alloc() function, pass function name and
line number of caller and log the same in case of failure,
this approach helps to remove error logs in caller function
there by reducing text segment.
Also add wmi_nofl_* macros.
Change-Id: Ib1ac8bf2bbcefa7f0015aff2733d3dc4773b185d
CRs-Fixed: 2281983
In qdf_mem_malloc() and qdf_mem_malloc_atomic(), pass function
name and line number, and log the same in case of failure, this
approach helps to remove error logs in caller function there by
reducing text segment.
Change-Id: Ia4586b112c6dd64aca5b397b43bb17499a0e6e30
CRs-Fixed: 2281983
In target_if_radar_event_handler, target_if_dfs_cac_complete_event_handler
& target_if_dfs_radar_detection_event_handler wmi_handle is derived &
dereferenced with out a NULL check. Add a NULL check for wmi_handle
before it is dereferenced.
Change-Id: I6dde5132a6a2e31a25654bd818a90e1c164a4a74
CRs-Fixed: 2305505
P2P Listen offload is not a requirement for Genoa, hence featurize
P2P listen offload code to save memory foot-print for Genoa.
Change-Id: I3c32b4ee2b37421e49acee4bd20d36e7a8a3bf77
CRs-Fixed: 2304555
In policy_mgr_is_hw_sbs_capable wmi_handle is derived & dereferenced
with out a NULL check. Add a NULL check for wmi_handle before it is
dereferenced.
Change-Id: I6081bb6f24ce52a3016712d4f1b481f5fb6a9c8f
CRs-Fixed: 2305529
Current driver calls ce_tasklet_kill API which does
tasklet_disable() first and then does tasklet_kill which invites
race condition as follows.
1) Lets say CPU-0 is executing ce_tasklet_kill() API
for CE1 (in process ctx) to kill any tasklets associated with CE1-IRQ
2) t1 time- CPU-1 has scheduled the tasklet as part of rescheduled API
ce_schedule_tasklet(), so this tasklet goes to be scheduled list of
kernel.
3) t2 time- CPU-0 executes tasklet_disable() and about to execute
tasklet_kill()
4) t3 time - kernel got a chance and wants to run the tasklet which was
scheduled at t1 time but it can't because t2 time, tasklet has been
disable.
5) t5 time- CPU-0 now executes tasklet_kill which checks if any
tasklet which is in "SCHEDULE" state to go to "RUNNING" state and
finish and tasklet on CPU-1 can't go to "RUNNING" state due to
tasklet_disable(), driver is stuck waiting for it to finish.
Fix the situation by removing tasklet_disable()
Change-Id: I3ac56975dc1f6538962060dd20e881c43e7516ca
CRs-Fixed: 2301368
To help triage issues where the scheduler thread is processing slowly,
add a scheduler processing history for offline analysis. This can also
be useful in determining if a processing delay in some operation is
attributed to the scheduler thread or not.
Change-Id: Icfea17efc34b2a23d4f8b2baebe08db4e2f6ce8b
CRs-Fixed: 2307252
At peer deletion corresponding mgmt packets needs to be cleaned up.
So add mgmt_txrx api to drain all the mgmt packets specific to a peer.
Change-Id: I6a7f5efa665a1da009e594248e88002df35ae9ff
CRs-Fixed: 2299964
In target_if_ftm_process_utf_event is derived & dereferenced
with out a NULL check. Add a NULL check for wmi_handle before it is
dereferenced.
Change-Id: Id3c1ae4df9aa7b0cfc12fbf9288bec2ae72c6de6
CRs-Fixed: 2305506
In target_if_tdls_update_fw_state, target_if_tdls_set_offchan_mode,
& target_if_tdls_set_uapsd wmi_handle is derived & dereferenced
with out a NULL check. Add a NULL check for wmi_handle before it is
dereferenced.
Change-Id: If741f69773a712cebcd1be889ca09d01eee97fae
CRs-Fixed: 2305520
In target_if_pno_start, target_if_pno_stop,
tgt_reg_chan_list_update_handler, tgt_reg_11d_new_cc_handler &
tgt_reg_ch_avoid_event_handler wmi_handle is derived & dereferenced
with out a NULL check. Add a NULL check for wmi_handle before it is
dereferenced.
Change-Id: I4b4afa5bb74a2c97d921af2672eb285f7c34062a
CRs-Fixed: 2305512
The Firmware will switch to default US regdomain
after SSR.
After SSR we need to keep the old country code,
so skip the chan list update firmware event duing SSR.
Change-Id: I8735abef67e072f60961aab655a016348dc9d4a0
CRs-Fixed: 2304303
Add DFS coverage for channel plus width combinations
for overlapping channels in ETSI domain.
Change-Id: Id55f6b42a7ae3bad45c334ff5163a9458b825cd6
CRs-Fixed: 2291635
Currently wds enable for vdev conditional check is there for
intra bss rx forward. This check will break the intra bss for
the platforms which does not support WDS feature. In this change
remove the wds enable check for dp vdev.
Change-Id: Ib61c53734254b768902704ccb0e2a5c9b53f35f1
CRs-Fixed: 2303905
