In case of successful transmission If MPDU tx
is retried more than the threshold then
increment MPDU retry count by transmit_cnt / threshold
Change-Id: Idbc7e2d0579ff68e272132fe4ffe9f951c4aacf5
CRs-Fixed: 3058464
This change introduces the new roam set param WMI command to set
the roam params from host to FW.
Also added a fail_bssid param in wmi_roam_result TLV to know the
roam failed AP BSSID from the FW.
Added a new vendor command event for sending roam events stats
attributes to userspace.
Change-Id: I7a08635a7912cbd940d90a2d62433296740ad913
CRs-Fixed: 3050799
Introduce a new vendor command QCA_NL80211_VENDOR_SUBCMD_ROAM_EVENTS
that aims to configure/trigger the roam events from the driver.
Change-Id: Ifd9464cc8cb485890c8d171dc136d377f7a59fa1
CRs-Fixed: 3028404
Currently there is mismatch in time-stamp source for
hif_hist_skip_event_record with respect to hif_hist_record_event
Updating time-stamp source in hif_hist_record_event to match with
hif_hist_skip_event_record time-stamp source.
Change-Id: I55680c40860eafb5c6ed6117ab7c55bb38cc24bb
CRs-Fixed: 3000319
Currently reg work is being cancelled in deinit path,
cancel work will remove all the pending work items
and wait for completion of current executing work.
But in reg work case even pending work items has to be
executed because we don't want to skip HP/TP values update.
To avoid this make sure all the pending reg work items are
flushed then disable the work for further queueing.
Change-Id: I2ba1e26cf41fb3b0c33ec584c56525cbfac94d8f
CRs-Fixed: 3065038
If ppdu rssi unit is dbm, need convert to db for API:
qdf_nbuf_update_radiotap, only need convert once for first mdpu in the
ppdu. if convert for each mpdu, wrong rssi will be saved.
Change-Id: I85e92121ddb289e3513022ff092083825197efb4
CRs-Fixed: 3057041
If two channel avoid event reported by FW back to back, flag
psoc_priv_obj->ch_avoid_ind of 2nd event set by
reg_process_ch_avoid_event may be modified when processing
1st event in reg_call_chan_change_cbks, from
scheduler_thread context.
Copy chan avoid info to message post to scheduler to avoid
such timing issue.
Change-Id: I8fd5e7e8f2d9b2117a5c6a54fd8b64659e10f7d6
CRs-Fixed: 3012331
2 threads blocked to wait channel_switch_complete_evt for SAP channel
switch is already in progress, qdf_event_set only woke up 1st thread
later, 2nd thread still kept blocked with hold net_dev for debug id
NET_DEV_HOLD_COUNTRY_CHANGE_UPDATE_SAP, leak happened.
Change-Id: Ib76318dd4a613ca1852a56b7701a04385b69ba56
CRs-Fixed: 3061976
Add HIF events to track NAPI POLL exit time, this gives
information about actual time spent by wlan host in napi softirq.
Change-Id: I7548fd05f2f7db714ac9bcf79171ffb3d478e936
CRs-Fixed: 3052902
Currently, host allows NAN log messages from firmware upto a max
size of 200 bytes. But firmware may need to send bigger messages
than this in case of stats events as tx/rx stats message length
can go upto 350 bytes.
So, allow NAN messages upto 400 bytes to avoid splitting
the stats messages.
Change-Id: Ibb03944da81ed8d378dadbf4750013e0fe941e57
CRs-Fixed: 3049258
This FEATURE_HAL_DELAYED_REG_WRITE_V2 was added to fix the
Audio jank issue, but it could not resolve it completely,
so that was later fixed by existing delayed reg write
support with the help of SMP2P messages to communicate
with FW regarding PCIe link status. This code is not being
used, so removing it and cleaning up the redundant code.
Change-Id: Iada088e72a76b4c071c8a80ee945f36ac959670e
CRs-Fixed: 3056475
Validate the SSID & cache ID if SSID length is present in the
pmksa entry, as in FILS case only SSID and cache id are filled
and BSSID is not filled.
So validate the BSSID only if the SSID is not present.
Change-Id: Ia0a31f953869f00495fad597bb564ec706425312
CRs-Fixed: 3051530
It calls spectral_process_phyerr of spectral operations without any
check. Which cause null point dereference potentially. So, check this
pointer before calling.
Change-Id: Iae246f847dd41e62b628223652a9527a65b43799
CRs-Fixed: 3055246
TP and HP values are assigned wrongly while
printing ring history. Fixing assignment.
Change-Id: I50ea90a3b49ab4d5459a3e0ddfa259f669764433
CRs-Fixed: 3051531
Add a CDP api to update the packet capture mode in dp_soc
when it get updated by user using vendor command.
Change-Id: Id0856aeeb5e1a77e1ce6fb23562fdbff4a2fb320
CRs-Fixed: 3048344
Add new vendor command to configure monitor mode packet filter
parameters which includes data/mgmt/ctrl frame types.
Change-Id: Ie5e5d35b725e3d1b617edc1c889dc269b22a3673
CRs-Fixed: 3025489
It doesn't check smode before used as array index, the potential risk
is that OOB read or write once get invalid value from target. So, this
change checks smode value before using.
Change-Id: Ibc0625f43e31bc8b49694cca778726c6528290a8
CRs-Fixed: 3034136
In extract_time_sync_ftm_offset_event_tlv there is a possible
OOB write when value of num_qtime received from firmware is
greater than FTM_TIME_SYNC_QTIME_PAIR_MAX.
Fix is to add a sanity check for value of num_qtime received from
firmware to avoid the OOB write.
Change-Id: I6e57b1d716992d1a3c7d2f7ea911fefcbfbeff34
CRs-Fixed: 3033509
When a scattered frame is received, msdu length caclulation
is incorrect, this leads to while loop can't break. At last
skb, null pointer dereference happned. Change is aimed to
correct the length caclulation.
Change-Id: Ifb316f004ea5829b1130ce4c0fc9253134e26713
CRs-Fixed: 3025973
Add support for extracting Thermal Stats Events
from thermal event TLV for FW event
WMI_THERM_THROT_STATS_EVENTID.
Also, added support for FW Cmd to request for
Thermal Stats: WMI_REQUEST_THERMAL_STATS_CMDID
Change-Id: I2bc80d082bda45e2255371bcb0c31d35d9806525
CRs-Fixed: 3016845
6GHz do not have any dfs channels so do not update dfs related
parameters for 6GHz frequencies
Change-Id: I791622ce4b401bca65f132665eb2a1ebd7c9e931
CRs-Fixed: 3020653
Dump flow pool stats even for low verbosity level as
part of periodic stats display.
Change-Id: Iea59d20b0a81cfd0bfdac65ad54a11fa33f30f2f
CRs-Fixed: 3031168
Firmware sends some ppdu stats required for packet capture
mode in new ppdu stats tlv HTT_PPDU_STATS_FOR_SMU_TLV.
Add code to parse it if feature is enabled via ini and
send the ppdu stats using wdi event to packet capture
component.
Change-Id: I5567007a91093dd342f37458760b3a61c040b779
CRs-Fixed: 3004476
Currently, rx packet capture events processing happens even
when feature is disabled by ini. This incurs per packet overhead
in rx path.
The fix is to move all the processing from rx path to packet capture mode
component. Send only wdi event from rx path, when feature is enabled by
ini.
Change-Id: I647256b85117cd3373950c78a5a0ae7d6710e4e2
CRs-Fixed: 2969123
Currently error BAR frames are routed to host, but host
doesn't have complete information to check whether these
frames are valid and really action need to be taken or not.
If host updates H.W without validating SSN it is causing
window movement and REO HW aging timeout happening for
next set of RX packets and delay is induced.
To avoid RX packets delay skipping BAR update to H.W
Change-Id: I92c1614993b6985218a453fe528fbd274fab254f
CRs-Fixed: 2995461
There is a requirement to get sequence number and tid for tx
data packets in packet capture mode. These fields are not
received as part of WBM tx completion, but are obtained from
FW in ppdu stats. As WBM tx completion and FW ppdu stats are
two different events, the ppdu_stats of previously sent ppdu
are filled in the radiotap header of current tx ppdu in packet
capture mode.
Enhance code to add required fields such as ppdu_id of tx current
ppdu and ppdu_id, tid, start_seq, ba_bitmap of previously sent ppdu
as extension2 to radiotap header. These fields will be added in
radiotap header only when add_rtap_ext2 is set.
Change-Id: I448a9c03a770b61ab802d855bc5f1a6587bd01b3
CRs-Fixed: 3004472
In case of split profile, while parsing the other segment
of the non transmitted profile present in the subsequent
MBSSID tag, it is possible that the beacon is corrupted where
the non tx profile length has gone out of bound.
In case of above scenario, the MBSSIE parsing code does not
free up the memory allocated for split_prof_start before
returning, which could possibly result into a memmory leak.
Handling the split_profile_continue bit before non tx profile
length check can avoid this situation.
Change-Id: Iaa491fd2803d88759e74ca5a668dddb9f8a42708
CRs-Fixed: 3023554
While parsing MBSS IE split profiles, bssid copy flag
is not reset in between sub element parsing resulting
in skipping the bssid copy for next non tx profile.
Reset skip_bssid_copy flag for each sub element parsing
so that correct bssid is copied for next non tx profile
CRs-Fixed: 3019298
Change-Id: I429190b21a3ddafdc75a73e8b063f6b6f629492a
Even though force wake request timed out there is possibility of
wake request got stuck and handled later at qmi level this leads
to leaving device in wake state for long time unnecessarily.
To avoid this send force wake release when wake request times out.
Change-Id: Ic0e1b3d3fe9d4b0e0f0d4b9be5804ef4f1d3e724
CRs-Fixed: 3019575
Since target already converts RSSI from SNR to dBm for QCA6490 and
WCN7850, so don't convert them again in host side.
Change-Id: Ie35f3821a802f2e65b61f4891f2ca9c632fa1477
CRs-Fixed: 3024119
util_scan_copy_beacon_data copies beacon and updates ie
pointers for the cache entry. However, two of the ie pointers
listed below are not updated:
1) hecap_6g - pointer to he 6ghz cap ie.
2) srp - pointer to spatial reuse parameter sub extended ie.
These non updated pointers will cause use after free issues
if the parent scan entry is freed.
Update ie pointers for hecap_6g and srp.
Change-Id: I6d0a6129941e3dc1267404a4191ab368c013a102
CRs-Fixed: 2862607
Enhance QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD to fetch thermal stats
for different temperature levels from the driver to userspace. The
stats will be stored in the driver/firmware for predefined temperature
levels and will be reported to userspace when
QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD is sent with command type
QCA_WLAN_VENDOR_ATTR_THERMAL_CMD_TYPE_GET_THERMAL_STATS.
The thermal stats can be cleared from userspace by sending
QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD command with type
QCA_WLAN_VENDOR_ATTR_THERMAL_CMD_TYPE_CLEAR_THERMAL_STATS.
Change-Id: I937bc89865df484a068c887d906df5a9502f1925
CRs-Fixed: 3016851
In the WMI_MGMT_RX_EVENTID event handling, add a length
check to validate if the buffer length sent by the firmware
is less than or equal to the actual buffer length.
Change-Id: I7db9af48bc525543b972dcaf40aee0a05d8f5023
CRs-Fixed: 3001331
In the WMI_PDEV_FIPS_EVENTID event handling, add a length
check to validate if the buffer length sent by the firmware
in fixed params is less than or equal to the actual buffer
length before processing the data.
Change-Id: I7a952d3e3a2f66060451263b72118a52aa89dd06
CRs-Fixed: 3009887
API "fw_diag_data_event_handler" is the handler of an event
WMI_DIAG_DATA_CONTAINER_EVENTID comes from FW. Arguments of
this handler function come from FW.
If num_data may be less than size of(struct wlan_diag_data),
possible OOB while extracting event data.
Fix is to add a sanity check for num_data to avoid the OOB
read.
Change-Id: Ia2eb62dbaa154936bdb4ea34065657d441f12810
CRs-Fixed: 3001178
API "target_if_wifi_pos_oem_rsp_ev_handler" is the handler for
the event with WMI_OEM_RESPONSE_EVENTID. Host receives
"rsp->dma_len" from fw. The integer overflow occurs if
"oem_rsp->dma_len" is big enough while calculating the total
length of the Oem Data response buffer.
Fix is to add a sanity check for rsp->dma_len to avoid integer
overflow.
Change-Id: Idfbd358f62534eae0147f03505ced5728877a269
CRs-Fixed: 3001191
During beacon or probe response, if channel is dfs && frame type
is MGMT_SUBTYPE_BEACON, it would call "util_scan_add_hidden_ssid"
to deal with the packet. If the ie id matches with SSID then OOB
read may occur in ie_len as it is validated with upper bound of
ie_ssid.
Validate the ie length first. If it is more than 0 then copy
memory to SSID which are equivalent to ie length.
Change-Id: Ib5e2ab7f6f3337d4c3e5c240e3133d8f276be50a
CRs-Fixed: 3007473
Add QCA new status vendor attribute
QCA_WLAN_VENDOR_TWT_STATUS_POWER_SAVE_EXIT_TERMINATE
to indicate the TWT session termination due to power save
exit request from userspace.
Change-Id: I515e4e8384b92b2556d72c4015252f075577f13c
CRs-Fixed: 3013360
Add new TWT teardown status code to indicate host teared
down the TWT session due to PS disable.
Change-Id: I49c2d7bb1abc4ceb4f79b833cbafcb44e8b936fe
CRs-Fixed: 3013358
In qdf_mem_multi_page_link, pages->cacheable_pages is array with elem num
pages->num_pages, but pages->cacheable_pages[pages->num_pages] is read,
out of bounds error will report if KASAN enabled.
When ini dp_tx_ext_desc is 6144 and DP_TX_DESC_POOL_SIZE is 6144,
Size in bytes of TX TSO Num Seg Desc is 16, page size is 4096, so TX TSO
Num Seq Desc need 24 pages (6144*16/4096), each address need 8 bytes,
so TSO Num Seq Desc need kmalloc 192 bytes to save address of 24 pages.
BUG: KASAN: slab-out-of-bounds in qdf_mem_multi_page_link+0x190/0x1f4
Read of size 8 at addr ffffff816b4d60c0 by task kworker/u16:0/8
CPU: 7 PID: 8 Comm: kworker/u16:0 Tainted: G S W O
Workqueue: cnss_driver_event cnss_driver_event_work
Call trace:
dump_backtrace+0x0/0x204
show_stack+0x18/0x24
dump_stack+0xcc/0x11c
print_address_description+0x88/0x578
__kasan_report+0x1ac/0x20c
kasan_report+0x14/0x20
__asan_load8+0x98/0x9c
qdf_mem_multi_page_link+0x190/0x1f4 [wlan]
dp_tx_tso_num_seg_pool_init+0x84/0x170 [wlan]
dp_soc_tx_desc_sw_pools_init+0xb4/0x128 [wlan]
dp_soc_init+0xf78/0x18c8 [wlan]
dp_soc_init_wifi3+0x14/0x20 [wlan]
cds_open+0x7e8/0x15fc [wlan]
hdd_wlan_start_modules+0x7d8/0xf10 [wlan]
hdd_wlan_startup+0x17c/0xbd4 [wlan]
wlan_hdd_pld_probe+0x234/0x370 [wlan]
pld_pcie_probe+0x6c/0x88 [wlan]
cnss_pci_call_driver_probe+0xd8/0x358
cnss_bus_call_driver_probe+0x38/0x6c
cnss_driver_event_work+0xf14/0x1188
process_one_work+0x53c/0x8b8
worker_thread+0x4f8/0x928
kthread+0x1e8/0x200
ret_from_fork+0x10/0x18
Allocated by task 8:
__kasan_kmalloc+0x100/0x1c0
kasan_kmalloc+0x10/0x1c
__kmalloc+0x130/0x448
kzalloc+0x14/0x20 [wlan]
__qdf_mem_malloc+0xcc/0x120 [wlan]
qdf_mem_multi_pages_alloc+0xc0/0x580 [wlan]
dp_prealloc_init+0x1b0/0x48c [wlan]
wlan_hdd_pld_probe+0x200/0x370 [wlan]
pld_pcie_probe+0x6c/0x88 [wlan]
cnss_pci_call_driver_probe+0xd8/0x358
cnss_bus_call_driver_probe+0x38/0x6c
cnss_driver_event_work+0xf14/0x1188
process_one_work+0x53c/0x8b8
worker_thread+0x4f8/0x928
kthread+0x1e8/0x200
ret_from_fork+0x10/0x18
The bad address belongs to the object
which belongs to the cache kmalloc-192 of size 192
The bad address is located 0 bytes to the right of
f816b4d60c0).
Change-Id: I6569c22bc8f900296f49a4426f085912a33aa452
CRs-Fixed: 3014390
Add CDP interface API support for pkt_log_exit,
to cleanup pkt_log_init on failure.
Change-Id: Ib50efaed5997d341d3e76c2e1dbe42856df40191
CRs-Fixed: 3012201
Currently in function wmi_extract_dbr_buf_release_entry,
num_buf_release_entry & num_meta_data_entry are copied
to direct_buf_rx_rsp structure without any validation which
may cause out of bound issue if num_buf_release_entry or
num_meta_data_entries provided in fixed param becomes greater
than actual number of entries.
Fix is to validate num_entries and num_meta_data before populating
param->num_buf_release_entry and param->num_meta_data_entry.
Change-Id: I18050fd4f90f8815d7eceb5f715fdbaa09130d3a
CRs-Fixed: 3000875
Define the new TWT attributes for configuring the broadcast TWT
parameters in enum qca_wlan_vendor_attr_twt_setup.
Change-Id: Ia7b0e1565cef3bfe5d213b783390c7231a1a8446
CRs-Fixed: 2924690
