Currently, Rx diag event work is not being flushed during idle shutdown.
This may result in use after free access if the scheduled diag event work
gets the chance to execute after driver modules are closed.
To address this, flush diag events work during idle shutdown.
Change-Id: I348e80d2c86a5e070f0fb67d66b758529fede76c
CRs-Fixed: 2838020
Currently QMI message length is not being validated before
handling QMI event. This is resulting in illegal memory access
when QMI message length is invalid.
To address this, discard QMI events with invalid length.
Change-Id: Ia9f04bcb4fa3b365cbbf2be8885a8d30f78f8f10
CRs-Fixed: 2839277
The bcast twt functionality may need to be enabled separately
for requestor and responder roles. Enable such configuration
by looking up WMI service bit support from target:
wmi_service_twt_bcast_req_support
wmi_service_twt_bcast_resp_support
Change-Id: Ibc91173c23cf69f0d248af27d61c77bee3e8f48a
CRs-Fixed: 2828720
Add feature capability indication for Adaptive 11r for the
drivers to advertize support for this.
Change-Id: I28da5c3d7d4d841de980c841b1d4c39be12ed295
CRs-Fixed: 2817358
As part of monitor mode init, add check for null monitor vdev before
accessing vdev_id in case prevous cleanup of monitor vdev still ongoing.
Change-Id: I0165684c8aa2abea73fa8c0d1692dac789fb20f6
CRs-Fixed: 2835758
Vdev object manager reference should be taken before enqueuing
serialization command and it should be released after dequeuing the
command from serialization queue. Currently this reference release is
done before moving the command to active queue from pending queue.
This may lead to vdev object deletion before the command is moved to
active queue and result in use after free access for vdev object.
To resolve this, release vdev object reference after moving the
serialization command to active queue.
Change-Id: Ibef0814a245abb36f526997d848cf15ef6a49a44
CRs-Fixed: 2832676
Introduce proper logging APIs for diag module and also rate limit error
logs when skb allocation fails in low memory conditions to avoid excessive
logging side effects
Change-Id: Ia41ff7cfd526180825df61a43f1f59163947f257
CRs-Fixed: 2836681
Currently, reg_set_2g_channel_params_for_freq only considers
enabled channels when filling in the channel params. This
could cause issue when starting vdev in a passive channel.
Update the logic to consider CHANNEL_STATE_DFS as well.
Change-Id: I7a49aaa9a51e09729d7b912a6e3fd62fa240d714
CRs-fixed: 2835565
Add drop statistics for duplicate EAPOL frames received
in the REO exception ring as OOR frames. This will help
understand if EAPOL frames are getting dropped which could
cause connection issues.
Change-Id: Ib9d5a3c04ce6638c65166f02261af5c526cc47eb
CRs-Fixed: 2814633
Currently, host decrements beacon switch count and sends
channel switch frame every time until count becomes 0 this
may introduce sync issue between fw and host.
To avoid sync issue csa switch count is offloaded to fw. fw
will send CSA_SWITCH_COUNT_STATUS_EVENTID once beacon count
becomes 0 and host will send vdev restart once it recives
CSA_SWITCH_COUNT_STATUS_EVENTID.
Change-Id: I60238e8e83b56ca4c6490f9516d673d14ef9c323
CRs-Fixed: 2831356
QMI bypass mode uses 2mb of of mem region for
fw uses. Current implementation does not free this
memory region when qmi bypass mode in enabled.
Free mem leak in qmi bypass mode.
Change-Id: Ie11aa9f20f93183e0b999cd6578aea4b231f8d8b
RTPM wow resume gets triggered from ongoing WMI cmds related to SAP
getting started on the 5 GHz DFS channel. Even though PCIe link resume
is successful, there is a link up vote from UMAC and scn link suspended
state is not getting clear. Thus, clear the scn->link_suspended state
at the end of hif_pci_bus_resume_noirq() because before HIF PCIe bus resume
noirq phase is complete, PCIe link is already resumed.
Change-Id: If05593c95d2d63d271fed4abcf84b43e96cc070e
CRs-Fixed: 2833831
check csa_beacon_template service and set
WLAN_SOC_CEXT_CSA_OFFLOAD/25th bit of
soc_fw_ext_caps in psoc if service is
supported by fw.
Change-Id: I8dca74c805cc8696f261e0f791818bca579c80c8
CRs-Fixed: 2826451
Add support to view station's peer RSSI value in auth and assoc request
packet by extracting rssi from probe request and passing it down to
FW in the auth request and assoc request mgmt frames.
Change-Id: I92f714ed815ab8c77f6a6b7df3363dc96f1119bc
CRs-Fixed: 2832982
The nla_data coming from user space is a variable length data,
but the driver is checking nla_len() against a fixed length struct only.
It is possible that the nla_len() check against fixed length struct
may pass and if the nla_data does not have the payload and it may
result in possible out-of-bound read (slot->payload).
Hence the fix is to, check if nla_len() is atleast more than
the fixed length struct and also account for payload length.
Change-Id: I2e68d55c0411cff55908c1704031e3c070f3316e
CRs-Fixed: 2825763
Add CDP API to dump the SW head pointer and tail pointer
of a few important srngs. This can be used to debug or
get a direction when the device doesn't dump ram info.
dp_print_ring_stat_from_hal is not being used, since without
device force wake recipe in place, reading hardware hp/tp
value can lead to NOC errors.
Change-Id: Ib0381acb007f1b4431f6a02cd9762e461d6393e8
CRs-Fixed: 2826084
Currently the connection manager queries the
blacklist manager about the action to be taken
and if all the candidates of a certain SSID are
blacklisted then the connection would be rejected.
There are various types of blacklisting, some
can be overridden and some have to be strictly
followed.
Fix is to overide the blacklist candidate and
connect to it if no other candidates are suitable
for connection.
Change-Id: I84358df5f94d4c82989bf81412355f312320dc0b
Crs-Fixed: 2825519
Define QCA vendor attributes to dynamically configure TX NSS and RX NSS
to be used with QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION and
QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_CONFIGURATION commands.
Change-Id: I9b3b3d3c5be2abd01fa8669b10c2961c271ecdbb
CRs-Fixed: 2831257
In mission mode, when PKTLOG is enabled, dp_mon_filter_update()
will reset the RXDMA2SW ring filters which will block the RX
completely leading to connection issues.
Reset monitor mode filter only when monitor VDEV is configured.
Change-Id: I0f55370af74a5f538ef926d8f8d61bffaa64a69e
CRs-Fixed: 2827739
The function qdf_ini_parse returns QDF_STATUS as SUCCESS even if no
fields are read from the ini file. Because of this even if the
ini file is corrupted and no values are read from it the function
still returns SUCCESS.
So, to avoid that and ensure that the ini file is not corrupted,
add a variable ini_read_count to count the number of fields read
from the ini file and return SUCCESS only if its value is not zero.
Change-Id: I5ec9a9cdc9780b6c9487f6ac64b411b81328d75c
CRs-Fixed: 2804937
Currently, there is no INI parameter to control NAN feature in 6GHz
frequency band. Because of this, there is no provision to disable the
NAN in 6GHz when there is no requirement.
To address this, add INI parameter to configure NAN feature in 6GHz.
Change-Id: Ibc653d6241d176f7fb75f18d2886175231ad71cc
CRs-Fixed: 2817925
Upper layer (OS_IF) can mark certain packets to be sent
to FW. Mark such packets as exception, so that it is sent
to the FW.
Change-Id: I653a7ea657e9dffc18ffd88662aa2082214bc469
CRs-Fixed: 2826442
This reverts commit Change-Id: I98f8f751dc75a3d6f2296f0844529e9c72c4090b.
This INI is moved to HDD_DP.
Change-Id: I451fa50621fdc8b6cbe027bdf1495788914481c9
CRs-Fixed: 2824623
Scan entry fails if any coruppted IEs are present
Introduced new ini parameters to enable scan based on ie
corruption. If ini parameter is enable then scan module skips
all IEs following coruppted IEs and adds scan entry without
completely dropping the frame. Otherwise if ini parameter is
disable then scan entry fails on corrupted ie.
Change-Id: If17b68448dd3e6ac3e98ed854ed67d7f16d9dff7
CRs-Fixed: 2806932
Rxdma err destination could still grow even after monitor
status ring filters are reset as part of monitor mode
disablement which will result in RXDMA2SW ring back-pressure.
Fix is to reset RXDMA_BUF ring filters when monitor mode is
disabled.
Change-Id: Ifd56f6bdbf6a5e4c5d39fc5c71dd85925e3d5f33
CRs-Fixed: 2818011
FW diag events will be dropped when number FW diag events pending for
processing is reached to configured RX_DIAG_WQ_MAX_SIZE value. Add a
log when these diag events a getting dropped for debugging purpose.
Change-Id: Ifc303991bdf274fa7426794eaf71517722e9f386
CRs-Fixed: 2824458
Excessive logging is detected when force wake request
command fails.
Rate limit the logs in hif_force_wake_request and
hal_write32_mb.
Change-Id: I9b1166074dfdb2d58d811571c802a75a6dbc03c5
CRs-Fixed: 2823961
RX error stats from REO2TCL ring is just for RX 2K jump/
OOR frame, host should not count them as rx_mpdu_error
stats for user space which will think wifi connection is bad
easily in noise environment.
Align this part logic with Helium that count TKIP/MIC error
frame, for HST/HSP, use error counted from RXDMA instead.
Change-Id: I2e488bedaed166ce410c53eb7e9710d7933c2717
CRs-Fixed: 2821147
Excessive logging was detected in dp_tx_msdu_multiple.
To fix this, Reduce log level when tx_hw_enqueue fails.
Change-Id: I66d58d12aff037896c7623c6755a443092673a88
CRs-Fixed: 2823453
Currently, FW diag logs, management frames and stats responses are
processed in worker context. Because of this, there is a possible
out of memory scenario when there are huge number of diag events
waiting in work queue.
To address this, process diag events in a separate worker thread and
set the limit for the number of diag events that can be queued in
work queue.
Change-Id: Ie6e5b905a3b591cf724cd6b024bec0612f9e2e0c
CRs-Fixed: 2818013
Add new API to check if frequency is passive or not. The API checks
the channel flag against REGULATORY_CHAN_NO_IR.
Change-Id: I166a7a79517f81c23ff933d2657ef3f4c551c082
CRs-fixed: 2822205
While in mission mode, add support for monitor mode to be created as
another interface to support STA + monitor mode. Create a new
mon_vdev_timer to be started during vdev_attach and calling
dp_mon_vdev_timer to reap monitor rings while in this mode.
CRs-Fixed: 2815653
Change-Id: I631deb5121d7997cded524befd11883079a23aaf
After clear nol channel, the number of nol channel is 0. We should update
this information to platform.
Change-Id: Ia39be9a2c53067629460ead6000c2661ead07f63
CRs-Fixed: 2818936
When 5G open mode AP and 2G WEP mode AP use same ssid, and WEP mode AP is
selected to connect on UI, 5G open mode AP will be candidate in driver
too for wrong security filter(WLAN_CRYPTO_CIPHER_NONE is supported by
default, WEP match isn't checked at all for open AP).
Since 5G is preferred, 5G open mode AP is selected and connected at last,
peer is set as authenticated without waiting for key install.
But WEP mode AP is assumed connected in wpa supplicant, so WEP key is sent
to driver and F/W later. If peer is set as authenticated before PTK is
installed, data may be sent without encryption, so F/W add assert for such
order.
To fix this issue, when reset cipher and auth set in vdev, don't keep
WLAN_CRYPTO_CIPHER_NONE and WLAN_CRYPTO_AUTH_OPEN, just set to 0,
all cipher and auth set should be get from connect request,
scm_check_wep can be called for open mode AP in scm_is_security_match,
when only WEP cipher is set in filter, open mode AP won't be selected.
Change-Id: I48f9e74d0e8e31e789f33d038b11614d6b2ee6d0
CRs-Fixed: 2820129
Currently the rx tids are getting setup for the
self peer in monitor mode. This leads to sending
commands to the reorder-hw and the hardware generates
its responses.
In Monitor mode, none of these rings are reaped, since
the reorder-hw is not used. This opens up a possibility
of backpressure on the reorder-hw rings.
Skip setting up the rx tids for monitor mode
self peer, since they are not used.
Change-Id: I37bade9ef5c8bd536a01371cc059ebbcfb85ee5a
CRs-Fixed: 2815866
REO remap register direct writes as part of SAP stop could
result in a NOC error if the UMAC is in low power state.
Fix is to use shadow register writes for REO remap and
WBM HP registers.
Change-Id: Ie515c3d28f4ccdd99a3757808f1ab6c5cf373e3d
CRs-Fixed: 2813105
Currently, we decrement active_work_cnt in a while loop in delayed
register worker and later on make a "allow_l1" call to enable L1ss.
The bus suspend routine depends on the value of active_work_cnt to
determine if any register writes are pending. In case there are, bus
suspend is rejected.
As a result its possible that when bus suspend happens, the
delayed worker while processing the last remaining enqueued
write, makes the active_work_cnt to 0. This will allow the bus suspend
routine to continue to disable the bus, even before the
delayed-reg-worker has called allow_l1 and run to completion. This may
lead to a NOC error while calling "allow_l1" API from
delayed-reg-worker.
Hence, move the decrement of active_work_cnt to the very end in
hal_reg_write_work function.
Change-Id: Iec602f97c953df1c6a018310fd02ab458547ce3a
CRs-fixed: 2813733
This change fixed compilation error about implicit-fallthrough and
pointer to in cast.
Change-Id: Iea2c25d97d8a039ed0f8083078427a8f8de70cd1
CRs-Fixed: 2814658
Currently the driver does not have a support to
filter out the 6ghz frequencies from the valid freq
list, and hence there is a high chance of selecting
the 6ghz freq as an operating freq for SAP, which
the legacy clients won't be able to scan.
Fix is to add a support for filtering out the 6ghz
frequencies from the valid freq list.
Change-Id: I8e3552a254e2b79cc1fc09da3e1e06ac378cbb07
CRs-Fixed: 2801414
Update log level of peer null check from err to info
in dp_tx_comp_process_tx_status as excessive logging
is detected.
CRs-Fixed: 2811236
Change-Id: I1b0ae723adb90b4b915f11479b5408fde147864c
Due to recent FW changes not filtering out BAR frames, redirect these
frames to REO exception ring and handle as normal data packets.
Change-Id: I4540929fddab14de57a23f6364fc916a70057cbe
CRs-Fixed: 2795499
