Currently DMA mask for the device is set during hif_enable_bus.
If the datapath memory prealloc feature is enabled, there are
a few dma memory allocation which is done before the DMA mask
is set for the device. This leads to the aforementioned dma
memory pre-allocation to be attempted at the default DMA mask.
Due to this the entire device capability of dma address might
not be used.
Add hif api to set dma mask before hif is initialized. This
is needed to set dma mask in case of datapath memory pre allocation.
Change-Id: I6fd25d9cb6ab3aaacd6f959abe4e060e23f37095
CRs-Fixed: 2845020
scenario:
FISA new FST entry is initialed, host will start one timer to
send HTT MSG DP_HTT_FST_CACHE_INVALIDATE_FULL to FW in 5 ms,
WOW suspending happened in the same time, PCIe bus get suspended.
5 ms later, HTT msg sending will try to prevent PCIe L1 to update
CE SRNG HP register, hit assert as PCIe bus suspended already.
suspend and cancel the FSE cache flushing timer when dp_bus_suspend,
resume it when dp_bus_resume.
CRs-Fixed: 2843214
Change-Id: Ie2bc115a0de068335d6c46749f52d205cc21f5a3
rx_ring_history is an array of pointers, address of pointer is
always a non-NULL value, this always passed the NULL check,
which leads to NULL pointer dereference, fixing the same.
Change-Id: I401203a6f2a5930869cf4002ac0e714d3fdba62f
CRs-Fixed: 2844038
Some AP disables AMSDU in BA256 mode, this has draw back
with KPI in HE mode, so leave a config field to use 64 BA
forcibly to make high KPI with these types of AP
Change-Id: Ia69ffe118fd5bbda78cfb98126a483fcf305294e
CRs-Fixed: 2828304
Currently, 6g PSC/non-PSC channels in the scan request are
scanned or optimized to scan only if RNR IE is found based on
the inis scan_mode_6ghz and scan_mode_6ghz_duty_cycle.
As scan_mode_6ghz_duty_cycle is set to 4 by default, first 3
scans are optimized to scan only if RNR IE is found and 4th scan
would be full scan. If there is any standalone AP in 6g channel
that doesn't advertize RNR IE in colocated APs beacons/probe
responses, that's not scanned till the 4th scan.
Reverse the order for scan_mode_6ghz_duty_cycle such that the
first scan of every four scans is a full scan and rest of the
three scans are optimized. So, the standalone 6g APs can be found
in first scan itself based on the ini scan_mode_6ghz.
Change-Id: Ice1614a94f1fd166e283355616ace241a5df2bcb
CRs-Fixed: 2829550
When the number of HTT packets in the endpoint TxQueue is more
than MaxTxQueueDepth, we hit the overflow condition. If the
overflow condition is hit, in htc_try_send(), we skip sending the
excess packets. This is true only if EpSendFull() is registered,
else we will try sending the excess packets.
As part of this logic, we are calling restore_tx_packet(); the
intention of calling resotre_tx_packet() is to just perform
skb_pull_head(), but restore_tx_packet() will also unmap the
HTT packet. Later, when we try to send the excess packets, these
would be already unmapped and when the HW/FW try to access this
unmapped location, it would lead to SMMU fault.
Change-Id: Ie60a302d6a2736f7aa12944b7016d2bdb9ffb10d
CRs-Fixed: 2836444
Currently, Stats request commands are sent over qmi right from the
target suspend request is sent to FW. This is leading to a crash in
FW since it is trying to access PCI when it is in suspend state.
To address this, send stats request over QMI only after the ack is
received for the target suspend command.
Change-Id: Id7a79d52740916f66476bf911e571c0ff466c7d3
CRs-Fixed: 2838737
cld80211_oem_rsp_alloc_skb api is used to alloc skb for reply msg.
A static buffer pointer is returned from this reentrant func
which can be called by kworker and scheduler thread at same
time resulting single buffer access by both threads. After
kworker thread freeing this skb, scheduler is further updating
data in this skb resulting in page fault error. Use local
skb pointer to avoid such race conditions
CRs-Fixed: 2822390
Change-Id: I5f807d06c4890b027c86de9187f17fb83b19db5e
In dual station case, wlan0 is connected to AP, wlan1
connects to the same ap and will get failed because two
interfaces can not connect to same band (same ap).
At present wlan1 will do unlink bss of ap after connect fail.
This may corrupt the bss tree in kernel because the bss is
still pointed by wlan0’s wdev -> current_bss.
Fix by avoid the unlink bss if the bss is still connected
in any interfaces.
Change-Id: I27c76eca2d4f130addabbdc2600f6959d24c8511
CRs-Fixed: 2837496
Currently, Rx diag event work is not being flushed during idle shutdown.
This may result in use after free access if the scheduled diag event work
gets the chance to execute after driver modules are closed.
To address this, flush diag events work during idle shutdown.
Change-Id: I348e80d2c86a5e070f0fb67d66b758529fede76c
CRs-Fixed: 2838020
Currently QMI message length is not being validated before
handling QMI event. This is resulting in illegal memory access
when QMI message length is invalid.
To address this, discard QMI events with invalid length.
Change-Id: Ia9f04bcb4fa3b365cbbf2be8885a8d30f78f8f10
CRs-Fixed: 2839277
The bcast twt functionality may need to be enabled separately
for requestor and responder roles. Enable such configuration
by looking up WMI service bit support from target:
wmi_service_twt_bcast_req_support
wmi_service_twt_bcast_resp_support
Change-Id: Ibc91173c23cf69f0d248af27d61c77bee3e8f48a
CRs-Fixed: 2828720
Add feature capability indication for Adaptive 11r for the
drivers to advertize support for this.
Change-Id: I28da5c3d7d4d841de980c841b1d4c39be12ed295
CRs-Fixed: 2817358
As part of monitor mode init, add check for null monitor vdev before
accessing vdev_id in case prevous cleanup of monitor vdev still ongoing.
Change-Id: I0165684c8aa2abea73fa8c0d1692dac789fb20f6
CRs-Fixed: 2835758
Vdev object manager reference should be taken before enqueuing
serialization command and it should be released after dequeuing the
command from serialization queue. Currently this reference release is
done before moving the command to active queue from pending queue.
This may lead to vdev object deletion before the command is moved to
active queue and result in use after free access for vdev object.
To resolve this, release vdev object reference after moving the
serialization command to active queue.
Change-Id: Ibef0814a245abb36f526997d848cf15ef6a49a44
CRs-Fixed: 2832676
Introduce proper logging APIs for diag module and also rate limit error
logs when skb allocation fails in low memory conditions to avoid excessive
logging side effects
Change-Id: Ia41ff7cfd526180825df61a43f1f59163947f257
CRs-Fixed: 2836681
Currently, reg_set_2g_channel_params_for_freq only considers
enabled channels when filling in the channel params. This
could cause issue when starting vdev in a passive channel.
Update the logic to consider CHANNEL_STATE_DFS as well.
Change-Id: I7a49aaa9a51e09729d7b912a6e3fd62fa240d714
CRs-fixed: 2835565
Add drop statistics for duplicate EAPOL frames received
in the REO exception ring as OOR frames. This will help
understand if EAPOL frames are getting dropped which could
cause connection issues.
Change-Id: Ib9d5a3c04ce6638c65166f02261af5c526cc47eb
CRs-Fixed: 2814633
Currently, host decrements beacon switch count and sends
channel switch frame every time until count becomes 0 this
may introduce sync issue between fw and host.
To avoid sync issue csa switch count is offloaded to fw. fw
will send CSA_SWITCH_COUNT_STATUS_EVENTID once beacon count
becomes 0 and host will send vdev restart once it recives
CSA_SWITCH_COUNT_STATUS_EVENTID.
Change-Id: I60238e8e83b56ca4c6490f9516d673d14ef9c323
CRs-Fixed: 2831356
QMI bypass mode uses 2mb of of mem region for
fw uses. Current implementation does not free this
memory region when qmi bypass mode in enabled.
Free mem leak in qmi bypass mode.
Change-Id: Ie11aa9f20f93183e0b999cd6578aea4b231f8d8b
RTPM wow resume gets triggered from ongoing WMI cmds related to SAP
getting started on the 5 GHz DFS channel. Even though PCIe link resume
is successful, there is a link up vote from UMAC and scn link suspended
state is not getting clear. Thus, clear the scn->link_suspended state
at the end of hif_pci_bus_resume_noirq() because before HIF PCIe bus resume
noirq phase is complete, PCIe link is already resumed.
Change-Id: If05593c95d2d63d271fed4abcf84b43e96cc070e
CRs-Fixed: 2833831
check csa_beacon_template service and set
WLAN_SOC_CEXT_CSA_OFFLOAD/25th bit of
soc_fw_ext_caps in psoc if service is
supported by fw.
Change-Id: I8dca74c805cc8696f261e0f791818bca579c80c8
CRs-Fixed: 2826451
Add support to view station's peer RSSI value in auth and assoc request
packet by extracting rssi from probe request and passing it down to
FW in the auth request and assoc request mgmt frames.
Change-Id: I92f714ed815ab8c77f6a6b7df3363dc96f1119bc
CRs-Fixed: 2832982
The nla_data coming from user space is a variable length data,
but the driver is checking nla_len() against a fixed length struct only.
It is possible that the nla_len() check against fixed length struct
may pass and if the nla_data does not have the payload and it may
result in possible out-of-bound read (slot->payload).
Hence the fix is to, check if nla_len() is atleast more than
the fixed length struct and also account for payload length.
Change-Id: I2e68d55c0411cff55908c1704031e3c070f3316e
CRs-Fixed: 2825763
Add CDP API to dump the SW head pointer and tail pointer
of a few important srngs. This can be used to debug or
get a direction when the device doesn't dump ram info.
dp_print_ring_stat_from_hal is not being used, since without
device force wake recipe in place, reading hardware hp/tp
value can lead to NOC errors.
Change-Id: Ib0381acb007f1b4431f6a02cd9762e461d6393e8
CRs-Fixed: 2826084
Currently the connection manager queries the
blacklist manager about the action to be taken
and if all the candidates of a certain SSID are
blacklisted then the connection would be rejected.
There are various types of blacklisting, some
can be overridden and some have to be strictly
followed.
Fix is to overide the blacklist candidate and
connect to it if no other candidates are suitable
for connection.
Change-Id: I84358df5f94d4c82989bf81412355f312320dc0b
Crs-Fixed: 2825519
Define QCA vendor attributes to dynamically configure TX NSS and RX NSS
to be used with QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION and
QCA_NL80211_VENDOR_SUBCMD_GET_WIFI_CONFIGURATION commands.
Change-Id: I9b3b3d3c5be2abd01fa8669b10c2961c271ecdbb
CRs-Fixed: 2831257
In mission mode, when PKTLOG is enabled, dp_mon_filter_update()
will reset the RXDMA2SW ring filters which will block the RX
completely leading to connection issues.
Reset monitor mode filter only when monitor VDEV is configured.
Change-Id: I0f55370af74a5f538ef926d8f8d61bffaa64a69e
CRs-Fixed: 2827739
The function qdf_ini_parse returns QDF_STATUS as SUCCESS even if no
fields are read from the ini file. Because of this even if the
ini file is corrupted and no values are read from it the function
still returns SUCCESS.
So, to avoid that and ensure that the ini file is not corrupted,
add a variable ini_read_count to count the number of fields read
from the ini file and return SUCCESS only if its value is not zero.
Change-Id: I5ec9a9cdc9780b6c9487f6ac64b411b81328d75c
CRs-Fixed: 2804937
Currently, there is no INI parameter to control NAN feature in 6GHz
frequency band. Because of this, there is no provision to disable the
NAN in 6GHz when there is no requirement.
To address this, add INI parameter to configure NAN feature in 6GHz.
Change-Id: Ibc653d6241d176f7fb75f18d2886175231ad71cc
CRs-Fixed: 2817925
Upper layer (OS_IF) can mark certain packets to be sent
to FW. Mark such packets as exception, so that it is sent
to the FW.
Change-Id: I653a7ea657e9dffc18ffd88662aa2082214bc469
CRs-Fixed: 2826442
This reverts commit Change-Id: I98f8f751dc75a3d6f2296f0844529e9c72c4090b.
This INI is moved to HDD_DP.
Change-Id: I451fa50621fdc8b6cbe027bdf1495788914481c9
CRs-Fixed: 2824623
Scan entry fails if any coruppted IEs are present
Introduced new ini parameters to enable scan based on ie
corruption. If ini parameter is enable then scan module skips
all IEs following coruppted IEs and adds scan entry without
completely dropping the frame. Otherwise if ini parameter is
disable then scan entry fails on corrupted ie.
Change-Id: If17b68448dd3e6ac3e98ed854ed67d7f16d9dff7
CRs-Fixed: 2806932
Rxdma err destination could still grow even after monitor
status ring filters are reset as part of monitor mode
disablement which will result in RXDMA2SW ring back-pressure.
Fix is to reset RXDMA_BUF ring filters when monitor mode is
disabled.
Change-Id: Ifd56f6bdbf6a5e4c5d39fc5c71dd85925e3d5f33
CRs-Fixed: 2818011
FW diag events will be dropped when number FW diag events pending for
processing is reached to configured RX_DIAG_WQ_MAX_SIZE value. Add a
log when these diag events a getting dropped for debugging purpose.
Change-Id: Ifc303991bdf274fa7426794eaf71517722e9f386
CRs-Fixed: 2824458
Excessive logging is detected when force wake request
command fails.
Rate limit the logs in hif_force_wake_request and
hal_write32_mb.
Change-Id: I9b1166074dfdb2d58d811571c802a75a6dbc03c5
CRs-Fixed: 2823961
RX error stats from REO2TCL ring is just for RX 2K jump/
OOR frame, host should not count them as rx_mpdu_error
stats for user space which will think wifi connection is bad
easily in noise environment.
Align this part logic with Helium that count TKIP/MIC error
frame, for HST/HSP, use error counted from RXDMA instead.
Change-Id: I2e488bedaed166ce410c53eb7e9710d7933c2717
CRs-Fixed: 2821147
Excessive logging was detected in dp_tx_msdu_multiple.
To fix this, Reduce log level when tx_hw_enqueue fails.
Change-Id: I66d58d12aff037896c7623c6755a443092673a88
CRs-Fixed: 2823453
Currently, FW diag logs, management frames and stats responses are
processed in worker context. Because of this, there is a possible
out of memory scenario when there are huge number of diag events
waiting in work queue.
To address this, process diag events in a separate worker thread and
set the limit for the number of diag events that can be queued in
work queue.
Change-Id: Ie6e5b905a3b591cf724cd6b024bec0612f9e2e0c
CRs-Fixed: 2818013
Add new API to check if frequency is passive or not. The API checks
the channel flag against REGULATORY_CHAN_NO_IR.
Change-Id: I166a7a79517f81c23ff933d2657ef3f4c551c082
CRs-fixed: 2822205
