Modify check to ensure packet number is consecutive for
fragments and drop the fragments if the check fails.
Change-Id: I2ca0ef6211594ba35aae894e6a385d3d5778bff6
CRs-Fixed: 2874369
Register dp_peer_flush_frags API in dp peer ops
for flushing fragments for a particular peer.
Change-Id: Ia179d3160bdc306ec965c465134042c66a0c40a6
CRs-Fixed: 2874366
Drop non-EAPOL frames from unauthorized peer in security mode.
Enabling this feature by default with this change.
Change-Id: I9878b37088149e34f456a38a9c0f722e4c5ee49a
CRs-Fixed: 2943789
CVE-2020-26145
Broadcast and multicast frames should never be fragmented. Several devices
process broadcasted fragments as normal unfragmented frames. Moreover, some
devices accept plaintext fragmented broadcast or multicast frames in
protected Wi-Fi networks. An adversary can abuse this to inject packets
by encapsulating them in a fragmented plaintext broadcast frame. Even
unicast packets can be encapsulated in broadcast Wi-Fi frames and hence
be injected.
Change-Id: I3181a05e177cf9374a14edb748bc5001d058e0f3
CRs-Fixed: 2893212
For security cert TC, RSNIE length can be 1 but if the beacon is
dropped, old entry will remain in scan cache and cause cert TC
failure as connection with old entry with valid RSN IE will pass.
So instead of dropping the frame, do not store the RSN pointer so
that old entry is overwritten.
Change-Id: I2fe4d2dd2352be6850f7a18a2ec829733ded7ee8
CRs-Fixed: 2944120
Even though HP/TP updates are posted writes at CPU level, they
are getting blocked until soc comes out retention which is hogging
CPU
To avoid this if EP is in low power state update HP/TP writes from
delayed work context. In delayed work vote for EP awake wait till it
comes out low power state and then proceed to HP/TP update.
Change-Id: I61d5795f58f25f850b5a9ad4d30e3181dba23713
CRs-Fixed: 2913495
Some of the targets require more QDF nbuf history
size, so making the size configurable keeping
default same.
Change-Id: Ic4ac43a1eacb1e58c0a05b794349525d614d7fc8
CRs-Fixed: 2929968
Add new ini's for assoc active and passive dwell time
for 6g. These will be applied if STA is connected.
Change-Id: I680fbd3038968ecf6ff9920fff982456135bfd77
CRs-Fixed: 2941359
Firmware generates wmi Rx diag events every few milliseconds,
and processing the same in system shared work queue may lead to
work queue lock-up detection. Hence, move Rx diag event processing
to dedicated work queue.
Change-Id: I10cdde317794e35bc6d10677ab76ea24a66e1880
CRs-Fixed: 2941409
In some of the targets modulo operator assembly API's
are not defined causing compilation error.
To avoid this use qdf based API's for modulo operations.
Change-Id: Ibc69b69aa38cadff5daa8dee8b65ceaacfe997b7
CRs-Fixed: 2940281
Logs are printed inside a spinlock which was held for
losing more than 2 seconds.
To fix this, reducing log level so it is not printed
in the console and instead in driver logs.
Change-Id: Ib510ddc1b5bff63db012b45ffa0280eedc356cc6
CRs-Fixed: 2938590
Add the history support to log Tx descriptors programmed
in Tx and completion HW rings.
Change-Id: I60954c93e2595e7dad1251c459eed8afc761e917
CRs-Fixed: 2924614
When host failed to find out vaddr by paddr from FW, output more
information for debug further.
Change-Id: I65c4965c12c2ffa3fe2a26a82df01d1b91501c73
CRs-Fixed: 2925194
Driver gets vdev by wlan_objmgr_pdev_get_first_vdev and returns wrong
vdev in some platforms, and then gets wrong channel/phy_mode. This
change gets vdev by id and fix this issue.
Change-Id: I814d516361238afbd0345bc362c286d1cb55a7d4
CRs-Fixed: 2933525
issue happen when wpa_supplicant is creating vdev
and schedule_thread is destroy the same vdev.
if state is not WLAN_OBJ_STATE_LOGICALLY_DELETED,
return back here, otherwise it will cause the creating
vdev_id to be invalid.
Change-Id: I574838bca574add497f1167c75ede44938b7bf17
CRs-Fixed: 2935068
Fisa packet history is around 6KB for each sw fisa
flow entry and this is part of the dp_fisa_rx_sw_ft
structure. The total size of the SW FT as a result is
around 830KB and the higher order memory allocation via
kzalloc for this could fail in low/fragmented memory
scenarios.
Fix is to allocate memory for FISA pkt history separately
and attach it to the SW FT entry.
Change-Id: I7296d7269c1b86ec38ea1668e8a0893335bbdb6f
CRs-Fixed: 2936353
Add support for Rx refill ring history, maintain records of refill info
during RXDMA ring replenish.
Change-Id: I034014eacfc510ec6f416fca601fa864326de9c2
CRs-Fixed: 2930005
Add an API to set the AP power type and then recompute the current
channel list.
Change-Id: Iacd4d3244f601836f3ed0eae725eaa6375a3584c
CRs-fixed: 2934625
Add country code check for ETSI domain, in other words
UK, since only UK supports 6G in EU as of today. The
TPC power calculation API calls this function to check
if programmed ctry is GB to allow STA to use VLP mode.
As and when more EU countries support 6G, the checks
will be appended to this API.
Change-Id: If985f3f64fc806cf1875f798ff3a86667a0861b8
CRs-Fixed: 2933678
Add new reason code WMI_HOST_ADD_TWT_STATUS_SCAN_IN_PROGRESS
to handle add dialog rejection due to scan is in progress
at firmware.
Change-Id: I30c3d1096690bd0cb7a669206f087e006c23ea44
CRs-Fixed: 2923289
When CE tasklets and NET_RX gets scheduled on same CPU,
NET_RX is throttling CE tasklet resulting WMI timeouts.
To avoid this affine CE irqs to gold cores, so that CE
tasklets will get enough CPU time.
Change-Id: Ided81a0565958aca6611eba911824c3485eca472
CRs-Fixed: 2933335
The firmware rejects the TWT setup request when scan is in
progress. Extend enum qca_wlan_vendor_twt_status to represent new
reason code for it.
Change-Id: I8576d8cce2fac62d9e3cf020a3dadee06ec14d5c
CRs-Fixed: 2923272
When nbuf is freed via dp_rx_buffer_pool_nbuf_free, the
nbuf is enqueued to emerg_nbuf_q always even in the case
where the emerg_nbuf_q is not initialized. This will result
in NULL pointer dereference when any nbuf is enqueued to
emerg_nbuf_q.
Fix is to add initialization check before adding the nbuf
to emerg_nbuf_q and free the nbuf if emerg_nbuf_q is not
initialized.
Change-Id: I075b3b93203eec21d44ea3967b5f46d59c291a14
CRs-Fixed: 2934593
add ssn_updates_count to dp_soc_stats rx err stats.
Also add bar fail count on rx tid update during
bar handling.
Change-Id: Ic9a963c8d29ace2087e63cba56bc0d7e40907e1a
CRs-Fixed: 2918806
Currently, excess logging is causing a crash when enqueuing
of Tx MSDU descriptor to HW failed.
Rate limiting the log messages to avoid the crash.
Change-Id: Ibb230ce03c23518b6f7feda61a49bf155c7ddc69
CRs-Fixed: 2933002
Same WDI subscribe event can be added multiple times to event list
since this is triggered by user control this will result to undefined
behaviour during events handling.
To avoid this add check to detect duplicate entry before adding
to list and reset list elements once removed from list.
Change-Id: Iaf23927f8439d4ac503776b915a8fe8cb6abfec5
CRs-Fixed: 2931068
Previously, for high accuracy scan,
configured scan policy SCAN_DBS_POLICY_FORCE_NONDBS
takes more time to scan.
For DBS HW, to improve scan time, this should be
changed to SCAN_DBS_POLICY_DEFAULT.
Change-Id: I692e2a8b4fd9c97b526197edc57b830fa091a456
CRs-Fixed: 2927022
The status of the IPA SMMU MAP/UNMAP operation is stored in the
result field of the mem info structure that is passed to the
IPA driver. Currently, this field is not checked for MAP/UNMAP
failures; when IPA HW accesses such a buffer for which
mapping is not correctly setup, it will lead to SMMU faults.
Check the result and assert(on failures) to avoid such issues.
Also, check if the physical address passed to the IPA driver is
non zero value.
Change-Id: Iec0702bdf4a07ea37e1213a33dc970028da654df
CRs-Fixed: 2928744
WLAN HW can still access the IPA tx doorbell address post
disable pipes if there are any pending tx completions which
could result in a NOC error.
Fix is to reset the WBM2SW ring HP addr to shadow addr in
DDR before pipes are disabled.
Change-Id: I52900eb34530388487923a887354ef8839d8c728
CRs-Fixed: 2846421
Define a new reason code in enum qca_wlan_vendor_hang_reason,
QCA_WLAN_TASKLET_CREDIT_LATENCY_DETECT, for tasklet/credit latency
detection.
Change-Id: I4852fc22f57d14d6eac30ddfd8361f2a63326981
CRs-Fixed: 2929164
Add fields to the validate bss data struct to pass more information
to the interface manager when validating a candidate.
Change-Id: I82536585517da87ec0883c6010461d7ee929bd18
CRs-fixed: 2836749
Sometimes firmware sends spectral events repeatedly with
wrong vdev. This causes continuous error logs are
written to kmsg.
Replace info prints in target_if_consume_spectral_report_gen3()
with debug level prints.
Change-Id: I2ca4be7d0d13e841a6dbd4efbc02ecd2b12893f8
CRs-Fixed: 2926759
Runtime PM for HTC layer has multiple cases of GET/PUT operations.
Adding runtime PM stats for HTC layer, this helps in debugging
RTPM GET/PUT out of sync issues.
Change-Id: Ib27efd73dce0bb5bd3ff030bd7ae1bc833f29610
CRs-Fixed: 2923250
Currently before suspending the device, we are draining
out the TX/RX SRNGs. The HP/TP updates which are done as
part of this will be posted writes(there won't be any link
levelccompletions for write transactions), there are chances
that we might end up updating HP/TP after the device enters
low power mode leading to system crashes.
In order to avoid this scenario, do a dummy read before
device is suspended; this will ensure all pendings writes are
flushed before read returns.
CRs-Fixed: 2919459
Change-Id: I5ab77f91fe14c506444bdea1587acfb34224fc69
In the issue reported, the clear stats request from the
user space is timing out because event id from firmware is not received.
From the logs it is not clear whether host driver received it or dropped
it in the error path.
Add debug logs, to make sure cp_stats event id is received in the host
driver and also in error cases.
Change-Id: I634714281db4a82826791725ec38fd589334cde8
CRs-Fixed: 2926978
Add iwpriv option 34 to dump the reo rx h/w descs
in DDR for debugging. This cmd will first send cache
flush cmd to REO for all rx tids and invalidate the h/w
cache. Henceforth ensuring that the reo status tlvs and
the DDR values are in sync.
iwpriv wlan0 txrx_stats 34 0
Add fix to ensure bar frame with 2k jump err code is
processed correctly using the REO error code instead of the
REO push reason.
Change-Id: Ia05be668343f3a5d4b3262b8d6a367a50875add5
CRs-Fixed: 2895965
Currently the PMKSA entries are deleted only if the BSSID matches
and will delete all the matching PMK cache entries even though
the new PMK is same as the existing PMK for the matched BSSID.
This results in unnecessary deletion/updation of PMKSA entries.
This change allows to check PMK as well along with BSSID. And if
the PMK doesn't match with existing matched BSSID entry then only
we delete the PMKSA entries.
This change fixes the below OKC scenario and avoids Full EAP:
Connect to AP1 -> Roam to AP2 -> Disconnect and Reconnect AP2 ->
Disconnect and Reconnect AP1.
Change-Id: Ic41c2044e70f8d375130ef9e0af9fe4b83027c26
CRs-Fixed: 2913686
As part of activaiton of serialization command from pending to
active queue, the lock is released. In the activation API, the
same API to move non scan cmds from pending to active queue can
be called if activation fails. This reentrant API may modify the
pending queue even before the control is given back to the caller
API leading to random behavior when accesing the next cmd from pending
queue via local variables.
Add fix to update queue size from pending queue after command activation
Change-Id: I8082e2a9dd3410369967ab20196853ddfa0639a7
CRs-Fixed: 2801956
