Log critical suspend/resume log using info log level such that
driver 3 stage suspend/resume state is known from available logs.
Change-Id: Id17133d406f2366058198b38445d7ff6afba3764
CRs-Fixed: 2160041
Current driver will create two apdaters in FTM mode, with device_mode
STA and P2P, where STA is incorrect and P2P is unnecessary.
And those types will cause memory leak in
qdf_mem_malloc()/sme_deregister_mgmt_frame(), when unloading driver.
Also, it is improper to fix the interface name to wlan0 for FTM mode,
as some platforms may use different naming rule.
Only create one adapter with FTM mode, with variable interface name.
CRs-Fixed: 2160513
Change-Id: If3bf4444e5535e6fe88c3ad2d87da217534984a0
Change "qcacmn: Rename enum tQDF_GLOBAL_CON_MODE" (qca-wifi-host-cmn
Change-Id I57933a62f6ce02b6594d97198be8132e61e8d1f6) renamed enum
tQDF_GLOBAL_CON_MODE to QDF_GLOBAL_MODE. Update all references to use
the new name.
Change-Id: I0e806e87a4c4828279dee83450b1fc20a236c9d3
CRs-Fixed: 2158636
Country code can be set by multiple sources. Print the source of country
code for debug purposes.
Change-Id: I54f8237de540d7a0d01671148109130a28516670
CRs-Fixed: 2149684
In function wma_is_vdev_valid, vdev_id received as argument is used
to access wma_handle->interfaces array directly without validation
of max value of vdev_id. If vdev_id is not less than max_bssid, then
an OOB read would occur in this function.
Also add free and break in wma_mc_process_msg while handling
SIR_HAL_CONFIG_GUARD_TIME message in WMA.
Change-Id: I5f4481c937d5c370b334f2a7f8a172d08140ab1d
CRs-Fixed: 2154304
Abort all outstanding scan requests on an SAP adapter synchronously
when the SAP adapter is to be stopped, so any scan callback
functions will not access the buffers for SAP adapter, ACS config,
etc. after they're freed.
Change-Id: Idc02b140c05a5de4dc652a547cd20b8d113447b6
CRs-Fixed: 2152962
During driver re-init, host might pass invalid(NULL) default scan
IEs to FW if host won't receive same IEs from supplicant as part
of vendor event QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION.
Validate driver has default scan IEs, before sending same to
firmware.
Change-Id: I333ceead0c375bfb9309466e420a6860199826dc
CRs-Fixed: 2155312
Currently the Scan Default IEs configured via the attribute
QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES are not validated. As a
result a buffer overread can occur when the Scan Default IEs are later
referenced. To address this issue validate the Scan Default IEs before
storing them.
Change-Id: Ifd8739c96a9990f01ff159eb59a7e904f7b8c592
CRs-Fixed: 2154346
The SAP configured in hidden ssid mode sends probe response
to BC probe requests in hidden ssid mode after force SCC.
In wma_set_channel, req.ssidhidden is not set by the host
which in turn sets the param->flags last bit to 0, and
the firmware receives these flags and sends the probe
responses.In the wma_vdev_start api, the host sets the flags
based upon the req.ssidhidden received from wma_set_channel
only in vdev start case , and not in vdev restart case.
Fix is to set the value of req.ssidhidden in wma_set_channel
and to set the hidden ssid flag in both vdev start and vdev
restart case.
Change-Id: I988d8d64b06128a37824c7d31d4407247ba46dce
CRs-Fixed: 2142430
Scan IEs are allocated at adapter runtime. Thus, scan IEs should be
freed during adapter stop.
Change-Id: Idd1ee68bc57ecd3dfea77a3d882b57aae21a478f
CRs-Fixed: 2159407
Scan command is entertained, when the firmware is down, and
it causes crash in the system.
Reject the scan command, when firmware is down.
Change-Id: Ib3501e14846dea9ea99f6fa13695108d4ae58bf0
CRs-Fixed: 2159449
Currently, the host sends a roam scan mode of
WMI_ROAM_SCAN_MODE_ROAMOFFLOAD to the firmware when roam
synch fails in the host. But the firmware expects a
WMI_ROAM_SCAN_MODE_NONE in the roam synch wait state
to respond with a HO_FAIL which will evetually lead
to a disconnection and clean up.
Change-Id: I39c768881c312ecbedf6e4a1742e3eaabcea1f4d
CRs-Fixed: 2159244
1\ Register the lim_process_rx_scan_handler with api
ucfg_scan_register_requester;
2\ Redefine function lim_send_preauth_scan_offload
to use api ucfg_scan_start;
Change-Id: I43a0b28c3abcce907575717dc3a4bfb190a32ec2
CRs-Fixed: 2144630
1\ The command content is wrongly reset and cause
the corresponding command could not find from the
active queue.
2\ It should release the command in time before issue
the next command.
Change-Id: I094a6ce0e34f4698222d85a785cb6424852e25f8
CRs-Fixed: 2144630
Firmware cannot handle scan IE more than a certain size owing to memory
restrictions. Check the scan IE length before passing params to firmware.
Change-Id: I73321a9d4932f4cbb876de904dacecf15c9083ff
CRs-Fixed: 2159363
In the file wma_unified_radio_tx_power_level_stats_event_handler ,
the driver allocates memory to rs_results->tx_time_per_power_level ,
also in api wma_unified_link_radio_stats_event_handler ,
rs_results->channels , without checking a previous allocated
memory for the same . Also the driver makes the pointers
rs_results->tx_time_per_power_level and rs_results->channels
as null without a prior check , which results in a memory leak.
Fix is to add a check for rs_results->channels and
rs_results->tx_time_per_power_level for NULL , and free
the already allocated memory for the same.
Change-Id: I02af53454270239bf68446a727b735c8ef10d434
CRs-Fixed: 2150714
Add a consistent set of logs for wlan module transition changes to aid
in debugging efforts.
Change-Id: Id7f039c03f25ba46194a101b64e08f8ae3042c50
CRs-Fixed: 2159403
Enable CONFIG_BYPASS_QMI and disable ADRASTEA_SHADOW_REGISTERS when
there's no QMI support in kernel, as shadow registers are configured
by WLAN FW and the configurations are passed through QMI framework.
CRs-Fixed: 2159269
Change-Id: Iaf5b82e37f3983fc18edbcf093b3ebf74d576f71
Host driver drops incoming HDD IPA events during unloading prcess,
when IPA pipe unloading timeout occurs, and IPA offload state could
be mismatch between host driver and FW.
Fix by setting unloading complete before IPA pipe disable and putting
events into pending event queue for unloading timeout case as well.
Change-Id: If44caa07f328bf3ac2d2fc02aafb796176114678
CRs-Fixed: 2152490
qcacld-2.0 to qcacld-3.0 propagation
The return value validation is missing for dot11fUnpackIeRSN, thus
"dot11f_ie_rsn.pmkid_count" could be larger than 4. When it is larger
than 4 there will be a buffer over-read in vos_mem_compare. Add status
check of dot11fUnpackIeRSN in lim_process_fils_auth_frame2.
Change-Id: If563ddb13bbfcad5660d136c35c39846010594e1
CRs-Fixed: 2147955
Linux convention is to embed a list node in a structure that is meant to
be a member of a list. However, hdd_adapter_list_node_t is created to
contain both the list node and the list item itself. Remove
hdd_adapter_list_node_t and embed the list node directly into
hdd_adapter instead.
Change-Id: I62888a0212d88aa212fee34b886e3d8a4875e0c7
CRs-Fixed: 2159309
sme_stop and mac_stop are accessing share data structures which
create a race condition when it is called from rmmod context.
Change context of sme_stop and mac_stop from rmmod thread to
mc thread.
Change-Id: Ie30f99d6b0c2f7c6cf20371dd66323d156360474
CRs-Fixed: 2148771
Enable WIFI_FEATURE_CONFIG_NDO caps in __wlan_hdd_cfg80211_get_features
to help in VTS test case passing.
Change-Id: Iea56e53add127dc79a959f26e5f512662ed304cb
CRs-Fixed: 2155700
In function get_container_ies_len, nBuf is passed from caller function
as length of the buffer remaining in the frame. len is calculated from
the length field present in the IE. Then find_ie_defn is called with
nBuf + len as buffer length available leading to potential OOB read
in the function find_ie_defn.
Also in function get_container_ies_len, if len is greater than nBuf,
OOB read would occur in the caller function unpack_core.
In function unpack_core, len is calculated from the length field in
the IE buffer, then the IE is parsed in one of the unpack functions
where len is decremented without any check for min value of len.
If the value of len obtained from the IE buffer is less than the
minSize of the IE, then an integer underflow would occur.
1. In function get_container_ies_len, change calling of find_ie_defn
to use nbuf - len.
2. In function get_container_ies_len, if len > nbuf, return error.
3. In function unpack_core, add sanity check to make sure len is not
less thatn IE's minSize.
Change-Id: I8e42fb7e9674845d152d2ec26a592e02a1b562ab
CRs-Fixed: 2153003
While sending probe response template down to firmware, driver
populates some items in data-structure which is not getting used.
Remove those unused items and send only what is needed.
CRs-Fixed: 2148056
Change-Id: I1878f523f0f88c354854dfdb75e60e66c4ecb0e8
Add a SSID length validation check before
copying the SSID field to scan request
structure from connect profile.
Change-Id: Ic6297a28f8852db2e5d22c5c7d5b8eab7b76dbfd
CRs-Fixed: 2145706
Initialize message local variable on stack in SME get peer info request
API before posting message via scheduler API.
Change-Id: I4471f3c3eacaacfb8e9145e61dd4eb33b921936f
CRs-Fixed: 2158564
