Add connect/disconnect log ring buffer to existing ROAM
debug functionality to record OS IF layer event.
Change-Id: Ifcbcd9a38ead27d60757983a0f56a37ae5d8af81
CRs-Fixed: 2852405
rx_mpdu_missed statistics used by CNE records instances
of BA hole happens, not duplicated frames instances.
Fix this field with correct value to avoid incorrect
VOLTE switching.
Change-Id: I815b9a4caeb6eedf36be66f8650ca98d00542c60
CRs-Fixed: 2848460
CONFIG_PCI_MSM will not be defined if MSM PCI driver is compiled
as a module, so if wlan driver invoke hif_pci_prevent_linkdown to
prevent linkdown, pld_wlan_pm_control() actually is not invoked,
result in Noc error due to inactive PCIe link.
PLD driver already abstract MSM specific feature, remove CONFIG_PCI_MSM
complilation flag in wlan driver.
Change-Id: Iaaf929a74b44ac94370f1d98b7aef7aaec308e0f
CRs-Fixed: 2850839
In SAP on non DFS channel, there are double votes for PCIe
link down and later if there is PCIe link up, this counter
sends D3 WoW case instead of D0 WoW case to firmware.
To fix this, In vdev restart case, if SAP is on non DFS
channel and previously it was on DFS channel then vote
for PCIe link down and if SAP is on DFS channel and
previously it was on non DFS channel then vote for PCIe
link up. Also, the PCIe link down should be needed if
vdev stop response is for DFS channel.
Change-Id: I817ffceb482091b8d9c5441d80abb43b7d0f866b
CRs-Fixed: 2849706
Reduce excessive data path logging to kmsg during roaming and
change the logging level for such prints to debug/info
high.
Change-Id: I1e6506de83e59a31304234905a3dd38f6d8b03f3
CRs-Fixed: 2848624
QDF per packet proto log level is set to debug due to
which the info is not logged to console.
Fix is to change QDF per packet proto log level to info.
Change-Id: I64b6d577475ea6133ec0565ae459629b81c0929c
CRs-Fixed: 2847863
Issue happens when
step 1: kernel pm core start to runtime suspend
step 2: host get wma_acquire_wakelock & send PDEV_SET_HW_MODE.
step 3: host send wow_enable cmd
step 4: wow suspend finished and wow resume happens as step2
send pm_runtime_get
step 5: fw dop PDEV_SET_HW_MODE as enter wow mode
so host can't get PDEV_SET_HW_MODE_RESP from fw.
Fix is:
Don't allow suspend if sending PDEV_SET_HW_MODE.
After change logical will be:
1 if PDEV_SET_HW_MODE before send hif_pre_runtime_suspend->
hif_runtime_pm_set_state_suspending, then wow suspend
will return failure.
2 if PDEV_SET_HW_MODE send after hif_pre_runtime_suspend->
hif_runtime_pm_set_state_suspending, it will request resume
and send after wow resume.
Change-Id: I91eea70f841cf9e5d6767f6005eb9662515657a6
CRs-Fixed: 2850561
Add wake_irq_type in HIF layer for power management,
this helps in deciding to enable sync-up between
runtime suspend and wow resume in case of moselle.
Change-Id: I23a4d02d3ae7ec543a28174461996b84b18fd95d
CRs-Fixed: 2851265
When runtime power management is enabled, until the system is fully
resumed, we do not post any message to CE, instead they will be queued
in HTC. Once the device is fully resumed, all HTT messages in the queues
will be downloaded to CE at once. In some corner cases, it is found that
too many FSE caches flush messages getting queued during the runtime
resume; once the device is fully resumed, all these would be downloaded
to the FW/HW at once causing unintended crashes.
Avoid posting FSE cache flush messages until the device is fully resumed
to fix the issue.
Change-Id: I2be21406e8c7a9dcd86df3e93c2568797defcad0
CRs-Fixed: 2843541
If is_bwnss_oui return true in util_scan_parse_vendor_ie,
and it will run into below logical:
scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8)
But in fact if ie->ie_len < 6, it will casue read out
of boundary issue. So add the length chekcing before
reading it
Change-Id: I0cdf723154eb808f8062efd897f9d67d54d4573b
CRs-Fixed: 2838849
During esp ie parse from beacon/probe response, the data pointer
is getting read from esp ie and it's not validate while updating
to esp params which may cause out of bound read issue.
Validate data pointer before updating to esp params.
Change-Id: I1167b82248613cc65fcd7c70cdcfe57595de6b21
CRs-Fixed: 2842234
For lithium based chip, the rssi_comb value fetched from monitor
buffer TLV is in unit dBm already, if plus noise_floor value in
qdf_nbuf_update_radiotap() again, then the rssi showed in wireshark
will be incorrect.
Convert rssi_comb to unit dB and not impact legacy chip in
qdf_nbuf_update_radiotap().
Change-Id: I889a15f39ebc639386405fb0aae1909c0cce75e0
CRs-Fixed: 2844896
During nbuf free if entry is not found in debug tracker list
it is treated as double free or unallocated buffer free
which is not correct because there is possibility of nbuf
entry not being present in debug tracker list due to memory
allocation failures for tracker nodes in system low memory state.
Maintaian counter for nbuf debug tracker node memory
allocation failures, during nbuf free if entry is not found
in debug tracker list and tracker memory allocation failures
are present then don't raise issue for nbuf free.
Change-Id: I770cfc23bad35af7e7dbec34852a31cc68300ca5
CRs-Fixed: 2844059
Use safe API - wlan_objmgr_iterate_obj_list to enumerate
vdev. It will check vdev in "create" state by
wlan_objmgr_vdev_try_get_ref.
Change-Id: I650801c07846e22f1863925ed4316c0a24bd9cae
CRs-Fixed: 2849177
During ie parse from beacon/probe response, the variable
tbtt_count and tbtt_length in util_scan_parse_rnr_ie() getting
read from ie and the value is not checked before using it which
may cause out of bound read issue
Validate tbtt_count and tbtt_length before using it
Change-Id: I51cfb2356fb16feda8a70c4b76c7f76c90b1393b
CRs-Fixed: 2836205
Currently the rx rings history is allocated dynamically
on load time. The memory requirement for saving these
history are more than a page (order 5 to 6 allocations).
Such big memory allocation can fail due to various
reasons, one of them being memory fragmentation.
Fix this by pre-allocating the rx ring history memory.
Also allocate the rx reinject history memory when the
HW accelerated path is used.
Change-Id: Id957cd5df91a2ca7f182dea691a0557b4e386f55
CRs-Fixed: 2844388
FW memory allocation depends upon important resource config sent from
host during wmi init. Hence, log these important resource config parameters
sent during wmi init.
Change-Id: I5e187b905716a5a2c1767bc4b081f54034994653
CRs-Fixed: 2839119
Channel number can be invalid when finding out the enumeration for the
channel. Rate limit the messages for the same.
Change-Id: Ie6cf178482647547d58d4d9555763332d6598846
CRs-Fixed: 2843978
In moselle, once wow enabled there is a possibility that wow wake
interrupt can be fired from FW during runtime suspend in-progress
in host, this will introduce a race between runtime suspend and
resume, so adding a synchronization between runtime suspend and
wow triggered runtime resume.
Change-Id: I38d6a24e4421697cc2d0090ba8d19884885596cb
CRs-Fixed: 2845672
In arch 32 platform, the size of rnr_chan_info is 8 bytes, and it only
allocates 4 bytes for each of them. Which cause memory access out of
bounds.
Change-Id: I4f1798c5354c6a76e32bdfed13ade9667465b789
CRs-Fixed: 2827289
Currently, Host driver assumes WMI_MIN_HEAD_ROOM is part of WMI
messages and Validations are done accordingly. But this
WMI_MIN_HEAD_ROOM is not considered in the firmware. Because of
this host may drop valid events.
To avoid this, Don't consider WMI_MIN_HEAD_ROOM while validating WMI
msg length.
Change-Id: I5f1fe12cfae570e636defb8a4a46ec154f988195
CRs-Fixed: 2844982
Add previously freed nbuf and buffer start address info in rx descriptor.
This helps in debugging use after free access of rx buffers.
Change-Id: I1c883bf049ce75dd0413b85946fe2982648d8004
CRs-Fixed: 2827151
Currently, 6g channels are sorted based on the weightage of each
channel. Frequencies are sorted but the flags associated to each
channel are not updated properly. So, channels carry invalid
flags to firmware and firmware may miss to scan few 6g channels
based on these flags and may scan few 6g channels unnecessarily.
Copy flags also while sorting frequencies to maintain the flags
of each channel as it is.
Also, change the type of phymode to enum scan_phy_mode
from uint32_t.
Change-Id: I0a2330faab1b738f2d7eff3d39ccbfffd51dfde0
CRs-Fixed: 2840029
A temporary variable "temp" is declared to use it while sorting
the channels based on the weightage/rnr info. This is declared
as a pointer to hold the reference of struct rnr_chan_weight but
memcpy is done to this without allocating memory.
Declare this as a variable instead of pointer to use it as an
intermediate variable for sorting.
Change-Id: If619f5fa462d5400f0a77e57317ac3c8debb34a5
CRs-Fixed: 2842819
During qdf assert generic failure information printed at last is misleading
failure reason, to avoid this don't print generic failure information.
Change-Id: I55359b2e41a3ee50de4e45e73183f2480c28a1eb
CRs-Fixed: 2789137
Currently DMA mask for the device is set during hif_enable_bus.
If the datapath memory prealloc feature is enabled, there are
a few dma memory allocation which is done before the DMA mask
is set for the device. This leads to the aforementioned dma
memory pre-allocation to be attempted at the default DMA mask.
Due to this the entire device capability of dma address might
not be used.
Add hif api to set dma mask before hif is initialized. This
is needed to set dma mask in case of datapath memory pre allocation.
Change-Id: I6fd25d9cb6ab3aaacd6f959abe4e060e23f37095
CRs-Fixed: 2845020
scenario:
FISA new FST entry is initialed, host will start one timer to
send HTT MSG DP_HTT_FST_CACHE_INVALIDATE_FULL to FW in 5 ms,
WOW suspending happened in the same time, PCIe bus get suspended.
5 ms later, HTT msg sending will try to prevent PCIe L1 to update
CE SRNG HP register, hit assert as PCIe bus suspended already.
suspend and cancel the FSE cache flushing timer when dp_bus_suspend,
resume it when dp_bus_resume.
CRs-Fixed: 2843214
Change-Id: Ie2bc115a0de068335d6c46749f52d205cc21f5a3
rx_ring_history is an array of pointers, address of pointer is
always a non-NULL value, this always passed the NULL check,
which leads to NULL pointer dereference, fixing the same.
Change-Id: I401203a6f2a5930869cf4002ac0e714d3fdba62f
CRs-Fixed: 2844038
Some AP disables AMSDU in BA256 mode, this has draw back
with KPI in HE mode, so leave a config field to use 64 BA
forcibly to make high KPI with these types of AP
Change-Id: Ia69ffe118fd5bbda78cfb98126a483fcf305294e
CRs-Fixed: 2828304
Currently, 6g PSC/non-PSC channels in the scan request are
scanned or optimized to scan only if RNR IE is found based on
the inis scan_mode_6ghz and scan_mode_6ghz_duty_cycle.
As scan_mode_6ghz_duty_cycle is set to 4 by default, first 3
scans are optimized to scan only if RNR IE is found and 4th scan
would be full scan. If there is any standalone AP in 6g channel
that doesn't advertize RNR IE in colocated APs beacons/probe
responses, that's not scanned till the 4th scan.
Reverse the order for scan_mode_6ghz_duty_cycle such that the
first scan of every four scans is a full scan and rest of the
three scans are optimized. So, the standalone 6g APs can be found
in first scan itself based on the ini scan_mode_6ghz.
Change-Id: Ice1614a94f1fd166e283355616ace241a5df2bcb
CRs-Fixed: 2829550
When the number of HTT packets in the endpoint TxQueue is more
than MaxTxQueueDepth, we hit the overflow condition. If the
overflow condition is hit, in htc_try_send(), we skip sending the
excess packets. This is true only if EpSendFull() is registered,
else we will try sending the excess packets.
As part of this logic, we are calling restore_tx_packet(); the
intention of calling resotre_tx_packet() is to just perform
skb_pull_head(), but restore_tx_packet() will also unmap the
HTT packet. Later, when we try to send the excess packets, these
would be already unmapped and when the HW/FW try to access this
unmapped location, it would lead to SMMU fault.
Change-Id: Ie60a302d6a2736f7aa12944b7016d2bdb9ffb10d
CRs-Fixed: 2836444
Currently, Stats request commands are sent over qmi right from the
target suspend request is sent to FW. This is leading to a crash in
FW since it is trying to access PCI when it is in suspend state.
To address this, send stats request over QMI only after the ack is
received for the target suspend command.
Change-Id: Id7a79d52740916f66476bf911e571c0ff466c7d3
CRs-Fixed: 2838737
cld80211_oem_rsp_alloc_skb api is used to alloc skb for reply msg.
A static buffer pointer is returned from this reentrant func
which can be called by kworker and scheduler thread at same
time resulting single buffer access by both threads. After
kworker thread freeing this skb, scheduler is further updating
data in this skb resulting in page fault error. Use local
skb pointer to avoid such race conditions
CRs-Fixed: 2822390
Change-Id: I5f807d06c4890b027c86de9187f17fb83b19db5e
In dual station case, wlan0 is connected to AP, wlan1
connects to the same ap and will get failed because two
interfaces can not connect to same band (same ap).
At present wlan1 will do unlink bss of ap after connect fail.
This may corrupt the bss tree in kernel because the bss is
still pointed by wlan0’s wdev -> current_bss.
Fix by avoid the unlink bss if the bss is still connected
in any interfaces.
Change-Id: I27c76eca2d4f130addabbdc2600f6959d24c8511
CRs-Fixed: 2837496
Currently, Rx diag event work is not being flushed during idle shutdown.
This may result in use after free access if the scheduled diag event work
gets the chance to execute after driver modules are closed.
To address this, flush diag events work during idle shutdown.
Change-Id: I348e80d2c86a5e070f0fb67d66b758529fede76c
CRs-Fixed: 2838020
Currently QMI message length is not being validated before
handling QMI event. This is resulting in illegal memory access
when QMI message length is invalid.
To address this, discard QMI events with invalid length.
Change-Id: Ia9f04bcb4fa3b365cbbf2be8885a8d30f78f8f10
CRs-Fixed: 2839277
The bcast twt functionality may need to be enabled separately
for requestor and responder roles. Enable such configuration
by looking up WMI service bit support from target:
wmi_service_twt_bcast_req_support
wmi_service_twt_bcast_resp_support
Change-Id: Ibc91173c23cf69f0d248af27d61c77bee3e8f48a
CRs-Fixed: 2828720
Add feature capability indication for Adaptive 11r for the
drivers to advertize support for this.
Change-Id: I28da5c3d7d4d841de980c841b1d4c39be12ed295
CRs-Fixed: 2817358
As part of monitor mode init, add check for null monitor vdev before
accessing vdev_id in case prevous cleanup of monitor vdev still ongoing.
Change-Id: I0165684c8aa2abea73fa8c0d1692dac789fb20f6
CRs-Fixed: 2835758
Vdev object manager reference should be taken before enqueuing
serialization command and it should be released after dequeuing the
command from serialization queue. Currently this reference release is
done before moving the command to active queue from pending queue.
This may lead to vdev object deletion before the command is moved to
active queue and result in use after free access for vdev object.
To resolve this, release vdev object reference after moving the
serialization command to active queue.
Change-Id: Ibef0814a245abb36f526997d848cf15ef6a49a44
CRs-Fixed: 2832676
Introduce proper logging APIs for diag module and also rate limit error
logs when skb allocation fails in low memory conditions to avoid excessive
logging side effects
Change-Id: Ia41ff7cfd526180825df61a43f1f59163947f257
CRs-Fixed: 2836681
Currently, reg_set_2g_channel_params_for_freq only considers
enabled channels when filling in the channel params. This
could cause issue when starting vdev in a passive channel.
Update the logic to consider CHANNEL_STATE_DFS as well.
Change-Id: I7a49aaa9a51e09729d7b912a6e3fd62fa240d714
CRs-fixed: 2835565
