Currently in function wmi_extract_dbr_buf_release_entry,
num_buf_release_entry & num_meta_data_entry are copied
to direct_buf_rx_rsp structure without any validation which
may cause out of bound issue if num_buf_release_entry or
num_meta_data_entries provided in fixed param becomes greater
than actual number of entries.
Fix is to validate num_entries and num_meta_data before populating
param->num_buf_release_entry and param->num_meta_data_entry.
Change-Id: I18050fd4f90f8815d7eceb5f715fdbaa09130d3a
CRs-Fixed: 3000875
Define the new TWT attributes for configuring the broadcast TWT
parameters in enum qca_wlan_vendor_attr_twt_setup.
Change-Id: Ia7b0e1565cef3bfe5d213b783390c7231a1a8446
CRs-Fixed: 2924690
Currently, we are Flushing fragments for peer as part of rx defrag
clean up. There is the possibility that frag flush is called while
we are accessing frags in rx defrag store fragment path in parallel.
Which will cause access after the free issue.
Adding lock in rx defrag store fragment path to avoid any
parallel flush while accessing the frags.
Change-Id: Ic27caab58429d776449f4b774eb7163ffa6215ac
CRs-Fixed: 2995156
Currently, reg curr channel list contains dfs channels
but sap and p2p go can't enable on dfs channels if
dfs_master_mode ini is disabled. So, usable channel list
may contain some invalid channels in case of p2p go and sap.
Fix is to check dfs_master_mode ini and include/exculde sap and
p2p go channels based on dfs_master_mode.
Change-Id: If82d2feda78315ab53c5c7ed75f743c14186da98
CRs-Fixed: 2961435
Currently, host sends bw value to upper layer in response
of GET_USABLE_CHAN command. but upper layer requires bw
value in form of nl80211_chan_width enum and considering
bw value as invalid and resulting into 0 bw.
Fix is to populate bw value from ch_params.ch_width instead
of populating from curr channel list and then convert to
nl80211_chan_width from phy_ch_width in hdd.
Change-Id: I1937ac2b3282224861a200a5d956a6e92109328e
CRs-Fixed: 2957055
Fetch usable channels for NAN interface mode from
policy manager or reg current channel list based on
filter mask and Update res msg channel list.
Change-Id: Ifa4ad4c7c8479f4a0ecc7dbe101f6507ff1525dc
CRs-Fixed: 2949340
Currently sleep based wait is used for checking EP request/release
vote is taken effect or not. But once worker thread goes to sleep
it is taking in order of milli seconds to schedule back worker thread
this scheduling delay is causing srng HP/TP writes to be updated in
delayed manner.
To avoid this first try checking EP vote is taken affect by busy wait
then go for sleep based method.
Change-Id: I72e81941a23752a41c9b5307e82c2e971aee1ec8
CRs-Fixed: 2999541
Currently timeout for checking pld_is_pci_ep_awake in
hif_prevent_link_low_power_states might be higher than
the defined timeout depends on how long qdf_sleep takes
to get scheduled again, so avoid this uncertain timeout
adding reference to the system time.
Change-Id: I67a28d46c996ccc56680cf8e20c09a70729a33c5
CRs-Fixed: 2994746
In MISSION mode, MSI address and data are still
configured for monitor status rings even though MCC
uses only polling mode for this ring.
Fix is to skip MSI configuration for monitor sts
ring in MISSION mode for MCC.
Change-Id: If295a5afc6731bbec1ad7182590e0015f3a911ba
CRs-Fixed:
After reg work is complete there is possiblity EP vote reset
request still not processed by F.W. So wait till EP vote reset
is done after reg work completion.
Change-Id: I1f4e318ac96ba3a15c613c5faf5095d4be7c8e99
CRs-Fixed: 2994233
Add api to set intermediate EP vote access state.
Make sure reg work handler is complete before setting
intermediate vote access.
Change-Id: Ib229d9af8b1e58505a9ae5fbf39aa912ca21a3c3
CRs-Fixed: 2994040
Currently there is no synchronization for flush log completion
between fw and userspace. When host driver receives command to
flush logs, it sends the command to fw and releases the control
of the userspace thread, it does not wait for the flush log
completion event from the fw and because of which user space
does not know when the host and fw completes the log flush.
To address above issue add a logic to wait for fw event of
flush log completion before host returns control to userspace.
Change-Id: I04fa0aead146d2b7b8627e4101c6dcd99d3947e9
CRs-Fixed: 2983387
Currently for UK ETSI1 is mapped due
to which reg list may skip some valid
channel list for UK in case of MCC and DSRC.
Fix is to map MCC to ETSI13_WORLD and
DSRC to ETSI10_WORLD.
Change-Id: Ibcc09e2c45506ee5d4d1cbbaf5763d6056a8ff71
CRs-Fixed: 2953624
When vdev deleted and interface down, there are pending pkts in nbuf
queue of dp rx thread in cornel cases, when flush cmd comes, even vdev
is not found by vdev id, rx stack callback isn't set to NULL, pkts are
still delivered to kernel stack, but rx queue is invalid now, assert
will happen when GRO flush happens.
Fix by setting rx stack callback as NULL when vdev isn't found by vdev
id.
Change-Id: Iad3b71dbc86563a4f8b5369474b2a901cdf8b325
CRs-Fixed: 2995694
Mark vdev as delete in process after flush out the packets in rx thread
queue currently.
If rx packet received after flush and before mark vdev as delete in
process, the packet is enqueued into rx thread queue and not flushed after
vdev deleted physically and net interface down. After that, if flush
pkts after interface down, assert will happen.
Fix:
Mark vdev as delete in process before flush out the packets in the rx
thread queues.
If the vdev is marked as delete in progress, then the
packets received on that particular vdev should not be
enqueued to dp rx thread any more.
Change-Id: If651a9e97b8501efc26400079194570ba6407f13
CRs-Fixed: 2996534
skb_set_len and skb_pull operations are done in both
dp_rx_deliver_to_pkt_capture_no_peer and
dp_rx_deliver_to_stack_no_peer. Due to this, in the
issue scenario, EAPOL frame gets dropped in roaming
scenario since qdf_nbuf_is_ipv4_eapol_pkt returns
false.
Fix is to do a skb_push_head operation in
dp_rx_deliver_to_pkt_capture_no_peer API before
exiting.
Change-Id: I071a5248f9f8577c8a21547f67ec53d707dee0be
CRs-Fixed: 2982188
In WMI INIT, check whether firmware supports the ack event or
not. If it supports then enable driver support and send it to
firmware during WMI INIT.
Change-Id: Icfdee6bc06e6a393de880b87fdab70665ea7c8b4
CRs-Fixed: 2987898
In case if TWT command (i.e setup, terminate, pause, resume,
nudge) comes from userspace and if the firmware is in below mode
1. scan in progress
2. roam in progress
3. CSA is in progress or
4. Any other error
then the command needs to be rejected in userspace context.
Synchronize the TWT command so that whenever command goes from
driver to firmware, then driver will receive ack event first
followed by respective event (i.e add dialog, delete dialog,
pause, resume, nudge) with below condition
1. If driver receives the ack event as successful then driver
waits for this ack event, respective event with status of the
TWT action frame over the air is expected.
2. If driver receives the ack event as failure then it will
rejects the TWT command in userspace context.
Change-Id: Ie885d98ecf2dad98d34676d889fd70e4c84f0a05
CRs-Fixed: 2987904
Currently host is populating secondary channel list from master
channel list based on ap power type. In case fw doesn't support
extd cc event then secondary channel list will not have 6g freq,
which may break legacy 6g handling.
Fix is to add validation check for ext cc event support, copy
secondary channel list from ap power type in case ext cc event
is supported by fw else copy secondary channel list from reg
current channel list.
Change-Id: I2e13be2936b624ccbee5e8e426987355076a0062
CRs-Fixed: 2987951
Initialize the last_desc_cleared pointer to -1 not 0, and
also fix the check it should always behind tp.
Change-Id: I281e066d45a99ac99d4f3c4e0bcc3f65f14bb589
CRs-Fixed: 2987029
Add TWT service bit capability support to check whether firmware
supports ack event or not. If firmware does not support ack event
then service bit capability will become 0 and whenever TWT
command comes, host will not wait for ack event and sends command
in a legacy way.
This support is mainly added to handle new host and old firmware
combination.
Change-Id: I55d373c2e017130b58a4b332da16f0eda8f34eba
CRs-Fixed: 2987749
Add QCA vendor interface for userspace to get information of usable
channels for different interface types from the driver/firmware.
Change-Id: Ice662b9f14e95f32f853637e73bccd686678f278
CRs-Fixed: 2939047
The existing assertions for unmapped variable in
rx descriptor results in an undesired bug_on since
the unmapped value is 0 for active descriptors.
The fix is to modify this assertion so that bug_on will
be triggered only if the unmapped value is 1 in rx
desc.
Change-Id: I03b27e0e42ce3c42b9fa148da9258063b0209b08
CRs-Fixed: 2985248
Wake-IRQ can be received just before Kernel issuing
suspend_noirq callback, such wake-IRQ would not be
handled by Kernel. So check if any tasklet most likely
CE2 is pending and abort suspend_noirq if true.
Change-Id: Ie3d6de97179aa0d8f383a086f4f8df27d3fc5254
CRs-Fixed: 2981882
Add CDP reason code support for sending DELBA request,
so protocol layer can make decisions for special cases.
Change-Id: I4e4b2e7f7232a8ab12d4c7838f97908f481dc787
CRs-Fixed: 2983553
The earlier logic for scanning non-inheritance IE fails if
non transmitted bssid profile has any extension element
such as MU EDCA before the extension element with
non-inheritance IE.
Since MU EDCA is also an extension element and it does not
have noninheritance element id in it, the logic used to fail
as the driver does not check further for any other extension
element ID in non transmitted bssid profile. Because of this
the IEs part of non-inheritance list used to get inherited,
causing disconnection issue.
With current fix, the scanning for non-inheritance IE has been
taken care properly. Driver will go through the non transmitted
bssid profile until it finds the extension element with
non-inheritance element ID in it.
Change-Id: Ib4346600a880a8390c6d023cf403ed18c62406d2
CRs-Fixed: 2935065
When host receives BAR frames with OOR/2K jump in sequence
number it updates REO HW with new starting sequence number
and requests F.W to setup peer reorder queue. But REORDER_QUEUE_SETUP
is already requested to F.W as part of initial add BA in host.
So while handling OOR/2K jump BAR frames don't send
REORDER_QUEUE_SETUP to F.W
Change-Id: Idc3657e901dc792f699b53c45e4ae5133d286891
CRs-Fixed: 2981280
If there is any non-inheritance element present as part of the
nontransmitted BSSID profile then while generating scan entry
for that profile, driver need not inherit those list of
element IDs and list of element ID extensions from the
transmitted BSSID profile.
Since non-inheritance element is an element ID extension, it
should be part of extension element. So the logic we use over
here is to find if there are any extension element present in
the nontransmitted BSSID profile. if yes, then only go ahead
with below logic or else go with the normal flow.
Logic:
Mark and store the start of the list of element IDs and
list of Element ID extension.
While generating the new ie for the non transmitted BSSID
profile, do not inherit the IEs present in the above
mentioned lists.
Change-Id: I466afa8273e841b6f7656b1dc59342bc2d4f13bc
CRs-Fixed: 2883389
If any nontransmitted BSSID profile is fragmented across
multiple MBSSID elements, then it is called split profile.
For a split profile to exist we need to have at least two
MBSSID elements as part of the RX beacon or probe response
Hence, first we need to identify the next MBSSID element
and check for the 5th bit from the starting of next
MBSSID IE and if it does not have Nontransmitted BSSID
capability element, then it's a split profile case.
This change is responsible in accumulating the non
transmitted BSSID profile, fragmented across multiple
MBSSIDs, so that the scan entry will not miss any
information.
Change-Id: Ia78cc47d1ffd03ada659d257b83741e7ab921fa2
CRs-Fixed: 2883389
There is a time involved between the smmu fault initiated
and the eventual system panic. In this time there is a
possibility of the nbuf history being overwritten losing
the information on the nbuf which might has actually caused
the SMMU fault.
Set the ssmu state and dont track the nbuf's when the smmu
fault is detected.
Change-Id: I579da332766618161567764656005ef13667270e
CRs-Fixed: 2960070
Error log peer not found is coming spurious in
dp_2k_jump_handle on continuous error pkts, so
rate limit the same.
Change-Id: If4b577a7759136ea824ca62b63ef91d102b8decb
CRs-Fixed: 2978939
If an MSDU is scattered across multiple nbufs, rx
attention tlvs are only valid for the last nbuf for
this MSDU. MSDU len err field is fetched from rx
attention tlvs for all the nbufs which could result
in an incorrect drop of packets.
Fix is to check for msdu len err for nbufs with msdu
continuation bit set to 0.
Change-Id: I0ed5cbb37a2ba34a39328618e3f5e66d419d7cca
CRs-Fixed: 2982308
CE irqs affinity is set to gold cores, but affinity
hint is not removed while freeing irqs.
So remove CE irq affinity before freeing them.
Change-Id: If3822422f823cb3caa6e291387a2beadc62049b7
CRs-Fixed: 2975529
Add functions to parse and extract wmi smart monitor
event received from target.
Change-Id: Ic18e3134b684c5f8e12839e997d628909a7e27c9
CRs-Fixed: 2969247
For operating class 128 and 130, a new center channel was added to list.
Update the table to reflect the new channels.
Change-Id: I6157f02089f7b4f16231a6bb35d829343bbc968f
CRs-fixed: 2975890
For 2G and 5G, the secondary channel list is coming from
master channel list which is not filtered by NOL.
Fix by using cur_chan_list to fill the secondary channel
list for 2G and 5G part.
Change-Id: I5e9ede6e39a66ad1a2f0e6c32c151ef175be6dab
CRs-Fixed: 2976916
First Requirement:
In case of WTC_BTM roam trigger reason, if FW reports rssi
threshold for 5G and 6G AP via wmi_roam_trigger_reason,
Host should print it in kmsg.
If wtc_candi_rssi_ext_present is set (1), It means fw
reports 5g and 6g candidate rssi (new firmware case).
If wtc_candi_rssi_ext_present is clear (0), It means fw
doesn’t report 5g and 6g candidate rssi (old firmware case).
Host use flag "wtc_candi_rssi_ext_present" to keep backward
compatibility.
Second requirement:
As per user space, value for scan mode in WTC command, is
like below:
0: no Scan, 1: partial scan and 2: full scan.
For NO scan case, FW sends value
ROAM_TRIGGER_SCAN_MODE_NO_SCAN_DISCONNECTION (3)
in wmi_roam_trigger_reason-> wtc_scan_mode. When driver receives
WTC scan mode as ROAM_TRIGGER_SCAN_MODE_NO_SCAN_DISCONNECTION,
it should print value as 0 instead of 3.
Convert WTC scan mode comes from FW to
wmi_configure_roam_trigger_parameters->scan_mode to make it
compatible to WTC command.
Change-Id: I8266460aac1272d345e4349c2ca52b4f9a745d4c
CRs-Fixed: 2965362
There is potential risk when starting CFR and resume happens at same
time, so this change adds wake lock for enhanced CFR.
Change-Id: Ifbde12cb73092b7fc4ef517e57051af4ffe7a79f
CRs-Fixed: 2974733
Runtime put should be done in hif_pm_runtime_get when
return value of __hif_pm_runtime_get is negative. In
the issue scenario, the ret value will be set to 0 when
the return value of __hif_pm_runtime_get is positive.
The store operation for ret variable somehow did not take
effect and the if check for non-zero ret value to do
runtime put did go through. The return value to
dp_tx_hw_enqueue from hif_pm_runtime_get is the updated
ret value of 0. This will result in double runtime put
for a single runtime get.
Fix is to modify the ret variable check to negative
instead of non-zero to ensure runtime put happens
correctly.
Change-Id: Idc380a11c82b6d1acf7c750e7b93776ac9d6b4f2
CRs-Fixed: 2969879
Add a new API reg_get_6g_power_type to update ap power
type when STA roams in/out of 6GHz channel. It is invoked
from CSR during initial connection and sch beacon process
during roaming.
Change-Id: I0d20d4d7f291ec608b27a1611c8877c33f4b45b1
CRs-Fixed: 2968243
