Potential NULL pointer dereferences of wmi_handle are found in these
functions:
wmi_extract_dfs_cac_complete_event()
wmi_extract_dfs_radar_detection_event()
wmi_extract_reg_chan_list_update_event()
wmi_extract_reg_11d_new_cc_event()
wmi_extract_reg_ch_avoid_event()
Introduce wmi_handle NULL check in the above functions.
Change-Id: I30a842818dff400b8648293f65794ff382eb24e7
CRs-Fixed: 2286258
Currently wmi_unified_api defines a wmi_unified_vdev_restart_send()
prototype, but there is no implementation of this function. This
discrepancy dates back to the initial introduction of the prototype in
change "qcacmn: Add tlv implementation of common unified API" (Change
Id I7e70b48ef5e1df0c0f81c639579e6eb1a6685dc3). Since this function
does not exist, and in fact has never existed, remove the prototype.
Note that another API, wmi_unified_vdev_start_send(), supports both
start and restart capability.
Change-Id: Ia88d8b1e825c806b454428e72d9731ccefd05c01
CRs-Fixed: 2286613
We are suspecting that peer_rx_reorder_queue_remove_cmd is causing
drop of ARP response frames from REO by the FW. This may cause drop of
ping packets.
Add a check in the function to detect if its being called.
Change-Id: I368aa8155830e8e6fadccfaf9ab5bfbfc8bfdd35
CRs-Fixed: 2254858
Currently the 'setratemask' command supports setting
the rate mask for upto MCS0-9 and NSS 4. Add 'lower32_2'
field in the ratemask_params struct to extend support
for the 'setratemask' command to set rate mask
for upto MCS0-11 and NSS 8.
Change-Id: I9c06ae238142dca37df9826ca34449dd34ee6782
CRs-fixed: 2251392
For a full explanation of the problem and phased solution refer to
"qcacmn: Clean up the extscan unified WMI (phase 1)", Change-Id
I11800361b572331cfada00fb7d518c314df20b43, in the qca-wifi-host-cmn
project.
For phase 3 (this change):
Remove the unions introduced in phase 1, leaving just the properly
named replacement identifiers.
Change-Id: Ia14a42a1a767a850fbfd82a5755ddea51246a95d
CRs-Fixed: 2282843
Add ini item to configure active dwell time of 2.4GHz band channels,
This will help to reduce AP search failure probability & hence
connection latency in 2.4GHz band channels especially in noisy
condition by increasing active dwell time.
Change-Id: I05259a8f1fd4a5c67da42e516721a01d32fa652e
CRs-Fixed: 2283692
Existing antenna gain command does not take odd antenna gain value that is
gains are not supported in steps of 0.5db. antenna_gain_half_db pdev
param provides this support. Added WMI and CDP changes to configure/read
this data.
CRs-Fixed: 2024854
Change-Id: I47da9eed74a1a0180cefb4c3f47bc4340da1bdfd
For a full explanation of the problem and phased solution refer to
"qcacmn: Clean up the extscan unified WMI (phase 1)", Change-Id
I11800361b572331cfada00fb7d518c314df20b43, in the qca-wifi-host-cmn
project.
For phase 2 (this change):
Replace all references of the badly named identifiers with references
to the properly named substitutes. Note that this phase may touch
multiple repos and may involve a number of separate changes.
Change-Id: Ie19d632faa50b23f18a2214a7b2502830ff3fbd3
CRs-Fixed: 2282767
Add WMI support to send action OUI extensions to firmware.
For STA interface, this feature is intended to control mode of connection,
connected AP's in-activity time, Tx rate etc.,
Change-Id: I6a0bc9d3f7f0d57805b872cae4baa1fe84fb8193
CRs-Fixed: 2254509
If SAR version 2 is not supported by firmware, then fallback to
default SAR version 1
Change-Id: Ibfbcfd7cf3f438f7cb46250c70221956ea54c7ca
CRs-Fixed: 2274447
The extscan unified data structures were duplicated from legacy
qcacld-3.0 data structures. As part of the duplication process some
things were inherited that are not appropriate in the unified WMI
including camelCase identifiers and the use of "session id" as an
instance identifier. Due to the fact that multiple repos are affected
a multi-phase cleanup is proposed in order to avoid cross-repo
inter-dependent commits.
For phase 1 (this change):
For each inappropriate identifier introduce an anonymous union which
will contain both the badly named identifier and a properly named
substitute.
Subsequent changes will address the following phases:
For phase 2:
Replace all references of the badly named identifiers with references
to the properly named substitutes. Note that this phase may touch
multiple repos and may involve a number of separate changes.
For phase 3:
Once phase 2 completes, remove the unions introduced in phase 1,
leaving just the properly named replacement identifiers.
For phase 4:
Update the legacy code to exclusively use the converged data
structures, abandoning the legacy data structures.
Change-Id: I11800361b572331cfada00fb7d518c314df20b43
CRs-Fixed: 2280645
Pass offset value to the Firmware to support split scanning
of total dwell time in smaller chunks. Offset passed is
calculated from TBTT.
Change-Id: I8114acd1147d468aa6471f672307d8ea0ec8611d
CRs-Fixed: 2134748
Currently the host sends the fixed gtk offload params
and the FILS TLV params, even when the FILS feature is disabled
in the host, which force firmware to pick the KEK from the
FILS TLV structure rather than from the fixed param structure,
which further leads to GTK re-keying feature fail.
Fix is to send only the fixed params in case when host doesnt
supports FILS.
Change-Id: I53a77257e716bf290a6f4bd62927020f073e2df6
CRs-Fixed: 2275938
WMI_VDEV_PARAM_SET_HE_SOUNDING_MODE provides the scope for host
to configure the sounding mode to (VHT or HE). It also provides
(SU or MU) and (Triggered or Non-Triggered) configurability.
Change-Id: Iac566383c5a6b6b3b402526afd2bfa4818f27bc5
CRs-Fixed: 2262752
Reduce log level of channel list logged as part
of roam scan offload command processing.
Change-Id: I8b37db9de94d8f399525255f7d073a6340a058f3
CRs-Fixed: 2271608
Add support for sending WMI command to firmware
to measure estimated airtime that a new client
will get and populate the result that firmware
returns in the ESP IE.
Change-Id: Ic5fcb11100ecd0597ba02dfa5512e2f4ff3558c9
CRs-Fixed: 2261469
WMI recording is done per pdev and hence an instance of
debugfs directory (eg: WMI0, WMI1, WMI2 for 3 radio boards)
has to be created in /sys/kernel/debug/ path.
The wmi handle is per pdev and hence is causing the problem of wmi_instance
being 0 always as each pdev has its own wmi_handle.
WMI1 and WMI2 debugfs directories are not created as wmi_instance
is always 0.
WMI debugfs directory is created for every pdev of the psoc and naming
convention is changed to WMI_SOCx_PDEVx.
Change-Id: Ieb7e9d072d84f699588a8f719508c5cd8d9873fb
CRs-Fixed: 2232472
Data len received in encrypt decrypt data response
is not validated against the max allowed size which
can result in buffer overflow.
Fix is to validate data len against max allowed size.
Change-Id: I69bd8e63014220e5a2f291e4a0b1914d10c79fd7
CRs-Fixed: 2226375
Add check for valid length before copying in function
extract_ndp_ind_tlv to avoid potential buffer overflow issue.
CRs-Fixed: 2271344
Change-Id: I2ddcbc46a45d4d5308b1e0cf663598c85512bbaf
Add definitions for the enum WMI_HOST_SMART_LOG_SCENARIO which defines
individual smart logging scenarios which can be enabled/disabled. Also
add utility macros to set/get the same.
Change-Id: I2b188a6f5cb202868d43253e706115de570cb1e8
CRs-Fixed: 2162053
Pdev parameter to prioritize IGMP packets are supported through
WMI_PDEV_PARAM_IGMPMLD_AC_OVERRIDE. In legacy platforms, they are
supported by different pdev parameters WMI_PDEV_PARAM_IGMPMLD_OVERRIDE
and WMI_PDEV_PARAM_IGMPMLD_TID.
Map host maintained pdev params wmi_pdev_param_igmpmld_override and
wmi_pdev_param_igmpmld_tid to WMI_PDEV_PARAM_IGMPMLD_AC_OVERRIDE since
this is the one supported by TLV based targets.
Change-Id: Ia11787265bd926f257dc1b028552c6e7f1f733d2
CRs-Fixed: 2272219
Worker thread WMI processing API has more broader use now. So make it
non-static.
CRs-Fixed: 2268243
Change-Id: Iae51e1115f5f3664d08c891e8a42d24bd3ef7bcf
Few WMI services are defined which are specific to newer WIN
platforms and are not supported for older platforms. Since the
code to check if service is enabled is common between the platforms,
we see prints quoting service is not supported on chipsets having
both new and old generation radios
Suppress these prints to a reduced trace level to avoid flooding.
Change-Id: I83140c8eec7cf337068fff60442b9d6684efd013
CRs-Fixed: 2261754
Update the definition of wmi_fatal_condition_event, to include
type+subtype specific data under type_subtype_specific_data.
CRs-Fixed: 2267901
Change-Id: I7f5be6ced26a88ac86ab16efd915a5e6ca5dc608
In the function __wlan_hdd_cfg80211_stats_ext_request,
data_len is recieved from vendor command and is passed ultimately
to send_stats_ext_req_cmd_tlv. In send_stats_ext_req_cmd_tlv, len
is calculated as sum of sizeof(*cmd), WMI_TLV_HDR_SIZE,
preq->request_data_len.The len is of type uint16_t
and adding sizeof(*cmd) + WMI_TLV_HDR_SIZE will cause a buffer
overflow.
Changed the datatype of len to size_t so that it doesn't overflow.
Change-Id: I6618042e3c60bbdb1ff5d833188f4bdb4832da7a
CRs-Fixed: 2243169
Add support for NDP TCP/IP params in ndp initiator
request, responder request, indication and confirm.
Change-Id: I5d60af154ea4a2f33d18d9b86049f316e7fbc524
CRs-Fixed: 2252227
If the feature is enabled macst frames would be sent out
even when there are clients in power save (instead of DTIM).
CRs-Fixed: 2133095
Change-Id: I927be022916674cb008459868b095f15c37d8636
1. Add support upto 2048 buffers in the ring
2. Add API to print current ring status per module per pdev
3. Start module ID numbering from 0
Change-Id: I7954007c6c486877ffb2ab91724885af2fbaab8c
CRs-Fixed: 2263968
Add host WMI definitions for the type and subtype fields in
wmi_fatal_condition_event.
CRs-Fixed: 2257956
Change-Id: I2c7043081de86a42b3e89ade34d4a1ffc0c39d77
Android Packet Filter 3.0 requires the framework to be able to
read and write into the APF work memory in the Firmware. It
also requires to be able to enable or disable the interpreter.
New WMI commands are defined for read/write/enable/disable
operations.
Complete the implementation of these new commands.
Change-Id: I852d61eb213d9ae530e8a71069144ef35816f5b8
CRs-Fixed: 2184971
wmi_buf_alloc() API expects length to be passed of type
uint16_t. However, the callers pass uint32_t to it.
This might result in overflow and illegal memory access
thereafter. The fix is to modify the API signature accordingly.
Change-Id: If09da4978d421269b884f7d3c933c49c81651475
CRs-Fixed: 2218346
Add service enum and populate service id for listen
interval offload support so that wmi_service_enabled
API can be used to check if the support is enabled.
Add enum for listen interval offload support
Change-Id: I62dbadb4980f54db8431ad53d096f7fc210d25d7
CRs-Fixed: 2253684
QCN7605 requires Management frames to be transported over WMI.
Enable this for HL transport too.
Change-Id: I97551684224cf027beadb403ac2220fa355af986
CRs-Fixed: 2252391
In wmi_unified_cmd_send, the skb head is pushed by size of WMI_CMD_HDR
and then the commandId is initialized in the header. However 1 byte of
reserved memory in the WMI_CMD_HDR is not initialized and is sent to
the FW as it is and this might lead to exposure of 1 byte of kernel
memory to FW.
Initialize the WMI_CMD_HDR to zero once the skb head is pushed and
then set the commandId in the header.
Change-Id: I89fd5401105cd9c61674a63aac5aa88fb20cc41a
CRs-Fixed: 2257688
Before wow enable or pdev suspend host sets hardware filter bitmap
and enables the filter via a command. But after resuming it sends
bitmap as zero with filter disable. This is interpreted by Firmware
as disable the modes set in the bitmap, so none of the modes are
disabled. With this host will not receive bc/mc packets after
disabling the hw filter, which it is expecting.
Use the correct bitmap sent by cld for disabling the hw filter.
Change-Id: I465e2ec40b6fde8a9e99743a1b9979b67cce5408
CRs-Fixed: 2194973
In implementation of Android Packet Filter, functions, variables,
definitions are named after BPF, which stands for Berkely Packet
Filter. The term was more appropriate for Link Layer packet
filters implemented in the Linux kernel, known as Linux Socket
Filters.
The term BPF is obsolete now, so rename it with the
appropriate acronym, APF.
Change-Id: I606afc747cddedb524a41cd8e5998400f04e69f6
CRs-Fixed: 2191531
File wmi_unified_tlv.c is bloated and adding support for upcoming
Android Packet Filter v3 is going to increase its size even more.
Create a new source file for APF related WMI modules and a header
file for declaring the API's
Change-Id: I37dcc30c7d1311067f375c891be9723612161de9
CRs-Fixed: 2189827
Add support to configure logging buffer size from
per-OEM kbuild based on memory requirement.
Change-Id: Ia91d79e5e738b1c9787015de101c3f67ccde46aa
CRs-Fixed: 2253438
qcacld-2.0 to qcacld-3.0 propagation
Add length check to prevent the data overflow the wmi buffer. The
total length of data should not exceed max svc msg size.
CRs-Fixed: 2248879
Change-Id: I1543732fcfe0cb7e32f7175f7775c9550854cae8
Currently the service bit of wmi_service_wow_wakeup_by_timer_pattern
is not set and it is 0. This is wrong because 0 is the service bit of
wmi_service_beacon_offload.
Set wmi_service_wow_wakeup_by_timer_pattern service bit as
WMI_SERVICE_WOW_WAKEUP_BY_TIMER_PATTERN
Change-Id: I52058d79281aeed9312ce6c0c361d3cb254fef07
CRs-Fixed: 2250922
Add support to read the TWT services being advertised
by the target and make use of it internally in the host
at appropriate places
Change-Id: I3691622447271467d9276788574a2f2717928f83
CRs-Fixed: 2251389
In case PMO feature flag disable, add this change. Change
WLAN_PMO_ENABLE to WLAN_POWER_MANAGEMENT_OFFLOAD.
Change-Id: I875e568dcb239da1b86d1a76cb8cbc925bb13cde
CRs-Fixed: 2243948
