FW is not setting up any context for CE5 but host is still
configuring the dest and status ring for CE5. This can
result in CE5 HW to write to MSI iova address when PCIe is
in low power state.
Fix is to disable MSI intr configuration for CE5 on
Lithium based targets.
Change-Id: I964305ad1258d41d7afe6422f87286904c0a6739
CRs-Fixed: 2954723
Memory allocated for tx_hw_desc_history uses incorrect
size parameter resulting in much lower memory to get
assigned. This will result in OOB access and corruptions
in memory, regions post the trailing boundary when updating
tx hw desc events via dp_tx_hw_desc_update_evt.
Fix is to use the appropriate memory size for tx_hw_desc_history
and add NULL check in dp_tx_hw_desc_update_evt.
Change-Id: I97af7898cf8bf1b24978d559f84a2a3d00227ed8
CRs-Fixed: 2952859
In case the serialization command timeout happens, it queues a msg
with in schedular thread to process timeout and pass the active timer
as its context, but if before the timeout process is executed the
actual command completion can remove the command from serialization
and it will update the timer data to point to the newly activated
command.
Now when the timer msg is executed the timer is pointing to the newly
activated command instead of actual command which was timed out
and thus remove the new command instead of the original command.
This leads to an issue where the new active command removal is a
failure when its process is completed and thus action remains
incomplete. This can also lead to two commands getting processed at
the same time as the new command was forcefully removed.
To fix this instead of passing the timer context pass the copied
command in msg to scheduler thread and do not delete the command
from serialization if the command is not active.
Change-Id: I14b489172d0f22a9ed3b26b9c94226a4095f1dee
CRs-Fixed: 2950525
Add HI_TASKLET support for CE, to improve priority
of CE tasklet higher than softirq, since CPU hogging
caused by RT thread.
Change-Id: I88fe8c048e908b9780745bb26b177acd2baf6a5c
CRs-Fixed: 2948946
Add a new flag to indicate to fw that host will set the
nan_disable_flag for channels.
Change-Id: Ibf627bff77e1afb0849149a63981ca50476f6bfd
CRs-Fixed: 2949481
There is a timing race condition between RTPM suspend flow and
DP TX flow. When TX is queued during RTPM suspend flow. TX
ring update may be delayed. Add a force TX HP flush when RTPM
is rejected due to TX pending frame. This can help to improve
TX pending frames delay when race condition happens.
Change-Id: I6f60f2902dfda630f81528dcf978da6644d18ba7
CRs-Fixed: 2942744
Add new API reg_get_band_from_cur_chan_list to build a chan
list based on either primary/secondary current channel list
as per requirement.
The legacy API reg_get_band_channel_list uses primary
current chan list to build a channel list. SAP needs to use
a secondary current channel list. Add a new API for SAP,
reg_get_secondary_band_channel_list for the same. Both these
APIs will call new API reg_get_band_from_cur_chan_list
by passing primary/secondary current chan list respectively.
Change-Id: I1e5573ac9371fc3ce5dc2c387fbd1d47696a161a
CRs-Fixed: 2947516
Currently, in get_htc_send_packets() when the
hif_system_pm_state_check() fails, we are not doing a
runtime PM put operation for the corresponding get operation.
This imbalance will never make the system enter runtime suspend
state and also we do a BUG() when such imbalance is encountered
during runtime PM deinit. This change also fixes a potential
memory leak.
Change-Id: I3e5916005d583de42a49dd2dc0632bfcca1251e4
CRs-Fixed: 2947247
Current in wmi_rx_diag_event_work, rx diag event is processing
in a while loop, if there is continuous diag event comes from
fw, it is possible that it occupy the work queue, and other work
are not able to run.
Break the while loop so give a chance to other work.
Change-Id: I7af6d60aeb8c0524cc51d663658d5b17349daa60
CRs-Fixed: 2948839
The current limits of DP RX packet drop thresholds are huge;
In scenarios, where the processing of RX packets is slow, huge
number of packets will be held in the memory and could eventually
lead to out of memory issues. Reducing the thresholds to address
the problem.
Change-Id: I76a2622fb30cda615aeb27fcc9c8e548ffec3e51
CRs-Fixed: 2941885
AP sets multiple AKM suites in RSN information of beacon
or unicast probe response. In case if the invalid or
unsupported AKM/unicast cipher suite present in the AKM
suite list, the driver detects it as wrong RSN IE and
drops it. This results Device driver doesn't send
authentication to initiate a connection to that AP even
one or more than one valid AKM suites present in RSN IE.
Ideally, the driver should able to initiate connection if
at least one AKM/unicast cipher is valid and supported in
AKM suite list.
Change-Id: I8ed525e3945e4e437d15b496c80b1ad2aef4cb65
CRs-Fixed: 2948248
hal_get_entrysize_from_srng returns the entry size
in dwords but the caller expects in bytes. This results
in insufficient data to be recorded for CE event.
Fix is to left shift the entry size by two bits in
hal_get_entrysize_from_srng so that the entry size
value returned is in bytes.
Change-Id: If532da7abe5ce9c293969f0052455085f18b1926
CRs-Fixed: 2935196
This is about CFR feature, set max ta ra entries to 4 for QCA6490 and
QCA6750 base on HW design.
Change-Id: Ief62ac394e3991a896d9bb954289e63ac105e74e
CRs-Fixed: 2939149
In wlan suspend and resume cases it is seen that group
irqs are getting disabled multiple times without getting
enabled which is causing irqs to be disabled permenantly.
Track for unbalanced disabling/enabling group irqs which
helps to root cause the issue.
Change-Id: Ic1ef637c317f04b3299f17f19208df11ece3c013
CRs-Fixed: 2939809
Firmware sends control frames in same wmi path as mgmt
frames. Currently, these frames will be dropped by mgmt
txrx component, so add support to handle control frames
in mgmt txrx component.
Change-Id: Ia046c1b3b25d40429a859e9c2659126b3d5eb3c0
CRs-Fixed: 2932123
HTC buffer is freed in enqueue failure case. Then it is requeued to
htt_htc_pkt_misclist also. In deinit flow, misclist entry should be
cleared, so buffer double free is hit in this stage. Make a change
to not requeue this frame to misclist.
Change-Id: I0211c4b548d7df7176ee72a83e21f8fcf7fa464c
CRs-Fixed: 2942972
In some RX backpressure cases, we see the HW accessing REO
queue descriptors of a deleted peer(after the queue descriptors
are unmapped/freed), this is leading to SMMU faults. There are
cases where the HW is accessing the stale REO queue descriptors
after ~12seconds after the queue descriptors were freed.
In order to avoid the problem, HW team has suggested to defer
unmapping/free of REO Queue descriptors. Add the logic for the
same.
Change-Id: I5b1fb966dc75b963ccc9d22c40272c8d1d8d6026
CRs-Fixed: 2939223
For some concurrency scenarios, there is a need to have each session
operate in independent power modes. To achieve this, add a second
current channel list to store info for the secondary power mode.
Also add the APIs to read from the secondary channel list.
Change-Id: Ib1bd712645de05786ea6d4bbfe6163c385bdfeaa
CRs-fixed: 2944483
In monitor mode, when the channel is set to any 2G band channel
the mac_id passed to dp_mon_process API is 1. As part of
dp_rx_buffers_replenish, refill history is logged and the
mac_id is used to index into the history array. The array is
of size 1 and OOB access would happen when ring_num which
is the mac_id, passed in is 1.
Fix is to pass the pdev->lmac_id instead to
dp_rx_refill_ring_record_entry and add ring_num sanity check.
Change-Id: Id824ec8b01e7923ad74771d5f34a25f5fccb65f3
CRs-Fixed: 2939544
Modify check to ensure packet number is consecutive for
fragments and drop the fragments if the check fails.
Change-Id: I2ca0ef6211594ba35aae894e6a385d3d5778bff6
CRs-Fixed: 2874369
Register dp_peer_flush_frags API in dp peer ops
for flushing fragments for a particular peer.
Change-Id: Ia179d3160bdc306ec965c465134042c66a0c40a6
CRs-Fixed: 2874366
Drop non-EAPOL frames from unauthorized peer in security mode.
Enabling this feature by default with this change.
Change-Id: I9878b37088149e34f456a38a9c0f722e4c5ee49a
CRs-Fixed: 2943789
CVE-2020-26145
Broadcast and multicast frames should never be fragmented. Several devices
process broadcasted fragments as normal unfragmented frames. Moreover, some
devices accept plaintext fragmented broadcast or multicast frames in
protected Wi-Fi networks. An adversary can abuse this to inject packets
by encapsulating them in a fragmented plaintext broadcast frame. Even
unicast packets can be encapsulated in broadcast Wi-Fi frames and hence
be injected.
Change-Id: I3181a05e177cf9374a14edb748bc5001d058e0f3
CRs-Fixed: 2893212
For security cert TC, RSNIE length can be 1 but if the beacon is
dropped, old entry will remain in scan cache and cause cert TC
failure as connection with old entry with valid RSN IE will pass.
So instead of dropping the frame, do not store the RSN pointer so
that old entry is overwritten.
Change-Id: I2fe4d2dd2352be6850f7a18a2ec829733ded7ee8
CRs-Fixed: 2944120
Even though HP/TP updates are posted writes at CPU level, they
are getting blocked until soc comes out retention which is hogging
CPU
To avoid this if EP is in low power state update HP/TP writes from
delayed work context. In delayed work vote for EP awake wait till it
comes out low power state and then proceed to HP/TP update.
Change-Id: I61d5795f58f25f850b5a9ad4d30e3181dba23713
CRs-Fixed: 2913495
Some of the targets require more QDF nbuf history
size, so making the size configurable keeping
default same.
Change-Id: Ic4ac43a1eacb1e58c0a05b794349525d614d7fc8
CRs-Fixed: 2929968
Add new ini's for assoc active and passive dwell time
for 6g. These will be applied if STA is connected.
Change-Id: I680fbd3038968ecf6ff9920fff982456135bfd77
CRs-Fixed: 2941359
Firmware generates wmi Rx diag events every few milliseconds,
and processing the same in system shared work queue may lead to
work queue lock-up detection. Hence, move Rx diag event processing
to dedicated work queue.
Change-Id: I10cdde317794e35bc6d10677ab76ea24a66e1880
CRs-Fixed: 2941409
In some of the targets modulo operator assembly API's
are not defined causing compilation error.
To avoid this use qdf based API's for modulo operations.
Change-Id: Ibc69b69aa38cadff5daa8dee8b65ceaacfe997b7
CRs-Fixed: 2940281
Logs are printed inside a spinlock which was held for
losing more than 2 seconds.
To fix this, reducing log level so it is not printed
in the console and instead in driver logs.
Change-Id: Ib510ddc1b5bff63db012b45ffa0280eedc356cc6
CRs-Fixed: 2938590
Add the history support to log Tx descriptors programmed
in Tx and completion HW rings.
Change-Id: I60954c93e2595e7dad1251c459eed8afc761e917
CRs-Fixed: 2924614
When host failed to find out vaddr by paddr from FW, output more
information for debug further.
Change-Id: I65c4965c12c2ffa3fe2a26a82df01d1b91501c73
CRs-Fixed: 2925194
Driver gets vdev by wlan_objmgr_pdev_get_first_vdev and returns wrong
vdev in some platforms, and then gets wrong channel/phy_mode. This
change gets vdev by id and fix this issue.
Change-Id: I814d516361238afbd0345bc362c286d1cb55a7d4
CRs-Fixed: 2933525
issue happen when wpa_supplicant is creating vdev
and schedule_thread is destroy the same vdev.
if state is not WLAN_OBJ_STATE_LOGICALLY_DELETED,
return back here, otherwise it will cause the creating
vdev_id to be invalid.
Change-Id: I574838bca574add497f1167c75ede44938b7bf17
CRs-Fixed: 2935068
Fisa packet history is around 6KB for each sw fisa
flow entry and this is part of the dp_fisa_rx_sw_ft
structure. The total size of the SW FT as a result is
around 830KB and the higher order memory allocation via
kzalloc for this could fail in low/fragmented memory
scenarios.
Fix is to allocate memory for FISA pkt history separately
and attach it to the SW FT entry.
Change-Id: I7296d7269c1b86ec38ea1668e8a0893335bbdb6f
CRs-Fixed: 2936353
Add support for Rx refill ring history, maintain records of refill info
during RXDMA ring replenish.
Change-Id: I034014eacfc510ec6f416fca601fa864326de9c2
CRs-Fixed: 2930005
Add an API to set the AP power type and then recompute the current
channel list.
Change-Id: Iacd4d3244f601836f3ed0eae725eaa6375a3584c
CRs-fixed: 2934625
Add country code check for ETSI domain, in other words
UK, since only UK supports 6G in EU as of today. The
TPC power calculation API calls this function to check
if programmed ctry is GB to allow STA to use VLP mode.
As and when more EU countries support 6G, the checks
will be appended to this API.
Change-Id: If985f3f64fc806cf1875f798ff3a86667a0861b8
CRs-Fixed: 2933678
Add new reason code WMI_HOST_ADD_TWT_STATUS_SCAN_IN_PROGRESS
to handle add dialog rejection due to scan is in progress
at firmware.
Change-Id: I30c3d1096690bd0cb7a669206f087e006c23ea44
CRs-Fixed: 2923289
When CE tasklets and NET_RX gets scheduled on same CPU,
NET_RX is throttling CE tasklet resulting WMI timeouts.
To avoid this affine CE irqs to gold cores, so that CE
tasklets will get enough CPU time.
Change-Id: Ided81a0565958aca6611eba911824c3485eca472
CRs-Fixed: 2933335
The firmware rejects the TWT setup request when scan is in
progress. Extend enum qca_wlan_vendor_twt_status to represent new
reason code for it.
Change-Id: I8576d8cce2fac62d9e3cf020a3dadee06ec14d5c
CRs-Fixed: 2923272
When nbuf is freed via dp_rx_buffer_pool_nbuf_free, the
nbuf is enqueued to emerg_nbuf_q always even in the case
where the emerg_nbuf_q is not initialized. This will result
in NULL pointer dereference when any nbuf is enqueued to
emerg_nbuf_q.
Fix is to add initialization check before adding the nbuf
to emerg_nbuf_q and free the nbuf if emerg_nbuf_q is not
initialized.
Change-Id: I075b3b93203eec21d44ea3967b5f46d59c291a14
CRs-Fixed: 2934593
