WMI recording is done per pdev and hence an instance of
debugfs directory (eg: WMI0, WMI1, WMI2 for 3 radio boards)
has to be created in /sys/kernel/debug/ path.
The wmi handle is per pdev and hence is causing the problem of wmi_instance
being 0 always as each pdev has its own wmi_handle.
WMI1 and WMI2 debugfs directories are not created as wmi_instance
is always 0.
WMI debugfs directory is created for every pdev of the psoc and naming
convention is changed to WMI_SOCx_PDEVx.
Change-Id: Ieb7e9d072d84f699588a8f719508c5cd8d9873fb
CRs-Fixed: 2232472
Data len received in encrypt decrypt data response
is not validated against the max allowed size which
can result in buffer overflow.
Fix is to validate data len against max allowed size.
Change-Id: I69bd8e63014220e5a2f291e4a0b1914d10c79fd7
CRs-Fixed: 2226375
Add check for valid length before copying in function
extract_ndp_ind_tlv to avoid potential buffer overflow issue.
CRs-Fixed: 2271344
Change-Id: I2ddcbc46a45d4d5308b1e0cf663598c85512bbaf
Pdev parameter to prioritize IGMP packets are supported through
WMI_PDEV_PARAM_IGMPMLD_AC_OVERRIDE. In legacy platforms, they are
supported by different pdev parameters WMI_PDEV_PARAM_IGMPMLD_OVERRIDE
and WMI_PDEV_PARAM_IGMPMLD_TID.
Map host maintained pdev params wmi_pdev_param_igmpmld_override and
wmi_pdev_param_igmpmld_tid to WMI_PDEV_PARAM_IGMPMLD_AC_OVERRIDE since
this is the one supported by TLV based targets.
Change-Id: Ia11787265bd926f257dc1b028552c6e7f1f733d2
CRs-Fixed: 2272219
Worker thread WMI processing API has more broader use now. So make it
non-static.
CRs-Fixed: 2268243
Change-Id: Iae51e1115f5f3664d08c891e8a42d24bd3ef7bcf
Few WMI services are defined which are specific to newer WIN
platforms and are not supported for older platforms. Since the
code to check if service is enabled is common between the platforms,
we see prints quoting service is not supported on chipsets having
both new and old generation radios
Suppress these prints to a reduced trace level to avoid flooding.
Change-Id: I83140c8eec7cf337068fff60442b9d6684efd013
CRs-Fixed: 2261754
In the function __wlan_hdd_cfg80211_stats_ext_request,
data_len is recieved from vendor command and is passed ultimately
to send_stats_ext_req_cmd_tlv. In send_stats_ext_req_cmd_tlv, len
is calculated as sum of sizeof(*cmd), WMI_TLV_HDR_SIZE,
preq->request_data_len.The len is of type uint16_t
and adding sizeof(*cmd) + WMI_TLV_HDR_SIZE will cause a buffer
overflow.
Changed the datatype of len to size_t so that it doesn't overflow.
Change-Id: I6618042e3c60bbdb1ff5d833188f4bdb4832da7a
CRs-Fixed: 2243169
Add support for NDP TCP/IP params in ndp initiator
request, responder request, indication and confirm.
Change-Id: I5d60af154ea4a2f33d18d9b86049f316e7fbc524
CRs-Fixed: 2252227
If the feature is enabled macst frames would be sent out
even when there are clients in power save (instead of DTIM).
CRs-Fixed: 2133095
Change-Id: I927be022916674cb008459868b095f15c37d8636
Android Packet Filter 3.0 requires the framework to be able to
read and write into the APF work memory in the Firmware. It
also requires to be able to enable or disable the interpreter.
New WMI commands are defined for read/write/enable/disable
operations.
Complete the implementation of these new commands.
Change-Id: I852d61eb213d9ae530e8a71069144ef35816f5b8
CRs-Fixed: 2184971
wmi_buf_alloc() API expects length to be passed of type
uint16_t. However, the callers pass uint32_t to it.
This might result in overflow and illegal memory access
thereafter. The fix is to modify the API signature accordingly.
Change-Id: If09da4978d421269b884f7d3c933c49c81651475
CRs-Fixed: 2218346
Add service enum and populate service id for listen
interval offload support so that wmi_service_enabled
API can be used to check if the support is enabled.
Add enum for listen interval offload support
Change-Id: I62dbadb4980f54db8431ad53d096f7fc210d25d7
CRs-Fixed: 2253684
QCN7605 requires Management frames to be transported over WMI.
Enable this for HL transport too.
Change-Id: I97551684224cf027beadb403ac2220fa355af986
CRs-Fixed: 2252391
In wmi_unified_cmd_send, the skb head is pushed by size of WMI_CMD_HDR
and then the commandId is initialized in the header. However 1 byte of
reserved memory in the WMI_CMD_HDR is not initialized and is sent to
the FW as it is and this might lead to exposure of 1 byte of kernel
memory to FW.
Initialize the WMI_CMD_HDR to zero once the skb head is pushed and
then set the commandId in the header.
Change-Id: I89fd5401105cd9c61674a63aac5aa88fb20cc41a
CRs-Fixed: 2257688
Before wow enable or pdev suspend host sets hardware filter bitmap
and enables the filter via a command. But after resuming it sends
bitmap as zero with filter disable. This is interpreted by Firmware
as disable the modes set in the bitmap, so none of the modes are
disabled. With this host will not receive bc/mc packets after
disabling the hw filter, which it is expecting.
Use the correct bitmap sent by cld for disabling the hw filter.
Change-Id: I465e2ec40b6fde8a9e99743a1b9979b67cce5408
CRs-Fixed: 2194973
In implementation of Android Packet Filter, functions, variables,
definitions are named after BPF, which stands for Berkely Packet
Filter. The term was more appropriate for Link Layer packet
filters implemented in the Linux kernel, known as Linux Socket
Filters.
The term BPF is obsolete now, so rename it with the
appropriate acronym, APF.
Change-Id: I606afc747cddedb524a41cd8e5998400f04e69f6
CRs-Fixed: 2191531
File wmi_unified_tlv.c is bloated and adding support for upcoming
Android Packet Filter v3 is going to increase its size even more.
Create a new source file for APF related WMI modules and a header
file for declaring the API's
Change-Id: I37dcc30c7d1311067f375c891be9723612161de9
CRs-Fixed: 2189827
qcacld-2.0 to qcacld-3.0 propagation
Add length check to prevent the data overflow the wmi buffer. The
total length of data should not exceed max svc msg size.
CRs-Fixed: 2248879
Change-Id: I1543732fcfe0cb7e32f7175f7775c9550854cae8
Currently the service bit of wmi_service_wow_wakeup_by_timer_pattern
is not set and it is 0. This is wrong because 0 is the service bit of
wmi_service_beacon_offload.
Set wmi_service_wow_wakeup_by_timer_pattern service bit as
WMI_SERVICE_WOW_WAKEUP_BY_TIMER_PATTERN
Change-Id: I52058d79281aeed9312ce6c0c361d3cb254fef07
CRs-Fixed: 2250922
Add support to read the TWT services being advertised
by the target and make use of it internally in the host
at appropriate places
Change-Id: I3691622447271467d9276788574a2f2717928f83
CRs-Fixed: 2251389
In case PMO feature flag disable, add this change. Change
WLAN_PMO_ENABLE to WLAN_POWER_MANAGEMENT_OFFLOAD.
Change-Id: I875e568dcb239da1b86d1a76cb8cbc925bb13cde
CRs-Fixed: 2243948
Check capability of dbs, mcc and scc on single band when enable
AP+AP, then same driver code can support different chip and
firmware.
Add wmi_service_dual_beacon_on_single_mac_(mcc/scc)_support
Change-Id: I505747122504b2a89813e7bdfcd27dc07539f39e
CRs-Fixed: 2214237
Convert pdev_id from target to host before passing
to ol layer to print correct noise floor value.
Change-Id: I2d138f19901ca5d654631bc2eca76a757dc46628
Add support for ndp schedule update event and provide channel information
in ndp confirm event.
Change-Id: Ic2c073dd4f220627cc2bd1a2d52d858136b6b450
CRs-Fixed: 2180310
Currently if the delta peak of the ETSI type 4 radar pulse is 0, it will
be considered as radar false dection, which affects normal dfs ETSI type
4 certification test.
More checks are added when delta peak of the ETSI type 4 radar pulse is 0.
If psidx_diff, the difference in the FFT peak index between the short FFT
and the first long FFT, is greater than 4 and less than 16, it is still
considered as valid ETSI type 4 radar pulse.
Change-Id: Iee9c22e0c208023bb9f0f70121f8269169b63d18
CRs-Fixed: 2173576
Add WMI support for building and sending the
WMI_TWT_ENABLE_CMDID to the firmware.
Change-Id: Ifbda4d1668e2bcb2e33d044269908e8d4c8333a5
CRs-Fixed: 2244214
Send average radar parameters to FW.
Extract host dfs spoof check status from FW.
Change-Id: I70c4e5aad0fe1eda55da37abd20cc6d70728edba
CRs-Fixed: 2211883
Address the following issues in the wmi folder:
CHECK: 'addres' may be misspelled - perhaps 'address'?
CHECK: 'COMAND' may be misspelled - perhaps 'COMMAND'?
CHECK: 'defintion' may be misspelled - perhaps 'definition'?
CHECK: 'happend' may be misspelled - perhaps 'happened'?
CHECK: 'managment' may be misspelled - perhaps 'management'?
CHECK: 'messsage' may be misspelled - perhaps 'message'?
CHECK: 'overriden' may be misspelled - perhaps 'overridden'?
CHECK: 'poiter' may be misspelled - perhaps 'pointer'?
CHECK: 'refering' may be misspelled - perhaps 'referring'?
CHECK: 'refrence' may be misspelled - perhaps 'reference'?
CHECK: 'shrinked' may be misspelled - perhaps 'shrunk'?
CHECK: 'succesfully' may be misspelled - perhaps 'successfully'?
CHECK: 'succesful' may be misspelled - perhaps 'successful'?
Change-Id: Ie97e4d83cc88a2610524b38adc3474cdd31170d9
CRs-Fixed: 2241590
Address the following issue in the wmi folder:
CHECK: 'accomodate' may be misspelled - perhaps 'accommodate'?
Change-Id: I7cdae0d5f5e9f17de9c3e4810edf9b87704a4f0a
CRs-Fixed: 2241588
In case of invalid MIMO PS config in wmi cmd, wmi cmd
is not sent and we return. This leads to memory leak as wmi
net buf allocated is not freed before returning.
Fix the memory leak by freeing the wmi net buf in such case
before return.
Change-Id: I7f353f0b4d84a663801482a9c28296371bea3b89
CRs-fixed: 2230346
Fix possible OOB access while sending NAN msg to firmware, by checking
data len calculation against integer overflow and making sure data len
to be less than max wmi msg size.
Change-Id: I98f42b9924a1810282ae3bca031cd5a1e3dd4047
CRs-Fixed: 2205722
