Reo timer threshold is set to 512us as a default so
increase the maximum value of timer threshold to 512us
to avoid out of bound value.
Change-Id: I291e80e5930b2d3537cbbc9716b323aeb6be89c3
CRs-Fixed: 2571639
set_wake_up_idle together with PF_WAKE_UP_IDLE is removed from
kernel 5.4 and hence kernel version check to avoid compilation
issues with 5.4 kernel.
Change-Id: If44e275eed1d639d90fc7fb4c93a5a2386ffba15
CRs-Fixed: 2580955
Depending on the requirement, a bigger size or a smaller size for
the frequency variable can be chosen. The advantages of each size
are described below:
Advantage of a bigger size:
When two technologies (e.g. 802.11AX and 802.11AD) are controlled
by the same driver software, the frequency range may be very large
and a bigger size (e.g. 32bit integer) is more appropriate.
Advantage of a smaller size:
When the frequency range is not very large, a smaller size
(e.g. 16bit integer) can be used. It saves a large amount of space
especially when many large arrays containing elements of this
type/size are defined in the driver.
Change-Id: I6c8fb2a4dc117e2535ef96009362923557cee398
CRs-Fixed: 2570456
In SLUB disabled builds, the qdf_mem_malloc calls the
qdf_mem_malloc_fl function which doesn't
validate if the size provided is 0 and returns the value
ZERO_SIZE_PTR(((void *)16)) for the pointer. When this pointer
is dereferenced, it causes invalid address dereference.
Validate if the size parameter provided to qdf_mem_malloc is
0 or greater than QDF_MEM_MAX_MALLOC. Return failure if the
validation fails.
Change-Id: I8fc6bc796847e9dd3dfd5186b0386d323560d0cf
CRs-Fixed: 2571505
crash scenario:
a. pktlog is enabled, the timer mon_reap_timer is active,
reap mon_status_ring hal desc periodically.
b. rx_desc status pool is freed in dp_rx_pdev_mon_detach() when do
dp_pdev_deinit() while the mon_reap_timer is still active until
dp_rxdma_ring_cleanup() free it.
c. during the timeslot between dp_rx_pdev_mon_detach() and
dp_rxdma_ring_cleanup(), if some hal desc is pending to be
processed on mon_status_ring, invalid accessing to rx_desc_status
pool happened.
solution:
if pktlog is enabled, stop mon_reap_timer ahead of
dp_rx_pdev_mon_detach() in dp_pktlogmod_exit().
Change-Id: I91b16a88a5e4390587925d6eb2840b3ec1ec2187
CRs-Fixed: 2579817
Move MACRO definition of TWOG_CHAN_6_IN_MHZ out of
ifdef CONFIG_CHAN_FREQ_API, move to public header file,
then other components can use it.
Change-Id: Ieb4b2b167c664246d39949ad4f8d53eda6b9d7de
CRs-Fixed: 2580207
Host send number of channels = 0 and channel list type =
WMI_CHANNEL_LIST_STATIC in RSO command to firmware to clear static
channel list for ROAM SCAN in firmware.
Hence, at WMI layer check for chan_count is removed and channel list
type mapping is done irrespective of chan_count.
Change-Id: Ia3dded0d58e32570d3dd5f7193410909ecef0cc4
CRs-Fixed: 2579748
Currently defragmented packets use HAL_RX_BUF_RBM_SW1_RBM as the RBM
value for the defragmented packets which are re-injected into REO.
Thus, if REO encounters any error while handling these packets, they
would end up in WBM2SW1 ring (via WBM), which is managed by the FW. The
FW will eventually recycle these buffers back to RXDMA via its refill
process. As a part of defragmentation, host does a 802.11 -> 802.3
header conversion. This is resulting in an address which is not 4
byte aligned. Hence, when RXDMA tries to use these addresses (after FW
recycles them), it may lead to issues.
Change the RBM value of the defragmented buffers which are
re-injected. Now, if REO ends up throwing an error for these
packets, they wll end up in WBM2SW3, which is managed by the host.
The host can then drop these packets and replenish RXDMA with 4 byte
aligned buffers (via FW).
Change-Id: I9d9c25385978d5be855699feb28d292c6f3fffdd
CRs-Fixed: 2572483
Crash scenario:
a. monitor mode dp_vdev is freed in dp_vdev_detach_wifi3 without
checking whether any dp_peer is associated.
b. monitor mode self dp_peer do peer clean up when HTT peer
unmap MSG received, invalid accessing to dp_vdev as it has been
freed in step (a).
Check if there is dp_peer associated for monitor mode dp_vdev,
skip dp_vdev free, when all dp_peer is freed, dp_delete_pending_vdev
will free dp_vdev.
Change-Id: Iea4b0efc6e7bbd4109d9cd0b109dfddf727a9fff
CRs-Fixed: 2576604
Pine supports restricted 80+80 MHz only on cfreq=5690 and cfreq=5775. If AP
detects RADAR in this channel, it chooses new 80+80 MHz random channel
which is not supported by Pine because, notion of 80+80 is not present in
current channel in regulatory component. Hence, as a temporary fix we
change the invalid 80+80 MHz channel to 160 MHz or lower.
Change-Id: I749607236a1dd7b9c7aa93ff889b65adcbb4191c
CRs-Fixed: 2570057
Local peer_id is being cleaned up across DP, HDD and PS/WMA.
So, any references to local peer_id/sta_id will be replaced
by peer mac address and all interactions between the layers
will be based on peer mac address.
Cleanup local peer id usage from DP APIs.
Change-Id: I930e1c6a09092a373c093239632d6f310fee18e2
CRs-Fixed: 2529041
Local peer_id is being cleaned up across DP, HDD and PS/WMA.
So, any references to local peer_id/sta_id will be replaced
by peer mac address and all interactions between the layers
will be based on peer mac address.
Cleanup unusued DP APIs which are based on local peer_id.
Change-Id: Idd95bc640ca7e36a427be7202935034d4ed58979
CRs-Fixed: 2529026
Add code to change the vdev_mlme timers to psoc_mlme timers
and also change code to send vdev_delete to FW while physical
destruction of vdev obj.
Change-Id: Ie041182155c75d0cc3825dc97b26abc6be38d76c
CRs-Fixed: 2563931
As part of the new changes, vdev mlme object will be freed before
the vdev delete response is received from the firmware. Hence do
not use the vdev_mlme object in the vdev delete response handler.
Change-Id: I6b2db32ac0ef415bf1b879b2cd222de67d9a69b7
CRs-Fixed: 2563404
Wakelock is system level lock not required to be taken
for every vdev, Hence move the wakelock to the psoc
hierarchy.
Change-Id: I525baf5f4b5dcadb493d84900dbd0a2e7c6407f6
CRs-Fixed: 2563406
Move the vdev response timer from the vdev object manager structure
to the psoc mlme structure.
Change-Id: Ieb87ac6549aa23e0beb61441fea459d3db78c2f3
CRs-Fixed: 2563410
Remove pdev and vdev control path handles from data path.
Instead send pdev_id and vdev_id along with opaque soc
handle in ol_if_ops.
Change-Id: I6ee083f07e464f283da0d70ada70a4e10e18e1b2
Avoid freeing flow_pool_array_lock when it is
not created. So free flow_pool_array_lock in 2
ways:
1. When dp_soc_cmn_setup fails free the flow_pool_array
lock only if it is created and then close the dp
soc handle.
2. As flow_pool_array_lock is created in dp_soc_cmn_setup
as part of dp_pdev_attach_wifi3 init sequence free the
lock only in the dp_soc_cmn_cleanup as part of the
dp_pdev_detach_wifi3 deinit sequence.
Change-Id: Ie3e11da0bc0854fa550c5d417ca3c0bc9e2593b1
CRs-Fixed: 2565603
With this change, in concurrent mode
(SAP on 5ghz or 6ghz and peer connected + STA Scan ongoing),
active dwell time for 2ghz is not reset to 0.
Change-Id: I27bcd64579727e279095cf5386638dbd49567b3d
CRs-Fixed: 2575762
To fix 'error: ‘num_channels’ may be used uninitialized in this
function' error, initialize num_channels to zero.
Change-Id: Ic35b606a6e075dd309844c5fca793f970a701f5e
CRs-Fixed: 2570055
Add support to send the config params as a part of NAN enable/req
command to the firmware. The config params contain information regarding
the enable/disable status of NAN RTT.
Change-Id: I9826d0cd2763fd70b8203cd03ca043b35d082820
CRs-Fixed: 2574051
If the timestamp field in the current Spectral report is equal to the
timestamp field in the previous report, assert the FW.
Change-Id: Idb32807f0cdd59a2eaab5dd6c1e62567fd5a45d0
CRs-Fixed: 2478593
All gen III chipsets use Direct-DMA mechanism to copy Spectral reports to
the Host for further processing. This mechanism involves ring and buffer
management in the Host, FW, and uCode, where improper/incomplete DMA and
improper tail update issues are seen. DBR framework provides support to
debug such issues. Add Spectral control path support to facilitate the
configuration of these debug options.
CRs-Fixed: 2478596 2478595
Change-Id: I094616c4137145389b6984ccab933e5ebd0aa1ab
Before iterating in pending list, use spinlock to avoid possible
race condition.
Remove function wlan_serialization_get_active_list_next_node_using_psoc
as it not being used and is part of legacy flow which is suppose to be
removed eventually.
Change-Id: I9e7cbd9db8b5a1c45915bf5291cd5011c276d0e2
CRs-Fixed: 2573425
To enhance visibility of 6GHz AP, 6G only AP shall send
Fils Discovery frame periodically in one beacon interval.
Change-Id: I51487380fca10418d2260dc2612e2adcf6cbb93b
CRs-Fixed: 2562434
All gen III chipsets use DDMA method to copy the spectral reports to
the Host. It is possible that the buffers can be improper/incompletely
DMAed, which leads to wrong values being present in the Spectral report.
To detect improper DMA, the DBR framework has the support to poison the
buffers before handing them over to the target. This framework expects
the buffer owner modules to check for poison values in key fields.
So, validate the Spectral reports and assert the target upon failure.
Change-Id: I519bf8abd87cfc9758fe7d126a195f39656d8ecc
CRs-Fixed: 2478592
For each DBR ring, add debugfs entry to dump at real-time the ring
parameters like head, tail index, the timestamps at which a buffer is
received and replenished. Issues that are specific to tail index
movement from the target can be identified with this debugfs entry.
CRs-Fixed: 2466514
Change-Id: Iafbc61726264464212cb783a1cce46e16b8a48ff
Improper/incomplete DMA by the target affects the functionality of modules
that are using DBR framework. Add debug infrastructure to poison DBR
buffers with a given poison value before handing buffers over to
the target. Buffer owner modules can explicitly check for the poison
value in order to detect the improper DMA.
All modules that use DBR framework can use this debug infrastructure.
Change-Id: Ib3923c13202990e0f1198645b680c44a20736167
CRs-Fixed: 2466518
Add debug infrastructure to track the movement of head and tail pointers
of the DBR ring along with the time at which each buffer is received and
replenished. All modules that use DBR framework can use this
infrastructure. Issues that are specific to tail index movement from
the target can be identified with this debug infrastructure.
CRs-Fixed: 2439460
Change-Id: I6b486a73cf6a3174dfa297f8fb370fd298b46b67
Increment pdev->num_tx_outstanding when
tx_desc is allocated and decrement tx_desc when tx_desc
is released. During runtime pm suspend, WOW PAUSE
is sent to firmware only if there are no
pending num_tx_outstanding descriptors.
Change-Id: I54aaa4d8a37b8cd47de1701a315bb0735c9739d2
CRs-Fixed: 2567689
Kernel 5.4 and 5.1 have removed the functions wakeup_source_init()
and wakeup_source_trash() respectively. Add conditional preprocessor
directives to use wakeup_source_register() and wakeup_source_unregister()
for Kernels 5.4 and 5.1 respectively.
Change-Id: I05597eb54b2988f7bc203b53427e17980a7473f9
CRs-Fixed: 2559016
Initialize channel_map to "us" at regulatory init.
Use NUM_6GHZ_CHANNELS to get 6Ghz channel numbers
instead of MAX_6GHZ_CHANNEL.
Change-Id: Ifed996c1a528c8a3c0a29d3959f17dff6d298193
CRs-Fixed: 2949971
Add a check to drop unicast frame being sent to same originating
VAP after hmmc conversion of IGMP control packets
Change-Id: Ic25812a7848af793075a0cb483100ebcf59d85b2
While checking if a channel frequency is 6Ghz PSC frequency within
wlan_reg_is_6ghz_psc_chan_freq, check the remainder of the expression,
instead of quotient.
Change-Id: Ia40d7cd8485f9f8eb90222f9a3454d46e681681b
CRs-Fixed: 2572914
Add logic to queue and bundle packets before
giving it to scheduler to ensure predictive HTC
bundling for improvement in TX throughput.
Change-Id: Iab5066a46235ce7e41fd29c44a2ce0cfb04b1505
CRs-Fixed: 2574530
Add regulatory APIs reg_get_unii_5g_bitmap and ucfg_reg_get_unii_5g_bitmap
to retrieve the value of "unii_5g_bitmap" stored in regulatory pdev
private object.
CRs-Fixed: 2574642
Change-Id: Iffb004b7fc9d9fbcf1972eb6f527529024e49c70
