Currently, there is no check of:
1) Firmware event parameters in dbglog_parse_debug_logs(), which can
result in integer underflow.
2) Number of dbg log args against the total length, which can result in
buffer over-read.
To fix this, compare size of firmware event parameters and number of
dbg log args with total buffer length.
Change-Id: I7fbc684ec9e80cfc66220755a1ad6b9394194735
CRs-Fixed: 2197246
In testbed sta mode the RSNE enc type and auth type may not match the
AP's enc type and auth type and thus the scan filter is unable to match
and find the AP.
Introduce auth and enc type as "ANY" in scan filter. With the auth
and enc type set as ANY, all the AP's matching the BSSID and SSID
will be filtered and the negotiated auth and enc type will be
dependent on AP's auth and enc type.
Change-Id: I82f07f68d9ec6c6f2104122a05d06a698c61a50a
CRs-Fixed: 2197222
With IE length sanity check, that involved by Change-Id I9a091486,
11ax AP cant be found due to the addition of +1 byte in HE-operation
IE in latest spec of 11ax (D2.2).
Remove all 11ax extended capability IE length checks for now due to
11ax being under development.
Change-Id: I45d676325c72c8e0020ca52d094fb1652f8fcaf2
CRs-Fixed: 2197252
There are scenario where indoor channel operations
(like active / passive scan/connect/roam etc)
are not desired / permitted specially in sap case.
Hence add support of disabling indoor channel
on sap start and revert it on sap stop.
Change-Id: Id6e01534532e3076a3e662e6a4f71e8be924165a
CRs-fixed: 2161319
Add vendor wifi test config command attribute to send
addba request with user configuration and to set the
no ack policy.
Change-Id: I2afd62478961a774d16becba49889e855ecf7415
CRs-Fixed: 2196977
1) for raw mode, drop frames with invalid size
2) for non-raw mode, fixed issue that
frag list data_len's not properly calculated
The length issues will introduce kernel issues
during skb_linearize() at upper OS network stack layer.
Symptoms:
1)
WARNING: at net/core/skbuff.c:1782
PC is at skb_copy_bits+0x1b8/0x230
2)
kernel BU at net/core/skbuff.c:1615!
PC is at __pskb_pull_tail+0x70/0x2e4
CRs-fixed: 2188754
Change-Id: I848ec976cd922708ffd02d8272ea5a6f3bce2a00
Fix a memory leak in the cnss layer, where the packet
used to send the disable command never gets freed.
CRs-Fixed: 2185830
Change-Id: I8118baf2397bf6440177d3fe92d34a537c29df8b
In existing code scan queue cleanup is done during radio detach,
leading to access of freed vdev netdev.
Extend cfg80211 scan cleanup API to support netdev level cleanup.
Change-Id: Ice6b6d262788e71c6d229ed7de6ab0e17f270b6c
CRs-Fixed: 2185302
In scm_handle_bcn_probe, scm_add_update_entry is called before
inform_beacon(wlan_cfg80211_inform_bss_frame).
Once scan entry is added to db, there is race condition that other
threads may remove it from db before wlan_cfg80211_inform_bss_frame
is called. Thus freed memory will be accessed in
wlan_cfg80211_inform_bss_frame.
To fix call inform_beacon(wlan_cfg80211_inform_bss_frame) before
adding the entry to scan DB and after updating required fields
from duplicate older entry.
Change-Id: Ib6dd967da9625ce944bffda5037b689ffd70903a
CRs-Fixed: 2197238
1. Populate number of capabilities after extracting service ready ext param
2. Deinit ring during pdev destroy only if ring is configured
3. Do not allocate module param if no capability is shared for
the pdev by target
Change-Id: Ie92b7fc882ba8b7755fea150c724459264a0ea79
CRs-Fixed: 2192671
qdf_spinlock_create(&peer->peer_lock) is called after
wlan_objmgr_psoc_peer_attach and wlan_objmgr_vdev_peer_attach in
wlan_objmgr_peer_obj_create.
In mgmt rx handler, peer is accessed and peer_lock is acquired
before peer_lock initialized in race condition case, spinlock
bad magic issue will happen
Initialize the peer spin lock before peer attaching to avoid the
race condition
Fix same things for vdev and pdev objects
Change-Id: I4cc9d281f8c9efa9de246747641804d985b4653c
CRs-Fixed: 2198193
Fix possible REO descriptor leak while draining REO
command ring by invoking command status handlers with
special error code.
Change-Id: I2fe5f60489b57a4b0a287e67e5610112f7292677
Initializing preferred_hw_mode to WMI_HOST_HW_MODE_MAX and removing
preferred_mode check. This is needed for Napier where preferred_hw_mode
of 0 is a valid configuation which represents single radio mode.
Change-Id: I8998745427427021f219667e03f767c66527d579
CRs-Fixed: 2192227
In order to migrate existing qdf_str_* APIs to qdf_str.h from
qdf_mem.h, qdf_mem.h included qdf_str.h. Now that consumers are
including qdf_str.h directly, remove this include.
Change-Id: I6b0ee3a4a2ad17db922b8e19087c1d730ad9b419
CRs-Fixed: 2196132
Add function for extract_nfcal_power_ev_param and
register wmi_pdev_nfcal_power_all_channels_event_id event
to support noise floor in HK.
Change-Id: I6eef823b507be94c65df026664244eec7fc07e24
CRs-Fixed: 2157972
get_pdev_wmi_handle() can return a NULL pointer in some cases.
Perform a NULL check before using the returned pointer.
target_psoc_get_service_ext_param() can return NULL pointer in
some cases. Perform a NULL check before using the pointer.
The power debug command can take a maximum of WMI_MAX_POWER_DBG_ARGS
arguments. Check for the limit before indexing the array to avoid
illegal access of memory or overflow the array.
Change-Id: I264475e9f86c7a7e78b17b7a1fa025718a7c5af6
CRs-Fixed: 2196063
The qdf_str APIs have recently been moved from qdf_mem. Reference the
new qdf_str.h header file where appropriate.
Change-Id: If97c9c37a7d720a7b93e50ec228da67a8e980c2e
CRs-Fixed: 2196129
The debug print in function send_beacon_tmpl_send_cmd_tlv
is too verbose and doesn't exhibit anything meaningful.
Remove it to make sure meaningful logs will not get
overwritten during SnS tests.
Change-Id: I4564ac83715f0003ad53aa73f0fb859cc5cbec1c
CRs-Fixed: 2197209
CCE disable param set based on return value
which has to be checked for 1, instead of
any return value non zero
Change-Id: Ia48e5d0f50a49944dbf7ca048aab1220d8989beb
CRs-Fixed: 2132295
Return value on dp_peer_add_ast where not correct
resulting in unnecessary flooding of print.
Correct the return values for the AST APIs
Change-Id: I03983995e96314cae91db95fe02edda4564baa46
CRs-Fixed: 2183715
qcacld-2.0 to qcacmn propagation
Adds qdf time api to get time of the day in millisec
Also send host timestamp to firmware, so that firmware can print the
logs timestamp in sync with host via the wmi interface,with
api wmi_send_time_stamp_sync_cmd_tlv()
Change-Id: Id6acfc5227fdca2fbf8d266998fdfc4046adc5f4
CRs-Fixed: 2193978
If a RX packet takes below procedure, there is a double unmap:
replenish -> rx_frag -> reo_reinject -> rx_process
Fix it by mapping it again before reinjection.
CRs-Fixed: 2181134
Change-Id: I69ca74e4aad57c854f301e492fe55012ee7290a3
At some point WLAN_MACADDR_LEN was added to the driver, despite
QDF_MAC_ADDR_SIZE already serving the same purpose. There are cases
where these two macros are implicitly assumed to be the same value.
This is a classic single-source-of-truth violation, and only serves to
confuse developers. Deprecate WLAN_MACADDR_LEN and use
QDF_MAC_ADDR_SIZE instead.
Change-Id: I4e941d5e17d161a5810e693c89b95ae08f83c6b0
CRs-Fixed: 2179728
A recent commit changed the return type for qdf_str_len() to size_t from
int32_t. Update call sites for qdf_str_len() to store the return value
as size_t to match.
Change-Id: Ib8bfad2c1fc7de1f6fc601d1be69e734d3a49dcf
CRs-Fixed: 2196858
Add protection for vdev & peer while traversing during collecting
control frame stats.
Change-Id: I1e8e4e5f6f94b35644e03ddafc03b0d885d27972
CRs-Fixed: 2189230
A set of files for string abstractions has recently been added to QDF.
Move any existing qdf_str_* APIs from qdf_mem to qdf_str.
Change-Id: I6e1e5d1edcdfae2af83a6497ebd872fba981cdec
CRs-Fixed: 2196098
Currently, RSSI in radiotap header is being sourced from
RX_MSDU_START TLV. RSSI information is missing in the TLV.
Source RSSI from PHYRX_RSSI_LEGACY TLV (rssi_comb).
Change-Id: I8030d970ff300a957e5215157e5f6a3599e4b430
CRs-Fixed: 2190210
TLVs in monitor packet buffers might be incomplete during
RXDMA flush, and should not be used to check PPDU IDs against
status ring PPDU IDs. This was causing stall in monitor
destination ring processing.
Change-Id: I99729beb65936477ea42cf5939da2036f36ee303
CRs-Fixed: 2193051
Peer reference is using dbgid WLAN_MGMT_NB_ID for TX and
WLAN_MGMT_SB_ID for RX, correct two functions related with TX with
dbgid WLAN_MGMT_NB_ID.
Change-Id: Icc15c06c00df0fb58c848a134e1b60c6c5e623fd
CRs-Fixed: 2196496
Byte counts reported in HTT Tx PPDU indications is sum of MPDU bytes
(including the 802.11 header).In Rx, we derive byte count from per-MSDU
Rx indications and this does not include 802.11 header bytes.
This is causing mismatch in reporting of Tx and Rx byte counts.
Also PPDU TLV for mcast MPDUs is not giving correct multicast bytes count.
Move the byte count update for Tx also to per-MSDU indications to match
the behavior with Rx
CRs-Fixed: 2182576
Change-Id: I92e779661014b058ba98c830881ff8eded4ea6ff
Add htt tx and rx structs from HTT to cdp_pdev_stats.
These Fw tx and rx stats are obtained through HTT events.
athstats application uses cdp_pdev_stats that contains host stats
and fw stats.
Change-Id: Ia063f406bdc6d32a684c4026b8425ecc96faa3db
CRs-Fixed: 2190793
Rx PPDU length is calculated from number of MSDU length in each MPDU
Rx PPDU stats are populated after updating PPDU length.
Change-Id: I2af6a82eaddc4e791d4e7445c933a5886304e8f3
Radar bandwidth detection at certain frquencies is reported to
be lower than the acceptable threshold. This is due to the low
rssi reported in the phyerrors.
Fix the issue by adjusting the rssi threshold accordingly.
Change-Id: Ia1598342e33b1217a1fb163878b2ac42661b33af
CRs-Fixed: 2184681
Add sanity check for wmi TLV header length before padding/shrinking
elements in a wmi which has a variable length for its TLV structure.
Currently, the TLV length is not checked so its maximum value could
be 65535 which results in a hugh count for elements. Number of elements
is used to terminate the loop for padding/shrinking. If the number
was too large, there would be memory overflow.
Change-Id: Iea0615fc511696c6cc5dcc48a9dfff225256a52b
CRs-Fixed: 2181685
Currently including only cdp_txrx_ipa.h header gives compilation
issue as we need to include ol_txrx.h header to remove dependency.
In this remove dependency by including proper common header file
in cdp_txrx_ipa.h
Change-Id: Ia207e990f09d284a6dac97fbae8e1bc61fb6cbe1
CRs-Fixed: 2193987
Add command support to not send ADDBA REQs.
The corresponding WMI VDEV param ID to set the
VDEV param has been added.
Change-Id: Id53f8101a61ccc0aba2a9a6735d1c6942ba3592d
CRs-fixed: 2188560
Under low memory conditions skb allocation sleeps
and results in kernel work queue watchdog.
Increase the wmi timeout to check if the system
recovers to allocate the SKB.
Change-Id: Ie4e42fdc71703c687ba2e5a4d995481ea7931c97
CRs-Fixed: 2158198
