CVE-2020-26139
With the CCE changes, EAPOL frames now arrive at
the wbm error ring with the push reason as route.
These frames need to be indicated to the stack.
Any other incoming frame with this reason code
needs to dropped.
Change-Id: I66df0b53a36d99b3e9d9000e0bd93bf7677c221d
Smart monitor mode requires buffers on monitor status ring only.
It does not require any buffers on monitor buffer ring.
As an optimization, initialization of descriptor pool and allocation
of buffers for monitor buffer ring is not required. Also filter
settings for monitor buffer ring are not required in smart monitor
mode.
Change-Id: If328b08184865e5472425b5520dd0a364a478c40
CRs-Fixed: 2965717
If number of entries available in tx comp ring are more
than quota then process number of entries as per quota
Change-Id: I6345cb6f7cee62c343d152f42beb15460ce02ef1
Currently, no NULL check is made for the value of dp_pev.
Adding a NULL check to avoid NULL dereference.
Change-Id: I2712b7e2fd53ba3a346878e73d2eedac161c5935
CRs-Fixed: 2955365
Currently dp_rx_err_process expects ring descriptor to be only
LINK_DESC_TYPE. In certain cases BUF_ADDR_TYPE ring descriptor is
observed in reo_exception ring. Add logic to handle the same.
Change-Id: I5baecc3f8eafc0830672b91bc9d9607b568a6cda
CRs-Fixed: 2954653
In case of aging out wds entries, avoid sending all
the wds delete wmi commands in a huge single burst.
Instead limit the maximum commands to half of the
wmi queue size. Inactivity will continue to be
marked every 120 secs but the inactive entries
will be flushed every 5 secs if there are pending
entries.
Change-Id: I6735704a0750ef466f1df798f0b354f4382098d6
CRs-Fixed: 2952682
Revert "qcacmn: drop duplicated EAP frames from REO exception path",
allow all EAP frame delivering to stack including retried ones.
Change-Id: I73733841c1feb21d5b5fd160856a8fe9c21168fc
CRs-Fixed: 2959701
Currently IPA tx buffers are fixed at 1007 buffers.
Adding INI support to change number of TX buffers at load time.
Change-Id: Ide0357554f34759198276b9699e0e6f4a3e20051
CRs-Fixed: 2957916
Currently there are no sufficient debug logs during
AST cleanup of peers, to conclude in which context
the AST got freed up, hence adding more debug logs.
Change-Id: I5603d856aed8cc3860a78d24d51cd8b5386d38bb
CRs-Fixed: 2956910
Refactor FISA packet history to not access "struct rx_pkt_tlvs". This is
because this structure may be different for Li and BE chips and should
not be accessed directly and only via hal_soc->ops in common code.
CRs-Fixed: 2888556
Change-Id: I0d9f2785a81c130a2dc506020a02ee5581c0bbd3
Implement core DP rx processing to functions in to corresponding
architecture specific be/li rx files. Keep common utility functions
in DP common files.
Change-Id: I40083e10772fd2b6ce2f1fa9e197f2ad92d0522a
CRs-Fixed: 2891021
Move DP TX target specific functionality to dp/wifi3.0/be
and dp/wifi3.0/li folders. DP Functionality common to both lithium and
beryllium targets stays in dp/wifi3.0.
Change-Id: I3497284153e2ea30a9cb1faf05bd41422329b804
CRs-Fixed: 2891038
Add changes in datapath rx monitor mode APIs
to handle modification in HAL APIs for WCN7850.
Change-Id: Iec7fbf9389033dfa86e71b1081e6a64607125ecc
CRs-Fixed: 2888556
Currently, wrong address is given to insert session_id in
meta_data.
To fix this, Passing pointer variable instead of address
to the pointer so that meta_data is filled correctly.
Change-Id: I019d73dc728fb214fd7c06a5027f0507ab4822a1
CRs-Fixed: 2959923
When handling RXDMA error marked frames that from MAC1,
wrong rx descriptor pool is referenced, so allocated
buffer length is incorrect and lead to skb crash. Make
changes to always uses mac0 rx descriptor pool for MCL
platform.
Change-Id: Ica01c3967d6248a23ea745da63149dae9cd56677
CRs-Fixed: 2945573
Optimize refill buffer pool feature code to be
light weight on CPU, so that refill thread will
consume less CPU resources and also replenishing
RX buffers will be done faster.
Change-Id: I849ca60558c6197003d95e7d54fdb5f837cdc217
CRs-Fixed: 2950166
GCMP header and MIC are not removed for received
fragments which will result in incorrect ethertype
and presence of LLC hdr in the data when the frames
are sent to network stack.
Fix is to add support for GCMP in rx de-fragmentation
path.
Change-Id: I83ed29a766e40e32f4b712342ebd40d08a2c65e0
CRs-Fixed: 2941879
Memory allocated for tx_hw_desc_history uses incorrect
size parameter resulting in much lower memory to get
assigned. This will result in OOB access and corruptions
in memory, regions post the trailing boundary when updating
tx hw desc events via dp_tx_hw_desc_update_evt.
Fix is to use the appropriate memory size for tx_hw_desc_history
and add NULL check in dp_tx_hw_desc_update_evt.
Change-Id: I97af7898cf8bf1b24978d559f84a2a3d00227ed8
CRs-Fixed: 2952859
IPA unmapping is skipped for WBM internal error case,
do IPA unmapping for rx buffer received in WBM error case.
While reinjecting RX buffer back to REO, software rx desc
unmapped field is not set in sequence which may lead to
map without unmap error in IPA module. So reset the unmapped
filed after IPA mapping is complete.
Change-Id: I42c1eaa1620f975d47ce2938c95b6b89dbbd3eca
CRs-Fixed: 2952671
While Rx buffers are getting umapped from net rx context if IPA
pipes are enabled at same time from MC thread context this is
leading to race condition and IPA map/unmap is going out of sync.
To fix this introducing IPA mapping lock and IPA mapping need to
be handled with lock held.
Change-Id: I9fa71bdb6d4e4aa93fc795cc5dd472a181325991
CRs-Fixed: 2945063
As per current design, in failure path of hdd_wlan_start_modules,
mem_free of hif_ext_group is done (in cds_dp_close) before
free_irq (in hdd_hif_close), during next hdd_wlan_start_modules,
request_irq adds new handler entry to the list in irq_desc, this
leads to a crash on accessing older stale entry from irq handler,
so adding a bus_ops hif_grp_irq_deconfigure to free ext grp IRQs.
Change-Id: I4d0a2bee1fabee388cea8a85226fae641165a8d5
CRs-Fixed: 2949400
There is a timing race condition between RTPM suspend flow and
DP TX flow. When TX is queued during RTPM suspend flow. TX
ring update may be delayed. Add a force TX HP flush when RTPM
is rejected due to TX pending frame. This can help to improve
TX pending frames delay when race condition happens.
Change-Id: I6f60f2902dfda630f81528dcf978da6644d18ba7
CRs-Fixed: 2942744
Use the qdf_assert_always instead of qdf_assert when rx_desc is NULL
getting by dp_rx_cookie_2_va_mon_status to capture real problem here
since the qdf_assert does not do anything.
Change-Id: I480917ecaf30f9faa4fdcda93c09a59e972a7e1c
CRs-Fixed: 2944083
HTC buffer is freed in enqueue failure case. Then it is requeued to
htt_htc_pkt_misclist also. In deinit flow, misclist entry should be
cleared, so buffer double free is hit in this stage. Make a change
to not requeue this frame to misclist.
Change-Id: I0211c4b548d7df7176ee72a83e21f8fcf7fa464c
CRs-Fixed: 2942972
CVE-2020-26145
Broadcast and multicast frames should never be fragmented. Several devices
process broadcasted fragments as normal unfragmented frames. Moreover, some
devices accept plaintext fragmented broadcast or multicast frames in
protected Wi-Fi networks. An adversary can abuse this to inject packets
by encapsulating them in a fragmented plaintext broadcast frame. Even
unicast packets can be encapsulated in broadcast Wi-Fi frames and hence
be injected.
Change-Id: I3181a05e177cf9374a14edb748bc5001d058e0f3
CRs-Fixed: 2893212
Drop non-EAPOL frames from unauthorized peer in security mode.
Enabling this feature by default with this change.
Change-Id: I9878b37088149e34f456a38a9c0f722e4c5ee49a
CRs-Fixed: 2943789
Provide multiple combinations to configure the msi interrupts
of DP and CE based on the number of MSIs available in the platform.
Number of MSIs used for CE and DP can be changed by modifying the
MSI assignment table in platform driver. Best possible mask for that
MSI is automatically chosen based on predetermined settings.
Change-Id: I02b44fb033631d69d97f2d8d2d3f698541d37aad
In some RX backpressure cases, we see the HW accessing REO
queue descriptors of a deleted peer(after the queue descriptors
are unmapped/freed), this is leading to SMMU faults. There are
cases where the HW is accessing the stale REO queue descriptors
after ~12seconds after the queue descriptors were freed.
In order to avoid the problem, HW team has suggested to defer
unmapping/free of REO Queue descriptors. Add the logic for the
same.
Change-Id: I5b1fb966dc75b963ccc9d22c40272c8d1d8d6026
CRs-Fixed: 2939223
It's regression of change: qcacmn: Fix smmu fault for tx buffer unmapped.
Only 1 tx buffer is smmu mapped for IPA with it.
During STA-SAP tethering, when IPA access 2nd tx buffer, smmu fault
happens.
Remove qdf_assert_always since it already exists in
__dp_ipa_handle_buf_smmu_mapping.
Change-Id: Ife8ed17d85a8bcfc507c312001af4b905c9b3a27
CRs-Fixed: 2937435
Modify check to ensure packet number is consecutive for
fragments and drop the fragments if the check fails.
Change-Id: I2ca0ef6211594ba35aae894e6a385d3d5778bff6
CRs-Fixed: 2874369
