Replace QDF_BUG(0) with call cds_trigger_recovery() in
wma_remove_peer(), as it is a possible scenario for NDI
since the NDI vdev is managed by FW.
Change-Id: Ief8a37c732a1feebe3a78f2f03da791712398d43
CRs-Fixed: 2346252
It doesn't update wma_handle->num_dbs_hw_modes after event
WMI_SERVICE_READY_EXT_EVENTID comes and re-allocate hw_mode_list,
which will cause potentially OOB read hw_mode_list.
Change-Id: I8e4aa13120bfe185fba3e0000cf289406b6bcfce
CRs-Fixed: 2336889
The primary data structure used within the protocol stack is currently
named sAniSirGlobal. This naming is problematic for two reasons.
First, the "Ani" and "Sir" are archaic references that should be
replaced throughout the driver. Second, camelCase is frowned upon by
the Linux coding style. In order to address these issues, rename
sAniSirGlobal to mac_context.
Change-Id: Ibaaeb5296e42a24c66d4adf4f720d32a9ae41888
CRs-Fixed: 2345128
This fixes below build error.
format '%lu' expects argument of type 'long unsigned int',
but argument 6 has type 'unsigned int' [-Werror=format=]
Change-Id: I54b2e171ab5c7799af3e23a5d1fd8d4cb3034983
CRs-Fixed: 2344741
Add the following HT Caps related INI/CFG items to MLME component.
gShortPreamble, CFG_HT_AMPDU_PARAMS, CFG_EXT_HT_CAP_INFO,
CFG_HT_INFO_FIELD, gEnableAMPDUPS and gMaxAmsduNum.
Change-Id: I019961016a2f0e39c7c62066c04788d3bd3d37e7
CRs-Fixed: 2318579
In function wma_send_bcn_buf_ll, bcn info is filled from
wma handle by mapping the vdev id. For valid vdev id also wma_handle
could have NULL beacon info. So, check for NULL pointer before
accessing the bcn pointer.
Change-Id: I660c8231801eb28962edc364a139e7980febb71e
CRs-Fixed: 2336946
When SSR is in progress, when trying to remove self peer, if
wma_remove_peer() is failed then wma_vdev_detach() doesn't send del sta
response and wma_self_peer_remove() can still proceed to start vdev
hold request timer. This can lead to skip of vdev reference count
release by wma acquired during vdev attach.
To address this, release vdev reference count when self peer remove is
failed and when del self sta request is timed-out.
Change-Id: I2703261a848983b10798cb8ec74d1cec5a393ce5
CRs-Fixed: 2342453
Currently Napier FW WAPI TX/RX initial PN logic is fit for WIN
host, modify MCL host to align with WIN so that WAPI can work.
Change-Id: I0b49a25e75d1e9c4856daf8648d6561486005ba9
CRs-Fixed: 2323152
In error cases of set hw mode, set dual config etc are not handled
in all scenarios and thus the active cmd is not removed in this case
resulting in active cmd timeout.
Fix this by handling and sending failure resp for all the error
scenarios.
Change-Id: I21151798f58bf9816458430d96c7fd1d5f0ee07f
CRs-Fixed: 2341816
Some target which support sending mgmt frame based on htt would DMA
write this PMF tx frame buffer, it may cause smmu check permission
fault, set a flag to do special DMA map.
Change-Id: I3686be211374d2c316726fa3248dedce87c3faed
CRs-Fixed: 2332329
Remove legacy cfg items definitions and related macros for the
converged CFG items.
Change-Id: I12944f50d68dafe989417dda777f29a6233c97a4
CRs-Fixed: 2340856
In wma_vdev_resp_timer(), while handling WMA_DELETE_BSS_REQ if
wma_crash_on_fw_timeout() is true, SSR is triggered, but timer
event_timeout isn't destroyed, wma_target_req, and user_data
isn't freed, result in timer and mem leak.
Change-Id: Ic47af43de671d195c6addd0360b96305af15d9bf
CRs-Fixed: 2337211
Currently if ADD_BSS_REQ vdev_start request times out, the
wma_vdev_resp_timer notifies this as ADD_BSS_RSP with failure status
to the upper layer and the SAP FSM moves from STARTING to DISCONNECTED
state. After this the WMA_DEL_STA_SELF_REQ is sent to the FW which does
a VDEV delete. However in cases where the ADD_BSS_REQ has been sent to the
FW but the response has not been received, the FW has the VDEV in started
state and asserts if a VDEV delete is sent without sending a vdev stop.
Send VDEV stop to the FW in case of ADD_BSS_REQ times our in
wma_vdev_resp_timer.
Change-Id: Ib2b95d38cb7fd36b02a738a73dbc1f8102d2169e
CRs-Fixed: 2323293
Wireless application needs to tune parameters per AC based.
Such as VI/VO queue use the different re-transmission attempts
while other queue keeps the default value. It helps to improve
the video/audio performance in noisy environment. this change
add the ability to config re-transmission attempts of non
aggregation QOS packets.
Change-Id: I95404302463275803e3feff3038f04c900b14705
CRs-Fixed: 2323555
Update NSS command is remove once driver receive the tx completion
event for the beacon. If SAP is in CAC wait state driver will not
get the tx completion for the beacon and the update NSS will timeout
after 30 sec and the serialization cmds queues will get stuck.
To avoid this remove the update NSS command from active queue as
soon as beacon is sent to firmware
Change-Id: I6f5b6bce91bdfacd4621020f313be25f74696b9d
CRs-Fixed: 2332302
To keep names of PMO ucfg APIs consistent, change some of them from
"pmo_ucfg_xxx" to "ucfg_pmo_xxx".
Change-Id: I77165be8c5c408c3f91f84a477c15be1c6ea15e8
CRs-Fixed: 2334109
Make the following updates to the extscan stop scan logic:
1) Exclusively use the Unified WMI data structures.
2) Update the HDD<=>SME interface to enforce the contract that SME
must not make any assumptions about the buffers provided by HDD.
Change-Id: Ie4a693b4a91d728a075cffad3ee368b22d9c5b2a
CRs-Fixed: 2335647
Make the following updates to the extscan start scan logic:
1) Exclusively use the Unified WMI data structures.
2) Update the HDD<=>SME interface to enforce the contract that SME
must not make any assumptions about the buffers provided by HDD.
3) Address a multitude of checkpatch issues
Change-Id: I68dc988fafb7e14b2b80d1007adf614ddff284e2
CRs-Fixed: 2335045
LFR2 uses ft reassoc, whose process is different from general
connect.
1.ft reassoc, normal reassoc and assoc, all of 3 need deliver
event WLAN_VDEV_SM_EV_START to SM, but need different handler.
2.ft reassoc send vdev start when add bss, not switch channel.
Change-Id: Ieefbcf0a28867be3c8a86d9a912143857c54fe06
CRs-Fixed: 2334194
In wma_self_peer_remove, sta_self_wmi_rsp is allocated and sent as
params to wma_fill_hold_req for WMA_DELETE_STA_REQ. However, if
wma_fill_hold_req fails and returns NULL, the memory allocated for
sta_self_wmi_rsp is not freed leading to memory leak.
Free sta_self_wmi_rsp in the error handling case for wma_fill_hold_req
in wma_self_peer_remove.
Change-Id: I8df840b39284e00a8c8be114c0fec13c3c199fc6
CRs-Fixed: 2334580
Make the following updates to the passpoint set/reset logic:
1) Exclusively use the Unified WMI data structures.
2) Refactor the vendor command processing to improve code
maintainability.
Change-Id: I39945b2cec90c3f34c81e5ca525842f1af9340f7
CRs-Fixed: 2334234
Protocol stack supposed to be HLOS-agnostic, but there is some use of
Linux fixed-width types u8, u16, and u32. These should be replaced with
C99 fixed-width types uint8_t, uint16_t, and uint32_t so that they will
correctly be HLOS-agnostic and work on non-Linux targets.
CRs-Fixed: 2326407
Change-Id: I8f9099a0170e4f94a54cdd6cc6c2e321a29af717
Featurize MCL only WMI APIs by compiling them as a separate source.
It enables profiles/configs to selectively compile the WMI APIs
based on whether the feature is required or not.
Featurize WMI APIs and TLVs that are specific to MCL -
- DSRC
- NAN
- P2P
- PMO
- roaming
- concurrency
- STA
- Generic MCL specific WMI (STA)
Change-Id: I3b005b8f60491c7d27cf221b7505116e1b9c1a38
CRs-Fixed: 2333916
During hdd wlan reinit VDEV delete command is not sent to firmware
since cds_driver_recovery is True and it is set to False at later stage.
To fix this, remove recovery check in wma_vdev_detach to send WMI command
to FW as WMI is active during reinit phase.
Change-Id: I94b7437edbf0c5bccbc469ce01940b14b46258fb
CRs-Fixed: 2333475
Make the following updates to the extscan set epno logic:
1) Exclusively use the Unified WMI data structures.
2) Refactor the vendor command processing to improve code
maintainability.
Change-Id: I8179fd9b9acced01956232f113d656e0137231b5
CRs-Fixed: 2333537
While handling the WMI_HOST_SWBA_EVENTID WMI FW event, driver invokes
corresponding wma handler wma_beacon_swba_handler. The event argument
comes directly from the FW. Towards the end of the function,
wma_beacon_swba_handler invokes wma_send_bcn_buf_ll and passes the
original TLV structure, param_buf, as an argument. wma_send_bcn_buf_ll
pull tim_info and p2p_noa_info from the param_buf structure. These
structures can be optionally defined in the message with zero length
resulting in them being NULL pointers. Later, throughout the function
they are then deferenced without every checking if they are in fact NULL.
Fix is to make sure in wma_send_bcn_buf_ll, param_buf->tim_info and
param_buf->p2p_noa_info dereferenced only after NULL check.
Change-Id: Ic27b59dd35f74413e9a978627047855e655b9ed1
CRs-Fixed: 2331956
Check if rs_results->total_num_tx_power_levels is allocated, before
checking the OOB in wma_unified_radio_tx_power_level_stats_event_handler
for new fixed_param->total_num_tx_power_levels
Change-Id: I3e3caf295fad568ecc8e294e6224356ea8a84da6
CRs-Fixed: 2333042
When vdev restart response is received for channel switch during
CSA, we set the phy mode in firmware and then send vdev up. But
even if the restart request has failed host sends vdev up. This
is wrong as firmware expects vdev up only after vdev start is
successful.
If vdev restart is rejected don't send vdev up to firmware.
Instead send WMA_SWITCH_CHANNEL_RSP with failure status.
Change-Id: I1f1ba860abeb0d25e90fd9b9977f02153aca81af
CRs-Fixed: 2331485
Below API's logs failure with caller information,
So no need logs at caller.
qdf_mem_malloc_atomic()
qdf_mem_malloc()
wmi_buf_alloc()
qdf_nbuf_alloc()
wmi_unified_cmd_send()
Change-Id: I5d7d49811d71f83ecafccd9f936af323073b32c6
CRs-Fixed: 2327098
PLD FW down uevent is asynchronous which races against all critical
driver transition events like probe, remove, shutdown, reinit and
hence move wmi_stop to wma shutdown notifier callbakk such that its
protected against all critical driver transition events.
Change-Id: I91046efeab8bc13b9f5c37d5a4d02b66c63e35a9
CRs-Fixed: 2330980
Add bound check for new fixed_param->total_num_tx_power_levels
with its old value of rs_results->total_num_tx_power_levels in
wma_unified_radio_tx_power_level_stats_event_handler.
rs_results->tx_time_per_power_level is allocated only once
if it has not been already allocated.This allocation is saved
into the global wma_handle structure.
If multiple invocations of this handler occur then a buffer
overflow can occur in the following scenario:
1. First message is used to allocate rs_results->tx_time_per_power_level
with a small, but valid size.
2. Second message skips allocation of rs_results->tx_time_per_power_level
since it was done with the first message. This message specifies a larger
valid value and causes the qdf_mem_copy() to overflow.
Change-Id: Ib9c7d3bd667e2ffc1408cd7356be35985331e028
CRs-Fixed: 2327688
When interface change timer expires, wma_wmi_service_close() is
called from hdd_iface_change_callback()->hdd_wlan_stop_modules()
->cds_close(). wmi_handle is made null here. At the same time,
if there is a modem reboot, host will receive early
indication from FW. Due to this, icnss driver sent
ICNSS_UEVENT_FW_DOWN event to host and it calls wmi_stop() again
from icnss_call_driver_uevent()->pld_snoc_uevent()->
wlan_hdd_pld_uevent() -> wlan_hdd_set_the_pld_uevent()->
wma_wmi_stop() -> wmi_stop(). As wmi_handle which was marked
null during wlan stop modules, this causes potential NULL
pointer dereference.
Flush iface_idle_work before wma_wmi_stop and add NULL check
before accessing wmi_handle.
Change-Id: I1bfa8ab7329040c0b5ba989c0d7de7bf7228dd35
CRs-Fixed: 2328575
Add sanity check for vdev_id in wma_lost_link_info_handler
against wma_handle->max_bssid.
Change-Id: I1f469b25ac88deb4d5bbaf754c0ea441e6cb04de
CRs-Fixed: 2325718
Make the following updates to the extscan get capabilities logic:
1) Exclusively use the Unified WMI data structures.
2) Update the HDD<=>SME interface to enforce the contract that SME
must not make any assumptions about the buffers provided by HDD.
Change-Id: I9e57c86a3da0924af01d82d626b61c28f7d520bf
CRs-Fixed: 2330211
Remove the QDF_BUG() from sanity check of pdev_id passed with
pdev_hw_mode_trans_ind event from FW.
Change-Id: I91bb697993e129bf3f8ff62900e21f85dbe85efc
CRs-Fixed: 2328603
Make the following updates to the extscan get cached results logic:
1) Exclusively use the Unified WMI data structures.
2) Update the HDD<=>SME interface to enforce the contract that SME
must not make any assumptions about the buffers provided by HDD.
Change-Id: I4144aa4cdb9c6d3ddaae30eedaec3096abf95857
CRs-Fixed: 2329405
pmac->sme.get_chain_rssi_cb is never checked if
WMI_PDEV_DIV_RSSI_ANTID_EVENTID messages is sent anytime
by user.
pmac->sme.get_chain_rssi_cb can not be appropriately
registered and can result in NULL pointer dereference.
Change-Id: I64783a0e2d054b45678f126b42de20470d3264d3
CRs-Fixed: 2324128
Don't account length field size while comparing against max
beacon size.
Current driver starts from (ptr+4 bytes) then tries to copy
512 bytes from that point which creates to copy extra 4 bytes
beyond the array's boundary.
Instead copy only 508 bytes if driver starts copying from
(ptr+ 4bytes).
ptr
^
|
|
+---------------+--------------------------------+
| | |
| Length | Max Beacon payload |
| | |
+---------------+--------------------------------+
|<-- 4 bytes -->|<-------- 508 bytes ----------->|
|<------------- 512 bytes --------------------->|
CRs-Fixed: 2327052
Change-Id: I2646986ec424f7da31107ad01f673588734eaa52
Currently the wmi_roam_synch_frame_event_id is sent from the FW before
the roam_synch event if the size of the beacon/probe, reassoc request
and reassoc response frames exceeds the max WMA message size.
In such scenarios, the FW sends two wmi_roam_synch_frame_event_id events
with the first event containing beacon/probe and reassoc response frames
and the second event with reassoc request frame.
However, driver is dropping the first event with beacon/probe and reassoc
response frame as the reassoc request is not present in that event.
This is expected in the first frame and the driver should handle each
frame independenly in the wma_roam_synch_frame_event_handler.
Remove the check for beacon/probe and reassoc request frame while
handling reassoc response frame in wma_roam_synch_frame_event_handler.
Change-Id: Ic66dd7f93da0de32715cf36be520128d2a1efc8e
CRs-Fixed: 2325217
Create and send user configurable ini for max number of roam preauth
retries and roam preauth no-ack timeout to the firmware.
Change-Id: I66808b33f421f56cd7c007cdde1db19c8e7ca5f9
CRs-Fixed: 2279049
Since refined PMO configures based on converged cfg component, apply
PMO configurations, remove related legacy codes.
Change-Id: I2cdf18c1000d8cc923c80c00bf530b2b0c60563e
CRs-Fixed: 2322185
