summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-12-20Merge android-msm-pixel-4.9-qt-qpr2 into android-msm-pixel-4.9android-r-preview-1_r0.5android-r-preview-1_r0.3android-msm-crosshatch-4.9-r-preview-1android-msm-bonito-4.9-r-preview-1SecurityBot AutoMerger
SBMerger: 284775313 Change-Id: Ib3cf65c3cd343a76a830ec7d77d60bd863ba7a71 Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
2019-12-16qcacld-3.0: Fix logic to drop duplicate deauth/disassoc framesandroid-10.0.0_r0.48android-10.0.0_r0.47Abhishek Singh
In wma_is_pkt_drop_candidate the enum values used to check the frame subtype is not proper and disassoc subtype is compared to SIR_MAC_MGMT_DISASSOC instead of IEEE80211_FC0_SUBTYPE_DISASSOC. Similar enum mismatch is present for deauth frame. Also the frame received time is updated even when the frame was dropped and thus the received time of the frame keeps on increasing. Thus the condition to check if frame is allowed after WMA_MGMT_FRAME_DETECT_DOS_TIMER ms always fails if driver continuously keep on getting the frames. This can lead to dropping of valid deauth/disassoc frames in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames and thus even if peer send valid deauth peer will not get disconnected. Fix this by using proper enum values to map the frame subtype. Also update the rcvd time stamp only when the frame is allowed, as this timestamp should be used to block the duplicate frames for WMA_MGMT_FRAME_DETECT_DOS_TIMER ms. bug: 141690880 Change-Id: I4f480e21369b585d78f240c5f4f062d010d889a8 CRs-Fixed: 2256679 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-12-16qcacld-3.0: setup IPA sys pipes if ipa_wdi_init succeedsVevek Venkatesan
At present, IPA sys pipes setup done before ipa_wdi_init, so chances for IPA uC is not yet up and running. As wdi init succeeds only if uC is up and running, setting up IPA sys pipes after ipa_wdi_init succeeds. bug: 144733838 Change-Id: Iee9783b0238a3bc96a2e73e47ffebf3b44623485 CRs-Fixed: 2573929 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-12-16qcacld-3.0: Prevent wlan suspend if conn in progressgaurank kathpalia
Currently the driver does not check if the state is key exchange in progress and suspends wlan before set-key happens which further results in FW also in wake up state. This would result in delayed EAP exchange, and also in power loss. Scenario:- 1. Turn on STA and try to connect to enterprise network 2. Turn off display. Here the display turn off would trigger APPS suspend while the STA is trying to connect, and authenticate and since there is no check in driver to prevent suspend in set key in progress state, it would result in a FW assert, as the expectation of FW is to allow suspend only after set key has been done. Fix is to prevent WLAN-suspend in case of connection in progress, and allow suspend only in connected and authenticated state. bug: 145103580 Change-Id: Ic173116f7ba424005d938a43c75831a6a4dc874c CRs-Fixed: 2512866 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-12-13qcacld-3.0: Destroy monitor mode vdev during stop adapterSourav Mohapatra
In monitor mode during driver unload VDEV, PDEV and PSOC objects are leaking because stop adapter is not cleaning up monitor mode vdev. Destroy monitor mode vdev object during stop adapter such that VDEV object and its parent PDEV, PSOC objects can be cleaned up properly. bug: 142158571 Change-Id: Ic5778d03226a880981a4b6affbeeee357e007f65 CRs-Fixed: 2576722 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-12-12qcacld-3.0: Fill Channel width for add_sta params from session entryVignesh Viswanathan
Currently the sta_context in add_bss params which is used to send the peer_assoc command to the FW, the ht_enable and vht_enable are set based on the AP's capability from the beacon. However, the channel width is set based on the assoc response frame from the AP. In a scenario where the AP advertises HT and VHT IEs in the beacon but does not send HT and VHT IEs in the assoc response frame, we will end up connecting in VHT/HT mode but with incorrect channel width. Update the sta_context channel width also based on the AP's capability from the beacon so that the connection would happen in the right channel width even if HT/VHT IEs are missing in the assoc response frame. bug: 142350508 bug: 144981147 Change-Id: Idb1907abebf32a34f88e935a30ebb8f1bce1d59c CRs-Fixed: 2324434 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-12-12qcacld-3.0: Reduce the candidate list to 5 in roam cmd for SAE authAbhinav Kumar
Current driver configuration is as follow: 1. SME active roam command queue timeout is 30 seconds 2. SAE auth timeout is 5 seconds 3. Max BSS count in roam command (CSR_MAX_BSSID_COUNT) for SAE authentication is 8 As SAE auth timeout is 5 seconds and SME active command queue timeout are 30 seconds, so only 6 SAE auth timeouts (30/5 = 6) are enough to trigger SME active command queue timeout for roam command. In case of continuous SAE auth time out, Driver will try SAE connection till 8th candidate. So when driver tries to process SAE connection for 7th BSSID, device leads to crash as by this time SAE roam command(connect command) gets removed from SME active roam command queue. Fix is to reduce the candidate list to 5 in roam command for SAE authentication considering SME roam command queue timeout is of 30 seconds. Change-Id: Ic43f44ef14ea4c3b972635682941a624cdc6dcc7 CRs-Fixed: 2551462 bug: 143129445 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-12-06qcacld-3.0: Avoid queuing multiple WM status change cmd for same peerYeshwanth Sriram Guntuka
In SAP mode, one peer sends multiple deauth frames which results in queuing multiple WM status change cmd which is added at head of queue. WM status change cmd is added at head of queue for other peers which results in delay in processing the cmd for first peer. The WM status cmd is processed and peer is deleted and connection is initiated by the same peer. The remaining WM status change cmd is now processed and del_sta is triggered. On receiving del_sta response, cleanup_trigger in sta_ds is checked and eWNI_SME_DISASSOC_RSP message is posted to SME instead of eWNI_SME_DISCONNECT_DONE_IND since the sta_ds entry is added newly. This will result in active command timeout since WM status change cmd is not removed from active queue. Fix is to drop deauth or disassoc frame after the first one is processed and use normal priority to queue WM status change cmd. bug: 141690880 Change-Id: Ib87fa7496d4adb6e25c30de657ce62101ca6f263 CRs-Fixed: 2291442 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-11-25qcacld-3.0: Use variable size structure to store channel in scan reqgaurank kathpalia
Currently the array of scan channel list is of size SIR_ESE_MAX_MEAS_IE_REQS, but the memory is allocated dynamically for the channge which can be greater than SIR_ESE_MAX_MEAS_IE_REQS. So use dynamic array for this as memory is allocated for this every time. bug: 139058079 Change-Id: I3c854b339c49d9f628033aa6742d57568ec14954 CRs-Fixed: 2560184 Signed-off-by: Isaac Chiou <isaacchiou@google.com>
2019-11-22Merge android-msm-pixel-4.9-qt-qpr2 into android-msm-pixel-4.9SecurityBot AutoMerger
SBMerger: 279089054 Change-Id: I614beadbc81f6ef0a6ecff39deacc02be07d930c Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
2019-11-22Merge android-msm-pixel-4.9-qt-qpr1 into android-msm-pixel-4.9-qt-qpr2SecurityBot AutoMerger
SBMerger: 279089054 Change-Id: Ia843d30b7fd916f4f690386689be0e451864b090 Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
2019-11-21qcacld-3.0: Validate number of requested EIDs in beacon requestandroid-10.0.0_r0.40android-10.0.0_r0.38android-10.0.0_r0.34android-10.0.0_r0.33android-msm-crosshatch-4.9-android10-qpr1android-msm-bonito-4.9-android10-qpr1Pragaspathi Thilagaraj
If the requested info field in beacon report request is present, the driver tries to allocate memory for the target beacon report EIDs from the number of requested EIDs received from the frame. Since the number of requested EIDs is directly controlled by the frame sent by AP, validate this value before using it to allocate memory. Bug: 144843138 Change-Id: Icbac3e952de0d7ae3144e9b319f2c51ccdf93ac5 CRs-Fixed: 2571480 Signed-off-by: Sunil Ravi <sunilravi@google.com>
2019-11-15qcacld-3.0: Avoid Integer underflow in hdd_dns_make_name_querySourav Mohapatra
In the function hdd_dns_make_name_query, the driver is performing a validation check that includes the use of length of the received string as an array index. As the length and string both are user controlled, the user can send the length as zero. As the policy states that the given attribute is NLA_BINARY, so there would be no validation check that can ensure the correct input. Therefore in the case of a malformed packet with null length string, it can cause a possible integer underflow. To avoid this vulnerability change the attribute type from NLA_BINARY to NLA_NUL_STRING. This will cause all the checks to be performed at validate_nla. Change-Id: I0bb569b71a88a07745d364dad23cf1210af4212e CRs-Fixed: 2409913 Bug: 141099048 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com> (cherry picked from commit 395c752bcb965db80a8d6b296f31150b05c99670)
2019-10-01qcacld-3.0: Avoid Integer underflow in hdd_dns_make_name_querySourav Mohapatra
In the function hdd_dns_make_name_query, the driver is performing a validation check that includes the use of length of the received string as an array index. As the length and string both are user controlled, the user can send the length as zero. As the policy states that the given attribute is NLA_BINARY, so there would be no validation check that can ensure the correct input. Therefore in the case of a malformed packet with null length string, it can cause a possible integer underflow. To avoid this vulnerability change the attribute type from NLA_BINARY to NLA_NUL_STRING. This will cause all the checks to be performed at validate_nla. Change-Id: I0bb569b71a88a07745d364dad23cf1210af4212e CRs-Fixed: 2409913 Bug: 141099048 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-09-26Merge android-msm-pixel-4.9-qt-qpr1 into android-msm-pixel-4.9Petri Gynther
Change-Id: I6d6ffde3b6fd2f4d5487e17fa6095a747b1df57a Signed-off-by: Petri Gynther <pgynther@google.com>
2019-09-12qcacld-3.0: Mark SRD channels as passiveandroid-10.0.0_r0.28android-10.0.0_r0.26Vinay Gannevaram
Currently the driver does not mark the SRD channels as passive which leads to hostapd starting P2P-GO on a SRD channel, but since driver does not allow the same, P2P-GO fails. Fix is to inform the wiphy about the SRD channels by making them as passive so that the hostpad does not give the command to start the P2P-GO on the particular SRD channel. Change-Id: I5eaa457b8819d7a22d2e592d1b79fff15b364f40 CRs-Fixed: 2491045 Bug: 138939517 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-09-09qcacld-3.0: Mark SRD channels as passiveVinay Gannevaram
Currently the driver does not mark the SRD channels as passive which leads to hostapd starting P2P-GO on a SRD channel, but since driver does not allow the same, P2P-GO fails. Fix is to inform the wiphy about the SRD channels by making them as passive so that the hostpad does not give the command to start the P2P-GO on the particular SRD channel. Change-Id: I5eaa457b8819d7a22d2e592d1b79fff15b364f40 CRs-Fixed: 2491045 Bug: 138939517 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-09-05qcacld-3.0: Avoid buffer overflow in wma_process_bipJianmin Zhu
If 11w is enabled, mmie should be included in broadcast multicast rmf, length check need consider it to avoid buffer overflow CRs-Fixed: 2270117 Bug: 139890137 Change-Id: I6c2ebe18fb5b6e4246ba6d28c1dbc55175279e30 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-09-05qcacld-3.0: Possible integer overflow in hdd apf read memory cbAshish Kumar Dhanotiya
In hdd_apf_read_memory_cb, context buffer length is checked against sum of packet offset and event length, packet offset and event length are extracted from FW response and can lead to integer overflow, which will allow to pass the length check and eventually will lead to buffer overwrite when event data is copied to context buffer. To avoid this issue, validate the event length against the available length in the context buffer, which can be obtained by getting difference of packet offset from the context buffer length. Change-Id: I53798e56403f1c550f0a762645ccd67a1dc8500d CRs-Fixed: 2436502 Bug: 139886621 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-09-05qcacld-3.0: Add check for num_peers in wma_ibss_peer_info_event_handlergaurank kathpalia
in wma_ibss_peer_info_event_handler, the driver has a upper bound check on num_peers and not a lower bound check. the num_peers should be a positive value. Since there is no check to see if num_peers is set to 0, this check can underflow and result in multiple OOB writes once the loop has incremented more than 32 times. Fix is to check whether num_peers is a positive value, and return if not found true. Change-Id: I599151cc6720ed931142ad6a519add6957fea467 CRs-Fixed: 2324139 Bug: 139886106 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-09-05qcacld-3.0: Fix out-of-bounds access in lim_process_assoc_req_frameAbhinav Kumar
Currently the function lim_process_assoc_req_frame uses frame_len without validation to parse the IE buffer which could lead to out-of-bounds memory access if the frame_len is less than or equal to LIM_ASSOC_REQ_IE_OFFSET(4). Add check to validate the frame_len with LIM_ASSOC_REQ_IE_OFFSET before sending frame_len - LIM_ASSOC_REQ_IE_OFFSET to cfg_get_vendor_ie_ptr_from_oui to parse the only IE buffer. Change-Id: Iaa9e8db4a2605169c9ad3904878a2e626eb6de8b CRs-Fixed: 2259707 Bug: 139883000 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-09-05qcacld-3.0: Check for following radio link stats eventsManikandan Mohan
When first WMI_RADIO_LINK_STATS_EVENTID is received radio stats buffer is allocated based on num_radio param. There is an option for pending following events. So update wma_unified_link_radio_stats_event_handler to check if following events are valid wrt num_radio values to avoid buffer overwrites. Change-Id: If4675bada5492c3bae98c655b45cac6dc76b6431 CRs-Fixed: 2309399 Bug: 139882999 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-09-05qcacld-3.0: Skip IE which has length less than the minimum valid IE lengthVinay Gannevaram
QBSS IE uses min length of 4 bytes for version 1 and min length of 5 bytes for version 2. Min length used for IE is 5 bytes in driver which can cause WPA IE parse failure if QBSS IE is 4 bytes resulting in failure in fetching scan results due to security mismatch and subsequently connection failure. Fix is to skip the IE which has length less than the minimum valid length. Regression cause is I8e42fb7e9674845d152d2ec26a592e02a1b562ab. Change-Id: I00fbffad221e2d9ecedcb87c9607ac8abd7c55b1 CRs-Fixed: 2364663 Bug: 138641772 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-09-04qcacld-3.0: Set the minsize of SuppChannels IE to 2Vinay Gannevaram
qcacld-2.0 to qcacld-3.0 propagation. Some stations send association request with zero length of SuppChannels IE then currently dot11f decodes it to an invalid value. To fix this, set the minsize of SuppChannels IE to 2. Change-Id: If44807d2f2b8a62e5a137ca3d17af2e2654f72f2 CRs-Fixed: 2303702 Bug: 138641772 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-09-03qcacld-3.0: Enable ch 144 for world reg rulesVinay Gannevaram
Currently ch 144 is disabled by default for world reg rules. Enable channel 144 by default for world reg rules. Change-Id: Id6e8f7db21380e052a1fe6ebff3db95437c7f1a8 CRs-Fixed: 2509880 Bug: 138389722 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-08-30qcacld-3.0: Enable ch 144 for world reg rulesVinay Gannevaram
Currently ch 144 is disabled by default for world reg rules. Enable channel 144 by default for world reg rules. Change-Id: Id6e8f7db21380e052a1fe6ebff3db95437c7f1a8 CRs-Fixed: 2509880 Bug: 138389722 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-08-29Merge android-msm-pixel-4.9-qt-qpr1 into android-msm-pixel-4.9Petri Gynther
Change-Id: I3cda47d6d90c9658a6fe36998e72764c5403ac24 Signed-off-by: Petri Gynther <pgynther@google.com>
2019-08-23qcacld-3.0: Take a wakelock till CSA completeRajeev Kumar
Currently the driver sends the CSA IEs in the beacon every beacon interval, and updates the CSA IE count in every beacon. If the wlan gets suspended in between the updation of CSA IEs, the CSA is delayed till the next resume, which could lead to STA kickout event, if there is delay between the CSA period, and the channel switch time. Fix is to take a wakelock till CSA is completed in order to avoid the STA kickout. Bug: 138612266 Change-Id: Iff03476433c755cbddc7568ffbd24ddb81fd1c90 CRs-Fixed: 2504039 Signed-off-by: Rajeev Kumar <quic_rajekuma@quicinc.com>
2019-08-15Merge android-msm-pixel-4.9-qt-qpr1 into android-msm-pixel-4.9Petri Gynther
Change-Id: I6be4d210c011bf532a9fdd3ef6839acb117adcb8 Signed-off-by: Petri Gynther <pgynther@google.com>
2019-08-15Merge android-msm-pixel-4.9-qt into android-msm-pixel-4.9-qt-qpr1Petri Gynther
Change-Id: Ied6e4b8f2a2c9cc2fefb989bffb83816b6694212 Signed-off-by: Petri Gynther <pgynther@google.com>
2019-08-07qcacld-3.0: Remove all calls to cdp_remove_peers_for_vdevVinay Gannevaram
Remove all calls to cdp_remove_peers_for_vdev(). cdp_remove_peers_for_vdev() is called from vdev_resp_handler to remove all vdev peers. All the peers associated with the vdev are deleted before vdev stop and hence this call to cdp_remove_peers_for_vdev() is redundant. Delete only the self peer and remove the code to delete the vdev peers. Change-Id: I8a91509917a371b860058a66831d8417b3a78671 CRs-Fixed: 2002372 Bug: 135964915 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-08-06qcacld-3.0: Remove safe channel check in validate channel switchBala Venkatesh
Currently, channel switch validated as true only in case of safe channel. For unsafe channel, channel switch will be failed. Change-Id: Ic1d11525c8ad5d93ffb31e5802083e73956704c0 CRs-Fixed: 2494488 Bug: 135760299 Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2019-08-06WiFi: Disable the configuration for BUILD_TAGPetri Gynther
BUILD_TAG is enabled by default. This causes the following git error to be seen during Pixel 3/3a WiFi module build: fatal: ambiguous argument '~..HEAD': unknown revision or path not in the working tree. Use '--' to separate paths from revisions, like this: 'git <command> [<revision>...] -- [<file>...]' Disable BUILD_TAG for Pixel 3/3a WiFi, just like has been done for C2F2 WiFi. Hand-ported from commit b6328e584e25 ("Wifi: Disable the configuration for BUILD_TAG") Test: Build Pixel 3/3a WiFi module without errors Change-Id: Iff3c7eb4ca4adf3b83a99af79b0ee9c8034d159c Signed-off-by: Petri Gynther <pgynther@google.com>
2019-07-04qcacld-3.0: Fix possible OOB in wma_unified_radio_tx_mem_free()android-q-preview-6_r0.6android-q-preview-6_r0.4android-10.0.0_r0.4android-10.0.0_r0.3android-10.0.0_r0.20android-10.0.0_r0.19android-10.0.0_r0.12android-10.0.0_r0.10android-msm-crosshatch-4.9-q-preview-6android-msm-crosshatch-4.9-android10-releaseandroid-msm-bonito-4.9-q-preview-6android-msm-bonito-4.9-android10-releaseArif Hussain
In wma_unified_radio_tx_mem_free() function, results buffer array may be dereferenced with large index value, that may result OOB memory access. Fix the same by correcting incrementing pointer to results buffer. Change-Id: I57a26dba9db32758c7d7fd51b99d3364a8020a9d CRs-Fixed: 2308644 Bug: 136197213 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-07-03qcacld-3.0: Fix possible OOB in wma_unified_radio_tx_mem_free()Arif Hussain
In wma_unified_radio_tx_mem_free() function, results buffer array may be dereferenced with large index value, that may result OOB memory access. Fix the same by correcting incrementing pointer to results buffer. Change-Id: I57a26dba9db32758c7d7fd51b99d3364a8020a9d CRs-Fixed: 2308644 Bug: 136197213 Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
2019-06-17qcacld-3.0: Modify default world rule to exclude channel 13Amar Singhal
Channel 13 can cause regulatory violation when enabled in world mode in OFDM mode. Therefore disable channel 13 in world mode. Bug: 134633080 Test: Check support channel list by "iw list" and "iw reg get" in world mode Change-Id: I1fb0531bc23726de448498a90e4508f0714e33a2 CRs-Fixed: 112274312 Signed-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>
2019-06-13qcacld-3.0: Add new vendor OUI in default INI to connect in 1x1Rajeev Kumar
The 3rd party AP with Vendor IE OUI 001018, Vendor Data 02 FF 00 9C 00 00 and NSS 4x4 is not able to handle OMN/SMPS frames sent by DUT in 2.4Ghz. This leads to the AP dropping the data rates to 1Mbps and low throughput is seen. This is because the connection is done with NSS 2x2 and when Coex scenarios occur, the DUT switches dynamically to 1x1 by sending OMN/SMPS frames. To overcome this issue, the workaround is to blacklist the above AP and do connection in 1x1 only. Add the vendor OUI of the 3rd party AP to gActionOUIConnect1x1 default INI string to connect in 1x1. Change-Id: Idc0f3238e3521bb20c592b44de77216125e69504 CRs-Fixed: 2352946 Bug: 133798139 Signed-off-by: Rajeev Kumar <quic_rajekuma@quicinc.com>
2019-06-03qcacld-3.0: Add check for wlan_suspended in __hdd_tx_timeoutRakshith Suresh Patkar
When scheduler thread is suspended, it will not process any messages until it is resumed. If messages are posted to scheduler thread when it is suspended, it will lead to KP due to scheduler buffer becoming full. Add check for hdd_ctx->hdd_wlan_suspended in __hdd_tx_timeout before posting any message to scheduler. Change-Id: Ic0bc6ec0dda23e2a6eaf59adb21f0bca5f2707df Bug: 133292713 CRs-Fixed: 2428339
2019-06-03Merge android-msm-pixel-4.9-qt into android-msm-pixel-4.9Petri Gynther
Change-Id: I4d3783cff4547c4fb9ff46b401ba592b2da043b9 Signed-off-by: Petri Gynther <pgynther@google.com>
2019-05-31qcacld-3.0: Add check for wlan_suspended in __hdd_tx_timeoutRakshith Suresh Patkar
When scheduler thread is suspended, it will not process any messages until it is resumed. If messages are posted to scheduler thread when it is suspended, it will lead to KP due to scheduler buffer becoming full. Add check for hdd_ctx->hdd_wlan_suspended in __hdd_tx_timeout before posting any message to scheduler. Change-Id: Ic0bc6ec0dda23e2a6eaf59adb21f0bca5f2707df Bug: 133292713 CRs-Fixed: 2428339
2019-05-29Merge "qcacld-3.0: Return proper error on request id mapping failure" into ↵Kumar Anand
android-msm-pixel-4.9
2019-05-29Merge "qcacld-3.0: Return proper error on request id mapping failure" into ↵Kumar Anand
android-msm-pixel-4.9-qt
2019-05-25Merge "qcacld-3.0: Clear oldest cached sta information" into ↵android-q-preview-5_r0.6android-q-preview-5_r0.4android-msm-crosshatch-4.9-q-preview-5android-msm-bonito-4.9-q-preview-5TreeHugger Robot
android-msm-pixel-4.9-qt
2019-05-24qcacld-3.0: Clear oldest cached sta informationAshish Kumar Dhanotiya
Currently host is caching all the connected sta info in case of SAP, once the sta count reaches to MAX, below mentioned issues occurs: 1. Driver can not cache the information of newly connected stations. 2. Some of the info is cached at the time of connection while remaining info is cached during disconnection. In the disconnect path driver tries to cache some of the info such mc_bc count, disconnect reason code, since driver can't cache anymore info, it does not find the current station which is getting disconnected in cache sta info structure leading to an error, and driver is returning an error without completing the wait for disconnect event which is resulting in timeout. Since sta_disconnect comes with rtnl_held, any other process is not able to get the rtnl_lock until this timeout occurs. To address this issue below mentioned two measures taken care: Clear the oldest cached sta information and save the newly connected station's information. In the disconnect path, do not return any error and simply proceed with disconnection as failure to cache the information of sta should not stop the disconnection process. Bug: 132884821 Bug: 133284357 Change-Id: Ia955a6774033fdfa91ff1fa7c8832b3ec7e8e1a0 CRs-Fixed: 2333075 Signed-off-by: hsuvictor <hsuvictor@google.com>
2019-05-24qcacld-3.0: Clear oldest cached sta informationAshish Kumar Dhanotiya
Currently host is caching all the connected sta info in case of SAP, once the sta count reaches to MAX, below mentioned issues occurs: 1. Driver can not cache the information of newly connected stations. 2. Some of the info is cached at the time of connection while remaining info is cached during disconnection. In the disconnect path driver tries to cache some of the info such mc_bc count, disconnect reason code, since driver can't cache anymore info, it does not find the current station which is getting disconnected in cache sta info structure leading to an error, and driver is returning an error without completing the wait for disconnect event which is resulting in timeout. Since sta_disconnect comes with rtnl_held, any other process is not able to get the rtnl_lock until this timeout occurs. To address this issue below mentioned two measures taken care: Clear the oldest cached sta information and save the newly connected station's information. In the disconnect path, do not return any error and simply proceed with disconnection as failure to cache the information of sta should not stop the disconnection process. Bug: 132884821 Bug: 133284357 Change-Id: Ia955a6774033fdfa91ff1fa7c8832b3ec7e8e1a0 CRs-Fixed: 2333075 Signed-off-by: hsuvictor <hsuvictor@google.com>
2019-05-23qcacld-3.0: Return proper error on request id mapping failureRajeev Kumar
When sending keepalive packets if there is failure in mapping request id to pattern id in function - hdd_map_req_id_to_pattern_id(), error code EINVAL is returned. This error code is misleading and not sufficient to inform the userspace that all available buffers are utilized and it should stop sending keepalive packets. Return proper error code if all available buffers are utilized and no buffers are available to address any new request to send keepalive packets. Change-Id: Ie54299a0a7ff43a7044316d641d19ce12ac047c8 CRs-Fixed: 2445981 Bug: 130214647 Signed-off-by: Rajeev Kumar <quic_rajekuma@quicinc.com>
2019-05-21qcacld-3.0: Return proper error on request id mapping failureRajeev Kumar
When sending keepalive packets if there is failure in mapping request id to pattern id in function - hdd_map_req_id_to_pattern_id(), error code EINVAL is returned. This error code is misleading and not sufficient to inform the userspace that all available buffers are utilized and it should stop sending keepalive packets. Return proper error code if all available buffers are utilized and no buffers are available to address any new request to send keepalive packets. Change-Id: Ie54299a0a7ff43a7044316d641d19ce12ac047c8 CRs-Fixed: 2445981 Bug: 130214647 Signed-off-by: Rajeev Kumar <quic_rajekuma@quicinc.com>
2019-05-20Merge changes from topic "p18_pkt_log-qt" into android-msm-pixel-4.9-qtKumar Anand
* changes: qcacld-3.0: Packet stat collection failure qcacld-3.0: Log pkt_stats to logger thread for sw_event wlan: Enable pktlog when verbose log on.
2019-05-20qcacld-3.0: Packet stat collection failureRajeev Kumar
Change made I7fd67b02c3b7cb4f1bfe7c6f4641f6d881e25abd to fix possible NULL dereference of pkt_stats_dump caused pkt stats collection to fail as pkt_stats_dump is NULL from cds_pkt_stats_to_logger_thread. Move NULL check for pkt_stats_dump to just before it is dereferenced Change-Id: I0f4c9d58f0d4d17d6c26bfbbd79f6447dd52230b Bug: 131812584 CRs-Fixed: 2358139 Signed-off-by: Rajeev Kumar <quic_rajekuma@quicinc.com>
2019-05-20qcacld-3.0: Log pkt_stats to logger thread for sw_eventRajeev Kumar
pktlog log types were received as individual log types like PKTLOG_TYPE_TX_CTRL, PKTLOG_TYPE_RC_FIND, etc. As per the current implementation, FW sends an aggregated log type as PKTLOG_TYPE_SW_EVENT. This aggregated log type event is not logged to userspace. Log sw_event pkt_stats to logger thread in process_sw_event. Change-Id: I5b12ecce25af6395a10eb7c7452a7eeb042d7c0a Bug: 131812584 CRs-Fixed: 2396980 Signed-off-by: Rajeev Kumar <quic_rajekuma@quicinc.com>