| Commit message (Collapse) | Author | Age |
| ... | |
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Check for the validity of num_msdus when received the htt message of
HTT_T2H_MSG_TYPE_TX_COMPL_IND or HTT_T2H_MSG_TYPE_TX_INSPECT_IND from
firmware to ensure the buffer overflow does not happen.
Change-Id: Ic6ce75f34c5e2705d174eda014350e6ef0391388
CRs-Fixed: 2146869
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212H
Change-Id: I8b45bd0727af6e5b6d6548dd2603f285a41a6cb3
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
There is no check for the return value of dot11fUnpackIeRSN API
in hdd_ProcessGENIE API, which may cause stack overflow if
pmkid_count is returned as more than the PMKIDCache size.
Add a check for return value of dot11fUnpackIeRSN to avoid possible
stack overflow.
Change-Id: I56424c706de121b18b8d3f2c4a35089ec0434452
CRs-Fixed: 2149187
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212G
Change-Id: I746dadefca84dc489cb65b0eca9cfbb732606ca4
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Add buffer size check in cfg_get_vendor_ie_ptr_from_oui before
comparing the OUI in IE buffer with the given OUI in case of
out of band issue.
Change-Id: I632c18fb1f18a56ee618596982da2acc19890dac
CRs-Fixed: 2150456
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
In some failure path of tlshim_mgmt_rx_process function,
locked spin lock must unlock before exit.
Optimize opClasses check in csrInitOperatingClasses.
Change-Id: I9fc195fac16e3b8ec03e0c87a48658d7748d1c31
CRs-Fixed: 2155647
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Check for buffer overflow for pktlog messages in process_tx_info
function before doing mem copy.
Change-Id: I5d34bfdecb4fd9dad1741da2256873ef3e9e708c
CRs-Fixed: 2154331
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212F
Change-Id: Ifac3c534ad67d054edc20023bc7071975521ea33
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Three paramaters gCCAThresholdEnable, gCCAThreshold2G and
gCCAThreshold5G are added to the INI file. Once threshold
is enabled in INI file, host will set
WMI_PDEV_PARAM_CCA_THRESHOLD(0~7 bit for 2G band,
8~15 bit for 5G band).
Change-Id: Ifc525baa7261ea9bf04cc9ff7e7c3189b07c7a39
CRs-Fixed: 2150640
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212E
Change-Id: I31fcec189c525dbbe55cdb887607f39d52fdf6e8
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
prima to qcacld-2.0 propagation
There can be a possible race in updation of roam substate
between csrRoamWaitForKeyTimeOutHandler and upper layer
disconnect in csrRoamIssueDeauth. Race can be as follows.
Driver roam substate is eCSR_ROAM_SUBSTATE_WAIT_FOR_KEY by
the time csrRoamWaitForKeyTimeOutHandler is invoked. This
can allow check CSR_IS_WAIT_FOR_KEY to pass. If MC thread
gets preempted and if driver processes upper layer disconnect,
then driver changes roam substate to eCSR_ROAM_SUBSTATE_DEAUTH_REQ
in csrRoamIssueDeauth. When MC thread resumes processing of
csrRoamWaitForKeyTimeOutHandler, then driver changes roam
substate to eCSR_ROAM_SUBSTATE_NONE. This can result in
unhandling of eWNI_SME_DEAUTH_RSP as roam substate is not in
eCSR_ROAM_SUBSTATE_DEAUTH_REQ and can result in active command
timeout. Hence, update roam substate atomically in same context
if CSR_IS_WAIT_FOR_KEY passes in csrRoamWaitForKeyTimeOutHandler.
Change-Id: I05cfc8de54fe4196df941c2fd48db8bedc7df779
CRs-Fixed: 2155141
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212D
Change-Id: Iafca22b55a2d9749ccfea439d6ab0b0e865d3a1a
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Compile would be blocked for peer_detach if the macro is
not defined. Add macro judge for peer_detach
Change-Id: I206670bf5afb15ed3095351d4a196165b56fbcf0
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212C
Change-Id: I6bbd5d489ff7003581e11c49beaf029127b9d633
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
To reduce fw event buffer size, some mac counters are changed
to 16bit on FW side. On host side, the same change should be
made on WMI interface. To keep CFG80211 interface unchanged,
counters will be copied to HDD one by one.
Change-Id: Id02565b45d400b520a0620f008703c26575965fe
CRs-Fixed: 2150525
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212B
Change-Id: I514cc605c3beeb18b3d1646dd6ddb5f3bdb0fc41
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
The return value validation is missing for dot11fUnpackIeRSN, thus
"dot11f_ie_rsn.pmkid_count" could be larger than 4. When it is larger
than 4 there will be a buffer over-read in vos_mem_compare. Add status
check of dot11fUnpackIeRSN in lim_process_fils_auth_frame2.
Change-Id: If563ddb13bbfcad5660d136c35c39846010594e1
CRs-Fixed: 2147955
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212A
Change-Id: Ic940b4cda4f484c316ffcbce72441385f5f614db
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
While processing setHostOffload ioctl there is a possibility of
sending invalid data to lower layers as user sent data structure
is different from local buffer structure.
To mitigate this issue, initialize local buffer to zero and then
update local buffer member by member.
Change-Id: I657d2a8c7d37435b1ad28ef6de60ea80a235ead9
CRs-Fixed: 2147130
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.212
Change-Id: Ifd77fcfceebc9064742b97dcb952d9f5586c266b
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Dumping the content of various Fw RAM is causing kernel
ring buffer to overflow and overwrite RAM start addresses
necessary for Fw Crash debugging. Hence removing the hex
dump. Also printing the ramdump base address for PCI hif.
Change-Id: I1af45d1174e5ade5a9e4a7ac537d7f51bb86364e
CRs-Fixed: 2152148
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.211Z
Change-Id: Iba241ee343f096a6fb0e272202fe9a4e3754f630
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Variable 'scn' is not used without compiling macro CONFIG_CNSS.
Change-Id: I7ac053f9ed14219fa79433f9e9cb410af7fcdf52
CRs-Fixed: 2151986
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.211Y
Change-Id: I3b14bc75ea50ce77183f785852781c59404dd38b
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Check for the maximum allowed data that can be written into
the buffer utf_event_info.data in the function
wma_process_utf_event.
Change-Id: I9ee37470b7a3e7016941f871d3cf73eb12718758
CRs-Fixed: 2131653
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Check for the num_peers received from firmware and ensure an
integer overflow does not happen in wma_peer_info_event_handler.
Change-Id: I524cc6bd5b75dd6326562b3a4513048d36677487
CRs-Fixed: 2132257
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.211X
Change-Id: I1bc61f37ca0d9169a6943e4829f62a623a912634
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Pending MSDUs count for each AC is added to link layer stats.
A new vendor attribute QCA_WLAN_VENDOR_ATTR_LL_STATS_WMM_AC_PENDING_MSDU
is added for the pending MSDUs.
Change-Id: I073100b57a9eea428974f8a03c319bae42e2ca6d
CRs-Fixed: 2147748
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.211W
Change-Id: I0121f714d7534d658b7da21e20e5d9268c5b4c9d
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
wmi_event cannot be referenced before it is assigned,
which causes sta crashes in scan. Move the original
commit codes to the place after wmi_event is assigned.
regression commit id:
de7d14350f8a39d54b8f752ee600566d6bfab1c2
Change-Id: I7565f98555b63d2e4e7488792b6f15c495593929
CRs-Fixed: 2151536
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.211V
Change-Id: I096b986cd4756e81d450711cd4223c47264436db
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Check for the validity of the number of channels passed in the
radio stats event received from firmware to ensure an integer
overflow does not happen.
Change-Id: Idf5738a40139aafad4de422965dc4ff3d0e53a32
CRs-Fixed: 2149958
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Release 4.0.11.211U
Change-Id: I7f95b9ae0c6f71c4f8140903ba354a94f925f990
CRs-Fixed: 774533
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Previous CL 3058259 didn't add wmi_oem_dma
command & event. Fix here.
Change wmi_unified.c from CL 3098637 to CL 3756651
Change-Id: I553759d374b81db03a337fccb628131545f84554
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Add num_extra_peers in struct wmi ready event
Change-Id: I8b67a634845ccb4be118e7045a8bbd76ed87b5c7
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_SERVICE_OFFCHAN_DATA_TID_SUPPORT
Change-Id: I6b9b44474a58cfa826efa4077aee7b920802ad14
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Add tx_pending_msdu in struct wmi_wmm_ac_stats
Change-Id: I1ddb39dd4b967893d11f9203daa676902c0fdf81
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_PDEV_SET_AC_TX_QUEUE_OPTIMIZED_CMDID
Change-Id: Ib0e73bb046a8cbdf30d285ac067fcad99c331c77
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_RSRC_CFG_FLAG_TCL_CCE
Change-Id: Ib91cb2041c0e75c006f1117bd6422afa942a787a
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Add sched_params in struct wmi_resource_config
Change-Id: Icda51486c5c20440daafd4c036a8d9c3730e8517
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_SERVICE_PEER_MAP_UNMAP_V2_SUPPORT
Change-Id: I6c630e2a57b227e59f3f34a9c60f0e6b0cfcb6e8
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_SERVICE_WOW_WAKEUP_BY_TIMER_PATTERN
Change-Id: I2a2f878677be0bead27b5f51c4fd551ce2d63d20
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define vdev cmd to enable/disable fw offloaded beacons
Change-Id: I22e5cfb48cf5e37c9371e90d105721bb81787475
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_SERVICE_THERM_THROT
Change-Id: I723ca0479d483c8068cdca4c47b334a8becf010d
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Add num_total_peers in wmi ready event
Change-Id: If921fe1c5f8e3fc92e10ff86d343eb73c585ffdb
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_BOARD_MCN_STRING_BUF_SIZE
Change-Id: Ia35ab0159c33c40a5bf5505680eb73e2be2987fe
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Add group keys params.
Change-Id: Ic3e3cf0f991256ee72837f11519e997ae690cbd1
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Change VDEV_EXTD_STAT to BCN_STAT
Change-Id: Ic56fc1a9dc2c8caf4eaeba8c8813a767db30d348
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define WMI_SERVICE_SCAN_PHYMODE_SUPPORT
Change-Id: I12b993b7c921a9759299c6a6cb267f8a836fa390
CRs-fixed: 865207
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Define a series of macros about WMI_HECAP_PHY
Change-Id: I310d4048f7f932e6b075dfd6c7ab49a0695c7648
CRs-fixed: 865207
|