From 72f690b3ddb741233c70a41282b0020e9489d571 Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Mon, 2 Jul 2018 11:15:09 +0800 Subject: qcacmn: Verify id before removing idr It causes kernel warning if remove an invalid id. So, verify id before removing idr. Change-Id: I22cd5753a6e4fae0087faaee1c722017523b311e CRs-Fixed: 2271235 --- qdf/linux/src/qdf_idr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/qdf/linux/src/qdf_idr.c b/qdf/linux/src/qdf_idr.c index e6c2b7f34341..9749083746b8 100644 --- a/qdf/linux/src/qdf_idr.c +++ b/qdf/linux/src/qdf_idr.c @@ -116,7 +116,8 @@ QDF_STATUS qdf_idr_remove(qdf_idr *idp, int32_t id) return QDF_STATUS_E_INVAL; qdf_spinlock_acquire(&idp->lock); - idr_remove(&idp->idr, id); + if (idr_find(&idp->idr, id)) + idr_remove(&idp->idr, id); qdf_spinlock_release(&idp->lock); return QDF_STATUS_SUCCESS; -- cgit v1.2.3 From 2ae4256ed35fe8d16a9bd1037029f030d42916f4 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Mon, 18 Jun 2018 15:15:09 +0530 Subject: qcacmn: Fix pointer dereference condition In the API extract_roam_scan_stats_res_evt_tlv, the driver extracts num_channels from the param_buf, which may be NULL, and lead to pointer dereference in the same API Fix is to have check for num_channels, and then let driver perform tasks. Change-Id: Iee56de8cd47cd3ea09078479e8ce34b6362b1685 CRs-Fixed: 2259297 --- wmi/src/wmi_unified_tlv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 11f0d412e47c..9c37be61570c 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -14702,7 +14702,7 @@ extract_roam_scan_stats_res_evt_tlv(wmi_unified_t wmi_handle, void *evt_buf, roam->trigger_value = roam_reason[i].trigger_value; } - if (chan_info) { + if (chan_info && num_channels) { for (j = 0; j < num_channels[i]; j++) roam->scan_freqs[j] = chan_info[chan_idx++]; } -- cgit v1.2.3 From 6d4ba73ed9bcf677d714497b7ec0269fb5526237 Mon Sep 17 00:00:00 2001 From: Lihua Liu Date: Thu, 5 Jul 2018 18:10:19 +0800 Subject: qcacmn: Fix a NULL pointer dereference issue The pointer ol_sc or scn would be freed if athdiag_procfs_init failed in hif_sdio_probe(), then null pointer dereference occur in hif_sdio_enable_bus. Add null check before using it. In addition, keep wlan working and do not free ol_sc/scn when athdiag_procfs_init failed in hif_sdio_probe since it's just for debug. Change-Id: Ic706dcfbdf3bab432e048af359fa99913a4df436 CRs-Fixed: 2273331 --- hif/src/sdio/if_sdio.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/hif/src/sdio/if_sdio.c b/hif/src/sdio/if_sdio.c index d5bc45800902..75afbe850ef5 100644 --- a/hif/src/sdio/if_sdio.c +++ b/hif/src/sdio/if_sdio.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2018 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -178,8 +178,6 @@ static A_STATUS hif_sdio_probe(void *context, void *hif_handle) if (athdiag_procfs_init(scn) != 0) { QDF_TRACE(QDF_MODULE_ID_HIF, QDF_TRACE_LEVEL_ERROR, "%s athdiag_procfs_init failed", __func__); - ret = QDF_STATUS_E_FAILURE; - goto err_attach1; } atomic_set(&hif_sdio_load_state, true); @@ -187,10 +185,6 @@ static A_STATUS hif_sdio_probe(void *context, void *hif_handle) return 0; -err_attach1: - if (scn->ramdump_base) - pld_hif_sdio_release_ramdump_mem(scn->ramdump_base); - qdf_mem_free(ol_sc); err_attach: qdf_mem_free(scn); scn = NULL; @@ -429,6 +423,11 @@ QDF_STATUS hif_sdio_enable_bus(struct hif_softc *hif_sc, wait_event_interruptible_timeout(sync_wait_queue, atomic_read(&hif_sdio_load_state) == true, HIF_SDIO_LOAD_TIMEOUT); + + if (!ol_sc || !scn) { + HIF_ERROR("wlan: %s ol_sc or scn is null", __func__); + return QDF_STATUS_E_INVAL; + } hif_sc->hostdef = ol_sc->hostdef; hif_sc->targetdef = ol_sc->targetdef; hif_sc->bus_type = ol_sc->bus_type; -- cgit v1.2.3 From f79c7951f65f69a2e10d7c0316382e5593a01323 Mon Sep 17 00:00:00 2001 From: Abhinav Kumar Date: Fri, 6 Jul 2018 17:40:32 +0530 Subject: qcacmn: Add comment between cases in the switch statement Add return statement in the case of WMI_ACTION_OUI_ITO_ALTERNATE in wmi_get_action_oui_id while conversion of host-specific action id to firmware specific. Change-Id: I59f1f5b6e38452fcfcbc04a3b03b25b7f97460b0 CRs-Fixed: 2267084 --- wmi/src/wmi_unified_tlv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 9c37be61570c..bda12de35414 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -14150,6 +14150,7 @@ wmi_get_action_oui_id(enum wmi_action_oui_id action_id, case WMI_ACTION_OUI_ITO_ALTERNATE: *id = WMI_VENDOR_OUI_ACTION_ALT_ITO; + return true; case WMI_ACTION_OUI_SWITCH_TO_11N_MODE: *id = WMI_VENDOR_OUI_ACTION_SWITCH_TO_11N_MODE; -- cgit v1.2.3 From 849c007d420b7531c8f7729e41c9af9778a66293 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Tue, 10 Jul 2018 16:05:38 +0530 Subject: qcacmn: Fix GTK offload req params Currently the host sends the fixed gtk offload params and the FILS TLV params, even when the FILS feature is disabled in the host, which force firmware to pick the KEK from the FILS TLV structure rather than from the fixed param structure, which further leads to GTK re-keying feature fail. Fix is to send only the fixed params in case when host doesnt supports FILS. Change-Id: I53a77257e716bf290a6f4bd62927020f073e2df6 CRs-Fixed: 2275938 --- wmi/inc/wmi_unified_param.h | 2 ++ wmi/src/wmi_unified_tlv.c | 59 ++++++++++++++++++++++++++++++--------------- 2 files changed, 41 insertions(+), 20 deletions(-) diff --git a/wmi/inc/wmi_unified_param.h b/wmi/inc/wmi_unified_param.h index f3e0c86382b4..8bf35ef108c6 100644 --- a/wmi/inc/wmi_unified_param.h +++ b/wmi/inc/wmi_unified_param.h @@ -3405,6 +3405,7 @@ struct periodic_tx_pattern { * @kek_len: Kek length * @ullKeyReplayCounter: replay counter * @bssid: bss id + * @is_fils_connection: Whether the present connection with the AP is FILS */ struct gtk_offload_params { uint32_t ulFlags; @@ -3413,6 +3414,7 @@ struct gtk_offload_params { uint32_t kek_len; uint64_t ullKeyReplayCounter; struct qdf_mac_addr bssid; + bool is_fils_connection; }; /** diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index bda12de35414..1a8cde22ebe1 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -9230,6 +9230,34 @@ send_cmd: return QDF_STATUS_SUCCESS; } +static void +fill_fils_tlv_params(WMI_GTK_OFFLOAD_CMD_fixed_param *cmd, + uint8_t vdev_id, + struct gtk_offload_params *params) +{ + uint8_t *buf_ptr; + wmi_gtk_offload_fils_tlv_param *ext_param; + + buf_ptr = (uint8_t *) cmd + sizeof(*cmd); + WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC, + sizeof(*ext_param)); + buf_ptr += WMI_TLV_HDR_SIZE; + ext_param = (wmi_gtk_offload_fils_tlv_param *)buf_ptr; + WMITLV_SET_HDR(&ext_param->tlv_header, + WMITLV_TAG_STRUC_wmi_gtk_offload_extended_tlv_param, + WMITLV_GET_STRUCT_TLVLEN( + wmi_gtk_offload_fils_tlv_param)); + ext_param->vdev_id = vdev_id; + ext_param->flags = cmd->flags; + ext_param->kek_len = params->kek_len; + qdf_mem_copy(ext_param->KEK, params->aKEK, params->kek_len); + qdf_mem_copy(ext_param->KCK, params->aKCK, + WMI_GTK_OFFLOAD_KCK_BYTES); + qdf_mem_copy(ext_param->replay_counter, + ¶ms->ullKeyReplayCounter, + GTK_REPLAY_COUNTER_BYTES); +} + /** * send_gtk_offload_cmd_tlv() - send GTK offload command to fw * @wmi_handle: wmi handle @@ -9246,13 +9274,18 @@ QDF_STATUS send_gtk_offload_cmd_tlv(wmi_unified_t wmi_handle, uint8_t vdev_id, int len; wmi_buf_t buf; WMI_GTK_OFFLOAD_CMD_fixed_param *cmd; - wmi_gtk_offload_fils_tlv_param *ext_param; QDF_STATUS status = QDF_STATUS_SUCCESS; - uint8_t *buf_ptr; WMI_LOGD("%s Enter", __func__); - len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + sizeof(*ext_param); + len = sizeof(*cmd); + /** + * In case of FILS connection, the buf will contain fixed params + * and the FILS lv params, so accordingly allocate the buffer. + */ + if (params->is_fils_connection) + len += WMI_TLV_HDR_SIZE + + sizeof(wmi_gtk_offload_fils_tlv_param); /* alloc wmi buffer */ buf = wmi_buf_alloc(wmi_handle, len); @@ -9263,7 +9296,6 @@ QDF_STATUS send_gtk_offload_cmd_tlv(wmi_unified_t wmi_handle, uint8_t vdev_id, } cmd = (WMI_GTK_OFFLOAD_CMD_fixed_param *) wmi_buf_data(buf); - buf_ptr = (uint8_t *)cmd; WMITLV_SET_HDR(&cmd->tlv_header, WMITLV_TAG_STRUC_WMI_GTK_OFFLOAD_CMD_fixed_param, WMITLV_GET_STRUCT_TLVLEN @@ -9284,22 +9316,9 @@ QDF_STATUS send_gtk_offload_cmd_tlv(wmi_unified_t wmi_handle, uint8_t vdev_id, } else { cmd->flags = gtk_offload_opcode; } - buf_ptr += sizeof(*cmd); - WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_STRUC, sizeof(*ext_param)); - buf_ptr += WMI_TLV_HDR_SIZE; - - ext_param = (wmi_gtk_offload_fils_tlv_param *)buf_ptr; - WMITLV_SET_HDR(&ext_param->tlv_header, - WMITLV_TAG_STRUC_wmi_gtk_offload_extended_tlv_param, - WMITLV_GET_STRUCT_TLVLEN( - wmi_gtk_offload_fils_tlv_param)); - ext_param->vdev_id = vdev_id; - ext_param->flags = cmd->flags; - ext_param->kek_len = params->kek_len; - qdf_mem_copy(ext_param->KEK, params->aKEK, params->kek_len); - qdf_mem_copy(ext_param->KCK, params->aKCK, WMI_GTK_OFFLOAD_KCK_BYTES); - qdf_mem_copy(ext_param->replay_counter, ¶ms->ullKeyReplayCounter, - GTK_REPLAY_COUNTER_BYTES); + /* In case of FILS connection the FW requires FILS tlv params */ + if (params->is_fils_connection) + fill_fils_tlv_params(cmd, vdev_id, params); WMI_LOGD("VDEVID: %d, GTK_FLAGS: x%x kek len %d", vdev_id, cmd->flags, params->kek_len); -- cgit v1.2.3 From 1036ae536bce3aed5e8261091dca6edbeff5a287 Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Date: Wed, 18 Jul 2018 12:11:46 -0700 Subject: qcacmn: Remove qdf_assert from hnc_link_clusters Remove qdf_assert from hnc_link_clusters as it already has required debug log. Change-Id: Id11eb10ad7164ff5347260d3933d633242a8ddd1 CRs-Fixed: 2281122 --- hif/src/hif_napi.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hif/src/hif_napi.c b/hif/src/hif_napi.c index bf4e241b834c..b42be4ea3037 100644 --- a/hif/src/hif_napi.c +++ b/hif/src/hif_napi.c @@ -1094,7 +1094,6 @@ static int hnc_link_clusters(struct qca_napi_data *napid) i, cl); if ((cl < HNC_MIN_CLUSTER) || (cl > HNC_MAX_CLUSTER)) { NAPI_DEBUG("Bad cluster (%d). SKIPPED\n", cl); - QDF_ASSERT(0); /* continue if ASSERTs are disabled */ continue; }; -- cgit v1.2.3 From 908d3ffb76f73b64029fd3f13468c396597466aa Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Mon, 18 Jun 2018 18:22:13 +0530 Subject: qcacmn: Add support for 1x1 connect with 1 Tx/Rx Chain action OUI Add WMI support for new 1x1 connect with 1 Tx/Rx Chain action OUI to be parsed and sent to the FW. Change-Id: I077eccb6fab0684d1bc0ec63745de728bfd1a868 CRs-Fixed: 2264328 --- wmi/inc/wmi_unified_param.h | 6 +++++- wmi/src/wmi_unified_tlv.c | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/wmi/inc/wmi_unified_param.h b/wmi/inc/wmi_unified_param.h index 8bf35ef108c6..d050b498ccc9 100644 --- a/wmi/inc/wmi_unified_param.h +++ b/wmi/inc/wmi_unified_param.h @@ -7381,6 +7381,9 @@ struct action_wakeup_set_param { * @WMI_ACTION_OUI_CONNECT_1X1: for 1x1 connection only * @WMI_ACTION_OUI_ITO_EXTENSION: for extending inactivity time of station * @WMI_ACTION_OUI_CCKM_1X1: for TX with CCKM 1x1 only + * @WMI_ACTION_OUI_ITO_ALTERNATE: for alternate inactivity time of station + * WMI_ACTION_OUI_SWITCH_TO_11N_MODE: for switching to 11n mode connection + * WMI_ACTION_OUI_CONNECT_1x1_WITH_1_CHAIN: for 1x1 connection with 1 Chain * @WMI_ACTION_OUI_MAXIMUM_ID: maximun number of action oui types */ enum wmi_action_oui_id { @@ -7389,7 +7392,8 @@ enum wmi_action_oui_id { WMI_ACTION_OUI_CCKM_1X1 = 2, WMI_ACTION_OUI_ITO_ALTERNATE = 3, WMI_ACTION_OUI_SWITCH_TO_11N_MODE = 4, - WMI_ACTION_OUI_MAXIMUM_ID = 5, + WMI_ACTION_OUI_CONNECT_1x1_WITH_1_CHAIN = 5, + WMI_ACTION_OUI_MAXIMUM_ID = 6, }; /** diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 1a8cde22ebe1..9450a7805fa8 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -14175,6 +14175,10 @@ wmi_get_action_oui_id(enum wmi_action_oui_id action_id, *id = WMI_VENDOR_OUI_ACTION_SWITCH_TO_11N_MODE; return true; + case WMI_ACTION_OUI_CONNECT_1x1_WITH_1_CHAIN: + *id = WMI_VENDOR_OUI_ACTION_CONNECTION_1X1_NUM_TX_RX_CHAINS_1; + return true; + default: return false; } -- cgit v1.2.3