From 083fef0100139b29bebe69b4b76c87671f04344e Mon Sep 17 00:00:00 2001 From: Ajit Vaishya Date: Tue, 20 Jan 2026 14:40:42 +0530 Subject: [PATCH 1/5] qcacld-3.0: Self rsn cap intersect with AP rsn cap currently self rsn cap intersect with AP rsn cap IE which is filed in bss desc, but while reading rsn cap IE from bss desc is getting all Zero's, due to which self cap also become Zero's. Fix is read AP rsn cap from negotiated rsn cap of bss desc which is populate properly and self rsn cap is filled correctly. Change-Id: Ia1d9c27e1f3a7528636ab78ebe973090a9ae6f1d CRs-Fixed: 4423830 --- core/mac/inc/sir_api.h | 1 + core/sme/src/csr/csr_api_scan.c | 1 + core/sme/src/csr/csr_util.c | 4 ++-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index f13d7eda15bc..1f1ff23d47b4 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -786,6 +786,7 @@ struct bss_description { #if defined(WLAN_SAE_SINGLE_PMK) && defined(WLAN_FEATURE_ROAM_OFFLOAD) uint32_t is_single_pmk; #endif + uint16_t neg_rsn_caps; /* Please keep the structure 4 bytes aligned above the ieFields */ uint32_t ieFields[1]; }; diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c index 8ba4ef61b6a1..5ce7d5345138 100644 --- a/core/sme/src/csr/csr_api_scan.c +++ b/core/sme/src/csr/csr_api_scan.c @@ -2256,6 +2256,7 @@ static QDF_STATUS csr_fill_bss_from_scan_entry(struct mac_context *mac_ctx, bss_desc->beaconInterval = scan_entry->bcn_int; bss_desc->capabilityInfo = scan_entry->cap_info.value; + bss_desc->neg_rsn_caps = scan_entry->neg_sec_info.rsn_caps; if (WLAN_REG_IS_5GHZ_CH_FREQ(scan_entry->channel.chan_freq) || WLAN_REG_IS_6GHZ_CHAN_FREQ(scan_entry->channel.chan_freq)) diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c index ecd857bcd604..a92dee201977 100644 --- a/core/sme/src/csr/csr_util.c +++ b/core/sme/src/csr/csr_util.c @@ -2603,8 +2603,6 @@ uint8_t csr_construct_rsn_ie(struct mac_context *mac, uint32_t sessionId, (mac, pSirBssDesc, &local_ap_ie)))) return ie_len; - /* get AP RSN cap */ - qdf_mem_copy(&rsn_cap, local_ap_ie->RSN.RSN_Cap, sizeof(rsn_cap)); if (!ap_ie && local_ap_ie) /* locally allocated */ qdf_mem_free(local_ap_ie); @@ -2624,6 +2622,8 @@ uint8_t csr_construct_rsn_ie(struct mac_context *mac, uint32_t sessionId, } self_rsn_cap = (uint16_t)rsn_val; + /* get AP RSN cap */ + rsn_cap = pSirBssDesc->neg_rsn_caps; /* If AP is capable then use self capability else set PMF as 0 */ if (rsn_cap & WLAN_CRYPTO_RSN_CAP_MFP_ENABLED && pProfile->MFPCapable) { From e7116cb9e98bf2de8fa7d246d43dbb64cc0c1252 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Tue, 7 Apr 2026 01:23:20 +0530 Subject: [PATCH 2/5] qcacld-3.0: Add A_INT64 typedef Add A_INT64 as a signed 64-bit integer type in uapi/linux/a_types.h. This complements the existing A_UINT64 definition and provides a consistent signed 64-bit typedef for consumers of this UAPI header. CRs-Fixed: 4492650 Change-Id: Ie7f5fb55ba291273ecf35920a217fc65dfa3f661 --- uapi/linux/a_types.h | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/uapi/linux/a_types.h b/uapi/linux/a_types.h index 190d40df6afd..5537fae67697 100644 --- a/uapi/linux/a_types.h +++ b/uapi/linux/a_types.h @@ -1,5 +1,6 @@ /* * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved. + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -29,15 +30,21 @@ #define _A_TYPES_H_ #include -typedef unsigned int A_UINT32; typedef unsigned long long A_UINT64; +typedef long long A_INT64; + +typedef unsigned int A_UINT32; +typedef int A_INT32; + typedef unsigned short A_UINT16; +typedef short A_INT16; + typedef unsigned char A_UINT8; -typedef int A_INT32; -typedef short A_INT16; -typedef char A_INT8; +typedef char A_INT8; + typedef unsigned char A_UCHAR; -typedef char A_CHAR; +typedef char A_CHAR; + typedef _Bool A_BOOL; #endif /* _ATHTYPES_H_ */ From 221de7eef147a76fc4764f863e2caddb79046de6 Mon Sep 17 00:00:00 2001 From: Deeksha Gupta Date: Thu, 25 Jan 2024 16:08:03 +0530 Subject: [PATCH 3/5] =?UTF-8?q?qcacld-3.0:=20Set=20=E2=80=9CWIPHY=5FFLAG?= =?UTF-8?q?=5FDFS=5FOFFLOAD=E2=80=9D=20always=20in=20wiphy=20flag?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ensure the "WIPHY_FLAG_DFS_OFFLOAD" flag is always set in wiphy flag, regardless of DFS master capability ini. This changes eliminates the need for supplicant to check DFS flags for the SAP channel, as the DFS logic is consistently offloaded to the driver. CRs-Fixed: 3716167 Change-Id: I571f1cf15d268b85ad4de4d2f2a93d39f59b1231 --- core/hdd/src/wlan_hdd_cfg80211.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index 9edadf77f669..3c0adf628743 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -1718,7 +1718,7 @@ static const struct nl80211_vendor_cmd_info wlan_hdd_cfg80211_vendor_events[] = }; /** - * __is_driver_dfs_capable() - get driver DFS capability + * __is_driver_dfs_capable() - get driver DFS offload capability * @wiphy: pointer to wireless wiphy structure. * @wdev: pointer to wireless_dev structure. * @data: Pointer to the data to be passed via vendor interface @@ -17739,7 +17739,7 @@ void wlan_hdd_update_wiphy(struct hdd_context *hdd_ctx) { int value; bool fils_enabled, mac_spoofing_enabled; - bool dfs_master_capable = true, is_oce_sta_enabled = false; + bool is_oce_sta_enabled = false; QDF_STATUS status; struct wiphy *wiphy = hdd_ctx->wiphy; uint8_t allow_mcc_go_diff_bi = 0, enable_mcc = 0; @@ -17764,11 +17764,7 @@ void wlan_hdd_update_wiphy(struct hdd_context *hdd_ctx) if (fils_enabled) wlan_hdd_cfg80211_set_wiphy_fils_feature(wiphy); - status = ucfg_mlme_get_dfs_master_capability(hdd_ctx->psoc, - &dfs_master_capable); - if (QDF_IS_STATUS_SUCCESS(status) && dfs_master_capable) - wlan_hdd_cfg80211_set_dfs_offload_feature(wiphy); - + wlan_hdd_cfg80211_set_dfs_offload_feature(wiphy); status = ucfg_mlme_get_bigtk_support(hdd_ctx->psoc, &is_bigtk_supported); From 1b0f7e3489a3e79fee044d1795d1fdea2fc3f71b Mon Sep 17 00:00:00 2001 From: Abinandhu M Date: Sun, 10 May 2026 22:52:01 +0530 Subject: [PATCH 4/5] qcacld-3.0: Disable SAP bringup in DFS when DFSmastercap is disabled Issue Scenario: 1) INI gEnableDFSMasterCap is set to 0 2) User tries to force start SAP on 160 MHz. 3) SAP starts on 160 MHz which contains DFS channels. This is a violation since the DUT does not support DFS master capability. To fix this, stop the SAP bringup if atleast one of the bonded channels is DFS. CRs-Fixed: 4516874 Change-Id: Iaeb77d52059505bafb8a0d38386cb1790432b498 --- .../policy_mgr/inc/wlan_policy_mgr_api.h | 18 +++++++++ .../src/wlan_policy_mgr_get_set_utils.c | 39 +++++++++++++++++++ core/hdd/src/wlan_hdd_hostapd.c | 19 +++++++++ 3 files changed, 76 insertions(+) diff --git a/components/cmn_services/policy_mgr/inc/wlan_policy_mgr_api.h b/components/cmn_services/policy_mgr/inc/wlan_policy_mgr_api.h index d902f7ee4327..141ce08f47a2 100644 --- a/components/cmn_services/policy_mgr/inc/wlan_policy_mgr_api.h +++ b/components/cmn_services/policy_mgr/inc/wlan_policy_mgr_api.h @@ -210,6 +210,24 @@ QDF_STATUS policy_mgr_get_sta_sap_scc_on_dfs_chnl(struct wlan_objmgr_psoc *psoc, uint8_t *sta_sap_scc_on_dfs_chnl); +/** + * policy_mgr_is_bonded_chan_dfs() - check whether the given bonded + * channel configuration falls under DFS + * @psoc: pointer to psoc + * @ch_width: channel width of the operating channel + * @mhz_freq_seg1: center frequency of segment 1; used for 80+80 MHz + * @chan_freq: primary/operating channel frequency in MHz + * + * This API checks whether the given channel or bonded channel span + * includes DFS, based on the channel width and frequency segments. + * + * Return: true if the given bonded channel is DFS, else false. + */ +bool +policy_mgr_is_bonded_chan_dfs(struct wlan_objmgr_psoc *psoc, + enum phy_ch_width ch_width, + qdf_freq_t mhz_freq_seg1, + uint32_t chan_freq); /** * policy_mgr_get_dfs_master_dynamic_enabled() - support dfs master or not * on AP interafce when STA+SAP(GO) concurrency diff --git a/components/cmn_services/policy_mgr/src/wlan_policy_mgr_get_set_utils.c b/components/cmn_services/policy_mgr/src/wlan_policy_mgr_get_set_utils.c index 5661c5a03491..0bffbe5e612e 100644 --- a/components/cmn_services/policy_mgr/src/wlan_policy_mgr_get_set_utils.c +++ b/components/cmn_services/policy_mgr/src/wlan_policy_mgr_get_set_utils.c @@ -181,6 +181,45 @@ policy_mgr_get_sta_sap_scc_on_dfs_chnl(struct wlan_objmgr_psoc *psoc, return QDF_STATUS_SUCCESS; } +bool +policy_mgr_is_bonded_chan_dfs(struct wlan_objmgr_psoc *psoc, + enum phy_ch_width ch_width, + qdf_freq_t mhz_freq_seg1, + uint32_t chan_freq) +{ + bool is_ch_dfs = false; + struct policy_mgr_psoc_priv_obj *pm_ctx; + + pm_ctx = policy_mgr_get_context(psoc); + if (!pm_ctx) { + policy_mgr_err("pm_ctx is NULL"); + return false; + } + + if (ch_width == CH_WIDTH_160MHZ) { + if (wlan_reg_get_5g_bonded_channel_state_for_freq(pm_ctx->pdev, + chan_freq, + ch_width) + == CHANNEL_STATE_DFS) + is_ch_dfs = true; + } else if (ch_width == CH_WIDTH_80P80MHZ) { + if (wlan_reg_get_channel_state_for_freq( + pm_ctx->pdev, + chan_freq) == + CHANNEL_STATE_DFS || + wlan_reg_get_channel_state_for_freq( + pm_ctx->pdev, + mhz_freq_seg1) == + CHANNEL_STATE_DFS) + is_ch_dfs = true; + } else { + if (wlan_reg_is_dfs_for_freq(pm_ctx->pdev, chan_freq)) + is_ch_dfs = true; + } + + return is_ch_dfs; +} + static bool policy_mgr_update_dfs_master_dynamic_enabled( struct wlan_objmgr_psoc *psoc, uint8_t vdev_id) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index 80659541d94a..76a1a5228125 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -5244,6 +5244,7 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *adapter, bool deliver_start_evt = true; struct s_ext_cap *p_ext_cap; enum reg_phymode reg_phy_mode, updated_phy_mode; + bool dfs_master_capable; hdd_enter(); @@ -5787,6 +5788,24 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *adapter, config->ch_width_orig = CH_WIDTH_20MHZ; } + status = ucfg_mlme_get_dfs_master_capability(hdd_ctx->psoc, + &dfs_master_capable); + if (QDF_IS_STATUS_ERROR(status)) { + hdd_err("Failed to get dfs master capable"); + ret = -EINVAL; + goto error; + } + + if (!dfs_master_capable && + policy_mgr_is_bonded_chan_dfs(hdd_ctx->psoc, + config->ch_width_orig, + config->ch_params.mhz_freq_seg1, + config->chan_freq)) { + hdd_err("Failed to bringup SAP; Atleast one bonded channel is DFS"); + ret = -EINVAL; + goto error; + } + if (wlan_hdd_setup_driver_overrides(adapter)) { ret = -EINVAL; goto error; From 3759ce5221446164d7bef684402d16116215e927 Mon Sep 17 00:00:00 2001 From: Surya Prakash Sivaraj Date: Fri, 22 May 2026 11:01:54 +0530 Subject: [PATCH 5/5] qcacld-3.0: Add print log for new roam scan type Firmware sends the roam scan info tlv to driver during roaming. Currently, in this tlv, firmware fills scan type as (0-3) and driver log this as "PARTIAL", "FULL", "NO SCAN" and "Higher Band" But with new requirement, idle roaming shall only roam to higher band (2.4 GHz < 5 GHz < 6 GHz) than current band. 1. If current band is 2.4 GHz, it cannot roam to 2.4 GHz. It can roam to 5 GHz and 6 GHz. 2. If current band is 5 GHz, it cannot roam to 2.4 GHz and 5 GHz. It can roam to 6 GHz. So, to add this requirement, firmware introduces new scan type 4 for which driver need to log. Change-Id: I80d1c47a434da5009aed4cab08c6eae91bda5b0e CRs-Fixed: 3379468 --- .../mlme/dispatcher/inc/wlan_mlme_api.h | 23 +++++++++++++++++-- .../mlme/dispatcher/src/wlan_mlme_api.c | 12 ++++++---- core/hdd/src/wlan_hdd_stats.c | 6 +++-- core/wma/src/wma_scan_roam.c | 2 +- 4 files changed, 33 insertions(+), 10 deletions(-) diff --git a/components/mlme/dispatcher/inc/wlan_mlme_api.h b/components/mlme/dispatcher/inc/wlan_mlme_api.h index 401bd9c549e5..3b757579f129 100644 --- a/components/mlme/dispatcher/inc/wlan_mlme_api.h +++ b/components/mlme/dispatcher/inc/wlan_mlme_api.h @@ -2444,11 +2444,30 @@ wlan_mlme_get_ignore_fw_reg_offload_ind(struct wlan_objmgr_psoc *psoc, char *mlme_get_roam_trigger_str(uint32_t roam_scan_trigger); /** - * mlme_get_roam_scan_type_str() - Get the string for roam sacn type + * enum roam_stats_scan_type - Roam scan type defines + * @ROAM_STATS_SCAN_TYPE_PARTIAL: Partial scan + * @ROAM_STATS_SCAN_TYPE_FULL: Full scan + * @ROAM_STATS_SCAN_TYPE_NO_SCAN: No roam scan was triggered. This is generally + * used in BTM events to indicate BTM frame exchange logs. + * @ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ: Higher band roam scan from 2 GHz + * to 5 GHz or 6 GHz + * @ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ: Higher band roam scan from 5 GHz to + * 6 GHz + */ +enum roam_stats_scan_type { + ROAM_STATS_SCAN_TYPE_PARTIAL = 0, + ROAM_STATS_SCAN_TYPE_FULL = 1, + ROAM_STATS_SCAN_TYPE_NO_SCAN = 2, + ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ = 3, + ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ = 4, +}; + +/** + * mlme_get_roam_scan_type_str() - Get the string for roam scan type * @roam_scan_type: roam scan type coming from fw via * wmi_roam_scan_info tlv * - * Return: Meaningful string for roam sacn type + * Return: Meaningful string for roam scan type */ char *mlme_get_roam_scan_type_str(uint32_t roam_scan_type); diff --git a/components/mlme/dispatcher/src/wlan_mlme_api.c b/components/mlme/dispatcher/src/wlan_mlme_api.c index dd930d969742..633b36067c91 100644 --- a/components/mlme/dispatcher/src/wlan_mlme_api.c +++ b/components/mlme/dispatcher/src/wlan_mlme_api.c @@ -3793,14 +3793,16 @@ char *mlme_get_roam_status_str(uint32_t roam_status) char *mlme_get_roam_scan_type_str(uint32_t roam_scan_type) { switch (roam_scan_type) { - case 0: + case ROAM_STATS_SCAN_TYPE_PARTIAL: return "PARTIAL"; - case 1: + case ROAM_STATS_SCAN_TYPE_FULL: return "FULL"; - case 2: + case ROAM_STATS_SCAN_TYPE_NO_SCAN: return "NO SCAN"; - case 3: - return "Higher Band"; + case ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ: + return "Higher Band: 5 GHz + 6 GHz"; + case ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ: + return "Higher Band : 6 GHz"; default: return "UNKNOWN"; } diff --git a/core/hdd/src/wlan_hdd_stats.c b/core/hdd/src/wlan_hdd_stats.c index 8f7deb17dcda..47c143862f89 100644 --- a/core/hdd/src/wlan_hdd_stats.c +++ b/core/hdd/src/wlan_hdd_stats.c @@ -3914,7 +3914,8 @@ hdd_get_roam_rt_stats_event_len(struct mlme_roam_debug_info *roam_stats) len += nla_total_size(sizeof(uint8_t)); if (roam_stats->scan.present) { - if (roam_stats->scan.num_chan && !roam_stats->scan.type) + if (roam_stats->scan.num_chan && + roam_stats->scan.type == ROAM_STATS_SCAN_TYPE_PARTIAL) for (i = 0; i < roam_stats->scan.num_chan;) i++; @@ -3987,7 +3988,8 @@ roam_rt_stats_fill_scan_freq(struct sk_buff *vendor_event, kfree_skb(vendor_event); return; } - if (roam_stats->scan.num_chan && !roam_stats->scan.type) { + if (roam_stats->scan.num_chan && + roam_stats->scan.type == ROAM_STATS_SCAN_TYPE_PARTIAL) { for (i = 0; i < roam_stats->scan.num_chan; i++) { if (nla_put_u32(vendor_event, i, roam_stats->scan.chan_freq[i])) { diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 276f64af9cf8..915e196f4d81 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -2070,7 +2070,7 @@ wma_rso_print_scan_info(struct wmi_roam_scan_data *scan, uint8_t vdev_id, tmp = buf; /* For partial scans, print the channel info */ - if (!scan->type) { + if (scan->type == ROAM_STATS_SCAN_TYPE_PARTIAL) { buf_cons = qdf_snprint(tmp, buf_left, "{"); buf_left -= buf_cons; tmp += buf_cons;