Currently the driver does not set weight calculated flag
in the spectrum channel structure for each channel as
true in 40, 80, 160 sorting case.
Now in the next iteration the weight calculation done
comes as false, and the weight is set as maximum
which leads to wrong channel and BW selection and the
last while running channel selection logic.
Fix is to set weight calculation done as true for all
the channels which come under the particular BW, and
skip the channels for which the weights are already
calculated.
Change-Id: Ib355dd5cf7c3aeeb5534bfa295785bdfc30eed86
CRs-Fixed: 2583538
Currently cdp_host_get_vdev_stats API provided
with vdev handle as its arguments, which is
directly accessed in that API. This can cause
a race-condition in access of the respective
handle if it has been deleted in parallel.
Hence as a part of cdp convergence, pass only
the vdev_id which will be used to get the
respective handles and hence avoiding unwanted
access of the handle if it has been deleted.
Change-Id: I4cc959b9244f5c22dea71194c86c583cd9c2a071
CRs-Fixed: 2583358
Supplicant delivers the HANG event via HIDL for STA
and via a legacy socket interface for SAP standalone case.
As per current supplicant implementation, wdev_id only matters
when the HANG event gets processed via HIDL.
Currently, for STA interface, host sends wdev as NULL to
cfg80211_vendor_event_alloc, this allows userspace to
process nl_cmd for QCA_NL80211_VENDOR_SUBCMD_HANG_REASON_INDEX
event with the 1st interface which is p2p in supplicant instead
of WLAN interface.
Set wdev with the proper value for STA interface to avoid processing
nl_cmd with P2P interface by userspace.
Change-Id: If3c1b2e11daf682a6ef535014738f4b2a2b5d009
CRs-Fixed: 2580359
Currently the driver caches the command which comes
for PS enable/disable and if the user disables the
command the API sme_ps_enable_disable cannot go
forward to enable/disable the command because
of the check for last user command cache to be disabled
or not.
Fix is to cache the command after the disable has
been sent to FW to avoid the scenario where the command
is not sent by host as the check to send the command failed.
Change-Id: Ibff459fa03aceaf6963735d22d30c54a488751f4
CRs-Fixed: 2582410
Currently the acs in progress is not set to 0 when
acs policy is 1 and the control returns the best channel
in do acs itself, hence it can lead to many unexpected
behaviour if set to 1 and acs is complete.
For example one case sceanrio is that the driver
returned from do acs without clearing the acs
in progress flag, and then stop adapter comes to
the driver for the same interface, the driver
would check that if acs in progress is tru then
it would wait for 3 seconds for it to complete.
Now since there is no complete to be there as
ACS had already been completed, there would be
an unnecessary delay for 3 seconds to shutdown
SAP which would cause latency.
Fix is to set the acs in progress as 0 when the overide
happens.
Change-Id: I03a80c4d4eeeb41f21e95e37bfbeb94e7ebee51e
CRs-Fixed: 2582703
Due to upgrade to kernel 5.4, struct pm_qos_request fields have changed,
causing compilation issues. Featurizing PM QoS so it is only enabled
for 4.19 kernel.
Change-Id: Ide2a3eb4b2bc970c6469efe8621bec55e50ecbd8
CRs-Fixed: 2580165
If hardware mode change is required during roaming, then
the roam command to disassoc from the current ap remains in the
active queue until SME receives hw_mode_res. Due to which the
SME requests for hardware mode switch and nss update are not
able to get queued into the active queue. Hence LFR2.0 roaming
fails to proceed after disassoc completion.
Removed the completed roam command from active queue.
Change-Id: I5f244ddba88cbb8af3a34e6f78b9b664ca009666
CRs-Fixed: 2576362
In SME layer, boundary check for dscp_to_up_map array is not present.
The dscpmapping is an array of 0x40 elements. Values in dscp_exceptions
are used to index dscpmapping. The indices are not validated to be less
than 0x40. The dscp_exceptions array is received from association
response frame. A malicious AP can send values up to 0xff, causing OOB
write of dscpmapping array.
Hence, max index check is added to avoid OOB write of dscpmapping array.
Change-Id: I73526849677e867673fc0bd0024ed2b003e4f89e
CRs-Fixed: 2569764
Fill HE capability and supported chan width in 6ghz
and remove VHT and HT support from the 6ghz channels
in wiphy structure.
Change-Id: Ibb1fbeca9bb7dc20b8545bc9f2b470cd7bef9fb2
CRs-Fixed: 2575744
Suppose, STA first connected to AP0 then connected to AP1.
After connection HOST sends current op channel to fw as roam
scan channel map only if the current(AP1) and previous AP(AP0)
profile does not match.
Now a disconnect indication comes to STA from AP1. While processing
deauth with currently associated AP (AP1) host first deletes its
previous connection profile(AP0) and then save the current AP profile
(AP1) as prev profile and complete disconnection with AP1.
At this point of time, STA successfully disconnected with AP1 and
has info about AP1 as a previous profile.
Now STA initiates a fresh connection with AP2 and successfully
connected. In case if the profile of AP1 and AP2 match, host does not
send the current home channel to fw after connection with AP2. This
results in the unavailability of the current home channel in fw scan
channel list and FW fails to find any AP available on current
operating channels in the partial scan.
Irrespective of capabilities of current and previously associated
APs, Host should send current home channel to FW after initial
connection as well as while roaming. FW has logic to append its
channel list with a list coming from host. So send current AP
channel to firmware all the time.
Change-Id: I7942b98116c651e6b53f1134fd6cc85bc80b5354
CRs-Fixed: 2561340
Protect pktlog funcitonality under given mutex to avoid possible
race condition between pktlog_release/pktlog_open and pktlogmod_exit.
Also call pktlogmod_exit before calling wdi_event_detach to avoid
accessing freed memory in pktlog release.
Change-Id: I452af523338788447f5c2764e883165237083f7d
CRs-Fixed: 2087777
If the first addba response frame is not sent out successfully for some
corner cases, the ba_status will be always set to DP_RX_BA_IN_PROGRESS.
The processing for next coming addba request frames will be in dead loop.
Which will block finishing the addba exchanging procedure.
Add checking with the return of lim_send_addba_response_frame, if failure,
will recover the ba_status to inactive status to give chance for next
coming addba request frame.
And also use pe_err_rl instead of pe_err to avoid excessive logging.
Change-Id: Ifc6adc166b5093742b34dd7d74924f9d54146ea4
CRs-Fixed: 2579510
Currently in the driver, the NSS reported to the userspace in case of
max rate reporting doesn't take into account if the hardware mode is DBS
or not. This causes the NSS to remain 2 even if the connection has
changed to 1x1.
Add a check if the current mode is DBS or not and update the NSS
accordingly.
Change-Id: I66ea830c7c6483c7ce957e1276b4ac5a535b17df
CRs-Fixed: 2579182
Change the default value of normalize weight ini to
disable all non-PSC 6ghz channels for the SAP ACS
operation, and give weightage only to the PSC
frequencies.
Change-Id: I4c8f349a396ffe4a2f378a59f5a67036b9d573eb
CRs-Fixed: 2578824
Currently if roaming is offloaded to target, and it is a ESE capable
association, but 11r capable is not available, the Tspec configure
before roaming can't handover to new AP in host, but target has
reassociated with new AP include Tspec configure, and if want to
delete Tspec after roaming it fails to find it in lim in host.
Fix it by also enable ftHandoffInProgress flag if hit such case
Change-Id: Ie242d3c2e137c31bc5f213ea1756846f18b860ae
CRs-Fixed: 2566015
“New channel width” information is not present in CSA event
received by host. When STA processes CSA beacon & CSA action frame
and moves to new channel, “New channel width” & "new channel center
frequencies" are not applied.
Firmware adds "Channel switch wrapper IE" information in CSA event and
sets "WMI_CSWRAP_IE_EXTENDED_PRESENT" bit in ies_present_flag.
Channel switch wrapper ie elemets are parsed to get Wide Bandwidth
Channel Switch information.
Change-Id: I095c49ae5a78cbfa8947e98cc39ec647aa7f3d27
CRs-Fixed: 2571406
As part of commit id I024e03e4ac46f8118da544889de3ffd7cc67a1b4, host
has increased the no of TID'S(8 * no_of_peers_supported + num_vdevs +
2) to fix a firmware assert. This causes memory allocation issues on
some firmware branches. Due to this fix is reverted
Change-Id: I70c9436ce7dcf886d3228298931b9f9569d1fdb1
Crs-Fixed: 2581524
1. Convert channel to frequency and use frequency
Regulatory API to check DFS status.
2. Skip dfs check for 6G channels.
Change-Id: I54b6d6a3ad25c192af4eec4e7f43932bada728b5
CRs-Fixed: 2580568
To avoid conditional compilation inside function body use QDF API
qdf_set_wake_up_idle in RX thread startup api.
Change-Id: Ibe78fb19893c6a942cfbdde2f33684ea402af47b
CRs-Fixed: 2580958
In multiple NDP peer case NDP indication might come for these
peers before first NDI confirm is sent for first peer. This
results in not updating policy manager session for NDI and
not creating datapath TX pool. Fix this issue by using one
time init flag for NDI instead of relying on peer count.
Change-Id: I812ff9be46580f3fb2da03ae7e1c1a36d205c38f
CRs-fixed: 2573935
If the entry of ch power info is not locked, free after use may be
happened. For example, csr_save_to_channel_power2_g_5_g does
csr_purge_channel_power, while csr_save_tx_power_to_cfg is called
in another thread and it calls csr_ll_peek_head then does some
operation on the entry.
Change-Id: If6cc4d8e0072e97288b60d3c72499b79c0a2bf67
CRs-Fixed: 2580147
If STA is on LTE-coex channel, start SAP on same band, to force
scc, it need select the LTE-coex channel too, or SAP failed to
start.
CRs-Fixed: 2580240
Change-Id: Ib05524711cb2475c3ca5ec7cf61a2b29c05658b6
For SAP/P2P GO on 5G, when receive cmd to disable 5G band when
modem n79 band used, will move to 2G band via CSA.
1. If no active connection on 2G, select ch by safe list, or
channel 6.
2. If there is STA on 2G, force scc with it.
3. If there is SAP/GO on 2G, force scc with it.
4. Handle one race condition that if candidate is already
selected & FW has gone ahead with roaming or about to go ahead
when set_band comes, it will be complicated for FW to stop the
current roaming. Instead, host will check roam sync to make sure
the new AP is on 2G, or disconnect the AP.
5. If 2 SAP on 5G, move both to 2G and keep scc.
When Set band to enable 5G band again, restored all 5G SAP/Go..
Change-Id: I9b2b1ead3b4502022aeefc08359037457bb051f9
CRs-Fixed: 2580204
As per SS’s WIPS requirements, if Host receives beacon recv start
command while processing scan request, HOST should not process
beacon reporting start cmd.
Next start command should get allow only after completion of scan.
After scan completion, supplicant should send a fresh start command
to start BEACON_REPORTING again.
Change-Id: I8b64665b6d019cfab76eefba4f7b11fa7dd2782e
CRs-Fixed: 2578642
In FTM and monitor test modes cfg80211 suspend op is not allowed.
If OS tries to do frequent suspend in FTM or monitor mode it can
lead to excessive console logging and hence to avoid excessive
console logging and its side effects rate limit the console
logging for FTM and monitor test modes.
Change-Id: I8d51db21f861f038f0538865f4c0634efd983f8c
CRs-Fixed: 2580927
Currently if the first channel if seen in the normalize
acs weight array is found, the driver does not set the
freq present as false back, which leads to further
disabling all frequencies for SAP which should not be
the expectation.
Fix is to set the freq present as false again for the
next frequency.
Change-Id: Iabeb40179a0ef02cb51441b1148eea79b82d0ebf
CRs-Fixed: 2578551
On some platforms with TQM, target don't know packet number of
successfully transmitted after more than one retransmission attempt,
and after TQM retry, host data path will be notified.
Adjust tx retries stats number from data path, and indicate to upper
layer when query by wlan_hdd_cfg80211_get_station() on these platforms,
other platforms keep tx retries from wmi vdev stats.
Change-Id: Ie4b9a9f3b9241a59452e3f21f68757f3638b1a19
CRs-Fixed: 2574368
For hdd_hostapd_channel_allow_suspend() and hdd_hostapd_
channel_prevent_suspend() APIs, use channel frequency
instead of channel number.
Change-Id: I05a3e60918f1b40d2cbfbdb78038540fc4a87184
CRs-fixed: 2565731
If the requested info field in beacon report request is present,
the driver tries to allocate memory for the target beacon report
EIDs from the number of requested EIDs received from the frame.
In SLUB disabled builds, the qdf_mem_malloc function doesn't
validate if the size provided is 0 and returns the value
ZERO_SIZE_PTR(((void *)16)) for the pointer. When this pointer
is dereferenced, it causes invalid address dereference.
Since the number of requested EIDs is directly controlled by the
frame sent by AP, validate this value before using it to allocate
memory.
Change-Id: Icbac3e952de0d7ae3144e9b319f2c51ccdf93ac5
CRs-Fixed: 2571480
Cleanup peer id from the callers of cdp APIs from
where the peer ID was passed, and use mac address
instead to identify the STA.
Change-Id: Ie6dcae77e959439a71c11b1a2fa0daddcaa6e719
CRs-Fixed: 2529822
