When gApAutoChannelSelection is set to 1 in ini, HOST driver ACS
runs in wlan_hdd_cfg80211_start_bss() with all the channel width,
hw mode and start and end channel parameters overridden with the
values from ini. After scan on all the channels, a weight is
assigned to all the channels based on rssi and no. of BSS present
on that channel. Weights of all the channels not present in the
scan list remains 0 as no scan happened on those channels and so
BSS count is 0 and RSSI is max. As the channel with lowest weight
is selected, channel which is not even present in scan list is getting
selected.
Assign SAP_ACS_WEIGHT_MAX to all the channels not in the scan list so
only one of the channel present in scan list gets selected after ACS
algorithm is completed.
Change-Id: Ic567c412ec7f68e2bb5d12e8e982650e56fd0488
CRs-Fixed: 2164979
Sometime data path is sending packets but ce handler have been
freed when SSR recovering.
Do txrx detach before driver free ce handler.
Change-Id: I0290cc6bf4e4087754fcdd7ae1fe058b8b2e68d2
CRs-Fixed: 2166232
Upon receiving a STA kick out event or a beacon miss event,
disable the Tx Queues immediately so that there is no influx
of packets anymore as the STA is going to disconnect further.
Change-Id: Ic6d7a3acbd8b90aec68771c1520359d39e0534db
CRs-Fixed: 2171633
This reverts I18ceba26bb6aab634da91a14cc6890a7b7bd836f. The issue
resolved by that change is addressed more appropriately by
Iaa1934594d5ffcf3b90dd2ad41bba4eb62f71119.
Change-Id: I9531c2afcf25f9a8a97eb8ec9ee90c4cf3d278a0
CRs-Fixed: 2175578
TDLS peer data structures can be cleared in WMA/WMI
peer deletion operation. So the TDLS peer may not be
available, when HDD tries to deregister TDLS
station, and it is not an error condition.
Remove the error log in TDLS sta deregister
function.
Change-Id: I72ebe12749eab2fe50011cf03b5cbad5dd1d9381
CRs-Fixed: 2171335
In function wma_populate_soc_caps, param_buf is received from the FW and
soc_hw_mode_caps->num_hw_modes denotes the number of HW mode capabilities
included under hw_mode_caps. However, the actual length of the
hw_mode_caps buffer filled by the FW is num_hw_mode_caps.
If the value of soc_hw_mode_caps->num_hw_modes is greater than
num_hw_mode_caps, then an OOB read would occur while copying the FW buffer
for hw_mode_caps.
Similarly, soc_hal_reg_caps->num_phy denotes the number of hal_reg_caps
included in the FW buffer. However the actual length of the hal_reg_caps
is num_hal_reg_caps. If the value of soc_hal_reg_caps->num_phy is greater
than num_hal_reg_caps, an OOB read would occur.
Add checks to make sure soc_hw_mode_caps->num_hw_modes is not greater
than num_hw_mode_caps.
Also add check to make sure soc_hal_reg_caps->num_phy is not greater
than num_hal_reg_caps.
Change-Id: I3accffca3fc83f7e614d8f9a5bb850733a508ff7
CRs-Fixed: 2160423
For wlan0/p2p0, connect_rpm_ctx is deinit in
hdd_cleanup_adapter.
In two cases, memleak will be detected.
1 if stop modules is triggered from __hdd_stop
turn on/off wifi, wait iface_change_wait_time
2 if stop modules is triggered from wlan_hdd_startup
when booting wifi, stay idle, wait iface_change_wait_time
As hdd_cleanup_adapter is only happens when rmmod, so it
doesn't satisfy LONU memleak detection.
Move connect_rpm_ctx from adapter to hdd_context, and
init/deinit following with module start/stop.
Change-Id: Iaa1934594d5ffcf3b90dd2ad41bba4eb62f71119
CRs-Fixed: 2169828
If there are 2 pe sessions in diff channels, e.g: P2P Go+STA,
even STA LFR2 roam to AP of same channel, pre-auth req treats
as on diff channel, but pre-auth rsp treats as same channel,
them both lim_handle_ft_pre_auth_rsp and scan complete event
handler call lim_ft_process_pre_auth_result
->lim_ft_setup_auth_session->lim_ft_prepare_add_bss_req
pftSessionEntry->ftPEContext.pAddBssReq is malloced twice,
1st is leaked.
Change-Id: Iddf083785136c75da4a06038264744313e8d4b39
CRs-Fixed: 2168890
Currently cld driver will attach RX thread to only the last perf core when
there is high t-put requirement. If some other processes are scheduled to
the last core,RX thread will be scheduled slowly. Add fix to set RX thread
CPU affinity to all online perf core to improve the RX t-put.
Change-Id: Ib5b56ddea1498df92dd09a1cbc6800cab415a3f3
CRs-Fixed: 2167475
After SAE auth completion, supplicant informs status to driver.
Add changes to handle SAE status that comes through vendor
command QCA_NL80211_VENDOR_SUBCMD_EXTERNAL_AUTH using attribute
QCA_ATTR_EXTERNAL_AUTH_STATUS.
Change-Id: I474cfe9ea049e684837133479f8b6697fef1f189
CRs-Fixed: 2029357
Add changes related to SAE auth timer to handle SAE authentication.
Start SAE auth timer of duration LIM_AUTH_SAE_TIMER_MS when driver
wants to trigger SAE authentication. If SAE authentication is not
completed in LIM_AUTH_SAE_TIMER_MS, then report failure to
supplicant.
Change-Id: I65f0cb01faa1194c133013eaea4a5d8554a045d2
CRs-Fixed: 2029357
Add changes to send authentication response frame to user space
when authentication type is SAE.
Change-Id: I0b28b7550d629d6fe9f5661538ea71687f5dd989
CRs-Fixed: 2029357
Add changes to support authentication in send mgmt path.
With these changes, supplicant/upper layer can send authentication
frame for station mode.
Change-Id: I6807f49acc9284e69c6362e07a583ff26f15edca
CRs-Fixed: 2029357
Add following changes as part of this
1. Add framework to trigger SAE using cfg80211
2. Add changes to send sae info from LIM to HDD layer.
Change-Id: Ia87088dc46ea3f75d05f42e20594dd79a97aff11
CRs-Fixed: 2029357
Add ini changes related to SAE and also changes related
to capability exchange with supplicant.
Change-Id: I8deaa124fe0c604e8777c4bffa064a2d8173661b
CRs-Fixed: 2029357
Add support for SAE AKM suites in CSR and also add support for
SAE in HDD. Also, add CONFIG_WLAN_FEATURE_SAE flag to enable/disable
SAE in Kbuild. When this is enabled, WLAN_FEATURE_SAE is used as a
feature flag for SAE.
Change-Id: I6254991afa0fd048d4f0b6f435ff630f1db04077
CRs-Fixed: 2029357
When calling ol_txrx_flush_rx_frames from rx thread, it is possible
that rx thread is scheduled out, if peer detach happens from MC thread,
after return back to rx thread, the peer may have been deleted which
causes panic.
Add ref_cnt to protect peer info and move delete peer_info_lock/
bufq_lock when finally delete peer rather than in the beginning
of ol_txrx_peer_detach.
Change-Id: I24a85de4551f93c379da59eb21a388e8eaf5f1d2
CRs-Fixed: 2164432
Check for the validity of group_id when received the htt message of
HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND from firmware to ensure the buffer
overflow does not happen.
Change-Id: I17ac9f37a1450f32fb080c3b22f6317b6238068c
CRs-Fixed: 2148610
Change band agnostic chainmask variable in hdd_config to uint8_t
because the parameter can take values 0, 1 and 2.
Change-Id: I4ea06db6031bcb98c3d3b352e175a09cd735901a
CRs-Fixed: 2171613
For STA+SAP concurrency support from GUI, first STA connection gets
triggered and while it is in progress, SAP start also comes up. Once
STA association is successful, STA connect event is sent to kernel which
gets queued in kernel workqueue and supplicant won't process M1 received
from AP and send M2 until this NL80211_CONNECT event is received. Workqueue
is not scheduled as RTNL lock is already taken by hostapd thread which has
issued start_bss command to driver. Driver cannot complete start_bss as the
pending command at the head of the SME command pending list is
hw_mode_update for STA session which cannot be processed as SME is in
WAITforKey state for STA interface. The start_bss command for SAP interface
is queued behind the hw_mode_update command and so it cannot be processed
until hw_mode_update command is processed. This causes a deadlock.
Disconnect STA interface first if connection or key exchange is in progress
and then start SAP interface to prevent this deadlock condition.
Change-Id: I2ef5fe0e3bc84e721e6a2baa0dae81c6106c5a8f
CRs-Fixed: 2171912
Enable the recently added net buf map and unmap tracking feature. This
feature is tied to MEMORY_DEBUG.
Change-Id: I2f1606447af8b022e0fb9886301fafa9a8fd334c
CRs-Fixed: 2151977
When a SSR SAP restart happens, hdd_ssr_restart_sap invokes
wlan_hdd_start_sap. In this function, IE buffers for sap_config is
allocated as part of wlan_hdd_cfg80211_update_apies and then copied
to csr_profile in wlansap_start_bss and then SAP FSM Starts the SAP.
The memory allocated for IE buffers in sap_config needs to be freed
in both SAP Start Success and failure cases without which, in case
of multiple SSRs, each time new malloc is done and will lead to
memory leak.
Free the IE buffers in sap_config in wlan_hdd_start_sap in both
SAP Start success and failure cases.
Change-Id: I43035c786444d0dfbcfaba9038a09cf345263b10
CRs-Fixed: 2168107
Currently channel avoid event is not handled, add hdd_ch_avoid_dyn_cbk
as channel change callback to handle channel avoid event.
Change-Id: I451eedf69fd5b91850ed82cf3ad8d7530e259176
CRs-Fixed: 2163673
Interface up runs in normal mode (wifi@1.0-service) and it gets
preempted by the con_mode change handler when Monitor mode is
invoked via user. Then again when the normal mode gets scheduled
after the completion of Monitor mode, it tries to access contents
freed during the con_mode change.
The execution of __con_mode_handler and __hdd_open is
synchronized with help of a mutex lock and an atomic variable
Change-Id: Ia78c225a21e2c505ffae6b16647ba8f2c661bbbd
CRs-Fixed: 2158683
TDLS operations should not be allowed, when it is disabled
through INI param.
Reject TDLS operation, if it is disabled through INI param.
Change-Id: I9ee03d84d619312f869f75327ca977534ff5bb07
CRs-Fixed: 2164148
