Scenario: In case of STA + STA, NB/SB issues disconnection for
vdev 0 when vdev 1 is in connecting state.
As connection is blocking serialization command and it can try
multiple candidates and can take upto 30+ sec, there is a
chance that disconnect may get timeout and is followed by
vdev delete from osif. This can lead to vdev delete sent
without vdev down/stop and bss peer delete for vdev 0.
So abort connection when trying for candidate if any of the
vdev is waiting for disconnect, to avoid disconnect timeout.
Change-Id: I876550532524767e811c9fd03e85e16d6a90b940
CRs-Fixed: 3049934
Add bound check before access array to avoid out of bound issue.
Separate array bound and duplicate check of 11a and 11b since they have
different length and type.
Change-Id: Icb9382cd42385339532518759de0f6137c5203bd
CRs-Fixed: 3051517
Currently, failure in csr_roam_synch_cb is not handled, therefore
failure during roam sync indication processing in CSR, leads to
out-of-sync between LIM and CSR sessions.
Handle the failure in csr_roam_synch_cb, by aborting the
roam complete notification to FW, and then process HO failure from
FW to cleanup LIM and CSR which will hold different BSSID profile.
Use vdev id instead of BSSID to retrieve/delete the LIM session.
Change-Id: I5ff2280e7ba1a8cb8e44c0c6b70647bf12b6ef31
CRs-Fixed: 3046370
Currently pdev_id is not initialized after ssr for thermal throttle
reconfig, Where host is sending vdev id as 64 which is leading to
firmware crash.
Hence initialize pdev_id to 0.
Change-Id: Ic614a382acb4f598c52948bcca1cd24f9754ad94
CRs-Fixed: 3041238
Add the support to the vendor command
QCA_NL80211_VENDOR_SUBCMD_SET_MONITOR_MODE which aims to configure the
monitor mode parameters for the specific interface.
Once enabled, the configured frames ( TX and RX ) are sent over the
active coexisting monitor interface.
Change-Id: Ieb01d5f928d4e414f46bd00524ad683ad889963e
CRs-Fixed: 3025473
Some IoT AP may have duplicate rates in supported rates and
extended rates in beacon, need filter them when populate peer 11a/11b
rates during connect/roaming, or array out of bound issue will happen.
Change-Id: I685e8c07ee147296bfa22742dad4210e7fa02c4a
CRs-Fixed: 3048142
Currently, packet capture mode frame filter configuration
is done based on ini. This change enables user to set the
packet capture mode frame filter configuration at runtime
through vendor command
QCA_NL80211_VENDOR_SUBCMD_SET_MONITOR_MODE.
Change-Id: Ifd40a9295394324b0cde4ff15bb55ea77851a6bc
CRs-Fixed: 3046091
if g_sta_sap_scc_on_dfs_chan is 1, SAP can't start on DFS channel except
there is STA/P2P client on it.
When SAP start alone, when select SAP channel after ACS, need remove DFS
channel correctly by valid check.
Change-Id: Ie500816bb0aeae3efd18767e64901bf19bedd6fc
CRs-Fixed: 3036095
Currently in unpack_tlv_core(), nBufRemaining is validated
after calling framesntohs API. Since, framesntohs() copies
pIn address to pOut address with length = 2 bytes as below.
DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2);
which could cause OOB issue if pIn contains less than 2 bytes.
Fix is to validate the nBufRemaining size before calling
framesntohs().
Change-Id: I3ead03ec948282a410ddba5b01f82ca31d3d9199
CRs-Fixed: 3042282
OFDM and CCK flags should not be set based on frequency. These
flags are already filled in pkt_capture_rx_get_phy_info based
on preamble.
Change-Id: Ie809ee2e3546ed69bedab12d73d408b379d6b73d
CRs-Fixed: 2965290
Currently average rssi is filled in rx packets as rssi not
available in rx tlv, but now ucode is providing rssi value
in rx tlv so do not fill average rssi as rssi is already
filled from rx tlv in packet capture component.
Change-Id: I67e5e4cf6f0eade0640012802d79fe92b87de001
CRs-Fixed: 3022166
Currently in function extract_peer_stats_count_tlv,
num_peers is copied directly to wmi_host_stats_event
structure without any validation which may cause
out of bound issue if num_peers provided in fixed
param becomes greater than actual number of peer
stats info.
Fix is to validate num_peer_stats_info before populating
stats_param->num_peer_stats_info_ext.
Change-Id: Icfb1c4fd34d3ec9120064e14bb65e35f8539f7fd
CRs-Fixed: 3032139
rem_len is calculated based on MAX size of the WMI message
(WMI_SVC_MSG_MAX_SIZE) while extracting data from
WMI_ROAM_STATS_EVENTID event data.
Correct this by considering the actual message length
received in the event.
Change-Id: If24f732a8fdc0ad403e9b8a936ff8cfa0b7f7737
CRs-Fixed: 3035196
Don't delete monitor interface while STA interface is getting down,
instead de-register packet capture callbacks and register back
when STA interface is UP again.
Change-Id: I42ea39ec619c08d99fa5ba287be20249e2b2582f
CRs-Fixed: 3013758
Add ini configuration to limit supported TX/RX HE MCS rates.
In case of XR use-case, higher throughput is not needed but
higher reliability is expected. So, this ini provide option to
limit HE MCS rate capability to MCS0-7 to achieve higher reliability.
Change-Id: Id6343f5b28d341e5ee377d11ad8420e3b8ded6ef
CRs-Fixed: 3033342
bss_descriptor->length is calculated as:
bss_desc->length = ie_length + sizeof(*bss_desc) -
sizeof(bss_desc->len)
In csr_parse_bss_description_ies(), the bss_desc length is
validated as below to return failure if ie_length is 0:
=> (bss_desc->length - sizeof(bss_desc->len)) <= ieFields_offset
Since the bss_desc->length already has the sizeof(bss_desc->len)
subtracted while it was populated.
So this could return failure, if the SSID IE length is less than
or equal to 4.
To avoid this, change the failure condition as below:
(bss_desc->length <= (ieFields_offset - sizeof(bss_desc->len))
Change-Id: Ib0af8e967c26ff0ca9a3b8c44107be4e80378e01
CRs-Fixed: 3022657
Add debug print to log the details sent in OCV frame
in SA query Response.
Also, remove additional line to print mac address of
peer.
Change-Id: Ia2114b69579d118b0ccc4fe9798caf2f855c895f
CRs-Fixed: 2860085
CFR only works when DUT as STA and connected to AP. But, host doesn't
stop CFR if CFR started and disconnect to AP. So add this change to
stop CFR once get disconnection event.
Change-Id: I5a616dbe4c35311fb260514a8d33ed9a1361c514
CRs-Fixed: 3026715
Currently, the SAE authentication request retry happens
after a fixed timeout of 1 second in a STA DUT.
To make this timeout user configurable, add an INI to
configure SAE auth failure timeout.
Change-Id: I3a3944ab14564a944e0c83cc31a92847b5e8c5e0
CRs-Fixed: 3011892
Currently during SAE roaming, if the DUT exhaust SAE retries
(i.e. DUT doesn't receive SAE auth confirm/commit response even
after max retries), host driver stops retrying and cleans up the
internal counters/frame. But, the failure is not notified to firmware.
So, firmware may go out of sync. Therefore, Notify the failure to
firmware through WMA_ROAM_PRE_AUTH_STATUS in such cases. So that,
firmware can abort roaming.
Change-Id: Ic769dcabc15c1052f5d7d43f3ef754dd7b7c1f40
CRs-Fixed: 2981666
Add support for sending WMI_REQUEST_THERMAL_STATS_CMDID
to request for the thermal stats via vendor cmd:
QCA_WLAN_VENDOR_ATTR_THERMAL_CMD_TYPE_GET_THERMAL_STATS
This vendor cmd can either be used to clear the thermal
stats or to request for the thermal stats.
Added ini gThermalStatsTempOffset, which can
configure thermal temperature offset value for capturing
thermal stats in thermal range such as Thermal STATS
starts capturing from temperature threshold to temperature
threshold + offset.
If this ini is set to 0, then the events are disabled.
Also, add support for the FW event where the requested
thermal stats are sent in FW event
WMI_THERM_THROT_STATS_EVENTID().
The following attributes are sent in the events for every
level:
STATS_MIN_TEMPERATURE
STATS_MAX_TEMPERATURE
STATS_DWELL_TIME
STATS_TEMP_LEVEL_COUNTER
Change-Id: If8acdeec5bde33be346332ccaf39d78d0151203d
CRs-Fixed: 3016818
Ideally we should deinit in reverse order of init so we
should Unsubscribe in reverse order of subscription in
packet capture component.
Change-Id: Icb62a14c2d1fd20073f6924d03d523b7871c62d6
CRs-Fixed: 3019862
Currently, nss is not filled for tx data packets. Fill the
last received nss from ppdu stats in the tx status in pkt
capture mode.
Change-Id: I1833be5e19eaba4e88befe9970f079b91ec4bbe4
CRs-Fixed: 3004484
Ppdu stats related to transmitted msdu are received from
firmware and queued to a list. Remove the received ppdu stats
from front of list and fill in tx status of current msdu.
Change-Id: I764aa909497971010202ce3decb3380a732ce12c
CRs-Fixed: 3004483
WDI_PKT_CAPTURE_PPDU_STATS event is sent when packet capture
related htt ppdu stats tlv is received from firmware.
Register for WDI_PKT_CAPTURE_PPDU_STATS wdi event and add
logic to insert received ppdu stats to a list.
Change-Id: Ie78cf4b161c90a0bcf514a3e71a82c3c3e358c24
CRs-Fixed: 3004480
