Set nan_separate_iface_support flag in FTM mode to avoid
create NAN vdev in FTM mode. This helps in FTM mode test cases
where max supported vdevs are used.
Change-Id: Ia628655a87505db787043ef29dd18d259052b521
CRs-Fixed: 2888703
This reverts commit I06ea617df49287ee87e7b5bf8b20971b581dedf1
which introduced a fix to enable/disable arp offload on every
suspend/resume even if gActiveModeOffload is enabled, which is
not correct. The expectation here is that if gActiveModeOffload
is enabled, host should enable arp offload only onece and it
should not disable on any condition.
Change-Id: Ifc4ff1c0a39cc4c17e9a292ef8b0ebabd766a710
CRs-Fixed: 3147896
Dynamic GRO feature is enabled by default and aimed for specific
customers. Add an ini control to allow other customers to config
this feature enable/disable.
Change-Id: I83edd69d0e30d5944f0724ed8350328abff619bb
CRs-Fixed: 3070912
It may cause out of bound access if length exceed
SIR_MAX_BEACON_SIZE.
Add length check to protect that.
Change-Id: I6581b62aa8b380a0f1195a16515ad635a9154023
CRs-Fixed: 3147267
Reject any incoming get_all_peers TDLS command if there are any
currently in progress.
The later commands will only be processed once the earlier commands
finish, since they are processed sequentially. However, once a
command finishes, the memory allocated for it from userspace is freed
up. Each command is passed the same address so the later commands will
end up writing to a freed address. To avoid this, reject incoming
requests if there are any still in progress.
Change-Id: I6970e3b73c6ce5afc921edaaf477825928800342
CRs-Fixed: 3150044
Reduce the log level for the frequent acceptable errors
to reduce the roam latencies
Change-Id: I9f5405025948d160e6fcd65ecca05dce7670ea84
CRs-Fixed: 3150439
Make sure the parsed association request array is valid at the
association ID index, before dereferencing it. This will prevent NULL
pointer deref. There is already a check for the beginning of the parsed
assoc req array, but it is not checking at the assoc ID index.
Change-Id: Icac3b2a4a0646dec4c64a2224e3271b0842a8194
CRs-Fixed: 3147273
In case of PNO scan, If firmware supports
WMI_SERVICE_PNO_SCAN_CONFIG_PER_CHANNEL, it uses the
upper-12 bits(bit-20 to bit 32) of channel_list for
flags and lower 20-bits(bit-0 to bit-19) for frequency.
If firmware doesn't support it, then channel_list holds
the frequency value only.
Fix is to fill the flags and frequency accordingly.
Change-Id: I8473072069da4532406ce720a0070a665e29b1af
CRs-Fixed: 3103939
Reduce stack frame size of wlan_update_bss_with_fils_data()
by allocating dynamic memory to fils indication.
Change-Id: I799100558b4192f4be2eaa1fb4f9508a2cb73e66
CRs-Fixed: 3123325
Ppdu_stats are received from firmware in softirq context.
While inserting the ppdu_stats into a qdf list, a spinlock
is held for its access, same qdf list is accessed by mon
thread using spinlock. There can be a scenario in which
mon_thread held spinlock for accessing qdf_list and is
interrupted by softirq in which ppdu_stats are received.
This leads to softirq spinning for lock forever leading
to deadlock.
To address this issue, use spin_lock_bh instead of spin_lock.
Also reduce the time for which lock is taken to access the list
for insertion and removal of ppdu_stats.
Change-Id: I52171fe3c1d22a1e9d1ab36daac54d8fa2b96020
CRs-Fixed: 3136901
Since structure wmi_wlan_profile_t includes tlv header, it has
to consider the tlv header in each iteration.
CRs-Fixed: 3136374
Change-Id: I14a86ed14f616a5f1aaeabd25a81fa22d762ffe3
In SAP mode, a preauth node is added to the preauth list when
assoc rejection happens due to some reason (e.g. blacklisting
the station BSSID). But when station tries SAE authentication,
host driver doesn't add/update the entry in preauth node list
as a node with same mac address is present in the list.
Host driver relies on the flag is_sae_authenticated to decide
whether to proceed with association or go for PMKID validation.
is_sae_authenticated is set to true only when SAE authentication
is completed and the node in preauth list has type as SAE.
But the preauth node added as part of assoc reject doesn't have
this info correct, which is disallows association as
is_sae_authenticated is not set. Fixing this here is
not a right way as the auth state also to be updated
to eLIM_MLM_WT_SAE_AUTH_STATE when first SAE auth frame
is received.
So, delete the existing preauth node and create a new one when
the first SAE auth frame is received to avoid stale entries.
Change-Id: I0acd72f960ba1de2a656b55a9805561322dfffe9
CRs-Fixed: 3135389
The tx_stats array length num_entries can't be more than
param_buf->num_tx_stats from fw.
Otherwies out-of-bounds will happen when read wmi_tx_stats.
Change-Id: I7ab3c7cc7baef6d903ba6301622bd67efe52cebe
CRs-Fixed: 3104318
In P2P connect process, GO and GC send deauth/disassoc at the
end of WPS. GO send disassoc and free station info. GO receive
deauth from GC, and send cmd WLAN_SER_CMD_GET_DISCONNECT_STATS
to get disconnect stats
If GO send deauth and free peer info before receive deauth
from GC. Wlan_objmgr_get_peer return null, and peer is null.
Cmd of WLAN_SER_CMD_GET_DISCONNECT_STATS will never be
released since get_peer_rssi_cb will never be called.
And cmd will timeout, which is not expected.
If we call get_peer_rssi_cb without check, cmd will release.
Also csr_get_peer_rssi_cb will check peer is null or not.
Change-Id: I10b496526e259711a4dd7a91b7388ac79bb54fef
CRs-Fixed: 3119513
In case of connection with Hotspot 2.0 AP, Disassocition
Imminent frame needs to be forwarded to userspace, so that
user can take necessary action, like issue pop-up
notification etc.
Currently, in case of connection with Hotspot 2.0 AP,
FW/HOST does not forward disassocition imminent frame
to userspace. This causes user-space fail to issue
necessary notification(s).
Disable BTM offload in firmware if connect req has
HS2.0 IE, so that FW/HOST forward Disassocition Imminent
frame to to userspace.
Change-Id: Ica57fb7399ef21069d599a1046a7da6fbd42bb43
CRs-Fixed: 2733036
During CSA max bw is selected for SAP in STA + SAP concurrency
for non-dfs channel and SAP is tear down after 60 sec of operation
due to STA is in 20Mhz and SAP is in 40Mhz with
IEEE80211_HT_CAP_SUP_WIDTH_20_40 flag disabled.
This change is to select 20Mhz BW during CSA if channel bonding is
disabled.
Change-Id: If4ed3d9a080ed976a0f4be6704848ae4494c7bbc
CRs-Fixed: 3126074
Currently, TPCReport IE is populated for beacon2 but
is not populated for probe response. As per Table 9-34
TPC report should be present in probe response.
Fix is to populate TPC Report IE for probe response from
beacon2.
Change-Id: I1b384ef71ca99e0144374885cafcd864375a3b58
CRs-Fixed: 3128799
Currently, for gEnableNUDTracking=3 ini, if NUD failure
happens, host sends the ROAM_INVOKE_CMD to fw and start
the roam_invoke timer and after roam_timer timeout or
ROAM_INVOKE_FAIL host sends disconnect. Suppose in response,
fw sends ROAM_START and ROAM_ABORT before sending
ROAM_INVOKE_FAIL, then host stops roam_invoke timer
in ROAM_ABORT case. Due to this, in ROAM_INVOKE_FAIL host
doesn't find timer and returns failure without sending
disconnect.
Fix is, remove the roam_invoke timer stop in case of
ROAM_ABORT and add it in north and south bound disconnect.
Change-Id: I6b7790f1e59d137c1476a8ad80fc4f113e86e580
CRs-Fixed: 3132545
Currently when reo id mismatch check is done there is
possiblity of flow getting evicted same time this may
lead to false alarm. To avoid this race condition reo id
mismatch check is done under lock protection.
Change-Id: I7d3ac25ec8c806677697242a0fd3fa338c0a6ad2
CRs-Fixed: 3129761
Add numss_m1 and ru_bit_mask check before access the data in
ppet16_ppet8_ru3_ru0.
numss_m1 + 1 should not exceed WMI_HOST_MAX_NUM_SS.
ru count should not exceed 4.
Change-Id: Ide6b562dacb0592fb5c2101c0ce016570cb1dac3
CRs-Fixed: 3080599
The mainline change of change-id Idc70e8437f89cb1cf4f6d35f924085409994714a
fixes a double free issue introduced as part of
wma->target_if migration of WMI_ROAM_PMKID_REQUEST_EVENTID event handling.
But this is not applicable for legacy branches as the same migration
changes are not done.
So Reverting the double free
change in wma_roam_pmkid_request_event_handler.
Change-Id: I88d31a295398eb2ab700857260285450a8f245bd
CRs-Fixed: 3130848
Currently memory allocated for structure roam_pmkid_req_event
is freed in two places causing usage after free.
Fix is to free memory only once in
wma_roam_pmkid_request_event_handler.
Change-Id: Idc70e8437f89cb1cf4f6d35f924085409994714a
CRs-Fixed: 3064667
Add ini support to configure 6GHz active and passive
scan dwell time and send this to firmware
to be used for LFR scans via WMI_ROAM_SCAN_MODE.
Based on these values, firmware will use host sent values
else use hardcoded values.
Currently firmware uses hardcoded values to configure 6Ghz
roam scan dwell time. With this change user can configure
it using INI.
Change-Id: I90e79ad59eef7f73faa0b9dfd2d38b65aca12285
CRs-Fixed: 3116861
num_transmit_power_env of tDot11fProbeResponse should also update like
tDot11fBeacon2, otherwise default value is 0, and transmit power
envelope IE(195) will not pack into probe response template.
Fix it by updating num_transmit_power_env of tDot11fProbeResponse to
same as tDot11fBeacon2.
Change-Id: I865ba9d9ad96068c52d3d6434b113cb7662e95c6
CRs-Fixed: 2933031
