Currently in function extract_peer_stats_count_tlv,
num_peers is copied directly to wmi_host_stats_event
structure without any validation which may cause
out of bound issue if num_peers provided in fixed
param becomes greater than actual number of peer
stats info.
Fix is to validate num_peer_stats_info before populating
stats_param->num_peer_stats_info_ext.
Change-Id: Icfb1c4fd34d3ec9120064e14bb65e35f8539f7fd
CRs-Fixed: 3032139
rem_len is calculated based on MAX size of the WMI message
(WMI_SVC_MSG_MAX_SIZE) while extracting data from
WMI_ROAM_STATS_EVENTID event data.
Correct this by considering the actual message length
received in the event.
Change-Id: If24f732a8fdc0ad403e9b8a936ff8cfa0b7f7737
CRs-Fixed: 3035196
Don't delete monitor interface while STA interface is getting down,
instead de-register packet capture callbacks and register back
when STA interface is UP again.
Change-Id: I42ea39ec619c08d99fa5ba287be20249e2b2582f
CRs-Fixed: 3013758
Add ini configuration to limit supported TX/RX HE MCS rates.
In case of XR use-case, higher throughput is not needed but
higher reliability is expected. So, this ini provide option to
limit HE MCS rate capability to MCS0-7 to achieve higher reliability.
Change-Id: Id6343f5b28d341e5ee377d11ad8420e3b8ded6ef
CRs-Fixed: 3033342
bss_descriptor->length is calculated as:
bss_desc->length = ie_length + sizeof(*bss_desc) -
sizeof(bss_desc->len)
In csr_parse_bss_description_ies(), the bss_desc length is
validated as below to return failure if ie_length is 0:
=> (bss_desc->length - sizeof(bss_desc->len)) <= ieFields_offset
Since the bss_desc->length already has the sizeof(bss_desc->len)
subtracted while it was populated.
So this could return failure, if the SSID IE length is less than
or equal to 4.
To avoid this, change the failure condition as below:
(bss_desc->length <= (ieFields_offset - sizeof(bss_desc->len))
Change-Id: Ib0af8e967c26ff0ca9a3b8c44107be4e80378e01
CRs-Fixed: 3022657
Add debug print to log the details sent in OCV frame
in SA query Response.
Also, remove additional line to print mac address of
peer.
Change-Id: Ia2114b69579d118b0ccc4fe9798caf2f855c895f
CRs-Fixed: 2860085
CFR only works when DUT as STA and connected to AP. But, host doesn't
stop CFR if CFR started and disconnect to AP. So add this change to
stop CFR once get disconnection event.
Change-Id: I5a616dbe4c35311fb260514a8d33ed9a1361c514
CRs-Fixed: 3026715
Currently, the SAE authentication request retry happens
after a fixed timeout of 1 second in a STA DUT.
To make this timeout user configurable, add an INI to
configure SAE auth failure timeout.
Change-Id: I3a3944ab14564a944e0c83cc31a92847b5e8c5e0
CRs-Fixed: 3011892
Currently during SAE roaming, if the DUT exhaust SAE retries
(i.e. DUT doesn't receive SAE auth confirm/commit response even
after max retries), host driver stops retrying and cleans up the
internal counters/frame. But, the failure is not notified to firmware.
So, firmware may go out of sync. Therefore, Notify the failure to
firmware through WMA_ROAM_PRE_AUTH_STATUS in such cases. So that,
firmware can abort roaming.
Change-Id: Ic769dcabc15c1052f5d7d43f3ef754dd7b7c1f40
CRs-Fixed: 2981666
Add support for sending WMI_REQUEST_THERMAL_STATS_CMDID
to request for the thermal stats via vendor cmd:
QCA_WLAN_VENDOR_ATTR_THERMAL_CMD_TYPE_GET_THERMAL_STATS
This vendor cmd can either be used to clear the thermal
stats or to request for the thermal stats.
Added ini gThermalStatsTempOffset, which can
configure thermal temperature offset value for capturing
thermal stats in thermal range such as Thermal STATS
starts capturing from temperature threshold to temperature
threshold + offset.
If this ini is set to 0, then the events are disabled.
Also, add support for the FW event where the requested
thermal stats are sent in FW event
WMI_THERM_THROT_STATS_EVENTID().
The following attributes are sent in the events for every
level:
STATS_MIN_TEMPERATURE
STATS_MAX_TEMPERATURE
STATS_DWELL_TIME
STATS_TEMP_LEVEL_COUNTER
Change-Id: If8acdeec5bde33be346332ccaf39d78d0151203d
CRs-Fixed: 3016818
Ideally we should deinit in reverse order of init so we
should Unsubscribe in reverse order of subscription in
packet capture component.
Change-Id: Icb62a14c2d1fd20073f6924d03d523b7871c62d6
CRs-Fixed: 3019862
Currently, nss is not filled for tx data packets. Fill the
last received nss from ppdu stats in the tx status in pkt
capture mode.
Change-Id: I1833be5e19eaba4e88befe9970f079b91ec4bbe4
CRs-Fixed: 3004484
Ppdu stats related to transmitted msdu are received from
firmware and queued to a list. Remove the received ppdu stats
from front of list and fill in tx status of current msdu.
Change-Id: I764aa909497971010202ce3decb3380a732ce12c
CRs-Fixed: 3004483
WDI_PKT_CAPTURE_PPDU_STATS event is sent when packet capture
related htt ppdu stats tlv is received from firmware.
Register for WDI_PKT_CAPTURE_PPDU_STATS wdi event and add
logic to insert received ppdu stats to a list.
Change-Id: Ie78cf4b161c90a0bcf514a3e71a82c3c3e358c24
CRs-Fixed: 3004480
Register for WDI_EVENT_PKT_CAPTURE_RX_DATA_NO_PEER in packet
capture mode and add logic to parse it. This wdi event
delivers rx data packets to packet capture component which are
received before peer is mapped in host, mostly in roaming scenario.
Change-Id: Ia718293c97dd11de6aab5a739683eec38e7e057b
CRs-Fixed: 3000153
Currently driver does not check the mode of the current interface
whether it is STA of CLI and it caches the connection info, in this
process it allocates the memory to cache he operation, this memory
get freed only for station type adapter because of which there is
a possibility of memleak for CLI interface.
To avoid above issue, add a change to only cache the information
STA interface.
Change-Id: Ic68d71dfd9887600fe1a287de66d735c2c802491
CRs-Fixed: 3028583
Afte DUT sta connected, when sme_get_rssi_snr_by_bssid is called to get
RSSI of current AP, only bssid is needed in scan filter.
If freq list, security are added into scan filter, can't get any scan
result and AP RSSI.
Change-Id: If96edc8768a6b2c8d729afcf479c84339517468e
CRs-Fixed: 3029559
For STA connection in HE 160, HE160 MCS is validated
during the session creation. If the HE160 is invalid,
the connection falls back to 80MHz. But, this check needs
to be bypassed for SAP, because during session creation SAP
will not have the peer capability, so the HE160 MCS validation
needs to be bypassed.
Change-Id: I3bbb2f35c40a123b5d05a94038970a0e7e43ac60
CRs-Fixed: 3025102
In sap_goto_starting(), update phymode and channel width
correctly incase there is mismatch between phymode
and operating channel frequency.
For instance, in case when operating frequency is in
5 Ghz band, phymode 11g is incorrect and should be
changed to 11a. Also, if phymode is 11a for 2.4 ghz
band, it should be changed to 11g.
Also, if phymode is of legacy type such as 11a or 11g,
channel width should be restricted to 20 Mhz.
In case of 11n, channel width should be restricted to
40 Mhz, if it is more than that.
Also, update the width from vdev as if not updated
there can be a case where there are different bw
in vdev and sap context.
Change-Id: I3df06c0f5bb0f4eb5ffc77317efbeaa88d998427
CRs-Fixed: 2976056
This change removes the "delete pmksa on BMISS" logic in commit
I5d8ec9e9d4f8a44178b113d370799fe2bc0373fb.
Will handle the issue in new commit by OUI checking of AP.
Change-Id: I871999f8c473afdc75b774210044fc059fcd07b0
CRs-Fixed: 3021068
The PER default low rate thresholds configured is 20Mbps. This
will cause PER roam scan always after the 25 secs PER monitor
window since the 11b rates are lower than 20Mbps.
So disable PER roam when the connection/roaming to peer is with
cckm/OFDM rates to avoid frequent roam scans.
Change-Id: Iaae469804547c0f0682b66de3609b5cda4b4b577
CRs-Fixed: 2984973
When the connect request is pending on MLME and NB disconnect comes,
driver will wait for previous connect finish to process the disconnect
request. This delay the disconnect and may cause framework ANR.
Add code to fire the timeout event of active timers in various MLME
state. This will abort the connect request and get disconnect done fast.
Change-Id: I19cc03108c966c8f1efc0a554dfc59123dfe37f1
CRs-Fixed: 3026311
In ucfg_twt_get_all_peer_session_params peer reference is
acquired and its not released leading to the reference leak,
leading to vdev destroy timeout.
Release the peer reference to resolve the issue.
Change-Id: I9992376473c30365f15fcdb8e374c856bc169d6b
CRs-Fixed: 3027189
