Currently In os_if_monitor_mode_configure API,
tb attribute is getting accessed before parsing
the data coming from userspace.
This is leading to illegal memory access.
Move tb attribute access after parsing userspace
data with API wlan_cfg80211_nla_parse.
Change-Id: Ia972ebb87e18ed82c6c3a2ff3ce2d10a4b9685b9
CRs-Fixed: 3241952
Max tx power limit is received as part of the
WMI_VDEV_START_RESP_EVENTID. Add debugs to print the
max_allowed_tx_power in host.
Change-Id: I4ca0d4a4a2a1e452b8a6a9f1c48ad52fcd2f6213
CRs-Fixed: 3167045
Currently if driver load/unload is in progress or driver is
loaded and mode change to FTM mode is issued from the sys
path, memory leakage occurs during driver unload.
To address this issue, don't change mode if driver is already
loaded or load/unload is in progress.
Change-Id: I09cacaf11d516c62de1a9699547eb01476afdc1f
CRs-Fixed: 3349217
In the current driver implementation, the default ini value of
gSoftApMaxPeers is set to 32, but for mobile devices, FW can
only support 10 SAP peers at max. Hence, change the default
value of gSoftApMaxPeers to 10.
Change-Id: I8c5a2a8422f02bb464a11d823f8528ebb88bb34c
CRs-Fixed: 3227078
This is applicable only when the roaming happens from 2.4 GHz/5 GHz
to 6 GHz AP.
The value is used to check if the 6 GHz AP to which we are roaming
(from 2.4 GHz/ 5 GHz) is better than current AP in terms of RSSI.
This checking is disabled if the value is set to zero.
Change-Id: I77f1183e1fd704dfa153841e669a20c9e75d0fe7
CRs-Fixed: 3353346
During the roam scan, if there are no desired APs found in the partial
frequency list, an immediate full scan on all the supported frequencies
is initiated as a fallback. This would include the 6 GHz PSC
frequencies by default.
This attribute allow that behavior to be modified to include PSCs only
if 6 GHz use has been detected in the environment.
Change-Id: I6dc380419f14b920737fd87cd9a487c28364563b
CRs-Fixed: 3351697
User can include/exclude the frequencies in roam full scan that
were already scanned by the previous partial scan, using the new
vendor attribute introduced as part of roam vendor command.
Host sends the configured value to firmware.
As per current implementation of roam scan, if there are no APs
found during partial scan, immediately a full scan will be
initiated as a fallback. This includes all channels that were
already scanned as part of partial scan.
This attribute controls the optimization, to exclude all channels
which are already scanned as part of partial scan.
Change-Id: Icd6381b4daadcfe32dabda131ae92e2e32f07f1d
CRs-Fixed: 3343657
User can configure roam hand-off delay value using the new vendor
attribute introduced as part roam vendor command.
This change gets the configured value and sends it to firmware.
And firmware delays the roam Hand-off (in msec) by the specified
duration to receive pending RX frames from the current BSS.
Change-Id: Ic328c077cba06532ee8ffed12cde072c816b92e0
CRs-Fixed: 3329964
Checking for roaming in progress wait on SME lock from work queue,
while the other thread who has taken SME lock wait for this
work queue to complete the execution.
To fix avoid taking SME lock while checking for roaming in progress.
Change-Id: I428bc957c276f36751cdb9a4b3337a8cc2d45f7f
CRs-Fixed: 3344013
Host checks RMF enable and robust action frame category, if both are
true then sets protected bit in mac header of management action frame.
Change-Id: I2d57c52b66ff7abd44dd02b73ad18f13fbdef009
CRs-Fixed: 3262340
DUT roams to 2 GHz channel 6 bw 20 MHz, OBSS parameters are not
initialized by lim_fill_ft_session. Later when DUT gets CSA event
to 2 GHz channel 1 bw 40 MHz, the OBSS scan command will send
invalid obss_width_trigger_interval with zero value to target.
Fix by initialize the OBSS parameters without check current AP's
BW.
Change-Id: I6f895371898fde292cde5a108a3b4fcd95836186
CRs-Fixed: 3287522
Currently, the bitmap of action frames that can wake up the
host during suspend is sent via the wmi command
WMI_WOW_SET_ACTION_WAKE_UP_CMDID. This bitmap doesn't include
DSCP action frames so currently the host doesn't wake up for
DSCP action frames when in suspend mode.
Enable wake up for DSCP action frame for runtime PM as well
as for wow mode.
Change-Id: I51ba3e8ef52755af25ed922161028dfbaccaa250
CRs-Fixed: 3262353
On reception of vendor specific action frames, host performs basic sanity
on vendor specific action frames fields and then forwards to supplicant.
Change-Id: Ib22b9a431411fff8128e461972b81b66688a0919
CRs-Fixed: 3262331
mscs_pkt_threshold - This ini specifies the Voice pkt count
threshold to Send the MSCS action frame to AP. To disable MSCS
feature in driver set mscs_pkt_threshold = 0 in ini file.
Change-Id: Ie1d8d3f3289d8f41a16f187bf9256b959019d998
CRs-Fixed: 3262346
Currently, roaming_in_progress is set during ROAM_START event from
firmware and reset after ROAM_SYNC_COMPLETE or ROAM_ABORT event.
But there can be a scenario that firmware sends ROAM_START event
followed by ROAM_HO_FAILED event which indicates that roaming is
failed to host, so roaming_in_progress flag needs to be reset at
ROAM_HO_FAILED otherwise subsequent data path related configuration
and stats request from userspace will fail as they will assume
that roaming is in progress.
Change-Id: I413359a9152de11c56125192931ab446a0dd4727
CRs-Fixed: 3308567
Assume AP1 and AP2 are SPMK APs. For SPMK AP(s), Host
should add an entry of an AP in PMK cache table like below in
two cases only:
Case 1. When DUT successfully associated with SPMK supported AP
In this case host update “is_spmk_ap” flag in PMK
table by parsing beacon of associated AP after
successful connection.
Case 2. When DUT successfully roamed to SPMK supported AP
In this case host update “is_spmk_ap” flag in PMK
table by parsing roam sync indication event.
In case of connection with SPMK AP, Host selectively deletes PMK
entry for other SPMK supported AP(s) on basis of “is_spmk_ap”
flag and maintains only one entry for all SPMK AP(s). And host
sends the same single PMK in RSO for further roaming to SPMK AP.
Initially, DUT is connected with AP2. Then Disconnection happens with
AP2 due to NUD failure. After disconnection, the upper layer sends
flush PMK requests for AP1 and AP2. Host deletes old PMK entries for
both APs. Now upper layer sends a set PMK request for AP2. Host adds
AP2 entry in PMK cache table but host does not set "is_spmk_ap" flag
in PMK table for this entry as DUT is not connected to AP2. Now host
receives a connect request for AP1 from the upper layer. DUT
successfully associated with AP1 by performing full SAE authentication.
Host adds an entry for AP1 in the PMK cache table and sets "is_spmk_ap"
flag for AP1 but fails to delete the entry for other SPMK AP(s), here
AP2, from PMK cache table. This is because of "is_spmk_ap" flag is not
set for AP2. At this point of time below is the PMK cache table entry
for SPMK AP(s): The Host PMK cache table has two entries for two SPMK
APs.
BSSID PMK is_spmk_ap flag
AP2 PMK2 0
AP1 PMK1 1
Now FW roams to AP2 using PMK1. Host process roam sync indication for
AP2 and updates "is_spmk_ap" flag for AP2 in the PMK cache table. As
Host has a stale entry for AP2 in the PMK cache table, Host sends AP2’s
PMK (here PMK2) in RSO command which firmware will use for further
roaming but roaming fails due to invalid PMK, as target SPMK AP expects
PMK1 in reassociation request.
To handle these scenarios, FW should send PMK info of roamed AP and
host override stale entry for roamed AP (if any) with roamed AP's PMK
in PMK cache table.
Change-Id: I5e46d16a64aa05469ebc389df9b638351d02a1e0
CRs-Fixed: 3313884
Firmware handles all NAN concurrencies in the platforms which
don't advertise the WMI service cabability
WMI_SERVICE_NAN_DISABLE_SUPPORT. Host takes care of the NAN
concurrency if the capability is advertised by firmware.
But there can be some legacy targets where firmware wants to
offload NAN+TDLS concurrency alone to the host and it takes care
of rest of the concurrencies. This is to make NAN of higher
priority and disable TDLS when NAN is active. Currently, TDLS is
of more priority than NAN and it can't change the order as it
can't disable TDLS to change the priority.
Currently, driver doesn't parse the NAN messages(even NAN enable
request) in such platforms. Parse the NAN messages and disable
TDLS upon NAN enable request. Rely on NAN state machine to
allow/disallow new TDLS requests. This needs NAN enable status.
Change-Id: Ie9c7c1cc2f1ed6328a31b93077c2928940fc3450
CRs-Fixed: 3263730
Currently if driver suspends all the components and after that
if host suspends fails it does not resume all the suspended
components which leads in failure of the operations from these
components.
In current issue driver suspends all the components and it
fails to suspend dp rx refill thread and because of which host
suspend fails. Driver suspends scan component as well as part
of all component suspend which is leading scan requests failures.
TO address above issue, resume all components in case of suspend
failure.
Change-Id: I693049a0c4089eb440f459ed3a066e741e8594fe
CRs-Fixed: 3311567
In LL Stats request handler the rx_ampdu is wrongly printed as
tx_ampdu. Rectified the debug log to print both the tx_ampdu
and rx_ampdu.
Change-Id: I00df3da79a0aed95cda76edb7e3f80409c6abf75
CRs-Fixed: 3254595
Roam invoke is triggered from userspace using bssid and channel
of the target AP. Therefore, use only the bssid and channel
specified by the userspace to retrieve the roam candidate.
Change-Id: I61d156cdd19925ba83ccf49723ed7b8d49eea3d1
CRs-Fixed: 3295815
For every random mac addr set/clear command to firmware,
driver gets reply from firmware whether success or fail.
But sometimes, if the response event is delayed by more
than 100ms by firmware then timeout happens in HDD.
Upon timeout, driver sends clear random mac command which
gets dropped in p2p_process_set_rand_mac API as prev command
status from firmware is pending.
So fix is to increase the timeout value to 1000ms
Change-Id: Icf4240265bac67e0fd3eaf2d904a597b4bfe2e25
CRs-Fixed: 3297401
Currently in packet capture, channel for data packets is updated
from pdev. We are updating channel in pdev when we receive auth
frame in mon thread. But, sometimes we are updating channel in
radiotap of M2 in pkt_capture_update_tx_status, before mon thread
process auth packet and update channel in pdev, because of which
we are updating wrong channel in M2.
So, to avoid this move update of channel from mon thread to
pkt_capture_mgmtpkt_process.
Change-Id: Icf14c4331849ad7cfdfbd7a3043e4e4dc3d33721
CRs-Fixed: 3266890
