In STA+SAP concurrency, when the STA connection is in progress or set_key
is in progress, the set_hw_mode command to SME is queued and would be
processed only after the connection is complete. Meanwhile, when a stop
SAP is received and SAP Dissassociate STA is triggered from HDD, the
command is queued in SME and cannot be processed until STA connection
is done. The add_key command from the supplicant is also stuck as the
previous stop_ap command is in progress leading to a deadlock. When the
AP sends deauth to the STA due to 4 Way Handshake failure, the STA is
reset and then the stop SAP command proceeds, followed by another
connection for the STA.
Disconnect STA interface first if connection or key exchange is in progress
and then stop SAP interface to prevent this deadlock condition.
Change-Id: I23ad1fc96882abeaae2d1b051659ea6d24b07428
CRs-Fixed: 2187070
p2p component has no 11w mgmt protection
information for tx frame.
Add LIM callback to register to p2p
module, to provide mgmt protection information.
Change-Id: Ibdb26d2ebbf51c191258c163cd45290ee5d4fccf
CRs-Fixed: 2172228
FW assert is observed when deleting VDEV due to there are peers
not deleted.
Add check for peer number in FW before sending delete VDEV
command to avoid such issue.
Change-Id: I4cc5d4c63faf3dc8f7b9d0702f92b54b298802cb
CRs-Fixed: 2163770
Currently we fail channel switch if new channel matches old channel. So it
dosnot take into account of mode switches HT20/HT40/VHT80.
So process channel switch request if either channel or mode is different.
Change-Id: I8743a6292277daad8b1bf38b79c236f19fbac700
CRs-Fixed: 2186212
Move wma_get_buf_start_scan_cmd logic to common code in
ucfg_scan_update_params.
Change-Id: Iaee8ab5b7f0c20867bf37db7509b1c1fab23579d
CRs-Fixed: 2180959
STA peer can be cleared from peer detach and HDD. If the
peer is cleared by peer detach, then return success to
HDD request.
Change-Id: I7aa564e7f2a1c9ce336ae96679d93a6e11703c37
CRs-Fixed: 2181163
When wiphy is registered with kernel, the kernel call the regulatory
notifier with the last request cached by the kernel. The last request
is initialized to world mode. So for the first time registration,
ignore the kernel callback.
Change-Id: I8c6070eebac4c04145e51daaecb7745f331f58b1
CRs-Fixed: 2174245
Currently driver created reg database instead of
db.txt for reg no-offload case.
Change-Id: Ia7853679532ad7536d34b4a4040feffb8566e907
CRs-Fixed: 2174245
The TX buffers in the vdev->ll_pause pending queue, which haven't mapped
the physical address.
Adding nbuf physical address checking to avoid the mis-matching unmap
especially when the MEMORY_DEBUG is enabled.
Change-Id: I6b0fcd1c7d07ca358d07b9931dea321ee8c6169a
CRs-Fixed: 2183678
qcacld-2.0 to qcacld-3.0 propagation
Currently driver sends beacon report for each channel recursively
in beacon table mode. There is a chance that variables on stack
can exceed allocated stack size which can lead to corruption of
stack. Remove unnecessary variables which are not required for
beacon table mode to fix this issue.
Change-Id: I9aa35e7da916f5d4c6380862d292b44c254c9334
CRs-Fixed: 2184037
As part of convergence the mode capabilities
are extracted and saved in the target info structure.
Update the hardware mode list and pcl from the converged
structures.
CRs-Fixed: 2179003
Change-Id: I3cfc28533448c312913db3bead5d5322386f3f74
When channel list contains all channels from channel 1 to channel
165 and ch width is 80MHz, the channel to be selected as part of
ACS algorithm should be a 5GHz channel as 2.4GHz channels does not
support 80MHz but 2.4GHz channel gets selected with channel
width as 40MHz. Similarly when ch width is 160Mhz, the 160Mhz bonding
can be made only by 36-64 and 100-128 channels but 2.4Ghz channel or
some other 5Ghz channel gets selected as a result of ACS algorithm.
Assign max weight to all the 2.4GHz channels in 80Mhz and to all 2.4 Ghz
channels and 5Ghz channels not in the range 36-64 and 100-128 in 160 Mhz
so that only a valid channel is selected after the ACS algorithm is
completed.
Change-Id: I00c40e5d000a1cf8b79397fd4e361838a60b363d
CRs-Fixed: 2182011
Remove panic after peer_delete timeout and fail corresponding peer
operation. Peer reference count can be taken by kworker thread which
may get pre-empted by other higher priority threads or stuck, leading
to delay in releasing reference. This delay cannot be completely
removed, hence rather than panic after timeout, enhance logging and
fail corresponding peer operation.
Change-Id: I42c379c0cf91d29d293c3c53c3a378421aef07f9
CRs-Fixed: 2181097
Add DBS check for all chain mask programming. Currently the check
is present only for band specific chain mask parameters.
Change-Id: I415a8e8f666961b90d1cd9130b3c33eecb62c1df
CRs-Fixed: 2184255
In __wlan_hdd_cfg80211_do_acs(), when gAP11ACOverride is 1,
it sets vht_enabled to 1, hw_mode to 11ac and acs_cfg->ch_width
to the value of ini gVhtChannelWidth. If acs_cfg->end_ch is less
than 14 and acs_cfg->ch_width is 80Mhz, set acs_cfg->ch_width to
40Mhz. As acs_cfg->end_ch is not assigned yet, it is 0 due to
which acs_cfg->ch_width gets assigned to 40Mhz.
Assign acs_cfg->end_ch before use when gAP11ACOverride is 1 in
__wlan_hdd_cfg80211_do_acs().
Change-Id: If8bcc7470c1693791dfc64ec0b6059c09747d739
CRs-Fixed: 2184017
Destroy the node when modules transition from opened to stopped.
Otherwise duplicate creation of node can lead to warning.
Change-Id: Ib1031cfa0572962454b293730fefd7a4b4cf8d09
CRs-Fixed: 2180344
Reverts Change-Id: I1e31ff122f9337c353d8be260b4802cc363790d6
Revert this change until the dependent kernel is change is
merged
Change-Id: Iad0b39f990a840c7901815932b8b5aa2c4c67c95
CRs-Fixed: 2186005
HT MCS index returned by wma_get_mcs_idx function is
between 0 and 7 for both nss equal to 1 and 2. This
results in incorrect HT MCS index for nss 2 case
populated in station stats on using iw station dump
command.
Fix is to set the correct HT MCS index based on nss.
Change-Id: Id4ac51b56bc44e90ea0e7570b387450af83ee8f5
CRs-Fixed: 2182050
Currently, firmware sends TSPEC as part of reassoc request during
roaming in ESE case. Driver also sends TSPEC again during roam synch
propagation in driver for ESE case which is redundant. So, do not
send TSPEC again in ESE case to avoid duplicate TSPEC.
Change-Id: Ib0a18bec7762ba56061d8564b870739b2eefd123
CRs-Fixed: 2181531
Currently variable "num_flows" and "len" is used directly, from
message, without any validation which causes buffer over-write.
To address this issue add check for the num_flows and len
Change-Id: Iddf2df0fd65f5b33b54f1a608cdd34e400c0e03c
CRs-Fixed: 2148489
Currently 11k offload params is sent directly as a message from CSR to WMA
leading to timing issues where 11k offload params are sent to the FW
before RSO start is sent.
Send the 11k offload params as part of the RSO request from CSR to WMA
and handle the request to send the 11k offload WMA command to FW.
Change-Id: Icff7146171cdf325f3a7e5a067652669ec0270ff
CRs-Fixed: 2183161
Adding an ini for wmi workqueue watchdog, the ini value will
give the timeout value for wmi watchdog timer.
Change-Id: I6338351c8d788478307892152305e10186ead6cb
In PD down uevent handling, if assoc resp timeout timer is active,
the timeout API is called from kernel thread and free up the
‘pLimJoinReq’. Now if assoc resp is received in MC thread it also
access ‘pLimJoinReq’ in parallel. This leads to use after free.
To fix this post a msg to MC thread to call the timeout APIs of the
connection timers.
Change-Id: I95e0bbb91c382298e35928d602c096ea5267dbe4
CRs-Fixed: 2184590
update the max frag entry,ht,vht, rf chains from from the converged
target psoc capabilities information and remove redundant wma_handle.
CRs-Fixed: 2178922
Change-Id: I6bfe734bac85905b0d6837bffb37d286cff2a4ff
Use the converged wmi service bitmap from the
target psoc info instead extracting the same from
the ready event.
CRs-Fixed: 2178812
Change-Id: I00d61aa3cbb2a90459d4363e2ca04e297cc74187
As part of converged init deinit architecuture, all the target
capabilities are saved as part of target_psoc_info, use the same
to update.
CRs-Fixed: 2178726
Change-Id: Iad1d0224e0fdfe1140d1600e17f3e585142eaf63
If wma_send_msg with msg_type WMA_SET_LINK_STATE_RSP, tpLinkStateParams
params has a member callbackArg which is malloc from heap. If this
message is flushed when driver unload, because no msg.flush_callback is
supplied, the flush just free msg->bodyptr and callbackArg got leak.
Fix it by supply a flush_callback as wma_discard_fw_event, and minor
change to avoid NULL pointer access.
Change-Id: Ie979a1e83cbd7c87e5bbb08382ae2af3230a13db
CRs-Fixed: 2181458
If hdd_ipa_init failes, driver cleanup is done. But return value
of hdd_ipa_init is not saved and returned to caller. This will
lead to wrong behaviors if following actions depend on the
return value.
Fix is to save return value of hdd_ipa_init.
Change-Id: Iad10733c8fcb7049aa9573ccd1da51250aa7fddf
CRs-Fixed: 2181510
