Currently if disconnet is triggered from the supplicant, RSO Stop
is sent with reason REASON_ROAM_STOP_ALL and this sends roam_scan_mode
as 0 to the FW.
However, if disconnect is triggered from the LIM/FW, the RSO Stop
is sent with reason REASON_DISCONNECTED and leads to roam_scan_mode
being sent as 4 which does not disable RSO in the FW.
In STA+STA scenario where vdev0 receives a disconnect from LIM,
RSO is not stopped for vdev0, however driver goes ahead to enable
RSO for vdev1, which leads to FW assert.
Send roam_scan_mode as 0 for RSO Stop command with REASON_DISCONNECTED
also.
Change-Id: Id2147653ecbd91e033f42382aa00a717d280f6e6
CRs-Fixed: 2266778
Currently fw_peer_count for HO failure is done in wma_roam_ho_fail_handler
which can lead to improper reset of the fw_peer_count if a HDD triggered
disassoc is in progress for the same peer leading to fw_peer_count going
to -1.
Reset the fw_peer_count for HO failure case in wma_delete_bss_ho_fail
API as this is called from the CSR/LIM for handling HO failure as
part of CSR disconnect.
Change-Id: I1526757b085086ca51eef9b9cca0ea757ed20b61
CRs-Fixed: 2266337
While processing get_station cfg operation, HDD is using Nss
value, which gets updated during association, to calculate data
rate. So, there is a possibility of driver to report invalid
MCS index to upper layer if association happens with Nss 2 and
when data transmission is happening at Nss 1 rate.
On receiving GET STATS response, calculate Nss value based upon
the current data rate received from firmware, and pass it to HDD,
so that HDD can use the same Nss value to report valid MCS index
to the upper layer.
Change-Id: I62f029d53149a4747f619027ce69ce65fb280b8d
CRs-Fixed: 2250993
In wma_is_ccmp_pn_replay_attack peer is used without taking the ref
count and thus this can lead to peer used after free.
Fix this by taking ref of peer before using the peer in
wma_is_ccmp_pn_replay_attack and release ref once access is done.
Change-Id: Iaa5936a1c7f6f8667a68fcb646eaec4cb3aa5469
CRs-Fixed: 2264434
Make sure to follow AP for NDI self peer creation so that self peer
creation and deletion can be symmetric.
Change-Id: Ie7f9c7b5500540c824a75758337967f8d4f6e692
CRs-Fixed: 2261713
Send dfs offload enable command to firmware if phyerror offload
service bit is enabled.
Change-Id: If84164ae6dec8585e5895ee526750df5b15c201f
CRs-Fixed: 2264638
Parse the association response frame to read the
peer TWT extended capabilities and fill them in
the WMI PEER ASSOC command and send it to the
firmware.
Change-Id: I07f21010abbdaa20e212abae127009dd11e6ab7d
CRs-Fixed: 2264690
Hardware capability logs in WMA are currently logged at info level. To
avoid spamming the console logs, reduce these logs to debug level.
Change-Id: I57c9a3712bde728695ef79aab495a429b8ef79e4
CRs-Fixed: 2265455
Currently the driver creates and deletes the objmgr peer
in HDD layer. According to the latest requirement, the CDP
peer create/delete needs the pointer of objmgr peer, which
thus has to created before CDP peer create, and deleted
after CDP peer delete, which is done in WMA layer.
Remove the objmgr peer create/delete from HDD, and move it
to the WMA layer.
Change-Id: I5bd62a83864e09a3728109e2deec2adf4bb899b5
CRs-Fixed: 2264892
Currently while going to suspend, dtim parameters are not
correctly getting configured. Some other parameters to config
like the inactivity timeout are completely skipped as well.
Cleanly port the setting of dtim and other parameters during
suspend and resume.
Change-Id: Ic41a8ace3f5650e53f2dcaa416bfe241b87aa88d
CRs-Fixed: 2248160
currently some HE capability is shared same value from
MIN value of 2G and 5G capability, separate them per band.
Change-Id: I37831b4044d4ca2deaf5015fb44227c824996136
CRs-Fixed: 2239070
Android Packet Filter 3.0 requires the framework to be able
to read and write into the APF work memory in the Firmware.
It also requires to be able to enable or disable the
interpreter.
Add support for the new read/write/enable/disable operations.
Change-Id: Ic72243b918f4a8385a92b803a1ca3c5305423b52
CRs-Fixed: 2184969
The function sme_reset_passpoint_list, posts the wma message
WMA_RESET_PASSPOINT_LIST_REQ. This message is freed at the
sme_reset_passpoint_list in case of failure. But for the success
case, the req_msg is not freed at wma_mc_process_msg. This
results in mem_leak in case of success case.
Free the req_msg at wma_mc_process_msg after returning from the
call wma_reset_passpoint_network_list.
Change-Id: Ib4b427a8acc2d531ac9d6e8f92a30205163ec0ba
CRs-Fixed: 2259237
Add the compilation flags for TWT feature to Kbuild.
Based on the compilation flag, include the source
files for compilation and also include the header
files path.
Change-Id: I45991b3c9e49e2aa0ff51a2650fde69ea447bf15
CRs-Fixed: 2238302
Process the TWT enable complete event sent by the
firmware after enabling TWT.
Set the appropriate state for TWT so that it can
be used later to check if TWT is enabled or not
in the target.
Change-Id: I924387d6afc2bf80efec0fce36ea907c6932dcda
CRs-Fixed: 2238302
Read the target service capabilities for TWT requestor
and TWT responder and update them in the driver.
Change-Id: I78879eb8ff4bf47eabd81cd8d07459b810fb7d7e
CRs-Fixed: 2238302
Send the WMI_TWT_ENABLE_CMDID command to the target if the target
supports any one mode out of requestor, responder or broadcast mode.
Change-Id: I7ab21fff89e7c88bf951b333d7a923857f2123d6
CRs-Fixed: 2238302
Introduce new WNI items for TWT as follows:
WNI_CFG_TWT_REQUESTOR
WNI_CFG_TWT_RESPONDER
WNI_CFG_BCAST_TWT
Based on the INI configuration and target support, enable
or disable the TWT services in the WNI CFG database.
Change-Id: Id1b239e53f30f00220e0cefb541fc641a898e712
CRs-Fixed: 2238302
If wma_remove_peer() fails to remove peer and send PEER_DELETE command
to fw, it will cause issues afterwards and asserts at random places
that would be misleading.
Assert in wma_remove_peer() if peer remove fails.
Change-Id: I97a4b72c359a4e2322c9c499d01f21a4d287e8fd
CRs-Fixed: 2252886
The tSirRetStatus definitions are obsolete, so replace them with
QDF_STATUS definitions in the wma folder.
Change-Id: I3ba728e378697fb02f02322e7a467cd4f8a62c10
CRs-Fixed: 2262962
In implementation of Android Packet Filter, functions, variables,
definitions are named after BPF, which stands for Berkely Packet
Filter. The term was more appropriate for Link Layer packet
filters implemented in the Linux kernel, known as Linux Socket
Filters.
The term BPF is obsolete now, so rename it with the
appropriate acronym, APF.
Change-Id: I9e02edbc580ffb2c559c8e864f54d255fc2d51a3
CRs-Fixed: 2191530
PMO should not know about vdev data path handle, but
pmo_unpause_all_vdev() need it, so register a wma callback to retrieve
the vdev dp handle instead of keep a copy in pmo vdev private context.
Refine current code to retrieve vdev dp handle using a wma callback
Change-Id: I1f668fff633a5e5cdfc478e7f619e9600930b333
CRs-Fixed: 2227384
During a channel switch, host sends the beacon template to the FW.
Currently the CSA/ECSA Channel Switch count offset fields in the
WMI_BCN_TMPL_CMDID fixed params are not filled from the host.
Add changes to calculate the CSA/ECSA Switch count offset from
start of the beacon template data and fill it in the fixed
params field for WMI_BCN_TMPL_CMDID.
Change-Id: Icb568f59346972784c4aceef9b42c8543adaa889
CRs-Fixed: 2246600
In wma_is_pkt_drop_candidate the frame received time is updated
even when the frame was dropped and thus the received time of
the frame keeps on increasing. Thus the condition to check if
frame is allowed after WMA_MGMT_FRAME_DETECT_DOS_TIMER ms always
fails if driver continuously keep on getting the frames.
This can lead to dropping of valid deauth/disassoc frames in case
if RMF is enabled and some rouge peer keep on sending rogue
deauth/disassoc frames and thus even if peer send valid deauth
peer will not get disconnected.
To fix this update the rcvd time stamp only when the frame is
allowed, as this timestamp should be used to block the duplicate
frames for WMA_MGMT_FRAME_DETECT_DOS_TIMER ms.
Change-Id: I4f480e21369b585d78f240c5f4f062d010d889a8
CRs-Fixed: 2256679
Add support for getting cfg integer from PMO. Register callbacks
during pe_open/close so that PMO can query CFG int values for
calculating parameters like listen interval etc.
Change-Id: I52d165586576e547e175ba276e6b7225db5b27e0
CRs-Fixed: 2252661
Currently after dp peer delete peer info is logged which leads
to invalid pointer access. Do not log the peer info after it is
deleted.
Change-Id: If4c2d9af7e3f2b29e3e034eec08fa68fd329257b
CRs-Fixed: 2259026
Peer removal happens in MC thread context and the corrresponding
unmap events processed in soft IRQ context. But both the events
are not synchronized correctly and causes race condition
in the system.
Apply reference count for the peer to avoid this
problem.
Change-Id: If1ca656a4dc0325032069af926697784cdec9b2d
CRs-Fixed: 2183468
In the function wma_update_intf_hw_mode_params, vdev_id received
from caller wma_pdev_set_hw_mode_resp_evt_handler, is used as
the array index for wma->interfaces. If vdev_id exceeds
wma->max_bssid then a possible OOB write could occur.
Add check to validate vdev_id against wma->max_bssid. Print
error if it exceeds.
Change-Id: I3ddf5e1b24fbd2bd401ac879219300857d05e4b7
CRs-Fixed: 2243990
new INI gNumVdevs is added to allow number of VDEV support
for both Host and FW. Also Updated logic to calculate num_peers
and num_tids.
Change-Id: Ife5ff24e9594c8986913c06899ac5e41c83fc75c
CRs-Fixed: 2245506
The API wma_inc_wow_stats lacks a break in switch case
after WOW_REASON_OEM_RESPONSE_EVENT. Due to this
execution falls through to the next case statement or
default.
Fix is to add a break after WOW_REASON_OEM_RESPONSE_EVENT
Change-Id: I0b95fd55403b29d74a471f038e518c58c81cfcf7
CRs-Fixed: 2233189
In wma_unified_link_peer_stats_event_handler() we are checking
if buf_len is of proper value. At this point buf_len is may be
uninitialized, thus causing a compilation issue.
Initialize buf_len before use in the validation check.
Change-Id: Ia19de3c5c8bcd154670a44a9dafca31c6bf0b76b
CRs-Fixed: 2256229
In wma_unified_link_peer_stats_event_handler a check for excess WMI
buffer is done by comparing difference between WMI_SVC_MSG_MAX_SIZE and
buffer length with size of wmi_peer_stats_event_fixed_param. In case the
buffer length is a value larger than WMI_SVC_MSG_MAX_SIZE, and as buffer
length is an unsigned integer, it causes an integer overflow and results
in a very large value, thus invalidating the check.
Change the check to compare difference of WMI_SVC_MSG_MAX_SIZE and size
of wmi_peer_stats_event_fixed_param with the buffer length which
prevents chance of integer overflow.
Change-Id: Ic99d0cf6b34c7c45dde3c4feb50e102807564eff
CRs-Fixed: 2224451
In function wma_send_offload_11k_params, check to support 11k offload
in FW fails due to usage of older WMI_SERVICE_EXT_IS_ENABLED leading
to 11k offload params not sent to FW.
Add changes to use wmi_service_enabled instead of
WMI_SERVICE_EXT_IS_ENABLED in wma_send_offload_11k_params.
Change-Id: Ic71043f448d74066a234ae1cb9513a1580011abd
CRs-Fixed: 2255255
Enable PNO feature in FW feature config such that WiFi
kernel space driver can return proper PNO feature capability
to user space.
Change-Id: I1360050aab0224b109ee9b3912d1aa428f5a5ed7
CRs-Fixed: 2249491
Current ucfg API's that disables wow events accept a u32 bitmap
variable. A pointer to that variable is passed to core API where
it assumes it as a u32 array of 4 bytes. This will lead to out of
bound memory access.
Change wow enable/disable API's to accept wow event type as the
parameter.
Change-Id: I220aaddfea62ab96f121014d0d65a1406988c946
CRs-Fixed: 2233108
After DUT connected AP, run on CLI: iwpriv wlan0 reassoc,
QDF_BUG(0) in driver on Rome.
When reassoc to current connected AP, LFR2 and LFR3 have
different design.
Helium supports LFR3, send WMI_ROAM_INVOKE_CMDID to F/W to
trigger offload roaming.
Rome only supports LFR2, Send vdev start cmd to F/W while
vdev already started first, then send reassoc frame.
Passpoint TC5.2a need reassoc to current connected AP.
Change-Id: Ic0e2c945c6978835f39ec1746f625a0c52f643a7
CRs-Fixed: 2232538
Currently driver marks cache type as static when it sends valid
channel list to firmware to use for roaming. When cache type is
static, driver will not add WMI_ROAM_SCAN_MODE_RSSI_CHANGE in
wma_process_roaming_config.
Roam scan may not trigger upon RSSI change when mode does not
have WMI_ROAM_SCAN_MODE_RSSI_CHANGE and may have issues related
to roaming.
Mark channel list as dynamic based on newly added ini
"force_rssi_trigger" for valid channel list as well.
With this new ini , customers can tune the behaviour of
roaming scan in firmware based on RSSI trigger or periodic.
Change-Id: I04123cb954408fd510d41d2b6ba96144be0945f9
CRs-fixed: 2240544
If SAP comes up in 2.4Ghz channel in HT/VHT 20/40Mhz and channel
switch comes for a 5Ghz channel, SAP gets started in HT/VHT 20/40
Mhz only while it should connect in VHT80Mhz or HT40Mhz depending
on whether the initial connection is in HT or VHT.
Change the bw to 80Mhz if initial connection is in VHT and to 40Mhz
if initial connection is in HT if channel switch comes for a 5Ghz
channel.
Change-Id: I709dd35575866b7ec9fddcfb94078f114a78d1a2
CRs-Fixed: 2226979
In the function wma_mgmt_rx_process, wbuf is the allocated skb
which houses the incoming management frame. An extra 100 bytes
buffer is allocated in wbuf->data to avoid OOB access when
additional headers are present in addition to ieee80211_frame.
This additional buffer is uninitialized and can cause potential
OOB for the management frames of length
sizeof(struct ieee80211_frame) and have no IE or any data.
Initialize the allocated extra bytes so that OOB is prevented.
Change-Id: I44047b0c6f3a731c741c5e0217f3bd0cdd8ed4dc
CRs-Fixed: 2249815
In the PI wma_tx_packet, host assigns downld_comp_required
to true/false according to tx_frm_download_comp_cb,
is_high_latency, tx_frm_ota_comp_cb, all the three
conditions to be true. Also the host checks
tx_frm_download_comp_cb, and assigns tx_frm_index
according to downld_comp_required, but in the else
case when tx_frm_download_comp_cb is false, the check
of downld_comp_required is void, as the downld_comp_required
cannot be true if prior tx_frm_download_comp_cb is false,
so the code in the else part which checks tx_frm_download_comp_cb
and assigns tx_frm_index is dead, and in any case cannot be
executed.
Fix is to remove the check of downld_comp_required in
the else case.
Change-Id: If1a376099234d541d508f18cee075dd0f1603294
CRs-Fixed: 2233558
WMI_SERVICE_READY_EXT_EVENT isn't supported in Rome F/W, service
ready ext timer shouldn't be started. Ext service bitmap is
passed to host by F/W event: WMI_SERVICE_AVAILABLE_EVENT.
Change-Id: Id8058c2e58c5771ef27482d3e4076869e560acf1
CRs-Fixed: 2251523
Currently, BTM offload config from the ini is sent to the FW as part
of the RSO start for the vdev which has roaming enabled. In case
of STA+STA concurrency, when roaming is enabled for second STA,
BTM config is sent for the second STA vdev leading the FW to assert
as the FW already has BTM offload enabled for the previous STA
session and supports only one vdev with BTM offload enabled at a time.
Send BTM offload config with flags as disabled as part of RSO Stop
so that the FW de-inits the BTM offload on the current connected vdev
before it inits BTM offload config on the new vdev for the second STA.
Change-Id: I7af499b0f7c77b5d52e6c74b09c28c845bdfcd9a
CRs-Fixed: 2251994
When add_bss is done for a STA vdev, the rmfEnabled flag is set
on the wma_txrx_node based on the PE session config. However this flag
is not reset during del_bss which leads to DPP public action frames
sent from supplicant with no session established to be considered
as rmf enabled (due to previous connected rmf session) and adding
additional bytes in the header. This leads to the DPP frame of
incorrect length to be transmitted and the other DPP STA receiving the
frame drops it.
Reset the rmfEnabled flag in wma_vdev_stop_resp_handler if set
previously for the VDEV.
Change-Id: I6ffb1f3efbfc8455768f54155a2abcc8ccf13fe6
CRs-Fixed: 2236476
