Video/audio wireless application needs to tune parameters
per AC based. Config the number of TX sw retry per AC via
driver INI configuration file. It helps to improve the
video/audio performance in noisy environment.
Change-Id: Icffb5174b265b6453021b0d0a8ad3e12b695847a
CRs-Fixed: 2212954
The routine wma_roam_synch_event_handler sends roam indication to the
upper layers. It uses the vdev_id of the synch event to pass the roaming
indication for the vdev session. If the vdevid exceeds the max_bssid
supported, then OOB write occurs in wma_roam_synch_event_handler.
Add check to validate vdev doesnot exceed the maximum bssid configured.
Add check to ensure vdev doesnot exceed max_bssid and return error if
violated.
Change-Id: Ief8b5070fd6cbb375900e2816524dbd946c5238d
CRs-Fixed: 2206569
Video/audio wireless application needs to tune parameters
per AC based. Configure A-MPDU subframe parameter per
AC via driver ini configuration file.
Change-Id: Id63be7aacf6465edee08f7a2f4c8a119f9bd6346
CRs-Fixed: 2212932
In the function wma_vdev_start_resp_handler when we recieve a
vdev start response event, we copy the req_msg->user_data to the
object hidden_ssid_restart of the structure
tpHalHiddenSsidVdevRestart. If hidden_ssid_restart_in_progress
flag is set for the corresponding vdev_id, then we post that
message to the PE and free the hidden_ssid_restart. If this
req_msg->user_data is used again if req_msg->msg_type is
WMA_CHNL_SWITCH_REQ , then a possible Use-After-Free will occur
in wma_vdev_start_resp_handler.
When a channel switch request has occured, there will not be a
hidden ssid restart event in progress. So add check to validate
if the req_msg->msg_type == WMA_HIDDEN_SSID_VDEV_RESTART.
Change-Id: Ie3195b23ff136fbfd38fcd4d32e993d4cb016316
CRs-Fixed: 2216751
Post the LFR2 Candidate found indication to low priority scan queue
instead of SME queue to maintain order with beacon/probe frames
from Scan queue.
Change-Id: I5e8a6247a7d5200371d776bce3436104a5ba2df2
CRs-Fixed: 2226234
Add support to process MU EDCA param set in assoc response
frames and send the params to FW.
Change-Id: Ia492d1212b3c357647a89e4f98d3cfdc7ff7bbac
CRs-Fixed: 2220227
Currently there is no provision to decide delay between two roam
scans in firmware. With these new ini's, driver wants to expose
control to decide delay between roam scans:
Add ini "min_delay_btw_scans" to set minimum duration allowed between
two consecutive roam scans. Fw should not allow roam scan if duration
between two consecutive roam scan is less than min_delay_btw_scan.
Add ini "roam_trigger_reason_bitmask" to set default value of
bit-mask containing roam_trigger_reasons for which
min_delay_btw_scans constraints should be apply.
Change-Id: I2af9d5dc8e6919eeb90251d3d744e3f07705e776
CRs-Fixed: 2221779
Fix condition checked before programming user's requested chainmask to
firwmare. Get current firmware advertised phy cap for non-dbs phymode
and check if it supports all chains for tx/rx 2g and 5g.
Change-Id: I3fcef315f478403955ce400b3ba6d138a8006a01
CRs-Fixed: 2202544
Add new ini item "enable_ftopen" to enable/disable FT open
feature. There is no ini currently to disable only FT open.
Change-Id: I18280d9de77857b15698eb233ba4ec71089beb06
CRs-Fixed: 2214766
The routine wma_unified_debug_print_event_handler logs the data from debug
print event handler. The param event data from firmware is copied to a
destination buffer .If the maximum size of the data exceeds or equals
BIG_ENDIAN_MAX_DEBUG_BUF for big endian hosts then possible OOB write will
occur in wma_unified_debug_print_event_handler. For other hosts, OOB read
could occur if datalen exceeds maximum firmware message size
WMI_SVC_MAX_SIZE.
Add check to validate datalen doesnot exceed the maximum firmware msg size
WMI_SVC_MAX_SIZE. Return failure if it exceeds.
Add check to ensure datalen doesnot exceed or equal the maximum buffer
length value for big endian hosts BIG_ENDIAN_MAX_DEBUG_BUF.
Add null termination at the end of the data recieved from the firmware.
Change-Id: Ibb662cb8e17ef8be8b7591308c422a78b71e331a
CRs-Fixed: 2222533
When SSR is in progress, WMI commands for peer and vdev deletion
will not be sent to FW. Do not wait for peer deletion for it will
always lead to timeout since peer delete command will not be sent.
And the check is not needed since vdev delete command will not be
sent, either.
Change-Id: Ib6f921a7c7ff09bf30ed19b443a30542db2b51a3
CRs-Fixed: 2217366
The SoftAP VSTA feature was introduced to overcome a limitation in a
prior version of WLAN hardware. Since the WLAN hardware supported by
this driver does not have this limitation, remove the feature code.
Change-Id: I1f2fe31b294fb7b2da1fa8619b3380412c5d872e
CRs-Fixed: 2224817
As many as 5 vdevs can be created, which is defined by MAX_SME_SESSIONS.
But flow control pools are only valid for active TxRx capable vdevs.
Which is 3 active vdev starts. So attach flow pool creation to vdev_start
instead of vdev_attach.
Change-Id: I137676ba618aa3a6684c7d17ef7d9263c4df6efe
CRs-Fixed: 2179220
Add new ini item "ho_delay_for_rx" to set delay Hand-off
period. For LFR 3.0 roaming scenario, once roam candidate
is found, firmware waits for minimum this much duration
to receive pending rx frames from current BSS before
switching to new channel for handoff to new AP.
Change-Id: Ided9a81e9402259f5df6b42926b3fa336b6bb4d0
CRs-Fixed: 2221748
WMI cmds should be blocked, before calling HTC stop
to avoid the race condition in the system
Change-Id: I677c55cd96ea6af973595eec1e759641fbea109a
CRs-Fixed: 2193653
The change for the CR 2211133 caused compilation issue in LE
branches. This reverts commit with
change Id-I45943ae76d8fcf7b53e1f064c462d01cd6d00dcf
Change-Id: I069f1a4ae8ad320f5a073ee072dd772e05c5fc5d
CRs-Fixed: 2222536
The driver contains considerable debris from the obsolete WOWL
messaging, so clean it up.
Change-Id: I432f7fc1567b0aa31a7be758c05f2213340baed0
CRs-Fixed: 2223859
The function wma_del_tdls_sta is used to process delete sta
request from UMAC in TDLS. peerStateParams is a pointer to the
structure tTdlsPeerStateParams. The memory allocated for
peerStateParams is freed in the call to the function
wma_update_tdls_peer_state(). When peerStateParams is used to
access vdev_id again after free, then a use after free case will
occur.
Retrieve the vdev_id value from the del_sta structure that is
passed into wma_del_tdls_sta initially.
Change-Id: Iad7edf87058bfc20aadc0e72d474b1c330790512
CRs-Fixed: 2216242
qcacld-2.0 to qcacld-3.0 propagation
Discard the original wmi interface:
WMI_PEER_ANTDIV_INFO_REQ_CMDID/PEER_ANTDIV_INFO_EVENTID,
replace with the new one:
WMI_PDEV_DIV_GET_RSSI_ANTID_CMDID/WMI_PDEV_DIV_RSSI_ANTID_EVENTID
to support chain value along with corresponding antenna info.
Change-Id: Ie9ea9d160e1ac1e2e65de422c85989159fb5a556
CRs-Fixed: 2005820
Currently Kbuild unconditionally sets -DHAL_SELF_STA_PER_BSS=1. There
is only one place where this macro is referenced, and it actually
requires that the macro be set for the driver to work. Since this
logic isn't really conditional, remove the conditional compilation.
Change-Id: I09a03339df086146b81b3012fb281e166fccd5da
CRs-Fixed: 2221852
Currently a set of ANI_COMPILER_TYPE macros are checked against, but
other than that they serve no purpose. As part of ongoing Kbuild
cleanup remove these obsolete macros.
Change-Id: Ia112d7d5ae8d12eae46144b53addc8ad54393bba
CRs-Fixed: 2220285
The routine wma_extscan_change_results_event_handler sends the ext scan
results to upper layers. This contains the bssid info, rssi values of
different APs that are scanner. If the num_rssi_samples is negative or
greater than UINT32_MAX,then an OOB write could happen.
Add check to ensure rssi_num is not negative or exceeds UINT32_MAX.
Also make sure the numap value is not negative.
Change-Id: If82c4fd1193c45d38bd4495c187a406deb25acad
CRs-Fixed: 2205957
The routine wma_unified_debug_print_event_handler logs the data from debug
print event handler. The param event data from firmware is copied to a
destination buffer .If the maximum size of the data exceeds or equals
BIG_ENDIAN_MAX_DEBUG_BUF for big endian hosts then possible OOB write will
occur in wma_unified_debug_print_event_handler. For other hosts, OOB read
could occur if datalen exceeds maximum firmware message size
WMI_SVC_MAX_SIZE.
Add check to validate datalen doesnot exceed the maximum firmware msg size
WMI_SVC_MAX_SIZE. Return failure if it exceeds.
Add check to ensure datalen doesnot exceed or equal the maximum buffer
length value for big endian hosts BIG_ENDIAN_MAX_DEBUG_BUF.
Invoke strlcpy instead of memcpy to ensure the string is null terminated
before printed.
Change-Id: I45943ae76d8fcf7b53e1f064c462d01cd6d00dcf
CRs-Fixed: 2211133
PDR recovery is taking longer time because vdev
delete is waiting for peer delete completion.
Modified vdev delete handler to get the status
of firmware. If firmware state is detected as down
then vdev delete handler will not wait for peer delete
completion.
Change-Id: I1014df239a1abecaccbe5097769a10c625597e12
CRs-Fixed: 2207795
Change htt_sec_type to cdp_sec_type since the CDP API expects a
cdp_sec_type as it's argument. Required for compilation using LLVM.
Change-Id: I8dbf59dd80bd0fce221a23544c69764508377ae0
CRs-Fixed: 2216859
In function wlansap_channel_change_request validate channel requested
before processing the request.
Change-Id: I1cc8c978b15fe6ee043ce6bf712a109994dce50b
CRs-Fixed: 2212078
Currently wma_update_hdd_cfg() has unconditional code to check for
firmware support of the WMI_SERVICE_EGAP service and to register an
event handler when it is present. However this code doesn't build
correctly when the Green AP feature is disabled in the build.
Therefore featurize the Green AP service event handling.
Change-Id: Ic5f8fcc960c4b1b6ebc3b9b78acd84f583c24b9f
CRs-Fixed: 2216245
Use the wmi enum type in function wma_get_rcpi_req instead of
rcpi_measurement_type.
Change-Id: I5b506059ad8b0f4cd65c24e20df6306a47249fdb
CRs-Fixed: 2216015
Fix usage of flag is_waiting_for_key such that it programs wake
timer only for secure STA connected state.
Change-Id: I336696f15c5fc932a4eedf5534c2182bda3d2e27
CRs-Fixed: 2214809
When a monitor mode vdev is created, a self-peer is created
automatically. However, when the vdev is destroyed, the self-peer is
leaked. Remove the self-peer when a monitor mode vdev is removed.
Change-Id: Ib6855957b56d057da9bf9a176b328cd9ec8dab96
CRs-Fixed: 2211141
Call cdp_set_pn_check to set PN check & security type in data path.
Required for RX defragmentation on Napier.
Change-Id: Ie00613be2e2713c58b4d83aa1c31eb4451442477
CRs-Fixed: 2213691
In function wma_unified_radio_tx_power_level_stats_event_handler,
radio_id is checked if it is greater than num_radio. However, radio_id
is an array index and its range is 0 to (num_radio-1). So if radio_id
is equal to num_radio, a buffer overflow would occur while accessing
the array link_stats_results->results.
Fix sanity check to return error if radio_id is greater than or equal
to num_radio in wma_unified_radio_tx_power_level_stats_event_handler.
Change-Id: Ib48e8388206f28e7b2cb80177363655008a109e6
CRs-Fixed: 2209106
wmi_handle is needed while registering for wmi event handler. But it is
not set for pdev before registering for EGAP event handler. With this,
EGAP support remains disabled which may end up in increased power
consumption.
Move setting of wmi_handle in pdev before registering for EGAP event.
Change-Id: Icb8accc738a3aaad7fbc1201c7c0d0b77945e8f2
CRs-Fixed: 2203380
The Data Path in the WLAN host driver needs to be sending DHCP START/
STOP indications to FW during DHCP based IP address acquisition phase
in the SAP mode.
Inspect the Tx/Rx frame, and send the notification to the FW through
WMI message.
Change-Id: Iad6308980a7158516f341b97f3baffab1e4c4bc3
CRs-Fixed: 2114816
Currently 11k offload command is sent to FW as part of RSO Start and
not explicit 11k offload disable command is sent to the FW. In case of
STA+STA concurrency cases, while 11k offload is enabled for the 2nd
STA after STA 1 is disconnected, the FW asserts because it has 11k
offload enabled for STA 1 and has not deconfigured it yet.
Send 11k offload disable command as part of RSO Stop during disconnect
to the FW so that it deconfigures 11k for the currently enabled STA
and re-configures for the second STA without assertion.
Change-Id: I8a1bcb8906c809f451f7ab3df3e4c671cef062fd
CRs-Fixed: 2208649
For P2P Device, firstly it will delete the last peer in wma vdev
detach, so not wait before deliver WMA_DEL_STA_SELF_REQ. Secondly,
no throughput case run on P2P device, and no need to take care the
case which no vdev stop response from FW and then deliver
WMI_VDEV_DELETE before WMI_PEER_DELETE.
Change-Id: I36358cbc6045db2dd77b354a37817991f261d856
CRs-Fixed: 2204327
IPA module has been moved to CLD component under the converged
driver model. Remove legacy WMA interface IPA command and use
the new defined API.
Change-Id: Icd9a207f43f8df4dc563d0078d402470683cfd7d
CRs-Fixed: 2177925
Move Channel convert and frame indication logic from lim_p2p.c
to lim_utils.c and remove unused timer
pMac->lim.limTimers.gLimP2pSingleShotNoaInsertTimer.
Change-Id: I71de90d5fb88462e52148a434d43ea80c41cfe36
CRs-Fixed: 2191282
Extend wma ARP stats handler function to handle other
connectivity stats data for TCP and IPv4.
Change-Id: Ibf14212eee3f7eff3841426d30b0728da04eb124
CRs-Fixed: 2161889
Change-Id I28d5985655b4 is accessing uninitialized pointer
params->rx_ops, which cause failure during load.
To fix this, as well as to avoid big structure on stack,
allocate that structure from heap and free after usage.
Change-Id: Ibcdb2904c223e43744e635ef5d530a63867f644b
CRs-Fixed: 2207937
There are several redundant operations and unused variables in
wma_rx_service_ready_event. Remove these, and adjust some formatting and
incorrect types while we are at it.
Change-Id: Ia6376ef0e984103e36ab0395b54466acf0ad2d04
CRs-Fixed: 2201875
In order to conserve firmware memory when various filtering features are
not in use, update the target configuration provided to firmware based
on the intersection of various filtering features and host
configuration.
Part 1
num_wow_filters = ARP/NS offload enabled ? 2 : 5
bpf_instruction_size - BPF enabled ? 0 (auto) : 0xffffffff
Part 2
num_packet_filter = Packet Filter enabled ? 12 : 0xffffffff
Change-Id: Ie8cb4ae44c83b115b249e22ebd7146278ed70612
CRs-Fixed: 2199297
In STA mode, tx params for auth and assoc req frame
are not updated if minrate is 1 or 6Mbps as these
are the default rates for 2.4G and 5G respectively.
If 2.4G APs min supported rate is 6Mbps, the tx params
are not updated which results in auth and assoc req
frame transmitted at 1Mbps.
Fix is to update tx params if minrate is 6Mbps and
AP is operating in 2.4G.
Change-Id: Ia12c7b13cfb93e2d3b5a4ae124003248fa109e3f
CRs-Fixed: 2205282
The params are passed individually as argument in wmi_unified_attach.
Instead of individual params, use a struct for wmi attach params.
Also pass max commands as param in wmi attach.
CRs-Fixed: 2192801
Change-Id: I28d5985655b436da048d72d33fe0fb4f57e85a50
