Currently, In the MLO t2lm API, wlan_mlo_parse_bcn_prbresp_t2lm_ie
is missing frame boundary checks which may lead to out-of-bound
reads if the lengths are not checked by the caller.
Fix is, while parsing t2lm ie pass the frame length and add
check for frame boundary.
CRs-Fixed: 3707241
Change-Id: Ic83638eff2250a704df8dfa8bd233238fcc7a25b
Currently, Host driver is enabling CTS2SELF for most of the qcom
AP (8CFDF0) and It will try to send the data in all the cases by
not waiting for RTS-CTS and in some cases if it does not win the
medium, it will take around 4x time than normal RTS-CTS(in case
of failure) leading to throughput issue.
This change is to disable CTS2SELF for OUI : 8CFDF0
Change-Id: I4becf0d1c093f458868634a9636d2e14d60a9f37
CRs-Fixed: 3689771
Add support to send roam cancel diag event in instances with
below reasons:
IDLE ROAM scan cancelled due to screen ON
scan cancelled due to other high priority roam scan
Add new diag structure & reason code enum for this diag
event
CRs-Fixed: 3708863
Change-Id: I1f7a819d766735f7d89eda3945e7ed92d22919ae
Extend the page fault action INI to handle following:
1) Ignore page fault event
2) Trigger SSR on page fault threshold
3) Send blob of data to userspace on page fault threshold
On pagefault wakeup event, save per symbol pagefault timestamp
and once the event count reaches configured threshold within the
configured time interval, either trigger SSR or notify userspace
with pagefault address and count based on INI configuration.
Change-Id: I0a3ece369ad0c7aac676fc91f6863e06a3f4ce8c
CRs-Fixed: 3713813
The SAP is not moved to the 6 GHz user configured
frequency in the following cases:
1. STA disconnected, SAP is standalone in 2.4 GHz
2. STA is VLP/PSC channel, but SAP is currently in
2.4 GHz(due to STA(DFS) + SAP)
Allow the SAP to restart in 6 GHz channels for the
above scenarios if the following criteria are met:
1. For standalone: The SAP user configured band is
superior than the current operating band.
2. For SCC: The 6 GHz STA should operate in PSC and
the channel should support VLP in DUT regdomain.
Change-Id: Iea292c94e579ccead2300f6e9b994c4b8e9a0a87
CRs-Fixed: 3713247
Check for DP drain status and prevent suspend if
we fail to drain txrx succefully.
Change-Id: I76c5587719cb162e3e7802586d5ddde24f18e755
CRs-Fixed: 3718937
Some solutions may not have HS-2.0 certification and there is
no need to forward the BTM frame to wpa_supplicant in such
solutions. Let firmware handle the frame in such cases by
enabling btm_offload so that it doesn't wakeup the host.
Firmware may roam to another AP upon BTM reception.
To enable/disable BTM offload add hs20_btm_offload_disable INI.
If this INI is enable BTM offload will be disable and if INI
is disable BTM offload will be enabled.
Change-Id: Id6e18404cc3a12a23b213c0f858c943715285932
CRs-Fixed: 3718776
UL data delay is high when connect specific AP.
To fix it with OUI ini, limit Tx BW if vendor OUI is received in beacon.
Change-Id: I54a4ddb4f113baf1da0ba5490760f38f30159f2e
CRs-Fixed: 3695107
FISA entry is updated by FISA RX and work queue, if the same
entry is hashed for different REO id, the lock may not work
as expected. Change is to hold the lock before work queue
waking up to prevent the race condition.
Change-Id: I16ba4439c1655bbb7bf83b13d9280cb3f7c56478
CRs-Fixed: 3674340
MLD address is mandatory for link VDEV connect request or
else the partner link will fail during candidate fetch from
scan DB because of MLD address mismatch.
For MLO OWE roaming, link VDEV connection starts after
completion of EAPOL-HS, and here MLD address is not filled
leading to link VDEV connect failure.
Use connect response to fill MLD address in link VDEV
connect for MLO OWE roaming
Change-Id: I9eae3b7ba3619a9ce62603efd0590aabce9c70f3
CRs-Fixed: 3715021
Currently, HS_20_AP param of cm_ext_obj->rso_config is set
to true when STA connects to a HS-2.0 AP. This is to disable
btm_offload as per HS-2.0 cert requirements.
But this flag is not cleared even when STA disconnects from
that AP and this disables btm_offload for next connections
as well even for non-HS-2.0 APs.
So, reset the flag as part of connect start to avoid this.
Change-Id: I3763544ecca0e4628b0c78633364fe70fd9b3094
CRs-Fixed: 3712758
Host tried to associate to AP, 6 GHz link is selected as
the assoc link and in the RNR there are two partner links 5 GHz, 2.4 GHz.
Only 6 GHz/2.4 GHz are beaconing and 5 GHz is not beaconing.
STA sent the ML-Probe request on 6 GHz link requesting the full profile
for the 5 GHz and 2.4 GHz links but AP responded with only one partner
link 2.4 GHz, from this we generated 2.4 GHz and added to scan cache,
AP didn't respond with 5 GHz link in per-sta.
STA sent the assoc request over 3-links and AP accepted the assoc,
and association is successful over 3-link and the same is intimated
to the firmware that 3link association is successful.
But while sending the connection information to the kernel 5 GHz link
is not found resulting in HDD/Kernel not being aware of the 5 GHz link.
Fix :- Use assoc response from the ML AP to generate ML probe resp
for the partner links to add to scan DB so that partner link
VDEV will have candidate to start connection.
Change-Id: I30176e58d9b02e7ed275b1c926cd1e119b66f8f3
CRs-Fixed: 3686809
When firmware roams to 2 link AP and sends roam synch key event,
then the pairwise keys are still copied to key_entries for all
the three links in extract_roam_synch_key_event_tlv(). But
since 3rd link is not valid, the pairwise key memory allocated
is not freed resulting in memory leak.
So free the allocated redundant memory for invalid link pairwise
key after roaming.
CRs-Fixed: 3697540
Change-Id: Idfdb53c918d8e684e6171b5e0917e722a2fc605a
This reverts change-Id I7ab2ade0f01ad5035f7b156ded7eb7af7c826b9e.
For CR-3698932, FW to make a change to program MLD address in addition to
link address for ROC request on MLO STA. for ROC scan req host will set
SCAN_FLAG_EXT_FILTER_PUBLIC_ACTION_FRAME.
Host to bring back logic (ROC on BSS channel) added in CR3069810 by
reverting CR3366671.
FW to make a change as replacement fix to CR3366671: allow ROC if requested
channel is same as ULL STA (active link in MLO case) BSS channel when scan
is suppressed due to ULL or other reason.
CRs-Fixed: 3704271
Change-Id: I5914bbd132ebfd9a7b1a852913fb16cdfb1fd8f7
Currently whenever the userspace is trying to reset the previously
configured max mlo links for association, set wifi config command
with "SET_NUM_ALLOWED_MLO_LINK 0" is issued, this always
resets the max mlo value to the ini default value which is 2
rather than defaulting to the firmware/ini intersected value.
Fix is to default to the firmware/ini intersected value rather than
the default value.
CRs-Fixed: 3707990
Change-Id: Iaa7cbe32613102ccffbcf92fcb7ef0a39f96a705
Currently on HO failure host posts disconnect with priority
set in serialization queue before dequeuing the dummy roam
command from serialization, as a result for 2 link ML STA
case when HO failure is received, assoc VDEV disconnect gets
priority over partner link VDEV in the serialization
queue. When assoc VDEV disconnect is complete, host updates this
info to userspace and userspace issues dynamic mac address
update command. While processing this command the DP assoc VDEV
is first detached then re attached. There is possibility of
race where link VDEV disconnect starts in parallel, as DP link
VDEV has the reference of DP assoc VDEV, in order to release the
reference it looks up for the DP assoc VDEV , but as part of mac
address update if DP assoc VDEV is detached and reattachment is
pending then the DP link VDEV doesn't get the DP assoc VDEV and
reference release fails.
To address this issue don't prioritize disconnect for
HO Fail case.
Change-Id: I74c7bce851423226d3aac2750fddd5e6c7e34fd1
CRs-Fixed: 3697528
Add more validation for vendor command force active link bitmap:
1.If force inactive num is present due to MCC link(DBS RD) or
concurrency with legacy intf, don't allow force active if
left inactive link number doesn't meet concurrency requirement.
2.If force inactive bitmap is present due to link removal or
concurrency with legacy intf, don't allow force active if
it is conflict with existing concurrency requirement.
Change-Id: Ic7507c1797189c079f0032a39819e15467bd6bf3
CRs-Fixed: 3701323
Currently the dp_link address is provided to CDP vdev
as a part of vdev register. Also, as per the vdev deletion
sequence, it is possible that dp_link can be destroyed
before CDP vdev is detached. This can lead to use-after-free
scenario when CDP vdev uses the osif_vdev handle (which is
the dp_link handle).
In order to fix this, do not free the dp_link till the CDP
vdev has been detached.
Change-Id: Ie5a1140a0d256b6115fa62e30e6bfd61d1dfc898
CRs-Fixed: 3696641
Peer state could be queried from both fast path and
slow path. Change separates this call and allows log
print from slow path call.
Change-Id: I888b67224752182b792e0165bd5cbacbb7e5f293
CRs-Fixed: 3691146
After received WoW ACK from FW, there should be some RX packets
coming and IRQ delayed, if these packets are not got processed,
FW UMAC will crash. Change adds an explicit check and abort suspend
if rings are not empty.
Change-Id: Ifbd0bfdbc564fb0c02eda7d13756d82966d88549
CRs-Fixed: 3693641
Send the OEM INI configuration of EHT/MLO WPA2 security bitmap
to FW in roam params so that FW can roam to APs allowed by OEMs.
Change-Id: I502d9d2601343f2d781e33c5a4fcf78df037a854
CRs-Fixed: 3698002
Introduce INI to allow OEM vendor to configure driver
to connect to various EHT/MLO configuration APs which
are not allowed by default.
The vendor has to specify which APs to be allowed to
connect in EHT/MLO as a bitmap.
The list of configuration allowed are:
1) Connect to WPA2-PSK APs without PMF in EHT only
2) Connect to WPA2-PSK APs without PMF in MLO
3) Connect to WPA2-PSK APs with PMF in EHT only
4) Connect to WPA2-PSK APs with PMF in MLO
5) Connect to WPA2-SAE APs without H2E in EHT only
6) Connect to WPA2-SAE APs without H2E in MLO
Vendors may chose to connect in 802.11be without MLO
and to facilitate such configuration, the following
API is enhanced to take additional argument on whether
the given candidate can allow MLO or only EHT.
API: wlan_cm_is_eht_allowed_for_current_security()
Change-Id: I3ea1cc0b2c7ba96d1b25aba7bc851773edf27bd8
CRs-Fixed: 3693810
Few non-TxMBSSID APs may not respond to ML probe req and driver
can't add latest scan entry for the partner links from ML probe
resp and if beacons from partner links are not received for a
duration enough to flush out the scan entry of that link then
connection of partner VDEV will fail with no candidates found.
Use assoc response from the MBSSID AP to generate ML probe resp
for the partner links to add to scan DB so that partner link
VDEV will have candidate to start connection.
Following are the conditions for this logic:
- Candidate is a non-TxBSSID in an MBSSID set
- Connection is for more than single link (MLSR/MLMR)
- Scan entry for partner link is not found in scan DB
Change-Id: If97475878d61d986988a6e97e693b194518dc192
CRs-Fixed: 3679519
Currently, driver drops BTM frames in unsupported cases,
e.g. connected to MBO AP without PMF capability, concurrent P2P
session present which doesn't allow STA roaming.
Add connectivity log support and indicate the reason for BTM
drop/block.
Define interface for userspace as below,
New subtype: WLAN_CONN_DIAG_BTM_BLOCK_EVENT
New enum to fill sub_reason for BTM_BLOCK_EVENT type
Change-Id: I87115da57d275a94c5ae69252ec09bcad698e47c
CRs-Fixed: 3699042
Firmware sends WMI_ROAM_SYNCH_KEY_EVENTID after roaming
to 3 Link ML AP. Host allocates memory for every crypto
keys and populates data from the fw event.
This memory is not freed if the addition to crypto
module fails and results in memleak.
Fix is to free the crypto key entry when addition fails.
CRs-Fixed: 3678765
Change-Id: Ife70261b697ec016f50d4e0730c3fa4fc0ec06ab
In the api wlan_connectivity_sta_info_event(), the
CONNECTING connectivity log is printed after
STA_INFO connectivity logs. But this behaviour is
not expected during STA INFO Log after roaming
as CONNECTING log should be printed only when
connect request is received from the userspace.
Modify the api wlan_connectivity_sta_info_event()
and logging CONNECTING event from the api
lim_process_mlm_join_cnf() in order to prevent
connecting log during roaming.
Change-Id: I91d2c14b109fb8a828ba99a021fe6b6e462516c8
CRs-Fixed: 3680502
Suppose INI gDot11Mode is configured as 1 dot11mode_11a, but
the enum MLME_DOT11_MODE_ABG is defined at the last, which is
causing STA to connect in dot11mode_11ac.
So, lower dot11modes should be defined first. Change the order
of dot11mode_11abg to the initial enum value.
Change MLME dot11mode mapping to CSR dot11mode, passing to
csr_convert_mode_to_nw_type function.
Change-Id: I71972bed1b6ac25f809c980e9fff4829fae7e4ff
CRs-Fixed: 3686458
T2LM Req/Resp Connectivity logging is not supported if
the T2LM request is initiated from STA.
Add support for T2LM Request/Response connectivity logging
when T2LM request is initiated from the STA.
Change-Id: If61b5ba7c7eb9ec5687d271afc300737df8fdf8d
CRs-Fixed: 3689209
Bss peer reference is taken without updating the ref count.
This is causing a crash if the peer is freed and the pointer
is still maintained resulting in the dangling pointer. Use
correct api to take BSS peer reference.
Change-Id: I732c10cf6339342a1f9716a5c8057085f9b91f68
CRs-Fixed: 3669170
Currently, SAP gets moved to STA channel when SAP causes MCC
upon STA connection. Same is true for ML-STA where SAP is in
same band as one of the ML-STA links, even if the ML-STA is
in DFS channel.
But STA may receive disconnect request from userspace just
after connect completion. If SAP-CSA is started before receiving
disconnect request, CSA is supposed to be aborted as the STA
would be gone out of the DFS channel.
If SAP-CSA is not aborted, host driver may send VDEV_RESTART on
the STA DFS channel without cac timer and firmware allows SAP to
proceed with VDEV_UP. Host driver doesn't send VDEV_UP as the SAP
channel is not valid anymore. Firmware waits for SAP VDEV_UP and
may cause inconsistency in firmware state machine as host doesn't
send VDEV_UP at all.
So, abort SAP restart if any of the STA/ML-STA links/P2P client
are in disconnecting to avoid this.
Change-Id: I8d229686d9dae685ed680592396bb7cf389f6011
CRs-Fixed: 3667305
Add ini to disable mcs 12 13 for SAP operating in
2.4 GHz with 40 MHz bandwidth.
Change-Id: I78ed90bf6bab80a8f81f7a0640b9aca9d2736f4d
CRs-Fixed: 3672437
Addressing an issue where the host driver receives a raom
sync key event with cipher type 15 and length 32 from the
firmware. Currently, Host lacks an updated cipher type and
defaults to value 0, corresponding to WEP key, with a maximum
length of 16. This invalid conversion result in firmware
crashing during the install key command.
This change is to add crypto cipher type corresponding
to fw implementation.
CRs-Fixed: 3680670
Change-Id: I2bc5b486fd9df79334191c84bc57151ed7efdfcf
When ML STA + Legacy STA concurrency is present, TDLS is disabled
on all the vdevs. If legacy STA gets disconnected, the TDLS
enable is done on only one MLO vdev, and on MLO link vdev TDLS
state is disabled. But TDLS peer set param commands are going
to firmware. This results in firmware abnormal behavior.
Enable TDLS on assoc & link vdev for ML STA case when concurrent
STA disconnects.
CRs-Fixed: 3685766
Change-Id: I36b839dd610e85d38081a985ceb68d8fad8879c5
Link switch uses cached partner links info in mlo_sta_ctx,
currently during roaming as partner links info is not filled
then link switch fails during connect.
Copy partner links info to sta context in mlo dev ctx on
roaming.
Change-Id: Ie513173f0ccdc39f46be5cf4af11021abe5950aa
CRs-Fixed: 3695386
In the api cm_roam_btm_req_event(), BTM request and
BTM Candidate Connectivity logs are printed for both
partial and full scan when disassoc_imminent is set for BTM
roam trigger. But actually, over the air frame was received
only once on the device.
So to avoid BTM frame logs duplication,
ignore the BTM request frame TLV & btm candidate TLV received from
firmware after BTM roam trigger with disassoc imminent set.
Change-Id: I7d8cf4a4f0c7e2ee7958ae3fc309f14890c2fd33
CRs-Fixed: 3675909
"CONNECTING" connectivity event is not logged during
NO CANDIDATE scenario which resulting in breaking of
connectivity logging mechanism.
Modify wlan_connectivity_connecting_event() api
to get connect request parameter as argument in
order to log CONNECTING event.
Change-Id: I040446db189c55ade3c6d0aa993388789f9881af
CRs-Fixed: 3678172
For MLO LINK connectivity log, the links not associated
during connection are also included as part of
inactive links which breaks the sanity of logging
mechanism.
Modify MLO LINK connectivity event to send the
associated link band bitmap in order facilitate
userspace to find links associated in current
connection and in turn find the inactive links
in a particular instance.
Change-Id: I7a490e9bf8a6666620d1c57b9f8047a22bf78fc5
CRs-Fixed: 3674048
After roaming to 2+5 MLO AP, MLD high RSSI roaming trigger is
getting disabled if assoc link is on 5 GHz.
To fix it, if self MLD roaming is supported, then don't enable
high rssi roaming trigger for 2.4 GHz link and disable it for 5
GHz link after roaming is competed.
Change-Id: I4c02cb2c946d97884fbc0d6cc513c585c21b9548
CRs-Fixed: 3670241
Send periodic fw stats to get chan noise floor when monitor mode
start, but not stop it when monitor mode stop,
pdev stats event is received even when event handler unregistered,
race condition lead to assert.
To fix it, when monitor mode stop, stop periodical pdev stats report
first.
Change-Id: I58a0ced84aca74a7228064067bb096803cf952fd
CRs-Fixed: 3667212
Host filled link address in the NS tuple, DUT sent NA frame with link mac
addr, not MLD addr.
To fix it, let host fill MLD address in the NS tuple for MLO vdev.
Change-Id: I863dc6184c59ee06950e4aa2287d4d4a6ff30b5c
CRs-Fixed: 3693220
If F/W doesn't support p2p device dynamic mac update, after dynamic mac
update, p2p tx will fail.
Check whether p2p device dynamic mac update supported by target, if not
supported, reject p2p device dynamic mac update request from upper layer.
Fix warning of uninitialized status.
Change-Id: I845bd9683f2b68c3ed28292917601fdefed13f72
CRs-Fixed: 3680411
In api cm_roam_scan_info_event(), band_mask is updated
for ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ and
ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ. But
the band mask is truncated for ROAM_STATS_SCAN_TYPE_FULL.
add check in api cm_roam_scan_info_event() to update
band mask only for scan type
ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ and
ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ in order
to prevent the band mask from truncating for
ROAM_STATS_SCAN_TYPE_FULL.
Change-Id: I3e85c87e3e304d0c4d4ae311c7be1939e73d05df
CRs-Fixed: 3666578
TDLS peer_update_timer and peer discovery timers are not stopped
upon sta disconnect.
So while the handler is invoked upon timer expiry, the
vdev could have been already deleted. This could result in
null pointer dereference of vdev while trying to get
TDLS vdev objects.
Since the timer is not required upon sta disconnection and
peer will already be deleted, stop the timer upon STA
disconnection itself, instead of doing it during vdev
destroy.
Change-Id: I3c405b3e7b57d25a7d1afbf6c93476271a29a6b8
CRs-Fixed: 3673078
Currently, mlo_link_agnostic is set to true without validating
destination address which means FW is free to choose
transmission link L0 or L1 due to which GAS frame TX is failing.
Fix is to set mlo_link_agnostic to false when dest address is not
AP address, so that FW can choose freq as per channel which is
sent as part of mgmt frame.
Change-Id: Icacc4ce06b0eda341342ac1cdcf347de74e59e39
CRs-Fixed: 3666152
(cherry picked from commit d3cbd7154a31479cb79230643a0a8818b41d2a67)
Add support for QCA_NL80211_VENDOR_SUBCMD_REGULATORY_TPC_INFO vendor
command to return the STA TPC information used within the BSS.
If STA is ML STA, multiple link TPC information will be returned to
userspace.
Change-Id: I6fd30893c057c876e9a01e112595e5cb0c906a70
CRs-Fixed: 3665538
