In the api extract_roam_frame_info_tlv(), the status code
for the MGMT tx packet is filled with tx_status value instead
of correct value.
Modify the api extract_roam_frame_info_tlv() to populate the
proper value of status code for MGMT TX packet.
Change-Id: Ia07b34ccc74f47bfac56bb1831e4ad1bce237d63
CRs-Fixed: 3741911
When firmware roams to 2 link AP and sends roam synch key event,
then the pairwise keys are still copied to key_entries for all
the three links in extract_roam_synch_key_event_tlv(). But
since 3rd link is not valid, the pairwise key memory allocated
is not freed resulting in memory leak.
So free the allocated redundant memory for invalid link pairwise
key after roaming.
CRs-Fixed: 3697540
Change-Id: Idfdb53c918d8e684e6171b5e0917e722a2fc605a
Firmware sends WMI_ROAM_SYNCH_KEY_EVENTID after roaming
to 3 Link ML AP. Host allocates memory for every crypto
keys and populates data from the fw event.
This memory is not freed if the addition to crypto
module fails and results in memleak.
Fix is to free the crypto key entry when addition fails.
CRs-Fixed: 3678765
Change-Id: Ife70261b697ec016f50d4e0730c3fa4fc0ec06ab
Addressing an issue where the host driver receives a raom
sync key event with cipher type 15 and length 32 from the
firmware. Currently, Host lacks an updated cipher type and
defaults to value 0, corresponding to WEP key, with a maximum
length of 16. This invalid conversion result in firmware
crashing during the install key command.
This change is to add crypto cipher type corresponding
to fw implementation.
CRs-Fixed: 3680670
Change-Id: I2bc5b486fd9df79334191c84bc57151ed7efdfcf
Currently, RSO_STOP is sent to firmware if ROAM_SYNC is aborted
due to some reason. Host doesn't check for the current state of
RSO state machine and may send the RSO_STOP twice. Firmware
responds with SUCCESS for the second request and driver
continue to cleanup peer/vdev assuming that it's a normal
RSO_STOP response. This results inconsistency in firmware
as it might be in the middle of peer/vdev cleanup and
leads to ASSERTION.
Check for the RSO state machine status and avoid sending
RSO_STOP twice.
Change-Id: I87cdb4a682095772070a839bbb86e56a9450b299
CRs-Fixed: 3677172
When there are more than one audio transport mediums
are available, there is a possibility to switch the
audio transport medium from one medium to another
medium.
To provide this support to switch the audio transport
medium, and to indicate the status of the bearer
switch to fw, add WMI interface changes.
Change-Id: I236e2d9a954191c104d56d286332ace644190e6e
CRs-Fixed: 3653962
While parsing the roam synch indication event from the firmware,
the RSSI is copied into a uint8_t variable. But RSSI is negative
value. So change the data type of roam_synch_ind->rssi as signed
int8_t type.
Firmware sends absolute value as RSSI so convert it into a negative
value before assigning to the destination buffer.
Change-Id: Ibec6ee8bfefc612be1600a0820ff061a247460ad
CRs-Fixed: 3641086
This change resolves following static analysis issues:
1. Using uint32_t and enumeration as operands to logical AND
operator (&&) is not allowed by the static analyzer tool.
Convert them to bool and use.
2. Overwriting the variable previous value before using it.
3. sizeof(key_alloc_buf[k]) returns 4/8 bytes as key_alloc_buf[k]
contains pointer. Use sizeof(*key_alloc_buf[k]) to get right
size of the object and use it to mem_zero the buffer.
Change-Id: I6faa5b3ff6847786a7f6ac525ccb0e5f60dbd020
CRs-Fixed: 3646512
Currently the roam scan high RSSI delta is configured via INI.
Define an attribute to allow user configure high RSSI roam
trigger threshold. STA is expected to trigger roam if the current
connected AP's RSSI gets above this high RSSI threshold. STA's
roam attempt on high RSSI threshold aims to find candidates from
other better Wi-Fi bands.
This attribute value is given priority over the INI.
Use a new service bit WMI_SERVICE_5GHZ_HI_RSSI_ROAM_SUPPORT to
enable high RSSI roam trigger in 5 GHz as well.
Change-Id: Ide48ad2261b603de36bd1b31114b91c3a9d6606f
CRs-Fixed: 3586170
Band is not printed for the neighbor report request/response logs.
Fill band info for neighbor report request/response frame
logging event from the wmi_neighbor_rpt_info TLV
wmi_roam_neighbor_report_info->neighbor_report_detail[Bits 26:24]
for both the single TLV and multi TLV case.
This band info indicates the band of the link over which the
frame was transmitted/received.
Change-Id: I2c6671ffc600cba571c666f01fa07fb3d89eb6a8
CRs-Fixed: 3626819
Reset HDD sta_ctx link info parameters after roaming to
reset the values in case of roaming from 3/2 link AP
to 1 link ML AP
Change-Id: I5e8165e50b92eed476d16696c14d4db82192c4ed
CRs-Fixed: 3627330
The host driver now sends a notification to the
firmware when a CSA (Channel Switch Announcement)
is rejected due to no change in channel, bandwidth,
or puncture.
Change-Id: I5d8a424459898d15a7931baf7ca4c3de8308c64e
CRs-Fixed: 3595843
MLO parameter is not observed in association/reassociation
request/response logs when connected to MLO AP.
Call api wlan_populate_mlo_mgmt_event_param() in the
api cm_roam_mgmt_frame_event() in order to populate
MLO parameter in MGMT frame logs after roaming.
Change-Id: I9dbd1a224ec861964a78883088440d79ae80cdd6
CRs-Fixed: 3620741
Introduce support to add frequency to peer in
order to enable Connectivity diag logging for
datapath related events
Change-Id: I634ddc0206530f1039a37fd60643877b2fdf7e87
CRs-Fixed: 3596250
If FW roams with 3-links, assoc beacon and link beacons
are sent by the firmware in roam sync frame event.
However, driver parses the per-sta link info of the
assoc beacon and caches the individual per-link probe
responses only if the link beacon is not present.
Therefore, in 3-link roaming cases, if both assoc link
ML probe response(assoc link + one partner link) and link
probe/beacon are received, then the per-sta profile present
in the ML assoc link probe is not saved to the scan cache
and this leads to bss retrieval failures.
To fix this, parse per-sta profile and generate individual
probe responses directly from the roam sync frame event for
both link and assoc beacon/ML probe responses. This caches
all the partner links individually.
Also, set the assoc state for the standby link bss after the
completion of roam sync processing on assoc vdev. This prevents
the age out of the standby link scan entry.
Change-Id: Ib349aedb826d5037c6015434557d909477e87e5a
CRs-Fixed: 3613058
Add support to add band info for Neighbor report request,
Neighbor request response, Beacon report request and
Beacon report response logging for MLO usecase.
Band info will indicate the band of the link involved
in MLO connection.
Change-Id: I758be63f085be46244f727a842806fb27660e8dd
CRs-Fixed: 3583958
Add support to add band info for BTM Query, BTM request
and BTM response logging for MLO usecase.
Band info will indicate the band of the link involved
in MLO conenection.
Change-Id: I5ba9fff874da52aa36af6ced97f065d9976665e2
CRs-Fixed: 3583657
Firmware sends PEER_OPER_MODE_CHANGE event to host in SAP
mode when a connected client indicates upgrade/downgrade
of its bandwidth.
Host needs this data as any further SAP bandwidth
upgrade/downgrade should honor the indicated bandwidth for
that specific peer.
Change-Id: I50fecf670b47c56e3f33b8519fde1d5eaec7523f
CRs-Fixed: 3604716
After roaming to 3 link AP, update the MLO manager with the
self link address received from the roam synch indication.
Change-Id: I6258abe7bb9e140307c30fee8701ef12a618d9f1
CRs-Fixed: 3591487
Currently while processing roam synch indication event, the
setup links info is filled for WLAN_UMAC_MLO_MAX_VDEVS(2). But
with 3 Link MLO support, it will reject the roam synch
indication event.
So allow 3 Link roam synch based on fw capability and ini
intersection for number of links supported. Use
wlan_mlme_get_sta_mlo_conn_max_num() API to get max allowed
links for connection.
Also replace array length declaration for setup_links having
WLAN_UMAC_MLO_MAX_VDEVS and use WLAN_MAX_ML_BSS_LINKS instead.
Change-Id: I1982e50f5036ba4eacbab50044444a7238cd1073
CRs-Fixed: 3573066
Currently in driver while using QDF_MAC_ADDR_FMT to print mac
address, the mac address reference provided to QDF_MAC_ADDR_REF is
incorrect in some cases. Fix all such instances.
Change-Id: Ib5d84b01542ebf04ee7d23fb65305036651a6a45
CRs-Fixed: 3556409
Send configured value of MLO TP preference percentage
via ini mlo_tp_preference_percentage to FW, so that FW
can consider provided value during score calculation
while roaming.
Change-Id: Iac8c82b525f9b37ff6d7eb86df369bd1efb375e3
CRs-Fixed: 3514938
Since fw update the logic of roam stats, the data of
wmi_roam_trigger_reason maybe null when fw send event
of WMI_ROAM_STATS_EVENTID to host driver, and at that
time, the num_roam_trigger_reason is zero, we don't
need reduce the length when extract roam stats event.
Change-Id: I332de7ba2d2efeba722e2194af4b9c97ef310a73
CRs-Fixed: 3475501
Firmware sends beacon/probe response of the roam candidate to host
through roam_frame_event when it chooses a candidate which needs
SAE authentication to be performed. This is needed as the host
checks if corresponding scan entry is present in the scan db
before starting SAE authentication trigger.
But in MLO roaming case, firmware might send ML probe response
and the scan entry corresponds to re-assoc link might be present
in the per STA profile of the ML probe response.
So, extract all per-STA profiles and add them to scan db.
Also, use this API to extract and add the link specific
ML probe responses for the ML probe response received
in roam sync indication if extraction via roam info fails due
to some reason(currently it may fail if fw roams to a link but
got ML probe rsp from other link as link_info is not
present roam info).
Change-Id: I6c67927732a54568dfe618bdecaca8f37515e203
CRs-Fixed: 3454834
Host received deauth and roam sync back-to-back after WoW, sent vdev
RSO_DISABLE before RSO_STATUS event, F/W assert.
1. Host received deauth event, limSmeState went out of link est state, sent
async event of cm_send_sb_disconnect_req.
2. Host received and handled roam_sync, CM_RSO: vdev0:
[ROAM_RSO_ENABLED(2)] --> [ROAM_SYNCH_IN_PROG(5)], roam sync failed since
not in link est state.
3. Host aborted roaming, ent back to CM-VDEV-0: CONNECTED, removed roaming
cmd from serialization queue.
4. Host sent RSO stop to F/W.
5. Host handled cm_send_sb_disconnect_req, dropped RSO stop during roam
sync, called cm_disconnect_continue_after_rso_stop without waiting for
RSO_STATUS event.
6. Host sent vdev RSO_DISABLE and vdev stop before received RSO_STATUS
event, F/W asserted.
To fix it, if host roam sync failed, need wait for HO_FAIL event and handle
it before handling other cmd, can't remove roaming cmd from assoc vdev
serialization queue to unblock other pending cmd before handling
HO_FAIL, just send assoc link RSO stop to F/W one time with
REASON_ROAM_SYNCH_FAILED, then wait for 2 events: FW_ROAM_EVT RSO status
and HO_FAIL. then handle HO_FAIL, at last remove roaming cmd, unblock other
cmd and trigger disconnect.
Change-Id: I03dd3ed21007ee67613c2d90b5567348c240f375
CRs-Fixed: 3445233
Extend WMI_ROAM_STATS_EVENTID event information for
requirement of:
1.Roam trigger related information, include timestamp,
trigger reason, trigger condition, abort reason,
scan type, roam status and fail reason.
2.Roam scan related information, include scan channel
number, dwell type, max dwell time of each channel
and total scan time.
3.all types of roam related frame information, include
timestamp and successful or failed status for Preauth,
Reassoc, EAPOL-M1/M2/M3/M4.
Cache roam information in wlan driver, when qca vendor
cmd of QCA_NL80211_VENDOR_SUBCMD_ROAM_STATS get roam
information, driver send all the cached information to
user space.
change-Id: Ic5e1120b51c20c103100833b4296002c5939b021
CRs-Fixed: 3389269
For newer AKMs with key materials length greater than
16bytes, kek, kck lengths varies. Therefore, get the
lengths explicitly from firmware and use them for saving
kek and kek materials.
Change-Id: Ie7ae61744e101899f12addc1baf90aed542a367b
CRs-Fixed: 3371470
Componentized code should be adhering to the coding standard.
However struct roam_offload_synch_ind has a large number of
camelcase members.
To fix this replace camel case members with snake_case.
Change-Id: If866379d8f01cc0e932ea391d586575de4af9163
CRs-Fixed: 3383579
Currently, the definition of WMI_ROAM_GET_VENDOR_CONTROL_PARAM_ID
is present at the fw-api level. The host should not be using fw-api
definitions outside the WMI TLV code. To make sure it,
1. Add host-defined enum vendor_control_roam_param which defines
the param IDs that the host supports.
2. Add logic to convert host-defined enum vendor_control_roam_param
to fw-api defined enum WMI_ROAM_GET_VENDOR_CONTROL_PARAM_ID and
vice versa.
Change-Id: I035ece1bc0af8e583782460868193affb76db0f3
CRs-Fixed: 3363916
In case of 1x MLO roaming, 4 way handshake is offloaded to supplicant
and link vdev is down in FW. Host has to bring up link vdev post
set key installation.
Add handling in host for following:
- During roam sync indication handle only assoc link.
- Save reassoc response and link information.
- After keys are installed bring up link vdev by
queueing connect req on link vdev.
- Enable roaming after all links are up.
Change-Id: I9c0722f88e950ba05ec3dd7f44883bedf568f97d
CRs-Fixed: 3287316
Pass the akm explicitly in the external auth
request to the userspace since there are many
SAE AKM suites.
Change-Id: Ifef8657f7ef75b402aa670813eba6adc5ab9853a
CRs-Fixed: 3355395
For SAE-EXT-KEY AKM with group-21 pwe, the PMK
length is 64bytes. Therefore, increase the max
size of the PMK to 64bytes in host to facilitate
PMK storage and PMK offloads.
Change-Id: I777a31acd56073d6a0312c47d95fe7d155b06fc6
CRs-Fixed: 3353102
Roam sync may get aborted on link vdev due to multiple reasons.
Link scan entry being not available at host is one such case.
del_sta response of BSS gets dropped due to stale link-RSO state
and results in disconnect timeout.
Reset the RSO state machine of link vdev when roaming is aborted
to allow cleanup the vdev in next disconnect.
Change-Id: Ie584c5b7ccae989cf2ce64e85da26d1b3526f1e0
CRs-Fixed: 3352543
When firmware attempts roaming to an MLO AP, it tries to find
the complete ML info(all links info) either through ML probe
response or beacons from all the links. It forwards all link
beacons(or ML probe response) to host as part of roam sync
indication through roam sync frame event.
Add support to fetch both link beacons and add them to scan db.
If firmware sends ML probe response, generate link probe response
as well and add it to the scan db.
The link scan result can be used in link connect in case of
hybrid roaming like OWE, 1x,..
Change-Id: Ic8457a5630441d6fd3faeb4791c79422db787f94
CRs-Fixed: 3335225
The kernel-doc script identified several documentation issues in
wmi_unified_coap_api.h, so fix them.
Change-Id: Ied119dcf6acd477981c990007a916c66689bcce8
CRs-Fixed: 3331885
Firmware may send two consecutive roam sync frame indications when
it supports MLO roaming. The first event carries link beacon and
second event carries assoc beacon. This is to let host driver have
both the link scan results if host has to take care of link
connect(e.g. OWE MLO roaming, EAP MLO roaming,.. ).
If host driver doesn't have support/doesn't need link beacon,
it would be overwritten by assoc beacon(e.g. wpa2 MLO roaming,
SAE MLO roaming, ..).
This results in a memleak as the previous cached beacon is
not freed(vdev->rso_cfg->roam_sync_frame_ind->bcn_probe_rsp).
Free the existing beacon if new one is received. Also, remove the
current free's from extract_roam_sync_frame_event_tlv() which
doesn't need any such freeing as the copy always happens to a
freshly allocated buffer.
Change-Id: If3b4d6e4b8e1e2af5306171ad7eda28e744da64e
CRs-Fixed: 3322094
Host driver expects maximum of WLAN_UMAC_MLO_MAX_VDEVS links
info in roam sync indication. But firmware may send more
number of links than expected and it may lead to buffer overflow.
Add a check to validate the number of links.
Change-Id: Id89d23470622ba3ca7e01a99cc7c12021ca3dafd
CRs-Fixed: 3314460
Add changes to enhance the debugs in the RSO path,
to identify the current pmk stored in the rso config.
Also, restrict the PMK dumps to a minimum size of 2.
Change-Id: I6e89afed45f5d43b45508ae43b59400a6e24e5ef
CRs-Fixed: 3312677
To protect user privacy, print SSID with QDF_SSID_FMT
and QDF_SSID_REF, then SSID will be hide in logs if
anonymization is enabled.
Change-Id: I3dd129b52c85c84e666f4f07b28a1e58f81259b7
CRs-Fixed: 3291841
More than one roam sync frame event can be sent from FW so
the beacon, reassoc req or rsp length can be zero.
Hence the current code validation check is incorrect resulting
in roam abort.
To fix this, change the validation to check if beacon,
reassoc req or rsp value is non zero and then check the size.
Change-Id: I6ddec91686c23d9b8dac4c891b37bb1ce9d0fb30
CRs-Fixed: 3306428
This change
1.fixes the use of uninitialized
variable in host driver.
2.Adds validation in extract_roam_sync_frame_event_tlv
Where these frame lengths are getting populated,
also at the place where subtraction happens to prevent
overflows
3.Adds NULL check in wma_handle_roam_reason_deauth, to avoid
the null pointer dereference.
Change-Id: I2d5ba61fb109f6d8b497df29cfa2dd572c00adeb
CRs-Fixed: 3297792
When roam from SAE legacy to SAE MLO, pre-auth TA is MLD address,
while peer AP expects link address, pre-auth fails.
Parse transmit address field from firmware roam_preauth_start_event and
include it when send NL80211_EXTERNAL_AUTH_START to wpa supplicant for
SAE roaming cases.
If transmit address is all zeros, wpa_supplicant will not do ML sae
auth, use MLD address as TA.
If transmit address is not zeros, wpa_supplicant will do ML sae auth,
use 'transmit address' as TA.
Since self peer is created with mld address, when roam from legacy to
MLO, try to get peer by mld address during pre-auth tx since bss peer
absent, or TX fails for no peer.
Change-Id: I99ed846e94165bfe01e1d1e8c620f035751c7056
CRs-Fixed: 3289987
