Currently, in wlan_defrag_elemsubelem_fragseq() API,
there is possible buffer over-read in fragbuff buffer.
Buffer may have a malicious length larger than their
payload size, which leads to a buffer over-read during
defragmentation.
Fix is to validate the fragment length against the buffer
boundary in util_get_successorfrag().
Change-Id: Ia9e688a0ab17954eb464ec586820bb95b51f12d1
CRs-Fixed: 3236560
Add following fixes for STA to support and operate in
eMLSR mode
1) Update and send eMLSR cap flag to FW even in vdev start
request on both links.
2) Copy EML caps to wmi peer assoc mlo params to send it
to FW.
Change-Id: Ic17b9b82809659d7a4392c09eceecae7c53b2049
CRs-Fixed: 3237737
Add feature flag to indicate support for sending authentication
frames with Link Address.
Change-Id: Ifbd28b8d474b28b0e85a23c9c91ebccedb381d9c
CRs-Fixed: 3239304
Firmware advertises WMI_SERVICE_DELETE_ALL_PEER_SUPPORT
capability to indicate vdev peer delete all command support.
PASN peer relies on the WMI_VDEV_DELETE_ALL_PEER_CMDID
command to delete the PASN peers before vdev delete.
So allow PASN peer create only on targets that advertise
WMI_SERVICE_DELETE_ALL_PEER_SUPPORT.
Change-Id: Ib94d9e14e34dd1e5c25bf6946e0d59fe83fd6dd3
CRs-Fixed: 3229438
Select best candidate by mlo score algorithm.
Check bss mlo type first by mlo info, mlo config, partner frequency and
dbs/sbs cap, calculate candidate score for SLO/MLMR/EMLSR bss types.
For SLO case, same as before except:
Decrease percent of legacy band and nss to include 320M and 8x8.
Decrease max percent of congestion from 100 to 80 to include MLMR joint
congestion.
Increase weight of both band width and nss to 20.
For EMLSR case, same as SLO except adding EMLSR boost score.
For MLMR case, besides adding MLMR boost score,
calculate joint RSSI/band width/congestion score for combination of
scan entry + each partner link by new mlo algorithm, select partner with
highest total joint score as candidate combination, only activate that
partner link.
Change-Id: I640c6825d945caf5fab504a77717195c2eac0c93
CRs-Fixed: 3234912
Add mld config checks in osif_vap_create_check and fail
once the config is invalid.
Change-Id: I26c3b4719fa9b18be0a4590861c654504fb3e6bf
CRs-Fixed: 3200923
btcoex status is not extracted in the extract_roam_scan_stats_tlv()
which was required for ROAM_SCAN_DONE event logging due to
which wrong status is printed in ROAM_SCAN_DONE
logging.
Extract bt_coex status in the extract_roam_scan_stats_tlv()
in order send correct value of bt_coex status for
ROAM_SCAN_DONE logging.
Change-Id: I45ee27e5b8a52b79954dceb9f3cdc46870b7a48d
CRs-Fixed: 3236401
Add infra to support Dedicated Bluetooth Antenna Mode (DBAM)
feature. It is used to switch between dedicated antenna for
BT and shared antenna for WLAN and BT.
Change-Id: I21688093674ef9b63ee811df9168a31bd71c56b5
CRs-Fixed: 3239895
Currently the channel state of HST secondary_cur_chan_list/cur_chan_list
is out of sync and beacon IE is populated from secondary_cur_chan_list,
which causes the actual supported channel lists and country IE channel
lists are unmatched for non-6 GHz case. So let secondary_cur_chan_list
align with cur_chan_list.
Change-Id: Ie3914ac48dc05d61ac2deb78a2892986efe238dd
CRs-Fixed: 3239390
In case of RCAC, check if CAC is completed only on the RCAC
channel and do not check the CAC info on current operating
channel.
After RCAC complete is sent to FW, the RCAC tree info is
cleared. In case of RCAC, check the CAC done info only
on RCAC channel.
CRs-Fixed: 3231140
Change-Id: I976b2b5e29ebdf2dc4fb2e5df1f2feb700c972af
In case of BW Expand is enabled, Check if the user
configured channel is available. If it is available,
STOP the AGILE SM and Restart the AGILE SM. This will
clear any old preCAC/RCAC chan information.
CRs-Fixed: 3231108
Change-Id: I0d45204c8525ad7439a3b11cb4f8f8e7f20105d3
Skb under panic issue is seen when a packet comes via RX err path,
MSDU length read by SW is coming as 0 and leaving no space for skb_push
in buffer, data is moving beyond the head and causing the issue.
MSDU length is read by generic API which is architecture-independent,
hence the struct size for one architecture is different from another
architecture.
FIX is to get the MSDU length by architecture-specific API.
Change-Id: I5a6259034e5e06ae9ce7ba6b135b44f2849f2fd9
CRs-Fixed: 3235636
Set function pointer for SCS peer lookup and rule handler.
Add a new module id for SCS.
SCS database maintained in dp_peer structure is redundant as
same info is maintained in control peer. Therefore remove
SCS database from dp_peer structure and also remove APIs
which access/update this database.
Change-Id: I951f12de487a4be3ae169d1e309352e4e5031fc9
CRs-Fixed: 3226693
Currently regulatory is using current channel list to indicate
the available channels to all the interested components.
With the addition of 6 GHz channels which has different power
types, super channel list is introduced.
With this change, use super channel list to indicate available
channels to other components.
Change-Id: I1a99643d83f090937a667e528b0359b27311e40c
CRs-Fixed: 3160500
Since there are multiple power modes in 6 GHz, the current channel list
alone is not enough to represent the capability of the chip or
device. Given a channel, in many cases it may be required to know all
the power modes that are supported by this channel.
To represent this information per channel, the concept of a super
channel list is introduced. Update regulatory APIs to use
super channel list.
Change-Id: I2e292125d6b667c2c28e4b1326f47f8ccc81e5a9
CRs-Fixed: 3159628
SAP secondary channel offset of HT info in beacon is set wrongly.
When STA connects it, channel bonding mode check fails, falls back to
20 MHz width.
SAP secondary channel offset of HT info in beacon is decided by checking
40 MHz bonded frequency list. If primary frequency is start frequency of a
bonded frequency, then secondary channel is above the primary channel,
secondary channel offset should be set to 1, else set to 3.
For example, if SAP primary frequency is 5220 MHz, {5220, 5240} is 40 MHz
bonded frequency, secondary channel offset only can be 1, can't be 3.
Change-Id: I491c2351c4c89d6344adf40a46150dc7577ee783
CRs-Fixed: 3241004
To avoid unmeaningful rate fluctuation, when report
rx linkspeed to upper layer, exclude special frames:
arp/ssdp/dhcp/eapol/ipv6 NA/NS/DHCPV6 in low rate.
Change-Id: I4bc49a808a02b4bc8c687f70690922045d65e739
CRs-Fixed: 3198484
There is a possibility where host can receive invalid SW cookie
from Rx rel ring which causes invalid rx descriptor access in
dp_rx_wbm_err_process().
Add a sanity check on received SW cookie to prevent the invalid
rx descriptor access.
Change-Id: I7818290466a2a8cea9938577fbf869d1fc30d5e3
CRs-Fixed: 3240038
In case of MLO, if connect is in progress and assoc vdev is moved to
connected state, if the disconnect is received before mlo mgr is
notified for connect, then it can lead to race between connect and
disconnect processing.
Add fix to avoid race between connect comlplete and disconnect by
checking connected link bitmap which is set in mlo connect notifier
Change-Id: I5783827c00106bf6bda2949e4154088fd172de15
CRs-Fixed: 3241708
If vdev is updated in mld_peer, then vdev in txrx_peer of mld peer
should be updated and synced accordingly.
Change-Id: I003ab5f3d96f0b62a5ed1dad2b1e8d4f57f58dad
CRs-Fixed: 3242644
Add function pointer declaration for SCS peer lookup and rule
match and also define cdp call for the same.
Change-Id: I4329b746a12f019a077652d02625b76c7f5fa21f
CRs-Fixed: 3226475
In hypervisor system, lock may hold too long due to context switches
and system calls at host which is leading to stolen time. Sometimes
this delay will be larger than 100 ms.
To address this issue, it needs to increase irq save spin lock detection
threshold to 100+ ms for hypervisor system.
Change-Id: I6ea11b96e786c7f45bc84b29e0315e690552569f
CRs-Fixed: 3125904
Add function declaration for the following APIs
1) dfs_bwexpand_find_usr_cnf_chan
2) dfs_bwexpand_try_jumping_to_target_subchan
3) dfs_is_rcac_cac_done
4) dfs_get_configured_bwexpand_dfs_chan
The mentioned APIs are used for BW Expand feature.
CRs-Fixed: 3230855
Change-Id: I17a4549a804a92f2ad3fbc8050a979a44796a152
Host failed to read some of cfr elements by HAL_RX_GET
for Waikiki since their LSB is big then 32 and reading
4 bytes isn't enough. This change reads 8 bytes and then
gets cfr elements properly.
CRs-Fixed: 3241915
Change-Id: I0863f22a1cc0c5fd490ec3669ff6a97b27c66f15
Changes to fetch the default monitor ring config and then
apply CFR filter settings on top of it instead of overwriting
the default one.
CRs-Fixed: 3241818
Change-Id: I7b9d1c9560fd665e0f6418176e6dd3642450442f
Add the following two vendor attributes to send TIM beacon
statistics to userspace which can be used for power saving:
QCA_WLAN_VENDOR_ATTR_LL_STATS_TIM_BEACON
QCA_WLAN_VENDOR_ATTR_LL_STATS_TIM_BEACON_ERR
Change-Id: I2986d7e573ed7eaf72a620b928daceccc43b9066
CRs-Fixed: 3234924
Packet logging buffer is only 2048 bytes, if copy non-linear
TX packet with skb->len (like TSO) which is likely > 2048,
this will lead to skb panic as packet logging buffer can not
accommodate it.
Only support TX packet logging with single linear buffer.
Change-Id: I1d15f9ab80fcc1720fdb3f7fe8c89e7f5e3c0a79
CRs-Fixed: 3242090
Add support for initiate pasn authentication using the vendor
command: QCA_NL80211_VENDOR_SUBCMD_PASN
Fill the below required attributes to initiate PASN:
QCA_WLAN_VENDOR_ATTR_PASN_ACTION
QCA_WLAN_VENDOR_ATTR_PASN_PEERS
QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAC_ADDR
QCA_WLAN_VENDOR_ATTR_PASN_PEER_SRC_ADDR
Change-Id: If33f54eafe5986b4571cc21a80fb0b61578db116
CRs-Fixed: 3232261
If there is no resourse to send packet via HTC, then check if interrupts
are not processed from that CE for last 3 seconds. If so, schedule a
tasklet to reap available entries. Also if Queue has reached 1024 entries
within 3 seconds, then also schedule tasklet.
This change is added because there is a case where intermittently
completion interrupts are not received from CE3 and hence adding
this WAR in host to come out of this issue scenario.
Change-Id: I126cd5e678517127659237308f8f6b1313f8f422
CRs-Fixed: 3234943
Create a HIF context for UMAC reset handler, register the datapath UMAC HW
reset callback handler with HIF layer, request for UMAC HW reset interrupt,
and schedule a high priority tasklet to process the interrupt in which
call the registered DP callback handler.
CRs-Fixed: 3184312
Change-Id: Iefc811bf0d1b093c3c63bf2238c94a1448f4f139
To support WDS feature in IPA driver, WLAN needs
to update the ast entry for any new rx packet, and for
end-nodes connected via repeater to root.
CRs-Fixed: 3226348
Change-Id: I7383b12f18e7c70ec06499d66130667eca033131
Current IPA/WLAN driver does not support the WDS feature.
Packets are dropped if they came via end-node which is not
in direct connection with root AP.
Fix is to enable WDS support and update the same to IPA
driver and create/update AST entries for end-node in
roaming, new src port learn case. Send WDS support to IPA
at wdi init and AP client connect event.
CRs-Fixed: 3226348
Change-Id: I26211613334b33d0d601629405597be329a56774
Add a new vendor subcommand QCA_NL80211_VENDOR_SUBCMD_SCS_RULE_CONFIG
for configuration event of Stream Classification Service (SCS) rule.
Also define the attributes present in this subcommand.
Change-Id: Idab722532f9870a377e5f1c02185bdfe2ccb39eb
CRs-Fixed: 3226253
Add enum for SCS rule configuration index.
This index is used by vendor subcommand
QCA_NL80211_VENDOR_SUBCMD_SCS_RULE_CONFIG while sending NL event
to SCS daemon.
Change-Id: Ic2491d8ec6c2f13f5c45ebaec189b239f0ee9933
CRs-Fixed: 3241704
Modify the get API that fetches the channel index given a frequency,
from a linear search to a binary search to improve the search time.
CRs-Fixed: 3230932
Change-Id: Id6a1a20d80989a797505772954fb913c4f57d227
Instead of looping through the current channel list, which takes O(N),
use the existing formula to directly convert frequency to
IEEE channel number, which will take O(1). This will reduce the CPU load.
CRs-Fixed: 3230932
Change-Id: I38e3a67c6ef4295cea3a8a57f3a853651445f0b5
Add a new QCA attribute QCA_WLAN_VENDOR_ATTR_CONFIG_DBAM
to configure Dedicated Bluetooth Antenna Mode (DBAM) feature.
It is used to switch between dedicated antenna mode for BT and
COEX shared antenna mode for WLAN and BT.
Change-Id: Id1e04e8647a0b4ff6bb83f272c0f891aa88f111c
CRs-Fixed: 3239894
Check RSN ie valid or not for beacon or probe response frames
in scanning. The invalid RSN ie will cause the AP filtered out
during candidate selection in connecting.
Change-Id: Id324ddfaa0f438482673e66b683dcf903d9fc0e3
CRs-Fixed: 3218707
When BW Expansion feature is enabled using UCI or cfg80211tool
command, the utility function to set/get the BW Expand feature
is introduced inside DFS module.
A new dfs member dfs_use_bw_expand is used to store the status
of BW Expansion feature.
CRs-Fixed: 3229250
Change-Id: If01e080f8e60e883fbeb2d7dfd599b91584bc293
Fix TWT configuration for 2.4 GHz PHYB mode MAC.
Change is macro protected. Wlan resource config sets twt_ap_pdev_count
to number of Radios per psoc. But for 2.4 GHz vap coming up in PHYB
mode needs the value 2 if only one radio is enabled per psoc. WAR is
done from host driver to enabled TWT certification process. Actual fix
must be done from Firmware code.
Change-Id: Id29692097ee555c94c54f53d7540eb108fbe98e0
CRs-Fixed: 3238210
