For MLO vdev currently the discovery attempts threshold is
multiplied by 2 to increase the discovery window thereby
increasing the discovery probability in noisy environmental
conditions. But 5 discovery attempts on each link is
sufficient threshold. Increased discovery attempts causes TP
issues with peer connected to different AP for MLO vdev since
frequent link active/inactive change happens.
So remove the discovery attempt multiplier for MLO TDLS vdev.
Enhance few debug logs.
CRs-Fixed: 3702198
Change-Id: If5513987447296140788c1ee021329dc721df65f
Any MLD peer setup call to cdp shall happen only after
clearing the existing MLD peer otherwise the MLD peer's
VDEV reference is lost on recreation. This leads to
VDEV reference leak.
Add history to track the peer setup and destroy sequence,
to understand the CP peer create/destroy sequence when
any such leak happens.
Change-Id: If338bc26e086490a3cc2bb4de32efa6a762ee0e6
CRs-Fixed: 3736548
Add new APIs to save number of links to which FW roamed
and add new API to retrieve this saved info.
Change-Id: Idfd8727855bd5da97a3808c78e89a505ef06c249
CRs-Fixed: 3755754
Currently, firmware-reported unsafe channels are ignored
and userspace configured channels are honored when
coex_unsafe_chan_nb_user_prefer ini is set. This is supported for
SAP mode only.
But some platforms may want driver to ignore the firmware-
reported coex channels for P2P-GO also.
Enhance the ini to allow user to configure mode specific
bit as mentioned below,
BIT 0: Don't honor fw coex/unsafe channel info for SAP mode
BIT 1: Don't honor fw coex/unsafe channel info for P2P-GO mode
Change-Id: I91a2c6b2da9aba411d081f6ae3b23d374fe53159
CRs-Fixed: 3766393
Currently, Host driver is rejecting force scc on non DBS
solution when QDF_MCC_TO_SCC_WITH_PREFERRED_BAND is set.
This change is to allow STA + SAP concurrency on non DBS solution.
CRs-Fixed: 3716279
Change-Id: Ief73a57d23f627764eca00254acf4cf7e9acd963
Host update “UL MU-MIMO” bit as HE cap in assoc request
based on below 2 things:
1. "enable_ul_mimo" INI
2. FW capability WMI_HECAP_PHY_ULMUMIMOOFDMA_GET
Fix is to overwrite he_cap->ul_mu feature in assoc request
configured via above FW capability with value of ini
"enable_ul_mimo".
Change-Id: I6ede13ec107a194f11a094ccd954155e859c02ec
CRs-Fixed: 3750038
Currently TDLS module acquires WIFI_POWER_EVENT_WAKELOCK_TDLS
wakelock and prevents run time suspend when TDLS is enabled for
a peer. While releasing the wakelock and allowing suspend, it
checks for the connected peer count in tdls_update_pmo_status().
But the peer count is not decremented here yet.
Below is the current call sequence:
tdls_disable_offchan_and_teardown_links()
-> 1. Call tdls_reset_peer() -> this calls
tdls_set_peer_link_status() ->
tdls_update_pmo_status()
-> 2. tdls_decrement_peer_count() - Sets the
connected peer count to 0
Update the sequence as below:
call tdls_decrement_peer_count() first and then call
tdls_reset_peer().
CRs-Fixed: 3735021
Change-Id: Idf91a0c96c9660df466143f8ac115f694b3070d2
HW is non-DBS. SAP is UP in 6 GHz. Now, when a STA connection is
attempted, the pcl for the second connection would have SAP SCC
channel with highest priority, all the 5 GHz channels with 2nd
highest priority and the 6 GHz channels with least priority.
Therefore, even if there is a strong 6 GHz candidate for STA, the
5 GHz candidate would be chosen and the SAP moves to SCC in 5 GHz.
To fix this, ignore the pcl scoring for the non-DBS concurrency
cases as the SAP can move to the channel of the best STA interface.
If the SAP is in legacy band, and if still a 6 GHz STA is chosen,
then the legacy SAP would be torn down. So, give STA the best
possible in non-DBS case.
Change-Id: If268b61c61e77db96b499437cdbc95188240fba8
CRs-Fixed: 3749399
Currently STA+Mon mode is not supported in LPC case
as both mode uses monitor interface to capture
packets. So to distinguish between two different
monitor modes export new API to store monitor interface flags
Change-Id: I463353a1a01f53d48e004f60c52c24f1d8084154
CRs-Fixed: 3739289
As per new requirement, If DUT associates with an AP does
not support BTM then when host receives BTM req frame
from FW. Instead of forwarding the BTM req frame to
supplicant, host should drop it.
Change-Id: Ie6b6c27c01b072fac19dc039327cb9a86370b535
CRs-Fixed: 3746758
For Dual SAP(legacy SAP + 6 GHz SAP), WFA HE-4.1.1 cert
case requires the following:
a) If Dual SAP is enabled, the 6 GHz SSID should be
discovered via the RNR IE of the colocated legacy SAP.
b) If a co-located neighbor is present, the 6 GHz SAP
should not send FD or unsolicited probe responses.
Add support for the above the cert case by configuring the
FD support for the 6 GHz SAP based on the operation of the
co-located SAP.
Change-Id: I045911cd34bceccdb08248ae7b99beb8454a2c98
CRs-Fixed: 3732649
Currently default link update is only done in link switch
or dynamic mac address update case.
There is other scenario also where default link case become
inactive and update to DP will not happen.
So, to handle those scenarios, expert new API to update
DP default link.
CRs-Fixed: 3733584
Change-Id: Iab24c38c454cc5cb9f568de680531b38e4d3da45
Currently when suspend sequence is going on and WOW handshake with
F.W is completed, then we check for wow initial wakeup flag if it
is not set then we proceed for suspend. But if this wow initial
wake flag is set just after it being checked in suspend sequence
then we miss honoring the wake message and host will be stuck in
suspend state.
So to avoid this make sure we are requesting resume from wow initial
wakeup setting context. So that resume request is posted properly.
Change-Id: Idd082ef82a4d7dbd62d7762f10debe1db9baed88
CRs-Fixed: 3743425
User/wpa_supplicant disable roaming flag is only effective for current
connection, it will be cleared during new connection.
APP/wpa_supplicant can uses QCA_NL80211_VENDOR_SUBCMD_ROAMING to change
roaming behavior for current connection.
Change-Id: If9f439f51e25e3d67f5db5557c0d8f468b071596
CRs-Fixed: 3737996
On receiving QCA_WLAN_VENDOR_ATTR_CONFIG_BTM_SUPPORT vendor
command, do below action in host:
1. Disable btm_offload_config in FW via RSO command.
2. If btm_offload_config disabled in FW at step #1,
FW forwards BTM frame to Host, Host needs to drop frame.
3. Disable btm ext capability (p_ext_cap->bss_transition)
bit in assoc request and unicast probe request to AP.
4. On disconnection, restore BTM configuration.
Change-Id: I228bafe243c43bc055f19d472c2f2d986225f577
CRs-Fixed: 3742276
Add support to process newly added vendor command
QCA_WLAN_VENDOR_ATTR_CONFIG_BTM_SUPPORT.
User space use this vendor command to disable/enable
BTM roaming for STA interface.
If host receives this vendor command in connected
state, host should return failure to user space.
Change-Id: Iafadc2fab2ee30a0eb2e8e7ebb7178c1d36fe1c9
CRs-Fixed: 3715920
AP sends "Operating Mode Notification" IE having max supported
channel width (say ap operating bw) via beacon/probe response/
association/re-association response frame.
When datapath detect leaky AP, to enable/disable, userspace
sends ch_width update to host.
Step 1. If STA founds OMN IE present in above frame, host
sends update channel width (say new AP operating BW is
80 MHz) ind via WMI_PEER_SET_PARAM_CMDID with param id 4
(WMI_HOST_PEER_CHWIDTH).
Step 2: After ch_width update to 80 MHz in FW at step 1,
if host receives a update ch_width (to 160 MHz) request
from userspace on leaky AP detection disable. Host updates
its internal channel info structure with new BW and sends
update indication to FW via WMI_VDEV_SET_PARAM_CMDID
with param id WMI_VDEV_PARAM_CHWIDTH_WITH_NOTIFY.
In case, if host allows ch_width update greater than ch_width
present in OMN IE (ap operating bw), FW only disable leaky
detection but did not update Rx/Tx BW as per new ch_width as
ap operating bw is still 80 MHz (configured at step 1).
This leads to out of sync for value of ch_width in host and
FW and IOT issues.
To keep host and FW in sync with current AP's operating BW,
add a sanity check and reject request before updating internal
channel info structure in host if new ch_width (coming from
user space) is greater than ap operating bw present OMN IE.
Change-Id: Iedc1706e32b9e08512ca6c9b98162902cd32f976
CRs-Fixed: 3732557
When enable irq failure is encountered trigger recovery with reason
code ENABLE_IRQ_FAILURE, this helps to recover the system in error
scenario.
Change-Id: I003f43fc9e3473cc939729700a03c8a8c790d34f
CRs-Fixed: 3724860
In the api extract_roam_frame_info_tlv(), the status code
for the MGMT tx packet is filled with tx_status value instead
of correct value.
Modify the api extract_roam_frame_info_tlv() to populate the
proper value of status code for MGMT TX packet.
Change-Id: Ia07b34ccc74f47bfac56bb1831e4ad1bce237d63
CRs-Fixed: 3741911
Force single link on 2 GHz:
mlo_support_link_num=1, mlo_support_link_band=1
Force single link on 5 GHz:
mlo_support_link_num=1, mlo_support_link_band=2
Force single link on 6 GHz:
mlo_support_link_num=1, mlo_support_link_band=4
Force 2 links on 2+5 GHz, force assoc link 2 GHz:
mlo_support_link_num=2, mlo_support_link_band=0x13
Force 2 links on 2+5 GHz, force assoc link 5 GHz:
mlo_support_link_num=2, mlo_support_link_band=0x23
Force 2 links on 5+6 GHz, force assoc link 6 GHz:
mlo_support_link_num=2, mlo_support_link_band=0x46
Change-Id: Id6f56421528a42aa7059693845fe71a206bded93
CRs-Fixed: 3722009
In mlo_roam_copy_reassoc_rsp(), assoc_rsp is a pointer inside
copied_reassoc_rsp incase of memory allocation for assoc_rsp,
copied_reassoc_rsp is getting freed but in the same error leg
"connect_ies->assoc_rsp.len" is getting set to 0 resulting in
use-after-free
Remove the code in the error handling to avoid use-after-free.
Change-Id: I5a7b3bbef42db4e8bedba0c7c3eaf961e4d7e83a
CRs-Fixed: 3728493
Currently, In the MLO t2lm API, wlan_mlo_parse_bcn_prbresp_t2lm_ie
is missing frame boundary checks which may lead to out-of-bound
reads if the lengths are not checked by the caller.
Fix is, while parsing t2lm ie pass the frame length and add
check for frame boundary.
CRs-Fixed: 3707241
Change-Id: Ic83638eff2250a704df8dfa8bd233238fcc7a25b
Currently, Host driver is enabling CTS2SELF for most of the qcom
AP (8CFDF0) and It will try to send the data in all the cases by
not waiting for RTS-CTS and in some cases if it does not win the
medium, it will take around 4x time than normal RTS-CTS(in case
of failure) leading to throughput issue.
This change is to disable CTS2SELF for OUI : 8CFDF0
Change-Id: I4becf0d1c093f458868634a9636d2e14d60a9f37
CRs-Fixed: 3689771
Add support to send roam cancel diag event in instances with
below reasons:
IDLE ROAM scan cancelled due to screen ON
scan cancelled due to other high priority roam scan
Add new diag structure & reason code enum for this diag
event
CRs-Fixed: 3708863
Change-Id: I1f7a819d766735f7d89eda3945e7ed92d22919ae
Extend the page fault action INI to handle following:
1) Ignore page fault event
2) Trigger SSR on page fault threshold
3) Send blob of data to userspace on page fault threshold
On pagefault wakeup event, save per symbol pagefault timestamp
and once the event count reaches configured threshold within the
configured time interval, either trigger SSR or notify userspace
with pagefault address and count based on INI configuration.
Change-Id: I0a3ece369ad0c7aac676fc91f6863e06a3f4ce8c
CRs-Fixed: 3713813
The SAP is not moved to the 6 GHz user configured
frequency in the following cases:
1. STA disconnected, SAP is standalone in 2.4 GHz
2. STA is VLP/PSC channel, but SAP is currently in
2.4 GHz(due to STA(DFS) + SAP)
Allow the SAP to restart in 6 GHz channels for the
above scenarios if the following criteria are met:
1. For standalone: The SAP user configured band is
superior than the current operating band.
2. For SCC: The 6 GHz STA should operate in PSC and
the channel should support VLP in DUT regdomain.
Change-Id: Iea292c94e579ccead2300f6e9b994c4b8e9a0a87
CRs-Fixed: 3713247
Check for DP drain status and prevent suspend if
we fail to drain txrx succefully.
Change-Id: I76c5587719cb162e3e7802586d5ddde24f18e755
CRs-Fixed: 3718937
Some solutions may not have HS-2.0 certification and there is
no need to forward the BTM frame to wpa_supplicant in such
solutions. Let firmware handle the frame in such cases by
enabling btm_offload so that it doesn't wakeup the host.
Firmware may roam to another AP upon BTM reception.
To enable/disable BTM offload add hs20_btm_offload_disable INI.
If this INI is enable BTM offload will be disable and if INI
is disable BTM offload will be enabled.
Change-Id: Id6e18404cc3a12a23b213c0f858c943715285932
CRs-Fixed: 3718776
UL data delay is high when connect specific AP.
To fix it with OUI ini, limit Tx BW if vendor OUI is received in beacon.
Change-Id: I54a4ddb4f113baf1da0ba5490760f38f30159f2e
CRs-Fixed: 3695107
FISA entry is updated by FISA RX and work queue, if the same
entry is hashed for different REO id, the lock may not work
as expected. Change is to hold the lock before work queue
waking up to prevent the race condition.
Change-Id: I16ba4439c1655bbb7bf83b13d9280cb3f7c56478
CRs-Fixed: 3674340
MLD address is mandatory for link VDEV connect request or
else the partner link will fail during candidate fetch from
scan DB because of MLD address mismatch.
For MLO OWE roaming, link VDEV connection starts after
completion of EAPOL-HS, and here MLD address is not filled
leading to link VDEV connect failure.
Use connect response to fill MLD address in link VDEV
connect for MLO OWE roaming
Change-Id: I9eae3b7ba3619a9ce62603efd0590aabce9c70f3
CRs-Fixed: 3715021
Currently, HS_20_AP param of cm_ext_obj->rso_config is set
to true when STA connects to a HS-2.0 AP. This is to disable
btm_offload as per HS-2.0 cert requirements.
But this flag is not cleared even when STA disconnects from
that AP and this disables btm_offload for next connections
as well even for non-HS-2.0 APs.
So, reset the flag as part of connect start to avoid this.
Change-Id: I3763544ecca0e4628b0c78633364fe70fd9b3094
CRs-Fixed: 3712758
Host tried to associate to AP, 6 GHz link is selected as
the assoc link and in the RNR there are two partner links 5 GHz, 2.4 GHz.
Only 6 GHz/2.4 GHz are beaconing and 5 GHz is not beaconing.
STA sent the ML-Probe request on 6 GHz link requesting the full profile
for the 5 GHz and 2.4 GHz links but AP responded with only one partner
link 2.4 GHz, from this we generated 2.4 GHz and added to scan cache,
AP didn't respond with 5 GHz link in per-sta.
STA sent the assoc request over 3-links and AP accepted the assoc,
and association is successful over 3-link and the same is intimated
to the firmware that 3link association is successful.
But while sending the connection information to the kernel 5 GHz link
is not found resulting in HDD/Kernel not being aware of the 5 GHz link.
Fix :- Use assoc response from the ML AP to generate ML probe resp
for the partner links to add to scan DB so that partner link
VDEV will have candidate to start connection.
Change-Id: I30176e58d9b02e7ed275b1c926cd1e119b66f8f3
CRs-Fixed: 3686809
When firmware roams to 2 link AP and sends roam synch key event,
then the pairwise keys are still copied to key_entries for all
the three links in extract_roam_synch_key_event_tlv(). But
since 3rd link is not valid, the pairwise key memory allocated
is not freed resulting in memory leak.
So free the allocated redundant memory for invalid link pairwise
key after roaming.
CRs-Fixed: 3697540
Change-Id: Idfdb53c918d8e684e6171b5e0917e722a2fc605a
This reverts change-Id I7ab2ade0f01ad5035f7b156ded7eb7af7c826b9e.
For CR-3698932, FW to make a change to program MLD address in addition to
link address for ROC request on MLO STA. for ROC scan req host will set
SCAN_FLAG_EXT_FILTER_PUBLIC_ACTION_FRAME.
Host to bring back logic (ROC on BSS channel) added in CR3069810 by
reverting CR3366671.
FW to make a change as replacement fix to CR3366671: allow ROC if requested
channel is same as ULL STA (active link in MLO case) BSS channel when scan
is suppressed due to ULL or other reason.
CRs-Fixed: 3704271
Change-Id: I5914bbd132ebfd9a7b1a852913fb16cdfb1fd8f7
Currently whenever the userspace is trying to reset the previously
configured max mlo links for association, set wifi config command
with "SET_NUM_ALLOWED_MLO_LINK 0" is issued, this always
resets the max mlo value to the ini default value which is 2
rather than defaulting to the firmware/ini intersected value.
Fix is to default to the firmware/ini intersected value rather than
the default value.
CRs-Fixed: 3707990
Change-Id: Iaa7cbe32613102ccffbcf92fcb7ef0a39f96a705
Currently on HO failure host posts disconnect with priority
set in serialization queue before dequeuing the dummy roam
command from serialization, as a result for 2 link ML STA
case when HO failure is received, assoc VDEV disconnect gets
priority over partner link VDEV in the serialization
queue. When assoc VDEV disconnect is complete, host updates this
info to userspace and userspace issues dynamic mac address
update command. While processing this command the DP assoc VDEV
is first detached then re attached. There is possibility of
race where link VDEV disconnect starts in parallel, as DP link
VDEV has the reference of DP assoc VDEV, in order to release the
reference it looks up for the DP assoc VDEV , but as part of mac
address update if DP assoc VDEV is detached and reattachment is
pending then the DP link VDEV doesn't get the DP assoc VDEV and
reference release fails.
To address this issue don't prioritize disconnect for
HO Fail case.
Change-Id: I74c7bce851423226d3aac2750fddd5e6c7e34fd1
CRs-Fixed: 3697528
Add more validation for vendor command force active link bitmap:
1.If force inactive num is present due to MCC link(DBS RD) or
concurrency with legacy intf, don't allow force active if
left inactive link number doesn't meet concurrency requirement.
2.If force inactive bitmap is present due to link removal or
concurrency with legacy intf, don't allow force active if
it is conflict with existing concurrency requirement.
Change-Id: Ic7507c1797189c079f0032a39819e15467bd6bf3
CRs-Fixed: 3701323
Currently the dp_link address is provided to CDP vdev
as a part of vdev register. Also, as per the vdev deletion
sequence, it is possible that dp_link can be destroyed
before CDP vdev is detached. This can lead to use-after-free
scenario when CDP vdev uses the osif_vdev handle (which is
the dp_link handle).
In order to fix this, do not free the dp_link till the CDP
vdev has been detached.
Change-Id: Ie5a1140a0d256b6115fa62e30e6bfd61d1dfc898
CRs-Fixed: 3696641
Peer state could be queried from both fast path and
slow path. Change separates this call and allows log
print from slow path call.
Change-Id: I888b67224752182b792e0165bd5cbacbb7e5f293
CRs-Fixed: 3691146
After received WoW ACK from FW, there should be some RX packets
coming and IRQ delayed, if these packets are not got processed,
FW UMAC will crash. Change adds an explicit check and abort suspend
if rings are not empty.
Change-Id: Ifbd0bfdbc564fb0c02eda7d13756d82966d88549
CRs-Fixed: 3693641
Send the OEM INI configuration of EHT/MLO WPA2 security bitmap
to FW in roam params so that FW can roam to APs allowed by OEMs.
Change-Id: I502d9d2601343f2d781e33c5a4fcf78df037a854
CRs-Fixed: 3698002
