Add new APIs to save number of links to which FW roamed
and add new API to retrieve this saved info.
Change-Id: Idfd8727855bd5da97a3808c78e89a505ef06c249
CRs-Fixed: 3755754
Currently, firmware-reported unsafe channels are ignored
and userspace configured channels are honored when
coex_unsafe_chan_nb_user_prefer ini is set. This is supported for
SAP mode only.
But some platforms may want driver to ignore the firmware-
reported coex channels for P2P-GO also.
Enhance the ini to allow user to configure mode specific
bit as mentioned below,
BIT 0: Don't honor fw coex/unsafe channel info for SAP mode
BIT 1: Don't honor fw coex/unsafe channel info for P2P-GO mode
Change-Id: I91a2c6b2da9aba411d081f6ae3b23d374fe53159
CRs-Fixed: 3766393
HW is non-DBS. SAP is UP in 6 GHz. Now, when a STA connection is
attempted, the pcl for the second connection would have SAP SCC
channel with highest priority, all the 5 GHz channels with 2nd
highest priority and the 6 GHz channels with least priority.
Therefore, even if there is a strong 6 GHz candidate for STA, the
5 GHz candidate would be chosen and the SAP moves to SCC in 5 GHz.
To fix this, ignore the pcl scoring for the non-DBS concurrency
cases as the SAP can move to the channel of the best STA interface.
If the SAP is in legacy band, and if still a 6 GHz STA is chosen,
then the legacy SAP would be torn down. So, give STA the best
possible in non-DBS case.
Change-Id: If268b61c61e77db96b499437cdbc95188240fba8
CRs-Fixed: 3749399
As per new requirement, If DUT associates with an AP does
not support BTM then when host receives BTM req frame
from FW. Instead of forwarding the BTM req frame to
supplicant, host should drop it.
Change-Id: Ie6b6c27c01b072fac19dc039327cb9a86370b535
CRs-Fixed: 3746758
User/wpa_supplicant disable roaming flag is only effective for current
connection, it will be cleared during new connection.
APP/wpa_supplicant can uses QCA_NL80211_VENDOR_SUBCMD_ROAMING to change
roaming behavior for current connection.
Change-Id: If9f439f51e25e3d67f5db5557c0d8f468b071596
CRs-Fixed: 3737996
On receiving QCA_WLAN_VENDOR_ATTR_CONFIG_BTM_SUPPORT vendor
command, do below action in host:
1. Disable btm_offload_config in FW via RSO command.
2. If btm_offload_config disabled in FW at step #1,
FW forwards BTM frame to Host, Host needs to drop frame.
3. Disable btm ext capability (p_ext_cap->bss_transition)
bit in assoc request and unicast probe request to AP.
4. On disconnection, restore BTM configuration.
Change-Id: I228bafe243c43bc055f19d472c2f2d986225f577
CRs-Fixed: 3742276
Add support to process newly added vendor command
QCA_WLAN_VENDOR_ATTR_CONFIG_BTM_SUPPORT.
User space use this vendor command to disable/enable
BTM roaming for STA interface.
If host receives this vendor command in connected
state, host should return failure to user space.
Change-Id: Iafadc2fab2ee30a0eb2e8e7ebb7178c1d36fe1c9
CRs-Fixed: 3715920
In mlo_roam_copy_reassoc_rsp(), assoc_rsp is a pointer inside
copied_reassoc_rsp incase of memory allocation for assoc_rsp,
copied_reassoc_rsp is getting freed but in the same error leg
"connect_ies->assoc_rsp.len" is getting set to 0 resulting in
use-after-free
Remove the code in the error handling to avoid use-after-free.
Change-Id: I5a7b3bbef42db4e8bedba0c7c3eaf961e4d7e83a
CRs-Fixed: 3728493
Currently, In the MLO t2lm API, wlan_mlo_parse_bcn_prbresp_t2lm_ie
is missing frame boundary checks which may lead to out-of-bound
reads if the lengths are not checked by the caller.
Fix is, while parsing t2lm ie pass the frame length and add
check for frame boundary.
CRs-Fixed: 3707241
Change-Id: Ic83638eff2250a704df8dfa8bd233238fcc7a25b
Add support to send roam cancel diag event in instances with
below reasons:
IDLE ROAM scan cancelled due to screen ON
scan cancelled due to other high priority roam scan
Add new diag structure & reason code enum for this diag
event
CRs-Fixed: 3708863
Change-Id: I1f7a819d766735f7d89eda3945e7ed92d22919ae
Some solutions may not have HS-2.0 certification and there is
no need to forward the BTM frame to wpa_supplicant in such
solutions. Let firmware handle the frame in such cases by
enabling btm_offload so that it doesn't wakeup the host.
Firmware may roam to another AP upon BTM reception.
To enable/disable BTM offload add hs20_btm_offload_disable INI.
If this INI is enable BTM offload will be disable and if INI
is disable BTM offload will be enabled.
Change-Id: Id6e18404cc3a12a23b213c0f858c943715285932
CRs-Fixed: 3718776
MLD address is mandatory for link VDEV connect request or
else the partner link will fail during candidate fetch from
scan DB because of MLD address mismatch.
For MLO OWE roaming, link VDEV connection starts after
completion of EAPOL-HS, and here MLD address is not filled
leading to link VDEV connect failure.
Use connect response to fill MLD address in link VDEV
connect for MLO OWE roaming
Change-Id: I9eae3b7ba3619a9ce62603efd0590aabce9c70f3
CRs-Fixed: 3715021
Currently, HS_20_AP param of cm_ext_obj->rso_config is set
to true when STA connects to a HS-2.0 AP. This is to disable
btm_offload as per HS-2.0 cert requirements.
But this flag is not cleared even when STA disconnects from
that AP and this disables btm_offload for next connections
as well even for non-HS-2.0 APs.
So, reset the flag as part of connect start to avoid this.
Change-Id: I3763544ecca0e4628b0c78633364fe70fd9b3094
CRs-Fixed: 3712758
Host tried to associate to AP, 6 GHz link is selected as
the assoc link and in the RNR there are two partner links 5 GHz, 2.4 GHz.
Only 6 GHz/2.4 GHz are beaconing and 5 GHz is not beaconing.
STA sent the ML-Probe request on 6 GHz link requesting the full profile
for the 5 GHz and 2.4 GHz links but AP responded with only one partner
link 2.4 GHz, from this we generated 2.4 GHz and added to scan cache,
AP didn't respond with 5 GHz link in per-sta.
STA sent the assoc request over 3-links and AP accepted the assoc,
and association is successful over 3-link and the same is intimated
to the firmware that 3link association is successful.
But while sending the connection information to the kernel 5 GHz link
is not found resulting in HDD/Kernel not being aware of the 5 GHz link.
Fix :- Use assoc response from the ML AP to generate ML probe resp
for the partner links to add to scan DB so that partner link
VDEV will have candidate to start connection.
Change-Id: I30176e58d9b02e7ed275b1c926cd1e119b66f8f3
CRs-Fixed: 3686809
Currently on HO failure host posts disconnect with priority
set in serialization queue before dequeuing the dummy roam
command from serialization, as a result for 2 link ML STA
case when HO failure is received, assoc VDEV disconnect gets
priority over partner link VDEV in the serialization
queue. When assoc VDEV disconnect is complete, host updates this
info to userspace and userspace issues dynamic mac address
update command. While processing this command the DP assoc VDEV
is first detached then re attached. There is possibility of
race where link VDEV disconnect starts in parallel, as DP link
VDEV has the reference of DP assoc VDEV, in order to release the
reference it looks up for the DP assoc VDEV , but as part of mac
address update if DP assoc VDEV is detached and reattachment is
pending then the DP link VDEV doesn't get the DP assoc VDEV and
reference release fails.
To address this issue don't prioritize disconnect for
HO Fail case.
Change-Id: I74c7bce851423226d3aac2750fddd5e6c7e34fd1
CRs-Fixed: 3697528
Add more validation for vendor command force active link bitmap:
1.If force inactive num is present due to MCC link(DBS RD) or
concurrency with legacy intf, don't allow force active if
left inactive link number doesn't meet concurrency requirement.
2.If force inactive bitmap is present due to link removal or
concurrency with legacy intf, don't allow force active if
it is conflict with existing concurrency requirement.
Change-Id: Ic7507c1797189c079f0032a39819e15467bd6bf3
CRs-Fixed: 3701323
Few non-TxMBSSID APs may not respond to ML probe req and driver
can't add latest scan entry for the partner links from ML probe
resp and if beacons from partner links are not received for a
duration enough to flush out the scan entry of that link then
connection of partner VDEV will fail with no candidates found.
Use assoc response from the MBSSID AP to generate ML probe resp
for the partner links to add to scan DB so that partner link
VDEV will have candidate to start connection.
Following are the conditions for this logic:
- Candidate is a non-TxBSSID in an MBSSID set
- Connection is for more than single link (MLSR/MLMR)
- Scan entry for partner link is not found in scan DB
Change-Id: If97475878d61d986988a6e97e693b194518dc192
CRs-Fixed: 3679519
Currently, driver drops BTM frames in unsupported cases,
e.g. connected to MBO AP without PMF capability, concurrent P2P
session present which doesn't allow STA roaming.
Add connectivity log support and indicate the reason for BTM
drop/block.
Define interface for userspace as below,
New subtype: WLAN_CONN_DIAG_BTM_BLOCK_EVENT
New enum to fill sub_reason for BTM_BLOCK_EVENT type
Change-Id: I87115da57d275a94c5ae69252ec09bcad698e47c
CRs-Fixed: 3699042
Firmware sends WMI_ROAM_SYNCH_KEY_EVENTID after roaming
to 3 Link ML AP. Host allocates memory for every crypto
keys and populates data from the fw event.
This memory is not freed if the addition to crypto
module fails and results in memleak.
Fix is to free the crypto key entry when addition fails.
CRs-Fixed: 3678765
Change-Id: Ife70261b697ec016f50d4e0730c3fa4fc0ec06ab
T2LM Req/Resp Connectivity logging is not supported if
the T2LM request is initiated from STA.
Add support for T2LM Request/Response connectivity logging
when T2LM request is initiated from the STA.
Change-Id: If61b5ba7c7eb9ec5687d271afc300737df8fdf8d
CRs-Fixed: 3689209
Bss peer reference is taken without updating the ref count.
This is causing a crash if the peer is freed and the pointer
is still maintained resulting in the dangling pointer. Use
correct api to take BSS peer reference.
Change-Id: I732c10cf6339342a1f9716a5c8057085f9b91f68
CRs-Fixed: 3669170
Link switch uses cached partner links info in mlo_sta_ctx,
currently during roaming as partner links info is not filled
then link switch fails during connect.
Copy partner links info to sta context in mlo dev ctx on
roaming.
Change-Id: Ie513173f0ccdc39f46be5cf4af11021abe5950aa
CRs-Fixed: 3695386
In the api cm_roam_btm_req_event(), BTM request and
BTM Candidate Connectivity logs are printed for both
partial and full scan when disassoc_imminent is set for BTM
roam trigger. But actually, over the air frame was received
only once on the device.
So to avoid BTM frame logs duplication,
ignore the BTM request frame TLV & btm candidate TLV received from
firmware after BTM roam trigger with disassoc imminent set.
Change-Id: I7d8cf4a4f0c7e2ee7958ae3fc309f14890c2fd33
CRs-Fixed: 3675909
After roaming to 2+5 MLO AP, MLD high RSSI roaming trigger is
getting disabled if assoc link is on 5 GHz.
To fix it, if self MLD roaming is supported, then don't enable
high rssi roaming trigger for 2.4 GHz link and disable it for 5
GHz link after roaming is competed.
Change-Id: I4c02cb2c946d97884fbc0d6cc513c585c21b9548
CRs-Fixed: 3670241
In api cm_roam_scan_info_event(), band_mask is updated
for ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ and
ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ. But
the band mask is truncated for ROAM_STATS_SCAN_TYPE_FULL.
add check in api cm_roam_scan_info_event() to update
band mask only for scan type
ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ and
ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ in order
to prevent the band mask from truncating for
ROAM_STATS_SCAN_TYPE_FULL.
Change-Id: I3e85c87e3e304d0c4d4ae311c7be1939e73d05df
CRs-Fixed: 3666578
Currently, host disables btm_offload feature if the connected AP
supports MBO/OCE but not PMF. Firmware doesn't process the btm
requests received from AP in such cases and forwards the same
to host. Host forwards them to userspace. But userspace may not
expect these frames as roaming is offloaded to firmware.
Drop the BTM request frames in driver for LFR3 cases when the
connected AP supports MBO without PMF.
Change-Id: I35800ff31f8a48d12eb57cdd36856fdef2b53b8e
CRs-Fixed: 3687371
Currently for STA + STA case, consider the below scenario:
1. Roam start received on vdev 2 & vdev 0. Vdev 2 roam
serialization command becomes active and vdev 0 roam
command is on the pending queue.
2. HO failure with AP0 received on vdev 2. This dequeues
the vdev2 roam serialization command. Vdev0 roam command
becomes active.
3. Roam synch indication received on vdev0 with peer AP as
AP0 (which is the peer on vdev 2). So duplicate detection
logic prevents same peer creation, so roam synch fails but
its not indicated properly to firmware. This leads to
disconnection of both the STAs.
To address the issue, first enqueue disconnect with high
priority set before removing roam command from serialization
so disconnect gets activated if roam was active for the
vdev.
Also while processing roam synch indication, check if peer is
found on different STA and send roam stop to fw so fw also
cleans up and initiates HO failure.
Change-Id: Iddeddcde782b936dc2ea4b8f32fd0be3c0ced591
CRs-Fixed: 3686114
Currently, RSO_STOP is sent to firmware if ROAM_SYNC is aborted
due to some reason. Host doesn't check for the current state of
RSO state machine and may send the RSO_STOP twice. Firmware
responds with SUCCESS for the second request and driver
continue to cleanup peer/vdev assuming that it's a normal
RSO_STOP response. This results inconsistency in firmware
as it might be in the middle of peer/vdev cleanup and
leads to ASSERTION.
Check for the RSO state machine status and avoid sending
RSO_STOP twice.
Change-Id: I87cdb4a682095772070a839bbb86e56a9450b299
CRs-Fixed: 3677172
Link beacon in roam sync frame event may be not for actual link when
roamed to 2+ link AP, then get right link beacon from scan cache, but
beacon size may be larger, if malloc buffer with link beacon size in roam
sync frame event to save beacon IE got from scan cache, OOB will happen.
To fix it, when malloc buf to save beacon IE during roaming, use max
mgmt mpdu size.
Change-Id: I08fc52ce26edc1f02365837a1ed7a632ed7c6706
CRs-Fixed: 3667410
Implement a locking mechanism for retrieving and
storing crypto keys. Currently, due to race condition,
Host driver is fetching information in one thread while
simultaneously writing key information in another thread,
resulting in synchronization issues.
This change is to add lock mechanism while reading and writing
crypto keys.
Change-Id: I156b619cf7c3c052ad3122a6f808d732fb5e4f51
CRs-Fixed: 3672330
Add new data structure to save the external/internal set link
request. The different source of request has different priority.
In some situations, a certain request may not be honored if
it conflicts with higher priority request.
Change-Id: Ib95d0c688f92dcfc294702e7deb2e3b7da13f76c
CRs-Fixed: 3650630
After 3-link association is complete, Host sends force
inactive num command between 5 GHz and 6 GHz links to
firmware. Later, if user wants to force enable 1 or 2
links, the current checks prevent it from taking effect
as a previous force active num is in place and a NO
FORCE command cannot be sent as it is a DBS RD.
So add new API in policy manager to check if the new
force active num command is valid and process accordingly.
All new force active num commands except for 5 GHz +
6 GHz links should be allowed while honoring the prior
force inactive bitmap as well.
CRs-Fixed: 3656412
Change-Id: Iecfca57d9b47acd31d191cca2632a6d1baf62174
Calculate valid number of roam scan channel count in case of
idle roam scan of type ROAM_STATS_SCAN_TYPE_HIGHER_BAND_6GHZ
or ROAM_STATS_SCAN_TYPE_HIGHER_BAND_5GHZ_6GHZ and send same
to upper layer via SCAN_DONE logging event.
Change-Id: If59c732c7efad78ef6e4b6b0ada48054f1d0252c
CRs-Fixed: 3652329
When there are more than one audio transport mediums
are available, there is a possibility to switch the
audio transport medium from one medium to another
medium.
To provide this support to switch the audio transport
medium, and to indicate the status of the bearer
switch to fw, add WMI interface changes.
Change-Id: I236e2d9a954191c104d56d286332ace644190e6e
CRs-Fixed: 3653962
Currently, SAP bw gets downgraded(from 320 MHz to 160 MHz) when
link connect starts on a channel which causes DBS/SBS.
But SAP is not aware of the link that can cause DBS/SBS if it is
inactive as corresponding entry is not present in driver policy
mgr table. When link switch is triggered to a channel which
causes SMM to DBS/SBS hw_mode, SAP bw update algo gets triggered
as there is a new connect which causes split-phy mode. SAP bw
update algorithm need not be triggered upon link switch start and
can be triggered post link switch to avoid interrupting link
switch.
Currently, it doesn't differentiate between user connect request
and link switch connect request. Add a check and avoid SAP bw
update trigger link switch cases. Evaluate the links posts
connection and trigger bw update if needed.
Change-Id: I90f836c04d096dffb5b82c53166b18d2ba27a584
CRs-Fixed: 3649268
In hidden SSID case, some IOT AP does not respond to the
unicast join probe requests and this leads to continuous
connection failures. The same AP however responds to broadcast
probe requests. The host announces join success only if the
probe response is received for the hidden SSID connection.
To fix this, after sending 3 unicast join probe requests, send
the pending probe requests as broadcast to proceed with to get
a probe response.
Change-Id: I686cbabd3b1b3d355829bc682de5d631b1738d86
CRs-Fixed: 3647028
Driver sends STA_INFO event with self mac addresses for each link
before initial connection. With the new requirement to send the
STA_INFO after every roam to detect the change in mac address, add
the sta info call after reassoc response is received and roaming
status is successful.
CRs-Fixed: 3653662
Change-Id: I18ecbdfea47fb3524154f799ea0c4777276cb34a
If connected in open mode, supplicant will not sent any
crypto keys so during link switch driver will not find any keys.
Currently driver panics if there isn't any key installed during
link switch but this is not applicable if the auth mode is open.
Don't check for keys to install if the current auth mode is open.
Change-Id: I6e0ed587f3e1e214eb6f65556de9aab4c09507dc
CRs-Fixed: 3651819
Add separate APIs to validate SAP, P2PGO or LL_LT_SAP
channels according to LL_LT_SAP concurrency.
Change-Id: I180796df6b312f9bbb0a8e61085ca1517cd687b5
CRs-Fixed: 3647561
Host clears existing connection info in MLO mgr and fills
roamed AP info in the same order received in roam_sync.
This overrides the existing VDEV order only in MLO manager but
it can be in different order in HDD.
During link switch MAC addr update, HDD first updates the VDEV
to the new link addr and later updates MLO manager and this
changes the order in MLO mgr, this can lead to having misaligned
link-VDEV mapping.
As FW is expected to derive same link addr as what host derives
and uses the same during connection with roamed AP, so use link
addr from roam sync params as a key to search MLO manager to
update the new roamed AP info. This will not alter the VDEV order
in MLO manager and will align with HDD order.
Change-Id: Ib1048f90a7e1b64c4135da2474579cffb669a49d
CRs-Fixed: 3655528
As per requirement send ROAM or NO ROAM connectivity
log event to upper layer based on below conditions:
Print ROAM If,
1.FW sends res->status == 0 on successful roaming to AP
2.FW sends res->status == 1 if FW triggered roaming but
failed due to reason other than below reason
Print NO_ROAM for below reasons where either candidate
AP is not found or we roamed to current AP itself
irrespective of the res->status value:
1.ROAM_FAIL_REASON_NO_AP_FOUND
2.ROAM_FAIL_REASON_NO_CAND_AP_FOUND
3.ROAM_FAIL_REASON_NO_AP_FOUND_AND_FINAL_BMISS_SENT
4.ROAM_FAIL_REASON_NO_CAND_AP_FOUND_AND_FINAL_BMISS_SENT
5.ROAM_FAIL_REASON_CURR_AP_STILL_OK
Change-Id: Ia2e07dcdacb78a22af9ae6b66c18c2c716161bf3
CRs-Fixed: 3653702
Update the diag interface files with minor fixes to include
qdf_packed attribute for missing structure and fix the enum
wlan_roam_failure_reason_code ordering to be in sync with WMI
Change-Id: I3b4f6296e7d80c9d27e4f66dd2092c0110aaa766
CRs-Fixed: 3659386
While parsing the roam synch indication event from the firmware,
the RSSI is copied into a uint8_t variable. But RSSI is negative
value. So change the data type of roam_synch_ind->rssi as signed
int8_t type.
Firmware sends absolute value as RSSI so convert it into a negative
value before assigning to the destination buffer.
Change-Id: Ibec6ee8bfefc612be1600a0820ff061a247460ad
CRs-Fixed: 3641086
If "override_ht20_40_24g" ini is set, the host driver disables
the HT40/HE40 caps for 2.4 GHz after connection via SET IE. The
firmware uses this for roam. However, if reassoc comes from userspace
with the HT40 cap different from the initial connect, then host
does not update the IEs based on new cap. This leads to mismatch
between user configuration and firmware roam.
To fix this, modify and send the HE40/HT40 caps via SET IE for
every connect request. Reset it after disconnection to the default
self cap.
Change-Id: I58e14e8ae8e8842e1d79a0284c4240ac7d279272
CRs-Fixed: 3651600
In the api wlan_convert_bitmap_to_band(), the bitmap
to band conversion algorithm evaluate 1st bit in the
bitmap as 2.4 GHz link instead of 0th bit.
Modify the bitmap to band conversion algorithm to
evaluate 0th bit for 2.4 GHz band instead of 1st
bit of the band bitmap received from FW.
CRs-Fixed: 3648693
Change-Id: I626d80991461c8757178116303f92f55be91db29
In api cm_roam_mgmt_frame_event(), Band info fetched from
roam_frame_info tlv is overwritten with the band info
value of previous connected AP present in mlo_dev_ctx before
roaming resulting in incorrect data for the reassoc
connectivity logging.
Modify cm_roam_mgmt_frame_event() to populate the band info
received from roam_frmae_info_tlv to reflect current AP
band info.
Change-Id: I219d4803b856beb1d64e9c35da374071f09b1aea
CRs-Fixed: 3640898
Currently host driver does not update the state of the bearer
switch state machine when userspace changes the bearer, which
results in out of sync state of the bearer currently in use.
To address above issue, update the state of the bearer switch
state machine if user space changes the bearer.
Change-Id: Id71cfdf320a11665707a367b13ea932155af0413
CRs-Fixed: 3649793
