Validate TWT setup request type value obtained from
user space, before sending down to fw
Change-Id: I820f4912bafb84b76583ac9ed1cd88f59ea9fb3d
CRs-Fixed: 2770628
Reviewed-on: https://gerrit.mot.com/1848491
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Sireesha Kosuri <sireeshak@motorola.com>
Reviewed-by: Bin Liu <liubin7@motorola.com>
Submit-Approved: Jira Key
In OWE transition mode, the beacon from the transition mode AP
should be dropped after sending unicast probe to avoid kernel
entry for BSS with null ssid. But while parsing the IE, the
frame pointer passed points to the fixed fields.
So pass the ssid IE pointer to the OWE transition mode IE
parsing API.
Change-Id: I668bc2dfc32a5a23b44da50ac81bac98250faa2a
CRs-Fixed: 2814173
In OWE transition mode, the AP advertises one Hidden SSID and one
normal ssid and the OWE capable STA connects to the OWE supported
hidden SSID. When connecting to the hidden SSID, if the AP sends
beacon for the unicast probe request sent by driver before
anouncing join success, then the beacon NULL ssid gets updated to
the kernel. Then after successful association, while indicating
the connection successs to the kernel, the current bss is not
filled as wlan_cfg80211_get_bss() is called with the actual ssid
and not the NULL ssid.
Due to this when supplicant sends install key command for this
bss, kernel returns error and set_key always fails.
Wait for the probe response from the AP for the unicast probe
request sent before announcing join success and drop the beacon
received from the AP so that the driver
fills the proper ssid to the kernel bss entry and same ssid gets
used in association completion handler.
Change-Id: Icded0af5d45d3281ab4304bf166bdc318aa7a942
CRs-Fixed: 2782618
Validate TWT setup request type value obtained from
user space, before sending down to fw
Change-Id: I820f4912bafb84b76583ac9ed1cd88f59ea9fb3d
CRs-Fixed: 2770628
In csr_issue_set_context_req_helper() profile is dereferenced
to get the encryption type.
Add null check before accessing the profile pointer.
Change-Id: I40c148648130918f9da0194ff6e132d55b113008
CRs-Fixed: 2777778
When channel Switch is happening and north bound disconnect is
also initiated at same time before vdev restart response is
received, the disconnect command will be activated by serialization
module but the eWNI_SME_DEAUTH_REQ message to lim was deferred.
The deferred message queue at lim was not processed as there was
no wmi command response received.
So process the deferred messages after the gLimProcessDefdMsgs
is set to 1.
Change-Id: I8200407663857349ea2eef0924fe1c345fab8028
CRs-Fixed: 2789632
Currently for Open mode, the install key command is not allowed
but usually set key with 0 length is sent in open mode and in
set key response path the OBSS scan is configured to firmware.
So send dummy response for install key command to go for open
mode connection.
Change-Id: Ia3665ca018114bbf354b8c3138a7c4d81f7f9707
CRs-Fixed: 2769414
In LFR3 Handoff failure case, data path peer teardown is not
done prior to cdp peer delete and this causes bug_on to be
triggered during cdp peer delete.
Fix is to invoke wma_remove_peer() in vdev stop response path
with ho_failed flag set.
Change-Id: I112b2e8fe1792a967c48138113766b649ee1ba26
CRs-Fixed: 2760180
When supplicant disables firmware roam, RSO stop command with
roam scan mode value 4 is sent to firmware and this value 4
indicates the firmare to enable only Forced roam trigger(roam
invoke command from host). But before
ROAM_DEINIT(WMI_VDEV_PARAM_ROAM_FW_OFFLOAD with value zero) is
posted to firmware, the roam scan mode should be 0 or else there
could be potential peer unmap failures if firmware has already
started roam and disconnect is triggered from north bound or from
peer.
To avoid this, in the roam offload state machine handle the state
switch from RSO stopped to deinit if supplicant disabled roaming
flag is set and send RSO stop with roam scan mode value 0 to
firmware.
Change-Id: If50a306b6019320ddab2ac1695a57718d27f477a
CRs-Fixed: 2755948
In roam trigger print the driver doesn't include the current
RSSI threshold info.
Add the current rssi threshold value at which roaming was
triggerd in roam trigger logging.
Also refine the candidate AP blacklisting related prints.
Change-Id: I6d39851278081a728b74e036c22e8d302d7b7b4c
CRs-Fixed: 2752998
After successful roam synch indication received in 802.1x/WPA3
security roaming, the peer will not be in authorized state since
EAP/EAPOL handshake is handled at the supplicant. Simultaneously
there is continuous vdev pause/unpause events from firmware, so
EAP handshake fails and EAP timeout kicks-in at supplicant and
disconnect is triggered. But on new connection the
hdd_reassoc_scenario flag is not reset, so
__wlan_hdd_cfg80211_ll_stats_get always returns failure and the
framework displays low rssi even though the connected AP rssi
is good.
Reset the hdd_reassoc_scenario flag after any disconnection.
Change-Id: I7b00fef86fa37d6e7ab857be1750add142f7e647
CRs-Fixed: 2752022
Add changes to include new roam scan sub-reasons in host driver
roam logging and refactor few existing string.
Below are the new reasons:
WMI_ROAM_TRIGGER_SUB_REASON_LOW_RSSI_PERIODIC
WMI_ROAM_TRIGGER_SUB_REASON_INACTIVITY_TIMER_LOW_RSSI
WMI_ROAM_TRIGGER_SUB_REASON_PERIODIC_TIMER_AFTER_INACTIVITY_CU
WMI_ROAM_TRIGGER_SUB_REASON_PERIODIC_TIMER_AFTER_INACTIVITY_LOW_RSSI
WMI_ROAM_TRIGGER_SUB_REASON_INACTIVITY_TIMER_CU
Change-Id: I1aeb48d29561b48ac7b8762626fa0050f4fb9030
CRs-Fixed: 2742558
If ERP key lengths are greater than maximum valid lengths,
currently the connect request is allowed to go through.
Allow fils connection to go through only if erp keys are
not sent in connect. If erp information is present, validate
the rrk, realm, username length.
Add changes to lookup pmkid based on bssid also in addition to
the existing logic to lookup based on fils cache_id and ssid.
Change-Id: Iebde1f382b7db13553b848a459cb4a783744c2a6
CRs-Fixed: 2732050
When FILS erp keys are not available, EAP initiate packet will not
be sent to the AP so FILS authentication wrapped data IE is not
required, but the driver is adding extra 3 bytes for wrapped data
even if wrapped data is not included. This will cause issues with
the FILS AP.
Don't allocate bytes for wrapped data if ERP keys are not available.
Change-Id: I9bd8033048829eeaf63ce123129e64f2685df04f
CRs-Fixed: 2732852
In wma_get_trigger_detail_str() driver prints the roam trigger
detail for Low rssi and Periodic scan triggers, the RSSI value of
the current AP is the value before roam scan is triggered. But
the firmware considers the rssi of the current AP after roam scan
is complete to calculate the next RSSI threshold. So there could
be mismatch in the current rssi value and next rssi threshold
when roam_info->rssi_trig_data.threshold is used to print the
current AP rssi.
Use roam_info->current_rssi to print the current connected AP
rssi in the roam trigger logging.
Change-Id: Ib154bb3cbdfe13dbcdd8c8830cdafb6daefa34b5
CRs-Fixed: 2739346
As part of beacon report request , currently driver sets last
beacon report indication data field to be 1 for last frame of
every channel. This is incorrect as per spec as the
expectation is to set this only after all channels of all
beacon measurement requests are done.
Add change to set the last beacon report fragment bit only
after measurement is complete on all channels for all the
measurement request index for a beacon report request. If
last channel has empty result and AP supports last beacon
report indication, then send empty report with last beacon
report indication element.
Change-Id: Ic8902b61c5a370ec828022cd73dffdef9eb37f32
CRs-Fixed: 2720249
In lim_populate_peer_rate_set(), bss description is obtained by
dereferencing the bss descriptor from session->lim_join_req.
But in LFR-3.0 roaming case, the lim_join_req will be NULL, since
roaming is south bound operation and there is no csr join request
message after roam. So this results in NULL pointer dereference
of bss_description in lim_populate_peer_rate_set() while
handling LFR-3.0 roam synch indication event.
Pass the correct bss descriptor from caller to ensure that valid
bss descriptor is passed to the lim_populate_peer_rate_set() api.
Change-Id: I3af915d5753c7aa054dc6d8766e51fd62c8314bb
CRs-Fixed: 2733807
For FILS pmksa caching, the STA can use the PMKSA cached as
part of the full 802.1x connection. When FILS PMKSA caching
is used, the supplicant might not send the ERP keys in the
connect request. So add support to allow connection when
ERP keys are not received in connect request but FILS
PMK is present in the cache.
If the PMK cache lookup is successful for the bssid,
use pmksa caching to associate, else fallback to full 802.1x
to associate to the BSS.
Change-Id: I9fa67ee5978b7199da1cb638f7f321baed6e5913
CRs-Fixed: 2710402
When roam invoke fails during handoff, firmware sends HO failure
indication to host. Here the roam_invoke_in_progress flag is not
cleared.
Clear the roam_invoke_in_progress flag when fastreassoc fails
due to handoff failure at firmware.
Change-Id: Ifc0ade939980138f64013299a9ea4e97468ce00f
CRs-Fixed: 2715281
The driver prints the current RSSI threshold and next RSSI
threshold for LOW RSSI roam trigger. Print these info for
Periodic scan roam trigger also.
Change-Id: I4140cae3631356949c925b8d21c032e6c02d4539
CRs-Fixed: 2694906
Currently when rrm measurement is completed for a particular
index, the rrm_cleanup() is called which clears the measurement
data for all the index. This can cause failure with multiple
measurement request where on completion of the first request,
second request data structure will also be made null.
Pass the measurement index to rrm_cleanup() and clear only
that index data.
Change-Id: Ib712c2da3ddfea374d60b250dd474b08093b24c7
CRs-Fixed: 2695836
When roam invoke from user space fails, internal disconnection
is triggered from csr. This queues disassociate command to lim
and then RSO command is also posted to lim. When disassociate
get processed, vdev down is sent, pe session is deleted and
roam offload flag at wma is cleared. When RSO stop is received
at wma, the roam offload flag is cleared and wma returns
failure without sending RSO command. So in STA+STA scenario,
after disconnection on 1st sta, roaming will be enabled on
2nd sta, but since RSO stop was not sent on 1st sta, firmware
will assert as btm offload is not disabled at the 1st STA.
Disable roaming first, followed by vdev stop/vdev down to
firmware.
Change-Id: I3f2f873cf50536b6f31bc0113ff737d6d95a520d
CRs-Fixed: 2672573
The roam sequence in LFR-3.0 is roam scan start notification
from firmware followed by roam start indication and then
roam synch,roam synch frame events. Roam start is sent
after candidate selection and host driver will disable
queues when roam start is received at the driver.
But for emergency roam trigger, firmware sends roam start
indication directly without notifying roam scan start to disable
data path queues immediately after deauth received from the AP.
So roam start is received before roam scan is started at firmware
and before candidate selection is done.
After roam start notification, host sends scan abort for all scan
on vdev by setting scan command request type to
WMI_SCN_STOP_VAP_ALL. This results in roam scan getting aborted at
firmare in emergency deauth roaming case and roaming fails.
Define new vdev id value based on which the scan module will
abort only host triggered scans setting the request type to
WMI_SCN_STOP_HOST_VAP_ALL in the scan request.
Change-Id: Ie8b005285973461f654329e1b2dc1a45205331f5
CRs-Fixed: 2644323
After roaming, new pe session is created and based on the authentication
status received in the roam synch indication, the is_key_installed flag
is set. But this flag is not set to sta ds after roaming.
This causes deauth frame to roamed AP sent out unencrypted after
roam.
Set the key installed flag to sta ds if the auth status in
roam synch indication is authenticated.
If the status is connected, this flag will be set in the
set key response path.
Change-Id: I9784fc4e44bb859b8ad075b164ed9bddc4c4fc36
CRs-Fixed: 2635262
When set_pmksa command is received from userspace, the internal
pmk table is updated with the new bssid entry and the pmk is saved
to the session. Additionally this update triggers an RSO update
command to the firmware which causes the use of stale pmk for
single pmkid case, in which the BSS capability of SAE single pmk
will be known only after parsing the beacon/probe received in the
roam synch indication.
So donot send RSO update on receiving set pmksa command.
Change-Id: I25419fbc3061ab963ccf3228b3681c83773a7963
CRs-Fixed: 2659055
When beacon report request is received from AP in table mode,
sme_rrm_issue_scan_req() is called recursively till scan results
in all channels for that country code is reached. In 6GHz, the
number of channels are high and recursively calling
sme_rrm_issue_scan_req for that much channels causes stack
corruption.
Remove recursive call to the function sme_rrm_issue_scan_req.
Instead, loop all the frequencies in the list and send
scan results on those channels.
Change-Id: Id75d00cfc98fcf218c6b1f85da3270e210697403
CRs-Fixed: 2654375
When multiple measurement requests are received in a single beacon
report request, multiple iterative scans are triggered for each
request for the frequency list provided in the request. This results
in free of rrm context global frequency list by the second
request rrm scan in the iter measurement timer start failure path
and was accessed by the scan done callback of the 1st measurement
request.
Add null check for rrm context frequency list and also if the
timer is already running, send measurement done indication for
that request.
Change-Id: I149ba47872095228595cd52535fb76c422eefba7
CRs-Fixed: 2648618
The driver doesn't ageout connected BSS from rrm scan
result after the scan default ageout time. This results
in connected AP information sent in beacon report request
in table mode always.
Fill the ageout threshold value as the default scan age out
time in the rrm scan filter.
Change-Id: I8f9b0457bd93e2d9b51a772bdbdfb01dcd429c56
CRs-Fixed: 2650915
Increase the roam failure reason string buffer size to
60 from 50.
Also add reason string for roam failure reason.
Change-Id: I42f4332463e4063aa0dee39631ca31965db12b62
CRs-Fixed: 2647260
Host driver sets broadcast keys followed by unicast keys for
FILS connection. This results in the data packet sent before
unicast set key and peer pn was reset. Sending broadcast keys
first will allow firmware to enable WAL_PEER_ALLOW_DATA and
data tx could start without unicast keys being set. Due
to this TX packet will go unencrypted and TX will fail without
ACK from peer AP, peer pn will be set to 2, after this unicast
key got set and this resets the peer pn to 1. And when next
frame TX was done, pn check failed and firmware assert occured.
Set the unicast keys to firmware first followed by the broadcast
keys for FILS case.
Change-Id: Ia498709ac524e95b831cc7ccdd17e6fc7ae0b130
CRs-Fixed: 2633632
The default value of ini gDualMacFeatureDisable is 0 and this
enables DBS scan with simultaneous scan from upper layer to
firmware. P2P scans get priority over sta scans and when
continuoes p2p scans are issues from some userspace application,
STA doesn't get scan time and APs in the environment are not
seen the scan results on STA interface.
To avoid this, change the default value of the gDualMacFeatureDisable
to 6, which disables simultaneous scans from upper layer to the
firmware.
Change-Id: I7ea3ed521270fc50acba30f84749d35ee60fcaa0
CRs-Fixed: 2632562
In pe_disconnect_callback(), while processing deauth/disassoc
frame received after emergency deauth roaming failure, the
reason code is extracted before stripping the ccmp iv, mic trailer
from the unicast frame and mmie is not stripped in case of broadcast
deauth frame. This results in incorrect reason code passed to
userspace.
Strip the ccmp iv, mic trailer from unicast deauthentication/
disassociation frame and strip the mmie from the broadcast
deauthentication/disassociation frame.
Change-Id: I07d7b4515471150d74d796ed6da2f87a928e6e35
CRs-Fixed: 2634822
Currently the ssid received in the beacon report request is not
printed when beacon report is received from AP in the kmsg.
Fix to print the SSID if its present in the beacon report
request.
Change-Id: Ide4659e955dec756f60b0508eb3be529c43601b3
CRs-Fixed: 2632653
For SAE connection, if sta has a PMKID cached from previous
full SAE authentication and uses it for the open authentication
with the AP and if the AP rejects the association with invalid
pmkid (53), then the STA tries association with next AP. This
could result in association with a low score candidate.
Retry association with same AP, with full SAE authentication,
if AP rejects association with reason code invalid pmkid. Limit
the retry count to 1 per AP.
Change-Id: I5b26822ff9bbeea51de1b80852d5d325d28bf17f
CRs-Fixed: 2625987
Currently when association reject with reason code 53(invalid
pmkid) is received from the AP, then we delete the pmksa entry
for that AP from csr_session, but with converged crypto component,
the entry needs to be deleted from the crypto pmk table.
Else when associating to the same AP again, driver will use the
stale pmk for the AP again.
Delete the pmk entry from crypto pmk table when association
reject is received from AP with reason code 53.
Change-Id: I54f4a7ee7e02d35e0560bfad9fe2e3466aaa361d
CRs-Fixed: 2636570
Currently the roam failure reason string size is 40 bytes.
Change this to 50 bytes to avoid truncation in some failure
cases.
Change-Id: I6c90e31fc792078354e98c7a5c61ffd5583469c3
CRs-Fixed: 2637901
Introduce ini for roaming_triggers to enable/disable specific
roaming triggers. This will be the master ini to control roaming
triggers. If this ini is set to zero, roaming will not be enabled
on the sta interface unless its enabled via vendor command.
A new roaming trigger - Sta kickout roaming is introduced in
firmware, include this bit support also in the ini.
The value of this ini will be sent over the wmi command
WMI_ROAM_ENABLE_DISABLE_TRIGGER_REASON_CMDID during RSO start.
Reset this value to 0 during RSO stop if RSO stop is due to
disconnect or roam synch failure.
Change-Id: I02f207cdde9d8fb68cd91fab07572baa9e7ac50d
CRs-Fixed: 2631712
For FILS connection with FILS auth algo, the keys are derived
at the driver and set key is done in the join response path.
In this path, if the security profile is not WEP, set key is
not done. So for FILS case set broadcast keys returns failure
and unicast keys are also not set.
Check the add_key flag also before returning error in set-keys.
Also store the keys in crypto component so that it can be used
at target-if layer to send the unicast/broadcast keys to firmware.
Change-Id: Ia0feb0c9d213ffe50e42b3e67b7074b19898918e
CRs-Fixed: 2625992
Currently the driver extracts the reason code from notif instead
of notif_params. This results in wrong reason code being sent
to upper layers.
Extract disconnect reason code from notif_params when disconnect
event is received.
Change-Id: I808feecbb74a0a6c78fa31ca78b35c7318e5e9cb
CRs-Fixed: 2623415
After deauth/disassoc, roaming is triggered by the firmware and
if roaming failure occurs before handoff is started, then
firmware sends the WMI_ROAM_EVENTID event with deauth reason.
Currently unspecified reason is sent to the upper layers for
every emergency deauth roaming failure.
Extract the reason code from the deauth/disassoc frame sent by
the AP, received in WMI_ROAM_EVENTID.
Change-Id: I461a38e8a8e60fa26b2ace3f54a6f8208f00838d
CRs-Fixed: 2611473
Currently the driver doesn't add MBO IE to probe if in the
scan request, req->ie_len is non-zero and req->ie doesn't have
the MBO IE.
Also when connection is triggered from AP2 from AP1 both advertising
different SSID, then there will be a vdev delete followed by
vdev create, and scan request is not received from userspace, then
the unicast probe sent from the driver doesn't have the MBO IE.
Add MBO IE if its not present in the scan request ie.
In roam profile if pAddIEScan is NULL, get IEs from default scan IE..
Change-Id: I574f5cae2158a2d4f0adad6d15b8aba2df1de0a2
CRs-Fixed: 2622871
The host driver start scan request on channels in the operating
class requested in the beacon report request. Starting from first
channel all channels are scanned one after another. The scan
request is sent in correct order of the channels in operating
class, but when filtering the scan results from the scan db, the
channel freqency is not indexed properly so first channel is sent
to the filter always. Due to this, always beacon report response
has only entries from first channel from the OP class.
Populate the correct channel frequency to filter the rrm scan
result.
Change-Id: I75461a4da99be9ef215f8c16258e0e21877fe362
CRs-Fixed: 2619363
Add BTM Query/Request prefix for BTM debug prints and Neighbor
Req/Resp prefix for Neighbor report logging. If the time
received from the firmware is zero, it implies AP has not sent
the response for the neighbor req/btm query. So log this info
as well. When channel count is zero, log that no channel update
from AP.
Refactor 11kv logging for more details.
Change-Id: I10bb731ce410215eb48322a2f8ad9ed8723e5270
CRs-Fixed: 2623418
Currently the strucutre tPmkidCacheInfo is allocated in stack
and used during pmksa operations. This structure takes up ~100
bytes of memory. This will cause stack corruption in low memory
devices.
Move allocations of structure tPmkidCacheInfo to heap.
Change-Id: Ibcf44bc331a9ef94499071af1899914edd75b3cf
CRs-Fixed: 2616488
Roaming logs are logging to kmsg, so unused diag log
sending API can be removed.
Remove unused roaming diag logs.
Change-Id: Idd5cfd2ad1f63394cb6b1872512bcc17307a78e6
CRs-Fixed: 2617079
Add following changes to refine csr_dump_connection_stats:
1. Remove unused argument and rename the function to reduce the
number of characters used.
2. Add self mac address information.
3. Rename Auth type to AKM. Print the AKM string instead of
existing diag auth type enum as it doesn't include new WPA3 and
FILS related AKM.
4. Print channel and channel bandwidth on the same line.
New format of log:
csr_connect_info: 3692: +---------CONNECTION INFO START------------+
csr_connect_info: 3692: VDEV-ID: 0 self_mac:18:23:73:36:23:0f
csr_connect_info: 3692: ssid: FILS_AP
csr_connect_info: 3692: bssid: c8:b3:73:36:a3:0f
csr_connect_info: 3692: rssi: -25 dBm
csr_connect_info: 3693: channel: 6 channel_bw: BW_20MHZ
csr_connect_info: 3695: dot11Mode: DOT11_MODE_11N
csr_connect_info: 3700: AKM: FILS-SHA384
csr_connect_info: 3701: Encry-type: ENC_MODE_OPEN
csr_connect_info: 3702: channel frequency: 5745
csr_connect_info: 3703: Qos enable: 1 | Associated: yes
csr_connect_info: 3704: +---------CONNECTION INFO END------------+
Change-Id: Ia87357dd607bfa0d9256c8129bf8e4448ae93104
CRs-Fixed: 2614465
Currently the driver sets rmf capability and encrypts
management frames only if peer advertises MFP required and the
sta is also MFP capable. The SAP marks the vdev as PMF enabled
if SAP is MFP capable. This will result in back to back connection
failures or STA performing SA query procedures after disconnecting
and connecting to the AP again.
Check for the AP MFP capability and STA MFP capability to enable
PMF.
Change-Id: Ie851f8dc6d08c46d5eec36c3eff34d322d37fac3
CRs-Fixed: 2612342
Currently, the driver rejects the roam stats event if any of the
roam trigger or roam scan or roam results tlv is not present.
Now the firmware will send neighbor report immediately after the
neighbor report response is received from AP instead of buffering
it.
So, handle roam stats event with neighbor report tlv alone and no
other tlv is present. Also update documentation for some static
functions
Change-Id: I8a697cda9945a7611930823dd7515bc36223f32a
CRs-Fixed: 2610358
Below beacon report/NEIGH rpt related details needs to be logged into kmsg:
i. Beacon Report Request
1. Token, Class, Channel list, Duration, Mode, BSSID wildcard, SSID
ii. Beacon Report Response
1. Token, Scanned AP Number
2. Reason – If Beacon Report could not proceed.
iii. Neighbor Report request
1. Sent from Mobile
iv. Neighbor Report Response
1. Channel list
Add the required details in beacon/neighbor report TX/RX path
Change-Id: I719863ecd4ac607d65dbbfde806921fe7214ce10
CRs-Fixed: 2610596
Update the mlme_get_roam_fail_reason_str() to return
correct string for new roam failure reason enums added.
Change-Id: I24983149fdcd8a0935eea9670832944638c33179
CRs-Fixed: 2607545
Currently the roam trigger, roam scan , candidates and
roam result related logs are printed at debug level and wouldnot
appear at kmsg. These logs are needed at kmsg for roaming
related debug requirement.
Change-Id: I0d407d04606462c88cf15f3693994f7cf11f6602
CRs-Fixed: 2607349
The host driver sends WMI_ROAM_PER_CONFIG_CMDID command after
WMI_ROAM_SCAN_MODE as part of RSO start/update. But the
expectation from firmware is that host should send this after
WMI_VDEV_PARAM_ROAM_FW_OFFLOAD but before WMI_ROAM_SCAN_MODE.
Also the WMI_VDEV_PARAM_ROAM_FW_OFFLOAD is sent after set key
response from csr->lim->wma->wmi. But the
WMI_ROAM_PER_CONFIG_CMDID is directly posted wma (csr->wma->wmi)
which can cause this command to go before the
WMI_VDEV_PARAM_ROAM_FW_OFFLOAD is sent to firmware.
One more instance where the WMI_ROAM_PER_CONFIG_CMDID can go
before vdev roam fw offload init is if the userspace sends
blacklist update command before offload init happens.
So route the WMI_ROAM_PER_CONFIG_CMDID via lim before posting
it to wma and add changes in rso update config to block the
blacklist command being sent in ROAM_DEINIT state.
Also Call csr_roam_offload_per_scan before csr_roam_send_rso_cmd
in csr_roam_offload_scan to send WMI_ROAM_PER_CONFIG_CMDID before
WMI_ROAM_SCAN_MODE.
Change-Id: I2600cfeafcc3e3ebfac6694c1f2cdb5df0366411
CRs-Fixed: 2596257
When WMI_ROAM_STATS_EVENTID is received, the driver copies the
roam scan candidate AP data from the event to destination
buffer. This num_ap count is used directly to fill the diag
buffer. When the number of candidates sent by the firmware
is greater than MAX_ROAM_CANDIDATE_AP(8), corruption of the
destination scan->ap buffer occurs.
Validate the number of APs before filling the diag event.
Change-Id: I5258bc0d4ce0108cbc5195aa464afd498ae9fbf9
CRs-Fixed: 2598513
When roaming is complete, firmware sends WMI_ROAM_STATS_EVENTID
to host driver. This event has details regarding the roam
trigger reason, roam scan and candidate details, roaming result
and 11kv info sent after roaming to AP. Parse this event and
fill the below diag log report to print this in logcat:
LOG_WLAN_AUTH_ASSOC_TX_RX_INFO
LOG_WLAN_ROAM_TRIGGER_INFO
LOG_WLAN_ROAM_SCAN_INFO
LOG_WLAN_ROAM_RESULT_INFO
LOG_WLAN_RRM_TX_RX_INFO
Change-Id: Ie09dc8ad5b236d0925327dba73a3f2e73a80109a
CRs-Fixed: 2597057
In function rrm_fill_beacon_ies, the total IE length is
calculated as sum of length field of the IE and 2 (element id 1
byte and IE length field 1 byte). The total IE length is defined
of type uint16_t and will overflow if the *(pBcnIes + 1)=0xfe.
Validate the len against total IE length to avoid overflow.
Change-Id: If8f86952ce43c5923906fc6ef18705f1785c5d88
CRs-Fixed: 2573329
When the firmware doesn't advertise the
wmi_service_hw_db2dbm_support target capability host should send
rssi values in SNR equivalent so that the hardware can trigger
interrupts. Else low rssi, idle roam, emergency deauth roam
interrupts will not be triggered.
Add changes to convert RSSI values coming from ini to
SNR and send it to firmware. Below ini parameters need
conversion:
bss_load_trigger_2g_rssi_threshold
bss_load_trigger_5g_rssi_threshold
idle_roam_min_rssi
candidate_min_rssi_for_beacon_miss
candidate_min_rssi_for_disconnect
Change-Id: Ied0325031b336d0b6c03ad5dda772170bc54190c
CRs-Fixed: 2590848
The connected profile in csr_roam_session is filled after join
success with an AP in csr_roam_process_join_res(). The connected
profile information also has the country code advertised by the
AP over its beacon in the Country Element (EID 7). When STA
roams from AP1 having country IE to AP1 which doesn't have
country IE, the driver checks if the country IE is present in
the AP2 beacon IEs. If the country code is present, new value is
copied, else the older country code value is not cleared.
This results in beacon report failure when roamed to AP2 due
to country code and op class mismatch.
Clear the country code in connected profile before checking if the
country code IE is present.
Change-Id: I503f9761ff33fb245a25b23893360389d7a0b258
CRs-Fixed: 2590117
The host driver checks the peer PMF capability
before adding MBO IE. But for open authentication
AP, the peer will not advertise PMF capability.
So while connecting to open mode AP, the MBO IE
doesn't get added in the association request frames.
Check if the authentication algorithm is open.
If the authentication algorithm is open don't
check for peer pmf capability to add MBO IE.
Change-Id: Ieae85ce696a40234535388a548906dc9521b19a0
CRs-Fixed: 2584527
The event WMI_ROAM_STATS_EVENTID is received after
every roam, once the roam synch complete is sent by the host.
This event contains details regarding the roam trigger reason,
values associated with the trigger, roam scan candidate info,
roam status, roam failure reason.
This helps in debugging/understanding the scenario when roam
failure happens.
WMI_ROAM_STATS_EVENTID Format:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
roam_stats_event_fixed_param |-> Contains vdev id and number of
| roams detail.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
roam_trigger data TLV |-> Has details on the roam trigger
| reason. Number of roam triggers
| TLV detail is present in the
| fixed param. Maximum 5 roam
| per event is supported
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
wmi_roam_scan_info TLV |-> Has details on the roam scan -
| scan type, rssi threshold,
| reason.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
wmi_roam_scan_channel_info |-> Has details on the roam scan
TLV | channels. Number of channels
| per trigger is found on the
| wmi_roam_scan_info TLV.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
wmi_roam_ap_info TLV |-> Has details on Roam candidate
| APs found during scan. Number
| of roam candidate APs per
| trigger is found on the
| on the wmi_roam_scan_info tlv.
| Max 8 candidates are allowed
| per roam scan.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
wmi_roam_result TLV |-> Info on roam success or failure.
| Fail reason, if roaming failed.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
wmi_roam_neighbor_report_info|->After roaming, firmware sends
TLV | neighbor/btm report to roamed AP
| to get list of roam candidates.
| This tlv provides info on this.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
wmi_roam_neighbor_channel_info|-> This has the info on the
| channel list received as part
| of BTM/Neighbor report.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Print the info received as part of this event into kmsg.
Featurize all the function defines for this roam logging under
WLAN_FEATURE_ROAM_OFFLOAD flag.
Change-Id: Iddc70b572f2e3dc47f08fd1c3c3597cb44981a17
CRs-Fixed: 2576222
If the requested info field in beacon report request is present,
the driver tries to allocate memory for the target beacon report
EIDs from the number of requested EIDs received from the frame.
In SLUB disabled builds, the qdf_mem_malloc function doesn't
validate if the size provided is 0 and returns the value
ZERO_SIZE_PTR(((void *)16)) for the pointer. When this pointer
is dereferenced, it causes invalid address dereference.
Since the number of requested EIDs is directly controlled by the
frame sent by AP, validate this value before using it to allocate
memory.
Change-Id: Icbac3e952de0d7ae3144e9b319f2c51ccdf93ac5
CRs-Fixed: 2571480
Currently the host driver checks if the BTM offload is enabled
via ini configuration and sets the BTM enabled bit of the
extended capabilities if BTM offload is enabled. The supplicant
decides if BTM is needed to be enabled or disabled based on the
PMF capability of the AP, since the STA is MBO certified.
When driver sets the BTM capability based on the btm_offload ini,
even if the AP supports MBO and doesn't advertise PMF, BTM is
honored by the MBO certified STA. This violates the MBO spec
that PMF is mandatory for MBO. So with the BTM capability
controlled by userspace, the BTM capability will be advertised
to MBO AP only if PMF is advertised as required for that AP.
Don't modify the BTM capability, and advertise it as it is
provided by the userspace. Firmware will drop the packet if
BTM capability is not advertised during initial connection.
Change-Id: I55b4e46a44011ce7a1982244df17ea32632f7ff3
CRs-Fixed: 2568311
SAE key derivation requires use of a secret element, PWE. This
element is deterministically discovered by repeatedly hashing
the password with some additional information until the
resulting hash is the abscissa of a point on the elliptic curve
(for ECC) or by exponentiating the hash digest to a constant to
produce an element (for FFC). This "hunting-and-pecking" loop
method is prone to side channel attacks.
To avoid this, a direct hashing to element technique in SAE is
introduced in IEEE P802.11-REVmd/D3.0. Support new RSNX IEEE
as part of the hash to element PWE derivation. The user space
sends the RSNX IE in the connect request.
Add support to save RSNXE from connect request and pack this IE
over SAE assoc request. Also send the IE in assoc IEs in RSO
commands.
Change-Id: I8eb756840400753794b1b80befe3a20f7d7c7705
CRs-Fixed: 2569596
Currently the driver uses STR_EDCA_ANI_ACBK_LOCAL as the length
for all the EDCA_LOCAL string cfg items.
Use the corresponding string length for EDCA_LOCAL string.
Change-Id: Ia6fd19b90c3d6c2c6e7a12e9f44389db2bf160f8
CRs-Fixed: 2569514
In pe_roam_synch_callback, fils_info is accessed from pe_session
and fils_info is defined only if WLAN_FEATURE_FILS_SK flag is
enabled.
Define new function to fill the fils_ft data, when the compile
flag WLAN_FEATURE_FILS_SK is defined.
Change-Id: If4f20950c489814366553e6fce65779b4f3551a4
CRs-Fixed: 2568349
Currently, when roaming to different SSID, the host driver
validates the SSID of the current connected AP and the roamed
SSID. If the validation fails, the driver disassociates with
the current AP, which results in data path carrier queues being
disabled. And as part of the roam indication to the user space,
the driver doesn't enable carrier queues.
Check if the SSID from the roam synch indication is present in
the allowed SSID list, if the SSID is present don't
disassociate with current AP.
Change-Id: Iafe3497d5d00753edbd5d5176ff3acd1a6d949bd
CRs-Fixed: 2567233
After roam synch indication is received, the driver compares the
SSID of the current AP and SSID of the roamed AP. If there is a
mismatch, driver issues disassociate to current connected AP.
This causes data path queues to be stopped and M2 to the roamed
AP from userspace will fail. The SSID of the current AP is
parsed from the beacon IEs stored in the connected bss
description. In hidden ssid case the SSID IE has 0 length
and the host receives unicast probe with SSID of the
AP in the roam synch indication. So SSID mismatch happens
and validation fails.
Check if the current SSID in the bss description is NULL.
If its NULL, get the SSID from the connected profile in csr
session.
Change-Id: I30c41b821c0fc506d763eb33f8bb706dd26b405a
CRs-Fixed: 2544915
In lim, gpLimMlmAuthReq is freed in lim_restore_auth_state if
auth failure timeout happens. gpLimMlmAuthReq is dereferenced in
lim_process_auth_retry_timer. When there is a race where
lim_restore_auth_state is called before lim_process_auth_retry_timer,
then null pointer dereference of gpLimMlmAuthReq happens in
lim_process_auth_retry_timer.
Validate gpLimMlmAuthReq against null before accessing it.
Change-Id: Ic1af10172aa98785c84165c4491c8bdc1b3e508f
CRs-Fixed: 2550793
Linux coding style doesn't allow camel case notations. So
rename assocReq to be in compliance.
Change-Id: I82e608da9548ac9413f9ecb025e5b662c9f555be
CRs-Fixed: 2480902
In SAE pmksa caching case, the authentication algorithm will be
open and pmkid will be included in association request frame.
Full SAE authentication with auth algo 3 will not happen.
If in SAE pmksa caching case, the auth frame is not acknowledged
then auth retry happens and while filling the authentication
algorithm in the auth retry frame, the driver doesn't check if
sae pmk caching is used. So if auth retry happens due to auth
failure, the driver sends authentication frame with auth algo as
SAE. So the AP tries to validate the auth frame for SAE cyclic
group and sends auth reject with status code 77 - the offered
finite cyclic group is not supported.
Fill the authentication algorithm as open for auth retry frame
in sae pmk cached case.
Change-Id: I6b579b8254623d1d267670862d2060fabc85edeb
CRs-Fixed: 2545547
Userspace gives a connect request to the driver with bssid/bssid
hint and if association reject is received from AP with reason
invalid PMKID(53), then it means the previous PMKID cached is
not valid and the STA has to do full SAE authentication to
derive new PMK. When assoc reject is received from AP, and
if no other candidate is found for connection, the driver sends
nl80211 connection failed notification and the supplicant issues
delete pmksa for that failed bssid, thereby preventing from
trying to the same AP again with same stale pmkid. But after
receiving assoc rejection, if other candidate is found, the
driver tries to connect to the other BSS and if association
fails with that too, the driver will send connect failed
notification for the latest BSSID to which connection failed. So
the PMKID for AP1, for which assoc reject was received due to
invalid pmkid, is not deleted and when connect request for that
AP is received again, the driver will try to do open auth with
the stale PMKID.
So delete the PMKID of SAE bssid when association rejection is
received from the AP due to invalid PMKID.
Change-Id: I2c7064b5cd333ccd166890bc4a6f7c8b8b9d503b
CRs-Fixed: 2542232
In WPA3 roam hybrid model, the SAE exchange/4-way handshake is
offloaded to the wpa_supplicant. After roam candidate selection,
firmware will send WMI_ROAM_PREAUTH_START_EVENTID to send SAE
authentication frame with the selected candidate. If the host
is in suspended state, then SAE preauthentication could fail.
So wakeup the host when WMI_ROAM_PREAUTH_START_EVENTID event is
received to carry out the SAE authentication with the provided
candidate
Change-Id: I7a89234e90e7fccef58ec3822dc0cda3740bad20
CRs-Fixed: 2512871
If supplicant disabled roaming, driver does not send RSO cmd to
fw. This causes roam invoke to fail in FW since RSO start never
happened at least once to configure roaming engine in FW.
So when supplicant disabled roaming on a vdev, send RSO start on
the vdev and then follow it with RSO stop command.
So when supplicant disabled roaming, disable the firmware
roam scans alone and allow roam invoke.
Change-Id: Ic3def72c6b60c42269d99e6db30cf3bfd1988d70
CRs-Fixed: 2543865
The host driver updates the group management cipher suite to the
firmware as part of RSO commands over the WMI_AP_PROFILE
command. The group management cipher suite is updated from the
group cipher suite which is not correct. As part of join success
update the group management cipher suite from roam_profile
in the roam serialization command in
csr_roam_save_connected_information().
Update the group management cipher suite from the roam profile
to the roam_request and copy it to the WMI_AP_PROFILE command
params in wma.
Change-Id: Ic8dca6938c487396e0202202efbb44ff214ecdcc
CRs-Fixed: 2542225
Consider STA+STA case where roaming is enabled on one sta.
There is a case where STA1 is roaming to a bssid and there is a
connect request for same bssid on STA2. Here the firwmare would
have already created peer for STA1 peer and STA2 peer creation
would have failed. But at host, since there is no response for
peer creation, the peer would be created for STA2 vdev.
When roam synch indication is received, then peer create fails
at host for the roaming vdev due to duplicate peer detection
logic. Still roam synch confirm is sent to the firmware.
When disconnection is received for STA1, then del bss is sent
for this vdev and firmware asserts as the peer was not created
for this STA2 vdev.
Defer the connect request processing and return failure when
roaming is in progress.
Change-Id: I0892dc567cd17e335b1de3cd5260050f2c1e6b44
CRs-Fixed: 2538389
In rrm_fill_beacon_ies(), the len is the total length of
IE + 2 bytes for element ID (1 byte) and length of the
IE(1 byte). Length is defined of type uint8_t and can have
only values upto 255. When the IE content length is 254,
adding 2 bytes to this will cause the len to overflow
resulting in continuous loop in rrm_fill_beacon_ies.
Change the len type to uint16_t to avoid integer overflow.
Change-Id: Id6a6bcce150f778e24316ccc5fb51c6e2a95fc5e
CRs-Fixed: 2537774
Currently the bitmap of action frames that can wake up the host
during suspend is sent via the wmi command
WMI_WOW_SET_ACTION_WAKE_UP_CMDID. This bitmap doesn't include
RRM action frames so currently the host doesn't wake up for rrm
action frames when in suspend mode.
Selectively enable wake up for rrm action frames during runtime PM
alone. Don't enable host wake up during normal suspend as it will
consume more power.
Change-Id: I097596118c2888fc9ea24802e4dbe69d02c5c5f7
CRs-Fixed: 2507185
Linux coding style doesn't allow camel case notations. So
rename limTimers to be in compliance.
Change-Id: I83807e8e5318cfad300365780f8cf9dc29037312
CRs-Fixed: 2482564
Linux coding style doesn't allow camel case notations. So
replace tLimMlmStaContext with the original structure.
Change-Id: Iea2968d9cf993c405390f0ff9712755137cebc07
CRs-Fixed: 2482105
Currently, sme_config_fast_roaming is called to set the
supplicant disabled roaming flag in the driver, which is
received over the vendor command
QCA_NL80211_VENDOR_SUBCMD_ROAMING. This supplicant disabled
roaming flag is used to toggle between RSO start and RSO stop.
When the driver is in disconnected state, the roaming module
would be in de-init state already. So the driver should return
success whenever a state change is received in disconnected
state. But currently the driver sends failure when its in
disconnected state. This results in sending failure status to
userspace.
Return QDF_SUCCESS status if any roam state change is requested
in disconnected state.
Change-Id: I520ab92b014eb1239e0164a39e0135e1bb4c2d70
CRs-Fixed: 2533019
In lim_send_link_report_action_frame(), the link report action
frame is filled in response to the link measurement request from
the AP. wma_tx_frame() is called to send the frame to the firmware.
But the vdev_id is initialized to 0 in
lim_send_link_report_action_frame(), but is not updated from
pe_session before passing it in wma_tx_frame. SO when STA comes
up on vdev 1, the vdev value is still sent as 0. This results in
the action frame dropped in firmware.
Fill the vdev_id from pe_session before sending it to firmware.
Change-Id: I5ee830fc6ca542c29f555bce63a77c3309777d3b
CRs-Fixed: 2530258
The nss value in the "iw <dev_name> link" command and
"iw <dev_name> dump station" is updated from the vdev mlme
object vdev_mlme->proto.generic.nss. This nss value is
updated only from lim_process_assoc_rsp_frame() and
lim_extract_ap_capability() only is the ap nss is less than
the session_nss. In roaming case the session_nss is updated
with the AP nss in lim_populate_peer_rate_set() so in assoc
response path the the global mlme vdev nss is not updated.
Update the vdev mlme object nss in lim_process_assoc_rsp_frame()
from the pe_session.
Change-Id: I2575a591f73ee172a83d4681e5f3134d5c9c60b0
CRs-Fixed: 2525710
To ensure the total weigtage of various factors doesn't exceed
100, there is a check in mlme_init_scoring_cfg(). If the total
weightage for roam score exceeds 100, the default values are
pushed for the weight configs.
In this computation, the enable/disable value is also added,
which results in configuration only upto 99%. Fix this weight
configuration and remove the enable flag value addition to the
total weight.
Change-Id: I15cf70428b2e8afa2203299dae98c287e5e2222d
CRs-Fixed: 2527361
As part of RSO update config, roam scan mode is set to 4 before
the WMI_ROAM_SCAN_RSSI_THRESHOLD command is sent to the firmware.
And after WMI_ROAM_SCAN_RSSI_THRESHOLD is sent, the roam scan
mode value is again set back to 7(value 7 enables RSSI scan and
periodic scan). There is a very small window between these two
commands where BMISS event is received and firmware forwards it
to the host which causes a disconnection.
Fix is to disable sending roam scan mode to 4 before sending the
WMI_ROAM_SCAN_RSSI_THRESHOLD command.
Change-Id: I2c22308d711e71e67d132a0bd121aed66497998b
CRs-Fixed: 2508762
Currently the host driver sets PMKSA op_flag for flush and
delete PMKSA entry as in both the cases PMK length is 0.
This is not correct because for delete PMKSA command only
the bssid and SSID will be sent to the firmware.
For the host driver to distinguish between del_pmksa and
flush pmksa, the is_flush_all flag should be used.
is_flush_all: true - Flush pmksa
is_flush_all: false - set/del pmksa based on the action flag.
Change-Id: I7eac65317a9c6904cfd08acce328a65df451269e
CRs-Fixed: 2503372
In wlan_hdd_extauth_copy_pmkid(), pmkid received from userspace
could be NULL. Currently there is no validation for the PMKID.
Add check to validate the received PMKID before copy.
Change-Id: I756458562bf20226a202a5ecdbbe9e79884169c7
CRs-Fixed: 2508935
Currently the host driver blocks roam scan offload command to
the target if the connected akm is OWE or SAE.
Add changes to read the WMI_SERVICE_WPA3_SAE_ROAM_SUPPORT and
WMI_SERVICE_WPA3_OWE_ROAM_SUPPORT service capability advertised
by the target and set it to the mlme fw_akm_bitmap. Read this
bitmap in csr_roam_offload_scan() to allow RSO command.
Also the connected akm is sent to the target via the
WMI_AP_PROFILE command. Translate the CSR akm type for OWE and
SAE akm also.
Change-Id: I68527722ab099e0c8e1681ed64ea416b9a6e9936
CRs-Fixed: 2491021
For WPA3 SAE LFR-3.0 roaming, authentication is offloaded to the
wpa_supplicant via the host driver due to the target crypto
inavailability limitations. The target does candidate selection
and sends the WMI_ROAM_PREAUTH_START_CMDID to the driver.
Once the SAE authentication is done, the supplicant sends the
external auth NL command with the authentication status, PMKID
derived. On receiving this event, send the PMKID, bssid, auth
status to the target over WMI_ROAM_PREAUTH_STATUS_CMDID command.
The host driver decides if the external authentication event is
received for preauth candidate or for initial connection by
checking the connected state information of the csr session.
When the authentication fails with the first candidate, the
target triggers the preauth start for the next candidate. This
happens till there are no candidates available to roam.
There could be a situation where the firmware sends preauth
event for candidate1 and before the supplicant could send the
external auth command to the host driver, the candidate1 preauth
timer could have expired and firmware sends the preauth start for
second candidate. After SAE is done with second candidate also,
the supplicant sends external auth event for second candidate. So
in this situation the firmware should decide to choose the
latest candidate. The host driver here is a mere passthrough and
doesn't maintain timer for the preauth event for each BSSID to
drop the expired candidate preauth events.
Change-Id: I799a05e55a59677dfc2ddf5b55ebc888ccfea03e
CRs-Fixed: 2507003
Firmware offloads WPA3 SAE authentication to host due to the
crypto library availability limitation. Once the roam candidate
selection is done in the firmware, firmware sends the
WMI_ROAM_PREAUTH_START_EVENTID. Once this event is received, the
host driver triggers the SAE.
Add support to offload the SAE authentication from firmware to
wpa_supplicant.
Change-Id: Ie3a9e731194e1edfcd9f33ef0d601767b9485d46
CRs-Fixed: 2490201
Currently the host driver updates the okc, pmksa flags
only after the set key management command is received from the
wpa supplicant. This is not needed as set_pmksa command is
received for 802.1x/SAE/OWE and key management needs to be
offloaded to firmware always for it to be able to include PMKID
in reassoc request/responses.
Receive the pmkid_modes from ini config parsed to mlme and
update in 11i tlv param of ROAM_SCAN_MODE command.
Change-Id: If169b402731e3713479e90b627060df470e5dab2
CRs-Fixed: 2506580
The host driver drops any authentication frames that doesn't
belong to current pe session. But, for WPA3 SAE roaming
pre-authentication is offloaded to user space, and as part of
that, the host driver should handle the SAE commit/confirm
messages received from the target AP for which there is no
pe_session.
Add changes to check the auth algorithm in the authentication
frames received for which no pe_session exist and if auth algo is
SAE, indicate that frame to wpa_supplicant.
Change-Id: Ie911524475423704246c1b4f694b83abdbf5129a
CRs-Fixed: 2505556
The host driver serialization module currently supports upto 4
commands in non scan pending queue. This is calculated at the
wlan_serialization_vdev_create_handler() as:
max_pending_cmds = (WLAN_SER_MAX_PENDING_CMDS /
WLAN_SER_MAX_VDEVS)
But in SAP case, if multiple STA sends deauth at the same time,
4 pending commands in non scan pending queue is not sufficient
and will result in only disassoc from the first 4 STA getting
honored.
The current host wlan driver supports 3 SAP mode and
2 STA vdevs amounting to a total of 5 vdevs supported.
So calculate the total non scan pending commands for
serialization based on the total peers supported for each
mode to fix this issue.
In SAP case, maximum 32 peer are supported and for STA case,
maximum 4 pending commands for serialization. So change the
max pending commands calculation as:
max_pending_cmds = (No. of sap modes supported * 32) +
(No .of STA modes supported *4 )
Change-Id: I30b2d79f2c15a092060dbdd729e1d035eb36fd83
CRs-Fixed: 2468945
When the set key timeout occurs and there is a disconnect
triggered from userspace during the set key timeout, then the
disconnect proceeds to free the roam_profile for the csr
session. And when the set key timeout handler
csr_roam_wait_for_key_time_out_handler() is invoked, it tries
to access the roam profile from csr_roam_link_up()->
csr_neighbor_roam_info_ctx_init(). This results in a race between the
supplicant thread and scheduler thread.
Acquire sme global lock before call to csr_roam_link_up() to avoid
this deadlock.
Change-Id: I1dd0bec7afa191648d064a1935a33d9612bb89bc
CRs-Fixed: 2486186
Linux coding style doesn't allow camel case notations. So
rename pLimJoinReq to be in compliance.
Change-Id: I813179ef538bdc4b4207123b5f7b7f6601091cf9
CRs-Fixed: 2480399
In P2P GO mode, if the P2P client device is not VHT capable and
only HT capable, but the DUT P2P GO is VHT capable and advertises
2x2 NSS and sends packets with 2x2 rates, it results in interop
issues with HT only capable P2P client devices.
When GO is operating in DBS mode, GO beacons advertise 2x2
capability but include OMN IE to indicate current operating mode
of 1x1. But here peer device is only HT capable and will not
understand OMN IE.
Check if the P2P client device is only HT capable and has
"\x00\x50\xf2\x04". Then downgrade the P2P GO operation to 1x1
nss. Modify rx mcs map value in association response to enable
only mcs 0-7.
Change-Id: I7177c5aee9a560a20c50a63886c0ee77f7d617ae
CRs-Fixed: 2464925
Firmware expects btm_offload_config value as 0x1c1 by default
so that BTM query is enabled. To enable BIT 7, "prefer_btm_query"
ini is used and its default value is 1. To enable BIT 8 in
btm_offload_config, "prefer_roam_score_for_candidate_selection"
ini is used and its default value is 1. Enable the BIT 6 also
by default.
Change the default value of btm_offload_config to set bit 6 by
default.
Change-Id: Ic0b222c281d1731aaf21aaff6a72ebf1f1f930de
CRs-Fixed: 2466687
Linux coding guidelines don't allow use of camel case identifiers.
So rename selfMacAddr to self_mac_addr to be in compliance.
Change-Id: Id70e00744883f9fd797da8d4bb1cf4f65c8aa9ff
CRs-Fixed: 2463827
Disable LFR2 in cld-3.2 mainline as roaming is offloaded
to firmware in LFR3. Also fix linker issues with lfr2 disabled.
Featurize LFR2 properly with adding correct header files
and bringing LFR2 only functions under WLAN_FEATURE_HOST_ROAM
compile time flag.
Change-Id: Iac81b693feaab503d371753a4d16cc3e70df2a87
CRs-Fixed: 2459786
eCsrAuthType is the enum of AKMs to be used during connection.
So the name eCsrAuthType is misleading as akm and auth algo are
different.
Also the Linux Coding Style doesn't allow mixed-case names and
so-called Hungarian notation, so rename the enum eCsrAuthType to
be compliant.
Change-Id: I35e18d1f84babd0ef2928ae9d7258028d4c9b3c5
CRs-Fixed: 2463813
