From 8f246c9dd17c1c2d50aa1341ca643ea21c018c6f Mon Sep 17 00:00:00 2001 From: Agrawal Ashish Date: Mon, 11 Jan 2016 22:48:16 +0530 Subject: [PATCH 1/4] qcacld-2.0: Dont include ext caps in Assoc request if AP doesn't support prima to qcacld-2.0 propagation Some AP doesn't announce Extended Capabilities IE in Probe Response. Device should not send extended Capabilities if AP doesn't support. Change-Id: I53215b866cb90f4addf45e3b6ed8af435eb57842 CRs-Fixed: 930199 --- .../CORE/MAC/src/include/parserApi.h | 1 + .../CORE/MAC/src/pe/include/limSession.h | 1 + .../CORE/MAC/src/pe/lim/limPropExtsUtils.c | 5 ++++- .../MAC/src/pe/lim/limSendManagementFrames.c | 19 +++++++++++-------- .../CORE/SYS/legacy/src/utils/src/parserApi.c | 5 +++++ 5 files changed, 22 insertions(+), 9 deletions(-) diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h index 072b09cb3b40..6184e10b27da 100644 --- a/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h +++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/include/parserApi.h @@ -165,6 +165,7 @@ typedef struct sSirProbeRespBeacon tDot11fIEVHTCaps VHTCaps; tDot11fIEVHTOperation VHTOperation; tDot11fIEVHTExtBssLoad VHTExtBssLoad; + tDot11fIEExtCap ExtCap; tDot11fIEOperatingMode OperatingMode; tANI_U8 WiderBWChanSwitchAnnPresent; tDot11fIEWiderBWChanSwitchAnn WiderBWChanSwitchAnn; diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h index c4bf4058daaf..e3809d2b1b6b 100644 --- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h +++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/include/limSession.h @@ -498,6 +498,7 @@ typedef struct sPESession // Added to Support BT-AMP /* Supported NSS is intersection of self and peer NSS */ bool supported_nss_1x1; bool add_bss_failed; + bool is_ext_caps_present; } tPESession, *tpPESession; /*------------------------------------------------------------------------- diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c index 4fa31061d6c0..047eb5b8cbf9 100644 --- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c +++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limPropExtsUtils.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -225,6 +225,9 @@ limExtractApCapability(tpAniSirGlobal pMac, tANI_U8 *pIE, tANI_U16 ieLen, if (pBeaconStruct->countryInfoPresent) psessionEntry->countryInfoPresent = TRUE; } + /* Check if Extended caps are present in probe resp or not */ + if (pBeaconStruct->ExtCap.present) + psessionEntry->is_ext_caps_present = true; vos_mem_free(pBeaconStruct); return; } /****** end limExtractApCapability() ******/ diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c index 3a60c497eaa7..d775e7e6421a 100644 --- a/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c +++ b/drivers/staging/qcacld-2.0/CORE/MAC/src/pe/lim/limSendManagementFrames.c @@ -2054,11 +2054,11 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal pMac, vos_mem_set( ( tANI_U8* )pFrm, sizeof( tDot11fAssocRequest ), 0 ); - if (nAddIELen) { + if (nAddIELen && psessionEntry->is_ext_caps_present) { vos_mem_set(( tANI_U8* )&extractedExtCap, sizeof( tDot11fIEExtCap ), 0); nSirStatus = lim_strip_extcap_update_struct(pMac, pAddIE, - &nAddIELen, - &extractedExtCap ); + &nAddIELen, + &extractedExtCap ); if(eSIR_SUCCESS != nSirStatus ) { extractedExtCapFlag = eANI_BOOLEAN_FALSE; @@ -2074,7 +2074,8 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal pMac, extractedExtCapFlag = lim_is_ext_cap_ie_present(p_ext_cap); } } else { - limLog(pMac, LOG1, FL("No additional IE for Assoc Request")); + limLog(pMac, LOG1, + FL("No addn IE or peer dosen't support addnIE for Assoc Req")); extractedExtCapFlag = eANI_BOOLEAN_FALSE; } @@ -2215,8 +2216,8 @@ limSendAssocReqMgmtFrame(tpAniSirGlobal pMac, isVHTEnabled = eANI_BOOLEAN_TRUE; } #endif - - PopulateDot11fExtCap( pMac, isVHTEnabled, &pFrm->ExtCap, psessionEntry); + if (psessionEntry->is_ext_caps_present) + PopulateDot11fExtCap( pMac, isVHTEnabled, &pFrm->ExtCap, psessionEntry); #if defined WLAN_FEATURE_VOWIFI_11R if (psessionEntry->pLimJoinReq->is11Rconnection) @@ -2685,8 +2686,9 @@ limSendReassocReqWithFTIEsMgmtFrame(tpAniSirGlobal pMac, limLog( pMac, LOG1, FL("Populate VHT IEs in Re-Assoc Request")); PopulateDot11fVHTCaps( pMac, psessionEntry, &frm.VHTCaps ); isVHTEnabled = eANI_BOOLEAN_TRUE; - PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry); } + if (psessionEntry->is_ext_caps_present) + PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry); #endif nStatus = dot11fGetPackedReAssocRequestSize( pMac, &frm, &nPayload ); @@ -3117,7 +3119,8 @@ limSendReassocReqMgmtFrame(tpAniSirGlobal pMac, } #endif - PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry); + if (psessionEntry->is_ext_caps_present) + PopulateDot11fExtCap(pMac, isVHTEnabled, &frm.ExtCap, psessionEntry); nStatus = dot11fGetPackedReAssocRequestSize( pMac, &frm, &nPayload ); if ( DOT11F_FAILED( nStatus ) ) diff --git a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c index 8b9070d03a2d..a9ad11acd3ec 100644 --- a/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c +++ b/drivers/staging/qcacld-2.0/CORE/SYS/legacy/src/utils/src/parserApi.c @@ -3681,6 +3681,11 @@ sirParseBeaconIE(tpAniSirGlobal pMac, pBeaconStruct->Vendor1IEPresent = pBies->Vendor1IE.present; pBeaconStruct->Vendor2IEPresent = pBies->Vendor2IE.present; pBeaconStruct->Vendor3IEPresent = pBies->Vendor3IE.present; + if (pBies->ExtCap.present) { + pBeaconStruct->ExtCap.present = 1; + vos_mem_copy( &pBeaconStruct->ExtCap, &pBies->ExtCap, + sizeof(tDot11fIEExtCap)); + } vos_mem_free(pBies); return eSIR_SUCCESS; From 06c9e00fb2c672c1bda281288e1d667988f41134 Mon Sep 17 00:00:00 2001 From: Srinivas Girigowda Date: Tue, 7 Jun 2016 08:51:34 -0700 Subject: [PATCH 2/4] qcacld-2.0: Validate CCXBEACONREQ IE fields Validate CCXBEACONREQ IE fields. Change-Id: Ie64a642abdd7923e91801186aa5743094a739fc9 CRs-Fixed: 1025185 --- .../qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c index 5a8f7215ca40..0e34590da5c6 100644 --- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c +++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c @@ -4127,7 +4127,8 @@ static VOS_STATUS hdd_parse_ese_beacon_req(tANI_U8 *pValue, tCsrEseBeaconReq *pEseBcnReq) { tANI_U8 *inPtr = pValue; - int tempInt = 0; + uint8_t input = 0; + uint32_t tempInt = 0; int j = 0, i = 0, v = 0; char buf[32]; @@ -4150,11 +4151,11 @@ static VOS_STATUS hdd_parse_ese_beacon_req(tANI_U8 *pValue, v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL; - v = kstrtos32(buf, 10, &tempInt); + v = kstrtou8(buf, 10, &input); if (v < 0) return -EINVAL; - tempInt = VOS_MIN(tempInt, SIR_ESE_MAX_MEAS_IE_REQS); - pEseBcnReq->numBcnReqIe = tempInt; + input = VOS_MIN(input, SIR_ESE_MAX_MEAS_IE_REQS); + pEseBcnReq->numBcnReqIe = input; hddLog(LOG1, "Number of Bcn Req Ie fields: %d", pEseBcnReq->numBcnReqIe); @@ -4175,24 +4176,24 @@ static VOS_STATUS hdd_parse_ese_beacon_req(tANI_U8 *pValue, v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL; - v = kstrtos32(buf, 10, &tempInt); + v = kstrtou32(buf, 10, &tempInt); if (v < 0) return -EINVAL; switch (i) { case 0: /* Measurement token */ - if (tempInt <= 0) { + if (!tempInt) { VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, - "Invalid Measurement Token(%d)", tempInt); + "Invalid Measurement Token: %d", tempInt); return -EINVAL; } pEseBcnReq->bcnReq[j].measurementToken = tempInt; break; case 1: /* Channel number */ - if ((tempInt <= 0) || + if ((!tempInt) || (tempInt > WNI_CFG_CURRENT_CHANNEL_STAMAX)) { VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, - "Invalid Channel Number(%d)", tempInt); + "Invalid Channel Number: %d", tempInt); return -EINVAL; } pEseBcnReq->bcnReq[j].channel = tempInt; @@ -4202,19 +4203,18 @@ static VOS_STATUS hdd_parse_ese_beacon_req(tANI_U8 *pValue, if ((tempInt < eSIR_PASSIVE_SCAN) || (tempInt > eSIR_BEACON_TABLE)) { VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, - "Invalid Scan Mode(%d) Expected{0|1|2}", tempInt); + "Invalid Scan Mode: %d Expected{0|1|2}", tempInt); return -EINVAL; } pEseBcnReq->bcnReq[j].scanMode= tempInt; break; case 3: /* Measurement duration */ - if (((tempInt <= 0) && + if (((!tempInt) && (pEseBcnReq->bcnReq[j].scanMode != eSIR_BEACON_TABLE)) || - ((tempInt < 0) && - (pEseBcnReq->bcnReq[j].scanMode == eSIR_BEACON_TABLE))) { + ((pEseBcnReq->bcnReq[j].scanMode == eSIR_BEACON_TABLE))) { VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, - "Invalid Measurement Duration(%d)", tempInt); + "Invalid Measurement Duration: %d", tempInt); return -EINVAL; } pEseBcnReq->bcnReq[j].measurementDuration = tempInt; From 665615d8f69b060f04482242107c9013976187ff Mon Sep 17 00:00:00 2001 From: Abhishek Singh Date: Sat, 30 Jul 2016 18:08:09 +0530 Subject: [PATCH 3/4] qcacld-2.0: Fix scan failure issue due to stale PE session If roaming is initiated by firmware, after getting the candidate list the CSR will start preauth with the candidates and thus preauth will be the active command in SME. Now if at the same time connect is issued from supplicant, HDD will queue disconnect cmd in SME queue and wait for disconnect to get complete for 2 sec. Now there is a chance that channel change along with preauth timeout can take more than 2 secs. In this scenareo the disconnect will timeout in HDD and will return connect failure to supplicant. Next supplicant will issue disconnect which is ignored by HDD as disconnect is already been queued in SME. Now if supplicant again sends the connect command, as part of connect command CSR will remove the disconnect command from the SME queue and queue this connect command. On preauth timeout the preauth state machine checks if disconnect is queued and if it is queued it will abort preauth. But in this case disconnect is removed by the connect request and thus preauth retry continues and if preauth is success handoff will be queued in SME queue. Now the connect request is processed and if this connect request's BSSID is same as the BSSID of the roam candidate, as all the CSR states for this BSSID session indicate roaming, instead of join it will try to reassociate and continue changing the CSR states again. Eventually this connect will fail. Next the handoff command is processed and as part of handoff it will try to cleanup original session, but as CSR states are changed by connect request the original session is not cleaned up properly. This results in stale PE session entry which does not allow the scan to be sent to firmware, returning the cached results and thus 0 scan results. To fix this: - Increase the WLAN_WAIT_TIME_DISCONNECT to 5 sec to make sure all sessions are cleaned up before allowing the new connect to proceed. - Increase the priority of preauth scans. Change-Id: Id7cc1e6f3c31df8a8c8955eb3ff48cb60e5b5ab2 CRs-Fixed: 1048394 --- drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h | 2 +- drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h index 65aed10d6466..72df9c0bb848 100644 --- a/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h +++ b/drivers/staging/qcacld-2.0/CORE/HDD/inc/wlan_hdd_main.h @@ -115,7 +115,7 @@ #define ACS_IN_PROGRESS (0) /** Maximum time(ms)to wait for disconnect to complete **/ -#define WLAN_WAIT_TIME_DISCONNECT 2000 +#define WLAN_WAIT_TIME_DISCONNECT 5000 #define WLAN_WAIT_TIME_STATS 800 #define WLAN_WAIT_TIME_POWER 800 #define WLAN_WAIT_TIME_COUNTRY 1000 diff --git a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c index 630625f6482a..869cdb8d18ea 100644 --- a/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c +++ b/drivers/staging/qcacld-2.0/CORE/SERVICES/WMA/wma.c @@ -8848,7 +8848,7 @@ VOS_STATUS wma_start_scan(tp_wma_handle wma_handle, cmd->min_rest_time = WMA_ROAM_PREAUTH_REST_TIME; cmd->max_rest_time = WMA_ROAM_PREAUTH_REST_TIME; cmd->max_scan_time = WMA_ROAM_PREAUTH_MAX_SCAN_TIME; - cmd->scan_priority = WMI_SCAN_PRIORITY_HIGH; + cmd->scan_priority = WMI_SCAN_PRIORITY_VERY_HIGH; adf_os_spin_lock_bh(&wma_handle->roam_preauth_lock); cmd->scan_id = ( (cmd->scan_id & WMA_MAX_SCAN_ID) | WMA_HOST_ROAM_SCAN_REQID_PREFIX); From 3f17bca12e2c1124b96b42ff70105a0131ae5272 Mon Sep 17 00:00:00 2001 From: Govind Singh Date: Wed, 10 Aug 2016 11:51:03 +0530 Subject: [PATCH 4/4] qcacld-2.0: Discard pktlog message for invalid msdu id During HOST AP offload case fw is sending pktlog tx info with invalid MSDU id. This will result in invalid de-reference tx descriptor. Discard pktlog msg for invalid msdu id to handle the above scenario. Change-Id: I2dae296fd0c63c916b6470567ded672cf73bf435 CRs-Fixed: 1052684 --- .../qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c | 21 +++++++++++-------- .../CORE/UTILS/PKTLOG/pktlog_internal.c | 7 ++++++- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c index 3bc0ae1f4222..fa296a21c96c 100644 --- a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c +++ b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_ac.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -312,7 +312,7 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state) if (!scn) { printk("%s: Invalid scn context\n", __func__); ASSERT(0); - return -1; + return A_ERROR; } txrx_pdev = scn->pdev_txrx_handle; @@ -326,7 +326,7 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state) if (!pl_dev) { printk("%s: Invalid pktlog context\n", __func__); ASSERT(0); - return -1; + return A_ERROR; } pl_info = pl_dev->pl_info; @@ -345,7 +345,7 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state) if (!pl_info->buf) { printk("%s: pktlog buf alloc failed\n", __func__); ASSERT(0); - return -1; + return A_ERROR; } } @@ -365,12 +365,13 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state) if (wdi_pktlog_subscribe(txrx_pdev, log_state)) { printk("Unable to subscribe to the WDI %s\n", __func__); - return -1; + return A_ERROR; } /* WMI command to enable pktlog on the firmware */ if (pktlog_enable_tgt(scn, log_state)) { - printk("Device cannot be enabled, %s\n", __func__); - return -1; + adf_os_print("Device cannot be enabled, %s\n", __func__); + wdi_pktlog_unsubscribe(txrx_pdev, pl_info->log_state); + return A_ERROR; } else { pl_dev->tgt_pktlog_enabled = true; } @@ -378,13 +379,15 @@ pktlog_enable(struct ol_softc *scn, int32_t log_state) pl_dev->pl_funcs->pktlog_disable(scn); pl_dev->tgt_pktlog_enabled = false; if (wdi_pktlog_unsubscribe(txrx_pdev, pl_info->log_state)) { - printk("Cannot unsubscribe pktlog from the WDI\n"); - return -1; + adf_os_print("%s: Cannot unsubscribe pktlog from the WDI\n", + __func__); + return A_ERROR; } } pl_info->log_state = log_state; return 0; + } int diff --git a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c index 8f9042fe2ef0..5f50f77c97aa 100644 --- a/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c +++ b/drivers/staging/qcacld-2.0/CORE/UTILS/PKTLOG/pktlog_internal.c @@ -375,6 +375,11 @@ process_tx_info(struct ol_txrx_pdev_t *txrx_pdev, >> TX_DESC_ID_HIGH_SHIFT); msdu_id += 1; } + if (tx_desc_id >= ol_cfg_target_tx_credit(txrx_pdev->ctrl_pdev)) { + adf_os_print("%s: drop due to invalid msdu id = %x\n", + __func__, tx_desc_id); + return A_ERROR; + } tx_desc = ol_tx_desc_find(txrx_pdev, tx_desc_id); adf_os_assert(tx_desc); netbuf = tx_desc->netbuf; @@ -385,7 +390,7 @@ process_tx_info(struct ol_txrx_pdev_t *txrx_pdev, if (len < (2 * IEEE80211_ADDR_LEN)) { adf_os_print("TX frame does not have a valid address\n"); - return -1; + return A_ERROR; } /* Adding header information for the TX data frames */ vdev_id = (u_int8_t)(*(htt_tx_desc +