If the tag length in next_elem is some invalid high value then the
existing length check can still pass and lead to the OOB access.
Add an OOB check w.r.t total IE length to ensure it has the
minimum number of bytes in the buffer.
Change-Id: I9778a3e0ced05d3246d91e23c2a47f7318634d75
CRs-Fixed: 3717566
If the length of the MBSSID IE is 0, then there is a potential
OOB read in util_scan_parse_mbssid(), when the Max BSSID indicator
field is accessed.
To fix this, do not proceed with MBSSID parsing if the length
of the MBSSID IE is zero.
Change-Id: I2c7a7641b77fed20a910cb77035588a7540caa62
CRs-Fixed: 3717567
While parsing ESP IE from beacon/probe response frame,
the condition in loop to copy ESP_INFO from the ESP IE is
incorrect which will iterate for 5 times rather than 4 times,
this may cause OOB access.
data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3)
Here adding 3 for esp_ie->esp_len, actually esp_len itself is
1 byte extra (esp_ len = ESP_ID_EXTN + ESP_INFO * 4),
but by adding 3 again will loop for one more iteration
this will cause OOB access.
Remove 3 in loop condition to avoid one more extra iteration
and ignore ESP_ID_EXTN element for total elements, in function
util_scan_update_esp_data.
Change-Id: Ia9226e483672369af36c6914e3ac914fe9de45e5
CRs-Fixed: 3710081
This change is to update no. of dwords for htt_tx_msdu_desc_ext2_t
as new dwords have to be added by FW to pass
rx buffer address info to support opt_dp_ctrl.
Change-Id: I3edb0a32a1e340d715c00776254ab50aca93c4e0
CRs-Fixed: 3717471
Currently, in the driver, the minimum MBSSID IE length value
in the driver is set to 4. Some APs advertize this value as
1. In such situations, driver fails to parse the the ie.
So, to avoid such cases, modify the minimum mbssid ie length
value to 1.
Change-Id: I6ef89706b95318cb9bd38e04cab56b0fdef99fd5
CRs-Fixed: 3684794
Currently host doesn't check if power type is supported
for connection channel while calculating best 6 GHz
power type for connection. This results in calculation
of incorrect power for connection values if 6 GHz power
type is not supported for that particular channel.
To address this issue configure power type for connection
only if that power type is supported for connection
channel.
Change-Id: I0570dbf7c8dc41b3f0a92480b8d8f57d89ea65f6
CRs-Fixed: 3697209
Add an API reg_translate_6g_chan_enum to translate an index between
MIN_6GHZ_CHANNEL and MAX_6GHZ_CHANNEL, to an index between 0 and
NUM_6GHZ_CHANNELS.
Change-Id: I5eaacf36403252a56293b8fadc797ac2aacd751d
CRs-Fixed: 3099080
Find the best 6 GHz power type for connection
according to following regulatory policy:
1) SP power type is selected only if AP advertises
SP and client supports SP.
2) LPI power type is selected only if AP advertises
LPI and client supports LPI.
3) VLP power type is selected for the below cases,
a) AP advertises VLP and client supports VLP
b) AP advertises SP but client doesn't support
SP but supports VLP.
c) AP advertises LPI but client doesn't support
LPI but supports VLP.
Change-Id: I6e3b9fc4bf7445c58681ef0ea8e45b434851a5b6
CRs-Fixed: 3456182
Define an attribute for high RSSI roam trigger threshold. STA is
expected to trigger roam if the current connected AP's RSSI gets above
this high RSSI threshold. STA's roam attempt on high RSSI threshold aims
to find candidates from other better Wi-Fi bands.
Change-Id: Ie0323ff990e2679fd9768d2242730f7369cdb64f
CRs-Fixed: 3586127
Currently host uses LPI as default power type when STA and
AP country is same without checking if powertype advertised
by AP is valid for client or not.
To address this issue default to power type advertised by AP.
Change-Id: I59144b020bed5af49dea8fdaad0e59daa556fefe
CRs-Fixed: 3381295
If country code for AP and STA are same and if STA does not
support VLP mode for a particular channel and if AP power
type is misconfigured to VLP mode, do not allow connection
to that AP as per regulatory guidelines.
Change-Id: Ie3bb980df25a15c4d9d7e566663e28950414f733
CRs-Fixed: 3362142
It is mandatory request to check security mode in 6 GHz band,
so enable check_6ghz_security by default. Keep default disable
for WIN as requested.
Change-Id: Idcc4cb9add98ad4bda8e4357e83460ca25221692
CRs-Fixed: 3006930
Currently SET_DISABLE_CHANNEL_LIST command is used to disable
legacy channels only.
Update this command to accept frequency for all the bands along with
the channel numbers from legacy (2.4 GHz/5 GHz) and update the
channel state in secondary channel list also.
Change-Id: Iecc9f73dca65900d82a2f2a044cb854cea58c638
CRs-Fixed: 3601253
Cleanup reg_cache_channel_state and the
related code with it.
Also, changed the logic so as to compare
channel freq instead of channel number in
reg_modify_chan_list_for_cached_channels()
Change-Id: I424b6886ed18f73bae0d2b36e36a9ddc1819688b
CRs-Fixed: 2908016
Currently driver does not consider gindoor_channel_support ini
when it decides the ap power type and because of that it always
decides ap power type as VLP. Driver should consider this ini
value as well because this INI says that indoor channels are
allowed so driver should set ap power mode as LPI to allow
LPI power mode.
Change-ID: Id7ad546ba23ce210497002e3083a22f1edc87185
CRs-Fixed: 3085997
Add a new counter inccorect_rdi to fisa stats to log incorrect reo
destination indications in fisa processing.
Change-Id: I785ad90ae1d36b2f6b9b1888373a29fcbd65348e
CRs-Fixed: 3426537
Due to limitation uCode always filling SGI as long for VHT mode in
rx_msdu_start_tlv.
This change is to extract VHT Rx data packet SGI from
WMI_VDEV_SMART_MONITOR_EVENTID.
Change-Id: I5fcdc463ea2a6d83253e39cc377a2471aeb4e122
CRs-Fixed: 3477303
Currently HP update can skip for few packets if the system suspend
is happening in parallel with tx. This could lead to SMMU fault if
the skipped HP update goes after tx desc force free.
Remove the tx pause check in HP updates and have the check before
calling dp_tx_send in case of intra-bss forward case. No special
handling is needed for non intra-bss case as we don't expect packets
from network stack after suspend.
Change-Id: Id4f2cefcc0a14e7c16438b9bda5cb1d55eb05050
CRs-Fixed: 3327818
In SAP due to intrabss forwarding, Tx ring update is going through
when WOW enable command has been sent to FW. This results in crash.
To fix this, do not update HP when apps suspend is in progress.
Change-Id: Id4176224563bdd759828397fa1cd23de1598192e
CRs-Fixed: 3294407
When do SAE-5.7.3 certification test case, STA will choose non SAE-PK
AP to connect which is wrong expected result, non SAE-PK AP beacon
will carry with QBSS IE that contributes more score than SAE-PK AP
score config.
Fix is to give SAE-PK AP more score to pass SAE-5.7.3 certification
case.
Change-Id: Ib3e516ccfa673e19f9bf0869aeffe4f5b1862a71
CRs-Fixed: 3101317
Currently low TPC power is configured to firmware if power constraint IE
is not present and only vendor DTPC IE is present. TPC power calculation
is depends on regulatory power, ap power constraint and TPE IE.
To fix this add new check is_power_constraint_abs in reg_tpc_obj.
Whenever local power constraint is from DTPC IE, is_power_constraint_abs
is set to true. And TPC power is calculated with regulatory power,
DTPC IE power and TPE IE power.
Change-Id: If6f1ea737c8b32db449dd340314026fd3693b698
CRs-Fixed: 3387238
From firmware perspective, host only sets 5 GHz regdomain hence 2 GHz
uses default setting and firmware does not update channel list event
for all phys according to the new country code.
Therefore sets pdev_id to 0xFF in function reg_set_country and it is
mapping to WMI_PDEV_ID_SOC when issue wmi command
WMI_SET_CURRENT_COUNTRY_CMDID as firmware required.
Change-Id: I0eb84db9f6d77c0473161cc4ffc0dcebd31c3d45
CRs-Fixed: 3239644
Currently, Fw did not set NACK reason code
to Host when Fw is not ready for WoW.
As part of the new change, Fw will send NACK
reason code along with WoW NACK to host.
Make changes in host to parse NACK reason
code from the received message.
Change-Id: I17ee99cb302ff546731a46d3ce03977c3c3d5a67
CRs-Fixed: 3481189
Currently host drops an AP from scan list if host country is set to
US and AP country is non-US. This implementation violates our
standard regulatory scan policy.
To address this issue, introduce a new INI to differentiate
between our standard regulatory policy with others.
Change-Id: Id72f871653e31969c4d1b147cb3c557f90a6c8f6
CRs-Fixed: 3361720
For example, If tmp_new[1] = 3, subie_len=160,
tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy will be 159.
In this scenario, while condition gets true (159 <= 160)
In if condition (159 >= 160), we are not breaking the loop in if.
tmp_new will get incremented, tmp_new will point at 159,
tmp_new[1] will point at 160, tmp_new[2] point at 161.
So, we are accessing one byte out-of-bound value.
To fix accessing out-of-bound value subtract one from the subie_len
in while and if condition to avoid this scenario.
Change-Id: I624585323963b6d79acf9ff0f96ec17e0b415c2d
CRs-Fixed: 3358833
When handling WMI_ROAM_SCAN_STATS_EVENTID,
the number of channels scanned for each roam trigger is fetched from
wmi_roam_scan_info TLV (wmi_roam_scan_info->roam_scan_channel_count),
The total number of channels for all the roam triggers is fetched from
param_buf->num_roam_scan_chan_info.
chan_idx is the index used to fetch the current channel info TLV to be
read. So if wmi_roam_scan_info->roam_scan_channel_count provided by
firmware exceeds the total param_buf->num_roam_scan_chan_info starting
from given chan_idx then OOB access of event buffer can happen.
To avoid this, validate the sum of the current chan_idx and
src_data->roam_scan_channel_count against
evt_buf->num_roam_scan_chan_info.
Change-Id: Ied94464d1f12690cf8832962b94595c2e00c33f8
CRs-Fixed: 3357714
Currently, BSS beamformee score is calculated from vht_cap or
eht caps, so for 6 GHz HE capable BSS it will calculated to zero.
Due to this 5 GHz will always get selected compared to 6 GHz BSS with
all other capabilities and conditions same in both BSS as 5 GHz
will have more total candidate score.
Fix this issue by correct calculation of AP beamformer capability
in case of 6 GHz HE BSS.
Change-Id: I0f3285ce1c5c1aeeba624c5371ff0f884ae78c58
CRs-Fixed: 3351991
Fetch fw capability to support p2p+p2p concurrency and
store cap info in 29th bit of soc_fw_ext_caps.
Change-Id: Id8e4c0310f8db503a2997e8aed5a6f1ce813dcc7
CRs-Fixed: 3032068
Add P2P_P2P_CONCURRENCY_SUPPORT service capablity to
validate whether fw can support p2p concurrency
support or not. when firmware advertises this flag it
can support MCC,SCC, DBS for p2p-GO/GC + p2p-GO/GC.
Change-Id: Ifec4bf984595b06374be9024601733c8537a9c3e
CRs-Fixed: 2984165
Currently host driver defines 11d offload APIs under
HOST_11D_SCAN feature flag which is not correct.
Add 11d offload APIs under TARGET_11D_SCAN feature flag.
Change-Id: I0d3205b215c9fc363a71c4e7a6b54e40fb10a964
CRs-Fixed: 3387603
Add QCA_WLAN_VENDOR_ATTR_CONFIG_WFC_STATE vendor attribute,
Userspace uses this attribute to configure wfc state to
Driver/Firmware. The Driver/Firmware uses this information to
optimize power savings, rate adaption, roaming, etc.
Change-Id: If58bd1e64216de81af6cf82eaabd740b85729eac
CRs-Fixed: 3343034
Realloc memory for wmi_service_ext_bitmap when
WMI_SERVICE_AVAILABLE_EVENTID event come, and
the num of wmi_service_ext_bitmap large then
previous num.
Change-Id: I2800fe3274e5516369486ef065ce03ba121bd5b3
CRs-Fixed: 3346739
Remove logic to enable/disable wake msi for drv systems. Today, during
WoW suspend sequence, between hif pci bus suspend and hif pci bus
suspend no irq, wake msi is getting disable temporarily. In case
fw toggles wake msi during this period, then the wake msi is lost,
which can lead to device not waking up for fw triggered wakeup.
Add the fix to remove enable/disable wake msi from suspend/resume
path and keep wake msi always enabled.
Change-Id: Idad0805f66ead4079d67577fa1151f73567511a3
CRs-Fixed: 3042261
Send the driver disconnect internal reason code as an event to user space
using QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON vendor command.
Change-Id: I0027675b809b94628b6c0c4b8e8286e38fa9f47d
CRs-Fixed: 3371398
Currently the FILS Discovery rx frames are dropped in
tgt_mgmt_txrx_rx_frame_handler considering them as unspecified
packets as action category for FILS Discovery is not defined.
Define FILS Discovery action category so that the FILS Discovery
will not be considered as unspecified frames and dropped while
processing.
Change-Id: I72398caf3cbb1f7d53d5f97da9d1997af2b33595
CRs-Fixed: 3346195
During the roam scan, if there are no desired APs found in the partial
frequency list, an immediate full scan on all the supported frequencies
is initiated as a fallback. This would include the 6 GHz PSC
frequencies. Define an attribute to allow that behavior to be modified
to include PSCs only if 6 GHz use has been detected.
Change-Id: I81eb9b20c2953e6b0dbf4138b31547db82d7397f
CRs-Fixed: 3351706
Add support to send Fils discovery template via target if
Add func to compute shortssid with the help of shortssid table
Change-Id: I78fa50641ee5ae0c338719c4cec91573a212f396
CRs-Fixed: 3114903
During the roam scan, if there are no desired APs found in the partial
frequency list, an immediate full scan on all the supported frequencies
is initiated as a fallback. This flag controls the frequency list
creation for full scan on the following lines.
1 - Full scan to exclude the frequencies that were already scanned by
the previous partial scan.
0 - Full scan to include all the supported frequencies irrespective of
the ones already scanned by partial scan.
Change-Id: Id48ae28e6d0e719b9db9b2e73bd76f9be1ea0b3e
CRs-Fixed: 3343567
Introduce a run time roam configuration for "hand off delay for RX".
This value, in milliseconds, will delay the hand off for the specified
time to receive pending RX frames from the current BSS.
Change-Id: I961109a2f9287a611ae8f4b38e2ea824ecf9c559
CRs-Fixed: 3329952
Host add support to handle action frames with category field
ACTION_CATEGORY_VENDOR_SPECIFIC_PROTECTED(vendor specific
protected action frames).
Change-Id: Iae105fe7c5c37438b29d9b2bc135961f795c5ab8
CRs-Fixed: 3262366
To avoid excessive logging, we whould not logs RTPM lock init and
deinit to the console. Thus, change the log level to debug.
Change-Id: Ib11045fe50f729b0580284fa913da48d3a59b323
CRs-Fixed: 2927959
