In util_scan_find_noninheritance_ie API,
ies[ELEM_ID_EXTN_POS] may lead to OOB access if
len==MIN_IE_LEN.
util_parse_noninheritance_list may lead to OOB
read access extn_elem[ELEM_ID_LIST_LEN_POS]
Fix is to add length checks and add sub_copy and length
subie_len checks before accessing extn_elem to avoid any
OOB read.
Change-Id: I7758c6e4d8d568a5050011603b48a23e0b11da94
CRs-Fixed: 3717569
Currently the user configured MFP state that comes from the
userspace in connect request is not handled or processed.
Instead the RSN caps from assoc IE of connect request is inter-
sected with AP RSN caps and sent to Firmware using RSO command.
This RSN caps is used in FW in selecting a roam candidate, which
was causing the cross AKM (eg:SAE -> PSK) roam fail.
Hence, use the user configured MFP value in sending the RSN caps
to Firmware.
Change-Id: I3facfcf3616667b4749109d26d924c3fb1537494
CRs-Fixed: 3606069
Added support for handling the crypto params from NL connect
request that has all the supported AKMs, unicast and multicast
ciphers to store them in the crypto and retrieve them later to
update the scan filter params.
Change-Id: I040c908c85d530ea4c86ec3e5b71044ffcf4b7d9
CRs-Fixed: 3767477
Add support to update key management with higher security
after BSS create response.
Also, Currenlty if there are multiple AKM and ucast cipher.
Host overwrites AKM and ucast cipher value with the new one.
Instead of overwrite, add support to do ORing to keep all values.
Change-Id: I679a86debef649efbce1a08b60512d127f7fbbee
CRs-Fixed: 3782223
In malformed beacon frame may deference the NULL pointer while
parsing MBSSID IE in util_scan_parse_mbssid will lead to crash.
Add check in util_scan_parse_mbsssid for split_prof_start before
passing to util_gen_new_ie and assign zero to split_prof_len
whenever split_prof_start freed to avoid unanticipated scenario.
Change-Id: Ibb9739d6b5d1775ab52d59f9aa5050ca693cd926
CRs-Fixed: 3717571
In some scenario, mbssid_info->prof_residue could be set to
true, hence mbssid_info->split_prof_continue will also be
set to true. Then for the next loop if buffer split_prof_start
is freed but split_prof_end does not reinitialize to NULL,
then use-after-free happens.
To address this issue, reinitialize split_prof_end properly
when split_prof_start is freed.
Change-Id: Iad7448868cfa4c2dd7922f6c1b2622cf20a6a28c
CRs-Fixed: 3583521
For corrupt beacon frame, the memory allocated for
split_prof_start is getting allocated for split
profile case. But since there are no other nonTx
profile or new MBSSID element present afterwards,
Hence, added mem free to handle this scenario.
Change-Id: I6b93ae0be97d72264071d1ce99345f8c0c23f81d
CRs-Fixed: 3156909
If the tag length in next_elem is some invalid high value then the
existing length check can still pass and lead to the OOB access.
Add an OOB check w.r.t total IE length to ensure it has the
minimum number of bytes in the buffer.
Change-Id: I9778a3e0ced05d3246d91e23c2a47f7318634d75
CRs-Fixed: 3717566
If the length of the MBSSID IE is 0, then there is a potential
OOB read in util_scan_parse_mbssid(), when the Max BSSID indicator
field is accessed.
To fix this, do not proceed with MBSSID parsing if the length
of the MBSSID IE is zero.
Change-Id: I2c7a7641b77fed20a910cb77035588a7540caa62
CRs-Fixed: 3717567
While parsing ESP IE from beacon/probe response frame,
the condition in loop to copy ESP_INFO from the ESP IE is
incorrect which will iterate for 5 times rather than 4 times,
this may cause OOB access.
data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3)
Here adding 3 for esp_ie->esp_len, actually esp_len itself is
1 byte extra (esp_ len = ESP_ID_EXTN + ESP_INFO * 4),
but by adding 3 again will loop for one more iteration
this will cause OOB access.
Remove 3 in loop condition to avoid one more extra iteration
and ignore ESP_ID_EXTN element for total elements, in function
util_scan_update_esp_data.
Change-Id: Ia9226e483672369af36c6914e3ac914fe9de45e5
CRs-Fixed: 3710081
This change is to update no. of dwords for htt_tx_msdu_desc_ext2_t
as new dwords have to be added by FW to pass
rx buffer address info to support opt_dp_ctrl.
Change-Id: I3edb0a32a1e340d715c00776254ab50aca93c4e0
CRs-Fixed: 3717471
Currently, in the driver, the minimum MBSSID IE length value
in the driver is set to 4. Some APs advertize this value as
1. In such situations, driver fails to parse the the ie.
So, to avoid such cases, modify the minimum mbssid ie length
value to 1.
Change-Id: I6ef89706b95318cb9bd38e04cab56b0fdef99fd5
CRs-Fixed: 3684794
Currently host doesn't check if power type is supported
for connection channel while calculating best 6 GHz
power type for connection. This results in calculation
of incorrect power for connection values if 6 GHz power
type is not supported for that particular channel.
To address this issue configure power type for connection
only if that power type is supported for connection
channel.
Change-Id: I0570dbf7c8dc41b3f0a92480b8d8f57d89ea65f6
CRs-Fixed: 3697209
Add an API reg_translate_6g_chan_enum to translate an index between
MIN_6GHZ_CHANNEL and MAX_6GHZ_CHANNEL, to an index between 0 and
NUM_6GHZ_CHANNELS.
Change-Id: I5eaacf36403252a56293b8fadc797ac2aacd751d
CRs-Fixed: 3099080
Find the best 6 GHz power type for connection
according to following regulatory policy:
1) SP power type is selected only if AP advertises
SP and client supports SP.
2) LPI power type is selected only if AP advertises
LPI and client supports LPI.
3) VLP power type is selected for the below cases,
a) AP advertises VLP and client supports VLP
b) AP advertises SP but client doesn't support
SP but supports VLP.
c) AP advertises LPI but client doesn't support
LPI but supports VLP.
Change-Id: I6e3b9fc4bf7445c58681ef0ea8e45b434851a5b6
CRs-Fixed: 3456182
Define an attribute for high RSSI roam trigger threshold. STA is
expected to trigger roam if the current connected AP's RSSI gets above
this high RSSI threshold. STA's roam attempt on high RSSI threshold aims
to find candidates from other better Wi-Fi bands.
Change-Id: Ie0323ff990e2679fd9768d2242730f7369cdb64f
CRs-Fixed: 3586127
Currently host uses LPI as default power type when STA and
AP country is same without checking if powertype advertised
by AP is valid for client or not.
To address this issue default to power type advertised by AP.
Change-Id: I59144b020bed5af49dea8fdaad0e59daa556fefe
CRs-Fixed: 3381295
If country code for AP and STA are same and if STA does not
support VLP mode for a particular channel and if AP power
type is misconfigured to VLP mode, do not allow connection
to that AP as per regulatory guidelines.
Change-Id: Ie3bb980df25a15c4d9d7e566663e28950414f733
CRs-Fixed: 3362142
It is mandatory request to check security mode in 6 GHz band,
so enable check_6ghz_security by default. Keep default disable
for WIN as requested.
Change-Id: Idcc4cb9add98ad4bda8e4357e83460ca25221692
CRs-Fixed: 3006930
Currently SET_DISABLE_CHANNEL_LIST command is used to disable
legacy channels only.
Update this command to accept frequency for all the bands along with
the channel numbers from legacy (2.4 GHz/5 GHz) and update the
channel state in secondary channel list also.
Change-Id: Iecc9f73dca65900d82a2f2a044cb854cea58c638
CRs-Fixed: 3601253
Cleanup reg_cache_channel_state and the
related code with it.
Also, changed the logic so as to compare
channel freq instead of channel number in
reg_modify_chan_list_for_cached_channels()
Change-Id: I424b6886ed18f73bae0d2b36e36a9ddc1819688b
CRs-Fixed: 2908016
Currently driver does not consider gindoor_channel_support ini
when it decides the ap power type and because of that it always
decides ap power type as VLP. Driver should consider this ini
value as well because this INI says that indoor channels are
allowed so driver should set ap power mode as LPI to allow
LPI power mode.
Change-ID: Id7ad546ba23ce210497002e3083a22f1edc87185
CRs-Fixed: 3085997
Add a new counter inccorect_rdi to fisa stats to log incorrect reo
destination indications in fisa processing.
Change-Id: I785ad90ae1d36b2f6b9b1888373a29fcbd65348e
CRs-Fixed: 3426537
Due to limitation uCode always filling SGI as long for VHT mode in
rx_msdu_start_tlv.
This change is to extract VHT Rx data packet SGI from
WMI_VDEV_SMART_MONITOR_EVENTID.
Change-Id: I5fcdc463ea2a6d83253e39cc377a2471aeb4e122
CRs-Fixed: 3477303
Currently HP update can skip for few packets if the system suspend
is happening in parallel with tx. This could lead to SMMU fault if
the skipped HP update goes after tx desc force free.
Remove the tx pause check in HP updates and have the check before
calling dp_tx_send in case of intra-bss forward case. No special
handling is needed for non intra-bss case as we don't expect packets
from network stack after suspend.
Change-Id: Id4f2cefcc0a14e7c16438b9bda5cb1d55eb05050
CRs-Fixed: 3327818
In SAP due to intrabss forwarding, Tx ring update is going through
when WOW enable command has been sent to FW. This results in crash.
To fix this, do not update HP when apps suspend is in progress.
Change-Id: Id4176224563bdd759828397fa1cd23de1598192e
CRs-Fixed: 3294407
When do SAE-5.7.3 certification test case, STA will choose non SAE-PK
AP to connect which is wrong expected result, non SAE-PK AP beacon
will carry with QBSS IE that contributes more score than SAE-PK AP
score config.
Fix is to give SAE-PK AP more score to pass SAE-5.7.3 certification
case.
Change-Id: Ib3e516ccfa673e19f9bf0869aeffe4f5b1862a71
CRs-Fixed: 3101317
Currently low TPC power is configured to firmware if power constraint IE
is not present and only vendor DTPC IE is present. TPC power calculation
is depends on regulatory power, ap power constraint and TPE IE.
To fix this add new check is_power_constraint_abs in reg_tpc_obj.
Whenever local power constraint is from DTPC IE, is_power_constraint_abs
is set to true. And TPC power is calculated with regulatory power,
DTPC IE power and TPE IE power.
Change-Id: If6f1ea737c8b32db449dd340314026fd3693b698
CRs-Fixed: 3387238
From firmware perspective, host only sets 5 GHz regdomain hence 2 GHz
uses default setting and firmware does not update channel list event
for all phys according to the new country code.
Therefore sets pdev_id to 0xFF in function reg_set_country and it is
mapping to WMI_PDEV_ID_SOC when issue wmi command
WMI_SET_CURRENT_COUNTRY_CMDID as firmware required.
Change-Id: I0eb84db9f6d77c0473161cc4ffc0dcebd31c3d45
CRs-Fixed: 3239644
Currently, Fw did not set NACK reason code
to Host when Fw is not ready for WoW.
As part of the new change, Fw will send NACK
reason code along with WoW NACK to host.
Make changes in host to parse NACK reason
code from the received message.
Change-Id: I17ee99cb302ff546731a46d3ce03977c3c3d5a67
CRs-Fixed: 3481189
Currently host drops an AP from scan list if host country is set to
US and AP country is non-US. This implementation violates our
standard regulatory scan policy.
To address this issue, introduce a new INI to differentiate
between our standard regulatory policy with others.
Change-Id: Id72f871653e31969c4d1b147cb3c557f90a6c8f6
CRs-Fixed: 3361720
For example, If tmp_new[1] = 3, subie_len=160,
tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy will be 159.
In this scenario, while condition gets true (159 <= 160)
In if condition (159 >= 160), we are not breaking the loop in if.
tmp_new will get incremented, tmp_new will point at 159,
tmp_new[1] will point at 160, tmp_new[2] point at 161.
So, we are accessing one byte out-of-bound value.
To fix accessing out-of-bound value subtract one from the subie_len
in while and if condition to avoid this scenario.
Change-Id: I624585323963b6d79acf9ff0f96ec17e0b415c2d
CRs-Fixed: 3358833
When handling WMI_ROAM_SCAN_STATS_EVENTID,
the number of channels scanned for each roam trigger is fetched from
wmi_roam_scan_info TLV (wmi_roam_scan_info->roam_scan_channel_count),
The total number of channels for all the roam triggers is fetched from
param_buf->num_roam_scan_chan_info.
chan_idx is the index used to fetch the current channel info TLV to be
read. So if wmi_roam_scan_info->roam_scan_channel_count provided by
firmware exceeds the total param_buf->num_roam_scan_chan_info starting
from given chan_idx then OOB access of event buffer can happen.
To avoid this, validate the sum of the current chan_idx and
src_data->roam_scan_channel_count against
evt_buf->num_roam_scan_chan_info.
Change-Id: Ied94464d1f12690cf8832962b94595c2e00c33f8
CRs-Fixed: 3357714
Currently, BSS beamformee score is calculated from vht_cap or
eht caps, so for 6 GHz HE capable BSS it will calculated to zero.
Due to this 5 GHz will always get selected compared to 6 GHz BSS with
all other capabilities and conditions same in both BSS as 5 GHz
will have more total candidate score.
Fix this issue by correct calculation of AP beamformer capability
in case of 6 GHz HE BSS.
Change-Id: I0f3285ce1c5c1aeeba624c5371ff0f884ae78c58
CRs-Fixed: 3351991
Fetch fw capability to support p2p+p2p concurrency and
store cap info in 29th bit of soc_fw_ext_caps.
Change-Id: Id8e4c0310f8db503a2997e8aed5a6f1ce813dcc7
CRs-Fixed: 3032068
Add P2P_P2P_CONCURRENCY_SUPPORT service capablity to
validate whether fw can support p2p concurrency
support or not. when firmware advertises this flag it
can support MCC,SCC, DBS for p2p-GO/GC + p2p-GO/GC.
Change-Id: Ifec4bf984595b06374be9024601733c8537a9c3e
CRs-Fixed: 2984165
Currently host driver defines 11d offload APIs under
HOST_11D_SCAN feature flag which is not correct.
Add 11d offload APIs under TARGET_11D_SCAN feature flag.
Change-Id: I0d3205b215c9fc363a71c4e7a6b54e40fb10a964
CRs-Fixed: 3387603
Add QCA_WLAN_VENDOR_ATTR_CONFIG_WFC_STATE vendor attribute,
Userspace uses this attribute to configure wfc state to
Driver/Firmware. The Driver/Firmware uses this information to
optimize power savings, rate adaption, roaming, etc.
Change-Id: If58bd1e64216de81af6cf82eaabd740b85729eac
CRs-Fixed: 3343034
Realloc memory for wmi_service_ext_bitmap when
WMI_SERVICE_AVAILABLE_EVENTID event come, and
the num of wmi_service_ext_bitmap large then
previous num.
Change-Id: I2800fe3274e5516369486ef065ce03ba121bd5b3
CRs-Fixed: 3346739
Remove logic to enable/disable wake msi for drv systems. Today, during
WoW suspend sequence, between hif pci bus suspend and hif pci bus
suspend no irq, wake msi is getting disable temporarily. In case
fw toggles wake msi during this period, then the wake msi is lost,
which can lead to device not waking up for fw triggered wakeup.
Add the fix to remove enable/disable wake msi from suspend/resume
path and keep wake msi always enabled.
Change-Id: Idad0805f66ead4079d67577fa1151f73567511a3
CRs-Fixed: 3042261
Send the driver disconnect internal reason code as an event to user space
using QCA_NL80211_VENDOR_SUBCMD_DRIVER_DISCONNECT_REASON vendor command.
Change-Id: I0027675b809b94628b6c0c4b8e8286e38fa9f47d
CRs-Fixed: 3371398
