qcacld-3.0: Append MBO IE from supplicant to Assoc Request Frame

The MBO IE sent from the supplicant supports multiple TLVs of the
same attribute type to be present. For example, for MBO case 5.2.8,
the supplicant sends 2 non-Preferred channel TLVs in the MBO IE.
However, when the driver unpacks the MBO IE for the Assoc Request
frame using frame parser, it supports only one unique TLV of each
attribute type in the MBO IE. So the second non-Preferred channel
TLV overwrrites the first TLV and the driver sends out Assoc Request
frame with only one non-Preferred Channel TLV in the MBO IE causing
the test case to fail.

Strip the MBO IE in the Additional IEs from supplicant and append
it to the end of the Assoc request frame without parsing it.

Change-Id: I35ede59983ef63268e4648bb38217ebec2454382
CRs-Fixed: 2310297

core/mac/inc/sir_mac_prot_def.h

@@ -473,6 +473,10 @@
 #define SIR_MAC_QCN_OUI_TYPE   "\x8c\xfd\xf0\x01"
 #define SIR_MAC_QCN_OUI_TYPE_SIZE  4
 
+/* MBO OUI definitions */
+#define SIR_MAC_MBO_OUI "\x50\x6f\x9a\x16"
+#define SIR_MAC_MBO_OUI_SIZE 4
+
 /* min size of wme oui header: oui(3) + type + subtype + version */
 #define SIR_MAC_OUI_WME_HDR_MIN       6
 

core/mac/src/cfg/cfgUtil/dot11f.frms

@@ -3668,7 +3668,6 @@ FRAME AssocRequest                        // 7.2.3.4
     OPTIE  hs20vendor_ie;
     OPTIE  QCN_IE;
     OPTIE  he_cap;
-    OPTIE  MBO_IE;
     OPTIE  osen_ie;
 } // End frame AssocRequest.
 

core/mac/src/include/dot11f.h

@@ -26,7 +26,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Mon Aug 27 19:08:28 2018 from the following file(s):
+ * Tue Sep 18 11:47:29 2018 from the following file(s):
  *
  * dot11f.frms
  *
@@ -9438,7 +9438,6 @@ typedef struct sDot11fAssocRequest{
 	tDot11fIEhs20vendor_ie                hs20vendor_ie;
 	tDot11fIEQCN_IE                       QCN_IE;
 	tDot11fIEhe_cap                       he_cap;
-	tDot11fIEMBO_IE                       MBO_IE;
 	tDot11fIEosen_ie                      osen_ie;
 } tDot11fAssocRequest;
 

core/mac/src/pe/lim/lim_send_management_frames.c

@@ -1663,6 +1663,8 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 	uint32_t bcn_ie_len = 0;
 	uint32_t aes_block_size_len = 0;
 	enum rateid min_rid = RATEID_DEFAULT;
+	uint8_t *mbo_ie = NULL;
+	uint8_t mbo_ie_len = 0;
 
 	if (NULL == pe_session) {
 		pe_err("pe_session is NULL");
@@ -1970,6 +1972,37 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 		aes_block_size_len = AES_BLOCK_SIZE;
 	}
 
+	/*
+	 * MBO IE needs to be appendded at the end of the assoc request
+	 * frame and is not parsed and unpacked by the frame parser
+	 * as the supplicant can send multiple TLVs with same Attribute
+	 * in the MBO IE and the frame parser does not support multiple
+	 * TLVs with same attribute in a single IE.
+	 * Strip off the MBO IE from add_ie and append it at the end.
+	 */
+	if (wlan_get_vendor_ie_ptr_from_oui(SIR_MAC_MBO_OUI,
+	    SIR_MAC_MBO_OUI_SIZE, add_ie, add_ie_len)) {
+		mbo_ie = qdf_mem_malloc(DOT11F_IE_MBO_IE_MAX_LEN + 2);
+		if (!mbo_ie) {
+			pe_err("Failed to allocate mbo_ie");
+			goto end;
+		}
+
+		qdf_status = lim_strip_ie(mac_ctx, add_ie, &add_ie_len,
+					  SIR_MAC_EID_VENDOR, ONE_BYTE,
+					  SIR_MAC_MBO_OUI,
+					  SIR_MAC_MBO_OUI_SIZE,
+					  mbo_ie, DOT11F_IE_MBO_IE_MAX_LEN);
+		if (QDF_IS_STATUS_ERROR(qdf_status)) {
+			pe_err("Failed to strip MBO IE");
+			goto free_mbo_ie;
+		}
+
+		/* Include the EID and length fields */
+		mbo_ie_len = mbo_ie[1] + 2;
+		pe_debug("Stripped MBO IE of length %d", mbo_ie_len);
+	}
+
 	/*
 	 * Do unpack to populate the add_ie buffer to frm structure
 	 * before packing the frm structure. In this way, the IE ordering
@@ -1996,7 +2029,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 	}
 
 	bytes = payload + sizeof(tSirMacMgmtHdr) +
-			aes_block_size_len;
+			aes_block_size_len + mbo_ie_len;
 
 	qdf_status = cds_packet_alloc((uint16_t) bytes, (void **)&frame,
 				(void **)&packet);
@@ -2036,6 +2069,11 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 		pe_warn("Assoc request pack warning (0x%08x)", status);
 	}
 
+	/* Copy the MBO IE to the end of the frame */
+	qdf_mem_copy(frame + sizeof(tSirMacMgmtHdr) + payload,
+		     mbo_ie, mbo_ie_len);
+	payload = payload + mbo_ie_len;
+
 	if (pe_session->assocReq != NULL) {
 		qdf_mem_free(pe_session->assocReq);
 		pe_session->assocReq = NULL;
@@ -2102,6 +2140,10 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 				pe_session, SENT_FAIL, QDF_STATUS_E_FAILURE);
 		/* Pkt will be freed up by the callback */
 	}
+free_mbo_ie:
+	if (mbo_ie)
+		qdf_mem_free(mbo_ie);
+
 end:
 	/* Free up buffer allocated for mlm_assoc_req */
 	qdf_mem_free(mlm_assoc_req);

core/mac/src/sys/legacy/src/utils/src/dot11f.c

@@ -24,7 +24,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Mon Aug 27 19:08:28 2018 from the following file(s):
+ * Tue Sep 18 11:47:29 2018 from the following file(s):
  *
  * dot11f.frms
  *
@@ -9632,9 +9632,6 @@ static const tIEDefn IES_AssocRequest[] = {
 	{ offsetof(tDot11fAssocRequest, he_cap), offsetof(tDot11fIEhe_cap,
 	present), 0, "he_cap", 0, 23, 56, SigIehe_cap, {0, 0, 0, 0, 0},
 	0, DOT11F_EID_HE_CAP, 35, 0, },
-	{ offsetof(tDot11fAssocRequest, MBO_IE), offsetof(tDot11fIEMBO_IE,
-	present), 0, "MBO_IE", 0, 6, 295, SigIeMBO_IE, {80, 111, 154, 22, 0},
-	4, DOT11F_EID_MBO_IE, 0, 0, },
 	{ offsetof(tDot11fAssocRequest, osen_ie), offsetof(tDot11fIEosen_ie,
 	present), 0, "osen_ie", 0, 6, 261, SigIeosen_ie, {80, 111, 154, 18, 0},
 	4, DOT11F_EID_OSEN_IE, 0, 0, },