Don't fetch TBTT info if data + neighbor_ap_info_field is <=
ie + rnr_ie_len + 2 instead of < ie + rnr_ie_len + 2.
Only less than validation may lead to extra iteration and
wrong rnr data.
CRs-Fixed: 3787446
Change-Id: I9dbaa066dd09f6c9ddfb3e400d95e009313cd54d
Currently, while parsing scan RNR Ie data is moved to
next neighbor_ap_info_field after parsing the current
neighbor_ap_info_field. But in last iteration pointer may
try to access invalid data if (uint8_t *)ie + rnr_ie_len + 2)
bytes are less than sizeof neighbor_ap_info_field and same
is the case with tbtt_length access.
Fix is to add a length check of data + next data size to be parsed
< (uint8_t *)ie + rnr_ie_len + 2) instead of adding a validation
of data length only.
CRs-Fixed: 3710080
Change-Id: I05e5a9a02f0f4f9bc468db894588e676f0a248c0
In malformed beacon frame may deference the NULL pointer while
parsing MBSSID IE in util_scan_parse_mbssid will lead to crash.
Add check in util_scan_parse_mbsssid for split_prof_start before
passing to util_gen_new_ie and assign zero to split_prof_len
whenever split_prof_start freed to avoid unanticipated scenario.
Change-Id: Ibb9739d6b5d1775ab52d59f9aa5050ca693cd926
CRs-Fixed: 3717571
If the scan entries for a non-tx profile MBSSID partner links
are not present at the time of candidate selection, then
host driver generates the scan entry for the missing partner
link from the assoc response.
The assoc response from the AP has PMKID in the RSN(some APs
do not include RSN IE in assoc resp).In this case, the RSN
along with PMKID gets inherited into the scan cache of the
missing partner and this leads to mismatch between M3 and
scan entry RSN causing disconnection.
To fix this, mark all the MBSSID partners without scan entries
as invalid links at the time of candidate shortlisting. Score
and connect to only non-tx candidates with valid scan entries.
Remove the probe response generation from assoc response logic.
Change-Id: I342519490ead2a2e91426439cf47e65c61b53aed
CRs-Fixed: 3766047
If the length of the MBSSID IE is 0, then there is a potential
OOB read in util_scan_parse_mbssid(), when the Max BSSID indicator
field is accessed.
To fix this, do not proceed with MBSSID parsing if the length
of the MBSSID IE is zero.
Change-Id: I2c7a7641b77fed20a910cb77035588a7540caa62
CRs-Fixed: 3717567
If the tag length in next_elem is some invalid high value then the
existing length check can still pass and lead to the OOB access.
Add an OOB check w.r.t total IE length to ensure it has the
minimum number of bytes in the buffer.
Change-Id: I9778a3e0ced05d3246d91e23c2a47f7318634d75
CRs-Fixed: 3717566
2 GHz link CCFS may not filled correctly in vht/he op, wrong CCFS0
is got from util_scan_sec_chan_freq_from_htinfo and passed to kernel,
regulatory check failed, disconnect will happen.
To fix it, add new API util_scan_ccfs0_from_htinfo, and get CCFS0 by it.
Change-Id: I0e8879f13cff37b85cffb6446cc15c60c05465d2
CRs-Fixed: 3739815
Currently, in the driver, the minimum MBSSID IE length value
in the driver is set to 4. Some APs advertize this value as
1. In such situations, driver fails to parse the the ie.
So, to avoid such cases, modify the minimum mbssid ie length
value to 1.
Change-Id: I6ef89706b95318cb9bd38e04cab56b0fdef99fd5
CRs-Fixed: 3684794
Currently, in function "util_get_ml_bv_partner_link_info" driver
access the ML IE memory with offset which is calculated from ML IE
length and increment this offset with other values (such as
perstaprof_stainfo_len). But this can lead to OOB for ML IE when
this offset value is increment beyond ML IE length.
So, to fix this, add check for offset before accessing ML IE.
Change-Id: Ie7312ab3379fce16e5b0f83d07d46f263f774ed8
CRs-Fixed: 3710085
Currently, In the MLO t2lm API, wlan_mlo_parse_bcn_prbresp_t2lm_ie
is missing frame boundary checks which may lead to out-of-bound
reads if the lengths are not checked by the caller.
Fix is, while parsing t2lm ie pass the frame length and add
check for frame boundary.
CRs-Fixed: 3704739
Change-Id: If3068db3489ee1c9a9da4945407598e27e3ca276
While parsing ESP IE from beacon/probe response frame,
the condition in loop to copy ESP_INFO from the ESP IE is
incorrect which will iterate for 5 times rather than 4 times,
this may cause OOB access.
data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3)
Here adding 3 for esp_ie->esp_len, actually esp_len itself is
1 byte extra (esp_ len = ESP_ID_EXTN + ESP_INFO * 4),
but by adding 3 again will loop for one more iteration
this will cause OOB access.
Remove 3 in loop condition to avoid one more extra iteration
and ignore ESP_ID_EXTN element for total elements, in function
util_scan_update_esp_data.
Change-Id: Ia9226e483672369af36c6914e3ac914fe9de45e5
CRs-Fixed: 3710081
Currently, while generating non-TX VAP scan entry from the
TX VAP beacon or probe response MBSSID IE, driver copies
the ML IE from MBSSID and main frame which lead to 2 ML IE
in the TX VAP frame.
Fix is, add proper check to copy the non-TX VAP ML IE from
MBSSID IE.
CRs-Fixed: 3708786
Change-Id: I93f2552fe8a0080ffc871b39b164fadd86df8ff0
Each link in MLO can have different RSN capabilities with
different AKMs, PMF capability, UC/MC cipher suites and so on.
For any choice of links for MLO connection, the AKMs of the
links should have one common AKM.
Eliminate partner links without overlapping AKMs from MLO
connection.
Modify partner link AKM to match assoc link AKM, so that
only overlapping AKM is chosen even though an AKM with
higher security exists for partner link.
Change-Id: I9573e938789a4b95ae824872845d31008861f6f2
CRs-Fixed: 3693814
For non-TxMBSSID ML AP ML probe req may not receive any response
from MBSSID AP and later partner link may fail to connect as
scan entry is not present.
Introduce new flag to suggest whether the partner link scan entry
is present or not in the scan DB. If flag is set to true, generate
scan entry for such links.
Introduce new APIs which will generate ML probe resp using
the per-STA profile of partner link from assoc resp frame.
Introduce API to get the current candidate scan entry from
connect request.
Change-Id: I1c33956b01eb468afa26be5b0bfba634ee3a0aee
CRs-Fixed: 3675830
Wireless environment may have APs with same BSSID but different
MLD address and if any APs BSSID is similar to the current
candidates affiliated partner link BSSID, then receiving beacon
or probe resp from such APs will override the affiliated link's
scan entry and the MLD address may be different or NULL if the
AP is non-ML.
If link VDEV connection starts and during candidate selection
it may find the scan entry of this other AP and attempt to drive
connection will lead to creating ML link VDEV's peer with
different MLD address than assoc VDEV's peer.
Enhance scan filter to match MLD address for link VDEV to avoid
such scan entry override.
Change-Id: I11c9b4efdf2d60e92482b296d731d613a200bf0e
CRs-Fixed: 3668326
Currently if the TBTT length is more than max supported length
driver doesn't the mld information from the RNR IE. This leads
to SLO rather than MLO.
Add the fix to restrict the max length to current supported max
length which helps to parse the ML information further
results in ML association.
CRs-Fixed: 3679296
Change-Id: Id8c58044be162f638ed5e74e0fd04aa0b77780f5
In order to identify certain vendor APs, it generated
AP beacon from MBSSID nonTx profile shall include these
Vendor Specific IEs (VSIEs).
If any matching VSIE of interest is present, copy the
IE to generated frame.
Change-Id: Ic3566ad0123c7353d7ace1b0077d6a3730d10dc8
CRs-Fixed: 3682937
Cancel scan when P2P scan with BSSID and found BSSID.
Send flag to fw by WMI_SCAN_FLAG_EXT_P2P_REDUCE_TIME_SCAN.
Change the scan flag value align with fw change of:
I4760f4515c07f575df523d7e387c07113b277a6b
Change-Id: I6af3c5ae1027af36e0494f1eaceb7cb5aebec494
CRs-Fixed: 3659688
Add null check for RNR node in the scan API
scm_filter_rnr_flag_pno before accessing its parameters.
CRs-Fixed: 3645688
Change-Id: I8c18c75214128496d159425c923db1be1525e298
Scenario: Turn on and off XPAN multiple times and in between
of this, bring all interface down.
When XPAN gets turned on, it will run ACS algorithm either on
new scan results or previous scan results which are having
last_scan_ageout_time less than 30sec to select the best
channel. If multiple times ACS request comes then driver should
select the same previous channel if it's scan time is less than
30sec. But in this case, driver was selecting different channel
when all channels were recently scanned.
This is because, in some scenario, the number of scan entries
was becoming 0 which causes ACS to select new channel even the
previous selected channel were recently scanned.
Reason for becoming number of scan entries as 0 is when all
interface goes down, stop modules will get call which results
to flush out the psoc. As part of psoc flush out, it will remove
all scan entries as well. But driver is not resetting the
last_scan_ageout_time when no scan entries are present. Hence,
it will not for new scan again and later all channels were having
same score after applying ACS logic. This led to select first
from scanned list.
As part of fix, reset the last_scan_ageout_time when no scan
entries are present.
Change-Id: I8e021ecf22047661076e11302998a42c029f8b37
CRs-Fixed: 3625075
Currently, scan on same mac channel is not allow where
LL_LT_SAP is present.
But as part of this change, allow scan on same mac channel
where LL_LT_SAP is present.
Change-Id: I0c781caa70bf5c95c0639218dd08a409ebeefbfc
CRs-Fixed: 3636119
STA info length subfield of STA info field indicates the number of
octets in the STA Info field, including one octet for the STA Info
Length subfield.
In the current implementation, one extra byte is added to STA info
length subfield to access STA profile subfield. Due to this, unable
to extract CSA, ECSA and MCST IEs from the STA profile.
To fix this, don't add WLAN_ML_BV_LINFO_PERSTAPROF_STAINFO_LENGTH_SIZE
to offset field to access the STA profile subelement.
Change-Id: I99fb3c5d1bfb9b3bf414fc0b778d724e98a3c7ae
CRs-Fixed: 3640538
Add a cfg set API to configure scan mode for 6 GHz. This is
invoked in reset HE capability API.
Change-Id: If4891036dec3777d85f3584eef965ed65ececadd
CRs-Fixed: 3629445
In the MLO-MBSSID test, STA can request information of
non-Tx BSS through Tx BSS by configuring non-Tx BSS MLD
ID within the ML probe request that is invoked as part
of scan request. Add support to configure MLD ID in
scan start params to FW.
Change-Id: I4a6debf6c3ec830fbe3aee1d3aa60ad7218cbcd6
CRs-Fixed: 3591596
For user-initiated scan request we need to set scan policy based on
scan type. (eg. Low Power Scan, High Accuracy Scan). Based on type
we set the policy for driver to use. Set the scan policy based on
scan type.
Change-Id: I8cd555eee8d7332a88fc7f2b6093b0a1dc3127b1
CRs-Fixed: 3509137
Currently, below 11BE RNR TBTT field doesn't get processed when
11BE is not defined,
TBTT_NEIGHBOR_AP_BSSID_S_SSID_BSS_PARAM_20MHZ_PSD_MLD_PARAM
So, station is not able to parse the RNR IEs from the 11BE APs.
Parse TBTT_NEIGHBOR_AP_BSSID_S_SSID_BSS_PARAM_20MHZ_PSD_MLD_PARAM
always but extract 11be info only when 11BE define is enabled.
Also, cleanup the duplicate code.
Change-Id: I49e38875f3f0a3ab238636f7a8e0f93c7aa4d04b
CRs-Fixed: 3624227
Currently, default value of last_scan_ageout_time ini is 0 sec.
Modify it to 30 sec to avoid dependency on userspace
configuration.
Change-Id: If0d00c98950a0c20f22ee73d01e4442bd0d677c0
CRs-Fixed: 3625696
Adding memory not allocate debug print when fail to allocate
memory for scan node
Change-Id: I77c9a3deeb9fff9fd265188060ff3aa3aa17b866
CRs-Fixed: 3611905
In the scenario about MLO 5 GHz + 6 GHz and 6 GHz is non-tx AP in
MBSSID, if DUT tries to connect 5 GHz link as assoc link and uses
the scan entry generated from 5 GHz beacon. Then there is no info
about profile index and count in the scan entry and these info is
necessary for firmware when vdev up.
To resolve this issue, get the info from 6 GHz scan entry if it
exists.
CRs-Fixed: 3616899
Change-Id: Ic9bf9bc107c3486be1e87ea2c19c5d388ca41883
Host needs to check new scan is enabled on device before
sending scan request.
Changes are as follows:
-Add new scan bit to scan obj.
-Fetch new scan service bit from FW.
-Update new scan in scan obj based on service bit from FW.
Change-Id: I19d874e859208dcdb2476e0fd2fbd61fcc77e565
CRs-Fixed: 3509136
When generating MBSSID beacon/probe response frames, it
misses the last IE in the MBSSID ie list. To address it,
correcting the comparing length.
CRs-Fixed: 3609711
Change-Id: Ia406be0ade901c9bc01698faec473bd25c59dfb3
Include Extended MLD Capabilities & Operations subfield size
calculation in the calculation of Common Info Length of the
Basic Variant ML-IE parsing
Change-Id: I8fea9058dc37b7605827ef827a3ccba71be00982
CRs-Fixed: 3590364
For multi link connection there might be the case where
rsnxe of the AP is not present on the link vdev.
This causes the link vdev alone to downgrade to 11ax
mode and assoc vdev is in 11be dot11 mode.
So for vdev with ML peer, the dot11mode is 11ax,
which causes abnormal firmware behavior.
Reject the partner link that doesn’t pass the security
check and validate the next available partner link.
if none of the partner link passes the security check,
proceed connection with single link.
Change-Id: I080557027180c0566a1c284a93fcc4b69c61a9c8
CRs-Fixed: 3581189
In some scenario, mbssid_info->prof_residue could be set to
true, hence mbssid_info->split_prof_continue will also be
set to true. Then for the next loop if buffer split_prof_start
is freed but split_prof_end does not reinitialize to NULL,
then use-after-free happens.
To address this issue, reinitialize split_prof_end properly
when split_prof_start is freed.
Change-Id: Iad7448868cfa4c2dd7922f6c1b2622cf20a6a28c
CRs-Fixed: 3583521
Currently PM_LL_LT_SAP_MODE is not handled in policy manager.
With this change add support for PM_LL_LT_SAP_MODE in the policy
manager.
Change-Id: I7b893b04498957eb4a7e9f74c4b4395d4a823bf9
CRs-Fixed: 3536612
APs can broadcast support for 20 & 40 MHz in the
HT cap IE and operate in 20 MHz also.
Therefore, use the extension channel offset field
of the HT info IE to identify the bandwidth of the
BSS.
Change-Id: I9987d45ec34ba3327b43ef70eb891d346e9e78c9
CRs-Fixed: 3587792
If bssid and short ssid is present in the rnr list,
do not add duplicated entry.
Change-Id: Ic2f3b2396cd087601cf72aad8b4fdf81188d064e
CRs-Fixed: 3554848
Currently in driver while using QDF_MAC_ADDR_FMT to print mac
address, the mac address reference provided to QDF_MAC_ADDR_REF is
incorrect in some cases. Fix all such instances.
Change-Id: I324581691dfe683e0d5b046e19b444928657ce05
CRs-Fixed: 3556423
Remove the interfering 6 GHz inaddition to the 5 GHz
channels from the scan list, if the DFS SAP is present.
Change-Id: Ia7dd5b87fe762d8ba326f9b7ac508731563312ba
CRs-Fixed: 3555971
For 11A only AP, HT and DS IE are not present in beacon,
STA may receive the beacon on adjacent channel, then
driver may record wrong channel frequency in scan entry.
Fix by update the channel frequency by old scan entry
channel frequency if new beacon RSSI lower than old beacon
RSSI and gap is bigger than 40 db within 5s.
Change-Id: Idbd144befa78597fcd50a753ca13b0f11d1f45f5
CRs-Fixed: 3484664
In api wlan_scan_start(), redundant check for
scan_start_req is observed in some static analysis
tool.
Remove the redundant check in the ap
wlan_scan_start() as the check is present in the
api scm_scan_free_scan_request_mem
Change-Id: Ic320bb95253668310c5d738216daba62ba2f4b3f
CRs-Fixed: 3528505
