1 // SPDX-License-Identifier: GPL-2.0 2 /****************************************************************************** 3 * 4 * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. 5 * 6 ******************************************************************************/ 7 8 #include <drv_types.h> 9 #include <linux/hex.h> 10 #include <linux/of.h> 11 #include <linux/unaligned.h> 12 13 u8 RTW_WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 }; 14 u16 RTW_WPA_VERSION = 1; 15 u8 WPA_AUTH_KEY_MGMT_NONE[] = { 0x00, 0x50, 0xf2, 0 }; 16 u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x50, 0xf2, 1 }; 17 u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x50, 0xf2, 2 }; 18 u8 WPA_CIPHER_SUITE_NONE[] = { 0x00, 0x50, 0xf2, 0 }; 19 u8 WPA_CIPHER_SUITE_WEP40[] = { 0x00, 0x50, 0xf2, 1 }; 20 u8 WPA_CIPHER_SUITE_TKIP[] = { 0x00, 0x50, 0xf2, 2 }; 21 u8 WPA_CIPHER_SUITE_WRAP[] = { 0x00, 0x50, 0xf2, 3 }; 22 u8 WPA_CIPHER_SUITE_CCMP[] = { 0x00, 0x50, 0xf2, 4 }; 23 u8 WPA_CIPHER_SUITE_WEP104[] = { 0x00, 0x50, 0xf2, 5 }; 24 25 u16 RSN_VERSION_BSD = 1; 26 u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x0f, 0xac, 1 }; 27 u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x0f, 0xac, 2 }; 28 u8 RSN_CIPHER_SUITE_NONE[] = { 0x00, 0x0f, 0xac, 0 }; 29 u8 RSN_CIPHER_SUITE_WEP40[] = { 0x00, 0x0f, 0xac, 1 }; 30 u8 RSN_CIPHER_SUITE_TKIP[] = { 0x00, 0x0f, 0xac, 2 }; 31 u8 RSN_CIPHER_SUITE_WRAP[] = { 0x00, 0x0f, 0xac, 3 }; 32 u8 RSN_CIPHER_SUITE_CCMP[] = { 0x00, 0x0f, 0xac, 4 }; 33 u8 RSN_CIPHER_SUITE_WEP104[] = { 0x00, 0x0f, 0xac, 5 }; 34 /* */ 35 /* for adhoc-master to generate ie and provide supported-rate to fw */ 36 /* */ 37 38 static u8 WIFI_CCKRATES[] = { 39 (IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK), 40 (IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK), 41 (IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK), 42 (IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK) 43 }; 44 45 static u8 WIFI_OFDMRATES[] = { 46 (IEEE80211_OFDM_RATE_6MB), 47 (IEEE80211_OFDM_RATE_9MB), 48 (IEEE80211_OFDM_RATE_12MB), 49 (IEEE80211_OFDM_RATE_18MB), 50 (IEEE80211_OFDM_RATE_24MB), 51 IEEE80211_OFDM_RATE_36MB, 52 IEEE80211_OFDM_RATE_48MB, 53 IEEE80211_OFDM_RATE_54MB 54 }; 55 56 int rtw_get_bit_value_from_ieee_value(u8 val) 57 { 58 static const unsigned char dot11_rate_table[] = { 59 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108, 0 60 }; /* last element must be zero!! */ 61 int i = 0; 62 63 while (dot11_rate_table[i] != 0) { 64 if (dot11_rate_table[i] == val) 65 return BIT(i); 66 i++; 67 } 68 return 0; 69 } 70 71 bool rtw_is_cckrates_included(u8 *rate) 72 { 73 while (*rate) { 74 u8 r = *rate & 0x7f; 75 76 if (r == 2 || r == 4 || r == 11 || r == 22) 77 return true; 78 rate++; 79 } 80 81 return false; 82 } 83 84 bool rtw_is_cckratesonly_included(u8 *rate) 85 { 86 while (*rate) { 87 u8 r = *rate & 0x7f; 88 89 if (r != 2 && r != 4 && r != 11 && r != 22) 90 return false; 91 rate++; 92 } 93 94 return true; 95 } 96 97 int rtw_check_network_type(unsigned char *rate, int channel) 98 { 99 if (channel > 14) 100 return WIRELESS_INVALID; 101 /* could be pure B, pure G, or B/G */ 102 if (rtw_is_cckratesonly_included(rate)) 103 return WIRELESS_11B; 104 if (rtw_is_cckrates_included(rate)) 105 return WIRELESS_11BG; 106 return WIRELESS_11G; 107 } 108 109 u8 *rtw_set_fixed_ie(unsigned char *pbuf, unsigned int len, unsigned char *source, 110 unsigned int *frlen) 111 { 112 memcpy(pbuf, source, len); 113 *frlen = *frlen + len; 114 return pbuf + len; 115 } 116 117 /* rtw_set_ie will update frame length */ 118 u8 *rtw_set_ie(u8 *pbuf, 119 signed int index, 120 uint len, 121 u8 *source, 122 uint *frlen) /* frame length */ 123 { 124 *pbuf = (u8)index; 125 126 *(pbuf + 1) = (u8)len; 127 128 if (len > 0) 129 memcpy(pbuf + 2, source, len); 130 131 *frlen = *frlen + (len + 2); 132 133 return pbuf + len + 2; 134 } 135 136 /* index: the information element id index, limit is the limit for search */ 137 u8 *rtw_get_ie(u8 *pbuf, signed int index, signed int *len, signed int limit) 138 { 139 signed int tmp, i; 140 u8 *p; 141 142 if (limit < 2) 143 return NULL; 144 145 p = pbuf; 146 i = 0; 147 *len = 0; 148 while (i + 2 <= limit) { 149 tmp = *(p + 1); 150 if (i + 2 + tmp > limit) 151 break; 152 153 if (*p == index) { 154 *len = tmp; 155 return p; 156 } 157 158 p += (tmp + 2); 159 i += (tmp + 2); 160 } 161 return NULL; 162 } 163 164 /** 165 * rtw_get_ie_ex - Search specific IE from a series of IEs 166 * @in_ie: Address of IEs to search 167 * @in_len: Length limit from in_ie 168 * @eid: Element ID to match 169 * @oui: OUI to match 170 * @oui_len: OUI length 171 * @ie: If not NULL and the specific IE is found, the IE will be copied to the buf starting from the specific IE 172 * @ielen: If not NULL and the specific IE is found, will set to the length of the entire IE 173 * 174 * Returns: The address of the specific IE found, or NULL 175 */ 176 u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, uint *ielen) 177 { 178 uint cnt; 179 u8 *target_ie = NULL; 180 181 if (ielen) 182 *ielen = 0; 183 184 if (!in_ie || in_len <= 0) 185 return target_ie; 186 187 cnt = 0; 188 189 while (cnt + 2 <= in_len) { 190 u8 ie_len = in_ie[cnt + 1]; 191 192 if (cnt + 2 + ie_len > in_len) 193 break; 194 195 if (eid == in_ie[cnt] && 196 (!oui || (ie_len >= oui_len && !memcmp(&in_ie[cnt + 2], oui, oui_len)))) { 197 target_ie = &in_ie[cnt]; 198 199 if (ie) 200 memcpy(ie, &in_ie[cnt], ie_len + 2); 201 202 if (ielen) 203 *ielen = ie_len + 2; 204 205 break; 206 } 207 cnt += ie_len + 2; /* goto next */ 208 } 209 210 return target_ie; 211 } 212 213 /** 214 * rtw_ies_remove_ie - Find matching IEs and remove 215 * @ies: Address of IEs to search 216 * @ies_len: Pointer of length of ies, will update to new length 217 * @offset: The offset to start search 218 * @eid: Element ID to match 219 * @oui: OUI to match 220 * @oui_len: OUI length 221 * 222 * Returns: _SUCCESS: ies is updated, _FAIL: not updated 223 */ 224 int rtw_ies_remove_ie(u8 *ies, uint *ies_len, uint offset, u8 eid, u8 *oui, u8 oui_len) 225 { 226 int ret = _FAIL; 227 u8 *target_ie; 228 u32 target_ielen; 229 u8 *start; 230 uint search_len; 231 232 if (!ies || !ies_len || *ies_len <= offset) 233 goto exit; 234 235 start = ies + offset; 236 search_len = *ies_len - offset; 237 238 while (1) { 239 target_ie = rtw_get_ie_ex(start, search_len, eid, oui, oui_len, NULL, &target_ielen); 240 if (target_ie && target_ielen) { 241 u8 *remain_ies = target_ie + target_ielen; 242 uint remain_len = search_len - (remain_ies - start); 243 244 memcpy(target_ie, remain_ies, remain_len); 245 *ies_len = *ies_len - target_ielen; 246 ret = _SUCCESS; 247 248 start = target_ie; 249 search_len = remain_len; 250 } else { 251 break; 252 } 253 } 254 exit: 255 return ret; 256 } 257 258 void rtw_set_supported_rate(u8 *supported_rates, uint mode) 259 { 260 memset(supported_rates, 0, NDIS_802_11_LENGTH_RATES_EX); 261 262 switch (mode) { 263 case WIRELESS_11B: 264 memcpy(supported_rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN); 265 break; 266 267 case WIRELESS_11G: 268 memcpy(supported_rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN); 269 break; 270 271 case WIRELESS_11BG: 272 case WIRELESS_11G_24N: 273 case WIRELESS_11_24N: 274 case WIRELESS_11BG_24N: 275 memcpy(supported_rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN); 276 memcpy(supported_rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN); 277 break; 278 } 279 } 280 281 uint rtw_get_rateset_len(u8 *rateset) 282 { 283 uint i; 284 285 for (i = 0; i < 13; i++) 286 if (rateset[i] == 0) 287 break; 288 return i; 289 } 290 291 int rtw_generate_ie(struct registry_priv *pregistrypriv) 292 { 293 u8 wireless_mode; 294 int sz = 0, rate_len; 295 struct wlan_bssid_ex *pdev_network = &pregistrypriv->dev_network; 296 u8 *ie = pdev_network->ies; 297 298 /* timestamp will be inserted by hardware */ 299 sz += 8; 300 ie += sz; 301 302 /* beacon interval : 2bytes */ 303 *(__le16 *)ie = cpu_to_le16((u16)pdev_network->configuration.beacon_period);/* BCN_INTERVAL; */ 304 sz += 2; 305 ie += 2; 306 307 /* capability info */ 308 *(u16 *)ie = 0; 309 310 *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_IBSS); 311 312 if (pregistrypriv->preamble == PREAMBLE_SHORT) 313 *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE); 314 315 if (pdev_network->privacy) 316 *(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY); 317 318 sz += 2; 319 ie += 2; 320 321 /* SSID */ 322 ie = rtw_set_ie(ie, WLAN_EID_SSID, pdev_network->ssid.ssid_length, pdev_network->ssid.ssid, &sz); 323 324 /* supported rates */ 325 wireless_mode = pregistrypriv->wireless_mode; 326 327 rtw_set_supported_rate(pdev_network->supported_rates, wireless_mode); 328 329 rate_len = rtw_get_rateset_len(pdev_network->supported_rates); 330 331 if (rate_len > 8) { 332 ie = rtw_set_ie(ie, WLAN_EID_SUPP_RATES, 8, pdev_network->supported_rates, &sz); 333 /* ie = rtw_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (pdev_network->supported_rates + 8), &sz); */ 334 } else { 335 ie = rtw_set_ie(ie, WLAN_EID_SUPP_RATES, rate_len, pdev_network->supported_rates, &sz); 336 } 337 338 /* DS parameter set */ 339 ie = rtw_set_ie(ie, WLAN_EID_DS_PARAMS, 1, (u8 *)&(pdev_network->configuration.ds_config), &sz); 340 341 /* IBSS Parameter Set */ 342 343 ie = rtw_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2, (u8 *)&(pdev_network->configuration.atim_window), &sz); 344 345 if (rate_len > 8) 346 ie = rtw_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (pdev_network->supported_rates + 8), &sz); 347 348 /* HT Cap. */ 349 if ((pregistrypriv->wireless_mode & WIRELESS_11_24N) && 350 (pregistrypriv->ht_enable == true)) { 351 /* todo: */ 352 } 353 354 /* pdev_network->ie_length = sz; update ie_length */ 355 356 /* return _SUCCESS; */ 357 358 return sz; 359 } 360 361 unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit) 362 { 363 int len; 364 u16 val16; 365 unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01}; 366 u8 *pbuf = pie; 367 int limit_new = limit; 368 __le16 le_tmp; 369 370 while (1) { 371 pbuf = rtw_get_ie(pbuf, WLAN_EID_VENDOR_SPECIFIC, &len, limit_new); 372 373 if (pbuf) { 374 /* check if oui matches... */ 375 if (memcmp((pbuf + 2), wpa_oui_type, sizeof(wpa_oui_type))) 376 goto check_next_ie; 377 378 /* check version... */ 379 memcpy((u8 *)&le_tmp, (pbuf + 6), sizeof(val16)); 380 381 val16 = le16_to_cpu(le_tmp); 382 if (val16 != 0x0001) 383 goto check_next_ie; 384 385 *wpa_ie_len = *(pbuf + 1); 386 387 return pbuf; 388 389 } else { 390 *wpa_ie_len = 0; 391 return NULL; 392 } 393 394 check_next_ie: 395 396 limit_new = limit - (pbuf - pie) - 2 - len; 397 398 if (limit_new <= 0) 399 break; 400 401 pbuf += (2 + len); 402 } 403 404 *wpa_ie_len = 0; 405 406 return NULL; 407 } 408 409 unsigned char *rtw_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len, int limit) 410 { 411 return rtw_get_ie(pie, WLAN_EID_RSN, rsn_ie_len, limit); 412 } 413 414 int rtw_get_wpa_cipher_suite(u8 *s) 415 { 416 if (!memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN)) 417 return WPA_CIPHER_NONE; 418 if (!memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN)) 419 return WPA_CIPHER_WEP40; 420 if (!memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN)) 421 return WPA_CIPHER_TKIP; 422 if (!memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN)) 423 return WPA_CIPHER_CCMP; 424 if (!memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN)) 425 return WPA_CIPHER_WEP104; 426 427 return 0; 428 } 429 430 int rtw_get_wpa2_cipher_suite(u8 *s) 431 { 432 if (!memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN)) 433 return WPA_CIPHER_NONE; 434 if (!memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN)) 435 return WPA_CIPHER_WEP40; 436 if (!memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN)) 437 return WPA_CIPHER_TKIP; 438 if (!memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN)) 439 return WPA_CIPHER_CCMP; 440 if (!memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN)) 441 return WPA_CIPHER_WEP104; 442 443 return 0; 444 } 445 446 int rtw_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher, int *is_8021x) 447 { 448 int i, ret = _SUCCESS; 449 int left, count; 450 u8 *pos; 451 u8 SUITE_1X[4] = {0x00, 0x50, 0xf2, 1}; 452 453 if (wpa_ie_len <= 0) { 454 /* No WPA IE - fail silently */ 455 return _FAIL; 456 } 457 458 if ((*wpa_ie != WLAN_EID_VENDOR_SPECIFIC) || 459 (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) || 460 (memcmp(wpa_ie + 2, RTW_WPA_OUI_TYPE, WPA_SELECTOR_LEN))) 461 return _FAIL; 462 463 pos = wpa_ie; 464 465 pos += 8; 466 left = wpa_ie_len - 8; 467 468 /* group_cipher */ 469 if (left >= WPA_SELECTOR_LEN) { 470 *group_cipher = rtw_get_wpa_cipher_suite(pos); 471 472 pos += WPA_SELECTOR_LEN; 473 left -= WPA_SELECTOR_LEN; 474 475 } else if (left > 0) 476 return _FAIL; 477 478 /* pairwise_cipher */ 479 if (left >= 2) { 480 /* count = le16_to_cpu(*(u16*)pos); */ 481 count = get_unaligned_le16(pos); 482 pos += 2; 483 left -= 2; 484 485 if (count == 0 || left < count * WPA_SELECTOR_LEN) 486 return _FAIL; 487 488 for (i = 0; i < count; i++) { 489 *pairwise_cipher |= rtw_get_wpa_cipher_suite(pos); 490 491 pos += WPA_SELECTOR_LEN; 492 left -= WPA_SELECTOR_LEN; 493 } 494 495 } else if (left == 1) 496 return _FAIL; 497 498 if (is_8021x) { 499 if (left >= 6) { 500 pos += 2; 501 if (!memcmp(pos, SUITE_1X, 4)) 502 *is_8021x = 1; 503 } 504 } 505 506 return ret; 507 } 508 509 int rtw_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher, int *pairwise_cipher, int *is_8021x) 510 { 511 int i, ret = _SUCCESS; 512 int left, count; 513 u8 *pos; 514 u8 SUITE_1X[4] = {0x00, 0x0f, 0xac, 0x01}; 515 516 if (rsn_ie_len <= 0) { 517 /* No RSN IE - fail silently */ 518 return _FAIL; 519 } 520 521 if ((*rsn_ie != WLAN_EID_RSN) || (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2))) 522 return _FAIL; 523 524 pos = rsn_ie; 525 pos += 4; 526 left = rsn_ie_len - 4; 527 528 /* group_cipher */ 529 if (left >= RSN_SELECTOR_LEN) { 530 *group_cipher = rtw_get_wpa2_cipher_suite(pos); 531 532 pos += RSN_SELECTOR_LEN; 533 left -= RSN_SELECTOR_LEN; 534 535 } else if (left > 0) 536 return _FAIL; 537 538 /* pairwise_cipher */ 539 if (left >= 2) { 540 /* count = le16_to_cpu(*(u16*)pos); */ 541 count = get_unaligned_le16(pos); 542 pos += 2; 543 left -= 2; 544 545 if (count == 0 || left < count * RSN_SELECTOR_LEN) 546 return _FAIL; 547 548 for (i = 0; i < count; i++) { 549 *pairwise_cipher |= rtw_get_wpa2_cipher_suite(pos); 550 551 pos += RSN_SELECTOR_LEN; 552 left -= RSN_SELECTOR_LEN; 553 } 554 555 } else if (left == 1) 556 return _FAIL; 557 558 if (is_8021x) { 559 if (left >= 6) { 560 pos += 2; 561 if (!memcmp(pos, SUITE_1X, 4)) 562 *is_8021x = 1; 563 } 564 } 565 566 return ret; 567 } 568 569 int rtw_get_wapi_ie(u8 *in_ie, uint in_len, u8 *wapi_ie, u16 *wapi_len) 570 { 571 int len = 0; 572 u8 authmode; 573 uint cnt; 574 u8 wapi_oui1[4] = {0x0, 0x14, 0x72, 0x01}; 575 u8 wapi_oui2[4] = {0x0, 0x14, 0x72, 0x02}; 576 577 if (wapi_len) 578 *wapi_len = 0; 579 580 if (!in_ie || in_len <= 0) 581 return len; 582 583 cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_); 584 585 while (cnt < in_len) { 586 authmode = in_ie[cnt]; 587 588 if (authmode == WLAN_EID_BSS_AC_ACCESS_DELAY && 589 (!memcmp(&in_ie[cnt + 6], wapi_oui1, 4) || 590 !memcmp(&in_ie[cnt + 6], wapi_oui2, 4))) { 591 if (wapi_ie) 592 memcpy(wapi_ie, &in_ie[cnt], in_ie[cnt + 1] + 2); 593 594 if (wapi_len) 595 *wapi_len = in_ie[cnt + 1] + 2; 596 597 } 598 599 cnt += in_ie[cnt + 1] + 2; /* get next */ 600 } 601 602 if (wapi_len) 603 len = *wapi_len; 604 605 return len; 606 } 607 608 void rtw_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len, u8 *wpa_ie, u16 *wpa_len) 609 { 610 u8 authmode; 611 u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01}; 612 uint cnt; 613 614 /* Search required WPA or WPA2 IE and copy to sec_ie[ ] */ 615 616 cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_); 617 618 while (cnt < in_len) { 619 authmode = in_ie[cnt]; 620 621 if ((authmode == WLAN_EID_VENDOR_SPECIFIC) && 622 (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) { 623 if (wpa_ie) 624 memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2); 625 626 *wpa_len = in_ie[cnt + 1] + 2; 627 } else if (authmode == WLAN_EID_RSN) { 628 if (rsn_ie) 629 memcpy(rsn_ie, &in_ie[cnt], in_ie[cnt + 1] + 2); 630 631 *rsn_len = in_ie[cnt + 1] + 2; 632 } 633 634 cnt += in_ie[cnt + 1] + 2; /* get next */ 635 } 636 } 637 638 /** 639 * rtw_get_wps_ie - Search WPS IE from a series of IEs 640 * @in_ie: Address of IEs to search 641 * @in_len: Length limit from in_ie 642 * @wps_ie: If not NULL and WPS IE is found, WPS IE will be copied to the buf starting from wps_ie 643 * @wps_ielen: If not NULL and WPS IE is found, will set to the length of the entire WPS IE 644 * 645 * Returns: The address of the WPS IE found, or NULL 646 */ 647 u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen) 648 { 649 uint cnt; 650 u8 *wpsie_ptr = NULL; 651 u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04}; 652 653 if (wps_ielen) 654 *wps_ielen = 0; 655 656 if (!in_ie || in_len <= 0) 657 return wpsie_ptr; 658 659 cnt = 0; 660 661 while (cnt < in_len) { 662 eid = in_ie[cnt]; 663 664 if ((eid == WLAN_EID_VENDOR_SPECIFIC) && (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) { 665 wpsie_ptr = &in_ie[cnt]; 666 667 if (wps_ie) 668 memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2); 669 670 if (wps_ielen) 671 *wps_ielen = in_ie[cnt + 1] + 2; 672 673 cnt += in_ie[cnt + 1] + 2; 674 675 break; 676 } 677 cnt += in_ie[cnt + 1] + 2; /* goto next */ 678 } 679 680 return wpsie_ptr; 681 } 682 683 /** 684 * rtw_get_wps_attr - Search a specific WPS attribute from a given WPS IE 685 * @wps_ie: Address of WPS IE to search 686 * @wps_ielen: Length limit from wps_ie 687 * @target_attr_id: The attribute ID of WPS attribute to search 688 * @buf_attr: If not NULL and the WPS attribute is found, WPS attribute will be copied to the buf starting from buf_attr 689 * @len_attr: If not NULL and the WPS attribute is found, will set to the length of the entire WPS attribute 690 * 691 * Returns: the address of the specific WPS attribute found, or NULL 692 */ 693 u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id, u8 *buf_attr, u32 *len_attr) 694 { 695 u8 *attr_ptr = NULL; 696 u8 *target_attr_ptr = NULL; 697 u8 wps_oui[4] = {0x00, 0x50, 0xF2, 0x04}; 698 699 if (len_attr) 700 *len_attr = 0; 701 702 if ((wps_ie[0] != WLAN_EID_VENDOR_SPECIFIC) || 703 (memcmp(wps_ie + 2, wps_oui, 4))) { 704 return attr_ptr; 705 } 706 707 /* 6 = 1(Element ID) + 1(Length) + 4(WPS OUI) */ 708 attr_ptr = wps_ie + 6; /* goto first attr */ 709 710 while (attr_ptr - wps_ie < wps_ielen) { 711 /* 4 = 2(Attribute ID) + 2(Length) */ 712 u16 attr_id = get_unaligned_be16(attr_ptr); 713 u16 attr_data_len = get_unaligned_be16(attr_ptr + 2); 714 u16 attr_len = attr_data_len + 4; 715 716 if (attr_id == target_attr_id) { 717 target_attr_ptr = attr_ptr; 718 719 if (buf_attr) 720 memcpy(buf_attr, attr_ptr, attr_len); 721 722 if (len_attr) 723 *len_attr = attr_len; 724 725 break; 726 } 727 attr_ptr += attr_len; /* goto next */ 728 } 729 730 return target_attr_ptr; 731 } 732 733 /** 734 * rtw_get_wps_attr_content - Search a specific WPS attribute content from a given WPS IE 735 * @wps_ie: Address of WPS IE to search 736 * @wps_ielen: Length limit from wps_ie 737 * @target_attr_id: The attribute ID of WPS attribute to search 738 * @buf_content: If not NULL and the WPS attribute is found, WPS attribute content will be copied to the buf starting from buf_content 739 * @len_content: If not NULL and the WPS attribute is found, will set to the length of the WPS attribute content 740 * 741 * Returns: the address of the specific WPS attribute content found, or NULL 742 */ 743 u8 *rtw_get_wps_attr_content(u8 *wps_ie, uint wps_ielen, u16 target_attr_id, u8 *buf_content, uint *len_content) 744 { 745 u8 *attr_ptr; 746 u32 attr_len; 747 748 if (len_content) 749 *len_content = 0; 750 751 attr_ptr = rtw_get_wps_attr(wps_ie, wps_ielen, target_attr_id, NULL, &attr_len); 752 753 if (attr_ptr && attr_len) { 754 if (buf_content) 755 memcpy(buf_content, attr_ptr + 4, attr_len - 4); 756 757 if (len_content) 758 *len_content = attr_len - 4; 759 760 return attr_ptr + 4; 761 } 762 763 return NULL; 764 } 765 766 static int rtw_ieee802_11_parse_vendor_specific(u8 *pos, uint elen, 767 struct rtw_ieee802_11_elems *elems, 768 int show_errors) 769 { 770 unsigned int oui; 771 772 /* 773 * first 3 bytes in vendor specific information element are the IEEE 774 * OUI of the vendor. The following byte is used a vendor specific 775 * sub-type. 776 */ 777 if (elen < 4) 778 return -1; 779 780 oui = get_unaligned_be24(pos); 781 switch (oui) { 782 case OUI_MICROSOFT: 783 /* 784 * Microsoft/Wi-Fi information elements are further typed and 785 * subtyped 786 */ 787 switch (pos[3]) { 788 case 1: 789 /* 790 * Microsoft OUI (00:50:F2) with OUI Type 1: 791 * real WPA information element 792 */ 793 elems->wpa_ie = pos; 794 elems->wpa_ie_len = elen; 795 break; 796 case WME_OUI_TYPE: /* this is a Wi-Fi WME info. element */ 797 if (elen < 5) 798 return -1; 799 800 switch (pos[4]) { 801 case WME_OUI_SUBTYPE_INFORMATION_ELEMENT: 802 case WME_OUI_SUBTYPE_PARAMETER_ELEMENT: 803 elems->wme = pos; 804 elems->wme_len = elen; 805 break; 806 case WME_OUI_SUBTYPE_TSPEC_ELEMENT: 807 elems->wme_tspec = pos; 808 elems->wme_tspec_len = elen; 809 break; 810 default: 811 return -1; 812 } 813 break; 814 case 4: 815 /* Wi-Fi Protected Setup (WPS) IE */ 816 elems->wps_ie = pos; 817 elems->wps_ie_len = elen; 818 break; 819 default: 820 return -1; 821 } 822 break; 823 824 case OUI_BROADCOM: 825 switch (pos[3]) { 826 case VENDOR_HT_CAPAB_OUI_TYPE: 827 elems->vendor_ht_cap = pos; 828 elems->vendor_ht_cap_len = elen; 829 break; 830 default: 831 return -1; 832 } 833 break; 834 835 default: 836 return -1; 837 } 838 839 return 0; 840 } 841 842 /** 843 * rtw_ieee802_11_parse_elems - Parse information elements in management frames 844 * @start: Pointer to the start of IEs 845 * @len: Length of IE buffer in octets 846 * @elems: Data structure for parsed elements 847 * @show_errors: Whether to show parsing errors in debug log 848 * Returns: Parsing result 849 */ 850 enum parse_result rtw_ieee802_11_parse_elems(u8 *start, uint len, 851 struct rtw_ieee802_11_elems *elems, 852 int show_errors) 853 { 854 uint left = len; 855 u8 *pos = start; 856 int unknown = 0; 857 858 memset(elems, 0, sizeof(*elems)); 859 860 while (left >= 2) { 861 u8 id, elen; 862 863 id = *pos++; 864 elen = *pos++; 865 left -= 2; 866 867 if (elen > left) 868 return PARSE_FAILED; 869 870 switch (id) { 871 case WLAN_EID_SSID: 872 elems->ssid = pos; 873 elems->ssid_len = elen; 874 break; 875 case WLAN_EID_SUPP_RATES: 876 elems->supp_rates = pos; 877 elems->supp_rates_len = elen; 878 break; 879 case WLAN_EID_FH_PARAMS: 880 elems->fh_params = pos; 881 elems->fh_params_len = elen; 882 break; 883 case WLAN_EID_DS_PARAMS: 884 elems->ds_params = pos; 885 elems->ds_params_len = elen; 886 break; 887 case WLAN_EID_CF_PARAMS: 888 elems->cf_params = pos; 889 elems->cf_params_len = elen; 890 break; 891 case WLAN_EID_TIM: 892 elems->tim = pos; 893 elems->tim_len = elen; 894 break; 895 case WLAN_EID_IBSS_PARAMS: 896 elems->ibss_params = pos; 897 elems->ibss_params_len = elen; 898 break; 899 case WLAN_EID_CHALLENGE: 900 elems->challenge = pos; 901 elems->challenge_len = elen; 902 break; 903 case WLAN_EID_ERP_INFO: 904 elems->erp_info = pos; 905 elems->erp_info_len = elen; 906 break; 907 case WLAN_EID_EXT_SUPP_RATES: 908 elems->ext_supp_rates = pos; 909 elems->ext_supp_rates_len = elen; 910 break; 911 case WLAN_EID_VENDOR_SPECIFIC: 912 if (rtw_ieee802_11_parse_vendor_specific(pos, elen, 913 elems, 914 show_errors)) 915 unknown++; 916 break; 917 case WLAN_EID_RSN: 918 elems->rsn_ie = pos; 919 elems->rsn_ie_len = elen; 920 break; 921 case WLAN_EID_PWR_CAPABILITY: 922 elems->power_cap = pos; 923 elems->power_cap_len = elen; 924 break; 925 case WLAN_EID_SUPPORTED_CHANNELS: 926 elems->supp_channels = pos; 927 elems->supp_channels_len = elen; 928 break; 929 case WLAN_EID_MOBILITY_DOMAIN: 930 elems->mdie = pos; 931 elems->mdie_len = elen; 932 break; 933 case WLAN_EID_FAST_BSS_TRANSITION: 934 elems->ftie = pos; 935 elems->ftie_len = elen; 936 break; 937 case WLAN_EID_TIMEOUT_INTERVAL: 938 elems->timeout_int = pos; 939 elems->timeout_int_len = elen; 940 break; 941 case WLAN_EID_HT_CAPABILITY: 942 elems->ht_capabilities = pos; 943 elems->ht_capabilities_len = elen; 944 break; 945 case WLAN_EID_HT_OPERATION: 946 elems->ht_operation = pos; 947 elems->ht_operation_len = elen; 948 break; 949 case WLAN_EID_VHT_CAPABILITY: 950 elems->vht_capabilities = pos; 951 elems->vht_capabilities_len = elen; 952 break; 953 case WLAN_EID_VHT_OPERATION: 954 elems->vht_operation = pos; 955 elems->vht_operation_len = elen; 956 break; 957 case WLAN_EID_OPMODE_NOTIF: 958 elems->vht_op_mode_notify = pos; 959 elems->vht_op_mode_notify_len = elen; 960 break; 961 default: 962 unknown++; 963 break; 964 } 965 966 left -= elen; 967 pos += elen; 968 } 969 970 if (left) 971 return PARSE_FAILED; 972 973 return unknown ? PARSE_UNKNOWN : PARSE_OK; 974 } 975 976 void rtw_macaddr_cfg(struct device *dev, u8 *mac_addr) 977 { 978 u8 mac[ETH_ALEN]; 979 struct device_node *np = dev->of_node; 980 const unsigned char *addr; 981 int len; 982 983 if (!mac_addr) 984 return; 985 986 if (rtw_initmac && mac_pton(rtw_initmac, mac)) { 987 /* Users specify the mac address */ 988 ether_addr_copy(mac_addr, mac); 989 } else { 990 /* Use the mac address stored in the Efuse */ 991 ether_addr_copy(mac, mac_addr); 992 } 993 994 if (is_broadcast_ether_addr(mac) || is_zero_ether_addr(mac)) { 995 addr = of_get_property(np, "local-mac-address", &len); 996 997 if (addr && len == ETH_ALEN) 998 ether_addr_copy(mac_addr, addr); 999 else 1000 eth_random_addr(mac_addr); 1001 } 1002 } 1003 1004 static int rtw_get_cipher_info(struct wlan_network *pnetwork) 1005 { 1006 u32 wpa_ielen; 1007 unsigned char *pbuf; 1008 int group_cipher = 0, pairwise_cipher = 0, is8021x = 0; 1009 int ret = _FAIL; 1010 1011 pbuf = rtw_get_wpa_ie(&pnetwork->network.ies[12], 1012 &wpa_ielen, 1013 pnetwork->network.ie_length - 12); 1014 1015 if (pbuf && (wpa_ielen > 0)) { 1016 if (rtw_parse_wpa_ie(pbuf, wpa_ielen + 2, &group_cipher, 1017 &pairwise_cipher, &is8021x) == _SUCCESS) { 1018 pnetwork->bcn_info.pairwise_cipher = pairwise_cipher; 1019 pnetwork->bcn_info.group_cipher = group_cipher; 1020 pnetwork->bcn_info.is_8021x = is8021x; 1021 ret = _SUCCESS; 1022 } 1023 } else { 1024 pbuf = rtw_get_wpa2_ie(&pnetwork->network.ies[12], &wpa_ielen, 1025 pnetwork->network.ie_length - 12); 1026 1027 if (pbuf && (wpa_ielen > 0)) { 1028 if (rtw_parse_wpa2_ie(pbuf, wpa_ielen + 2, &group_cipher, 1029 &pairwise_cipher, &is8021x) == _SUCCESS) { 1030 pnetwork->bcn_info.pairwise_cipher = pairwise_cipher; 1031 pnetwork->bcn_info.group_cipher = group_cipher; 1032 pnetwork->bcn_info.is_8021x = is8021x; 1033 ret = _SUCCESS; 1034 } 1035 } 1036 } 1037 1038 return ret; 1039 } 1040 1041 void rtw_get_bcn_info(struct wlan_network *pnetwork) 1042 { 1043 unsigned short cap = 0; 1044 u8 bencrypt = 0; 1045 /* u8 wpa_ie[255], rsn_ie[255]; */ 1046 u16 wpa_len = 0, rsn_len = 0; 1047 struct HT_info_element *pht_info = NULL; 1048 struct ieee80211_ht_cap *pht_cap = NULL; 1049 unsigned int len; 1050 unsigned char *p; 1051 __le16 le_cap; 1052 1053 memcpy((u8 *)&le_cap, rtw_get_capability_from_ie(pnetwork->network.ies), 2); 1054 cap = le16_to_cpu(le_cap); 1055 if (cap & WLAN_CAPABILITY_PRIVACY) { 1056 bencrypt = 1; 1057 pnetwork->network.privacy = 1; 1058 } else { 1059 pnetwork->bcn_info.encryp_protocol = ENCRYP_PROTOCOL_OPENSYS; 1060 } 1061 rtw_get_sec_ie(pnetwork->network.ies, pnetwork->network.ie_length, NULL, &rsn_len, NULL, &wpa_len); 1062 1063 if (rsn_len > 0) { 1064 pnetwork->bcn_info.encryp_protocol = ENCRYP_PROTOCOL_WPA2; 1065 } else if (wpa_len > 0) { 1066 pnetwork->bcn_info.encryp_protocol = ENCRYP_PROTOCOL_WPA; 1067 } else { 1068 if (bencrypt) 1069 pnetwork->bcn_info.encryp_protocol = ENCRYP_PROTOCOL_WEP; 1070 } 1071 rtw_get_cipher_info(pnetwork); 1072 1073 /* get bwmode and ch_offset */ 1074 /* parsing HT_CAP_IE */ 1075 p = rtw_get_ie(pnetwork->network.ies + _FIXED_IE_LENGTH_, WLAN_EID_HT_CAPABILITY, &len, pnetwork->network.ie_length - _FIXED_IE_LENGTH_); 1076 if (p && len > 0) { 1077 pht_cap = (struct ieee80211_ht_cap *)(p + 2); 1078 pnetwork->bcn_info.ht_cap_info = le16_to_cpu(pht_cap->cap_info); 1079 } else { 1080 pnetwork->bcn_info.ht_cap_info = 0; 1081 } 1082 /* parsing HT_INFO_IE */ 1083 p = rtw_get_ie(pnetwork->network.ies + _FIXED_IE_LENGTH_, WLAN_EID_HT_OPERATION, &len, pnetwork->network.ie_length - _FIXED_IE_LENGTH_); 1084 if (p && len > 0) { 1085 pht_info = (struct HT_info_element *)(p + 2); 1086 pnetwork->bcn_info.ht_info_infos_0 = pht_info->infos[0]; 1087 } else { 1088 pnetwork->bcn_info.ht_info_infos_0 = 0; 1089 } 1090 } 1091 1092 /* show MCS rate, unit: 100Kbps */ 1093 u16 rtw_mcs_rate(u8 bw_40MHz, u8 short_GI, unsigned char *MCS_rate) 1094 { 1095 u16 max_rate = 0; 1096 1097 if (MCS_rate[0] & BIT(7)) 1098 max_rate = (bw_40MHz) ? ((short_GI) ? 1500 : 1350) : ((short_GI) ? 722 : 650); 1099 else if (MCS_rate[0] & BIT(6)) 1100 max_rate = (bw_40MHz) ? ((short_GI) ? 1350 : 1215) : ((short_GI) ? 650 : 585); 1101 else if (MCS_rate[0] & BIT(5)) 1102 max_rate = (bw_40MHz) ? ((short_GI) ? 1200 : 1080) : ((short_GI) ? 578 : 520); 1103 else if (MCS_rate[0] & BIT(4)) 1104 max_rate = (bw_40MHz) ? ((short_GI) ? 900 : 810) : ((short_GI) ? 433 : 390); 1105 else if (MCS_rate[0] & BIT(3)) 1106 max_rate = (bw_40MHz) ? ((short_GI) ? 600 : 540) : ((short_GI) ? 289 : 260); 1107 else if (MCS_rate[0] & BIT(2)) 1108 max_rate = (bw_40MHz) ? ((short_GI) ? 450 : 405) : ((short_GI) ? 217 : 195); 1109 else if (MCS_rate[0] & BIT(1)) 1110 max_rate = (bw_40MHz) ? ((short_GI) ? 300 : 270) : ((short_GI) ? 144 : 130); 1111 else if (MCS_rate[0] & BIT(0)) 1112 max_rate = (bw_40MHz) ? ((short_GI) ? 150 : 135) : ((short_GI) ? 72 : 65); 1113 1114 return max_rate; 1115 } 1116 1117 int rtw_action_frame_parse(const u8 *frame, u32 frame_len, u8 *category, u8 *action) 1118 { 1119 const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); 1120 u16 fc; 1121 u8 c; 1122 u8 a = ACT_PUBLIC_MAX; 1123 1124 fc = le16_to_cpu(((struct ieee80211_hdr_3addr *)frame)->frame_control); 1125 1126 if ((fc & (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) != 1127 (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION)) 1128 return false; 1129 1130 c = frame_body[0]; 1131 1132 switch (c) { 1133 case RTW_WLAN_CATEGORY_P2P: /* vendor-specific */ 1134 break; 1135 default: 1136 a = frame_body[1]; 1137 } 1138 1139 if (category) 1140 *category = c; 1141 if (action) 1142 *action = a; 1143 1144 return true; 1145 } 1146 1147 static const char * const _action_public_str[] = { 1148 "ACT_PUB_BSSCOEXIST", 1149 "ACT_PUB_DSE_ENABLE", 1150 "ACT_PUB_DSE_DEENABLE", 1151 "ACT_PUB_DSE_REG_LOCATION", 1152 "ACT_PUB_EXT_CHL_SWITCH", 1153 "ACT_PUB_DSE_MSR_REQ", 1154 "ACT_PUB_DSE_MSR_RPRT", 1155 "ACT_PUB_MP", 1156 "ACT_PUB_DSE_PWR_CONSTRAINT", 1157 "ACT_PUB_VENDOR", 1158 "ACT_PUB_GAS_INITIAL_REQ", 1159 "ACT_PUB_GAS_INITIAL_RSP", 1160 "ACT_PUB_GAS_COMEBACK_REQ", 1161 "ACT_PUB_GAS_COMEBACK_RSP", 1162 "ACT_PUB_TDLS_DISCOVERY_RSP", 1163 "ACT_PUB_LOCATION_TRACK", 1164 "ACT_PUB_RSVD", 1165 }; 1166 1167 const char *action_public_str(u8 action) 1168 { 1169 action = (action >= ACT_PUBLIC_MAX) ? ACT_PUBLIC_MAX : action; 1170 return _action_public_str[action]; 1171 } 1172