1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * nxpwifi: scan ioctl and command handling
4 *
5 * Copyright 2011-2024 NXP
6 */
7
8 #include "cfg.h"
9 #include "util.h"
10 #include "fw.h"
11 #include "main.h"
12 #include "cmdevt.h"
13 #include "11n.h"
14 #include "11ac.h"
15 #include "11ax.h"
16 #include "cfg80211.h"
17
18 /* The maximum number of channels the firmware can scan per command */
19 #define NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN 14
20
21 #define NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD 4
22
23 /* Memory needed to store a max sized Channel List TLV for a firmware scan */
24 #define CHAN_TLV_MAX_SIZE (sizeof(struct nxpwifi_ie_types_header) \
25 + (NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN \
26 * sizeof(struct nxpwifi_chan_scan_param_set)))
27
28 /* Memory needed to store supported rate */
29 #define RATE_TLV_MAX_SIZE (sizeof(struct nxpwifi_ie_types_rates_param_set) \
30 + HOSTCMD_SUPPORTED_RATES)
31
32 /* Memory needed to store a max number/size WildCard SSID TLV for a firmware scan */
33 #define WILDCARD_SSID_TLV_MAX_SIZE \
34 (NXPWIFI_MAX_SSID_LIST_LENGTH * \
35 (sizeof(struct nxpwifi_ie_types_wildcard_ssid_params) \
36 + IEEE80211_MAX_SSID_LEN))
37
38 /* Maximum memory needed for a nxpwifi_scan_cmd_config with all TLVs at max */
39 #define MAX_SCAN_CFG_ALLOC (sizeof(struct nxpwifi_scan_cmd_config) \
40 + sizeof(struct nxpwifi_ie_types_num_probes) \
41 + sizeof(struct nxpwifi_ie_types_htcap) \
42 + sizeof(struct nxpwifi_ie_types_vhtcap) \
43 + sizeof(struct nxpwifi_ie_types_he_cap) \
44 + CHAN_TLV_MAX_SIZE \
45 + RATE_TLV_MAX_SIZE \
46 + WILDCARD_SSID_TLV_MAX_SIZE)
47
48 union nxpwifi_scan_cmd_config_tlv {
49 /* Scan configuration (variable length) */
50 struct nxpwifi_scan_cmd_config config;
51 /* Max allocated block */
52 u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC];
53 };
54
55 #define NXPWIFI_WPA_CIPHER_SUITE_TKIP SUITE(WLAN_OUI_MICROSOFT, 2)
56 #define NXPWIFI_WPA_CIPHER_SUITE_CCMP SUITE(WLAN_OUI_MICROSOFT, 4)
57
58 static void
_dbg_security_flags(int log_level,const char * func,const char * desc,struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)59 _dbg_security_flags(int log_level, const char *func, const char *desc,
60 struct nxpwifi_private *priv,
61 struct nxpwifi_bssdescriptor *bss_desc)
62 {
63 _nxpwifi_dbg(priv->adapter, log_level,
64 "info: %s: %s:\twpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s\tEncMode=%#x privacy=%#x\n",
65 func, desc,
66 bss_desc->bcn_wpa_ie ?
67 bss_desc->bcn_wpa_ie->vend_hdr.element_id : 0,
68 bss_desc->bcn_rsn_ie ?
69 bss_desc->bcn_rsn_ie->id : 0,
70 priv->sec_info.wep_enabled ? "e" : "d",
71 priv->sec_info.wpa_enabled ? "e" : "d",
72 priv->sec_info.wpa2_enabled ? "e" : "d",
73 priv->sec_info.encryption_mode,
74 bss_desc->privacy);
75 }
76
77 #define dbg_security_flags(mask, desc, priv, bss_desc) \
78 _dbg_security_flags(NXPWIFI_DBG_##mask, __func__, desc, priv, bss_desc)
79
80 /* Parse a WPA/RSN element and check whether its PTK list contains the OUI */
81 static u8
nxpwifi_search_oui_in_ie(struct ie_body * iebody,u8 * oui)82 nxpwifi_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
83 {
84 u8 count;
85
86 count = iebody->ptk_cnt[0];
87
88 /*
89 * PTK may contain multiple OUIs; iterate through the list and compare
90 * each one
91 */
92 while (count) {
93 if (!memcmp(iebody->ptk_body, oui, sizeof(iebody->ptk_body)))
94 return NXPWIFI_OUI_PRESENT;
95
96 --count;
97 if (count)
98 iebody = (struct ie_body *)((u8 *)iebody +
99 sizeof(iebody->ptk_body));
100 }
101
102 pr_debug("info: %s: OUI is not found in PTK\n", __func__);
103 return NXPWIFI_OUI_NOT_PRESENT;
104 }
105
106 /* Check whether the RSN IE is present and if its PTK list contains the OUI */
107 static u8
nxpwifi_is_rsn_oui_present(struct nxpwifi_bssdescriptor * bss_desc,u32 cipher)108 nxpwifi_is_rsn_oui_present(struct nxpwifi_bssdescriptor *bss_desc,
109 u32 cipher)
110 {
111 struct ie_body *iebody;
112 u8 ret = NXPWIFI_OUI_NOT_PRESENT;
113 __be32 oui = cpu_to_be32(cipher);
114
115 if (bss_desc->bcn_rsn_ie) {
116 iebody = (struct ie_body *)
117 (((u8 *)bss_desc->bcn_rsn_ie->data) +
118 RSN_GTK_OUI_OFFSET);
119 ret = nxpwifi_search_oui_in_ie(iebody, (u8 *)&oui);
120 if (ret)
121 return ret;
122 }
123 return ret;
124 }
125
126 /* Check if the WPA IE exists and whether its PTK list contains the OUI */
127 static u8
nxpwifi_is_wpa_oui_present(struct nxpwifi_bssdescriptor * bss_desc,u32 cipher)128 nxpwifi_is_wpa_oui_present(struct nxpwifi_bssdescriptor *bss_desc, u32 cipher)
129 {
130 struct ie_body *iebody;
131 u8 ret = NXPWIFI_OUI_NOT_PRESENT;
132 __be32 oui = cpu_to_be32(cipher);
133
134 if (bss_desc->bcn_wpa_ie) {
135 iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
136 WPA_GTK_OUI_OFFSET);
137 ret = nxpwifi_search_oui_in_ie(iebody, (u8 *)&oui);
138 if (ret)
139 return ret;
140 }
141 return ret;
142 }
143
144 /* Check whether both driver and BSS operate with no security */
145 static bool
nxpwifi_is_bss_no_sec(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)146 nxpwifi_is_bss_no_sec(struct nxpwifi_private *priv,
147 struct nxpwifi_bssdescriptor *bss_desc)
148 {
149 if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
150 !priv->sec_info.wpa2_enabled &&
151 !bss_desc->bcn_rsn_ie &&
152 !bss_desc->bcn_wpa_ie &&
153 !priv->sec_info.encryption_mode && !bss_desc->privacy) {
154 return true;
155 }
156 return false;
157 }
158
159 /* Check whether static WEP is enabled and the BSS privacy setting matches */
160 static bool
nxpwifi_is_bss_static_wep(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)161 nxpwifi_is_bss_static_wep(struct nxpwifi_private *priv,
162 struct nxpwifi_bssdescriptor *bss_desc)
163 {
164 if (priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
165 !priv->sec_info.wpa2_enabled && bss_desc->privacy) {
166 return true;
167 }
168 return false;
169 }
170
171 /* Check whether WPA is enabled and the BSS contains a WPA IE */
172 static bool
nxpwifi_is_bss_wpa(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)173 nxpwifi_is_bss_wpa(struct nxpwifi_private *priv,
174 struct nxpwifi_bssdescriptor *bss_desc)
175 {
176 if (!priv->sec_info.wep_enabled && priv->sec_info.wpa_enabled &&
177 !priv->sec_info.wpa2_enabled &&
178 bss_desc->bcn_wpa_ie) {
179 dbg_security_flags(INFO, "WPA", priv, bss_desc);
180 return true;
181 }
182 return false;
183 }
184
185 /* Check whether WPA2 is enabled and the BSS includes an RSN IE */
186 static bool
nxpwifi_is_bss_wpa2(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)187 nxpwifi_is_bss_wpa2(struct nxpwifi_private *priv,
188 struct nxpwifi_bssdescriptor *bss_desc)
189 {
190 if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
191 priv->sec_info.wpa2_enabled &&
192 bss_desc->bcn_rsn_ie) {
193 /*
194 * Some APs (e.g., WRT54G) may omit the privacy bit even when
195 * using WPA2
196 */
197 dbg_security_flags(ERROR, "WPA2", priv, bss_desc);
198 return true;
199 }
200 return false;
201 }
202
203 /* Check dynamic WEP: enabled in driver, privacy set, and no WPA/RSN IE present */
204 static bool
nxpwifi_is_bss_dynamic_wep(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)205 nxpwifi_is_bss_dynamic_wep(struct nxpwifi_private *priv,
206 struct nxpwifi_bssdescriptor *bss_desc)
207 {
208 if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
209 !priv->sec_info.wpa2_enabled &&
210 !bss_desc->bcn_wpa_ie &&
211 !bss_desc->bcn_rsn_ie &&
212 priv->sec_info.encryption_mode && bss_desc->privacy) {
213 dbg_security_flags(INFO, "dynamic", priv, bss_desc);
214 return true;
215 }
216 return false;
217 }
218
219 /*
220 * Check whether a scanned network is compatible with the driver's security
221 * configuration. The decision considers WEP, WPA, WPA2, privacy settings,
222 * and whether HT must be disabled when required (e.g., no AES).
223 *
224 * General rules:
225 * - Open networks: always compatible.
226 * - WPA-only: compatible; HT disabled if AES is not supported.
227 * - WPA2-only: compatible; HT disabled if AES is not supported.
228 * - Static WEP: compatible; HT disabled.
229 * - Dynamic WEP: compatible when privacy is enabled.
230 *
231 * Note: Compatibility is not enforced during roaming except for security mode.
232 */
233 static int
nxpwifi_is_network_compatible(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc,u32 mode)234 nxpwifi_is_network_compatible(struct nxpwifi_private *priv,
235 struct nxpwifi_bssdescriptor *bss_desc, u32 mode)
236 {
237 struct nxpwifi_adapter *adapter = priv->adapter;
238
239 bss_desc->disable_11n = false;
240
241 /* Skip compatibility checks while roaming */
242 if (priv->media_connected &&
243 priv->bss_mode == NL80211_IFTYPE_STATION &&
244 bss_desc->bss_mode == NL80211_IFTYPE_STATION)
245 return 0;
246
247 if (priv->wps.session_enable) {
248 nxpwifi_dbg(adapter, IOCTL,
249 "info: return success directly in WPS period\n");
250 return 0;
251 }
252
253 if (bss_desc->chan_sw_ie_present) {
254 nxpwifi_dbg(adapter, INFO,
255 "Don't connect to AP with WLAN_EID_CHANNEL_SWITCH\n");
256 return -EPERM;
257 }
258
259 if (bss_desc->bss_mode == mode) {
260 if (nxpwifi_is_bss_no_sec(priv, bss_desc)) {
261 return 0;
262 } else if (nxpwifi_is_bss_static_wep(priv, bss_desc)) {
263 nxpwifi_dbg(adapter, INFO,
264 "info: Disable 11n in WEP mode.\n");
265 bss_desc->disable_11n = true;
266 return 0;
267 } else if (nxpwifi_is_bss_wpa(priv, bss_desc)) {
268 if (((priv->config_bands & BAND_GN ||
269 priv->config_bands & BAND_AN) &&
270 bss_desc->bcn_ht_cap) &&
271 !nxpwifi_is_wpa_oui_present(bss_desc,
272 NXPWIFI_WPA_CIPHER_SUITE_CCMP)) {
273 if (nxpwifi_is_wpa_oui_present
274 (bss_desc, NXPWIFI_WPA_CIPHER_SUITE_TKIP)) {
275 nxpwifi_dbg(adapter, INFO,
276 "info: Disable 11n if AES\t"
277 "is not supported by AP\n");
278 bss_desc->disable_11n = true;
279 } else {
280 return -EINVAL;
281 }
282 }
283 return 0;
284 } else if (nxpwifi_is_bss_wpa2(priv, bss_desc)) {
285 if (((priv->config_bands & BAND_GN ||
286 priv->config_bands & BAND_AN) &&
287 bss_desc->bcn_ht_cap) &&
288 !nxpwifi_is_rsn_oui_present(bss_desc,
289 WLAN_CIPHER_SUITE_CCMP)) {
290 if (nxpwifi_is_rsn_oui_present
291 (bss_desc, WLAN_CIPHER_SUITE_TKIP)) {
292 nxpwifi_dbg(adapter, INFO,
293 "info: Disable 11n if AES\t"
294 "is not supported by AP\n");
295 bss_desc->disable_11n = true;
296 } else if (nxpwifi_is_rsn_oui_present
297 (bss_desc, WLAN_CIPHER_SUITE_GCMP_256) ||
298 nxpwifi_is_rsn_oui_present
299 (bss_desc, WLAN_CIPHER_SUITE_CCMP_256)) {
300 return 0;
301 } else {
302 return -EINVAL;
303 }
304 }
305 return 0;
306 } else if (nxpwifi_is_bss_dynamic_wep(priv, bss_desc)) {
307 return 0;
308 }
309
310 /* Security mismatch */
311 dbg_security_flags(ERROR, "failed", priv, bss_desc);
312 return -EINVAL;
313 }
314
315 return -EINVAL;
316 }
317
318 /*
319 * Build the channel list for scanning based on region and band settings.
320 * Used when a scan request does not specify its own channel list.
321 */
322 static int
nxpwifi_scan_create_channel_list(struct nxpwifi_private * priv,const struct nxpwifi_user_scan_cfg * user_scan_in,struct nxpwifi_chan_scan_param_set * scan_chan_list,u8 filtered_scan)323 nxpwifi_scan_create_channel_list(struct nxpwifi_private *priv,
324 const struct nxpwifi_user_scan_cfg
325 *user_scan_in,
326 struct nxpwifi_chan_scan_param_set
327 *scan_chan_list,
328 u8 filtered_scan)
329 {
330 enum nl80211_band band;
331 struct ieee80211_supported_band *sband;
332 struct ieee80211_channel *ch;
333 struct nxpwifi_adapter *adapter = priv->adapter;
334 int chan_idx = 0, i;
335 u16 scan_time = 0;
336
337 if (user_scan_in)
338 scan_time = (u16)user_scan_in->chan_list[0].scan_time;
339
340 for (band = 0; (band < NUM_NL80211_BANDS) ; band++) {
341 if (!priv->wdev.wiphy->bands[band])
342 continue;
343
344 sband = priv->wdev.wiphy->bands[band];
345
346 for (i = 0; (i < sband->n_channels) ; i++) {
347 ch = &sband->channels[i];
348 if (ch->flags & IEEE80211_CHAN_DISABLED)
349 continue;
350 scan_chan_list[chan_idx].band_cfg = band;
351
352 if (scan_time)
353 scan_chan_list[chan_idx].max_scan_time =
354 cpu_to_le16(scan_time);
355 else if ((ch->flags & IEEE80211_CHAN_NO_IR) ||
356 (ch->flags & IEEE80211_CHAN_RADAR))
357 scan_chan_list[chan_idx].max_scan_time =
358 cpu_to_le16(adapter->passive_scan_time);
359 else
360 scan_chan_list[chan_idx].max_scan_time =
361 cpu_to_le16(adapter->active_scan_time);
362
363 if (ch->flags & IEEE80211_CHAN_NO_IR)
364 scan_chan_list[chan_idx].chan_scan_mode_bmap |=
365 (NXPWIFI_PASSIVE_SCAN | NXPWIFI_HIDDEN_SSID_REPORT);
366 else
367 scan_chan_list[chan_idx].chan_scan_mode_bmap &=
368 ~NXPWIFI_PASSIVE_SCAN;
369
370 scan_chan_list[chan_idx].chan_number = (u32)ch->hw_value;
371 scan_chan_list[chan_idx].chan_scan_mode_bmap |=
372 NXPWIFI_DISABLE_CHAN_FILT;
373
374 if (filtered_scan &&
375 !((ch->flags & IEEE80211_CHAN_NO_IR) ||
376 (ch->flags & IEEE80211_CHAN_RADAR)))
377 scan_chan_list[chan_idx].max_scan_time =
378 cpu_to_le16(adapter->specific_scan_time);
379
380 chan_idx++;
381 }
382 }
383 return chan_idx;
384 }
385
386 /*
387 * Build the channel-list TLV for bgscan based on region and band settings.
388 */
389 static int
nxpwifi_bgscan_create_channel_list(struct nxpwifi_private * priv,const struct nxpwifi_bg_scan_cfg * bgscan_cfg_in,struct nxpwifi_chan_scan_param_set * scan_chan_list)390 nxpwifi_bgscan_create_channel_list(struct nxpwifi_private *priv,
391 const struct nxpwifi_bg_scan_cfg
392 *bgscan_cfg_in,
393 struct nxpwifi_chan_scan_param_set
394 *scan_chan_list)
395 {
396 enum nl80211_band band;
397 struct ieee80211_supported_band *sband;
398 struct ieee80211_channel *ch;
399 struct nxpwifi_adapter *adapter = priv->adapter;
400 int chan_idx = 0, i;
401 u16 scan_time = 0, specific_scan_time = adapter->specific_scan_time;
402
403 if (bgscan_cfg_in)
404 scan_time = (u16)bgscan_cfg_in->chan_list[0].scan_time;
405
406 for (band = 0; (band < NUM_NL80211_BANDS); band++) {
407 if (!priv->wdev.wiphy->bands[band])
408 continue;
409
410 sband = priv->wdev.wiphy->bands[band];
411
412 for (i = 0; (i < sband->n_channels) ; i++) {
413 ch = &sband->channels[i];
414 if (ch->flags & IEEE80211_CHAN_DISABLED)
415 continue;
416 scan_chan_list[chan_idx].band_cfg = band;
417
418 if (scan_time)
419 scan_chan_list[chan_idx].max_scan_time =
420 cpu_to_le16(scan_time);
421 else if (ch->flags & IEEE80211_CHAN_NO_IR)
422 scan_chan_list[chan_idx].max_scan_time =
423 cpu_to_le16(adapter->passive_scan_time);
424 else
425 scan_chan_list[chan_idx].max_scan_time =
426 cpu_to_le16(specific_scan_time);
427
428 if (ch->flags & IEEE80211_CHAN_NO_IR)
429 scan_chan_list[chan_idx].chan_scan_mode_bmap |=
430 NXPWIFI_PASSIVE_SCAN;
431 else
432 scan_chan_list[chan_idx].chan_scan_mode_bmap &=
433 ~NXPWIFI_PASSIVE_SCAN;
434
435 scan_chan_list[chan_idx].chan_number = (u32)ch->hw_value;
436 chan_idx++;
437 }
438 }
439 return chan_idx;
440 }
441
442 /* Append the rate TLV to the scan configuration command */
443 static int
nxpwifi_append_rate_tlv(struct nxpwifi_private * priv,struct nxpwifi_scan_cmd_config * scan_cfg_out,u8 radio)444 nxpwifi_append_rate_tlv(struct nxpwifi_private *priv,
445 struct nxpwifi_scan_cmd_config *scan_cfg_out,
446 u8 radio)
447 {
448 struct nxpwifi_ie_types_rates_param_set *rates_tlv;
449 u8 rates[NXPWIFI_SUPPORTED_RATES], *tlv_pos;
450 u32 rates_size;
451
452 memset(rates, 0, sizeof(rates));
453
454 tlv_pos = (u8 *)scan_cfg_out->tlv_buf + scan_cfg_out->tlv_buf_len;
455
456 if (priv->scan_request)
457 rates_size = nxpwifi_get_rates_from_cfg80211(priv, rates,
458 radio);
459 else
460 rates_size = nxpwifi_get_supported_rates(priv, rates);
461
462 nxpwifi_dbg(priv->adapter, CMD,
463 "info: SCAN_CMD: Rates size = %d\n",
464 rates_size);
465 rates_tlv = (struct nxpwifi_ie_types_rates_param_set *)tlv_pos;
466 rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
467 rates_tlv->header.len = cpu_to_le16((u16)rates_size);
468 memcpy(rates_tlv->rates, rates, rates_size);
469 scan_cfg_out->tlv_buf_len += sizeof(rates_tlv->header) + rates_size;
470
471 return rates_size;
472 }
473
474 /*
475 * Build and send multiple scan commands by chunking channel TLVs per scan
476 * limit.
477 */
478 static int
nxpwifi_scan_channel_list(struct nxpwifi_private * priv,u32 max_chan_per_scan,u8 filtered_scan,struct nxpwifi_scan_cmd_config * scan_cfg_out,struct nxpwifi_ie_types_chan_list_param_set * tlv_o,struct nxpwifi_chan_scan_param_set * scan_chan_list)479 nxpwifi_scan_channel_list(struct nxpwifi_private *priv,
480 u32 max_chan_per_scan, u8 filtered_scan,
481 struct nxpwifi_scan_cmd_config *scan_cfg_out,
482 struct nxpwifi_ie_types_chan_list_param_set *tlv_o,
483 struct nxpwifi_chan_scan_param_set *scan_chan_list)
484 {
485 struct nxpwifi_adapter *adapter = priv->adapter;
486 int ret = 0;
487 struct nxpwifi_chan_scan_param_set *tmp_chan_list;
488 u32 tlv_idx, rates_size, cmd_no;
489 u32 total_scan_time;
490 u32 done_early;
491 u8 radio_type;
492
493 if (!scan_cfg_out || !tlv_o || !scan_chan_list) {
494 nxpwifi_dbg(priv->adapter, ERROR,
495 "info: Scan: Null detect: %p, %p, %p\n",
496 scan_cfg_out, tlv_o, scan_chan_list);
497 return -EINVAL;
498 }
499
500 /* Check csa channel expiry before preparing scan list */
501 nxpwifi_11h_get_csa_closed_channel(priv);
502
503 tlv_o->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
504
505 tmp_chan_list = scan_chan_list;
506
507 /*
508 * Iterate through the channel list and send a firmware scan command for
509 * each group of max_chan_per_scan channels, or individually for
510 * channels 1, 6, and 11 when configured.
511 */
512 while (tmp_chan_list->chan_number) {
513 tlv_idx = 0;
514 total_scan_time = 0;
515 radio_type = 0;
516 tlv_o->header.len = 0;
517 done_early = false;
518
519 /*
520 * Build the channel TLV for the scan command. Continue adding
521 * channel TLVs until one of the following conditions is met:
522 * - tlv_idx reaches the maximum allowed per scan command
523 * - the next channel is 0 (end of the desired channel list)
524 * - done_early is set (used for per-channel scanning of 1, 6,
525 * and 11)
526 */
527 while (tlv_idx < max_chan_per_scan &&
528 tmp_chan_list->chan_number && !done_early) {
529 if (tmp_chan_list->chan_number == priv->csa_chan) {
530 tmp_chan_list++;
531 continue;
532 }
533
534 radio_type = tmp_chan_list->band_cfg;
535 nxpwifi_dbg(priv->adapter, INFO,
536 "info: Scan: Chan(%3d), Band(%d),\t"
537 "Mode(%d, %d), Dur(%d)\n",
538 tmp_chan_list->chan_number,
539 tmp_chan_list->band_cfg,
540 tmp_chan_list->chan_scan_mode_bmap
541 & NXPWIFI_PASSIVE_SCAN,
542 (tmp_chan_list->chan_scan_mode_bmap
543 & NXPWIFI_DISABLE_CHAN_FILT) >> 1,
544 le16_to_cpu(tmp_chan_list->max_scan_time));
545
546 /* Copy the current channel TLV into the command being prepared */
547 memcpy(&tlv_o->chan_scan_param[tlv_idx], tmp_chan_list,
548 sizeof(*tlv_o->chan_scan_param));
549
550 /*
551 * Increment the TLV header length by the size
552 * appended
553 */
554 le16_unaligned_add_cpu(&tlv_o->header.len,
555 sizeof(*tlv_o->chan_scan_param));
556
557 /*
558 * The tlv buffer length is set to the number of bytes
559 * of the between the channel tlv pointer and the start
560 * of the tlv buffer. This compensates for any TLVs
561 * that were appended before the channel list.
562 */
563 scan_cfg_out->tlv_buf_len =
564 (u32)((u8 *)tlv_o - scan_cfg_out->tlv_buf);
565
566 scan_cfg_out->tlv_buf_len +=
567 (sizeof(tlv_o->header)
568 + le16_to_cpu(tlv_o->header.len));
569
570 /* Advance the index for the channel TLV being constructed. */
571 tlv_idx++;
572
573 /* Count the total scan time per command */
574 total_scan_time +=
575 le16_to_cpu(tmp_chan_list->max_scan_time);
576
577 done_early = false;
578
579 /*
580 * Stop the loop if the current channel is one of 1, 6,
581 * or 11 and no SSID or BSSID filter is applied.
582 */
583 if (!filtered_scan &&
584 (tmp_chan_list->chan_number == 1 ||
585 tmp_chan_list->chan_number == 6 ||
586 tmp_chan_list->chan_number == 11))
587 done_early = true;
588
589 /* Advance the tmp pointer to the next channel to be scanned. */
590 tmp_chan_list++;
591
592 /*
593 * Stop the loop if the next channel is one of 1, 6,
594 * or 11. This causes that channel to be scanned alone
595 * in the next iteration.
596 */
597 if (!filtered_scan &&
598 (tmp_chan_list->chan_number == 1 ||
599 tmp_chan_list->chan_number == 6 ||
600 tmp_chan_list->chan_number == 11))
601 done_early = true;
602 }
603
604 /* Ensure the total scan time does not exceed the scan-command timeout. */
605 if (total_scan_time > NXPWIFI_MAX_TOTAL_SCAN_TIME) {
606 nxpwifi_dbg(priv->adapter, ERROR,
607 "total scan time %dms\t"
608 "is over limit (%dms), scan skipped\n",
609 total_scan_time,
610 NXPWIFI_MAX_TOTAL_SCAN_TIME);
611 ret = -EINVAL;
612 break;
613 }
614
615 rates_size = nxpwifi_append_rate_tlv(priv, scan_cfg_out,
616 radio_type);
617
618 if (priv->adapter->ext_scan)
619 cmd_no = HOST_CMD_802_11_SCAN_EXT;
620 else
621 cmd_no = HOST_CMD_802_11_SCAN;
622
623 ret = nxpwifi_send_cmd(priv, cmd_no, HOST_ACT_GEN_SET,
624 0, scan_cfg_out, false);
625
626 /*
627 * The rate element is updated for each scan command, but the
628 * same starting pointer is reused, so the previous rate element
629 * in scan_cfg_out->buf is overwritten.
630 */
631 scan_cfg_out->tlv_buf_len -=
632 sizeof(struct nxpwifi_ie_types_header) + rates_size;
633
634 if (ret) {
635 nxpwifi_cancel_pending_scan_cmd(adapter);
636 break;
637 }
638 }
639
640 return ret;
641 }
642
643 /*
644 * Build final scan config from user params, disabling missing filters and using
645 * defaults.
646 */
647 static void
nxpwifi_config_scan(struct nxpwifi_private * priv,const struct nxpwifi_user_scan_cfg * user_scan_in,struct nxpwifi_scan_cmd_config * scan_cfg_out,struct nxpwifi_ie_types_chan_list_param_set ** chan_list_out,struct nxpwifi_chan_scan_param_set * scan_chan_list,u8 * max_chan_per_scan,u8 * filtered_scan,u8 * scan_current_only)648 nxpwifi_config_scan(struct nxpwifi_private *priv,
649 const struct nxpwifi_user_scan_cfg *user_scan_in,
650 struct nxpwifi_scan_cmd_config *scan_cfg_out,
651 struct nxpwifi_ie_types_chan_list_param_set **chan_list_out,
652 struct nxpwifi_chan_scan_param_set *scan_chan_list,
653 u8 *max_chan_per_scan, u8 *filtered_scan,
654 u8 *scan_current_only)
655 {
656 struct nxpwifi_adapter *adapter = priv->adapter;
657 struct nxpwifi_ie_types_num_probes *num_probes_tlv;
658 struct nxpwifi_ie_types_scan_chan_gap *chan_gap_tlv;
659 struct nxpwifi_ie_types_random_mac *random_mac_tlv;
660 struct nxpwifi_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
661 struct nxpwifi_ie_types_bssid_list *bssid_tlv;
662 struct nxpwifi_ie_types_extcap *ext_cap;
663 u8 *ext_capab = NULL;
664 u8 *tlv_pos;
665 u32 num_probes;
666 u32 ssid_len;
667 u32 chan_idx;
668 u32 scan_time;
669 u32 scan_type;
670 u16 scan_dur;
671 u8 channel;
672 u8 radio_type;
673 int i, vsid;
674 u8 ssid_filter;
675 struct nxpwifi_ie_types_htcap *ht_cap;
676 struct nxpwifi_ie_types_bss_mode *bss_mode;
677 struct nxpwifi_ie_types_vhtcap *vht_cap;
678 struct nxpwifi_ie_types_he_cap *he_cap;
679
680 /*
681 * tlv_buf_len is recalculated for each scan command. TLVs added in this
682 * routine are preserved because the send routine appends channel TLVs
683 * at chan_list_out. The difference between chan_list_out and the start
684 * of the TLV buffer determines the size of the TLVs added here.
685 */
686 scan_cfg_out->tlv_buf_len = 0;
687
688 /*
689 * Running TLV pointer. It is assigned to chan_list_out at the end of
690 * the function so later routines know where channel TLVs can be
691 * appended in the command buffer.
692 */
693 tlv_pos = scan_cfg_out->tlv_buf;
694
695 /*
696 * Initialize the scan as un-filtered; the flag is later set to TRUE
697 * below if a SSID or BSSID filter is sent in the command
698 */
699 *filtered_scan = false;
700
701 /*
702 * Initialize the scan as not being only on the current channel. If
703 * the channel list is customized, only contains one channel, and is
704 * the active channel, this is set true and data flow is not halted.
705 */
706 *scan_current_only = false;
707
708 if (user_scan_in) {
709 u8 tmpaddr[ETH_ALEN];
710
711 /*
712 * Default the ssid_filter flag to TRUE, set false under
713 * certain wildcard conditions and qualified by the existence
714 * of an SSID list before marking the scan as filtered
715 */
716 ssid_filter = true;
717
718 /*
719 * Set the BSS type scan filter, use Adapter setting if
720 * unset
721 */
722 scan_cfg_out->bss_mode =
723 (u8)(user_scan_in->bss_mode ?: adapter->scan_mode);
724
725 /*
726 * Set the number of probes to send, use Adapter setting
727 * if unset
728 */
729 num_probes = user_scan_in->num_probes ?: adapter->scan_probes;
730
731 /*
732 * Set the BSSID filter to the incoming configuration,
733 * if non-zero. If not set, it will remain disabled
734 * (all zeros).
735 */
736 memcpy(scan_cfg_out->specific_bssid,
737 user_scan_in->specific_bssid,
738 sizeof(scan_cfg_out->specific_bssid));
739
740 memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
741
742 if (adapter->ext_scan &&
743 !is_zero_ether_addr(tmpaddr)) {
744 bssid_tlv =
745 (struct nxpwifi_ie_types_bssid_list *)tlv_pos;
746 bssid_tlv->header.type = cpu_to_le16(TLV_TYPE_BSSID);
747 bssid_tlv->header.len = cpu_to_le16(ETH_ALEN);
748 memcpy(bssid_tlv->bssid, user_scan_in->specific_bssid,
749 ETH_ALEN);
750 tlv_pos += sizeof(struct nxpwifi_ie_types_bssid_list);
751 }
752
753 for (i = 0; i < user_scan_in->num_ssids; i++) {
754 ssid_len = user_scan_in->ssid_list[i].ssid_len;
755
756 wildcard_ssid_tlv =
757 (struct nxpwifi_ie_types_wildcard_ssid_params *)
758 tlv_pos;
759 wildcard_ssid_tlv->header.type =
760 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
761 wildcard_ssid_tlv->header.len =
762 cpu_to_le16((u16)(ssid_len + sizeof(u8)));
763
764 /*
765 * max_ssid_length = 0 tells firmware to perform
766 * specific scan for the SSID filled, whereas
767 * max_ssid_length = IEEE80211_MAX_SSID_LEN is for
768 * wildcard scan.
769 */
770 if (ssid_len)
771 wildcard_ssid_tlv->max_ssid_length = 0;
772 else
773 wildcard_ssid_tlv->max_ssid_length =
774 IEEE80211_MAX_SSID_LEN;
775
776 if (!memcmp(user_scan_in->ssid_list[i].ssid,
777 "DIRECT-", 7))
778 wildcard_ssid_tlv->max_ssid_length = 0xfe;
779
780 memcpy(wildcard_ssid_tlv->ssid,
781 user_scan_in->ssid_list[i].ssid, ssid_len);
782
783 tlv_pos += (sizeof(wildcard_ssid_tlv->header)
784 + le16_to_cpu(wildcard_ssid_tlv->header.len));
785
786 nxpwifi_dbg(adapter, INFO,
787 "info: scan: ssid[%d]: %s, %d\n",
788 i, wildcard_ssid_tlv->ssid,
789 wildcard_ssid_tlv->max_ssid_length);
790
791 /*
792 * Empty wildcard ssid with a maxlen will match many or
793 * potentially all SSIDs (maxlen == 32), therefore do
794 * not treat the scan as
795 * filtered.
796 */
797 if (!ssid_len && wildcard_ssid_tlv->max_ssid_length)
798 ssid_filter = false;
799 }
800
801 /*
802 * The default number of channels sent in the command is low to
803 * ensure the response buffer from the firmware does not
804 * truncate scan results. That is not an issue with an SSID
805 * or BSSID filter applied to the scan results in the firmware.
806 */
807 memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
808 if ((i && ssid_filter) ||
809 !is_zero_ether_addr(tmpaddr))
810 *filtered_scan = true;
811
812 if (user_scan_in->scan_chan_gap) {
813 nxpwifi_dbg(adapter, INFO,
814 "info: scan: channel gap = %d\n",
815 user_scan_in->scan_chan_gap);
816 *max_chan_per_scan =
817 NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN;
818
819 chan_gap_tlv = (void *)tlv_pos;
820 chan_gap_tlv->header.type =
821 cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
822 chan_gap_tlv->header.len =
823 cpu_to_le16(sizeof(chan_gap_tlv->chan_gap));
824 chan_gap_tlv->chan_gap =
825 cpu_to_le16((user_scan_in->scan_chan_gap));
826 tlv_pos +=
827 sizeof(struct nxpwifi_ie_types_scan_chan_gap);
828 }
829
830 if (!is_zero_ether_addr(user_scan_in->random_mac)) {
831 random_mac_tlv = (void *)tlv_pos;
832 random_mac_tlv->header.type =
833 cpu_to_le16(TLV_TYPE_RANDOM_MAC);
834 random_mac_tlv->header.len =
835 cpu_to_le16(sizeof(random_mac_tlv->mac));
836 ether_addr_copy(random_mac_tlv->mac,
837 user_scan_in->random_mac);
838 tlv_pos +=
839 sizeof(struct nxpwifi_ie_types_random_mac);
840 }
841 } else {
842 scan_cfg_out->bss_mode = (u8)adapter->scan_mode;
843 num_probes = adapter->scan_probes;
844 }
845
846 /*
847 * If a specific BSSID or SSID is used, the number of channels in the
848 * scan command will be increased to the absolute maximum.
849 */
850 if (*filtered_scan) {
851 *max_chan_per_scan = NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN;
852 } else {
853 if (!priv->media_connected)
854 *max_chan_per_scan = NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD;
855 else
856 *max_chan_per_scan =
857 NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD / 2;
858 }
859
860 if (adapter->ext_scan) {
861 bss_mode = (struct nxpwifi_ie_types_bss_mode *)tlv_pos;
862 bss_mode->header.type = cpu_to_le16(TLV_TYPE_BSS_MODE);
863 bss_mode->header.len = cpu_to_le16(sizeof(bss_mode->bss_mode));
864 bss_mode->bss_mode = scan_cfg_out->bss_mode;
865 tlv_pos += sizeof(bss_mode->header) +
866 le16_to_cpu(bss_mode->header.len);
867 }
868
869 /*
870 * If the input config or adapter has the number of Probes set,
871 * add tlv
872 */
873 if (num_probes) {
874 nxpwifi_dbg(adapter, INFO,
875 "info: scan: num_probes = %d\n",
876 num_probes);
877
878 num_probes_tlv = (struct nxpwifi_ie_types_num_probes *)tlv_pos;
879 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
880 num_probes_tlv->header.len =
881 cpu_to_le16(sizeof(num_probes_tlv->num_probes));
882 num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);
883
884 tlv_pos += sizeof(num_probes_tlv->header) +
885 le16_to_cpu(num_probes_tlv->header.len);
886 }
887
888 if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
889 (priv->config_bands & BAND_GN ||
890 priv->config_bands & BAND_AN)) {
891 ht_cap = (struct nxpwifi_ie_types_htcap *)tlv_pos;
892 memset(ht_cap, 0, sizeof(struct nxpwifi_ie_types_htcap));
893 ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
894 ht_cap->header.len =
895 cpu_to_le16(sizeof(struct ieee80211_ht_cap));
896 radio_type =
897 nxpwifi_band_to_radio_type(priv->config_bands);
898 nxpwifi_fill_cap_info(priv, radio_type, &ht_cap->ht_cap);
899 tlv_pos += sizeof(struct nxpwifi_ie_types_htcap);
900 }
901
902 if (ISSUPP_11ACENABLED(adapter->fw_cap_info) &&
903 (priv->config_bands & BAND_AAC)) {
904 vht_cap = (struct nxpwifi_ie_types_vhtcap *)tlv_pos;
905 memset(vht_cap, 0, sizeof(struct nxpwifi_ie_types_vhtcap));
906 vht_cap->header.type = cpu_to_le16(WLAN_EID_VHT_CAPABILITY);
907 vht_cap->header.len = cpu_to_le16(sizeof(struct ieee80211_vht_cap));
908 nxpwifi_fill_vht_cap_tlv(priv, &vht_cap->vht_cap, priv->config_bands);
909 tlv_pos += sizeof(*vht_cap);
910 }
911
912 if (ISSUPP_11AXENABLED(adapter->fw_cap_ext) &&
913 (priv->config_bands & BAND_GAX ||
914 priv->config_bands & BAND_AAX)) {
915 he_cap = (struct nxpwifi_ie_types_he_cap *)tlv_pos;
916 memset(he_cap, 0, sizeof(struct nxpwifi_ie_types_he_cap));
917 tlv_pos += nxpwifi_fill_he_cap_tlv(priv, he_cap, priv->config_bands);
918 }
919
920 if (nxpwifi_is_sta_11ax_twt_req_supported(priv)) {
921 for (vsid = 0; vsid < NXPWIFI_MAX_VSIE_NUM; vsid++) {
922 if (priv->vs_ie[vsid].mask & NXPWIFI_VSIE_MASK_SCAN) {
923 ext_capab = (u8 *)cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
924 priv->vs_ie[vsid].ie,
925 sizeof(priv->vs_ie[vsid].ie));
926 break;
927 }
928 }
929
930 if (ext_capab) {
931 ext_capab += 2;
932 } else {
933 ext_cap = (struct nxpwifi_ie_types_extcap *)tlv_pos;
934 memset(ext_cap, 0, sizeof(struct nxpwifi_ie_types_extcap) +
935 NXPWIFI_EXT_CAPAB_IE_LEN);
936 ext_cap->header.type = cpu_to_le16(WLAN_EID_EXT_CAPABILITY);
937 ext_cap->header.len = cpu_to_le16(NXPWIFI_EXT_CAPAB_IE_LEN);
938 ext_capab = ext_cap->ext_capab;
939 tlv_pos += sizeof(struct nxpwifi_ie_types_extcap) +
940 le16_to_cpu(ext_cap->header.len);
941 }
942
943 ext_capab[9] |= WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT;
944 }
945
946 /* Append vendor specific element TLV */
947 nxpwifi_cmd_append_vsie_tlv(priv, NXPWIFI_VSIE_MASK_SCAN, &tlv_pos);
948
949 /*
950 * Set the channel TLV output pointer to the end of the newly added TLVs
951 * (SSID, num_probes). Channel TLVs for each scan will be appended after
952 * these, preserving previously added TLVs.
953 */
954 *chan_list_out =
955 (struct nxpwifi_ie_types_chan_list_param_set *)tlv_pos;
956
957 if (user_scan_in && user_scan_in->chan_list[0].chan_number) {
958 nxpwifi_dbg(adapter, INFO,
959 "info: Scan: Using supplied channel list\n");
960
961 for (chan_idx = 0;
962 chan_idx < NXPWIFI_USER_SCAN_CHAN_MAX &&
963 user_scan_in->chan_list[chan_idx].chan_number;
964 chan_idx++) {
965 channel = user_scan_in->chan_list[chan_idx].chan_number;
966 scan_chan_list[chan_idx].chan_number = channel;
967
968 radio_type =
969 user_scan_in->chan_list[chan_idx].radio_type;
970 scan_chan_list[chan_idx].band_cfg = radio_type;
971
972 scan_type = user_scan_in->chan_list[chan_idx].scan_type;
973
974 if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
975 scan_chan_list[chan_idx].chan_scan_mode_bmap |=
976 (NXPWIFI_PASSIVE_SCAN |
977 NXPWIFI_HIDDEN_SSID_REPORT);
978 else
979 scan_chan_list[chan_idx].chan_scan_mode_bmap &=
980 ~NXPWIFI_PASSIVE_SCAN;
981
982 scan_chan_list[chan_idx].chan_scan_mode_bmap |=
983 NXPWIFI_DISABLE_CHAN_FILT;
984
985 scan_time = user_scan_in->chan_list[chan_idx].scan_time;
986
987 if (scan_time) {
988 scan_dur = (u16)scan_time;
989 } else {
990 if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
991 scan_dur = adapter->passive_scan_time;
992 else if (*filtered_scan)
993 scan_dur = adapter->specific_scan_time;
994 else
995 scan_dur = adapter->active_scan_time;
996 }
997
998 scan_chan_list[chan_idx].min_scan_time =
999 cpu_to_le16(scan_dur);
1000 scan_chan_list[chan_idx].max_scan_time =
1001 cpu_to_le16(scan_dur);
1002 }
1003
1004 /* Check if we are only scanning the current channel */
1005 if (chan_idx == 1 &&
1006 user_scan_in->chan_list[0].chan_number ==
1007 priv->curr_bss_params.bss_descriptor.channel) {
1008 *scan_current_only = true;
1009 nxpwifi_dbg(adapter, INFO,
1010 "info: Scan: Scanning current channel only\n");
1011 }
1012 } else {
1013 nxpwifi_dbg(adapter, INFO,
1014 "info: Scan: Creating full region channel list\n");
1015 nxpwifi_scan_create_channel_list(priv, user_scan_in,
1016 scan_chan_list,
1017 *filtered_scan);
1018 }
1019 }
1020
1021 /* Parse the beacon buffer and update the BSS descriptor fields. */
nxpwifi_update_bss_desc_with_ie(struct nxpwifi_adapter * adapter,struct nxpwifi_bssdescriptor * bss_entry)1022 int nxpwifi_update_bss_desc_with_ie(struct nxpwifi_adapter *adapter,
1023 struct nxpwifi_bssdescriptor *bss_entry)
1024 {
1025 u8 element_id;
1026 u16 elem_size = sizeof(struct element);
1027 struct ieee_types_fh_param_set *fh_param_set;
1028 struct ieee_types_ds_param_set *ds_param_set;
1029 struct ieee_types_cf_param_set *cf_param_set;
1030 u8 *current_ptr;
1031 u8 *rate;
1032 u8 element_len;
1033 u16 total_ie_len;
1034 u8 bytes_to_copy;
1035 u8 rate_size;
1036 u8 found_data_rate_ie;
1037 u32 bytes_left;
1038 struct ieee_types_vendor_specific *vendor_ie;
1039 const u8 wpa_oui[4] = { 0x00, 0x50, 0xf2, 0x01 };
1040 const u8 wmm_oui[4] = { 0x00, 0x50, 0xf2, 0x02 };
1041 struct element *elem;
1042
1043 found_data_rate_ie = false;
1044 rate_size = 0;
1045 current_ptr = bss_entry->beacon_buf;
1046 bytes_left = bss_entry->beacon_buf_size;
1047
1048 /* Process variable element */
1049 while (bytes_left >= 2) {
1050 element_id = *current_ptr;
1051 element_len = *(current_ptr + 1);
1052 total_ie_len = element_len + elem_size;
1053
1054 if (bytes_left < total_ie_len) {
1055 nxpwifi_dbg(adapter, ERROR,
1056 "err: InterpretIE: in processing\t"
1057 "element, bytes left < element length\n");
1058 return -EINVAL;
1059 }
1060 switch (element_id) {
1061 case WLAN_EID_SSID:
1062 if (element_len > IEEE80211_MAX_SSID_LEN)
1063 return -EINVAL;
1064 bss_entry->ssid.ssid_len = element_len;
1065 memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
1066 element_len);
1067 nxpwifi_dbg(adapter, INFO,
1068 "info: InterpretIE: ssid: %-32s\n",
1069 bss_entry->ssid.ssid);
1070 break;
1071
1072 case WLAN_EID_SUPP_RATES:
1073 if (element_len > NXPWIFI_SUPPORTED_RATES)
1074 return -EINVAL;
1075 memcpy(bss_entry->data_rates, current_ptr + 2,
1076 element_len);
1077 memcpy(bss_entry->supported_rates, current_ptr + 2,
1078 element_len);
1079 rate_size = element_len;
1080 found_data_rate_ie = true;
1081 break;
1082
1083 case WLAN_EID_FH_PARAMS:
1084 if (total_ie_len < sizeof(*fh_param_set))
1085 return -EINVAL;
1086 fh_param_set =
1087 (struct ieee_types_fh_param_set *)current_ptr;
1088 memcpy(&bss_entry->phy_param_set.fh_param_set,
1089 fh_param_set,
1090 sizeof(struct ieee_types_fh_param_set));
1091 break;
1092
1093 case WLAN_EID_DS_PARAMS:
1094 if (total_ie_len < sizeof(*ds_param_set))
1095 return -EINVAL;
1096 ds_param_set =
1097 (struct ieee_types_ds_param_set *)current_ptr;
1098
1099 bss_entry->channel = ds_param_set->current_chan;
1100
1101 memcpy(&bss_entry->phy_param_set.ds_param_set,
1102 ds_param_set,
1103 sizeof(struct ieee_types_ds_param_set));
1104 break;
1105
1106 case WLAN_EID_CF_PARAMS:
1107 if (total_ie_len < sizeof(*cf_param_set))
1108 return -EINVAL;
1109 cf_param_set =
1110 (struct ieee_types_cf_param_set *)current_ptr;
1111 memcpy(&bss_entry->cf_param_set,
1112 cf_param_set,
1113 sizeof(struct ieee_types_cf_param_set));
1114 break;
1115
1116 case WLAN_EID_ERP_INFO:
1117 if (!element_len)
1118 return -EINVAL;
1119 bss_entry->erp_flags = *(current_ptr + 2);
1120 break;
1121
1122 case WLAN_EID_PWR_CONSTRAINT:
1123 if (!element_len)
1124 return -EINVAL;
1125 bss_entry->local_constraint = *(current_ptr + 2);
1126 bss_entry->sensed_11h = true;
1127 break;
1128
1129 case WLAN_EID_CHANNEL_SWITCH:
1130 bss_entry->chan_sw_ie_present = true;
1131 fallthrough;
1132 case WLAN_EID_PWR_CAPABILITY:
1133 case WLAN_EID_TPC_REPORT:
1134 case WLAN_EID_QUIET:
1135 bss_entry->sensed_11h = true;
1136 break;
1137
1138 case WLAN_EID_EXT_SUPP_RATES:
1139 /*
1140 * Only process extended supported rate
1141 * if data rate is already found.
1142 * Data rate element should come before
1143 * extended supported rate element
1144 */
1145 if (found_data_rate_ie) {
1146 if ((element_len + rate_size) >
1147 NXPWIFI_SUPPORTED_RATES)
1148 bytes_to_copy =
1149 (NXPWIFI_SUPPORTED_RATES -
1150 rate_size);
1151 else
1152 bytes_to_copy = element_len;
1153
1154 rate = (u8 *)bss_entry->data_rates;
1155 rate += rate_size;
1156 memcpy(rate, current_ptr + 2, bytes_to_copy);
1157
1158 rate = (u8 *)bss_entry->supported_rates;
1159 rate += rate_size;
1160 memcpy(rate, current_ptr + 2, bytes_to_copy);
1161 }
1162 break;
1163
1164 case WLAN_EID_VENDOR_SPECIFIC:
1165 vendor_ie = (struct ieee_types_vendor_specific *)
1166 current_ptr;
1167
1168 /* 802.11 requires at least 3-byte OUI. */
1169 if (element_len < sizeof(vendor_ie->vend_hdr.oui))
1170 return -EINVAL;
1171
1172 /* Not long enough for a match? Skip it. */
1173 if (element_len < sizeof(wpa_oui))
1174 break;
1175
1176 if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
1177 sizeof(wpa_oui))) {
1178 bss_entry->bcn_wpa_ie =
1179 (struct ieee_types_vendor_specific *)
1180 current_ptr;
1181 bss_entry->wpa_offset =
1182 (u16)(current_ptr -
1183 bss_entry->beacon_buf);
1184 } else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
1185 sizeof(wmm_oui))) {
1186 if (total_ie_len ==
1187 sizeof(struct ieee80211_wmm_param_ie) ||
1188 total_ie_len ==
1189 sizeof(struct ieee_types_wmm_info))
1190 /*
1191 * Only accept and copy the WMM element if
1192 * it matches the size expected for the
1193 * WMM Info element or the WMM Parameter element.
1194 */
1195 memcpy((u8 *)&bss_entry->wmm_ie,
1196 current_ptr, total_ie_len);
1197 }
1198 break;
1199 case WLAN_EID_RSN:
1200 bss_entry->bcn_rsn_ie =
1201 (struct element *)current_ptr;
1202 bss_entry->rsn_offset =
1203 (u16)(current_ptr - bss_entry->beacon_buf);
1204 break;
1205 case WLAN_EID_RSNX:
1206 bss_entry->bcn_rsnx_ie =
1207 (struct element *)current_ptr;
1208 bss_entry->rsnx_offset =
1209 (u16)(current_ptr - bss_entry->beacon_buf);
1210 break;
1211 case WLAN_EID_HT_CAPABILITY:
1212 bss_entry->bcn_ht_cap =
1213 (struct ieee80211_ht_cap *)(current_ptr +
1214 elem_size);
1215 bss_entry->ht_cap_offset =
1216 (u16)(current_ptr + elem_size -
1217 bss_entry->beacon_buf);
1218 break;
1219 case WLAN_EID_HT_OPERATION:
1220 bss_entry->bcn_ht_oper =
1221 (struct ieee80211_ht_operation *)(current_ptr +
1222 elem_size);
1223 bss_entry->ht_info_offset =
1224 (u16)(current_ptr + elem_size -
1225 bss_entry->beacon_buf);
1226 break;
1227 case WLAN_EID_VHT_CAPABILITY:
1228 bss_entry->disable_11ac = false;
1229 bss_entry->bcn_vht_cap = (void *)(current_ptr +
1230 elem_size);
1231 bss_entry->vht_cap_offset =
1232 (u16)((u8 *)bss_entry->bcn_vht_cap -
1233 bss_entry->beacon_buf);
1234 break;
1235 case WLAN_EID_VHT_OPERATION:
1236 bss_entry->bcn_vht_oper =
1237 (void *)(current_ptr + elem_size);
1238 bss_entry->vht_info_offset =
1239 (u16)((u8 *)bss_entry->bcn_vht_oper -
1240 bss_entry->beacon_buf);
1241 break;
1242 case WLAN_EID_BSS_COEX_2040:
1243 bss_entry->bcn_bss_co_2040 = current_ptr;
1244 bss_entry->bss_co_2040_offset =
1245 (u16)(current_ptr - bss_entry->beacon_buf);
1246 break;
1247 case WLAN_EID_EXT_CAPABILITY:
1248 bss_entry->bcn_ext_cap = current_ptr;
1249 bss_entry->ext_cap_offset =
1250 (u16)(current_ptr - bss_entry->beacon_buf);
1251 break;
1252 case WLAN_EID_OPMODE_NOTIF:
1253 bss_entry->oper_mode = (void *)current_ptr;
1254 bss_entry->oper_mode_offset =
1255 (u16)(current_ptr - bss_entry->beacon_buf);
1256 break;
1257 case WLAN_EID_EXTENSION:
1258 if (!element_len)
1259 return -EINVAL;
1260
1261 elem = (struct element *)current_ptr;
1262
1263 switch (elem->data[0]) {
1264 case WLAN_EID_EXT_HE_CAPABILITY:
1265 bss_entry->disable_11ax = false;
1266 bss_entry->bcn_he_cap =
1267 (void *)(current_ptr + elem_size + 1);
1268 bss_entry->he_cap_offset =
1269 (u16)((u8 *)bss_entry->bcn_he_cap -
1270 bss_entry->beacon_buf);
1271 break;
1272 case WLAN_EID_EXT_HE_OPERATION:
1273 bss_entry->bcn_he_oper =
1274 (void *)(current_ptr + elem_size + 1);
1275 bss_entry->he_info_offset =
1276 (u16)((u8 *)bss_entry->bcn_he_oper -
1277 bss_entry->beacon_buf);
1278 break;
1279 default:
1280 break;
1281 }
1282 break;
1283 default:
1284 break;
1285 }
1286
1287 current_ptr += total_ie_len;
1288 bytes_left -= total_ie_len;
1289
1290 } /* while (bytes_left > 2) */
1291 return 0;
1292 }
1293
1294 /* Convert the radio-type scan parameter to the join command's band config. */
1295 static u8
nxpwifi_radio_type_to_band(u8 radio_type)1296 nxpwifi_radio_type_to_band(u8 radio_type)
1297 {
1298 switch (radio_type) {
1299 case HOST_SCAN_RADIO_TYPE_A:
1300 return BAND_A;
1301 case HOST_SCAN_RADIO_TYPE_BG:
1302 default:
1303 return BAND_G;
1304 }
1305 }
1306
1307 /* Internal helper to start a scan using the given configuration. */
nxpwifi_scan_networks(struct nxpwifi_private * priv,const struct nxpwifi_user_scan_cfg * user_scan_in)1308 int nxpwifi_scan_networks(struct nxpwifi_private *priv,
1309 const struct nxpwifi_user_scan_cfg *user_scan_in)
1310 {
1311 int ret;
1312 struct nxpwifi_adapter *adapter = priv->adapter;
1313 struct cmd_ctrl_node *cmd_node;
1314 union nxpwifi_scan_cmd_config_tlv *scan_cfg_out;
1315 struct nxpwifi_ie_types_chan_list_param_set *chan_list_out;
1316 struct nxpwifi_chan_scan_param_set *scan_chan_list;
1317 u8 filtered_scan;
1318 u8 scan_current_chan_only;
1319 u8 max_chan_per_scan;
1320
1321 if (adapter->scan_processing) {
1322 nxpwifi_dbg(adapter, WARN,
1323 "cmd: Scan already in process...\n");
1324 return -EBUSY;
1325 }
1326
1327 if (priv->scan_block) {
1328 nxpwifi_dbg(adapter, WARN,
1329 "cmd: Scan is blocked during association...\n");
1330 return -EBUSY;
1331 }
1332
1333 if (test_bit(NXPWIFI_SURPRISE_REMOVED, &adapter->work_flags) ||
1334 test_bit(NXPWIFI_IS_CMD_TIMEDOUT, &adapter->work_flags)) {
1335 nxpwifi_dbg(adapter, ERROR,
1336 "Ignore scan. Card removed or firmware in bad state\n");
1337 return -EPERM;
1338 }
1339
1340 spin_lock_bh(&adapter->nxpwifi_cmd_lock);
1341 adapter->scan_processing = true;
1342 spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
1343
1344 scan_cfg_out = kzalloc_obj(union nxpwifi_scan_cmd_config_tlv,
1345 GFP_KERNEL);
1346 if (!scan_cfg_out) {
1347 ret = -ENOMEM;
1348 goto done;
1349 }
1350
1351 scan_chan_list = kzalloc_objs(struct nxpwifi_chan_scan_param_set,
1352 NXPWIFI_USER_SCAN_CHAN_MAX, GFP_KERNEL);
1353 if (!scan_chan_list) {
1354 kfree(scan_cfg_out);
1355 ret = -ENOMEM;
1356 goto done;
1357 }
1358
1359 nxpwifi_config_scan(priv, user_scan_in, &scan_cfg_out->config,
1360 &chan_list_out, scan_chan_list, &max_chan_per_scan,
1361 &filtered_scan, &scan_current_chan_only);
1362
1363 ret = nxpwifi_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
1364 &scan_cfg_out->config, chan_list_out,
1365 scan_chan_list);
1366
1367 /* Get scan command from scan_pending_q and put to cmd_pending_q */
1368 if (!ret) {
1369 spin_lock_bh(&adapter->scan_pending_q_lock);
1370 if (!list_empty(&adapter->scan_pending_q)) {
1371 cmd_node = list_first_entry(&adapter->scan_pending_q,
1372 struct cmd_ctrl_node, list);
1373 list_del(&cmd_node->list);
1374 spin_unlock_bh(&adapter->scan_pending_q_lock);
1375 nxpwifi_insert_cmd_to_pending_q(adapter, cmd_node);
1376 nxpwifi_queue_work(adapter, &adapter->main_work);
1377
1378 /* Perform internal scan synchronously */
1379 if (!priv->scan_request) {
1380 nxpwifi_dbg(adapter, INFO,
1381 "wait internal scan\n");
1382 nxpwifi_wait_queue_complete(adapter, cmd_node);
1383 }
1384 } else {
1385 spin_unlock_bh(&adapter->scan_pending_q_lock);
1386 }
1387 }
1388
1389 kfree(scan_cfg_out);
1390 kfree(scan_chan_list);
1391 done:
1392 if (ret) {
1393 spin_lock_bh(&adapter->nxpwifi_cmd_lock);
1394 adapter->scan_processing = false;
1395 spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
1396 }
1397 return ret;
1398 }
1399
1400 /*
1401 * Build the firmware scan command from the given configuration, including
1402 * fixed fields and TLVs, and set the command ID, size, and endianness.
1403 */
nxpwifi_cmd_802_11_scan(struct host_cmd_ds_command * cmd,struct nxpwifi_scan_cmd_config * scan_cfg)1404 int nxpwifi_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
1405 struct nxpwifi_scan_cmd_config *scan_cfg)
1406 {
1407 struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;
1408
1409 /* Set fixed field variables in scan command */
1410 scan_cmd->bss_mode = scan_cfg->bss_mode;
1411 memcpy(scan_cmd->bssid, scan_cfg->specific_bssid,
1412 sizeof(scan_cmd->bssid));
1413 memcpy(scan_cmd->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
1414
1415 cmd->command = cpu_to_le16(HOST_CMD_802_11_SCAN);
1416
1417 /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
1418 cmd->size = cpu_to_le16((u16)(sizeof(scan_cmd->bss_mode)
1419 + sizeof(scan_cmd->bssid)
1420 + scan_cfg->tlv_buf_len + S_DS_GEN));
1421
1422 return 0;
1423 }
1424
1425 /* Check compatibility of the requested network with current driver settings. */
nxpwifi_check_network_compatibility(struct nxpwifi_private * priv,struct nxpwifi_bssdescriptor * bss_desc)1426 int nxpwifi_check_network_compatibility(struct nxpwifi_private *priv,
1427 struct nxpwifi_bssdescriptor *bss_desc)
1428 {
1429 int ret = 0;
1430
1431 if (!bss_desc)
1432 return -EINVAL;
1433
1434 if ((nxpwifi_get_cfp(priv, (u8)bss_desc->bss_band,
1435 (u16)bss_desc->channel, 0))) {
1436 switch (priv->bss_mode) {
1437 case NL80211_IFTYPE_STATION:
1438 ret = nxpwifi_is_network_compatible(priv, bss_desc,
1439 priv->bss_mode);
1440 if (ret)
1441 nxpwifi_dbg(priv->adapter, ERROR,
1442 "Incompatible network settings\n");
1443 break;
1444 default:
1445 ret = 0;
1446 }
1447 }
1448
1449 return ret;
1450 }
1451
1452 /* Check if the SSID length is zero or all bytes are zero. */
nxpwifi_is_hidden_ssid(struct cfg80211_ssid * ssid)1453 static bool nxpwifi_is_hidden_ssid(struct cfg80211_ssid *ssid)
1454 {
1455 int idx;
1456
1457 for (idx = 0; idx < ssid->ssid_len; idx++) {
1458 if (ssid->ssid[idx])
1459 return false;
1460 }
1461
1462 return true;
1463 }
1464
1465 /* Find hidden SSIDs on passive channels and save those channels for active scan. */
nxpwifi_save_hidden_ssid_channels(struct nxpwifi_private * priv,struct cfg80211_bss * bss)1466 static int nxpwifi_save_hidden_ssid_channels(struct nxpwifi_private *priv,
1467 struct cfg80211_bss *bss)
1468 {
1469 struct nxpwifi_bssdescriptor *bss_desc;
1470 int ret;
1471 int chid;
1472
1473 /* Allocate and fill new bss descriptor */
1474 bss_desc = kzalloc_obj(*bss_desc, GFP_KERNEL);
1475 if (!bss_desc)
1476 return -ENOMEM;
1477
1478 ret = nxpwifi_fill_new_bss_desc(priv, bss, bss_desc);
1479 if (ret)
1480 goto done;
1481
1482 if (nxpwifi_is_hidden_ssid(&bss_desc->ssid)) {
1483 nxpwifi_dbg(priv->adapter, INFO, "found hidden SSID\n");
1484 for (chid = 0 ; chid < NXPWIFI_USER_SCAN_CHAN_MAX; chid++) {
1485 if (priv->hidden_chan[chid].chan_number ==
1486 bss->channel->hw_value)
1487 break;
1488
1489 if (!priv->hidden_chan[chid].chan_number) {
1490 priv->hidden_chan[chid].chan_number =
1491 bss->channel->hw_value;
1492 priv->hidden_chan[chid].radio_type =
1493 bss->channel->band;
1494 priv->hidden_chan[chid].scan_type =
1495 NXPWIFI_SCAN_TYPE_ACTIVE;
1496 break;
1497 }
1498 }
1499 }
1500
1501 done:
1502 /* Free beacon_ie allocated by nxpwifi_fill_new_bss_desc(). */
1503 kfree(bss_desc->beacon_buf);
1504 kfree(bss_desc);
1505 return ret;
1506 }
1507
nxpwifi_update_curr_bss_params(struct nxpwifi_private * priv,struct cfg80211_bss * bss)1508 static int nxpwifi_update_curr_bss_params(struct nxpwifi_private *priv,
1509 struct cfg80211_bss *bss)
1510 {
1511 struct nxpwifi_bssdescriptor *bss_desc;
1512 int ret;
1513
1514 /* Allocate and fill new bss descriptor */
1515 bss_desc = kzalloc_obj(*bss_desc, GFP_KERNEL);
1516 if (!bss_desc)
1517 return -ENOMEM;
1518
1519 ret = nxpwifi_fill_new_bss_desc(priv, bss, bss_desc);
1520 if (ret)
1521 goto done;
1522
1523 ret = nxpwifi_check_network_compatibility(priv, bss_desc);
1524 if (ret)
1525 goto done;
1526
1527 spin_lock_bh(&priv->curr_bcn_buf_lock);
1528 /* Make a copy of current BSSID descriptor */
1529 memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
1530 sizeof(priv->curr_bss_params.bss_descriptor));
1531
1532 /* beacon_ie will be copied to its own buffer in nxpwifi_save_curr_bcn(). */
1533 nxpwifi_save_curr_bcn(priv);
1534 spin_unlock_bh(&priv->curr_bcn_buf_lock);
1535
1536 done:
1537 /* Free beacon_ie allocated by nxpwifi_fill_new_bss_desc(). */
1538 kfree(bss_desc->beacon_buf);
1539 kfree(bss_desc);
1540 return ret;
1541 }
1542
1543 static int
nxpwifi_parse_single_response_buf(struct nxpwifi_private * priv,u8 ** bss_info,u32 * bytes_left,u64 fw_tsf,const u8 * radio_type,bool ext_scan,s32 rssi_val)1544 nxpwifi_parse_single_response_buf(struct nxpwifi_private *priv, u8 **bss_info,
1545 u32 *bytes_left, u64 fw_tsf, const u8 *radio_type,
1546 bool ext_scan, s32 rssi_val)
1547 {
1548 struct nxpwifi_adapter *adapter = priv->adapter;
1549 struct nxpwifi_chan_freq_power *cfp;
1550 struct cfg80211_bss *bss;
1551 u8 bssid[ETH_ALEN];
1552 s32 rssi;
1553 const u8 *ie_buf;
1554 size_t ie_len;
1555 u16 channel = 0;
1556 u16 beacon_size = 0;
1557 u32 curr_bcn_bytes;
1558 u32 freq;
1559 u16 beacon_period;
1560 u16 cap_info_bitmap;
1561 u8 *current_ptr;
1562 u64 timestamp;
1563 struct nxpwifi_fixed_bcn_param *bcn_param;
1564 struct nxpwifi_bss_priv *bss_priv;
1565
1566 if (*bytes_left >= sizeof(beacon_size)) {
1567 /* Extract & convert beacon size from command buffer */
1568 beacon_size = get_unaligned_le16((*bss_info));
1569 *bytes_left -= sizeof(beacon_size);
1570 *bss_info += sizeof(beacon_size);
1571 }
1572
1573 if (!beacon_size || beacon_size > *bytes_left) {
1574 *bss_info += *bytes_left;
1575 *bytes_left = 0;
1576 return -EINVAL;
1577 }
1578
1579 /*
1580 * Initialize the current working beacon pointer for this BSS
1581 * iteration
1582 */
1583 current_ptr = *bss_info;
1584
1585 /* Advance the return beacon pointer past the current beacon */
1586 *bss_info += beacon_size;
1587 *bytes_left -= beacon_size;
1588
1589 curr_bcn_bytes = beacon_size;
1590
1591 /*
1592 * First 5 fields are bssid, RSSI(for legacy scan only),
1593 * time stamp, beacon interval, and capability information
1594 */
1595 if (curr_bcn_bytes < ETH_ALEN + sizeof(u8) +
1596 sizeof(struct nxpwifi_fixed_bcn_param)) {
1597 nxpwifi_dbg(adapter, ERROR,
1598 "InterpretIE: not enough bytes left\n");
1599 return -EINVAL;
1600 }
1601
1602 memcpy(bssid, current_ptr, ETH_ALEN);
1603 current_ptr += ETH_ALEN;
1604 curr_bcn_bytes -= ETH_ALEN;
1605
1606 if (!ext_scan) {
1607 rssi = (s32)*current_ptr;
1608 rssi = (-rssi) * 100; /* Convert dBm to mBm */
1609 current_ptr += sizeof(u8);
1610 curr_bcn_bytes -= sizeof(u8);
1611 nxpwifi_dbg(adapter, INFO,
1612 "info: InterpretIE: RSSI=%d\n", rssi);
1613 } else {
1614 rssi = rssi_val;
1615 }
1616
1617 bcn_param = (struct nxpwifi_fixed_bcn_param *)current_ptr;
1618 current_ptr += sizeof(*bcn_param);
1619 curr_bcn_bytes -= sizeof(*bcn_param);
1620
1621 timestamp = le64_to_cpu(bcn_param->timestamp);
1622 beacon_period = le16_to_cpu(bcn_param->beacon_period);
1623
1624 cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
1625 nxpwifi_dbg(adapter, INFO,
1626 "info: InterpretIE: capabilities=0x%X\n",
1627 cap_info_bitmap);
1628
1629 /* Rest of the current buffer are element's */
1630 ie_buf = current_ptr;
1631 ie_len = curr_bcn_bytes;
1632 nxpwifi_dbg(adapter, INFO,
1633 "info: InterpretIE: IELength for this AP = %d\n",
1634 curr_bcn_bytes);
1635
1636 while (curr_bcn_bytes >= sizeof(struct element)) {
1637 u8 element_id, element_len;
1638
1639 element_id = *current_ptr;
1640 element_len = *(current_ptr + 1);
1641 if (curr_bcn_bytes < element_len +
1642 sizeof(struct element)) {
1643 nxpwifi_dbg(adapter, ERROR,
1644 "%s: bytes left < element length\n", __func__);
1645 return -EFAULT;
1646 }
1647 if (element_id == WLAN_EID_DS_PARAMS) {
1648 channel = *(current_ptr +
1649 sizeof(struct element));
1650 break;
1651 }
1652
1653 current_ptr += element_len + sizeof(struct element);
1654 curr_bcn_bytes -= element_len +
1655 sizeof(struct element);
1656 }
1657
1658 if (channel) {
1659 struct ieee80211_channel *chan;
1660 struct nxpwifi_bssdescriptor *bss_desc;
1661 u8 band;
1662
1663 /* Skip entry if on csa closed channel */
1664 if (channel == priv->csa_chan) {
1665 nxpwifi_dbg(adapter, WARN,
1666 "Dropping entry on csa closed channel\n");
1667 return 0;
1668 }
1669
1670 band = BAND_G;
1671 if (radio_type)
1672 band = nxpwifi_radio_type_to_band(*radio_type &
1673 (BIT(0) | BIT(1)));
1674
1675 cfp = nxpwifi_get_cfp(priv, band, channel, 0);
1676
1677 freq = cfp ? cfp->freq : 0;
1678
1679 chan = ieee80211_get_channel(priv->wdev.wiphy, freq);
1680
1681 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
1682 bss = cfg80211_inform_bss(priv->wdev.wiphy, chan,
1683 CFG80211_BSS_FTYPE_UNKNOWN,
1684 bssid, timestamp,
1685 cap_info_bitmap,
1686 beacon_period,
1687 ie_buf, ie_len, rssi,
1688 GFP_ATOMIC);
1689 if (bss) {
1690 bss_priv = (struct nxpwifi_bss_priv *)bss->priv;
1691 bss_priv->band = band;
1692 bss_priv->fw_tsf = fw_tsf;
1693 bss_desc =
1694 &priv->curr_bss_params.bss_descriptor;
1695 if (priv->media_connected &&
1696 !memcmp(bssid, bss_desc->mac_address,
1697 ETH_ALEN))
1698 nxpwifi_update_curr_bss_params(priv,
1699 bss);
1700
1701 if ((chan->flags & IEEE80211_CHAN_RADAR) ||
1702 (chan->flags & IEEE80211_CHAN_NO_IR)) {
1703 nxpwifi_dbg(adapter, INFO,
1704 "radar or passive channel %d\n",
1705 channel);
1706 nxpwifi_save_hidden_ssid_channels(priv,
1707 bss);
1708 }
1709
1710 cfg80211_put_bss(priv->wdev.wiphy, bss);
1711 }
1712 }
1713 } else {
1714 nxpwifi_dbg(adapter, WARN, "missing BSS channel element\n");
1715 }
1716
1717 return 0;
1718 }
1719
nxpwifi_complete_scan(struct nxpwifi_private * priv)1720 static void nxpwifi_complete_scan(struct nxpwifi_private *priv)
1721 {
1722 struct nxpwifi_adapter *adapter = priv->adapter;
1723
1724 adapter->survey_idx = 0;
1725 if (adapter->curr_cmd->wait_q_enabled) {
1726 adapter->cmd_wait_q.status = 0;
1727 if (!priv->scan_request) {
1728 nxpwifi_dbg(adapter, INFO,
1729 "complete internal scan\n");
1730 nxpwifi_complete_cmd(adapter, adapter->curr_cmd);
1731 }
1732 }
1733 }
1734
1735 /* Find hidden SSIDs on passive channels and run active scans on them. */
1736 static int
nxpwifi_active_scan_req_for_passive_chan(struct nxpwifi_private * priv)1737 nxpwifi_active_scan_req_for_passive_chan(struct nxpwifi_private *priv)
1738 {
1739 int ret;
1740 struct nxpwifi_adapter *adapter = priv->adapter;
1741 u8 id = 0;
1742 struct nxpwifi_user_scan_cfg *user_scan_cfg;
1743
1744 if (adapter->active_scan_triggered || !priv->scan_request ||
1745 priv->scan_aborting) {
1746 adapter->active_scan_triggered = false;
1747 return 0;
1748 }
1749
1750 if (!priv->hidden_chan[0].chan_number) {
1751 nxpwifi_dbg(adapter, INFO, "No BSS with hidden SSID found on DFS channels\n");
1752 return 0;
1753 }
1754 user_scan_cfg = kzalloc_obj(*user_scan_cfg, GFP_KERNEL);
1755
1756 if (!user_scan_cfg)
1757 return -ENOMEM;
1758
1759 for (id = 0; id < NXPWIFI_USER_SCAN_CHAN_MAX; id++) {
1760 if (!priv->hidden_chan[id].chan_number)
1761 break;
1762 memcpy(&user_scan_cfg->chan_list[id],
1763 &priv->hidden_chan[id],
1764 sizeof(struct nxpwifi_user_scan_chan));
1765 }
1766
1767 adapter->active_scan_triggered = true;
1768 if (priv->scan_request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
1769 ether_addr_copy(user_scan_cfg->random_mac,
1770 priv->scan_request->mac_addr);
1771 user_scan_cfg->num_ssids = priv->scan_request->n_ssids;
1772 user_scan_cfg->ssid_list = priv->scan_request->ssids;
1773
1774 ret = nxpwifi_scan_networks(priv, user_scan_cfg);
1775 kfree(user_scan_cfg);
1776
1777 memset(&priv->hidden_chan, 0, sizeof(priv->hidden_chan));
1778
1779 if (ret)
1780 nxpwifi_dbg(adapter, ERROR, "scan failed: %d\n", ret);
1781
1782 return ret;
1783 }
1784
nxpwifi_check_next_scan_command(struct nxpwifi_private * priv)1785 static void nxpwifi_check_next_scan_command(struct nxpwifi_private *priv)
1786 {
1787 struct nxpwifi_adapter *adapter = priv->adapter;
1788 struct cmd_ctrl_node *cmd_node;
1789
1790 spin_lock_bh(&adapter->scan_pending_q_lock);
1791 if (list_empty(&adapter->scan_pending_q)) {
1792 spin_unlock_bh(&adapter->scan_pending_q_lock);
1793
1794 spin_lock_bh(&adapter->nxpwifi_cmd_lock);
1795 adapter->scan_processing = false;
1796 spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
1797
1798 nxpwifi_active_scan_req_for_passive_chan(priv);
1799
1800 if (!adapter->ext_scan)
1801 nxpwifi_complete_scan(priv);
1802
1803 if (priv->scan_request) {
1804 struct cfg80211_scan_info info = {
1805 .aborted = false,
1806 };
1807
1808 nxpwifi_dbg(adapter, INFO,
1809 "info: notifying scan done\n");
1810 cfg80211_scan_done(priv->scan_request, &info);
1811 priv->scan_request = NULL;
1812 priv->scan_aborting = false;
1813 } else {
1814 priv->scan_aborting = false;
1815 nxpwifi_dbg(adapter, INFO,
1816 "info: scan already aborted\n");
1817 }
1818 } else if ((priv->scan_aborting && !priv->scan_request) ||
1819 priv->scan_block) {
1820 spin_unlock_bh(&adapter->scan_pending_q_lock);
1821
1822 nxpwifi_cancel_pending_scan_cmd(adapter);
1823
1824 spin_lock_bh(&adapter->nxpwifi_cmd_lock);
1825 adapter->scan_processing = false;
1826 spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
1827
1828 if (!adapter->active_scan_triggered) {
1829 if (priv->scan_request) {
1830 struct cfg80211_scan_info info = {
1831 .aborted = true,
1832 };
1833
1834 nxpwifi_dbg(adapter, INFO,
1835 "info: aborting scan\n");
1836 cfg80211_scan_done(priv->scan_request, &info);
1837 priv->scan_request = NULL;
1838 priv->scan_aborting = false;
1839 } else {
1840 priv->scan_aborting = false;
1841 nxpwifi_dbg(adapter, INFO,
1842 "info: scan already aborted\n");
1843 }
1844 }
1845 } else {
1846 /* Move a scan command from scan_pending_q to cmd_pending_q. */
1847 cmd_node = list_first_entry(&adapter->scan_pending_q,
1848 struct cmd_ctrl_node, list);
1849 list_del(&cmd_node->list);
1850 spin_unlock_bh(&adapter->scan_pending_q_lock);
1851 nxpwifi_insert_cmd_to_pending_q(adapter, cmd_node);
1852 }
1853 }
1854
nxpwifi_cancel_scan(struct nxpwifi_adapter * adapter)1855 void nxpwifi_cancel_scan(struct nxpwifi_adapter *adapter)
1856 {
1857 struct nxpwifi_private *priv;
1858 int i;
1859
1860 nxpwifi_cancel_pending_scan_cmd(adapter);
1861
1862 if (adapter->scan_processing) {
1863 spin_lock_bh(&adapter->nxpwifi_cmd_lock);
1864 adapter->scan_processing = false;
1865 spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
1866 for (i = 0; i < adapter->priv_num; i++) {
1867 priv = adapter->priv[i];
1868 if (priv->scan_request) {
1869 struct cfg80211_scan_info info = {
1870 .aborted = true,
1871 };
1872
1873 nxpwifi_dbg(adapter, INFO,
1874 "info: aborting scan\n");
1875 cfg80211_scan_done(priv->scan_request, &info);
1876 priv->scan_request = NULL;
1877 priv->scan_aborting = false;
1878 }
1879 }
1880 }
1881 }
1882
1883 /*
1884 * Handle the scan command response.
1885 *
1886 * The scan response buffer has the following layout:
1887 *
1888 * -------------------------------------------------------------
1889 * | Header (4 * t_u16): standard command response header |
1890 * -------------------------------------------------------------
1891 * | BufSize (t_u16): size of the BSS description data |
1892 * -------------------------------------------------------------
1893 * | NumOfSet (t_u8): number of returned BSS descriptions |
1894 * -------------------------------------------------------------
1895 * | BSS description data (variable, size = BufSize) |
1896 * -------------------------------------------------------------
1897 * | TLV data (variable, size = cmd_size - fixed fields) |
1898 * -------------------------------------------------------------
1899 */
nxpwifi_ret_802_11_scan(struct nxpwifi_private * priv,struct host_cmd_ds_command * resp)1900 int nxpwifi_ret_802_11_scan(struct nxpwifi_private *priv,
1901 struct host_cmd_ds_command *resp)
1902 {
1903 int ret = 0;
1904 struct nxpwifi_adapter *adapter = priv->adapter;
1905 struct host_cmd_ds_802_11_scan_rsp *scan_rsp;
1906 u8 *tlv_data;
1907 const struct nxpwifi_ie_types_tsf_timestamp *tsf_tlv;
1908 u8 *bss_info;
1909 u32 scan_resp_size;
1910 u32 bytes_left;
1911 u32 idx;
1912 u32 tlv_buf_size;
1913 const struct nxpwifi_ie_types_chan_band_list_param_set *chan_band_tlv;
1914 const struct chan_band_param_set *chan_band;
1915 u8 is_bgscan_resp;
1916 __le64 fw_tsf = 0;
1917 const u8 *radio_type;
1918 struct cfg80211_wowlan_nd_match *pmatch;
1919 struct cfg80211_sched_scan_request *nd_config = NULL;
1920
1921 is_bgscan_resp = (le16_to_cpu(resp->command)
1922 == HOST_CMD_802_11_BG_SCAN_QUERY);
1923 if (is_bgscan_resp)
1924 scan_rsp = &resp->params.bg_scan_query_resp.scan_resp;
1925 else
1926 scan_rsp = &resp->params.scan_resp;
1927
1928 if (scan_rsp->number_of_sets > NXPWIFI_MAX_AP) {
1929 nxpwifi_dbg(adapter, ERROR,
1930 "SCAN_RESP: too many AP returned (%d)\n",
1931 scan_rsp->number_of_sets);
1932 ret = -EINVAL;
1933 goto check_next_scan;
1934 }
1935
1936 /* Check csa channel expiry before parsing scan response */
1937 nxpwifi_11h_get_csa_closed_channel(priv);
1938
1939 bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
1940 nxpwifi_dbg(adapter, INFO,
1941 "info: SCAN_RESP: bss_descript_size %d\n",
1942 bytes_left);
1943
1944 scan_resp_size = le16_to_cpu(resp->size);
1945
1946 nxpwifi_dbg(adapter, INFO,
1947 "info: SCAN_RESP: returned %d APs before parsing\n",
1948 scan_rsp->number_of_sets);
1949
1950 bss_info = scan_rsp->bss_desc_and_tlv_buffer;
1951
1952 /*
1953 * TLV buffer size = scan_resp_size minus the fixed fields, BSS
1954 * description data, and the command response header (S_DS_GEN).
1955 */
1956 tlv_buf_size = scan_resp_size - (bytes_left
1957 + sizeof(scan_rsp->bss_descript_size)
1958 + sizeof(scan_rsp->number_of_sets)
1959 + S_DS_GEN);
1960
1961 tlv_data = (scan_rsp->bss_desc_and_tlv_buffer +
1962 bytes_left);
1963
1964 /* Find timestamp TLV */
1965 {
1966 const struct nxpwifi_tlv *t;
1967
1968 t = nxpwifi_find_tlv(TLV_TYPE_TSFTIMESTAMP, tlv_data, tlv_buf_size);
1969 tsf_tlv = (const struct nxpwifi_ie_types_tsf_timestamp *)t;
1970 }
1971
1972 /* Find channel-band list TLV */
1973 {
1974 const struct nxpwifi_tlv *t;
1975
1976 t = nxpwifi_find_tlv(TLV_TYPE_CHANNELBANDLIST, tlv_data,
1977 tlv_buf_size);
1978 chan_band_tlv =
1979 (const struct nxpwifi_ie_types_chan_band_list_param_set *)t;
1980 }
1981
1982 #ifdef CONFIG_PM
1983 if (priv->wdev.wiphy->wowlan_config)
1984 nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
1985 #endif
1986
1987 if (nd_config) {
1988 adapter->nd_info =
1989 kzalloc_flex(*adapter->nd_info, matches,
1990 scan_rsp->number_of_sets, GFP_ATOMIC);
1991
1992 if (adapter->nd_info)
1993 adapter->nd_info->n_matches = scan_rsp->number_of_sets;
1994 }
1995
1996 for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
1997 /*
1998 * If a TSF TLV is present, save its TSF value in fw_tsf. This
1999 * is the firmware TSF at the time the beacon or probe response
2000 * was received.
2001 */
2002 if (tsf_tlv)
2003 memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
2004 sizeof(fw_tsf));
2005
2006 if (chan_band_tlv) {
2007 chan_band = &chan_band_tlv->chan_band_param[idx];
2008 radio_type = &chan_band->radio_type;
2009 } else {
2010 radio_type = NULL;
2011 }
2012
2013 if (chan_band_tlv && adapter->nd_info) {
2014 adapter->nd_info->matches[idx] =
2015 kzalloc(sizeof(*pmatch) + sizeof(u32),
2016 GFP_ATOMIC);
2017
2018 pmatch = adapter->nd_info->matches[idx];
2019
2020 if (pmatch) {
2021 pmatch->n_channels = 1;
2022 pmatch->channels[0] = chan_band->chan_number;
2023 }
2024 }
2025
2026 ret = nxpwifi_parse_single_response_buf(priv, &bss_info,
2027 &bytes_left,
2028 le64_to_cpu(fw_tsf),
2029 radio_type, false, 0);
2030 if (ret)
2031 goto check_next_scan;
2032 }
2033
2034 check_next_scan:
2035 nxpwifi_check_next_scan_command(priv);
2036 return ret;
2037 }
2038
2039 /*
2040 * Prepare the extended scan command using the provided scan configuration
2041 * and build the structure to be sent to firmware.
2042 */
nxpwifi_cmd_802_11_scan_ext(struct nxpwifi_private * priv,struct host_cmd_ds_command * cmd,void * data_buf)2043 int nxpwifi_cmd_802_11_scan_ext(struct nxpwifi_private *priv,
2044 struct host_cmd_ds_command *cmd,
2045 void *data_buf)
2046 {
2047 struct host_cmd_ds_802_11_scan_ext *ext_scan = &cmd->params.ext_scan;
2048 struct nxpwifi_scan_cmd_config *scan_cfg = data_buf;
2049
2050 memcpy(ext_scan->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
2051
2052 cmd->command = cpu_to_le16(HOST_CMD_802_11_SCAN_EXT);
2053
2054 /* Size is equal to the sizeof(fixed portions) + the TLV len + header */
2055 cmd->size = cpu_to_le16((u16)(sizeof(ext_scan->reserved)
2056 + scan_cfg->tlv_buf_len + S_DS_GEN));
2057
2058 return 0;
2059 }
2060
2061 /* Prepare the background scan config command to send to firmware. */
nxpwifi_cmd_802_11_bg_scan_config(struct nxpwifi_private * priv,struct host_cmd_ds_command * cmd,void * data_buf)2062 int nxpwifi_cmd_802_11_bg_scan_config(struct nxpwifi_private *priv,
2063 struct host_cmd_ds_command *cmd,
2064 void *data_buf)
2065 {
2066 struct host_cmd_ds_802_11_bg_scan_config *bgscan_config =
2067 &cmd->params.bg_scan_config;
2068 struct nxpwifi_bg_scan_cfg *bgscan_cfg_in = data_buf;
2069 u8 *tlv_pos = bgscan_config->tlv;
2070 u8 num_probes;
2071 u32 ssid_len, chan_idx, scan_time, scan_type, scan_dur, chan_num;
2072 int i;
2073 struct nxpwifi_ie_types_num_probes *num_probes_tlv;
2074 struct nxpwifi_ie_types_repeat_count *repeat_count_tlv;
2075 struct nxpwifi_ie_types_min_rssi_threshold *rssi_threshold_tlv;
2076 struct nxpwifi_ie_types_bgscan_start_later *start_later_tlv;
2077 struct nxpwifi_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
2078 struct nxpwifi_ie_types_chan_list_param_set *tlv_l;
2079 struct nxpwifi_chan_scan_param_set *temp_chan;
2080
2081 cmd->command = cpu_to_le16(HOST_CMD_802_11_BG_SCAN_CONFIG);
2082 cmd->size = cpu_to_le16(sizeof(*bgscan_config) + S_DS_GEN);
2083
2084 bgscan_config->action = cpu_to_le16(bgscan_cfg_in->action);
2085 bgscan_config->enable = bgscan_cfg_in->enable;
2086 bgscan_config->bss_type = bgscan_cfg_in->bss_type;
2087 bgscan_config->scan_interval =
2088 cpu_to_le32(bgscan_cfg_in->scan_interval);
2089 bgscan_config->report_condition =
2090 cpu_to_le32(bgscan_cfg_in->report_condition);
2091
2092 /* stop sched scan */
2093 if (!bgscan_config->enable)
2094 return 0;
2095
2096 bgscan_config->chan_per_scan = bgscan_cfg_in->chan_per_scan;
2097
2098 num_probes = (bgscan_cfg_in->num_probes ?
2099 bgscan_cfg_in->num_probes : priv->adapter->scan_probes);
2100
2101 if (num_probes) {
2102 num_probes_tlv = (struct nxpwifi_ie_types_num_probes *)tlv_pos;
2103 num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
2104 num_probes_tlv->header.len =
2105 cpu_to_le16(sizeof(num_probes_tlv->num_probes));
2106 num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);
2107
2108 tlv_pos += sizeof(num_probes_tlv->header) +
2109 le16_to_cpu(num_probes_tlv->header.len);
2110 }
2111
2112 if (bgscan_cfg_in->repeat_count) {
2113 repeat_count_tlv =
2114 (struct nxpwifi_ie_types_repeat_count *)tlv_pos;
2115 repeat_count_tlv->header.type =
2116 cpu_to_le16(TLV_TYPE_REPEAT_COUNT);
2117 repeat_count_tlv->header.len =
2118 cpu_to_le16(sizeof(repeat_count_tlv->repeat_count));
2119 repeat_count_tlv->repeat_count =
2120 cpu_to_le16(bgscan_cfg_in->repeat_count);
2121
2122 tlv_pos += sizeof(repeat_count_tlv->header) +
2123 le16_to_cpu(repeat_count_tlv->header.len);
2124 }
2125
2126 if (bgscan_cfg_in->rssi_threshold) {
2127 rssi_threshold_tlv =
2128 (struct nxpwifi_ie_types_min_rssi_threshold *)tlv_pos;
2129 rssi_threshold_tlv->header.type =
2130 cpu_to_le16(TLV_TYPE_RSSI_LOW);
2131 rssi_threshold_tlv->header.len =
2132 cpu_to_le16(sizeof(rssi_threshold_tlv->rssi_threshold));
2133 rssi_threshold_tlv->rssi_threshold =
2134 cpu_to_le16(bgscan_cfg_in->rssi_threshold);
2135
2136 tlv_pos += sizeof(rssi_threshold_tlv->header) +
2137 le16_to_cpu(rssi_threshold_tlv->header.len);
2138 }
2139
2140 for (i = 0; i < bgscan_cfg_in->num_ssids; i++) {
2141 ssid_len = bgscan_cfg_in->ssid_list[i].ssid.ssid_len;
2142
2143 wildcard_ssid_tlv =
2144 (struct nxpwifi_ie_types_wildcard_ssid_params *)tlv_pos;
2145 wildcard_ssid_tlv->header.type =
2146 cpu_to_le16(TLV_TYPE_WILDCARDSSID);
2147 wildcard_ssid_tlv->header.len =
2148 cpu_to_le16((u16)(ssid_len + sizeof(u8)));
2149
2150 /*
2151 * max_ssid_length = 0 tells firmware to scan only for the given
2152 * SSID. max_ssid_length = IEEE80211_MAX_SSID_LEN triggers a
2153 * wildcard scan.
2154 */
2155 if (ssid_len)
2156 wildcard_ssid_tlv->max_ssid_length = 0;
2157 else
2158 wildcard_ssid_tlv->max_ssid_length =
2159 IEEE80211_MAX_SSID_LEN;
2160
2161 memcpy(wildcard_ssid_tlv->ssid,
2162 bgscan_cfg_in->ssid_list[i].ssid.ssid, ssid_len);
2163
2164 tlv_pos += (sizeof(wildcard_ssid_tlv->header) +
2165 le16_to_cpu(wildcard_ssid_tlv->header.len));
2166 }
2167
2168 tlv_l = (struct nxpwifi_ie_types_chan_list_param_set *)tlv_pos;
2169
2170 if (bgscan_cfg_in->chan_list[0].chan_number) {
2171 nxpwifi_dbg(priv->adapter, INFO, "info: bgscan: Using supplied channel list\n");
2172
2173 tlv_l->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
2174
2175 for (chan_idx = 0;
2176 chan_idx < NXPWIFI_BG_SCAN_CHAN_MAX &&
2177 bgscan_cfg_in->chan_list[chan_idx].chan_number;
2178 chan_idx++) {
2179 temp_chan = &tlv_l->chan_scan_param[chan_idx];
2180
2181 /* Increment the TLV header length by size appended */
2182 le16_unaligned_add_cpu(&tlv_l->header.len,
2183 sizeof(*tlv_l->chan_scan_param));
2184
2185 temp_chan->chan_number =
2186 bgscan_cfg_in->chan_list[chan_idx].chan_number;
2187 temp_chan->band_cfg =
2188 bgscan_cfg_in->chan_list[chan_idx].radio_type;
2189
2190 scan_type =
2191 bgscan_cfg_in->chan_list[chan_idx].scan_type;
2192
2193 if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
2194 temp_chan->chan_scan_mode_bmap |=
2195 NXPWIFI_PASSIVE_SCAN;
2196 else
2197 temp_chan->chan_scan_mode_bmap &=
2198 ~NXPWIFI_PASSIVE_SCAN;
2199
2200 scan_time = bgscan_cfg_in->chan_list[chan_idx].scan_time;
2201
2202 if (scan_time) {
2203 scan_dur = (u16)scan_time;
2204 } else {
2205 scan_dur = (scan_type ==
2206 NXPWIFI_SCAN_TYPE_PASSIVE) ?
2207 priv->adapter->passive_scan_time :
2208 priv->adapter->specific_scan_time;
2209 }
2210
2211 temp_chan->min_scan_time = cpu_to_le16(scan_dur);
2212 temp_chan->max_scan_time = cpu_to_le16(scan_dur);
2213 }
2214 } else {
2215 nxpwifi_dbg(priv->adapter, INFO,
2216 "info: bgscan: Creating full region channel list\n");
2217 chan_num =
2218 nxpwifi_bgscan_create_channel_list
2219 (priv, bgscan_cfg_in,
2220 tlv_l->chan_scan_param);
2221 le16_unaligned_add_cpu(&tlv_l->header.len,
2222 chan_num *
2223 sizeof(*tlv_l->chan_scan_param));
2224 }
2225
2226 tlv_pos += (sizeof(tlv_l->header)
2227 + le16_to_cpu(tlv_l->header.len));
2228
2229 if (bgscan_cfg_in->start_later) {
2230 start_later_tlv =
2231 (struct nxpwifi_ie_types_bgscan_start_later *)tlv_pos;
2232 start_later_tlv->header.type =
2233 cpu_to_le16(TLV_TYPE_BGSCAN_START_LATER);
2234 start_later_tlv->header.len =
2235 cpu_to_le16(sizeof(start_later_tlv->start_later));
2236 start_later_tlv->start_later =
2237 cpu_to_le16(bgscan_cfg_in->start_later);
2238
2239 tlv_pos += sizeof(start_later_tlv->header) +
2240 le16_to_cpu(start_later_tlv->header.len);
2241 }
2242
2243 /* Append vendor specific element TLV */
2244 nxpwifi_cmd_append_vsie_tlv(priv, NXPWIFI_VSIE_MASK_BGSCAN, &tlv_pos);
2245
2246 le16_unaligned_add_cpu(&cmd->size, tlv_pos - bgscan_config->tlv);
2247
2248 return 0;
2249 }
2250
nxpwifi_stop_bg_scan(struct nxpwifi_private * priv)2251 int nxpwifi_stop_bg_scan(struct nxpwifi_private *priv)
2252 {
2253 struct nxpwifi_bg_scan_cfg *bgscan_cfg;
2254 int ret;
2255
2256 if (!priv->sched_scanning) {
2257 nxpwifi_dbg(priv->adapter, MSG, "bgscan already stopped!\n");
2258 return 0;
2259 }
2260
2261 bgscan_cfg = kzalloc_obj(*bgscan_cfg, GFP_KERNEL);
2262 if (!bgscan_cfg)
2263 return -ENOMEM;
2264
2265 bgscan_cfg->bss_type = NXPWIFI_BSS_MODE_INFRA;
2266 bgscan_cfg->action = NXPWIFI_BGSCAN_ACT_SET;
2267 bgscan_cfg->enable = false;
2268
2269 ret = nxpwifi_send_cmd(priv, HOST_CMD_802_11_BG_SCAN_CONFIG,
2270 HOST_ACT_GEN_SET, 0, bgscan_cfg, true);
2271 if (!ret)
2272 priv->sched_scanning = false;
2273
2274 kfree(bgscan_cfg);
2275 return ret;
2276 }
2277
2278 static void
nxpwifi_update_chan_statistics(struct nxpwifi_private * priv,struct nxpwifi_ietypes_chanstats * tlv_stat)2279 nxpwifi_update_chan_statistics(struct nxpwifi_private *priv,
2280 struct nxpwifi_ietypes_chanstats *tlv_stat)
2281 {
2282 struct nxpwifi_adapter *adapter = priv->adapter;
2283 u8 i, num_chan;
2284 struct nxpwifi_fw_chan_stats *fw_chan_stats;
2285 struct nxpwifi_chan_stats chan_stats;
2286
2287 fw_chan_stats = (void *)((u8 *)tlv_stat +
2288 sizeof(struct nxpwifi_ie_types_header));
2289 num_chan = le16_to_cpu(tlv_stat->header.len) /
2290 sizeof(struct nxpwifi_chan_stats);
2291
2292 for (i = 0 ; i < num_chan; i++) {
2293 if (adapter->survey_idx >= adapter->num_in_chan_stats) {
2294 nxpwifi_dbg(adapter, WARN,
2295 "FW reported too many channel results (max %d)\n",
2296 adapter->num_in_chan_stats);
2297 return;
2298 }
2299 chan_stats.chan_num = fw_chan_stats->chan_num;
2300 chan_stats.bandcfg = fw_chan_stats->bandcfg;
2301 chan_stats.flags = fw_chan_stats->flags;
2302 chan_stats.noise = fw_chan_stats->noise;
2303 chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
2304 chan_stats.cca_scan_dur =
2305 le16_to_cpu(fw_chan_stats->cca_scan_dur);
2306 chan_stats.cca_busy_dur =
2307 le16_to_cpu(fw_chan_stats->cca_busy_dur);
2308 nxpwifi_dbg(adapter, INFO,
2309 "chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
2310 chan_stats.chan_num,
2311 chan_stats.noise,
2312 chan_stats.total_bss,
2313 chan_stats.cca_scan_dur,
2314 chan_stats.cca_busy_dur);
2315 memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
2316 sizeof(struct nxpwifi_chan_stats));
2317 fw_chan_stats++;
2318 }
2319 }
2320
2321 /* Handle the extended scan command response. */
nxpwifi_ret_802_11_scan_ext(struct nxpwifi_private * priv,struct host_cmd_ds_command * resp)2322 int nxpwifi_ret_802_11_scan_ext(struct nxpwifi_private *priv,
2323 struct host_cmd_ds_command *resp)
2324 {
2325 struct nxpwifi_adapter *adapter = priv->adapter;
2326 struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
2327 struct nxpwifi_ie_types_header *tlv;
2328 struct nxpwifi_ietypes_chanstats *tlv_stat;
2329 u16 buf_left, type, len;
2330
2331 struct host_cmd_ds_command *cmd_ptr;
2332 struct cmd_ctrl_node *cmd_node;
2333 bool complete_scan = false;
2334
2335 nxpwifi_dbg(adapter, INFO, "info: EXT scan returns successfully\n");
2336
2337 ext_scan_resp = &resp->params.ext_scan;
2338
2339 tlv = (void *)ext_scan_resp->tlv_buffer;
2340 buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN);
2341
2342 while (buf_left >= sizeof(struct nxpwifi_ie_types_header)) {
2343 type = le16_to_cpu(tlv->type);
2344 len = le16_to_cpu(tlv->len);
2345
2346 if (buf_left < (sizeof(struct nxpwifi_ie_types_header) + len)) {
2347 nxpwifi_dbg(adapter, ERROR,
2348 "error processing scan response TLVs");
2349 break;
2350 }
2351
2352 switch (type) {
2353 case TLV_TYPE_CHANNEL_STATS:
2354 tlv_stat = (void *)tlv;
2355 nxpwifi_update_chan_statistics(priv, tlv_stat);
2356 break;
2357 default:
2358 break;
2359 }
2360
2361 buf_left -= len + sizeof(struct nxpwifi_ie_types_header);
2362 tlv = (void *)((u8 *)tlv + len +
2363 sizeof(struct nxpwifi_ie_types_header));
2364 }
2365
2366 spin_lock_bh(&adapter->cmd_pending_q_lock);
2367 spin_lock_bh(&adapter->scan_pending_q_lock);
2368 if (list_empty(&adapter->scan_pending_q)) {
2369 complete_scan = true;
2370 list_for_each_entry(cmd_node, &adapter->cmd_pending_q, list) {
2371 cmd_ptr = (void *)cmd_node->cmd_skb->data;
2372 if (le16_to_cpu(cmd_ptr->command) ==
2373 HOST_CMD_802_11_SCAN_EXT) {
2374 nxpwifi_dbg(adapter, INFO,
2375 "Scan pending in command pending list");
2376 complete_scan = false;
2377 break;
2378 }
2379 }
2380 }
2381 spin_unlock_bh(&adapter->scan_pending_q_lock);
2382 spin_unlock_bh(&adapter->cmd_pending_q_lock);
2383
2384 if (complete_scan)
2385 nxpwifi_complete_scan(priv);
2386
2387 return 0;
2388 }
2389
2390 /*
2391 * Handle the extended scan report event: parse the results and notify
2392 * cfg80211.
2393 */
nxpwifi_handle_event_ext_scan_report(struct nxpwifi_private * priv,void * buf)2394 int nxpwifi_handle_event_ext_scan_report(struct nxpwifi_private *priv,
2395 void *buf)
2396 {
2397 int ret = 0;
2398 struct nxpwifi_adapter *adapter = priv->adapter;
2399 u8 *bss_info;
2400 u32 bytes_left, bytes_left_for_tlv, idx;
2401 u16 type, len;
2402 struct nxpwifi_ie_types_data *tlv;
2403 struct nxpwifi_ie_types_scan_rsp *scan_rsp_tlv;
2404 struct nxpwifi_ie_types_scan_inf *scan_info_tlv;
2405 u8 *radio_type;
2406 u64 fw_tsf = 0;
2407 s32 rssi = 0;
2408 struct nxpwifi_event_scan_result *event_scan = buf;
2409 u8 num_of_set = event_scan->num_of_set;
2410 u8 *scan_resp = buf + sizeof(struct nxpwifi_event_scan_result);
2411 u16 scan_resp_size = le16_to_cpu(event_scan->buf_size);
2412
2413 if (num_of_set > NXPWIFI_MAX_AP) {
2414 nxpwifi_dbg(adapter, ERROR,
2415 "EXT_SCAN: Invalid number of AP returned (%d)!!\n",
2416 num_of_set);
2417 ret = -EINVAL;
2418 goto check_next_scan;
2419 }
2420
2421 bytes_left = scan_resp_size;
2422 nxpwifi_dbg(adapter, INFO,
2423 "EXT_SCAN: size %d, returned %d APs...",
2424 scan_resp_size, num_of_set);
2425 nxpwifi_dbg_dump(adapter, CMD_D, "EXT_SCAN buffer:", buf,
2426 scan_resp_size +
2427 sizeof(struct nxpwifi_event_scan_result));
2428
2429 tlv = (struct nxpwifi_ie_types_data *)scan_resp;
2430
2431 for (idx = 0; idx < num_of_set && bytes_left; idx++) {
2432 type = le16_to_cpu(tlv->header.type);
2433 len = le16_to_cpu(tlv->header.len);
2434 if (bytes_left < sizeof(struct nxpwifi_ie_types_header) + len) {
2435 nxpwifi_dbg(adapter, ERROR,
2436 "EXT_SCAN: Error bytes left < TLV length\n");
2437 break;
2438 }
2439 scan_rsp_tlv = NULL;
2440 scan_info_tlv = NULL;
2441 bytes_left_for_tlv = bytes_left;
2442
2443 /*
2444 * BSS response TLV with beacon or probe response buffer
2445 * at the initial position of each descriptor
2446 */
2447 if (type != TLV_TYPE_BSS_SCAN_RSP)
2448 break;
2449
2450 bss_info = (u8 *)tlv;
2451 scan_rsp_tlv = (struct nxpwifi_ie_types_scan_rsp *)tlv;
2452 tlv = (struct nxpwifi_ie_types_data *)(tlv->data + len);
2453 bytes_left_for_tlv -=
2454 (len + sizeof(struct nxpwifi_ie_types_header));
2455
2456 while (bytes_left_for_tlv >=
2457 sizeof(struct nxpwifi_ie_types_header) &&
2458 le16_to_cpu(tlv->header.type) != TLV_TYPE_BSS_SCAN_RSP) {
2459 type = le16_to_cpu(tlv->header.type);
2460 len = le16_to_cpu(tlv->header.len);
2461 if (bytes_left_for_tlv <
2462 sizeof(struct nxpwifi_ie_types_header) + len) {
2463 nxpwifi_dbg(adapter, ERROR,
2464 "EXT_SCAN: Error in processing TLV,\t"
2465 "bytes left < TLV length\n");
2466 scan_rsp_tlv = NULL;
2467 bytes_left_for_tlv = 0;
2468 continue;
2469 }
2470 switch (type) {
2471 case TLV_TYPE_BSS_SCAN_INFO:
2472 scan_info_tlv =
2473 (struct nxpwifi_ie_types_scan_inf *)tlv;
2474 if (len !=
2475 sizeof(struct nxpwifi_ie_types_scan_inf) -
2476 sizeof(struct nxpwifi_ie_types_header)) {
2477 bytes_left_for_tlv = 0;
2478 continue;
2479 }
2480 break;
2481 default:
2482 break;
2483 }
2484 tlv = (struct nxpwifi_ie_types_data *)(tlv->data + len);
2485 bytes_left -=
2486 (len + sizeof(struct nxpwifi_ie_types_header));
2487 bytes_left_for_tlv -=
2488 (len + sizeof(struct nxpwifi_ie_types_header));
2489 }
2490
2491 if (!scan_rsp_tlv)
2492 break;
2493
2494 /*
2495 * Advance pointer to the beacon buffer length and
2496 * update the bytes count so that the function
2497 * wlan_interpret_bss_desc_with_ie() can handle the
2498 * scan buffer withut any change
2499 */
2500 bss_info += sizeof(u16);
2501 bytes_left -= sizeof(u16);
2502
2503 if (scan_info_tlv) {
2504 rssi = (s32)(s16)(le16_to_cpu(scan_info_tlv->rssi));
2505 rssi *= 100; /* Convert dBm to mBm */
2506 nxpwifi_dbg(adapter, INFO,
2507 "info: InterpretIE: RSSI=%d\n", rssi);
2508 fw_tsf = le64_to_cpu(scan_info_tlv->tsf);
2509 radio_type = &scan_info_tlv->radio_type;
2510 } else {
2511 radio_type = NULL;
2512 }
2513 ret = nxpwifi_parse_single_response_buf(priv, &bss_info,
2514 &bytes_left, fw_tsf,
2515 radio_type, true, rssi);
2516 if (ret)
2517 goto check_next_scan;
2518 }
2519
2520 check_next_scan:
2521 if (!event_scan->more_event)
2522 nxpwifi_check_next_scan_command(priv);
2523
2524 return ret;
2525 }
2526
2527 /*
2528 * Prepare the background scan query command. Sets the command ID, size,
2529 * flush parameter, and fixes endianness.
2530 */
nxpwifi_cmd_802_11_bg_scan_query(struct host_cmd_ds_command * cmd)2531 int nxpwifi_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
2532 {
2533 struct host_cmd_ds_802_11_bg_scan_query *bg_query =
2534 &cmd->params.bg_scan_query;
2535
2536 cmd->command = cpu_to_le16(HOST_CMD_802_11_BG_SCAN_QUERY);
2537 cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_bg_scan_query)
2538 + S_DS_GEN);
2539
2540 bg_query->flush = 1;
2541
2542 return 0;
2543 }
2544
2545 /* Insert a scan command node into the scan_pending_q. */
2546 void
nxpwifi_queue_scan_cmd(struct nxpwifi_private * priv,struct cmd_ctrl_node * cmd_node)2547 nxpwifi_queue_scan_cmd(struct nxpwifi_private *priv,
2548 struct cmd_ctrl_node *cmd_node)
2549 {
2550 struct nxpwifi_adapter *adapter = priv->adapter;
2551
2552 cmd_node->wait_q_enabled = true;
2553 cmd_node->condition = &adapter->scan_wait_q_woken;
2554 spin_lock_bh(&adapter->scan_pending_q_lock);
2555 list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
2556 spin_unlock_bh(&adapter->scan_pending_q_lock);
2557 }
2558
2559 /* Append a vendor-specific element TLV to the buffer. */
2560 int
nxpwifi_cmd_append_vsie_tlv(struct nxpwifi_private * priv,u16 vsie_mask,u8 ** buffer)2561 nxpwifi_cmd_append_vsie_tlv(struct nxpwifi_private *priv,
2562 u16 vsie_mask, u8 **buffer)
2563 {
2564 int id, ret_len = 0;
2565 struct nxpwifi_ie_types_vendor_param_set *vs_param_set;
2566
2567 if (!buffer)
2568 return 0;
2569 if (!(*buffer))
2570 return 0;
2571
2572 /*
2573 * Traverse through the saved vendor specific element array and append
2574 * the selected(scan/assoc) element as TLV to the command
2575 */
2576 for (id = 0; id < NXPWIFI_MAX_VSIE_NUM; id++) {
2577 if (priv->vs_ie[id].mask & vsie_mask) {
2578 vs_param_set =
2579 (struct nxpwifi_ie_types_vendor_param_set *)
2580 *buffer;
2581 vs_param_set->header.type =
2582 cpu_to_le16(TLV_TYPE_PASSTHROUGH);
2583 vs_param_set->header.len =
2584 cpu_to_le16((((u16)priv->vs_ie[id].ie[1])
2585 & 0x00FF) + 2);
2586 if (le16_to_cpu(vs_param_set->header.len) >
2587 NXPWIFI_MAX_VSIE_LEN) {
2588 nxpwifi_dbg(priv->adapter, ERROR,
2589 "Invalid param length!\n");
2590 break;
2591 }
2592
2593 memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
2594 le16_to_cpu(vs_param_set->header.len));
2595 *buffer += le16_to_cpu(vs_param_set->header.len) +
2596 sizeof(struct nxpwifi_ie_types_header);
2597 ret_len += le16_to_cpu(vs_param_set->header.len) +
2598 sizeof(struct nxpwifi_ie_types_header);
2599 }
2600 }
2601 return ret_len;
2602 }
2603
2604 /*
2605 * Save the beacon buffer of the current BSS descriptor.
2606 *
2607 * The buffer is preserved so it can be restored when the current SSID's
2608 * beacon is missing, such as when:
2609 * - the SSID was not found in the latest scan, or
2610 * - the SSID was the last entry in the scan table and was overwritten.
2611 */
2612 void
nxpwifi_save_curr_bcn(struct nxpwifi_private * priv)2613 nxpwifi_save_curr_bcn(struct nxpwifi_private *priv)
2614 {
2615 struct nxpwifi_bssdescriptor *curr_bss =
2616 &priv->curr_bss_params.bss_descriptor;
2617
2618 if (!curr_bss->beacon_buf_size)
2619 return;
2620
2621 /* allocate beacon buffer at 1st time; or if it's size has changed */
2622 if (!priv->curr_bcn_buf ||
2623 priv->curr_bcn_size != curr_bss->beacon_buf_size) {
2624 priv->curr_bcn_size = curr_bss->beacon_buf_size;
2625
2626 kfree(priv->curr_bcn_buf);
2627 priv->curr_bcn_buf = kmalloc(curr_bss->beacon_buf_size,
2628 GFP_ATOMIC);
2629 if (!priv->curr_bcn_buf)
2630 return;
2631 }
2632
2633 memcpy(priv->curr_bcn_buf, curr_bss->beacon_buf,
2634 curr_bss->beacon_buf_size);
2635 nxpwifi_dbg(priv->adapter, INFO,
2636 "info: current beacon saved %d\n",
2637 priv->curr_bcn_size);
2638
2639 curr_bss->beacon_buf = priv->curr_bcn_buf;
2640
2641 /* adjust the pointers in the current BSS descriptor */
2642 if (curr_bss->bcn_wpa_ie)
2643 curr_bss->bcn_wpa_ie =
2644 (struct ieee_types_vendor_specific *)
2645 (curr_bss->beacon_buf +
2646 curr_bss->wpa_offset);
2647
2648 if (curr_bss->bcn_rsn_ie)
2649 curr_bss->bcn_rsn_ie =
2650 (struct element *)(curr_bss->beacon_buf +
2651 curr_bss->rsn_offset);
2652
2653 if (curr_bss->bcn_ht_cap)
2654 curr_bss->bcn_ht_cap = (struct ieee80211_ht_cap *)
2655 (curr_bss->beacon_buf +
2656 curr_bss->ht_cap_offset);
2657
2658 if (curr_bss->bcn_ht_oper)
2659 curr_bss->bcn_ht_oper = (struct ieee80211_ht_operation *)
2660 (curr_bss->beacon_buf +
2661 curr_bss->ht_info_offset);
2662
2663 if (curr_bss->bcn_vht_cap)
2664 curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
2665 curr_bss->vht_cap_offset);
2666
2667 if (curr_bss->bcn_vht_oper)
2668 curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
2669 curr_bss->vht_info_offset);
2670
2671 if (curr_bss->bcn_he_cap)
2672 curr_bss->bcn_he_cap = (void *)(curr_bss->beacon_buf +
2673 curr_bss->he_cap_offset);
2674
2675 if (curr_bss->bcn_he_oper)
2676 curr_bss->bcn_he_oper = (void *)(curr_bss->beacon_buf +
2677 curr_bss->he_info_offset);
2678
2679 if (curr_bss->bcn_bss_co_2040)
2680 curr_bss->bcn_bss_co_2040 =
2681 (curr_bss->beacon_buf + curr_bss->bss_co_2040_offset);
2682
2683 if (curr_bss->bcn_ext_cap)
2684 curr_bss->bcn_ext_cap = curr_bss->beacon_buf +
2685 curr_bss->ext_cap_offset;
2686
2687 if (curr_bss->oper_mode)
2688 curr_bss->oper_mode = (void *)(curr_bss->beacon_buf +
2689 curr_bss->oper_mode_offset);
2690 }
2691
2692 /* Free the beacon buffer in the current BSS descriptor. */
2693 void
nxpwifi_free_curr_bcn(struct nxpwifi_private * priv)2694 nxpwifi_free_curr_bcn(struct nxpwifi_private *priv)
2695 {
2696 kfree(priv->curr_bcn_buf);
2697 priv->curr_bcn_buf = NULL;
2698 }
2699