1 /* 2 * Proxmity Ranging 3 * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #ifndef PROXIMITY_RANGING_H 10 #define PROXIMITY_RANGING_H 11 12 #include "wpa_common.h" 13 #include "utils/list.h" 14 #include "wps/wps_defs.h" 15 16 struct ieee80211_mgmt; 17 18 #define DEVICE_IDENTITY_KEY_LEN 16 19 #define DEVICE_IDENTITY_TAG_LEN 8 20 #define DEVICE_IDENTITY_NONCE_LEN 8 21 #define DIR_STR_LEN 3 22 #define DEVICE_MAX_HASH_LEN 32 23 24 /* DIRA Cipher versions */ 25 #define DIRA_CIPHER_VERSION_128 0 26 27 /** 28 * PR_MAX_OP_CLASSES - Maximum number of operating classes 29 */ 30 #define PR_MAX_OP_CLASSES 30 31 32 /** 33 * PR_MAX_OP_CLASS_CHANNELS - Maximum number of channels per operating class 34 */ 35 #define PR_MAX_OP_CLASS_CHANNELS 60 36 37 /** 38 * PR_MAX_PEER - Maximum number of Proximity Ranging peers that device can store 39 */ 40 #define PR_MAX_PEER 100 41 42 /* 43 * Proximity Ranging negotiation status 44 * Proximity Ranging Implementation Considerations for P2P Operation D1.8, 45 * Table 5 (Proximity Ranging Status Attribute format). 46 */ 47 #define PR_NEGOTIATION_SUCCESS 0 48 #define PR_NEGOTIATION_UPDATE 1 49 #define PR_NEGOTIATION_FAIL 2 50 51 /** 52 * enum pr_session_end_reason - Reason codes for ranging session end 53 */ 54 enum pr_session_end_reason { 55 PR_SESSION_END_TIMEOUT = 0, 56 PR_SESSION_END_USER_ABORT = 1, 57 PR_SESSION_END_PEER_COMPLETE = 2, 58 PR_SESSION_END_NEG_FAILED = 3, 59 }; 60 61 enum pr_pasn_role { 62 PR_ROLE_IDLE = 0, 63 PR_ROLE_PASN_INITIATOR, 64 PR_ROLE_PASN_RESPONDER, 65 }; 66 67 /** 68 * struct pr_channels - List of supported channels 69 */ 70 struct pr_channels { 71 /** 72 * struct pr_op_class - Supported operating class 73 */ 74 struct pr_op_class { 75 /** 76 * op_class - Operating class 77 */ 78 u8 op_class; 79 80 /** 81 * channel - Supported channels 82 */ 83 u8 channel[PR_MAX_OP_CLASS_CHANNELS]; 84 85 /** 86 * channels - Number of channel entries in use 87 */ 88 size_t channels; 89 } op_class[PR_MAX_OP_CLASSES]; 90 91 /** 92 * op_classes - Number of op_class entries in use 93 */ 94 size_t op_classes; 95 }; 96 97 /** 98 * Format and Bandwidth values for EDCA based ranging with range of 10-16 99 * from IEEE Std 802.11-2024, 9.4.2.166 (FTM Parameters element), Table 9-325 100 * (Format And Bandwidth subfield) as specified in Proximity Ranging 101 * Implementation Considerations for P2P Operation, Draft 1.8, Table 8 102 * (Proximity Ranging EDCA Capability Attribute format) for the the Ranging 103 * Parameters field B0-B3. 104 */ 105 enum edca_format_and_bw_value { 106 EDCA_FORMAT_AND_BW_VHT20 = 10, 107 EDCA_FORMAT_AND_BW_HT40 = 11, 108 EDCA_FORMAT_AND_BW_VHT40 = 12, 109 EDCA_FORMAT_AND_BW_VHT80 = 13, 110 EDCA_FORMAT_AND_BW_VHT80P80 = 14, 111 EDCA_FORMAT_AND_BW_VHT160_DUAL_LO = 15, 112 EDCA_FORMAT_AND_BW_VHT160_SINGLE_LO = 16, 113 EDCA_FORMAT_AND_BW_INVALID 114 }; 115 116 /** 117 * Format and Bandwidth values for NTB based ranging as from IEEE Std 118 * 802.11-2024, 9.4.2.300 (Ranging Parameters element), Table 9-412 (Format And 119 * Bandwidth subfield) as specified in Proximity Ranging Implementation 120 * Considerations for P2P Operation, Draft 1.8, Table 9 (Proximity Ranging 11az 121 * NTB Capability Attribute format) for the Ranging Parameter field B0-B2. 122 */ 123 enum ntb_format_and_bw_value { 124 NTB_FORMAT_AND_BW_HE20 = 0, 125 NTB_FORMAT_AND_BW_HE40 = 1, 126 NTB_FORMAT_AND_BW_HE80 = 2, 127 NTB_FORMAT_AND_BW_HE80P80 = 3, 128 NTB_FORMAT_AND_BW_HE160_DUAL_LO = 4, 129 NTB_FORMAT_AND_BW_HE160_SINGLE_LO = 5, 130 NTB_FORMAT_AND_BW_INVALID 131 }; 132 133 struct pr_capabilities { 134 u8 pasn_type; 135 136 char device_name[WPS_DEV_NAME_MAX_LEN + 1]; 137 138 bool edca_support; 139 140 bool ntb_support; 141 142 bool secure_he_ltf; 143 144 bool support_6ghz; 145 }; 146 147 struct edca_capabilities { 148 bool ista_support; 149 150 bool rsta_support; 151 152 /** 153 * Ranging Parameters field for device specific EDCA capabilities 154 * Proximity Ranging Implementation Considerations for P2P Operation Draft 1.8, 155 * Table 8 (Proximity Ranging EDCA Capability Attribute format). 156 */ 157 #define EDCA_FORMAT_AND_BW 0 158 #define EDCA_MAX_TX_ANTENNA 4 159 #define EDCA_MAX_RX_ANTENNA 7 160 161 #define EDCA_FORMAT_AND_BW_MASK 0x000F 162 #define EDCA_MAX_TX_ANTENNA_MASK 0x0007 163 #define EDCA_MAX_RX_ANTENNA_MASK 0x0007 164 u16 edca_hw_caps; 165 166 char country[3]; 167 168 struct pr_channels channels; 169 }; 170 171 struct ntb_capabilities { 172 bool ista_support; 173 174 bool rsta_support; 175 176 bool secure_he_ltf; 177 178 /** 179 * Ranging Parameter field for NTB capabilities 180 * Proximity Ranging Implementation Considerations for P2P Operation Draft 1.8, 181 * Table 9 (Proximity Ranging 11az NTB Capability Attribute format). 182 */ 183 #define NTB_FORMAT_AND_BW 0 184 #define MAX_TX_LTF_REPETATIONS 3 185 #define MAX_RX_LTF_REPETATIONS 6 186 #define MAX_RX_LTF_TOTAL 9 187 #define MAX_TX_LTF_TOTAL 11 188 #define MAX_RX_STS_LE_80 13 189 #define MAX_RX_STS_GT_80 16 190 #define MAX_TX_STS_LE_80 19 191 #define MAX_TX_STS_GT_80 22 192 193 #define NTB_FORMAT_AND_BW_MASK 0x00000007 194 195 /* Max TX LTF repetations supported for non trigger based ranging */ 196 #define MAX_TX_LTF_REPETATIONS_MASK 0x00000007 197 198 /* Max RX LTF repetations supported for non trigger based ranging */ 199 #define MAX_RX_LTF_REPETATIONS_MASK 0x00000007 200 201 /* Max RX LTF total supported for non trigger based ranging */ 202 #define MAX_RX_LTF_TOTAL_MASK 0x00000003 203 204 /* Max TX LTF total supported for non trigger based ranging */ 205 #define MAX_TX_LTF_TOTAL_MASK 0x00000003 206 207 /* To configure max R2I STS for Bandwidth less than or equal to 80 MHz */ 208 #define MAX_RX_STS_LE_80_MASK 0x00000007 209 210 /* To configure max R2I STS for Bandwidth greater than 80Mz */ 211 #define MAX_RX_STS_GT_80_MASK 0x00000007 212 213 /* To configure max I2R STS for Bandwidth less than or equal to 80 MHz */ 214 #define MAX_TX_STS_LE_80_MASK 0x00000007 215 216 /* To configure max I2R STS for Bandwidth greater than 80 MHz */ 217 #define MAX_TX_STS_GT_80_MASK 0x00000007 218 u32 ntb_hw_caps; 219 220 char country[3]; 221 222 struct pr_channels channels; 223 }; 224 225 /* 226 * Proximity Ranging Attribute IDs 227 * Proximity Ranging Implementation Considerations for P2P Operation Draft 1.8, 228 * Table 4 (Proximity Ranging Attribute ID list). 229 */ 230 enum pr_attr_id { 231 PR_ATTR_STATUS = 0, 232 PR_ATTR_RANGING_CAPABILITY = 1, 233 PR_ATTR_EDCA_CAPABILITY = 2, 234 PR_ATTR_NTB_CAPABILITY = 3, 235 PR_ATTR_OPERATION_MODE = 4, 236 PR_ATTR_WLAN_AP_INFO = 5, 237 PR_ATTR_DEVICE_IDENTITY_RESOLUTION = 6, 238 PR_ATTR_VENDOR_SPECIFIC = 221, 239 }; 240 241 /* 242 * Proximity Ranging capabilities in Ranging Protocol Type field, 243 * Proximity Ranging Implementation Considerations for P2P Operation Draft 1.8, 244 * Table 7 (Proximity Ranging Capability Attribute format). 245 */ 246 #define PR_EDCA_BASED_RANGING BIT(0) 247 #define PR_NTB_SECURE_LTF_BASED_RANGING BIT(1) 248 #define PR_NTB_OPEN_BASED_RANGING BIT(2) 249 250 /** 251 * Ranging Role field in EDCA capabilities 252 * Proximity Ranging Implementation Considerations for P2P Operation Draft 1.8, 253 * Table 8 (Proximity Ranging EDCA Capability Attribute format). 254 */ 255 #define PR_ISTA_SUPPORT BIT(0) 256 #define PR_RSTA_SUPPORT BIT(1) 257 258 /* 259 * PASN capabilities in PASN Type field 260 * Proximity Ranging Implementation Considerations for P2P Operation D1.8, 261 * Table 7 (Proximity Ranging Capability Attribute). 262 */ 263 #define PR_PASN_DH19_UNAUTH BIT(0) 264 #define PR_PASN_DH19_AUTH BIT(1) 265 #define PR_PASN_DH20_UNAUTH BIT(2) 266 #define PR_PASN_DH20_AUTH BIT(3) 267 268 /* Authentication Mode */ 269 #define PR_PASN_AUTH_MODE_PASN 0 270 #define PR_PASN_AUTH_MODE_SAE 1 271 #define PR_PASN_AUTH_MODE_PMK 2 272 273 /* Peer discovery type */ 274 #define PR_DISCOVERY_TYPE_USD 0 275 #define PR_DISCOVERY_TYPE_OOB 1 276 277 /** 278 * struct pr_pasn_ranging_params - Peer parameters to be used in PASN to trigger 279 * ranging in case PR PASN is successful. 280 */ 281 struct pr_pasn_ranging_params { 282 enum { 283 PR_PASN_AND_RANGING, 284 PR_STOP_RANGING, 285 } action; 286 u8 peer_addr[ETH_ALEN]; 287 u8 ranging_type; 288 u8 ranging_role; 289 u8 pr_pasn_status; 290 u8 auth_mode; 291 int freq; 292 u32 ranging_timeout; 293 u8 src_addr[ETH_ALEN]; 294 enum pr_pasn_role pasn_role; 295 296 /** 297 * EDCA based ranging specific parameters 298 * 299 * @burst_period: Burst period in units of 100 milliseconds 300 * @num_bursts_exp: Number of bursts exponent 301 * @ftms_per_burst: Number of FTM frames per burst 302 * @ftmr_retries: Number of retries for FTM Request frame 303 * @burst_duration: Burst duration as defined in IEEE Std 802.11-2024, 304 * Table 9-322 (Burst Duration subfield encoding). 305 */ 306 u16 burst_period; 307 u8 num_bursts_exp; 308 u8 ftms_per_burst; 309 u8 ftmr_retries; 310 u8 burst_duration; 311 312 /** 313 * NTB ranging specific parameters 314 * 315 * @min_time_between_measurements: Minimum time between two consecutive 316 * range measurements in units of 100 microseconds. 317 * @max_time_between_measurements: Maximum time between two consecutive 318 * range measurements in units of 10 milliseconds, to avoid FTM 319 * negotiation. 320 * @availability_window: Duration of the Availability Window (AW) in 321 * units of 1 millisecond (0-255 ms). 322 * @nominal_time: Nominal duration between adjacent Availability Windows 323 * in units of milliseconds. 324 */ 325 u32 min_time_between_measurements; 326 u32 max_time_between_measurements; 327 u8 availability_window; 328 u32 nominal_time; 329 330 /** 331 * @request_lci: Whether to request LCI 332 * @request_civicloc: Whether to request civic location 333 */ 334 bool request_lci; 335 bool request_civicloc; 336 337 /** 338 * @lmr_feedback: Negotiate LMR feedback for NTB ranging. 339 * Only valid when NTB ranging type is set. Required for RSTA 340 * to report measurement results back to the initiator. 341 */ 342 bool lmr_feedback; 343 344 /** 345 * @ingress_threshold: Ingress range threshold in millimeters. 346 * The kernel reports a measurement result when the device 347 * moves into this range. 348 */ 349 u64 ingress_threshold; 350 351 /** 352 * @egress_threshold: Egress range threshold in millimeters. 353 * The kernel reports a measurement result when the device 354 * moves out of this range. 355 */ 356 u64 egress_threshold; 357 358 /** 359 * @pr_suppress_results: Suppress ranging results for PD requests. 360 * Cannot be used with range_report or lmr_feedback. 361 */ 362 bool pr_suppress_results; 363 364 u32 continuous_ranging_session_time; 365 366 int forced_pr_freq; 367 u8 ranging_op_class; 368 u16 channel_width; /* channel width in MHz (20/40/80/160/320) */ 369 u8 format_bw; 370 u32 center_freq1; 371 u32 center_freq2; 372 u64 cookie; 373 374 /* Per-session credentials - if set, used instead of stored ones */ 375 char password[100]; 376 bool password_valid; 377 u8 pmk[PMK_LEN_MAX]; 378 size_t pmk_len; 379 }; 380 381 struct pr_dev_ik { 382 struct dl_list list; 383 u8 dik[DEVICE_IDENTITY_KEY_LEN]; 384 char password[100]; 385 bool password_valid; 386 u8 pmk[PMK_LEN_MAX]; 387 size_t pmk_len; 388 bool pmk_valid; 389 }; 390 391 /** 392 * struct pr_device_info - Proximity ranging peer information 393 */ 394 struct pr_device { 395 struct dl_list list; 396 struct os_reltime last_seen; 397 int listen_freq; 398 399 /** 400 * pr_device_addr - PR Device Address of the peer 401 */ 402 u8 pr_device_addr[ETH_ALEN]; 403 404 struct pr_capabilities pr_caps; 405 struct edca_capabilities edca_caps; 406 struct ntb_capabilities ntb_caps; 407 408 /* Password to be used in PASN-SAE by the Seeker. 409 * This is updated with valid password if DIRA matches for the peer. 410 */ 411 char password[100]; 412 bool password_valid; 413 414 /* PMK to be used in PASN-PMK by the Seeker. 415 * This is updated with valid PMK if DIRA matches for the peer. 416 */ 417 u8 pmk[PMK_LEN_MAX]; 418 size_t pmk_len; 419 bool pmk_valid; 420 421 /* DevIK of the peer resolved via DIRA verification. 422 * Set to the matched dev_ik->dik when pr_validate_dira() succeeds. 423 * Cleared by pr_clear_dev_iks(). 424 */ 425 u8 dik[DEVICE_IDENTITY_KEY_LEN]; 426 bool dik_valid; 427 428 #ifdef CONFIG_PASN 429 /* PASN data structure */ 430 struct pasn_data *pasn; 431 struct wpabuf *ranging_wrapper; 432 enum pr_pasn_role pasn_role; 433 #endif /* CONFIG_PASN */ 434 435 u8 ranging_role; 436 u8 protocol_type; 437 u8 final_op_class; 438 u8 final_op_channel; 439 u8 discovery_type; 440 }; 441 442 443 /** 444 * struct pr_message - Proximity ranging peer information 445 */ 446 struct pr_message { 447 struct wpabuf *pr_attributes; 448 449 u8 pr_device_addr[ETH_ALEN]; 450 451 const u8 *pr_capability; 452 size_t pr_capability_len; 453 454 const u8 *edca_capability; 455 size_t edca_capability_len; 456 457 const u8 *ntb_capability; 458 size_t ntb_capability_len; 459 460 const u8 *dira; 461 size_t dira_len; 462 463 const u8 *status_ie; 464 size_t status_ie_len; 465 466 const u8 *op_mode; 467 size_t op_mode_len; 468 }; 469 470 471 struct pr_config { 472 u8 pasn_type; 473 474 int preferred_ranging_role; 475 476 char country[3]; 477 478 u8 dev_addr[ETH_ALEN]; 479 480 /** 481 * dev_name - Device Name 482 */ 483 char *dev_name; 484 485 bool edca_ista_support; 486 487 bool edca_rsta_support; 488 489 /* Best single format_bw value derived from pd_format_bw_bitmap */ 490 u8 edca_format_and_bw; 491 492 u32 edca_min_ranging_interval; 493 494 u8 max_tx_antenna; 495 496 u8 max_rx_antenna; 497 498 struct pr_channels edca_channels; 499 500 bool ntb_ista_support; 501 502 bool ntb_rsta_support; 503 504 bool concurrent_ista_rsta; 505 506 u32 pmsr_max_peers; 507 508 u32 pr_max_peer_ista_role; 509 510 u32 pr_max_peer_rsta_role; 511 512 u8 max_ftms_per_burst; 513 514 bool secure_he_ltf; 515 516 u8 max_tx_ltf_repetations; 517 518 u8 max_rx_ltf_repetations; 519 520 u8 max_tx_ltf_total; 521 522 u8 max_rx_ltf_total; 523 524 u8 max_rx_sts_le_80; 525 526 u8 max_rx_sts_gt_80; 527 528 u8 max_tx_sts_le_80; 529 530 u8 max_tx_sts_gt_80; 531 532 /* PD ranging preamble and bandwidth bitmaps (shared by EDCA and NTB) */ 533 u32 pd_preamble_bitmap; 534 u32 pd_format_bw_bitmap; 535 536 /* Best single format_bw value derived from pd_format_bw_bitmap */ 537 u8 ntb_format_and_bw; 538 539 u32 ntb_min_ranging_interval; 540 541 struct pr_channels ntb_channels; 542 543 bool support_6ghz; 544 545 /* Cipher version type */ 546 int dik_cipher; 547 548 /* Buffer to hold the DevIK */ 549 u8 dik_data[DEVICE_IDENTITY_KEY_LEN]; 550 551 /* Length of DevIK in octets */ 552 size_t dik_len; 553 554 /* DevIK expiration */ 555 int expiration; 556 557 /* Global password to be used in PASN-SAE for Advertiser */ 558 char global_password[100]; 559 560 bool global_password_valid; 561 562 /** 563 * cb_ctx - Context to use with callback functions 564 */ 565 void *cb_ctx; 566 567 /** 568 * pasn_send_mgmt - Function handler to transmit a Management frame 569 * @ctx: Callback context from cb_ctx 570 * @data: Frame to transmit 571 * @data_len: Length of frame to transmit 572 * @noack: No ack flag 573 * @freq: Frequency in MHz for the channel on which to transmit 574 * @wait: How many milliseconds to wait for a response frame 575 * Returns: 0 on success, -1 on failure 576 */ 577 int (*pasn_send_mgmt)(void *ctx, const u8 *data, size_t data_len, 578 int noack, unsigned int freq, unsigned int wait); 579 580 /** 581 * negotiation_started - Called when PASN negotiation begins 582 * @ctx: Callback context from cb_ctx 583 * @peer_addr: MAC address of the peer 584 * @role: Ranging role (initiator or responder) 585 * @protocol_type: Ranging protocol type 586 * 587 * Fired on the initiator after Auth frame 1 (M1) is sent, and on the 588 * responder after Auth frame 1 (M1) is received and M2 is sent back. 589 */ 590 void (*negotiation_started)(void *ctx, const u8 *peer_addr, u8 role, 591 u8 protocol_type); 592 593 void (*pasn_result)(void *ctx, u8 role, u8 protocol_type, u8 op_class, 594 u8 op_channel, const char *country); 595 596 int (*set_keys)(void *ctx, const u8 *own_addr, const u8 *peer_addr, 597 int cipher, int akmp, struct wpa_ptk *ptk); 598 599 void (*clear_keys)(void *ctx, const u8 *own_addr, const u8 *peer_addr); 600 601 void (*get_ranging_params)(void *ctx, const u8 *dev_addr, 602 const u8 *peer_addr, u8 ranging_role, 603 u8 protocol_type, u8 op_class, u8 op_channel, 604 u8 self_format_bw, u8 peer_format_bw); 605 606 void (*device_found)(void *ctx, const struct pr_device *dev); 607 }; 608 609 struct pr_data { 610 /** 611 * cfg - PR module configuration 612 * 613 * This is included in the same memory allocation with the 614 * struct pr_data and as such, must not be freed separately. 615 */ 616 struct pr_config *cfg; 617 618 struct dl_list devices; 619 620 struct dl_list dev_iks; 621 622 /* PMKSA cache for PASN-PMK authentication */ 623 struct rsn_pmksa_cache *initiator_pmksa; 624 struct rsn_pmksa_cache *responder_pmksa; 625 626 /* PR PASN request tracking - similar to pasn_params in wpa_supplicant 627 */ 628 struct pr_pasn_ranging_params *pr_pasn_params; 629 630 /* Set when final measurement result received; blocks further results */ 631 bool ranging_final_received; 632 }; 633 634 /* PR Device Identity Resolution Attribute parameters */ 635 struct pr_dira { 636 /* Cipher version type */ 637 int cipher_version; 638 /* Nonce used in DIRA attribute */ 639 u8 nonce[DEVICE_IDENTITY_NONCE_LEN]; 640 /* Length of nonce */ 641 size_t nonce_len; 642 /* Tag computed for nonce using NIK */ 643 u8 tag[DEVICE_IDENTITY_TAG_LEN]; 644 /* Length of tag in octets */ 645 size_t tag_len; 646 }; 647 648 struct operation_mode { 649 /* Bitmap for Ranging Protocol type */ 650 u8 protocol_type; 651 652 /* Bitmap for Role-ISTA/RSTA */ 653 u8 role; 654 655 char country[3]; 656 657 struct pr_channels channels; 658 }; 659 660 struct pr_data * pr_init(const struct pr_config *cfg); 661 void pr_flush(struct pr_data *pr); 662 void pr_deinit(struct pr_data *pr); 663 void pr_set_dev_addr(struct pr_data *pr, const u8 *addr); 664 void pr_clear_dev_iks(struct pr_data *pr); 665 void pr_add_dev_ik(struct pr_data *pr, const u8 *dik, const char *password, 666 const u8 *pmk, size_t pmk_len, bool own); 667 int pr_set_peer_credentials(struct pr_data *pr, const u8 *addr, 668 const u8 *pmk, size_t pmk_len, 669 const char *password); 670 struct wpabuf * pr_prepare_usd_elems(struct pr_data *pr, const u8 *src_addr); 671 void pr_process_usd_elems(struct pr_data *pr, const u8 *ies, u16 ies_len, 672 const u8 *peer_addr, unsigned int freq); 673 int pr_ensure_oob_peer(struct pr_data *pr, const u8 *addr, int freq); 674 int pr_initiate_pasn_auth(struct pr_data *pr, const u8 *addr, int freq, 675 u8 auth_mode, u8 ranging_role, u8 ranging_type, 676 int forced_pr_freq); 677 int pr_pasn_auth_tx_status(struct pr_data *pr, const u8 *data, size_t data_len, 678 bool acked); 679 int pr_pasn_auth_retransmit(struct pr_data *pr, const u8 *addr); 680 int pr_pasn_auth_rx(struct pr_data *pr, const struct ieee80211_mgmt *mgmt, 681 size_t len, int freq); 682 683 #endif /* PROXIMITY_RANGING_H */ 684