// SPDX-License-Identifier: GPL-2.0-only
/*
* nxpwifi: scan ioctl and command handling
*
* Copyright 2011-2024 NXP
*/
#include "cfg.h"
#include "util.h"
#include "fw.h"
#include "main.h"
#include "cmdevt.h"
#include "11n.h"
#include "11ac.h"
#include "11ax.h"
#include "cfg80211.h"
/* The maximum number of channels the firmware can scan per command */
#define NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN 14
#define NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD 4
/* Memory needed to store a max sized Channel List TLV for a firmware scan */
#define CHAN_TLV_MAX_SIZE (sizeof(struct nxpwifi_ie_types_header) \
+ (NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN \
* sizeof(struct nxpwifi_chan_scan_param_set)))
/* Memory needed to store supported rate */
#define RATE_TLV_MAX_SIZE (sizeof(struct nxpwifi_ie_types_rates_param_set) \
+ HOSTCMD_SUPPORTED_RATES)
/* Memory needed to store a max number/size WildCard SSID TLV for a firmware scan */
#define WILDCARD_SSID_TLV_MAX_SIZE \
(NXPWIFI_MAX_SSID_LIST_LENGTH * \
(sizeof(struct nxpwifi_ie_types_wildcard_ssid_params) \
+ IEEE80211_MAX_SSID_LEN))
/* Maximum memory needed for a nxpwifi_scan_cmd_config with all TLVs at max */
#define MAX_SCAN_CFG_ALLOC (sizeof(struct nxpwifi_scan_cmd_config) \
+ sizeof(struct nxpwifi_ie_types_num_probes) \
+ sizeof(struct nxpwifi_ie_types_htcap) \
+ sizeof(struct nxpwifi_ie_types_vhtcap) \
+ sizeof(struct nxpwifi_ie_types_he_cap) \
+ CHAN_TLV_MAX_SIZE \
+ RATE_TLV_MAX_SIZE \
+ WILDCARD_SSID_TLV_MAX_SIZE)
union nxpwifi_scan_cmd_config_tlv {
/* Scan configuration (variable length) */
struct nxpwifi_scan_cmd_config config;
/* Max allocated block */
u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC];
};
#define NXPWIFI_WPA_CIPHER_SUITE_TKIP SUITE(WLAN_OUI_MICROSOFT, 2)
#define NXPWIFI_WPA_CIPHER_SUITE_CCMP SUITE(WLAN_OUI_MICROSOFT, 4)
static void
_dbg_security_flags(int log_level, const char *func, const char *desc,
struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
_nxpwifi_dbg(priv->adapter, log_level,
"info: %s: %s:\twpa_ie=%#x wpa2_ie=%#x WEP=%s WPA=%s WPA2=%s\tEncMode=%#x privacy=%#x\n",
func, desc,
bss_desc->bcn_wpa_ie ?
bss_desc->bcn_wpa_ie->vend_hdr.element_id : 0,
bss_desc->bcn_rsn_ie ?
bss_desc->bcn_rsn_ie->id : 0,
priv->sec_info.wep_enabled ? "e" : "d",
priv->sec_info.wpa_enabled ? "e" : "d",
priv->sec_info.wpa2_enabled ? "e" : "d",
priv->sec_info.encryption_mode,
bss_desc->privacy);
}
#define dbg_security_flags(mask, desc, priv, bss_desc) \
_dbg_security_flags(NXPWIFI_DBG_##mask, __func__, desc, priv, bss_desc)
/* Parse a WPA/RSN element and check whether its PTK list contains the OUI */
static u8
nxpwifi_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
{
u8 count;
count = iebody->ptk_cnt[0];
/*
* PTK may contain multiple OUIs; iterate through the list and compare
* each one
*/
while (count) {
if (!memcmp(iebody->ptk_body, oui, sizeof(iebody->ptk_body)))
return NXPWIFI_OUI_PRESENT;
--count;
if (count)
iebody = (struct ie_body *)((u8 *)iebody +
sizeof(iebody->ptk_body));
}
pr_debug("info: %s: OUI is not found in PTK\n", __func__);
return NXPWIFI_OUI_NOT_PRESENT;
}
/* Check whether the RSN IE is present and if its PTK list contains the OUI */
static u8
nxpwifi_is_rsn_oui_present(struct nxpwifi_bssdescriptor *bss_desc,
u32 cipher)
{
struct ie_body *iebody;
u8 ret = NXPWIFI_OUI_NOT_PRESENT;
__be32 oui = cpu_to_be32(cipher);
if (bss_desc->bcn_rsn_ie) {
iebody = (struct ie_body *)
(((u8 *)bss_desc->bcn_rsn_ie->data) +
RSN_GTK_OUI_OFFSET);
ret = nxpwifi_search_oui_in_ie(iebody, (u8 *)&oui);
if (ret)
return ret;
}
return ret;
}
/* Check if the WPA IE exists and whether its PTK list contains the OUI */
static u8
nxpwifi_is_wpa_oui_present(struct nxpwifi_bssdescriptor *bss_desc, u32 cipher)
{
struct ie_body *iebody;
u8 ret = NXPWIFI_OUI_NOT_PRESENT;
__be32 oui = cpu_to_be32(cipher);
if (bss_desc->bcn_wpa_ie) {
iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
WPA_GTK_OUI_OFFSET);
ret = nxpwifi_search_oui_in_ie(iebody, (u8 *)&oui);
if (ret)
return ret;
}
return ret;
}
/* Check whether both driver and BSS operate with no security */
static bool
nxpwifi_is_bss_no_sec(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
!priv->sec_info.wpa2_enabled &&
!bss_desc->bcn_rsn_ie &&
!bss_desc->bcn_wpa_ie &&
!priv->sec_info.encryption_mode && !bss_desc->privacy) {
return true;
}
return false;
}
/* Check whether static WEP is enabled and the BSS privacy setting matches */
static bool
nxpwifi_is_bss_static_wep(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
if (priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
!priv->sec_info.wpa2_enabled && bss_desc->privacy) {
return true;
}
return false;
}
/* Check whether WPA is enabled and the BSS contains a WPA IE */
static bool
nxpwifi_is_bss_wpa(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
if (!priv->sec_info.wep_enabled && priv->sec_info.wpa_enabled &&
!priv->sec_info.wpa2_enabled &&
bss_desc->bcn_wpa_ie) {
dbg_security_flags(INFO, "WPA", priv, bss_desc);
return true;
}
return false;
}
/* Check whether WPA2 is enabled and the BSS includes an RSN IE */
static bool
nxpwifi_is_bss_wpa2(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
priv->sec_info.wpa2_enabled &&
bss_desc->bcn_rsn_ie) {
/*
* Some APs (e.g., WRT54G) may omit the privacy bit even when
* using WPA2
*/
dbg_security_flags(ERROR, "WPA2", priv, bss_desc);
return true;
}
return false;
}
/* Check dynamic WEP: enabled in driver, privacy set, and no WPA/RSN IE present */
static bool
nxpwifi_is_bss_dynamic_wep(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
if (!priv->sec_info.wep_enabled && !priv->sec_info.wpa_enabled &&
!priv->sec_info.wpa2_enabled &&
!bss_desc->bcn_wpa_ie &&
!bss_desc->bcn_rsn_ie &&
priv->sec_info.encryption_mode && bss_desc->privacy) {
dbg_security_flags(INFO, "dynamic", priv, bss_desc);
return true;
}
return false;
}
/*
* Check whether a scanned network is compatible with the driver's security
* configuration. The decision considers WEP, WPA, WPA2, privacy settings,
* and whether HT must be disabled when required (e.g., no AES).
*
* General rules:
* - Open networks: always compatible.
* - WPA-only: compatible; HT disabled if AES is not supported.
* - WPA2-only: compatible; HT disabled if AES is not supported.
* - Static WEP: compatible; HT disabled.
* - Dynamic WEP: compatible when privacy is enabled.
*
* Note: Compatibility is not enforced during roaming except for security mode.
*/
static int
nxpwifi_is_network_compatible(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc, u32 mode)
{
struct nxpwifi_adapter *adapter = priv->adapter;
bss_desc->disable_11n = false;
/* Skip compatibility checks while roaming */
if (priv->media_connected &&
priv->bss_mode == NL80211_IFTYPE_STATION &&
bss_desc->bss_mode == NL80211_IFTYPE_STATION)
return 0;
if (priv->wps.session_enable) {
nxpwifi_dbg(adapter, IOCTL,
"info: return success directly in WPS period\n");
return 0;
}
if (bss_desc->chan_sw_ie_present) {
nxpwifi_dbg(adapter, INFO,
"Don't connect to AP with WLAN_EID_CHANNEL_SWITCH\n");
return -EPERM;
}
if (bss_desc->bss_mode == mode) {
if (nxpwifi_is_bss_no_sec(priv, bss_desc)) {
return 0;
} else if (nxpwifi_is_bss_static_wep(priv, bss_desc)) {
nxpwifi_dbg(adapter, INFO,
"info: Disable 11n in WEP mode.\n");
bss_desc->disable_11n = true;
return 0;
} else if (nxpwifi_is_bss_wpa(priv, bss_desc)) {
if (((priv->config_bands & BAND_GN ||
priv->config_bands & BAND_AN) &&
bss_desc->bcn_ht_cap) &&
!nxpwifi_is_wpa_oui_present(bss_desc,
NXPWIFI_WPA_CIPHER_SUITE_CCMP)) {
if (nxpwifi_is_wpa_oui_present
(bss_desc, NXPWIFI_WPA_CIPHER_SUITE_TKIP)) {
nxpwifi_dbg(adapter, INFO,
"info: Disable 11n if AES\t"
"is not supported by AP\n");
bss_desc->disable_11n = true;
} else {
return -EINVAL;
}
}
return 0;
} else if (nxpwifi_is_bss_wpa2(priv, bss_desc)) {
if (((priv->config_bands & BAND_GN ||
priv->config_bands & BAND_AN) &&
bss_desc->bcn_ht_cap) &&
!nxpwifi_is_rsn_oui_present(bss_desc,
WLAN_CIPHER_SUITE_CCMP)) {
if (nxpwifi_is_rsn_oui_present
(bss_desc, WLAN_CIPHER_SUITE_TKIP)) {
nxpwifi_dbg(adapter, INFO,
"info: Disable 11n if AES\t"
"is not supported by AP\n");
bss_desc->disable_11n = true;
} else if (nxpwifi_is_rsn_oui_present
(bss_desc, WLAN_CIPHER_SUITE_GCMP_256) ||
nxpwifi_is_rsn_oui_present
(bss_desc, WLAN_CIPHER_SUITE_CCMP_256)) {
return 0;
} else {
return -EINVAL;
}
}
return 0;
} else if (nxpwifi_is_bss_dynamic_wep(priv, bss_desc)) {
return 0;
}
/* Security mismatch */
dbg_security_flags(ERROR, "failed", priv, bss_desc);
return -EINVAL;
}
return -EINVAL;
}
/*
* Build the channel list for scanning based on region and band settings.
* Used when a scan request does not specify its own channel list.
*/
static int
nxpwifi_scan_create_channel_list(struct nxpwifi_private *priv,
const struct nxpwifi_user_scan_cfg
*user_scan_in,
struct nxpwifi_chan_scan_param_set
*scan_chan_list,
u8 filtered_scan)
{
enum nl80211_band band;
struct ieee80211_supported_band *sband;
struct ieee80211_channel *ch;
struct nxpwifi_adapter *adapter = priv->adapter;
int chan_idx = 0, i;
u16 scan_time = 0;
if (user_scan_in)
scan_time = (u16)user_scan_in->chan_list[0].scan_time;
for (band = 0; (band < NUM_NL80211_BANDS) ; band++) {
if (!priv->wdev.wiphy->bands[band])
continue;
sband = priv->wdev.wiphy->bands[band];
for (i = 0; (i < sband->n_channels) ; i++) {
ch = &sband->channels[i];
if (ch->flags & IEEE80211_CHAN_DISABLED)
continue;
scan_chan_list[chan_idx].band_cfg = band;
if (scan_time)
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(scan_time);
else if ((ch->flags & IEEE80211_CHAN_NO_IR) ||
(ch->flags & IEEE80211_CHAN_RADAR))
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(adapter->passive_scan_time);
else
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(adapter->active_scan_time);
if (ch->flags & IEEE80211_CHAN_NO_IR)
scan_chan_list[chan_idx].chan_scan_mode_bmap |=
(NXPWIFI_PASSIVE_SCAN | NXPWIFI_HIDDEN_SSID_REPORT);
else
scan_chan_list[chan_idx].chan_scan_mode_bmap &=
~NXPWIFI_PASSIVE_SCAN;
scan_chan_list[chan_idx].chan_number = (u32)ch->hw_value;
scan_chan_list[chan_idx].chan_scan_mode_bmap |=
NXPWIFI_DISABLE_CHAN_FILT;
if (filtered_scan &&
!((ch->flags & IEEE80211_CHAN_NO_IR) ||
(ch->flags & IEEE80211_CHAN_RADAR)))
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(adapter->specific_scan_time);
chan_idx++;
}
}
return chan_idx;
}
/*
* Build the channel-list TLV for bgscan based on region and band settings.
*/
static int
nxpwifi_bgscan_create_channel_list(struct nxpwifi_private *priv,
const struct nxpwifi_bg_scan_cfg
*bgscan_cfg_in,
struct nxpwifi_chan_scan_param_set
*scan_chan_list)
{
enum nl80211_band band;
struct ieee80211_supported_band *sband;
struct ieee80211_channel *ch;
struct nxpwifi_adapter *adapter = priv->adapter;
int chan_idx = 0, i;
u16 scan_time = 0, specific_scan_time = adapter->specific_scan_time;
if (bgscan_cfg_in)
scan_time = (u16)bgscan_cfg_in->chan_list[0].scan_time;
for (band = 0; (band < NUM_NL80211_BANDS); band++) {
if (!priv->wdev.wiphy->bands[band])
continue;
sband = priv->wdev.wiphy->bands[band];
for (i = 0; (i < sband->n_channels) ; i++) {
ch = &sband->channels[i];
if (ch->flags & IEEE80211_CHAN_DISABLED)
continue;
scan_chan_list[chan_idx].band_cfg = band;
if (scan_time)
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(scan_time);
else if (ch->flags & IEEE80211_CHAN_NO_IR)
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(adapter->passive_scan_time);
else
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(specific_scan_time);
if (ch->flags & IEEE80211_CHAN_NO_IR)
scan_chan_list[chan_idx].chan_scan_mode_bmap |=
NXPWIFI_PASSIVE_SCAN;
else
scan_chan_list[chan_idx].chan_scan_mode_bmap &=
~NXPWIFI_PASSIVE_SCAN;
scan_chan_list[chan_idx].chan_number = (u32)ch->hw_value;
chan_idx++;
}
}
return chan_idx;
}
/* Append the rate TLV to the scan configuration command */
static int
nxpwifi_append_rate_tlv(struct nxpwifi_private *priv,
struct nxpwifi_scan_cmd_config *scan_cfg_out,
u8 radio)
{
struct nxpwifi_ie_types_rates_param_set *rates_tlv;
u8 rates[NXPWIFI_SUPPORTED_RATES], *tlv_pos;
u32 rates_size;
memset(rates, 0, sizeof(rates));
tlv_pos = (u8 *)scan_cfg_out->tlv_buf + scan_cfg_out->tlv_buf_len;
if (priv->scan_request)
rates_size = nxpwifi_get_rates_from_cfg80211(priv, rates,
radio);
else
rates_size = nxpwifi_get_supported_rates(priv, rates);
nxpwifi_dbg(priv->adapter, CMD,
"info: SCAN_CMD: Rates size = %d\n",
rates_size);
rates_tlv = (struct nxpwifi_ie_types_rates_param_set *)tlv_pos;
rates_tlv->header.type = cpu_to_le16(WLAN_EID_SUPP_RATES);
rates_tlv->header.len = cpu_to_le16((u16)rates_size);
memcpy(rates_tlv->rates, rates, rates_size);
scan_cfg_out->tlv_buf_len += sizeof(rates_tlv->header) + rates_size;
return rates_size;
}
/*
* Build and send multiple scan commands by chunking channel TLVs per scan
* limit.
*/
static int
nxpwifi_scan_channel_list(struct nxpwifi_private *priv,
u32 max_chan_per_scan, u8 filtered_scan,
struct nxpwifi_scan_cmd_config *scan_cfg_out,
struct nxpwifi_ie_types_chan_list_param_set *tlv_o,
struct nxpwifi_chan_scan_param_set *scan_chan_list)
{
struct nxpwifi_adapter *adapter = priv->adapter;
int ret = 0;
struct nxpwifi_chan_scan_param_set *tmp_chan_list;
u32 tlv_idx, rates_size, cmd_no;
u32 total_scan_time;
u32 done_early;
u8 radio_type;
if (!scan_cfg_out || !tlv_o || !scan_chan_list) {
nxpwifi_dbg(priv->adapter, ERROR,
"info: Scan: Null detect: %p, %p, %p\n",
scan_cfg_out, tlv_o, scan_chan_list);
return -EINVAL;
}
/* Check csa channel expiry before preparing scan list */
nxpwifi_11h_get_csa_closed_channel(priv);
tlv_o->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
tmp_chan_list = scan_chan_list;
/*
* Iterate through the channel list and send a firmware scan command for
* each group of max_chan_per_scan channels, or individually for
* channels 1, 6, and 11 when configured.
*/
while (tmp_chan_list->chan_number) {
tlv_idx = 0;
total_scan_time = 0;
radio_type = 0;
tlv_o->header.len = 0;
done_early = false;
/*
* Build the channel TLV for the scan command. Continue adding
* channel TLVs until one of the following conditions is met:
* - tlv_idx reaches the maximum allowed per scan command
* - the next channel is 0 (end of the desired channel list)
* - done_early is set (used for per-channel scanning of 1, 6,
* and 11)
*/
while (tlv_idx < max_chan_per_scan &&
tmp_chan_list->chan_number && !done_early) {
if (tmp_chan_list->chan_number == priv->csa_chan) {
tmp_chan_list++;
continue;
}
radio_type = tmp_chan_list->band_cfg;
nxpwifi_dbg(priv->adapter, INFO,
"info: Scan: Chan(%3d), Band(%d),\t"
"Mode(%d, %d), Dur(%d)\n",
tmp_chan_list->chan_number,
tmp_chan_list->band_cfg,
tmp_chan_list->chan_scan_mode_bmap
& NXPWIFI_PASSIVE_SCAN,
(tmp_chan_list->chan_scan_mode_bmap
& NXPWIFI_DISABLE_CHAN_FILT) >> 1,
le16_to_cpu(tmp_chan_list->max_scan_time));
/* Copy the current channel TLV into the command being prepared */
memcpy(&tlv_o->chan_scan_param[tlv_idx], tmp_chan_list,
sizeof(*tlv_o->chan_scan_param));
/*
* Increment the TLV header length by the size
* appended
*/
le16_unaligned_add_cpu(&tlv_o->header.len,
sizeof(*tlv_o->chan_scan_param));
/*
* The tlv buffer length is set to the number of bytes
* of the between the channel tlv pointer and the start
* of the tlv buffer. This compensates for any TLVs
* that were appended before the channel list.
*/
scan_cfg_out->tlv_buf_len =
(u32)((u8 *)tlv_o - scan_cfg_out->tlv_buf);
scan_cfg_out->tlv_buf_len +=
(sizeof(tlv_o->header)
+ le16_to_cpu(tlv_o->header.len));
/* Advance the index for the channel TLV being constructed. */
tlv_idx++;
/* Count the total scan time per command */
total_scan_time +=
le16_to_cpu(tmp_chan_list->max_scan_time);
done_early = false;
/*
* Stop the loop if the current channel is one of 1, 6,
* or 11 and no SSID or BSSID filter is applied.
*/
if (!filtered_scan &&
(tmp_chan_list->chan_number == 1 ||
tmp_chan_list->chan_number == 6 ||
tmp_chan_list->chan_number == 11))
done_early = true;
/* Advance the tmp pointer to the next channel to be scanned. */
tmp_chan_list++;
/*
* Stop the loop if the next channel is one of 1, 6,
* or 11. This causes that channel to be scanned alone
* in the next iteration.
*/
if (!filtered_scan &&
(tmp_chan_list->chan_number == 1 ||
tmp_chan_list->chan_number == 6 ||
tmp_chan_list->chan_number == 11))
done_early = true;
}
/* Ensure the total scan time does not exceed the scan-command timeout. */
if (total_scan_time > NXPWIFI_MAX_TOTAL_SCAN_TIME) {
nxpwifi_dbg(priv->adapter, ERROR,
"total scan time %dms\t"
"is over limit (%dms), scan skipped\n",
total_scan_time,
NXPWIFI_MAX_TOTAL_SCAN_TIME);
ret = -EINVAL;
break;
}
rates_size = nxpwifi_append_rate_tlv(priv, scan_cfg_out,
radio_type);
if (priv->adapter->ext_scan)
cmd_no = HOST_CMD_802_11_SCAN_EXT;
else
cmd_no = HOST_CMD_802_11_SCAN;
ret = nxpwifi_send_cmd(priv, cmd_no, HOST_ACT_GEN_SET,
0, scan_cfg_out, false);
/*
* The rate element is updated for each scan command, but the
* same starting pointer is reused, so the previous rate element
* in scan_cfg_out->buf is overwritten.
*/
scan_cfg_out->tlv_buf_len -=
sizeof(struct nxpwifi_ie_types_header) + rates_size;
if (ret) {
nxpwifi_cancel_pending_scan_cmd(adapter);
break;
}
}
return ret;
}
/*
* Build final scan config from user params, disabling missing filters and using
* defaults.
*/
static void
nxpwifi_config_scan(struct nxpwifi_private *priv,
const struct nxpwifi_user_scan_cfg *user_scan_in,
struct nxpwifi_scan_cmd_config *scan_cfg_out,
struct nxpwifi_ie_types_chan_list_param_set **chan_list_out,
struct nxpwifi_chan_scan_param_set *scan_chan_list,
u8 *max_chan_per_scan, u8 *filtered_scan,
u8 *scan_current_only)
{
struct nxpwifi_adapter *adapter = priv->adapter;
struct nxpwifi_ie_types_num_probes *num_probes_tlv;
struct nxpwifi_ie_types_scan_chan_gap *chan_gap_tlv;
struct nxpwifi_ie_types_random_mac *random_mac_tlv;
struct nxpwifi_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
struct nxpwifi_ie_types_bssid_list *bssid_tlv;
struct nxpwifi_ie_types_extcap *ext_cap;
u8 *ext_capab = NULL;
u8 *tlv_pos;
u32 num_probes;
u32 ssid_len;
u32 chan_idx;
u32 scan_time;
u32 scan_type;
u16 scan_dur;
u8 channel;
u8 radio_type;
int i, vsid;
u8 ssid_filter;
struct nxpwifi_ie_types_htcap *ht_cap;
struct nxpwifi_ie_types_bss_mode *bss_mode;
struct nxpwifi_ie_types_vhtcap *vht_cap;
struct nxpwifi_ie_types_he_cap *he_cap;
/*
* tlv_buf_len is recalculated for each scan command. TLVs added in this
* routine are preserved because the send routine appends channel TLVs
* at chan_list_out. The difference between chan_list_out and the start
* of the TLV buffer determines the size of the TLVs added here.
*/
scan_cfg_out->tlv_buf_len = 0;
/*
* Running TLV pointer. It is assigned to chan_list_out at the end of
* the function so later routines know where channel TLVs can be
* appended in the command buffer.
*/
tlv_pos = scan_cfg_out->tlv_buf;
/*
* Initialize the scan as un-filtered; the flag is later set to TRUE
* below if a SSID or BSSID filter is sent in the command
*/
*filtered_scan = false;
/*
* Initialize the scan as not being only on the current channel. If
* the channel list is customized, only contains one channel, and is
* the active channel, this is set true and data flow is not halted.
*/
*scan_current_only = false;
if (user_scan_in) {
u8 tmpaddr[ETH_ALEN];
/*
* Default the ssid_filter flag to TRUE, set false under
* certain wildcard conditions and qualified by the existence
* of an SSID list before marking the scan as filtered
*/
ssid_filter = true;
/*
* Set the BSS type scan filter, use Adapter setting if
* unset
*/
scan_cfg_out->bss_mode =
(u8)(user_scan_in->bss_mode ?: adapter->scan_mode);
/*
* Set the number of probes to send, use Adapter setting
* if unset
*/
num_probes = user_scan_in->num_probes ?: adapter->scan_probes;
/*
* Set the BSSID filter to the incoming configuration,
* if non-zero. If not set, it will remain disabled
* (all zeros).
*/
memcpy(scan_cfg_out->specific_bssid,
user_scan_in->specific_bssid,
sizeof(scan_cfg_out->specific_bssid));
memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
if (adapter->ext_scan &&
!is_zero_ether_addr(tmpaddr)) {
bssid_tlv =
(struct nxpwifi_ie_types_bssid_list *)tlv_pos;
bssid_tlv->header.type = cpu_to_le16(TLV_TYPE_BSSID);
bssid_tlv->header.len = cpu_to_le16(ETH_ALEN);
memcpy(bssid_tlv->bssid, user_scan_in->specific_bssid,
ETH_ALEN);
tlv_pos += sizeof(struct nxpwifi_ie_types_bssid_list);
}
for (i = 0; i < user_scan_in->num_ssids; i++) {
ssid_len = user_scan_in->ssid_list[i].ssid_len;
wildcard_ssid_tlv =
(struct nxpwifi_ie_types_wildcard_ssid_params *)
tlv_pos;
wildcard_ssid_tlv->header.type =
cpu_to_le16(TLV_TYPE_WILDCARDSSID);
wildcard_ssid_tlv->header.len =
cpu_to_le16((u16)(ssid_len + sizeof(u8)));
/*
* max_ssid_length = 0 tells firmware to perform
* specific scan for the SSID filled, whereas
* max_ssid_length = IEEE80211_MAX_SSID_LEN is for
* wildcard scan.
*/
if (ssid_len)
wildcard_ssid_tlv->max_ssid_length = 0;
else
wildcard_ssid_tlv->max_ssid_length =
IEEE80211_MAX_SSID_LEN;
if (!memcmp(user_scan_in->ssid_list[i].ssid,
"DIRECT-", 7))
wildcard_ssid_tlv->max_ssid_length = 0xfe;
memcpy(wildcard_ssid_tlv->ssid,
user_scan_in->ssid_list[i].ssid, ssid_len);
tlv_pos += (sizeof(wildcard_ssid_tlv->header)
+ le16_to_cpu(wildcard_ssid_tlv->header.len));
nxpwifi_dbg(adapter, INFO,
"info: scan: ssid[%d]: %s, %d\n",
i, wildcard_ssid_tlv->ssid,
wildcard_ssid_tlv->max_ssid_length);
/*
* Empty wildcard ssid with a maxlen will match many or
* potentially all SSIDs (maxlen == 32), therefore do
* not treat the scan as
* filtered.
*/
if (!ssid_len && wildcard_ssid_tlv->max_ssid_length)
ssid_filter = false;
}
/*
* The default number of channels sent in the command is low to
* ensure the response buffer from the firmware does not
* truncate scan results. That is not an issue with an SSID
* or BSSID filter applied to the scan results in the firmware.
*/
memcpy(tmpaddr, scan_cfg_out->specific_bssid, ETH_ALEN);
if ((i && ssid_filter) ||
!is_zero_ether_addr(tmpaddr))
*filtered_scan = true;
if (user_scan_in->scan_chan_gap) {
nxpwifi_dbg(adapter, INFO,
"info: scan: channel gap = %d\n",
user_scan_in->scan_chan_gap);
*max_chan_per_scan =
NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN;
chan_gap_tlv = (void *)tlv_pos;
chan_gap_tlv->header.type =
cpu_to_le16(TLV_TYPE_SCAN_CHANNEL_GAP);
chan_gap_tlv->header.len =
cpu_to_le16(sizeof(chan_gap_tlv->chan_gap));
chan_gap_tlv->chan_gap =
cpu_to_le16((user_scan_in->scan_chan_gap));
tlv_pos +=
sizeof(struct nxpwifi_ie_types_scan_chan_gap);
}
if (!is_zero_ether_addr(user_scan_in->random_mac)) {
random_mac_tlv = (void *)tlv_pos;
random_mac_tlv->header.type =
cpu_to_le16(TLV_TYPE_RANDOM_MAC);
random_mac_tlv->header.len =
cpu_to_le16(sizeof(random_mac_tlv->mac));
ether_addr_copy(random_mac_tlv->mac,
user_scan_in->random_mac);
tlv_pos +=
sizeof(struct nxpwifi_ie_types_random_mac);
}
} else {
scan_cfg_out->bss_mode = (u8)adapter->scan_mode;
num_probes = adapter->scan_probes;
}
/*
* If a specific BSSID or SSID is used, the number of channels in the
* scan command will be increased to the absolute maximum.
*/
if (*filtered_scan) {
*max_chan_per_scan = NXPWIFI_MAX_CHANNELS_PER_SPECIFIC_SCAN;
} else {
if (!priv->media_connected)
*max_chan_per_scan = NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD;
else
*max_chan_per_scan =
NXPWIFI_DEF_CHANNELS_PER_SCAN_CMD / 2;
}
if (adapter->ext_scan) {
bss_mode = (struct nxpwifi_ie_types_bss_mode *)tlv_pos;
bss_mode->header.type = cpu_to_le16(TLV_TYPE_BSS_MODE);
bss_mode->header.len = cpu_to_le16(sizeof(bss_mode->bss_mode));
bss_mode->bss_mode = scan_cfg_out->bss_mode;
tlv_pos += sizeof(bss_mode->header) +
le16_to_cpu(bss_mode->header.len);
}
/*
* If the input config or adapter has the number of Probes set,
* add tlv
*/
if (num_probes) {
nxpwifi_dbg(adapter, INFO,
"info: scan: num_probes = %d\n",
num_probes);
num_probes_tlv = (struct nxpwifi_ie_types_num_probes *)tlv_pos;
num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
num_probes_tlv->header.len =
cpu_to_le16(sizeof(num_probes_tlv->num_probes));
num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);
tlv_pos += sizeof(num_probes_tlv->header) +
le16_to_cpu(num_probes_tlv->header.len);
}
if (ISSUPP_11NENABLED(priv->adapter->fw_cap_info) &&
(priv->config_bands & BAND_GN ||
priv->config_bands & BAND_AN)) {
ht_cap = (struct nxpwifi_ie_types_htcap *)tlv_pos;
memset(ht_cap, 0, sizeof(struct nxpwifi_ie_types_htcap));
ht_cap->header.type = cpu_to_le16(WLAN_EID_HT_CAPABILITY);
ht_cap->header.len =
cpu_to_le16(sizeof(struct ieee80211_ht_cap));
radio_type =
nxpwifi_band_to_radio_type(priv->config_bands);
nxpwifi_fill_cap_info(priv, radio_type, &ht_cap->ht_cap);
tlv_pos += sizeof(struct nxpwifi_ie_types_htcap);
}
if (ISSUPP_11ACENABLED(adapter->fw_cap_info) &&
(priv->config_bands & BAND_AAC)) {
vht_cap = (struct nxpwifi_ie_types_vhtcap *)tlv_pos;
memset(vht_cap, 0, sizeof(struct nxpwifi_ie_types_vhtcap));
vht_cap->header.type = cpu_to_le16(WLAN_EID_VHT_CAPABILITY);
vht_cap->header.len = cpu_to_le16(sizeof(struct ieee80211_vht_cap));
nxpwifi_fill_vht_cap_tlv(priv, &vht_cap->vht_cap, priv->config_bands);
tlv_pos += sizeof(*vht_cap);
}
if (ISSUPP_11AXENABLED(adapter->fw_cap_ext) &&
(priv->config_bands & BAND_GAX ||
priv->config_bands & BAND_AAX)) {
he_cap = (struct nxpwifi_ie_types_he_cap *)tlv_pos;
memset(he_cap, 0, sizeof(struct nxpwifi_ie_types_he_cap));
tlv_pos += nxpwifi_fill_he_cap_tlv(priv, he_cap, priv->config_bands);
}
if (nxpwifi_is_sta_11ax_twt_req_supported(priv)) {
for (vsid = 0; vsid < NXPWIFI_MAX_VSIE_NUM; vsid++) {
if (priv->vs_ie[vsid].mask & NXPWIFI_VSIE_MASK_SCAN) {
ext_capab = (u8 *)cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
priv->vs_ie[vsid].ie,
sizeof(priv->vs_ie[vsid].ie));
break;
}
}
if (ext_capab) {
ext_capab += 2;
} else {
ext_cap = (struct nxpwifi_ie_types_extcap *)tlv_pos;
memset(ext_cap, 0, sizeof(struct nxpwifi_ie_types_extcap) +
NXPWIFI_EXT_CAPAB_IE_LEN);
ext_cap->header.type = cpu_to_le16(WLAN_EID_EXT_CAPABILITY);
ext_cap->header.len = cpu_to_le16(NXPWIFI_EXT_CAPAB_IE_LEN);
ext_capab = ext_cap->ext_capab;
tlv_pos += sizeof(struct nxpwifi_ie_types_extcap) +
le16_to_cpu(ext_cap->header.len);
}
ext_capab[9] |= WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT;
}
/* Append vendor specific element TLV */
nxpwifi_cmd_append_vsie_tlv(priv, NXPWIFI_VSIE_MASK_SCAN, &tlv_pos);
/*
* Set the channel TLV output pointer to the end of the newly added TLVs
* (SSID, num_probes). Channel TLVs for each scan will be appended after
* these, preserving previously added TLVs.
*/
*chan_list_out =
(struct nxpwifi_ie_types_chan_list_param_set *)tlv_pos;
if (user_scan_in && user_scan_in->chan_list[0].chan_number) {
nxpwifi_dbg(adapter, INFO,
"info: Scan: Using supplied channel list\n");
for (chan_idx = 0;
chan_idx < NXPWIFI_USER_SCAN_CHAN_MAX &&
user_scan_in->chan_list[chan_idx].chan_number;
chan_idx++) {
channel = user_scan_in->chan_list[chan_idx].chan_number;
scan_chan_list[chan_idx].chan_number = channel;
radio_type =
user_scan_in->chan_list[chan_idx].radio_type;
scan_chan_list[chan_idx].band_cfg = radio_type;
scan_type = user_scan_in->chan_list[chan_idx].scan_type;
if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
scan_chan_list[chan_idx].chan_scan_mode_bmap |=
(NXPWIFI_PASSIVE_SCAN |
NXPWIFI_HIDDEN_SSID_REPORT);
else
scan_chan_list[chan_idx].chan_scan_mode_bmap &=
~NXPWIFI_PASSIVE_SCAN;
scan_chan_list[chan_idx].chan_scan_mode_bmap |=
NXPWIFI_DISABLE_CHAN_FILT;
scan_time = user_scan_in->chan_list[chan_idx].scan_time;
if (scan_time) {
scan_dur = (u16)scan_time;
} else {
if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
scan_dur = adapter->passive_scan_time;
else if (*filtered_scan)
scan_dur = adapter->specific_scan_time;
else
scan_dur = adapter->active_scan_time;
}
scan_chan_list[chan_idx].min_scan_time =
cpu_to_le16(scan_dur);
scan_chan_list[chan_idx].max_scan_time =
cpu_to_le16(scan_dur);
}
/* Check if we are only scanning the current channel */
if (chan_idx == 1 &&
user_scan_in->chan_list[0].chan_number ==
priv->curr_bss_params.bss_descriptor.channel) {
*scan_current_only = true;
nxpwifi_dbg(adapter, INFO,
"info: Scan: Scanning current channel only\n");
}
} else {
nxpwifi_dbg(adapter, INFO,
"info: Scan: Creating full region channel list\n");
nxpwifi_scan_create_channel_list(priv, user_scan_in,
scan_chan_list,
*filtered_scan);
}
}
/* Parse the beacon buffer and update the BSS descriptor fields. */
int nxpwifi_update_bss_desc_with_ie(struct nxpwifi_adapter *adapter,
struct nxpwifi_bssdescriptor *bss_entry)
{
u8 element_id;
u16 elem_size = sizeof(struct element);
struct ieee_types_fh_param_set *fh_param_set;
struct ieee_types_ds_param_set *ds_param_set;
struct ieee_types_cf_param_set *cf_param_set;
u8 *current_ptr;
u8 *rate;
u8 element_len;
u16 total_ie_len;
u8 bytes_to_copy;
u8 rate_size;
u8 found_data_rate_ie;
u32 bytes_left;
struct ieee_types_vendor_specific *vendor_ie;
const u8 wpa_oui[4] = { 0x00, 0x50, 0xf2, 0x01 };
const u8 wmm_oui[4] = { 0x00, 0x50, 0xf2, 0x02 };
struct element *elem;
found_data_rate_ie = false;
rate_size = 0;
current_ptr = bss_entry->beacon_buf;
bytes_left = bss_entry->beacon_buf_size;
/* Process variable element */
while (bytes_left >= 2) {
element_id = *current_ptr;
element_len = *(current_ptr + 1);
total_ie_len = element_len + elem_size;
if (bytes_left < total_ie_len) {
nxpwifi_dbg(adapter, ERROR,
"err: InterpretIE: in processing\t"
"element, bytes left < element length\n");
return -EINVAL;
}
switch (element_id) {
case WLAN_EID_SSID:
if (element_len > IEEE80211_MAX_SSID_LEN)
return -EINVAL;
bss_entry->ssid.ssid_len = element_len;
memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
element_len);
nxpwifi_dbg(adapter, INFO,
"info: InterpretIE: ssid: %-32s\n",
bss_entry->ssid.ssid);
break;
case WLAN_EID_SUPP_RATES:
if (element_len > NXPWIFI_SUPPORTED_RATES)
return -EINVAL;
memcpy(bss_entry->data_rates, current_ptr + 2,
element_len);
memcpy(bss_entry->supported_rates, current_ptr + 2,
element_len);
rate_size = element_len;
found_data_rate_ie = true;
break;
case WLAN_EID_FH_PARAMS:
if (total_ie_len < sizeof(*fh_param_set))
return -EINVAL;
fh_param_set =
(struct ieee_types_fh_param_set *)current_ptr;
memcpy(&bss_entry->phy_param_set.fh_param_set,
fh_param_set,
sizeof(struct ieee_types_fh_param_set));
break;
case WLAN_EID_DS_PARAMS:
if (total_ie_len < sizeof(*ds_param_set))
return -EINVAL;
ds_param_set =
(struct ieee_types_ds_param_set *)current_ptr;
bss_entry->channel = ds_param_set->current_chan;
memcpy(&bss_entry->phy_param_set.ds_param_set,
ds_param_set,
sizeof(struct ieee_types_ds_param_set));
break;
case WLAN_EID_CF_PARAMS:
if (total_ie_len < sizeof(*cf_param_set))
return -EINVAL;
cf_param_set =
(struct ieee_types_cf_param_set *)current_ptr;
memcpy(&bss_entry->cf_param_set,
cf_param_set,
sizeof(struct ieee_types_cf_param_set));
break;
case WLAN_EID_ERP_INFO:
if (!element_len)
return -EINVAL;
bss_entry->erp_flags = *(current_ptr + 2);
break;
case WLAN_EID_PWR_CONSTRAINT:
if (!element_len)
return -EINVAL;
bss_entry->local_constraint = *(current_ptr + 2);
bss_entry->sensed_11h = true;
break;
case WLAN_EID_CHANNEL_SWITCH:
bss_entry->chan_sw_ie_present = true;
fallthrough;
case WLAN_EID_PWR_CAPABILITY:
case WLAN_EID_TPC_REPORT:
case WLAN_EID_QUIET:
bss_entry->sensed_11h = true;
break;
case WLAN_EID_EXT_SUPP_RATES:
/*
* Only process extended supported rate
* if data rate is already found.
* Data rate element should come before
* extended supported rate element
*/
if (found_data_rate_ie) {
if ((element_len + rate_size) >
NXPWIFI_SUPPORTED_RATES)
bytes_to_copy =
(NXPWIFI_SUPPORTED_RATES -
rate_size);
else
bytes_to_copy = element_len;
rate = (u8 *)bss_entry->data_rates;
rate += rate_size;
memcpy(rate, current_ptr + 2, bytes_to_copy);
rate = (u8 *)bss_entry->supported_rates;
rate += rate_size;
memcpy(rate, current_ptr + 2, bytes_to_copy);
}
break;
case WLAN_EID_VENDOR_SPECIFIC:
vendor_ie = (struct ieee_types_vendor_specific *)
current_ptr;
/* 802.11 requires at least 3-byte OUI. */
if (element_len < sizeof(vendor_ie->vend_hdr.oui))
return -EINVAL;
/* Not long enough for a match? Skip it. */
if (element_len < sizeof(wpa_oui))
break;
if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
sizeof(wpa_oui))) {
bss_entry->bcn_wpa_ie =
(struct ieee_types_vendor_specific *)
current_ptr;
bss_entry->wpa_offset =
(u16)(current_ptr -
bss_entry->beacon_buf);
} else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
sizeof(wmm_oui))) {
if (total_ie_len ==
sizeof(struct ieee80211_wmm_param_ie) ||
total_ie_len ==
sizeof(struct ieee_types_wmm_info))
/*
* Only accept and copy the WMM element if
* it matches the size expected for the
* WMM Info element or the WMM Parameter element.
*/
memcpy((u8 *)&bss_entry->wmm_ie,
current_ptr, total_ie_len);
}
break;
case WLAN_EID_RSN:
bss_entry->bcn_rsn_ie =
(struct element *)current_ptr;
bss_entry->rsn_offset =
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_RSNX:
bss_entry->bcn_rsnx_ie =
(struct element *)current_ptr;
bss_entry->rsnx_offset =
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_HT_CAPABILITY:
bss_entry->bcn_ht_cap =
(struct ieee80211_ht_cap *)(current_ptr +
elem_size);
bss_entry->ht_cap_offset =
(u16)(current_ptr + elem_size -
bss_entry->beacon_buf);
break;
case WLAN_EID_HT_OPERATION:
bss_entry->bcn_ht_oper =
(struct ieee80211_ht_operation *)(current_ptr +
elem_size);
bss_entry->ht_info_offset =
(u16)(current_ptr + elem_size -
bss_entry->beacon_buf);
break;
case WLAN_EID_VHT_CAPABILITY:
bss_entry->disable_11ac = false;
bss_entry->bcn_vht_cap = (void *)(current_ptr +
elem_size);
bss_entry->vht_cap_offset =
(u16)((u8 *)bss_entry->bcn_vht_cap -
bss_entry->beacon_buf);
break;
case WLAN_EID_VHT_OPERATION:
bss_entry->bcn_vht_oper =
(void *)(current_ptr + elem_size);
bss_entry->vht_info_offset =
(u16)((u8 *)bss_entry->bcn_vht_oper -
bss_entry->beacon_buf);
break;
case WLAN_EID_BSS_COEX_2040:
bss_entry->bcn_bss_co_2040 = current_ptr;
bss_entry->bss_co_2040_offset =
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_EXT_CAPABILITY:
bss_entry->bcn_ext_cap = current_ptr;
bss_entry->ext_cap_offset =
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_OPMODE_NOTIF:
bss_entry->oper_mode = (void *)current_ptr;
bss_entry->oper_mode_offset =
(u16)(current_ptr - bss_entry->beacon_buf);
break;
case WLAN_EID_EXTENSION:
if (!element_len)
return -EINVAL;
elem = (struct element *)current_ptr;
switch (elem->data[0]) {
case WLAN_EID_EXT_HE_CAPABILITY:
bss_entry->disable_11ax = false;
bss_entry->bcn_he_cap =
(void *)(current_ptr + elem_size + 1);
bss_entry->he_cap_offset =
(u16)((u8 *)bss_entry->bcn_he_cap -
bss_entry->beacon_buf);
break;
case WLAN_EID_EXT_HE_OPERATION:
bss_entry->bcn_he_oper =
(void *)(current_ptr + elem_size + 1);
bss_entry->he_info_offset =
(u16)((u8 *)bss_entry->bcn_he_oper -
bss_entry->beacon_buf);
break;
default:
break;
}
break;
default:
break;
}
current_ptr += total_ie_len;
bytes_left -= total_ie_len;
} /* while (bytes_left > 2) */
return 0;
}
/* Convert the radio-type scan parameter to the join command's band config. */
static u8
nxpwifi_radio_type_to_band(u8 radio_type)
{
switch (radio_type) {
case HOST_SCAN_RADIO_TYPE_A:
return BAND_A;
case HOST_SCAN_RADIO_TYPE_BG:
default:
return BAND_G;
}
}
/* Internal helper to start a scan using the given configuration. */
int nxpwifi_scan_networks(struct nxpwifi_private *priv,
const struct nxpwifi_user_scan_cfg *user_scan_in)
{
int ret;
struct nxpwifi_adapter *adapter = priv->adapter;
struct cmd_ctrl_node *cmd_node;
union nxpwifi_scan_cmd_config_tlv *scan_cfg_out;
struct nxpwifi_ie_types_chan_list_param_set *chan_list_out;
struct nxpwifi_chan_scan_param_set *scan_chan_list;
u8 filtered_scan;
u8 scan_current_chan_only;
u8 max_chan_per_scan;
if (adapter->scan_processing) {
nxpwifi_dbg(adapter, WARN,
"cmd: Scan already in process...\n");
return -EBUSY;
}
if (priv->scan_block) {
nxpwifi_dbg(adapter, WARN,
"cmd: Scan is blocked during association...\n");
return -EBUSY;
}
if (test_bit(NXPWIFI_SURPRISE_REMOVED, &adapter->work_flags) ||
test_bit(NXPWIFI_IS_CMD_TIMEDOUT, &adapter->work_flags)) {
nxpwifi_dbg(adapter, ERROR,
"Ignore scan. Card removed or firmware in bad state\n");
return -EPERM;
}
spin_lock_bh(&adapter->nxpwifi_cmd_lock);
adapter->scan_processing = true;
spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
scan_cfg_out = kzalloc_obj(union nxpwifi_scan_cmd_config_tlv,
GFP_KERNEL);
if (!scan_cfg_out) {
ret = -ENOMEM;
goto done;
}
scan_chan_list = kzalloc_objs(struct nxpwifi_chan_scan_param_set,
NXPWIFI_USER_SCAN_CHAN_MAX, GFP_KERNEL);
if (!scan_chan_list) {
kfree(scan_cfg_out);
ret = -ENOMEM;
goto done;
}
nxpwifi_config_scan(priv, user_scan_in, &scan_cfg_out->config,
&chan_list_out, scan_chan_list, &max_chan_per_scan,
&filtered_scan, &scan_current_chan_only);
ret = nxpwifi_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
&scan_cfg_out->config, chan_list_out,
scan_chan_list);
/* Get scan command from scan_pending_q and put to cmd_pending_q */
if (!ret) {
spin_lock_bh(&adapter->scan_pending_q_lock);
if (!list_empty(&adapter->scan_pending_q)) {
cmd_node = list_first_entry(&adapter->scan_pending_q,
struct cmd_ctrl_node, list);
list_del(&cmd_node->list);
spin_unlock_bh(&adapter->scan_pending_q_lock);
nxpwifi_insert_cmd_to_pending_q(adapter, cmd_node);
nxpwifi_queue_work(adapter, &adapter->main_work);
/* Perform internal scan synchronously */
if (!priv->scan_request) {
nxpwifi_dbg(adapter, INFO,
"wait internal scan\n");
nxpwifi_wait_queue_complete(adapter, cmd_node);
}
} else {
spin_unlock_bh(&adapter->scan_pending_q_lock);
}
}
kfree(scan_cfg_out);
kfree(scan_chan_list);
done:
if (ret) {
spin_lock_bh(&adapter->nxpwifi_cmd_lock);
adapter->scan_processing = false;
spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
}
return ret;
}
/*
* Build the firmware scan command from the given configuration, including
* fixed fields and TLVs, and set the command ID, size, and endianness.
*/
int nxpwifi_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
struct nxpwifi_scan_cmd_config *scan_cfg)
{
struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;
/* Set fixed field variables in scan command */
scan_cmd->bss_mode = scan_cfg->bss_mode;
memcpy(scan_cmd->bssid, scan_cfg->specific_bssid,
sizeof(scan_cmd->bssid));
memcpy(scan_cmd->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
cmd->command = cpu_to_le16(HOST_CMD_802_11_SCAN);
/* Size is equal to the sizeof(fixed portions) + the TLV len + header */
cmd->size = cpu_to_le16((u16)(sizeof(scan_cmd->bss_mode)
+ sizeof(scan_cmd->bssid)
+ scan_cfg->tlv_buf_len + S_DS_GEN));
return 0;
}
/* Check compatibility of the requested network with current driver settings. */
int nxpwifi_check_network_compatibility(struct nxpwifi_private *priv,
struct nxpwifi_bssdescriptor *bss_desc)
{
int ret = 0;
if (!bss_desc)
return -EINVAL;
if ((nxpwifi_get_cfp(priv, (u8)bss_desc->bss_band,
(u16)bss_desc->channel, 0))) {
switch (priv->bss_mode) {
case NL80211_IFTYPE_STATION:
ret = nxpwifi_is_network_compatible(priv, bss_desc,
priv->bss_mode);
if (ret)
nxpwifi_dbg(priv->adapter, ERROR,
"Incompatible network settings\n");
break;
default:
ret = 0;
}
}
return ret;
}
/* Check if the SSID length is zero or all bytes are zero. */
static bool nxpwifi_is_hidden_ssid(struct cfg80211_ssid *ssid)
{
int idx;
for (idx = 0; idx < ssid->ssid_len; idx++) {
if (ssid->ssid[idx])
return false;
}
return true;
}
/* Find hidden SSIDs on passive channels and save those channels for active scan. */
static int nxpwifi_save_hidden_ssid_channels(struct nxpwifi_private *priv,
struct cfg80211_bss *bss)
{
struct nxpwifi_bssdescriptor *bss_desc;
int ret;
int chid;
/* Allocate and fill new bss descriptor */
bss_desc = kzalloc_obj(*bss_desc, GFP_KERNEL);
if (!bss_desc)
return -ENOMEM;
ret = nxpwifi_fill_new_bss_desc(priv, bss, bss_desc);
if (ret)
goto done;
if (nxpwifi_is_hidden_ssid(&bss_desc->ssid)) {
nxpwifi_dbg(priv->adapter, INFO, "found hidden SSID\n");
for (chid = 0 ; chid < NXPWIFI_USER_SCAN_CHAN_MAX; chid++) {
if (priv->hidden_chan[chid].chan_number ==
bss->channel->hw_value)
break;
if (!priv->hidden_chan[chid].chan_number) {
priv->hidden_chan[chid].chan_number =
bss->channel->hw_value;
priv->hidden_chan[chid].radio_type =
bss->channel->band;
priv->hidden_chan[chid].scan_type =
NXPWIFI_SCAN_TYPE_ACTIVE;
break;
}
}
}
done:
/* Free beacon_ie allocated by nxpwifi_fill_new_bss_desc(). */
kfree(bss_desc->beacon_buf);
kfree(bss_desc);
return ret;
}
static int nxpwifi_update_curr_bss_params(struct nxpwifi_private *priv,
struct cfg80211_bss *bss)
{
struct nxpwifi_bssdescriptor *bss_desc;
int ret;
/* Allocate and fill new bss descriptor */
bss_desc = kzalloc_obj(*bss_desc, GFP_KERNEL);
if (!bss_desc)
return -ENOMEM;
ret = nxpwifi_fill_new_bss_desc(priv, bss, bss_desc);
if (ret)
goto done;
ret = nxpwifi_check_network_compatibility(priv, bss_desc);
if (ret)
goto done;
spin_lock_bh(&priv->curr_bcn_buf_lock);
/* Make a copy of current BSSID descriptor */
memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
sizeof(priv->curr_bss_params.bss_descriptor));
/* beacon_ie will be copied to its own buffer in nxpwifi_save_curr_bcn(). */
nxpwifi_save_curr_bcn(priv);
spin_unlock_bh(&priv->curr_bcn_buf_lock);
done:
/* Free beacon_ie allocated by nxpwifi_fill_new_bss_desc(). */
kfree(bss_desc->beacon_buf);
kfree(bss_desc);
return ret;
}
static int
nxpwifi_parse_single_response_buf(struct nxpwifi_private *priv, u8 **bss_info,
u32 *bytes_left, u64 fw_tsf, const u8 *radio_type,
bool ext_scan, s32 rssi_val)
{
struct nxpwifi_adapter *adapter = priv->adapter;
struct nxpwifi_chan_freq_power *cfp;
struct cfg80211_bss *bss;
u8 bssid[ETH_ALEN];
s32 rssi;
const u8 *ie_buf;
size_t ie_len;
u16 channel = 0;
u16 beacon_size = 0;
u32 curr_bcn_bytes;
u32 freq;
u16 beacon_period;
u16 cap_info_bitmap;
u8 *current_ptr;
u64 timestamp;
struct nxpwifi_fixed_bcn_param *bcn_param;
struct nxpwifi_bss_priv *bss_priv;
if (*bytes_left >= sizeof(beacon_size)) {
/* Extract & convert beacon size from command buffer */
beacon_size = get_unaligned_le16((*bss_info));
*bytes_left -= sizeof(beacon_size);
*bss_info += sizeof(beacon_size);
}
if (!beacon_size || beacon_size > *bytes_left) {
*bss_info += *bytes_left;
*bytes_left = 0;
return -EINVAL;
}
/*
* Initialize the current working beacon pointer for this BSS
* iteration
*/
current_ptr = *bss_info;
/* Advance the return beacon pointer past the current beacon */
*bss_info += beacon_size;
*bytes_left -= beacon_size;
curr_bcn_bytes = beacon_size;
/*
* First 5 fields are bssid, RSSI(for legacy scan only),
* time stamp, beacon interval, and capability information
*/
if (curr_bcn_bytes < ETH_ALEN + sizeof(u8) +
sizeof(struct nxpwifi_fixed_bcn_param)) {
nxpwifi_dbg(adapter, ERROR,
"InterpretIE: not enough bytes left\n");
return -EINVAL;
}
memcpy(bssid, current_ptr, ETH_ALEN);
current_ptr += ETH_ALEN;
curr_bcn_bytes -= ETH_ALEN;
if (!ext_scan) {
rssi = (s32)*current_ptr;
rssi = (-rssi) * 100; /* Convert dBm to mBm */
current_ptr += sizeof(u8);
curr_bcn_bytes -= sizeof(u8);
nxpwifi_dbg(adapter, INFO,
"info: InterpretIE: RSSI=%d\n", rssi);
} else {
rssi = rssi_val;
}
bcn_param = (struct nxpwifi_fixed_bcn_param *)current_ptr;
current_ptr += sizeof(*bcn_param);
curr_bcn_bytes -= sizeof(*bcn_param);
timestamp = le64_to_cpu(bcn_param->timestamp);
beacon_period = le16_to_cpu(bcn_param->beacon_period);
cap_info_bitmap = le16_to_cpu(bcn_param->cap_info_bitmap);
nxpwifi_dbg(adapter, INFO,
"info: InterpretIE: capabilities=0x%X\n",
cap_info_bitmap);
/* Rest of the current buffer are element's */
ie_buf = current_ptr;
ie_len = curr_bcn_bytes;
nxpwifi_dbg(adapter, INFO,
"info: InterpretIE: IELength for this AP = %d\n",
curr_bcn_bytes);
while (curr_bcn_bytes >= sizeof(struct element)) {
u8 element_id, element_len;
element_id = *current_ptr;
element_len = *(current_ptr + 1);
if (curr_bcn_bytes < element_len +
sizeof(struct element)) {
nxpwifi_dbg(adapter, ERROR,
"%s: bytes left < element length\n", __func__);
return -EFAULT;
}
if (element_id == WLAN_EID_DS_PARAMS) {
channel = *(current_ptr +
sizeof(struct element));
break;
}
current_ptr += element_len + sizeof(struct element);
curr_bcn_bytes -= element_len +
sizeof(struct element);
}
if (channel) {
struct ieee80211_channel *chan;
struct nxpwifi_bssdescriptor *bss_desc;
u8 band;
/* Skip entry if on csa closed channel */
if (channel == priv->csa_chan) {
nxpwifi_dbg(adapter, WARN,
"Dropping entry on csa closed channel\n");
return 0;
}
band = BAND_G;
if (radio_type)
band = nxpwifi_radio_type_to_band(*radio_type &
(BIT(0) | BIT(1)));
cfp = nxpwifi_get_cfp(priv, band, channel, 0);
freq = cfp ? cfp->freq : 0;
chan = ieee80211_get_channel(priv->wdev.wiphy, freq);
if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
bss = cfg80211_inform_bss(priv->wdev.wiphy, chan,
CFG80211_BSS_FTYPE_UNKNOWN,
bssid, timestamp,
cap_info_bitmap,
beacon_period,
ie_buf, ie_len, rssi,
GFP_ATOMIC);
if (bss) {
bss_priv = (struct nxpwifi_bss_priv *)bss->priv;
bss_priv->band = band;
bss_priv->fw_tsf = fw_tsf;
bss_desc =
&priv->curr_bss_params.bss_descriptor;
if (priv->media_connected &&
!memcmp(bssid, bss_desc->mac_address,
ETH_ALEN))
nxpwifi_update_curr_bss_params(priv,
bss);
if ((chan->flags & IEEE80211_CHAN_RADAR) ||
(chan->flags & IEEE80211_CHAN_NO_IR)) {
nxpwifi_dbg(adapter, INFO,
"radar or passive channel %d\n",
channel);
nxpwifi_save_hidden_ssid_channels(priv,
bss);
}
cfg80211_put_bss(priv->wdev.wiphy, bss);
}
}
} else {
nxpwifi_dbg(adapter, WARN, "missing BSS channel element\n");
}
return 0;
}
static void nxpwifi_complete_scan(struct nxpwifi_private *priv)
{
struct nxpwifi_adapter *adapter = priv->adapter;
adapter->survey_idx = 0;
if (adapter->curr_cmd->wait_q_enabled) {
adapter->cmd_wait_q.status = 0;
if (!priv->scan_request) {
nxpwifi_dbg(adapter, INFO,
"complete internal scan\n");
nxpwifi_complete_cmd(adapter, adapter->curr_cmd);
}
}
}
/* Find hidden SSIDs on passive channels and run active scans on them. */
static int
nxpwifi_active_scan_req_for_passive_chan(struct nxpwifi_private *priv)
{
int ret;
struct nxpwifi_adapter *adapter = priv->adapter;
u8 id = 0;
struct nxpwifi_user_scan_cfg *user_scan_cfg;
if (adapter->active_scan_triggered || !priv->scan_request ||
priv->scan_aborting) {
adapter->active_scan_triggered = false;
return 0;
}
if (!priv->hidden_chan[0].chan_number) {
nxpwifi_dbg(adapter, INFO, "No BSS with hidden SSID found on DFS channels\n");
return 0;
}
user_scan_cfg = kzalloc_obj(*user_scan_cfg, GFP_KERNEL);
if (!user_scan_cfg)
return -ENOMEM;
for (id = 0; id < NXPWIFI_USER_SCAN_CHAN_MAX; id++) {
if (!priv->hidden_chan[id].chan_number)
break;
memcpy(&user_scan_cfg->chan_list[id],
&priv->hidden_chan[id],
sizeof(struct nxpwifi_user_scan_chan));
}
adapter->active_scan_triggered = true;
if (priv->scan_request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
ether_addr_copy(user_scan_cfg->random_mac,
priv->scan_request->mac_addr);
user_scan_cfg->num_ssids = priv->scan_request->n_ssids;
user_scan_cfg->ssid_list = priv->scan_request->ssids;
ret = nxpwifi_scan_networks(priv, user_scan_cfg);
kfree(user_scan_cfg);
memset(&priv->hidden_chan, 0, sizeof(priv->hidden_chan));
if (ret)
nxpwifi_dbg(adapter, ERROR, "scan failed: %d\n", ret);
return ret;
}
static void nxpwifi_check_next_scan_command(struct nxpwifi_private *priv)
{
struct nxpwifi_adapter *adapter = priv->adapter;
struct cmd_ctrl_node *cmd_node;
spin_lock_bh(&adapter->scan_pending_q_lock);
if (list_empty(&adapter->scan_pending_q)) {
spin_unlock_bh(&adapter->scan_pending_q_lock);
spin_lock_bh(&adapter->nxpwifi_cmd_lock);
adapter->scan_processing = false;
spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
nxpwifi_active_scan_req_for_passive_chan(priv);
if (!adapter->ext_scan)
nxpwifi_complete_scan(priv);
if (priv->scan_request) {
struct cfg80211_scan_info info = {
.aborted = false,
};
nxpwifi_dbg(adapter, INFO,
"info: notifying scan done\n");
cfg80211_scan_done(priv->scan_request, &info);
priv->scan_request = NULL;
priv->scan_aborting = false;
} else {
priv->scan_aborting = false;
nxpwifi_dbg(adapter, INFO,
"info: scan already aborted\n");
}
} else if ((priv->scan_aborting && !priv->scan_request) ||
priv->scan_block) {
spin_unlock_bh(&adapter->scan_pending_q_lock);
nxpwifi_cancel_pending_scan_cmd(adapter);
spin_lock_bh(&adapter->nxpwifi_cmd_lock);
adapter->scan_processing = false;
spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
if (!adapter->active_scan_triggered) {
if (priv->scan_request) {
struct cfg80211_scan_info info = {
.aborted = true,
};
nxpwifi_dbg(adapter, INFO,
"info: aborting scan\n");
cfg80211_scan_done(priv->scan_request, &info);
priv->scan_request = NULL;
priv->scan_aborting = false;
} else {
priv->scan_aborting = false;
nxpwifi_dbg(adapter, INFO,
"info: scan already aborted\n");
}
}
} else {
/* Move a scan command from scan_pending_q to cmd_pending_q. */
cmd_node = list_first_entry(&adapter->scan_pending_q,
struct cmd_ctrl_node, list);
list_del(&cmd_node->list);
spin_unlock_bh(&adapter->scan_pending_q_lock);
nxpwifi_insert_cmd_to_pending_q(adapter, cmd_node);
}
}
void nxpwifi_cancel_scan(struct nxpwifi_adapter *adapter)
{
struct nxpwifi_private *priv;
int i;
nxpwifi_cancel_pending_scan_cmd(adapter);
if (adapter->scan_processing) {
spin_lock_bh(&adapter->nxpwifi_cmd_lock);
adapter->scan_processing = false;
spin_unlock_bh(&adapter->nxpwifi_cmd_lock);
for (i = 0; i < adapter->priv_num; i++) {
priv = adapter->priv[i];
if (priv->scan_request) {
struct cfg80211_scan_info info = {
.aborted = true,
};
nxpwifi_dbg(adapter, INFO,
"info: aborting scan\n");
cfg80211_scan_done(priv->scan_request, &info);
priv->scan_request = NULL;
priv->scan_aborting = false;
}
}
}
}
/*
* Handle the scan command response.
*
* The scan response buffer has the following layout:
*
* -------------------------------------------------------------
* | Header (4 * t_u16): standard command response header |
* -------------------------------------------------------------
* | BufSize (t_u16): size of the BSS description data |
* -------------------------------------------------------------
* | NumOfSet (t_u8): number of returned BSS descriptions |
* -------------------------------------------------------------
* | BSS description data (variable, size = BufSize) |
* -------------------------------------------------------------
* | TLV data (variable, size = cmd_size - fixed fields) |
* -------------------------------------------------------------
*/
int nxpwifi_ret_802_11_scan(struct nxpwifi_private *priv,
struct host_cmd_ds_command *resp)
{
int ret = 0;
struct nxpwifi_adapter *adapter = priv->adapter;
struct host_cmd_ds_802_11_scan_rsp *scan_rsp;
u8 *tlv_data;
const struct nxpwifi_ie_types_tsf_timestamp *tsf_tlv;
u8 *bss_info;
u32 scan_resp_size;
u32 bytes_left;
u32 idx;
u32 tlv_buf_size;
const struct nxpwifi_ie_types_chan_band_list_param_set *chan_band_tlv;
const struct chan_band_param_set *chan_band;
u8 is_bgscan_resp;
__le64 fw_tsf = 0;
const u8 *radio_type;
struct cfg80211_wowlan_nd_match *pmatch;
struct cfg80211_sched_scan_request *nd_config = NULL;
is_bgscan_resp = (le16_to_cpu(resp->command)
== HOST_CMD_802_11_BG_SCAN_QUERY);
if (is_bgscan_resp)
scan_rsp = &resp->params.bg_scan_query_resp.scan_resp;
else
scan_rsp = &resp->params.scan_resp;
if (scan_rsp->number_of_sets > NXPWIFI_MAX_AP) {
nxpwifi_dbg(adapter, ERROR,
"SCAN_RESP: too many AP returned (%d)\n",
scan_rsp->number_of_sets);
ret = -EINVAL;
goto check_next_scan;
}
/* Check csa channel expiry before parsing scan response */
nxpwifi_11h_get_csa_closed_channel(priv);
bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
nxpwifi_dbg(adapter, INFO,
"info: SCAN_RESP: bss_descript_size %d\n",
bytes_left);
scan_resp_size = le16_to_cpu(resp->size);
nxpwifi_dbg(adapter, INFO,
"info: SCAN_RESP: returned %d APs before parsing\n",
scan_rsp->number_of_sets);
bss_info = scan_rsp->bss_desc_and_tlv_buffer;
/*
* TLV buffer size = scan_resp_size minus the fixed fields, BSS
* description data, and the command response header (S_DS_GEN).
*/
tlv_buf_size = scan_resp_size - (bytes_left
+ sizeof(scan_rsp->bss_descript_size)
+ sizeof(scan_rsp->number_of_sets)
+ S_DS_GEN);
tlv_data = (scan_rsp->bss_desc_and_tlv_buffer +
bytes_left);
/* Find timestamp TLV */
{
const struct nxpwifi_tlv *t;
t = nxpwifi_find_tlv(TLV_TYPE_TSFTIMESTAMP, tlv_data, tlv_buf_size);
tsf_tlv = (const struct nxpwifi_ie_types_tsf_timestamp *)t;
}
/* Find channel-band list TLV */
{
const struct nxpwifi_tlv *t;
t = nxpwifi_find_tlv(TLV_TYPE_CHANNELBANDLIST, tlv_data,
tlv_buf_size);
chan_band_tlv =
(const struct nxpwifi_ie_types_chan_band_list_param_set *)t;
}
#ifdef CONFIG_PM
if (priv->wdev.wiphy->wowlan_config)
nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
#endif
if (nd_config) {
adapter->nd_info =
kzalloc_flex(*adapter->nd_info, matches,
scan_rsp->number_of_sets, GFP_ATOMIC);
if (adapter->nd_info)
adapter->nd_info->n_matches = scan_rsp->number_of_sets;
}
for (idx = 0; idx < scan_rsp->number_of_sets && bytes_left; idx++) {
/*
* If a TSF TLV is present, save its TSF value in fw_tsf. This
* is the firmware TSF at the time the beacon or probe response
* was received.
*/
if (tsf_tlv)
memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE],
sizeof(fw_tsf));
if (chan_band_tlv) {
chan_band = &chan_band_tlv->chan_band_param[idx];
radio_type = &chan_band->radio_type;
} else {
radio_type = NULL;
}
if (chan_band_tlv && adapter->nd_info) {
adapter->nd_info->matches[idx] =
kzalloc(sizeof(*pmatch) + sizeof(u32),
GFP_ATOMIC);
pmatch = adapter->nd_info->matches[idx];
if (pmatch) {
pmatch->n_channels = 1;
pmatch->channels[0] = chan_band->chan_number;
}
}
ret = nxpwifi_parse_single_response_buf(priv, &bss_info,
&bytes_left,
le64_to_cpu(fw_tsf),
radio_type, false, 0);
if (ret)
goto check_next_scan;
}
check_next_scan:
nxpwifi_check_next_scan_command(priv);
return ret;
}
/*
* Prepare the extended scan command using the provided scan configuration
* and build the structure to be sent to firmware.
*/
int nxpwifi_cmd_802_11_scan_ext(struct nxpwifi_private *priv,
struct host_cmd_ds_command *cmd,
void *data_buf)
{
struct host_cmd_ds_802_11_scan_ext *ext_scan = &cmd->params.ext_scan;
struct nxpwifi_scan_cmd_config *scan_cfg = data_buf;
memcpy(ext_scan->tlv_buffer, scan_cfg->tlv_buf, scan_cfg->tlv_buf_len);
cmd->command = cpu_to_le16(HOST_CMD_802_11_SCAN_EXT);
/* Size is equal to the sizeof(fixed portions) + the TLV len + header */
cmd->size = cpu_to_le16((u16)(sizeof(ext_scan->reserved)
+ scan_cfg->tlv_buf_len + S_DS_GEN));
return 0;
}
/* Prepare the background scan config command to send to firmware. */
int nxpwifi_cmd_802_11_bg_scan_config(struct nxpwifi_private *priv,
struct host_cmd_ds_command *cmd,
void *data_buf)
{
struct host_cmd_ds_802_11_bg_scan_config *bgscan_config =
&cmd->params.bg_scan_config;
struct nxpwifi_bg_scan_cfg *bgscan_cfg_in = data_buf;
u8 *tlv_pos = bgscan_config->tlv;
u8 num_probes;
u32 ssid_len, chan_idx, scan_time, scan_type, scan_dur, chan_num;
int i;
struct nxpwifi_ie_types_num_probes *num_probes_tlv;
struct nxpwifi_ie_types_repeat_count *repeat_count_tlv;
struct nxpwifi_ie_types_min_rssi_threshold *rssi_threshold_tlv;
struct nxpwifi_ie_types_bgscan_start_later *start_later_tlv;
struct nxpwifi_ie_types_wildcard_ssid_params *wildcard_ssid_tlv;
struct nxpwifi_ie_types_chan_list_param_set *tlv_l;
struct nxpwifi_chan_scan_param_set *temp_chan;
cmd->command = cpu_to_le16(HOST_CMD_802_11_BG_SCAN_CONFIG);
cmd->size = cpu_to_le16(sizeof(*bgscan_config) + S_DS_GEN);
bgscan_config->action = cpu_to_le16(bgscan_cfg_in->action);
bgscan_config->enable = bgscan_cfg_in->enable;
bgscan_config->bss_type = bgscan_cfg_in->bss_type;
bgscan_config->scan_interval =
cpu_to_le32(bgscan_cfg_in->scan_interval);
bgscan_config->report_condition =
cpu_to_le32(bgscan_cfg_in->report_condition);
/* stop sched scan */
if (!bgscan_config->enable)
return 0;
bgscan_config->chan_per_scan = bgscan_cfg_in->chan_per_scan;
num_probes = (bgscan_cfg_in->num_probes ?
bgscan_cfg_in->num_probes : priv->adapter->scan_probes);
if (num_probes) {
num_probes_tlv = (struct nxpwifi_ie_types_num_probes *)tlv_pos;
num_probes_tlv->header.type = cpu_to_le16(TLV_TYPE_NUMPROBES);
num_probes_tlv->header.len =
cpu_to_le16(sizeof(num_probes_tlv->num_probes));
num_probes_tlv->num_probes = cpu_to_le16((u16)num_probes);
tlv_pos += sizeof(num_probes_tlv->header) +
le16_to_cpu(num_probes_tlv->header.len);
}
if (bgscan_cfg_in->repeat_count) {
repeat_count_tlv =
(struct nxpwifi_ie_types_repeat_count *)tlv_pos;
repeat_count_tlv->header.type =
cpu_to_le16(TLV_TYPE_REPEAT_COUNT);
repeat_count_tlv->header.len =
cpu_to_le16(sizeof(repeat_count_tlv->repeat_count));
repeat_count_tlv->repeat_count =
cpu_to_le16(bgscan_cfg_in->repeat_count);
tlv_pos += sizeof(repeat_count_tlv->header) +
le16_to_cpu(repeat_count_tlv->header.len);
}
if (bgscan_cfg_in->rssi_threshold) {
rssi_threshold_tlv =
(struct nxpwifi_ie_types_min_rssi_threshold *)tlv_pos;
rssi_threshold_tlv->header.type =
cpu_to_le16(TLV_TYPE_RSSI_LOW);
rssi_threshold_tlv->header.len =
cpu_to_le16(sizeof(rssi_threshold_tlv->rssi_threshold));
rssi_threshold_tlv->rssi_threshold =
cpu_to_le16(bgscan_cfg_in->rssi_threshold);
tlv_pos += sizeof(rssi_threshold_tlv->header) +
le16_to_cpu(rssi_threshold_tlv->header.len);
}
for (i = 0; i < bgscan_cfg_in->num_ssids; i++) {
ssid_len = bgscan_cfg_in->ssid_list[i].ssid.ssid_len;
wildcard_ssid_tlv =
(struct nxpwifi_ie_types_wildcard_ssid_params *)tlv_pos;
wildcard_ssid_tlv->header.type =
cpu_to_le16(TLV_TYPE_WILDCARDSSID);
wildcard_ssid_tlv->header.len =
cpu_to_le16((u16)(ssid_len + sizeof(u8)));
/*
* max_ssid_length = 0 tells firmware to scan only for the given
* SSID. max_ssid_length = IEEE80211_MAX_SSID_LEN triggers a
* wildcard scan.
*/
if (ssid_len)
wildcard_ssid_tlv->max_ssid_length = 0;
else
wildcard_ssid_tlv->max_ssid_length =
IEEE80211_MAX_SSID_LEN;
memcpy(wildcard_ssid_tlv->ssid,
bgscan_cfg_in->ssid_list[i].ssid.ssid, ssid_len);
tlv_pos += (sizeof(wildcard_ssid_tlv->header) +
le16_to_cpu(wildcard_ssid_tlv->header.len));
}
tlv_l = (struct nxpwifi_ie_types_chan_list_param_set *)tlv_pos;
if (bgscan_cfg_in->chan_list[0].chan_number) {
nxpwifi_dbg(priv->adapter, INFO, "info: bgscan: Using supplied channel list\n");
tlv_l->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
for (chan_idx = 0;
chan_idx < NXPWIFI_BG_SCAN_CHAN_MAX &&
bgscan_cfg_in->chan_list[chan_idx].chan_number;
chan_idx++) {
temp_chan = &tlv_l->chan_scan_param[chan_idx];
/* Increment the TLV header length by size appended */
le16_unaligned_add_cpu(&tlv_l->header.len,
sizeof(*tlv_l->chan_scan_param));
temp_chan->chan_number =
bgscan_cfg_in->chan_list[chan_idx].chan_number;
temp_chan->band_cfg =
bgscan_cfg_in->chan_list[chan_idx].radio_type;
scan_type =
bgscan_cfg_in->chan_list[chan_idx].scan_type;
if (scan_type == NXPWIFI_SCAN_TYPE_PASSIVE)
temp_chan->chan_scan_mode_bmap |=
NXPWIFI_PASSIVE_SCAN;
else
temp_chan->chan_scan_mode_bmap &=
~NXPWIFI_PASSIVE_SCAN;
scan_time = bgscan_cfg_in->chan_list[chan_idx].scan_time;
if (scan_time) {
scan_dur = (u16)scan_time;
} else {
scan_dur = (scan_type ==
NXPWIFI_SCAN_TYPE_PASSIVE) ?
priv->adapter->passive_scan_time :
priv->adapter->specific_scan_time;
}
temp_chan->min_scan_time = cpu_to_le16(scan_dur);
temp_chan->max_scan_time = cpu_to_le16(scan_dur);
}
} else {
nxpwifi_dbg(priv->adapter, INFO,
"info: bgscan: Creating full region channel list\n");
chan_num =
nxpwifi_bgscan_create_channel_list
(priv, bgscan_cfg_in,
tlv_l->chan_scan_param);
le16_unaligned_add_cpu(&tlv_l->header.len,
chan_num *
sizeof(*tlv_l->chan_scan_param));
}
tlv_pos += (sizeof(tlv_l->header)
+ le16_to_cpu(tlv_l->header.len));
if (bgscan_cfg_in->start_later) {
start_later_tlv =
(struct nxpwifi_ie_types_bgscan_start_later *)tlv_pos;
start_later_tlv->header.type =
cpu_to_le16(TLV_TYPE_BGSCAN_START_LATER);
start_later_tlv->header.len =
cpu_to_le16(sizeof(start_later_tlv->start_later));
start_later_tlv->start_later =
cpu_to_le16(bgscan_cfg_in->start_later);
tlv_pos += sizeof(start_later_tlv->header) +
le16_to_cpu(start_later_tlv->header.len);
}
/* Append vendor specific element TLV */
nxpwifi_cmd_append_vsie_tlv(priv, NXPWIFI_VSIE_MASK_BGSCAN, &tlv_pos);
le16_unaligned_add_cpu(&cmd->size, tlv_pos - bgscan_config->tlv);
return 0;
}
int nxpwifi_stop_bg_scan(struct nxpwifi_private *priv)
{
struct nxpwifi_bg_scan_cfg *bgscan_cfg;
int ret;
if (!priv->sched_scanning) {
nxpwifi_dbg(priv->adapter, MSG, "bgscan already stopped!\n");
return 0;
}
bgscan_cfg = kzalloc_obj(*bgscan_cfg, GFP_KERNEL);
if (!bgscan_cfg)
return -ENOMEM;
bgscan_cfg->bss_type = NXPWIFI_BSS_MODE_INFRA;
bgscan_cfg->action = NXPWIFI_BGSCAN_ACT_SET;
bgscan_cfg->enable = false;
ret = nxpwifi_send_cmd(priv, HOST_CMD_802_11_BG_SCAN_CONFIG,
HOST_ACT_GEN_SET, 0, bgscan_cfg, true);
if (!ret)
priv->sched_scanning = false;
kfree(bgscan_cfg);
return ret;
}
static void
nxpwifi_update_chan_statistics(struct nxpwifi_private *priv,
struct nxpwifi_ietypes_chanstats *tlv_stat)
{
struct nxpwifi_adapter *adapter = priv->adapter;
u8 i, num_chan;
struct nxpwifi_fw_chan_stats *fw_chan_stats;
struct nxpwifi_chan_stats chan_stats;
fw_chan_stats = (void *)((u8 *)tlv_stat +
sizeof(struct nxpwifi_ie_types_header));
num_chan = le16_to_cpu(tlv_stat->header.len) /
sizeof(struct nxpwifi_chan_stats);
for (i = 0 ; i < num_chan; i++) {
if (adapter->survey_idx >= adapter->num_in_chan_stats) {
nxpwifi_dbg(adapter, WARN,
"FW reported too many channel results (max %d)\n",
adapter->num_in_chan_stats);
return;
}
chan_stats.chan_num = fw_chan_stats->chan_num;
chan_stats.bandcfg = fw_chan_stats->bandcfg;
chan_stats.flags = fw_chan_stats->flags;
chan_stats.noise = fw_chan_stats->noise;
chan_stats.total_bss = le16_to_cpu(fw_chan_stats->total_bss);
chan_stats.cca_scan_dur =
le16_to_cpu(fw_chan_stats->cca_scan_dur);
chan_stats.cca_busy_dur =
le16_to_cpu(fw_chan_stats->cca_busy_dur);
nxpwifi_dbg(adapter, INFO,
"chan=%d, noise=%d, total_network=%d scan_duration=%d, busy_duration=%d\n",
chan_stats.chan_num,
chan_stats.noise,
chan_stats.total_bss,
chan_stats.cca_scan_dur,
chan_stats.cca_busy_dur);
memcpy(&adapter->chan_stats[adapter->survey_idx++], &chan_stats,
sizeof(struct nxpwifi_chan_stats));
fw_chan_stats++;
}
}
/* Handle the extended scan command response. */
int nxpwifi_ret_802_11_scan_ext(struct nxpwifi_private *priv,
struct host_cmd_ds_command *resp)
{
struct nxpwifi_adapter *adapter = priv->adapter;
struct host_cmd_ds_802_11_scan_ext *ext_scan_resp;
struct nxpwifi_ie_types_header *tlv;
struct nxpwifi_ietypes_chanstats *tlv_stat;
u16 buf_left, type, len;
struct host_cmd_ds_command *cmd_ptr;
struct cmd_ctrl_node *cmd_node;
bool complete_scan = false;
nxpwifi_dbg(adapter, INFO, "info: EXT scan returns successfully\n");
ext_scan_resp = &resp->params.ext_scan;
tlv = (void *)ext_scan_resp->tlv_buffer;
buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN);
while (buf_left >= sizeof(struct nxpwifi_ie_types_header)) {
type = le16_to_cpu(tlv->type);
len = le16_to_cpu(tlv->len);
if (buf_left < (sizeof(struct nxpwifi_ie_types_header) + len)) {
nxpwifi_dbg(adapter, ERROR,
"error processing scan response TLVs");
break;
}
switch (type) {
case TLV_TYPE_CHANNEL_STATS:
tlv_stat = (void *)tlv;
nxpwifi_update_chan_statistics(priv, tlv_stat);
break;
default:
break;
}
buf_left -= len + sizeof(struct nxpwifi_ie_types_header);
tlv = (void *)((u8 *)tlv + len +
sizeof(struct nxpwifi_ie_types_header));
}
spin_lock_bh(&adapter->cmd_pending_q_lock);
spin_lock_bh(&adapter->scan_pending_q_lock);
if (list_empty(&adapter->scan_pending_q)) {
complete_scan = true;
list_for_each_entry(cmd_node, &adapter->cmd_pending_q, list) {
cmd_ptr = (void *)cmd_node->cmd_skb->data;
if (le16_to_cpu(cmd_ptr->command) ==
HOST_CMD_802_11_SCAN_EXT) {
nxpwifi_dbg(adapter, INFO,
"Scan pending in command pending list");
complete_scan = false;
break;
}
}
}
spin_unlock_bh(&adapter->scan_pending_q_lock);
spin_unlock_bh(&adapter->cmd_pending_q_lock);
if (complete_scan)
nxpwifi_complete_scan(priv);
return 0;
}
/*
* Handle the extended scan report event: parse the results and notify
* cfg80211.
*/
int nxpwifi_handle_event_ext_scan_report(struct nxpwifi_private *priv,
void *buf)
{
int ret = 0;
struct nxpwifi_adapter *adapter = priv->adapter;
u8 *bss_info;
u32 bytes_left, bytes_left_for_tlv, idx;
u16 type, len;
struct nxpwifi_ie_types_data *tlv;
struct nxpwifi_ie_types_scan_rsp *scan_rsp_tlv;
struct nxpwifi_ie_types_scan_inf *scan_info_tlv;
u8 *radio_type;
u64 fw_tsf = 0;
s32 rssi = 0;
struct nxpwifi_event_scan_result *event_scan = buf;
u8 num_of_set = event_scan->num_of_set;
u8 *scan_resp = buf + sizeof(struct nxpwifi_event_scan_result);
u16 scan_resp_size = le16_to_cpu(event_scan->buf_size);
if (num_of_set > NXPWIFI_MAX_AP) {
nxpwifi_dbg(adapter, ERROR,
"EXT_SCAN: Invalid number of AP returned (%d)!!\n",
num_of_set);
ret = -EINVAL;
goto check_next_scan;
}
bytes_left = scan_resp_size;
nxpwifi_dbg(adapter, INFO,
"EXT_SCAN: size %d, returned %d APs...",
scan_resp_size, num_of_set);
nxpwifi_dbg_dump(adapter, CMD_D, "EXT_SCAN buffer:", buf,
scan_resp_size +
sizeof(struct nxpwifi_event_scan_result));
tlv = (struct nxpwifi_ie_types_data *)scan_resp;
for (idx = 0; idx < num_of_set && bytes_left; idx++) {
type = le16_to_cpu(tlv->header.type);
len = le16_to_cpu(tlv->header.len);
if (bytes_left < sizeof(struct nxpwifi_ie_types_header) + len) {
nxpwifi_dbg(adapter, ERROR,
"EXT_SCAN: Error bytes left < TLV length\n");
break;
}
scan_rsp_tlv = NULL;
scan_info_tlv = NULL;
bytes_left_for_tlv = bytes_left;
/*
* BSS response TLV with beacon or probe response buffer
* at the initial position of each descriptor
*/
if (type != TLV_TYPE_BSS_SCAN_RSP)
break;
bss_info = (u8 *)tlv;
scan_rsp_tlv = (struct nxpwifi_ie_types_scan_rsp *)tlv;
tlv = (struct nxpwifi_ie_types_data *)(tlv->data + len);
bytes_left_for_tlv -=
(len + sizeof(struct nxpwifi_ie_types_header));
while (bytes_left_for_tlv >=
sizeof(struct nxpwifi_ie_types_header) &&
le16_to_cpu(tlv->header.type) != TLV_TYPE_BSS_SCAN_RSP) {
type = le16_to_cpu(tlv->header.type);
len = le16_to_cpu(tlv->header.len);
if (bytes_left_for_tlv <
sizeof(struct nxpwifi_ie_types_header) + len) {
nxpwifi_dbg(adapter, ERROR,
"EXT_SCAN: Error in processing TLV,\t"
"bytes left < TLV length\n");
scan_rsp_tlv = NULL;
bytes_left_for_tlv = 0;
continue;
}
switch (type) {
case TLV_TYPE_BSS_SCAN_INFO:
scan_info_tlv =
(struct nxpwifi_ie_types_scan_inf *)tlv;
if (len !=
sizeof(struct nxpwifi_ie_types_scan_inf) -
sizeof(struct nxpwifi_ie_types_header)) {
bytes_left_for_tlv = 0;
continue;
}
break;
default:
break;
}
tlv = (struct nxpwifi_ie_types_data *)(tlv->data + len);
bytes_left -=
(len + sizeof(struct nxpwifi_ie_types_header));
bytes_left_for_tlv -=
(len + sizeof(struct nxpwifi_ie_types_header));
}
if (!scan_rsp_tlv)
break;
/*
* Advance pointer to the beacon buffer length and
* update the bytes count so that the function
* wlan_interpret_bss_desc_with_ie() can handle the
* scan buffer withut any change
*/
bss_info += sizeof(u16);
bytes_left -= sizeof(u16);
if (scan_info_tlv) {
rssi = (s32)(s16)(le16_to_cpu(scan_info_tlv->rssi));
rssi *= 100; /* Convert dBm to mBm */
nxpwifi_dbg(adapter, INFO,
"info: InterpretIE: RSSI=%d\n", rssi);
fw_tsf = le64_to_cpu(scan_info_tlv->tsf);
radio_type = &scan_info_tlv->radio_type;
} else {
radio_type = NULL;
}
ret = nxpwifi_parse_single_response_buf(priv, &bss_info,
&bytes_left, fw_tsf,
radio_type, true, rssi);
if (ret)
goto check_next_scan;
}
check_next_scan:
if (!event_scan->more_event)
nxpwifi_check_next_scan_command(priv);
return ret;
}
/*
* Prepare the background scan query command. Sets the command ID, size,
* flush parameter, and fixes endianness.
*/
int nxpwifi_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
{
struct host_cmd_ds_802_11_bg_scan_query *bg_query =
&cmd->params.bg_scan_query;
cmd->command = cpu_to_le16(HOST_CMD_802_11_BG_SCAN_QUERY);
cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_bg_scan_query)
+ S_DS_GEN);
bg_query->flush = 1;
return 0;
}
/* Insert a scan command node into the scan_pending_q. */
void
nxpwifi_queue_scan_cmd(struct nxpwifi_private *priv,
struct cmd_ctrl_node *cmd_node)
{
struct nxpwifi_adapter *adapter = priv->adapter;
cmd_node->wait_q_enabled = true;
cmd_node->condition = &adapter->scan_wait_q_woken;
spin_lock_bh(&adapter->scan_pending_q_lock);
list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
spin_unlock_bh(&adapter->scan_pending_q_lock);
}
/* Append a vendor-specific element TLV to the buffer. */
int
nxpwifi_cmd_append_vsie_tlv(struct nxpwifi_private *priv,
u16 vsie_mask, u8 **buffer)
{
int id, ret_len = 0;
struct nxpwifi_ie_types_vendor_param_set *vs_param_set;
if (!buffer)
return 0;
if (!(*buffer))
return 0;
/*
* Traverse through the saved vendor specific element array and append
* the selected(scan/assoc) element as TLV to the command
*/
for (id = 0; id < NXPWIFI_MAX_VSIE_NUM; id++) {
if (priv->vs_ie[id].mask & vsie_mask) {
vs_param_set =
(struct nxpwifi_ie_types_vendor_param_set *)
*buffer;
vs_param_set->header.type =
cpu_to_le16(TLV_TYPE_PASSTHROUGH);
vs_param_set->header.len =
cpu_to_le16((((u16)priv->vs_ie[id].ie[1])
& 0x00FF) + 2);
if (le16_to_cpu(vs_param_set->header.len) >
NXPWIFI_MAX_VSIE_LEN) {
nxpwifi_dbg(priv->adapter, ERROR,
"Invalid param length!\n");
break;
}
memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
le16_to_cpu(vs_param_set->header.len));
*buffer += le16_to_cpu(vs_param_set->header.len) +
sizeof(struct nxpwifi_ie_types_header);
ret_len += le16_to_cpu(vs_param_set->header.len) +
sizeof(struct nxpwifi_ie_types_header);
}
}
return ret_len;
}
/*
* Save the beacon buffer of the current BSS descriptor.
*
* The buffer is preserved so it can be restored when the current SSID's
* beacon is missing, such as when:
* - the SSID was not found in the latest scan, or
* - the SSID was the last entry in the scan table and was overwritten.
*/
void
nxpwifi_save_curr_bcn(struct nxpwifi_private *priv)
{
struct nxpwifi_bssdescriptor *curr_bss =
&priv->curr_bss_params.bss_descriptor;
if (!curr_bss->beacon_buf_size)
return;
/* allocate beacon buffer at 1st time; or if it's size has changed */
if (!priv->curr_bcn_buf ||
priv->curr_bcn_size != curr_bss->beacon_buf_size) {
priv->curr_bcn_size = curr_bss->beacon_buf_size;
kfree(priv->curr_bcn_buf);
priv->curr_bcn_buf = kmalloc(curr_bss->beacon_buf_size,
GFP_ATOMIC);
if (!priv->curr_bcn_buf)
return;
}
memcpy(priv->curr_bcn_buf, curr_bss->beacon_buf,
curr_bss->beacon_buf_size);
nxpwifi_dbg(priv->adapter, INFO,
"info: current beacon saved %d\n",
priv->curr_bcn_size);
curr_bss->beacon_buf = priv->curr_bcn_buf;
/* adjust the pointers in the current BSS descriptor */
if (curr_bss->bcn_wpa_ie)
curr_bss->bcn_wpa_ie =
(struct ieee_types_vendor_specific *)
(curr_bss->beacon_buf +
curr_bss->wpa_offset);
if (curr_bss->bcn_rsn_ie)
curr_bss->bcn_rsn_ie =
(struct element *)(curr_bss->beacon_buf +
curr_bss->rsn_offset);
if (curr_bss->bcn_ht_cap)
curr_bss->bcn_ht_cap = (struct ieee80211_ht_cap *)
(curr_bss->beacon_buf +
curr_bss->ht_cap_offset);
if (curr_bss->bcn_ht_oper)
curr_bss->bcn_ht_oper = (struct ieee80211_ht_operation *)
(curr_bss->beacon_buf +
curr_bss->ht_info_offset);
if (curr_bss->bcn_vht_cap)
curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
curr_bss->vht_cap_offset);
if (curr_bss->bcn_vht_oper)
curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
curr_bss->vht_info_offset);
if (curr_bss->bcn_he_cap)
curr_bss->bcn_he_cap = (void *)(curr_bss->beacon_buf +
curr_bss->he_cap_offset);
if (curr_bss->bcn_he_oper)
curr_bss->bcn_he_oper = (void *)(curr_bss->beacon_buf +
curr_bss->he_info_offset);
if (curr_bss->bcn_bss_co_2040)
curr_bss->bcn_bss_co_2040 =
(curr_bss->beacon_buf + curr_bss->bss_co_2040_offset);
if (curr_bss->bcn_ext_cap)
curr_bss->bcn_ext_cap = curr_bss->beacon_buf +
curr_bss->ext_cap_offset;
if (curr_bss->oper_mode)
curr_bss->oper_mode = (void *)(curr_bss->beacon_buf +
curr_bss->oper_mode_offset);
}
/* Free the beacon buffer in the current BSS descriptor. */
void
nxpwifi_free_curr_bcn(struct nxpwifi_private *priv)
{
kfree(priv->curr_bcn_buf);
priv->curr_bcn_buf = NULL;
}
