1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3 * ieee80211.c
4 *
5 * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
6 * Linux device driver for RTL8192SU
7 *
8 * Modifications for inclusion into the Linux staging tree are
9 * Copyright(c) 2010 Larry Finger. All rights reserved.
10 *
11 * Contact information:
12 * WLAN FAE <wlanfae@realtek.com>.
13 * Larry Finger <Larry.Finger@lwfinger.net>
14 *
15 ******************************************************************************/
16
17 #define _IEEE80211_C
18
19 #include "drv_types.h"
20 #include "ieee80211.h"
21 #include "wifi.h"
22 #include "osdep_service.h"
23 #include "wlan_bssdef.h"
24
25 static const u8 WPA_OUI_TYPE[] = {0x00, 0x50, 0xf2, 1};
26 static const u8 WPA_CIPHER_SUITE_NONE[] = {0x00, 0x50, 0xf2, 0};
27 static const u8 WPA_CIPHER_SUITE_WEP40[] = {0x00, 0x50, 0xf2, 1};
28 static const u8 WPA_CIPHER_SUITE_TKIP[] = {0x00, 0x50, 0xf2, 2};
29 static const u8 WPA_CIPHER_SUITE_CCMP[] = {0x00, 0x50, 0xf2, 4};
30 static const u8 WPA_CIPHER_SUITE_WEP104[] = {0x00, 0x50, 0xf2, 5};
31
32 static const u8 RSN_CIPHER_SUITE_NONE[] = {0x00, 0x0f, 0xac, 0};
33 static const u8 RSN_CIPHER_SUITE_WEP40[] = {0x00, 0x0f, 0xac, 1};
34 static const u8 RSN_CIPHER_SUITE_TKIP[] = {0x00, 0x0f, 0xac, 2};
35 static const u8 RSN_CIPHER_SUITE_CCMP[] = {0x00, 0x0f, 0xac, 4};
36 static const u8 RSN_CIPHER_SUITE_WEP104[] = {0x00, 0x0f, 0xac, 5};
37
38 /*-----------------------------------------------------------
39 * for adhoc-master to generate ie and provide supported-rate to fw
40 *-----------------------------------------------------------
41 */
42
43 static u8 WIFI_CCKRATES[] = {
44 (IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
45 (IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
46 (IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
47 (IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)
48 };
49
50 static u8 WIFI_OFDMRATES[] = {
51 (IEEE80211_OFDM_RATE_6MB),
52 (IEEE80211_OFDM_RATE_9MB),
53 (IEEE80211_OFDM_RATE_12MB),
54 (IEEE80211_OFDM_RATE_18MB),
55 (IEEE80211_OFDM_RATE_24MB),
56 (IEEE80211_OFDM_RATE_36MB),
57 (IEEE80211_OFDM_RATE_48MB),
58 (IEEE80211_OFDM_RATE_54MB)
59 };
60
r8712_is_cckrates_included(u8 * rate)61 uint r8712_is_cckrates_included(u8 *rate)
62 {
63 u32 i = 0;
64
65 while (rate[i] != 0) {
66 if ((((rate[i]) & 0x7f) == 2) || (((rate[i]) & 0x7f) == 4) ||
67 (((rate[i]) & 0x7f) == 11) || (((rate[i]) & 0x7f) == 22))
68 return true;
69 i++;
70 }
71 return false;
72 }
73
r8712_is_cckratesonly_included(u8 * rate)74 uint r8712_is_cckratesonly_included(u8 *rate)
75 {
76 u32 i = 0;
77
78 while (rate[i] != 0) {
79 if ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
80 (((rate[i]) & 0x7f) != 11) && (((rate[i]) & 0x7f) != 22))
81 return false;
82 i++;
83 }
84 return true;
85 }
86
87 /* r8712_set_ie will update frame length */
r8712_set_ie(u8 * pbuf,sint index,uint len,u8 * source,uint * frlen)88 u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen)
89 {
90 *pbuf = (u8)index;
91 *(pbuf + 1) = (u8)len;
92 if (len > 0)
93 memcpy((void *)(pbuf + 2), (void *)source, len);
94 *frlen = *frlen + (len + 2);
95 return pbuf + len + 2;
96 }
97
98 /* ---------------------------------------------------------------------------
99 * index: the information element id index, limit is the limit for search
100 * ---------------------------------------------------------------------------
101 */
r8712_get_ie(u8 * pbuf,sint index,uint * len,sint limit)102 u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit)
103 {
104 sint tmp, i;
105 u8 *p;
106
107 if (limit < 1)
108 return NULL;
109 p = pbuf;
110 i = 0;
111 *len = 0;
112 while (1) {
113 if (*p == index) {
114 *len = *(p + 1);
115 return p;
116 }
117 tmp = *(p + 1);
118 p += (tmp + 2);
119 i += (tmp + 2);
120 if (i >= limit)
121 break;
122 }
123 return NULL;
124 }
125
set_supported_rate(u8 * rates,uint mode)126 static void set_supported_rate(u8 *rates, uint mode)
127 {
128 memset(rates, 0, NDIS_802_11_LENGTH_RATES_EX);
129 switch (mode) {
130 case WIRELESS_11B:
131 memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
132 break;
133 case WIRELESS_11G:
134 case WIRELESS_11A:
135 memcpy(rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
136 break;
137 case WIRELESS_11BG:
138 memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
139 memcpy(rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES,
140 IEEE80211_NUM_OFDM_RATESLEN);
141 break;
142 }
143 }
144
r8712_get_rateset_len(u8 * rateset)145 static uint r8712_get_rateset_len(u8 *rateset)
146 {
147 uint i = 0;
148
149 while (1) {
150 if ((rateset[i]) == 0)
151 break;
152 if (i > 12)
153 break;
154 i++;
155 }
156 return i;
157 }
158
r8712_generate_ie(struct registry_priv * registrypriv)159 int r8712_generate_ie(struct registry_priv *registrypriv)
160 {
161 int rate_len;
162 uint sz = 0;
163 struct wlan_bssid_ex *dev_network = ®istrypriv->dev_network;
164 u8 *ie = dev_network->IEs;
165 u16 beaconPeriod = (u16)dev_network->Configuration.BeaconPeriod;
166
167 /*timestamp will be inserted by hardware*/
168 sz += 8;
169 ie += sz;
170 /*beacon interval : 2bytes*/
171 *(__le16 *)ie = cpu_to_le16(beaconPeriod);
172 sz += 2;
173 ie += 2;
174 /*capability info*/
175 *(u16 *)ie = 0;
176 *(__le16 *)ie |= cpu_to_le16(cap_IBSS);
177 if (registrypriv->preamble == PREAMBLE_SHORT)
178 *(__le16 *)ie |= cpu_to_le16(cap_ShortPremble);
179 if (dev_network->Privacy)
180 *(__le16 *)ie |= cpu_to_le16(cap_Privacy);
181 sz += 2;
182 ie += 2;
183 /*SSID*/
184 ie = r8712_set_ie(ie, _SSID_IE_, dev_network->Ssid.SsidLength,
185 dev_network->Ssid.Ssid, &sz);
186 /*supported rates*/
187 set_supported_rate(dev_network->rates, registrypriv->wireless_mode);
188 rate_len = r8712_get_rateset_len(dev_network->rates);
189 if (rate_len > 8) {
190 ie = r8712_set_ie(ie, _SUPPORTEDRATES_IE_, 8,
191 dev_network->rates, &sz);
192 ie = r8712_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8),
193 (dev_network->rates + 8), &sz);
194 } else {
195 ie = r8712_set_ie(ie, _SUPPORTEDRATES_IE_,
196 rate_len, dev_network->rates, &sz);
197 }
198 /*DS parameter set*/
199 ie = r8712_set_ie(ie, _DSSET_IE_, 1,
200 (u8 *)&dev_network->Configuration.DSConfig, &sz);
201 /*IBSS Parameter Set*/
202 ie = r8712_set_ie(ie, _IBSS_PARA_IE_, 2,
203 (u8 *)&dev_network->Configuration.ATIMWindow, &sz);
204 return sz;
205 }
206
r8712_get_wpa_ie(unsigned char * ie,uint * wpa_ie_len,int limit)207 unsigned char *r8712_get_wpa_ie(unsigned char *ie, uint *wpa_ie_len, int limit)
208 {
209 u32 len;
210 u16 val16;
211 unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
212 u8 *buf = ie;
213
214 while (1) {
215 buf = r8712_get_ie(buf, _WPA_IE_ID_, &len, limit);
216 if (buf) {
217 /*check if oui matches...*/
218 if (memcmp((buf + 2), wpa_oui_type,
219 sizeof(wpa_oui_type)))
220 goto check_next_ie;
221 /*check version...*/
222 memcpy((u8 *)&val16, (buf + 6), sizeof(val16));
223 le16_to_cpus(&val16);
224 if (val16 != 0x0001)
225 goto check_next_ie;
226 *wpa_ie_len = *(buf + 1);
227 return buf;
228 }
229 *wpa_ie_len = 0;
230 return NULL;
231 check_next_ie:
232 limit = limit - (buf - ie) - 2 - len;
233 if (limit <= 0)
234 break;
235 buf += (2 + len);
236 }
237 *wpa_ie_len = 0;
238 return NULL;
239 }
240
r8712_get_wpa2_ie(unsigned char * pie,uint * rsn_ie_len,int limit)241 unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
242 int limit)
243 {
244 return r8712_get_ie(pie, _WPA2_IE_ID_, rsn_ie_len, limit);
245 }
246
r8712_get_wpa_cipher_suite(u8 * s)247 static int r8712_get_wpa_cipher_suite(u8 *s)
248 {
249 if (!memcmp(s, (void *)WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN))
250 return WPA_CIPHER_NONE;
251 if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN))
252 return WPA_CIPHER_WEP40;
253 if (!memcmp(s, (void *)WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN))
254 return WPA_CIPHER_TKIP;
255 if (!memcmp(s, (void *)WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN))
256 return WPA_CIPHER_CCMP;
257 if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN))
258 return WPA_CIPHER_WEP104;
259 return 0;
260 }
261
r8712_get_wpa2_cipher_suite(u8 * s)262 static int r8712_get_wpa2_cipher_suite(u8 *s)
263 {
264 if (!memcmp(s, (void *)RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN))
265 return WPA_CIPHER_NONE;
266 if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN))
267 return WPA_CIPHER_WEP40;
268 if (!memcmp(s, (void *)RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN))
269 return WPA_CIPHER_TKIP;
270 if (!memcmp(s, (void *)RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN))
271 return WPA_CIPHER_CCMP;
272 if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN))
273 return WPA_CIPHER_WEP104;
274 return 0;
275 }
276
r8712_parse_wpa_ie(u8 * wpa_ie,int wpa_ie_len,int * group_cipher,int * pairwise_cipher)277 int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
278 int *pairwise_cipher)
279 {
280 int i;
281 int left, count;
282 u8 *pos;
283
284 if (wpa_ie_len <= 0) {
285 /* No WPA IE - fail silently */
286 return -EINVAL;
287 }
288 if ((*wpa_ie != _WPA_IE_ID_) ||
289 (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) ||
290 (memcmp(wpa_ie + 2, (void *)WPA_OUI_TYPE, WPA_SELECTOR_LEN)))
291 return -EINVAL;
292 pos = wpa_ie;
293 pos += 8;
294 left = wpa_ie_len - 8;
295 /*group_cipher*/
296 if (left >= WPA_SELECTOR_LEN) {
297 *group_cipher = r8712_get_wpa_cipher_suite(pos);
298 pos += WPA_SELECTOR_LEN;
299 left -= WPA_SELECTOR_LEN;
300 } else if (left > 0) {
301 return -EINVAL;
302 }
303 /*pairwise_cipher*/
304 if (left >= 2) {
305 count = le16_to_cpu(*(__le16 *)pos);
306 pos += 2;
307 left -= 2;
308 if (count == 0 || left < count * WPA_SELECTOR_LEN)
309 return -EINVAL;
310 for (i = 0; i < count; i++) {
311 *pairwise_cipher |= r8712_get_wpa_cipher_suite(pos);
312 pos += WPA_SELECTOR_LEN;
313 left -= WPA_SELECTOR_LEN;
314 }
315 } else if (left == 1) {
316 return -EINVAL;
317 }
318 return 0;
319 }
320
r8712_parse_wpa2_ie(u8 * rsn_ie,int rsn_ie_len,int * group_cipher,int * pairwise_cipher)321 int r8712_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher,
322 int *pairwise_cipher)
323 {
324 int i;
325 int left, count;
326 u8 *pos;
327
328 if (rsn_ie_len <= 0) {
329 /* No RSN IE - fail silently */
330 return -EINVAL;
331 }
332 if ((*rsn_ie != _WPA2_IE_ID_) ||
333 (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2)))
334 return -EINVAL;
335 pos = rsn_ie;
336 pos += 4;
337 left = rsn_ie_len - 4;
338 /*group_cipher*/
339 if (left >= RSN_SELECTOR_LEN) {
340 *group_cipher = r8712_get_wpa2_cipher_suite(pos);
341 pos += RSN_SELECTOR_LEN;
342 left -= RSN_SELECTOR_LEN;
343 } else if (left > 0) {
344 return -EINVAL;
345 }
346 /*pairwise_cipher*/
347 if (left >= 2) {
348 count = le16_to_cpu(*(__le16 *)pos);
349 pos += 2;
350 left -= 2;
351 if (count == 0 || left < count * RSN_SELECTOR_LEN)
352 return -EINVAL;
353 for (i = 0; i < count; i++) {
354 *pairwise_cipher |= r8712_get_wpa2_cipher_suite(pos);
355 pos += RSN_SELECTOR_LEN;
356 left -= RSN_SELECTOR_LEN;
357 }
358 } else if (left == 1) {
359 return -EINVAL;
360 }
361 return 0;
362 }
363
r8712_get_sec_ie(u8 * in_ie,uint in_len,u8 * rsn_ie,u16 * rsn_len,u8 * wpa_ie,u16 * wpa_len)364 int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
365 u8 *wpa_ie, u16 *wpa_len)
366 {
367 u8 authmode;
368 u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
369 uint cnt;
370
371 /*Search required WPA or WPA2 IE and copy to sec_ie[ ]*/
372 cnt = _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_;
373 while (cnt < in_len) {
374 authmode = in_ie[cnt];
375 if ((authmode == _WPA_IE_ID_) &&
376 (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
377 memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
378 *wpa_len = in_ie[cnt + 1] + 2;
379 cnt += in_ie[cnt + 1] + 2; /*get next */
380 } else {
381 if (authmode == _WPA2_IE_ID_) {
382 memcpy(rsn_ie, &in_ie[cnt],
383 in_ie[cnt + 1] + 2);
384 *rsn_len = in_ie[cnt + 1] + 2;
385 cnt += in_ie[cnt + 1] + 2; /*get next*/
386 } else {
387 cnt += in_ie[cnt + 1] + 2; /*get next*/
388 }
389 }
390 }
391 return *rsn_len + *wpa_len;
392 }
393
r8712_get_wps_ie(u8 * in_ie,uint in_len,u8 * wps_ie,uint * wps_ielen)394 int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
395 {
396 int match;
397 uint cnt;
398 u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
399
400 cnt = 12;
401 match = false;
402 while (cnt < in_len) {
403 eid = in_ie[cnt];
404 if ((eid == _WPA_IE_ID_) &&
405 (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
406 memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
407 *wps_ielen = in_ie[cnt + 1] + 2;
408 cnt += in_ie[cnt + 1] + 2;
409 match = true;
410 break;
411 }
412 cnt += in_ie[cnt + 1] + 2; /* goto next */
413 }
414 return match;
415 }
416
