1 /*
2 * Marvell Wireless LAN device driver: management IE handling- setting and
3 * deleting IE.
4 *
5 * Copyright (C) 2012-2014, Marvell International Ltd.
6 *
7 * This software file (the "File") is distributed by Marvell International
8 * Ltd. under the terms of the GNU General Public License Version 2, June 1991
9 * (the "License"). You may use, redistribute and/or modify this File in
10 * accordance with the terms and conditions of the License, a copy of which
11 * is available by writing to the Free Software Foundation, Inc.,
12 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
13 * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
14 *
15 * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
17 * ARE EXPRESSLY DISCLAIMED. The License provides additional details about
18 * this warranty disclaimer.
19 */
20
21 #include "main.h"
22
23 /* This function checks if current IE index is used by any on other interface.
24 * Return: -1: yes, current IE index is used by someone else.
25 * 0: no, current IE index is NOT used by other interface.
26 */
27 static int
mwifiex_ie_index_used_by_other_intf(struct mwifiex_private * priv,u16 idx)28 mwifiex_ie_index_used_by_other_intf(struct mwifiex_private *priv, u16 idx)
29 {
30 int i;
31 struct mwifiex_adapter *adapter = priv->adapter;
32 struct mwifiex_ie *ie;
33
34 for (i = 0; i < adapter->priv_num; i++) {
35 if (adapter->priv[i] != priv) {
36 ie = &adapter->priv[i]->mgmt_ie[idx];
37 if (ie->mgmt_subtype_mask && ie->ie_length)
38 return -1;
39 }
40 }
41
42 return 0;
43 }
44
45 /* Get unused IE index. This index will be used for setting new IE */
46 static int
mwifiex_ie_get_autoidx(struct mwifiex_private * priv,u16 subtype_mask,struct mwifiex_ie * ie,u16 * index)47 mwifiex_ie_get_autoidx(struct mwifiex_private *priv, u16 subtype_mask,
48 struct mwifiex_ie *ie, u16 *index)
49 {
50 u16 mask, len, i;
51
52 for (i = 0; i < priv->adapter->max_mgmt_ie_index; i++) {
53 mask = le16_to_cpu(priv->mgmt_ie[i].mgmt_subtype_mask);
54 len = le16_to_cpu(ie->ie_length);
55
56 if (mask == MWIFIEX_AUTO_IDX_MASK)
57 continue;
58
59 if (mask == subtype_mask) {
60 if (len > IEEE_MAX_IE_SIZE)
61 continue;
62
63 *index = i;
64 return 0;
65 }
66
67 if (!priv->mgmt_ie[i].ie_length) {
68 if (mwifiex_ie_index_used_by_other_intf(priv, i))
69 continue;
70
71 *index = i;
72 return 0;
73 }
74 }
75
76 return -1;
77 }
78
79 /* This function prepares IE data buffer for command to be sent to FW */
80 static int
mwifiex_update_autoindex_ies(struct mwifiex_private * priv,struct mwifiex_ie_list * ie_list)81 mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
82 struct mwifiex_ie_list *ie_list)
83 {
84 u16 travel_len, index, mask;
85 s16 input_len, tlv_len;
86 struct mwifiex_ie *ie;
87 u8 *tmp;
88
89 input_len = le16_to_cpu(ie_list->len);
90 travel_len = sizeof(struct mwifiex_ie_types_header);
91
92 ie_list->len = 0;
93
94 while (input_len >= sizeof(struct mwifiex_ie_types_header)) {
95 ie = (struct mwifiex_ie *)(((u8 *)ie_list) + travel_len);
96 tlv_len = le16_to_cpu(ie->ie_length);
97 travel_len += tlv_len + MWIFIEX_IE_HDR_SIZE;
98
99 if (input_len < tlv_len + MWIFIEX_IE_HDR_SIZE)
100 return -1;
101 index = le16_to_cpu(ie->ie_index);
102 mask = le16_to_cpu(ie->mgmt_subtype_mask);
103
104 if (index == MWIFIEX_AUTO_IDX_MASK) {
105 /* automatic addition */
106 if (mwifiex_ie_get_autoidx(priv, mask, ie, &index))
107 return -1;
108 if (index == MWIFIEX_AUTO_IDX_MASK)
109 return -1;
110
111 tmp = (u8 *)&priv->mgmt_ie[index].ie_buffer;
112 memcpy(tmp, &ie->ie_buffer, le16_to_cpu(ie->ie_length));
113 priv->mgmt_ie[index].ie_length = ie->ie_length;
114 priv->mgmt_ie[index].ie_index = cpu_to_le16(index);
115 priv->mgmt_ie[index].mgmt_subtype_mask =
116 cpu_to_le16(mask);
117
118 ie->ie_index = cpu_to_le16(index);
119 } else {
120 if (mask != MWIFIEX_DELETE_MASK)
121 return -1;
122 /*
123 * Check if this index is being used on any
124 * other interface.
125 */
126 if (mwifiex_ie_index_used_by_other_intf(priv, index))
127 return -1;
128
129 ie->ie_length = 0;
130 memcpy(&priv->mgmt_ie[index], ie,
131 sizeof(struct mwifiex_ie));
132 }
133
134 le16_add_cpu(&ie_list->len,
135 le16_to_cpu(priv->mgmt_ie[index].ie_length) +
136 MWIFIEX_IE_HDR_SIZE);
137 input_len -= tlv_len + MWIFIEX_IE_HDR_SIZE;
138 }
139
140 if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
141 return mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
142 HostCmd_ACT_GEN_SET,
143 UAP_CUSTOM_IE_I, ie_list, false);
144
145 return 0;
146 }
147
148 /* Copy individual custom IEs for beacon, probe response and assoc response
149 * and prepare single structure for IE setting.
150 * This function also updates allocated IE indices from driver.
151 */
152 static int
mwifiex_update_uap_custom_ie(struct mwifiex_private * priv,struct mwifiex_ie * beacon_ie,u16 * beacon_idx,struct mwifiex_ie * pr_ie,u16 * probe_idx,struct mwifiex_ie * ar_ie,u16 * assoc_idx)153 mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
154 struct mwifiex_ie *beacon_ie, u16 *beacon_idx,
155 struct mwifiex_ie *pr_ie, u16 *probe_idx,
156 struct mwifiex_ie *ar_ie, u16 *assoc_idx)
157 {
158 struct mwifiex_ie_list *ap_custom_ie;
159 u8 *pos;
160 u16 len;
161 int ret;
162
163 ap_custom_ie = kzalloc(sizeof(*ap_custom_ie), GFP_KERNEL);
164 if (!ap_custom_ie)
165 return -ENOMEM;
166
167 ap_custom_ie->type = cpu_to_le16(TLV_TYPE_MGMT_IE);
168 pos = (u8 *)ap_custom_ie->ie_list;
169
170 if (beacon_ie) {
171 len = sizeof(struct mwifiex_ie) - IEEE_MAX_IE_SIZE +
172 le16_to_cpu(beacon_ie->ie_length);
173 memcpy(pos, beacon_ie, len);
174 pos += len;
175 le16_add_cpu(&ap_custom_ie->len, len);
176 }
177 if (pr_ie) {
178 len = sizeof(struct mwifiex_ie) - IEEE_MAX_IE_SIZE +
179 le16_to_cpu(pr_ie->ie_length);
180 memcpy(pos, pr_ie, len);
181 pos += len;
182 le16_add_cpu(&ap_custom_ie->len, len);
183 }
184 if (ar_ie) {
185 len = sizeof(struct mwifiex_ie) - IEEE_MAX_IE_SIZE +
186 le16_to_cpu(ar_ie->ie_length);
187 memcpy(pos, ar_ie, len);
188 pos += len;
189 le16_add_cpu(&ap_custom_ie->len, len);
190 }
191
192 ret = mwifiex_update_autoindex_ies(priv, ap_custom_ie);
193
194 pos = (u8 *)(&ap_custom_ie->ie_list[0].ie_index);
195 if (beacon_ie && *beacon_idx == MWIFIEX_AUTO_IDX_MASK) {
196 /* save beacon ie index after auto-indexing */
197 *beacon_idx = le16_to_cpu(ap_custom_ie->ie_list[0].ie_index);
198 len = sizeof(*beacon_ie) - IEEE_MAX_IE_SIZE +
199 le16_to_cpu(beacon_ie->ie_length);
200 pos += len;
201 }
202 if (pr_ie && le16_to_cpu(pr_ie->ie_index) == MWIFIEX_AUTO_IDX_MASK) {
203 /* save probe resp ie index after auto-indexing */
204 *probe_idx = *((u16 *)pos);
205 len = sizeof(*pr_ie) - IEEE_MAX_IE_SIZE +
206 le16_to_cpu(pr_ie->ie_length);
207 pos += len;
208 }
209 if (ar_ie && le16_to_cpu(ar_ie->ie_index) == MWIFIEX_AUTO_IDX_MASK)
210 /* save assoc resp ie index after auto-indexing */
211 *assoc_idx = *((u16 *)pos);
212
213 kfree(ap_custom_ie);
214 return ret;
215 }
216
217 /* This function checks if the vendor specified IE is present in passed buffer
218 * and copies it to mwifiex_ie structure.
219 * Function takes pointer to struct mwifiex_ie pointer as argument.
220 * If the vendor specified IE is present then memory is allocated for
221 * mwifiex_ie pointer and filled in with IE. Caller should take care of freeing
222 * this memory.
223 */
mwifiex_update_vs_ie(const u8 * ies,int ies_len,struct mwifiex_ie ** ie_ptr,u16 mask,unsigned int oui,u8 oui_type)224 static int mwifiex_update_vs_ie(const u8 *ies, int ies_len,
225 struct mwifiex_ie **ie_ptr, u16 mask,
226 unsigned int oui, u8 oui_type)
227 {
228 struct ieee_types_header *vs_ie;
229 struct mwifiex_ie *ie = *ie_ptr;
230 const u8 *vendor_ie;
231
232 vendor_ie = cfg80211_find_vendor_ie(oui, oui_type, ies, ies_len);
233 if (vendor_ie) {
234 if (!*ie_ptr) {
235 *ie_ptr = kzalloc(sizeof(struct mwifiex_ie),
236 GFP_KERNEL);
237 if (!*ie_ptr)
238 return -ENOMEM;
239 ie = *ie_ptr;
240 }
241
242 vs_ie = (struct ieee_types_header *)vendor_ie;
243 if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 >
244 IEEE_MAX_IE_SIZE)
245 return -EINVAL;
246 memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length),
247 vs_ie, vs_ie->len + 2);
248 le16_add_cpu(&ie->ie_length, vs_ie->len + 2);
249 ie->mgmt_subtype_mask = cpu_to_le16(mask);
250 ie->ie_index = cpu_to_le16(MWIFIEX_AUTO_IDX_MASK);
251 }
252
253 *ie_ptr = ie;
254 return 0;
255 }
256
257 /* This function parses beacon IEs, probe response IEs, association response IEs
258 * from cfg80211_ap_settings->beacon and sets these IE to FW.
259 */
mwifiex_set_mgmt_beacon_data_ies(struct mwifiex_private * priv,struct cfg80211_beacon_data * data)260 static int mwifiex_set_mgmt_beacon_data_ies(struct mwifiex_private *priv,
261 struct cfg80211_beacon_data *data)
262 {
263 struct mwifiex_ie *beacon_ie = NULL, *pr_ie = NULL, *ar_ie = NULL;
264 u16 beacon_idx = MWIFIEX_AUTO_IDX_MASK, pr_idx = MWIFIEX_AUTO_IDX_MASK;
265 u16 ar_idx = MWIFIEX_AUTO_IDX_MASK;
266 int ret = 0;
267
268 if (data->beacon_ies && data->beacon_ies_len) {
269 mwifiex_update_vs_ie(data->beacon_ies, data->beacon_ies_len,
270 &beacon_ie, MGMT_MASK_BEACON,
271 WLAN_OUI_MICROSOFT,
272 WLAN_OUI_TYPE_MICROSOFT_WPS);
273 mwifiex_update_vs_ie(data->beacon_ies, data->beacon_ies_len,
274 &beacon_ie, MGMT_MASK_BEACON,
275 WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P);
276 }
277
278 if (data->proberesp_ies && data->proberesp_ies_len) {
279 mwifiex_update_vs_ie(data->proberesp_ies,
280 data->proberesp_ies_len, &pr_ie,
281 MGMT_MASK_PROBE_RESP, WLAN_OUI_MICROSOFT,
282 WLAN_OUI_TYPE_MICROSOFT_WPS);
283 mwifiex_update_vs_ie(data->proberesp_ies,
284 data->proberesp_ies_len, &pr_ie,
285 MGMT_MASK_PROBE_RESP,
286 WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P);
287 }
288
289 if (data->assocresp_ies && data->assocresp_ies_len) {
290 mwifiex_update_vs_ie(data->assocresp_ies,
291 data->assocresp_ies_len, &ar_ie,
292 MGMT_MASK_ASSOC_RESP |
293 MGMT_MASK_REASSOC_RESP,
294 WLAN_OUI_MICROSOFT,
295 WLAN_OUI_TYPE_MICROSOFT_WPS);
296 mwifiex_update_vs_ie(data->assocresp_ies,
297 data->assocresp_ies_len, &ar_ie,
298 MGMT_MASK_ASSOC_RESP |
299 MGMT_MASK_REASSOC_RESP, WLAN_OUI_WFA,
300 WLAN_OUI_TYPE_WFA_P2P);
301 }
302
303 if (beacon_ie || pr_ie || ar_ie) {
304 ret = mwifiex_update_uap_custom_ie(priv, beacon_ie,
305 &beacon_idx, pr_ie,
306 &pr_idx, ar_ie, &ar_idx);
307 if (ret)
308 goto done;
309 }
310
311 priv->beacon_idx = beacon_idx;
312 priv->proberesp_idx = pr_idx;
313 priv->assocresp_idx = ar_idx;
314
315 done:
316 kfree(beacon_ie);
317 kfree(pr_ie);
318 kfree(ar_ie);
319
320 return ret;
321 }
322
323 /* This function parses head and tail IEs, from cfg80211_beacon_data and sets
324 * these IE to FW.
325 */
mwifiex_uap_parse_tail_ies(struct mwifiex_private * priv,struct cfg80211_beacon_data * info)326 static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
327 struct cfg80211_beacon_data *info)
328 {
329 struct mwifiex_ie *gen_ie;
330 struct ieee_types_header *hdr;
331 struct ieee80211_vendor_ie *vendorhdr;
332 u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
333 int left_len, parsed_len = 0;
334 unsigned int token_len;
335 int err = 0;
336
337 if (!info->tail || !info->tail_len)
338 return 0;
339
340 gen_ie = kzalloc(sizeof(*gen_ie), GFP_KERNEL);
341 if (!gen_ie)
342 return -ENOMEM;
343
344 left_len = info->tail_len;
345
346 /* Many IEs are generated in FW by parsing bss configuration.
347 * Let's not add them here; else we may end up duplicating these IEs
348 */
349 while (left_len > sizeof(struct ieee_types_header)) {
350 hdr = (void *)(info->tail + parsed_len);
351 token_len = hdr->len + sizeof(struct ieee_types_header);
352 if (token_len > left_len) {
353 err = -EINVAL;
354 goto out;
355 }
356
357 switch (hdr->element_id) {
358 case WLAN_EID_SSID:
359 case WLAN_EID_SUPP_RATES:
360 case WLAN_EID_COUNTRY:
361 case WLAN_EID_PWR_CONSTRAINT:
362 case WLAN_EID_EXT_SUPP_RATES:
363 case WLAN_EID_HT_CAPABILITY:
364 case WLAN_EID_HT_OPERATION:
365 case WLAN_EID_VHT_CAPABILITY:
366 case WLAN_EID_VHT_OPERATION:
367 case WLAN_EID_VENDOR_SPECIFIC:
368 break;
369 default:
370 if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
371 err = -EINVAL;
372 goto out;
373 }
374 memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len);
375 ie_len += token_len;
376 break;
377 }
378 left_len -= token_len;
379 parsed_len += token_len;
380 }
381
382 /* parse only WPA vendor IE from tail, WMM IE is configured by
383 * bss_config command
384 */
385 vendorhdr = (void *)cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
386 WLAN_OUI_TYPE_MICROSOFT_WPA,
387 info->tail, info->tail_len);
388 if (vendorhdr) {
389 token_len = vendorhdr->len + sizeof(struct ieee_types_header);
390 if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
391 err = -EINVAL;
392 goto out;
393 }
394 memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len);
395 ie_len += token_len;
396 }
397
398 if (!ie_len)
399 goto out;
400
401 gen_ie->ie_index = cpu_to_le16(gen_idx);
402 gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
403 MGMT_MASK_PROBE_RESP |
404 MGMT_MASK_ASSOC_RESP);
405 gen_ie->ie_length = cpu_to_le16(ie_len);
406
407 if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL,
408 NULL, NULL)) {
409 err = -EINVAL;
410 goto out;
411 }
412
413 priv->gen_idx = gen_idx;
414
415 out:
416 kfree(gen_ie);
417 return err;
418 }
419
420 /* This function parses different IEs-head & tail IEs, beacon IEs,
421 * probe response IEs, association response IEs from cfg80211_ap_settings
422 * function and sets these IE to FW.
423 */
mwifiex_set_mgmt_ies(struct mwifiex_private * priv,struct cfg80211_beacon_data * info)424 int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
425 struct cfg80211_beacon_data *info)
426 {
427 int ret;
428
429 ret = mwifiex_uap_parse_tail_ies(priv, info);
430
431 if (ret)
432 return ret;
433
434 return mwifiex_set_mgmt_beacon_data_ies(priv, info);
435 }
436
437 /* This function removes management IE set */
mwifiex_del_mgmt_ies(struct mwifiex_private * priv)438 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv)
439 {
440 struct mwifiex_ie *beacon_ie = NULL, *pr_ie = NULL;
441 struct mwifiex_ie *ar_ie = NULL, *gen_ie = NULL;
442 int ret = 0;
443
444 if (priv->gen_idx != MWIFIEX_AUTO_IDX_MASK) {
445 gen_ie = kmalloc(sizeof(*gen_ie), GFP_KERNEL);
446 if (!gen_ie)
447 return -ENOMEM;
448
449 gen_ie->ie_index = cpu_to_le16(priv->gen_idx);
450 gen_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
451 gen_ie->ie_length = 0;
452 if (mwifiex_update_uap_custom_ie(priv, gen_ie, &priv->gen_idx,
453 NULL, &priv->proberesp_idx,
454 NULL, &priv->assocresp_idx)) {
455 ret = -1;
456 goto done;
457 }
458
459 priv->gen_idx = MWIFIEX_AUTO_IDX_MASK;
460 }
461
462 if (priv->beacon_idx != MWIFIEX_AUTO_IDX_MASK) {
463 beacon_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
464 if (!beacon_ie) {
465 ret = -ENOMEM;
466 goto done;
467 }
468 beacon_ie->ie_index = cpu_to_le16(priv->beacon_idx);
469 beacon_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
470 beacon_ie->ie_length = 0;
471 }
472 if (priv->proberesp_idx != MWIFIEX_AUTO_IDX_MASK) {
473 pr_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
474 if (!pr_ie) {
475 ret = -ENOMEM;
476 goto done;
477 }
478 pr_ie->ie_index = cpu_to_le16(priv->proberesp_idx);
479 pr_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
480 pr_ie->ie_length = 0;
481 }
482 if (priv->assocresp_idx != MWIFIEX_AUTO_IDX_MASK) {
483 ar_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
484 if (!ar_ie) {
485 ret = -ENOMEM;
486 goto done;
487 }
488 ar_ie->ie_index = cpu_to_le16(priv->assocresp_idx);
489 ar_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
490 ar_ie->ie_length = 0;
491 }
492
493 if (beacon_ie || pr_ie || ar_ie)
494 ret = mwifiex_update_uap_custom_ie(priv,
495 beacon_ie, &priv->beacon_idx,
496 pr_ie, &priv->proberesp_idx,
497 ar_ie, &priv->assocresp_idx);
498
499 done:
500 kfree(gen_ie);
501 kfree(beacon_ie);
502 kfree(pr_ie);
503 kfree(ar_ie);
504
505 return ret;
506 }
507