1// SPDX-License-Identifier: GPL-2.0
2/******************************************************************************
3 * ieee80211.c
4 *
5 * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
6 * Linux device driver for RTL8192SU
7 *
8 * Modifications for inclusion into the Linux staging tree are
9 * Copyright(c) 2010 Larry Finger. All rights reserved.
10 *
11 * Contact information:
12 * WLAN FAE <wlanfae@realtek.com>.
13 * Larry Finger <Larry.Finger@lwfinger.net>
14 *
15 ******************************************************************************/
16
17#define _IEEE80211_C
18
19#include "drv_types.h"
20#include "ieee80211.h"
21#include "wifi.h"
22#include "osdep_service.h"
23#include "wlan_bssdef.h"
24
25static const u8 WPA_OUI_TYPE[] = {0x00, 0x50, 0xf2, 1};
26static const u8 WPA_CIPHER_SUITE_NONE[] = {0x00, 0x50, 0xf2, 0};
27static const u8 WPA_CIPHER_SUITE_WEP40[] = {0x00, 0x50, 0xf2, 1};
28static const u8 WPA_CIPHER_SUITE_TKIP[] = {0x00, 0x50, 0xf2, 2};
29static const u8 WPA_CIPHER_SUITE_CCMP[] = {0x00, 0x50, 0xf2, 4};
30static const u8 WPA_CIPHER_SUITE_WEP104[] = {0x00, 0x50, 0xf2, 5};
31
32static const u8 RSN_CIPHER_SUITE_NONE[] = {0x00, 0x0f, 0xac, 0};
33static const u8 RSN_CIPHER_SUITE_WEP40[] = {0x00, 0x0f, 0xac, 1};
34static const u8 RSN_CIPHER_SUITE_TKIP[] = {0x00, 0x0f, 0xac, 2};
35static const u8 RSN_CIPHER_SUITE_CCMP[] = {0x00, 0x0f, 0xac, 4};
36static const u8 RSN_CIPHER_SUITE_WEP104[] = {0x00, 0x0f, 0xac, 5};
37
38/*-----------------------------------------------------------
39 * for adhoc-master to generate ie and provide supported-rate to fw
40 *-----------------------------------------------------------
41 */
42
43static u8 WIFI_CCKRATES[] =  {
44	(IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
45	(IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
46	(IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
47	(IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)
48};
49
50static u8 WIFI_OFDMRATES[] = {
51	(IEEE80211_OFDM_RATE_6MB),
52	(IEEE80211_OFDM_RATE_9MB),
53	(IEEE80211_OFDM_RATE_12MB),
54	(IEEE80211_OFDM_RATE_18MB),
55	(IEEE80211_OFDM_RATE_24MB),
56	(IEEE80211_OFDM_RATE_36MB),
57	(IEEE80211_OFDM_RATE_48MB),
58	(IEEE80211_OFDM_RATE_54MB)
59};
60
61uint r8712_is_cckrates_included(u8 *rate)
62{
63	u32 i = 0;
64
65	while (rate[i] != 0) {
66		if ((((rate[i]) & 0x7f) == 2) || (((rate[i]) & 0x7f) == 4) ||
67		    (((rate[i]) & 0x7f) == 11) || (((rate[i]) & 0x7f) == 22))
68			return true;
69		i++;
70	}
71	return false;
72}
73
74uint r8712_is_cckratesonly_included(u8 *rate)
75{
76	u32 i = 0;
77
78	while (rate[i] != 0) {
79		if ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
80		    (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
81			return false;
82		i++;
83	}
84	return true;
85}
86
87/* r8712_set_ie will update frame length */
88u8 *r8712_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen)
89{
90	*pbuf = (u8)index;
91	*(pbuf + 1) = (u8)len;
92	if (len > 0)
93		memcpy((void *)(pbuf + 2), (void *)source, len);
94	*frlen = *frlen + (len + 2);
95	return pbuf + len + 2;
96}
97
98/* ---------------------------------------------------------------------------
99 * index: the information element id index, limit is the limit for search
100 * ---------------------------------------------------------------------------
101 */
102u8 *r8712_get_ie(u8 *pbuf, sint index, uint *len, sint limit)
103{
104	sint tmp, i;
105	u8 *p;
106
107	if (limit < 1)
108		return NULL;
109	p = pbuf;
110	i = 0;
111	*len = 0;
112	while (1) {
113		if (*p == index) {
114			*len = *(p + 1);
115			return p;
116		}
117		tmp = *(p + 1);
118		p += (tmp + 2);
119		i += (tmp + 2);
120		if (i >= limit)
121			break;
122	}
123	return NULL;
124}
125
126static void set_supported_rate(u8 *rates, uint mode)
127{
128	memset(rates, 0, NDIS_802_11_LENGTH_RATES_EX);
129	switch (mode) {
130	case WIRELESS_11B:
131		memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
132		break;
133	case WIRELESS_11G:
134	case WIRELESS_11A:
135		memcpy(rates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
136		break;
137	case WIRELESS_11BG:
138		memcpy(rates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
139		memcpy(rates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES,
140		       IEEE80211_NUM_OFDM_RATESLEN);
141		break;
142	}
143}
144
145static uint r8712_get_rateset_len(u8 *rateset)
146{
147	uint i = 0;
148
149	while (1) {
150		if ((rateset[i]) == 0)
151			break;
152		if (i > 12)
153			break;
154		i++;
155	}
156	return i;
157}
158
159int r8712_generate_ie(struct registry_priv *registrypriv)
160{
161	int rate_len;
162	uint sz = 0;
163	struct wlan_bssid_ex *dev_network = &registrypriv->dev_network;
164	u8 *ie = dev_network->IEs;
165	u16 beacon_period = (u16)dev_network->Configuration.BeaconPeriod;
166
167	/*timestamp will be inserted by hardware*/
168	sz += 8;
169	ie += sz;
170	/*beacon interval : 2bytes*/
171	*(__le16 *)ie = cpu_to_le16(beacon_period);
172	sz += 2;
173	ie += 2;
174	/*capability info*/
175	*(u16 *)ie = 0;
176	*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_IBSS);
177	if (registrypriv->preamble == PREAMBLE_SHORT)
178		*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
179	if (dev_network->Privacy)
180		*(__le16 *)ie |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
181	sz += 2;
182	ie += 2;
183	/*SSID*/
184	ie = r8712_set_ie(ie, WLAN_EID_SSID, dev_network->Ssid.SsidLength,
185			  dev_network->Ssid.Ssid, &sz);
186	/*supported rates*/
187	set_supported_rate(dev_network->rates, registrypriv->wireless_mode);
188	rate_len = r8712_get_rateset_len(dev_network->rates);
189	if (rate_len > 8) {
190		ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES, 8,
191				  dev_network->rates, &sz);
192		ie = r8712_set_ie(ie, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8),
193				  (dev_network->rates + 8), &sz);
194	} else {
195		ie = r8712_set_ie(ie, WLAN_EID_SUPP_RATES,
196				  rate_len, dev_network->rates, &sz);
197	}
198	/*DS parameter set*/
199	ie = r8712_set_ie(ie, WLAN_EID_DS_PARAMS, 1,
200			  (u8 *)&dev_network->Configuration.DSConfig, &sz);
201	/*IBSS Parameter Set*/
202	ie = r8712_set_ie(ie, WLAN_EID_IBSS_PARAMS, 2,
203			  (u8 *)&dev_network->Configuration.ATIMWindow, &sz);
204	return sz;
205}
206
207unsigned char *r8712_get_wpa_ie(unsigned char *ie, uint *wpa_ie_len, int limit)
208{
209	u32 len;
210	u16 val16;
211	unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
212	u8 *buf = ie;
213
214	while (1) {
215		buf = r8712_get_ie(buf, _WPA_IE_ID_, &len, limit);
216		if (buf) {
217			/*check if oui matches...*/
218			if (memcmp((buf + 2), wpa_oui_type,
219				   sizeof(wpa_oui_type)))
220				goto check_next_ie;
221			/*check version...*/
222			memcpy((u8 *)&val16, (buf + 6), sizeof(val16));
223			le16_to_cpus(&val16);
224			if (val16 != 0x0001)
225				goto check_next_ie;
226			*wpa_ie_len = *(buf + 1);
227			return buf;
228		}
229		*wpa_ie_len = 0;
230		return NULL;
231check_next_ie:
232		limit = limit - (buf - ie) - 2 - len;
233		if (limit <= 0)
234			break;
235		buf += (2 + len);
236	}
237	*wpa_ie_len = 0;
238	return NULL;
239}
240
241unsigned char *r8712_get_wpa2_ie(unsigned char *pie, uint *rsn_ie_len,
242				 int limit)
243{
244	return r8712_get_ie(pie, _WPA2_IE_ID_, rsn_ie_len, limit);
245}
246
247static int r8712_get_wpa_cipher_suite(u8 *s)
248{
249	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN))
250		return WPA_CIPHER_NONE;
251	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN))
252		return WPA_CIPHER_WEP40;
253	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN))
254		return WPA_CIPHER_TKIP;
255	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN))
256		return WPA_CIPHER_CCMP;
257	if (!memcmp(s, (void *)WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN))
258		return WPA_CIPHER_WEP104;
259	return 0;
260}
261
262static int r8712_get_wpa2_cipher_suite(u8 *s)
263{
264	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN))
265		return WPA_CIPHER_NONE;
266	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN))
267		return WPA_CIPHER_WEP40;
268	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN))
269		return WPA_CIPHER_TKIP;
270	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN))
271		return WPA_CIPHER_CCMP;
272	if (!memcmp(s, (void *)RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN))
273		return WPA_CIPHER_WEP104;
274	return 0;
275}
276
277int r8712_parse_wpa_ie(u8 *wpa_ie, int wpa_ie_len, int *group_cipher,
278		       int *pairwise_cipher)
279{
280	int i;
281	int left, count;
282	u8 *pos;
283
284	if (wpa_ie_len <= 0) {
285		/* No WPA IE - fail silently */
286		return -EINVAL;
287	}
288	if ((*wpa_ie != _WPA_IE_ID_) ||
289	    (*(wpa_ie + 1) != (u8)(wpa_ie_len - 2)) ||
290	    (memcmp(wpa_ie + 2, (void *)WPA_OUI_TYPE, WPA_SELECTOR_LEN)))
291		return -EINVAL;
292	pos = wpa_ie;
293	pos += 8;
294	left = wpa_ie_len - 8;
295	/*group_cipher*/
296	if (left >= WPA_SELECTOR_LEN) {
297		*group_cipher = r8712_get_wpa_cipher_suite(pos);
298		pos += WPA_SELECTOR_LEN;
299		left -= WPA_SELECTOR_LEN;
300	} else if (left > 0) {
301		return -EINVAL;
302	}
303	/*pairwise_cipher*/
304	if (left >= 2) {
305		count = le16_to_cpu(*(__le16 *)pos);
306		pos += 2;
307		left -= 2;
308		if (count == 0 || left < count * WPA_SELECTOR_LEN)
309			return -EINVAL;
310		for (i = 0; i < count; i++) {
311			*pairwise_cipher |= r8712_get_wpa_cipher_suite(pos);
312			pos += WPA_SELECTOR_LEN;
313			left -= WPA_SELECTOR_LEN;
314		}
315	} else if (left == 1) {
316		return -EINVAL;
317	}
318	return 0;
319}
320
321int r8712_parse_wpa2_ie(u8 *rsn_ie, int rsn_ie_len, int *group_cipher,
322			int *pairwise_cipher)
323{
324	int i;
325	int left, count;
326	u8 *pos;
327
328	if (rsn_ie_len <= 0) {
329		/* No RSN IE - fail silently */
330		return -EINVAL;
331	}
332	if ((*rsn_ie != _WPA2_IE_ID_) ||
333	    (*(rsn_ie + 1) != (u8)(rsn_ie_len - 2)))
334		return -EINVAL;
335	pos = rsn_ie;
336	pos += 4;
337	left = rsn_ie_len - 4;
338	/*group_cipher*/
339	if (left >= RSN_SELECTOR_LEN) {
340		*group_cipher = r8712_get_wpa2_cipher_suite(pos);
341		pos += RSN_SELECTOR_LEN;
342		left -= RSN_SELECTOR_LEN;
343	} else if (left > 0) {
344		return -EINVAL;
345	}
346	/*pairwise_cipher*/
347	if (left >= 2) {
348		count = le16_to_cpu(*(__le16 *)pos);
349		pos += 2;
350		left -= 2;
351		if (count == 0 || left < count * RSN_SELECTOR_LEN)
352			return -EINVAL;
353		for (i = 0; i < count; i++) {
354			*pairwise_cipher |= r8712_get_wpa2_cipher_suite(pos);
355			pos += RSN_SELECTOR_LEN;
356			left -= RSN_SELECTOR_LEN;
357		}
358	} else if (left == 1) {
359		return -EINVAL;
360	}
361	return 0;
362}
363
364int r8712_get_sec_ie(u8 *in_ie, uint in_len, u8 *rsn_ie, u16 *rsn_len,
365		     u8 *wpa_ie, u16 *wpa_len)
366{
367	u8 authmode;
368	u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
369	uint cnt;
370
371	/*Search required WPA or WPA2 IE and copy to sec_ie[ ]*/
372	cnt = _TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_;
373	while (cnt < in_len) {
374		authmode = in_ie[cnt];
375		if ((authmode == _WPA_IE_ID_) &&
376		    (!memcmp(&in_ie[cnt + 2], &wpa_oui[0], 4))) {
377			memcpy(wpa_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
378			*wpa_len = in_ie[cnt + 1] + 2;
379			cnt += in_ie[cnt + 1] + 2;  /*get next */
380		} else {
381			if (authmode == _WPA2_IE_ID_) {
382				memcpy(rsn_ie, &in_ie[cnt],
383				       in_ie[cnt + 1] + 2);
384				*rsn_len = in_ie[cnt + 1] + 2;
385				cnt += in_ie[cnt + 1] + 2;  /*get next*/
386			} else {
387				cnt += in_ie[cnt + 1] + 2;   /*get next*/
388			}
389		}
390	}
391	return *rsn_len + *wpa_len;
392}
393
394int r8712_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
395{
396	int match;
397	uint cnt;
398	u8 eid, wps_oui[4] = {0x0, 0x50, 0xf2, 0x04};
399
400	cnt = 12;
401	match = false;
402	while (cnt < in_len) {
403		eid = in_ie[cnt];
404		if ((eid == _WPA_IE_ID_) &&
405		    (!memcmp(&in_ie[cnt + 2], wps_oui, 4))) {
406			memcpy(wps_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
407			*wps_ielen = in_ie[cnt + 1] + 2;
408			cnt += in_ie[cnt + 1] + 2;
409			match = true;
410			break;
411		}
412		cnt += in_ie[cnt + 1] + 2; /* goto next */
413	}
414	return match;
415}
416