1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3 * Copyright (C) 2015-2017 Intel Deutschland GmbH
4 * Copyright (C) 2018-2020 Intel Corporation
5 */
6 #include <linux/etherdevice.h>
7 #include <linux/math64.h>
8 #include <net/cfg80211.h>
9 #include "mvm.h"
10 #include "iwl-io.h"
11 #include "iwl-prph.h"
12 #include "constants.h"
13
14 struct iwl_mvm_loc_entry {
15 struct list_head list;
16 u8 addr[ETH_ALEN];
17 u8 lci_len, civic_len;
18 u8 buf[];
19 };
20
21 struct iwl_mvm_smooth_entry {
22 struct list_head list;
23 u8 addr[ETH_ALEN];
24 s64 rtt_avg;
25 u64 host_time;
26 };
27
28 struct iwl_mvm_ftm_pasn_entry {
29 struct list_head list;
30 u8 addr[ETH_ALEN];
31 u8 hltk[HLTK_11AZ_LEN];
32 u8 tk[TK_11AZ_LEN];
33 u8 cipher;
34 u8 tx_pn[IEEE80211_CCMP_PN_LEN];
35 u8 rx_pn[IEEE80211_CCMP_PN_LEN];
36 };
37
iwl_mvm_ftm_add_pasn_sta(struct iwl_mvm * mvm,struct ieee80211_vif * vif,u8 * addr,u32 cipher,u8 * tk,u32 tk_len,u8 * hltk,u32 hltk_len)38 int iwl_mvm_ftm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
39 u8 *addr, u32 cipher, u8 *tk, u32 tk_len,
40 u8 *hltk, u32 hltk_len)
41 {
42 struct iwl_mvm_ftm_pasn_entry *pasn = kzalloc(sizeof(*pasn),
43 GFP_KERNEL);
44 u32 expected_tk_len;
45
46 lockdep_assert_held(&mvm->mutex);
47
48 if (!pasn)
49 return -ENOBUFS;
50
51 pasn->cipher = iwl_mvm_cipher_to_location_cipher(cipher);
52
53 switch (pasn->cipher) {
54 case IWL_LOCATION_CIPHER_CCMP_128:
55 case IWL_LOCATION_CIPHER_GCMP_128:
56 expected_tk_len = WLAN_KEY_LEN_CCMP;
57 break;
58 case IWL_LOCATION_CIPHER_GCMP_256:
59 expected_tk_len = WLAN_KEY_LEN_GCMP_256;
60 break;
61 default:
62 goto out;
63 }
64
65 /*
66 * If associated to this AP and already have security context,
67 * the TK is already configured for this station, so it
68 * shouldn't be set again here.
69 */
70 if (vif->bss_conf.assoc &&
71 !memcmp(addr, vif->bss_conf.bssid, ETH_ALEN)) {
72 struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
73 struct ieee80211_sta *sta;
74
75 rcu_read_lock();
76 sta = rcu_dereference(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id]);
77 if (!IS_ERR_OR_NULL(sta) && sta->mfp)
78 expected_tk_len = 0;
79 rcu_read_unlock();
80 }
81
82 if (tk_len != expected_tk_len || hltk_len != sizeof(pasn->hltk)) {
83 IWL_ERR(mvm, "Invalid key length: tk_len=%u hltk_len=%u\n",
84 tk_len, hltk_len);
85 goto out;
86 }
87
88 memcpy(pasn->addr, addr, sizeof(pasn->addr));
89 memcpy(pasn->hltk, hltk, sizeof(pasn->hltk));
90
91 if (tk && tk_len)
92 memcpy(pasn->tk, tk, sizeof(pasn->tk));
93
94 list_add_tail(&pasn->list, &mvm->ftm_initiator.pasn_list);
95 return 0;
96 out:
97 kfree(pasn);
98 return -EINVAL;
99 }
100
iwl_mvm_ftm_remove_pasn_sta(struct iwl_mvm * mvm,u8 * addr)101 void iwl_mvm_ftm_remove_pasn_sta(struct iwl_mvm *mvm, u8 *addr)
102 {
103 struct iwl_mvm_ftm_pasn_entry *entry, *prev;
104
105 lockdep_assert_held(&mvm->mutex);
106
107 list_for_each_entry_safe(entry, prev, &mvm->ftm_initiator.pasn_list,
108 list) {
109 if (memcmp(entry->addr, addr, sizeof(entry->addr)))
110 continue;
111
112 list_del(&entry->list);
113 kfree(entry);
114 return;
115 }
116 }
117
iwl_mvm_ftm_reset(struct iwl_mvm * mvm)118 static void iwl_mvm_ftm_reset(struct iwl_mvm *mvm)
119 {
120 struct iwl_mvm_loc_entry *e, *t;
121
122 mvm->ftm_initiator.req = NULL;
123 mvm->ftm_initiator.req_wdev = NULL;
124 memset(mvm->ftm_initiator.responses, 0,
125 sizeof(mvm->ftm_initiator.responses));
126
127 list_for_each_entry_safe(e, t, &mvm->ftm_initiator.loc_list, list) {
128 list_del(&e->list);
129 kfree(e);
130 }
131 }
132
iwl_mvm_ftm_restart(struct iwl_mvm * mvm)133 void iwl_mvm_ftm_restart(struct iwl_mvm *mvm)
134 {
135 struct cfg80211_pmsr_result result = {
136 .status = NL80211_PMSR_STATUS_FAILURE,
137 .final = 1,
138 .host_time = ktime_get_boottime_ns(),
139 .type = NL80211_PMSR_TYPE_FTM,
140 };
141 int i;
142
143 lockdep_assert_held(&mvm->mutex);
144
145 if (!mvm->ftm_initiator.req)
146 return;
147
148 for (i = 0; i < mvm->ftm_initiator.req->n_peers; i++) {
149 memcpy(result.addr, mvm->ftm_initiator.req->peers[i].addr,
150 ETH_ALEN);
151 result.ftm.burst_index = mvm->ftm_initiator.responses[i];
152
153 cfg80211_pmsr_report(mvm->ftm_initiator.req_wdev,
154 mvm->ftm_initiator.req,
155 &result, GFP_KERNEL);
156 }
157
158 cfg80211_pmsr_complete(mvm->ftm_initiator.req_wdev,
159 mvm->ftm_initiator.req, GFP_KERNEL);
160 iwl_mvm_ftm_reset(mvm);
161 }
162
iwl_mvm_ftm_initiator_smooth_config(struct iwl_mvm * mvm)163 void iwl_mvm_ftm_initiator_smooth_config(struct iwl_mvm *mvm)
164 {
165 INIT_LIST_HEAD(&mvm->ftm_initiator.smooth.resp);
166
167 IWL_DEBUG_INFO(mvm,
168 "enable=%u, alpha=%u, age_jiffies=%u, thresh=(%u:%u)\n",
169 IWL_MVM_FTM_INITIATOR_ENABLE_SMOOTH,
170 IWL_MVM_FTM_INITIATOR_SMOOTH_ALPHA,
171 IWL_MVM_FTM_INITIATOR_SMOOTH_AGE_SEC * HZ,
172 IWL_MVM_FTM_INITIATOR_SMOOTH_OVERSHOOT,
173 IWL_MVM_FTM_INITIATOR_SMOOTH_UNDERSHOOT);
174 }
175
iwl_mvm_ftm_initiator_smooth_stop(struct iwl_mvm * mvm)176 void iwl_mvm_ftm_initiator_smooth_stop(struct iwl_mvm *mvm)
177 {
178 struct iwl_mvm_smooth_entry *se, *st;
179
180 list_for_each_entry_safe(se, st, &mvm->ftm_initiator.smooth.resp,
181 list) {
182 list_del(&se->list);
183 kfree(se);
184 }
185 }
186
187 static int
iwl_ftm_range_request_status_to_err(enum iwl_tof_range_request_status s)188 iwl_ftm_range_request_status_to_err(enum iwl_tof_range_request_status s)
189 {
190 switch (s) {
191 case IWL_TOF_RANGE_REQUEST_STATUS_SUCCESS:
192 return 0;
193 case IWL_TOF_RANGE_REQUEST_STATUS_BUSY:
194 return -EBUSY;
195 default:
196 WARN_ON_ONCE(1);
197 return -EIO;
198 }
199 }
200
iwl_mvm_ftm_cmd_v5(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct iwl_tof_range_req_cmd_v5 * cmd,struct cfg80211_pmsr_request * req)201 static void iwl_mvm_ftm_cmd_v5(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
202 struct iwl_tof_range_req_cmd_v5 *cmd,
203 struct cfg80211_pmsr_request *req)
204 {
205 int i;
206
207 cmd->request_id = req->cookie;
208 cmd->num_of_ap = req->n_peers;
209
210 /* use maximum for "no timeout" or bigger than what we can do */
211 if (!req->timeout || req->timeout > 255 * 100)
212 cmd->req_timeout = 255;
213 else
214 cmd->req_timeout = DIV_ROUND_UP(req->timeout, 100);
215
216 /*
217 * We treat it always as random, since if not we'll
218 * have filled our local address there instead.
219 */
220 cmd->macaddr_random = 1;
221 memcpy(cmd->macaddr_template, req->mac_addr, ETH_ALEN);
222 for (i = 0; i < ETH_ALEN; i++)
223 cmd->macaddr_mask[i] = ~req->mac_addr_mask[i];
224
225 if (vif->bss_conf.assoc)
226 memcpy(cmd->range_req_bssid, vif->bss_conf.bssid, ETH_ALEN);
227 else
228 eth_broadcast_addr(cmd->range_req_bssid);
229 }
230
iwl_mvm_ftm_cmd_common(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct iwl_tof_range_req_cmd_v9 * cmd,struct cfg80211_pmsr_request * req)231 static void iwl_mvm_ftm_cmd_common(struct iwl_mvm *mvm,
232 struct ieee80211_vif *vif,
233 struct iwl_tof_range_req_cmd_v9 *cmd,
234 struct cfg80211_pmsr_request *req)
235 {
236 int i;
237
238 cmd->initiator_flags =
239 cpu_to_le32(IWL_TOF_INITIATOR_FLAGS_MACADDR_RANDOM |
240 IWL_TOF_INITIATOR_FLAGS_NON_ASAP_SUPPORT);
241 cmd->request_id = req->cookie;
242 cmd->num_of_ap = req->n_peers;
243
244 /*
245 * Use a large value for "no timeout". Don't use the maximum value
246 * because of fw limitations.
247 */
248 if (req->timeout)
249 cmd->req_timeout_ms = cpu_to_le32(req->timeout);
250 else
251 cmd->req_timeout_ms = cpu_to_le32(0xfffff);
252
253 memcpy(cmd->macaddr_template, req->mac_addr, ETH_ALEN);
254 for (i = 0; i < ETH_ALEN; i++)
255 cmd->macaddr_mask[i] = ~req->mac_addr_mask[i];
256
257 if (vif->bss_conf.assoc) {
258 memcpy(cmd->range_req_bssid, vif->bss_conf.bssid, ETH_ALEN);
259
260 /* AP's TSF is only relevant if associated */
261 for (i = 0; i < req->n_peers; i++) {
262 if (req->peers[i].report_ap_tsf) {
263 struct iwl_mvm_vif *mvmvif =
264 iwl_mvm_vif_from_mac80211(vif);
265
266 cmd->tsf_mac_id = cpu_to_le32(mvmvif->id);
267 return;
268 }
269 }
270 } else {
271 eth_broadcast_addr(cmd->range_req_bssid);
272 }
273
274 /* Don't report AP's TSF */
275 cmd->tsf_mac_id = cpu_to_le32(0xff);
276 }
277
iwl_mvm_ftm_cmd_v8(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct iwl_tof_range_req_cmd_v8 * cmd,struct cfg80211_pmsr_request * req)278 static void iwl_mvm_ftm_cmd_v8(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
279 struct iwl_tof_range_req_cmd_v8 *cmd,
280 struct cfg80211_pmsr_request *req)
281 {
282 iwl_mvm_ftm_cmd_common(mvm, vif, (void *)cmd, req);
283 }
284
285 static int
iwl_mvm_ftm_target_chandef_v1(struct iwl_mvm * mvm,struct cfg80211_pmsr_request_peer * peer,u8 * channel,u8 * bandwidth,u8 * ctrl_ch_position)286 iwl_mvm_ftm_target_chandef_v1(struct iwl_mvm *mvm,
287 struct cfg80211_pmsr_request_peer *peer,
288 u8 *channel, u8 *bandwidth,
289 u8 *ctrl_ch_position)
290 {
291 u32 freq = peer->chandef.chan->center_freq;
292
293 *channel = ieee80211_frequency_to_channel(freq);
294
295 switch (peer->chandef.width) {
296 case NL80211_CHAN_WIDTH_20_NOHT:
297 *bandwidth = IWL_TOF_BW_20_LEGACY;
298 break;
299 case NL80211_CHAN_WIDTH_20:
300 *bandwidth = IWL_TOF_BW_20_HT;
301 break;
302 case NL80211_CHAN_WIDTH_40:
303 *bandwidth = IWL_TOF_BW_40;
304 break;
305 case NL80211_CHAN_WIDTH_80:
306 *bandwidth = IWL_TOF_BW_80;
307 break;
308 default:
309 IWL_ERR(mvm, "Unsupported BW in FTM request (%d)\n",
310 peer->chandef.width);
311 return -EINVAL;
312 }
313
314 *ctrl_ch_position = (peer->chandef.width > NL80211_CHAN_WIDTH_20) ?
315 iwl_mvm_get_ctrl_pos(&peer->chandef) : 0;
316
317 return 0;
318 }
319
320 static int
iwl_mvm_ftm_target_chandef_v2(struct iwl_mvm * mvm,struct cfg80211_pmsr_request_peer * peer,u8 * channel,u8 * format_bw,u8 * ctrl_ch_position)321 iwl_mvm_ftm_target_chandef_v2(struct iwl_mvm *mvm,
322 struct cfg80211_pmsr_request_peer *peer,
323 u8 *channel, u8 *format_bw,
324 u8 *ctrl_ch_position)
325 {
326 u32 freq = peer->chandef.chan->center_freq;
327
328 *channel = ieee80211_frequency_to_channel(freq);
329
330 switch (peer->chandef.width) {
331 case NL80211_CHAN_WIDTH_20_NOHT:
332 *format_bw = IWL_LOCATION_FRAME_FORMAT_LEGACY;
333 *format_bw |= IWL_LOCATION_BW_20MHZ << LOCATION_BW_POS;
334 break;
335 case NL80211_CHAN_WIDTH_20:
336 *format_bw = IWL_LOCATION_FRAME_FORMAT_HT;
337 *format_bw |= IWL_LOCATION_BW_20MHZ << LOCATION_BW_POS;
338 break;
339 case NL80211_CHAN_WIDTH_40:
340 *format_bw = IWL_LOCATION_FRAME_FORMAT_HT;
341 *format_bw |= IWL_LOCATION_BW_40MHZ << LOCATION_BW_POS;
342 break;
343 case NL80211_CHAN_WIDTH_80:
344 *format_bw = IWL_LOCATION_FRAME_FORMAT_VHT;
345 *format_bw |= IWL_LOCATION_BW_80MHZ << LOCATION_BW_POS;
346 break;
347 default:
348 IWL_ERR(mvm, "Unsupported BW in FTM request (%d)\n",
349 peer->chandef.width);
350 return -EINVAL;
351 }
352
353 /* non EDCA based measurement must use HE preamble */
354 if (peer->ftm.trigger_based || peer->ftm.non_trigger_based)
355 *format_bw |= IWL_LOCATION_FRAME_FORMAT_HE;
356
357 *ctrl_ch_position = (peer->chandef.width > NL80211_CHAN_WIDTH_20) ?
358 iwl_mvm_get_ctrl_pos(&peer->chandef) : 0;
359
360 return 0;
361 }
362
363 static int
iwl_mvm_ftm_put_target_v2(struct iwl_mvm * mvm,struct cfg80211_pmsr_request_peer * peer,struct iwl_tof_range_req_ap_entry_v2 * target)364 iwl_mvm_ftm_put_target_v2(struct iwl_mvm *mvm,
365 struct cfg80211_pmsr_request_peer *peer,
366 struct iwl_tof_range_req_ap_entry_v2 *target)
367 {
368 int ret;
369
370 ret = iwl_mvm_ftm_target_chandef_v1(mvm, peer, &target->channel_num,
371 &target->bandwidth,
372 &target->ctrl_ch_position);
373 if (ret)
374 return ret;
375
376 memcpy(target->bssid, peer->addr, ETH_ALEN);
377 target->burst_period =
378 cpu_to_le16(peer->ftm.burst_period);
379 target->samples_per_burst = peer->ftm.ftms_per_burst;
380 target->num_of_bursts = peer->ftm.num_bursts_exp;
381 target->measure_type = 0; /* regular two-sided FTM */
382 target->retries_per_sample = peer->ftm.ftmr_retries;
383 target->asap_mode = peer->ftm.asap;
384 target->enable_dyn_ack = IWL_MVM_FTM_INITIATOR_DYNACK;
385
386 if (peer->ftm.request_lci)
387 target->location_req |= IWL_TOF_LOC_LCI;
388 if (peer->ftm.request_civicloc)
389 target->location_req |= IWL_TOF_LOC_CIVIC;
390
391 target->algo_type = IWL_MVM_FTM_INITIATOR_ALGO;
392
393 return 0;
394 }
395
396 #define FTM_PUT_FLAG(flag) (target->initiator_ap_flags |= \
397 cpu_to_le32(IWL_INITIATOR_AP_FLAGS_##flag))
398
399 static void
iwl_mvm_ftm_put_target_common(struct iwl_mvm * mvm,struct cfg80211_pmsr_request_peer * peer,struct iwl_tof_range_req_ap_entry_v6 * target)400 iwl_mvm_ftm_put_target_common(struct iwl_mvm *mvm,
401 struct cfg80211_pmsr_request_peer *peer,
402 struct iwl_tof_range_req_ap_entry_v6 *target)
403 {
404 memcpy(target->bssid, peer->addr, ETH_ALEN);
405 target->burst_period =
406 cpu_to_le16(peer->ftm.burst_period);
407 target->samples_per_burst = peer->ftm.ftms_per_burst;
408 target->num_of_bursts = peer->ftm.num_bursts_exp;
409 target->ftmr_max_retries = peer->ftm.ftmr_retries;
410 target->initiator_ap_flags = cpu_to_le32(0);
411
412 if (peer->ftm.asap)
413 FTM_PUT_FLAG(ASAP);
414
415 if (peer->ftm.request_lci)
416 FTM_PUT_FLAG(LCI_REQUEST);
417
418 if (peer->ftm.request_civicloc)
419 FTM_PUT_FLAG(CIVIC_REQUEST);
420
421 if (IWL_MVM_FTM_INITIATOR_DYNACK)
422 FTM_PUT_FLAG(DYN_ACK);
423
424 if (IWL_MVM_FTM_INITIATOR_ALGO == IWL_TOF_ALGO_TYPE_LINEAR_REG)
425 FTM_PUT_FLAG(ALGO_LR);
426 else if (IWL_MVM_FTM_INITIATOR_ALGO == IWL_TOF_ALGO_TYPE_FFT)
427 FTM_PUT_FLAG(ALGO_FFT);
428
429 if (peer->ftm.trigger_based)
430 FTM_PUT_FLAG(TB);
431 else if (peer->ftm.non_trigger_based)
432 FTM_PUT_FLAG(NON_TB);
433 }
434
435 static int
iwl_mvm_ftm_put_target_v3(struct iwl_mvm * mvm,struct cfg80211_pmsr_request_peer * peer,struct iwl_tof_range_req_ap_entry_v3 * target)436 iwl_mvm_ftm_put_target_v3(struct iwl_mvm *mvm,
437 struct cfg80211_pmsr_request_peer *peer,
438 struct iwl_tof_range_req_ap_entry_v3 *target)
439 {
440 int ret;
441
442 ret = iwl_mvm_ftm_target_chandef_v1(mvm, peer, &target->channel_num,
443 &target->bandwidth,
444 &target->ctrl_ch_position);
445 if (ret)
446 return ret;
447
448 /*
449 * Versions 3 and 4 has some common fields, so
450 * iwl_mvm_ftm_put_target_common() can be used for version 7 too.
451 */
452 iwl_mvm_ftm_put_target_common(mvm, peer, (void *)target);
453
454 return 0;
455 }
456
457 static int
iwl_mvm_ftm_put_target_v4(struct iwl_mvm * mvm,struct cfg80211_pmsr_request_peer * peer,struct iwl_tof_range_req_ap_entry_v4 * target)458 iwl_mvm_ftm_put_target_v4(struct iwl_mvm *mvm,
459 struct cfg80211_pmsr_request_peer *peer,
460 struct iwl_tof_range_req_ap_entry_v4 *target)
461 {
462 int ret;
463
464 ret = iwl_mvm_ftm_target_chandef_v2(mvm, peer, &target->channel_num,
465 &target->format_bw,
466 &target->ctrl_ch_position);
467 if (ret)
468 return ret;
469
470 iwl_mvm_ftm_put_target_common(mvm, peer, (void *)target);
471
472 return 0;
473 }
474
475 static int
iwl_mvm_ftm_put_target(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request_peer * peer,struct iwl_tof_range_req_ap_entry_v6 * target)476 iwl_mvm_ftm_put_target(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
477 struct cfg80211_pmsr_request_peer *peer,
478 struct iwl_tof_range_req_ap_entry_v6 *target)
479 {
480 int ret;
481
482 ret = iwl_mvm_ftm_target_chandef_v2(mvm, peer, &target->channel_num,
483 &target->format_bw,
484 &target->ctrl_ch_position);
485 if (ret)
486 return ret;
487
488 iwl_mvm_ftm_put_target_common(mvm, peer, target);
489
490 if (vif->bss_conf.assoc &&
491 !memcmp(peer->addr, vif->bss_conf.bssid, ETH_ALEN)) {
492 struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
493 struct ieee80211_sta *sta;
494
495 rcu_read_lock();
496
497 sta = rcu_dereference(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id]);
498 if (sta->mfp)
499 FTM_PUT_FLAG(PMF);
500
501 rcu_read_unlock();
502
503 target->sta_id = mvmvif->ap_sta_id;
504 } else {
505 target->sta_id = IWL_MVM_INVALID_STA;
506 }
507
508 /*
509 * TODO: Beacon interval is currently unknown, so use the common value
510 * of 100 TUs.
511 */
512 target->beacon_interval = cpu_to_le16(100);
513 return 0;
514 }
515
iwl_mvm_ftm_send_cmd(struct iwl_mvm * mvm,struct iwl_host_cmd * hcmd)516 static int iwl_mvm_ftm_send_cmd(struct iwl_mvm *mvm, struct iwl_host_cmd *hcmd)
517 {
518 u32 status;
519 int err = iwl_mvm_send_cmd_status(mvm, hcmd, &status);
520
521 if (!err && status) {
522 IWL_ERR(mvm, "FTM range request command failure, status: %u\n",
523 status);
524 err = iwl_ftm_range_request_status_to_err(status);
525 }
526
527 return err;
528 }
529
iwl_mvm_ftm_start_v5(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)530 static int iwl_mvm_ftm_start_v5(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
531 struct cfg80211_pmsr_request *req)
532 {
533 struct iwl_tof_range_req_cmd_v5 cmd_v5;
534 struct iwl_host_cmd hcmd = {
535 .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
536 .dataflags[0] = IWL_HCMD_DFL_DUP,
537 .data[0] = &cmd_v5,
538 .len[0] = sizeof(cmd_v5),
539 };
540 u8 i;
541 int err;
542
543 iwl_mvm_ftm_cmd_v5(mvm, vif, &cmd_v5, req);
544
545 for (i = 0; i < cmd_v5.num_of_ap; i++) {
546 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
547
548 err = iwl_mvm_ftm_put_target_v2(mvm, peer, &cmd_v5.ap[i]);
549 if (err)
550 return err;
551 }
552
553 return iwl_mvm_ftm_send_cmd(mvm, &hcmd);
554 }
555
iwl_mvm_ftm_start_v7(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)556 static int iwl_mvm_ftm_start_v7(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
557 struct cfg80211_pmsr_request *req)
558 {
559 struct iwl_tof_range_req_cmd_v7 cmd_v7;
560 struct iwl_host_cmd hcmd = {
561 .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
562 .dataflags[0] = IWL_HCMD_DFL_DUP,
563 .data[0] = &cmd_v7,
564 .len[0] = sizeof(cmd_v7),
565 };
566 u8 i;
567 int err;
568
569 /*
570 * Versions 7 and 8 has the same structure except from the responders
571 * list, so iwl_mvm_ftm_cmd() can be used for version 7 too.
572 */
573 iwl_mvm_ftm_cmd_v8(mvm, vif, (void *)&cmd_v7, req);
574
575 for (i = 0; i < cmd_v7.num_of_ap; i++) {
576 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
577
578 err = iwl_mvm_ftm_put_target_v3(mvm, peer, &cmd_v7.ap[i]);
579 if (err)
580 return err;
581 }
582
583 return iwl_mvm_ftm_send_cmd(mvm, &hcmd);
584 }
585
iwl_mvm_ftm_start_v8(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)586 static int iwl_mvm_ftm_start_v8(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
587 struct cfg80211_pmsr_request *req)
588 {
589 struct iwl_tof_range_req_cmd_v8 cmd;
590 struct iwl_host_cmd hcmd = {
591 .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
592 .dataflags[0] = IWL_HCMD_DFL_DUP,
593 .data[0] = &cmd,
594 .len[0] = sizeof(cmd),
595 };
596 u8 i;
597 int err;
598
599 iwl_mvm_ftm_cmd_v8(mvm, vif, (void *)&cmd, req);
600
601 for (i = 0; i < cmd.num_of_ap; i++) {
602 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
603
604 err = iwl_mvm_ftm_put_target_v4(mvm, peer, &cmd.ap[i]);
605 if (err)
606 return err;
607 }
608
609 return iwl_mvm_ftm_send_cmd(mvm, &hcmd);
610 }
611
iwl_mvm_ftm_start_v9(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)612 static int iwl_mvm_ftm_start_v9(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
613 struct cfg80211_pmsr_request *req)
614 {
615 struct iwl_tof_range_req_cmd_v9 cmd;
616 struct iwl_host_cmd hcmd = {
617 .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
618 .dataflags[0] = IWL_HCMD_DFL_DUP,
619 .data[0] = &cmd,
620 .len[0] = sizeof(cmd),
621 };
622 u8 i;
623 int err;
624
625 iwl_mvm_ftm_cmd_common(mvm, vif, &cmd, req);
626
627 for (i = 0; i < cmd.num_of_ap; i++) {
628 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
629 struct iwl_tof_range_req_ap_entry_v6 *target = &cmd.ap[i];
630
631 err = iwl_mvm_ftm_put_target(mvm, vif, peer, target);
632 if (err)
633 return err;
634 }
635
636 return iwl_mvm_ftm_send_cmd(mvm, &hcmd);
637 }
638
iter(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_sta * sta,struct ieee80211_key_conf * key,void * data)639 static void iter(struct ieee80211_hw *hw,
640 struct ieee80211_vif *vif,
641 struct ieee80211_sta *sta,
642 struct ieee80211_key_conf *key,
643 void *data)
644 {
645 struct iwl_tof_range_req_ap_entry_v6 *target = data;
646
647 if (!sta || memcmp(sta->addr, target->bssid, ETH_ALEN))
648 return;
649
650 WARN_ON(!sta->mfp);
651
652 if (WARN_ON(key->keylen > sizeof(target->tk)))
653 return;
654
655 memcpy(target->tk, key->key, key->keylen);
656 target->cipher = iwl_mvm_cipher_to_location_cipher(key->cipher);
657 WARN_ON(target->cipher == IWL_LOCATION_CIPHER_INVALID);
658 }
659
660 static void
iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct iwl_tof_range_req_ap_entry_v7 * target)661 iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
662 struct iwl_tof_range_req_ap_entry_v7 *target)
663 {
664 struct iwl_mvm_ftm_pasn_entry *entry;
665 u32 flags = le32_to_cpu(target->initiator_ap_flags);
666
667 if (!(flags & (IWL_INITIATOR_AP_FLAGS_NON_TB |
668 IWL_INITIATOR_AP_FLAGS_TB)))
669 return;
670
671 lockdep_assert_held(&mvm->mutex);
672
673 list_for_each_entry(entry, &mvm->ftm_initiator.pasn_list, list) {
674 if (memcmp(entry->addr, target->bssid, sizeof(entry->addr)))
675 continue;
676
677 target->cipher = entry->cipher;
678 memcpy(target->hltk, entry->hltk, sizeof(target->hltk));
679
680 if (vif->bss_conf.assoc &&
681 !memcmp(vif->bss_conf.bssid, target->bssid,
682 sizeof(target->bssid)))
683 ieee80211_iter_keys(mvm->hw, vif, iter, target);
684 else
685 memcpy(target->tk, entry->tk, sizeof(target->tk));
686
687 memcpy(target->rx_pn, entry->rx_pn, sizeof(target->rx_pn));
688 memcpy(target->tx_pn, entry->tx_pn, sizeof(target->tx_pn));
689
690 target->initiator_ap_flags |=
691 cpu_to_le32(IWL_INITIATOR_AP_FLAGS_SECURED);
692 return;
693 }
694 }
695
696 static int
iwl_mvm_ftm_put_target_v7(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request_peer * peer,struct iwl_tof_range_req_ap_entry_v7 * target)697 iwl_mvm_ftm_put_target_v7(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
698 struct cfg80211_pmsr_request_peer *peer,
699 struct iwl_tof_range_req_ap_entry_v7 *target)
700 {
701 int err = iwl_mvm_ftm_put_target(mvm, vif, peer, (void *)target);
702 if (err)
703 return err;
704
705 iwl_mvm_ftm_set_secured_ranging(mvm, vif, target);
706 return err;
707 }
708
iwl_mvm_ftm_start_v11(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)709 static int iwl_mvm_ftm_start_v11(struct iwl_mvm *mvm,
710 struct ieee80211_vif *vif,
711 struct cfg80211_pmsr_request *req)
712 {
713 struct iwl_tof_range_req_cmd_v11 cmd;
714 struct iwl_host_cmd hcmd = {
715 .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
716 .dataflags[0] = IWL_HCMD_DFL_DUP,
717 .data[0] = &cmd,
718 .len[0] = sizeof(cmd),
719 };
720 u8 i;
721 int err;
722
723 iwl_mvm_ftm_cmd_common(mvm, vif, (void *)&cmd, req);
724
725 for (i = 0; i < cmd.num_of_ap; i++) {
726 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
727 struct iwl_tof_range_req_ap_entry_v7 *target = &cmd.ap[i];
728
729 err = iwl_mvm_ftm_put_target_v7(mvm, vif, peer, target);
730 if (err)
731 return err;
732 }
733
734 return iwl_mvm_ftm_send_cmd(mvm, &hcmd);
735 }
736
737 static void
iwl_mvm_ftm_set_ndp_params(struct iwl_mvm * mvm,struct iwl_tof_range_req_ap_entry_v8 * target)738 iwl_mvm_ftm_set_ndp_params(struct iwl_mvm *mvm,
739 struct iwl_tof_range_req_ap_entry_v8 *target)
740 {
741 /* Only 2 STS are supported on Tx */
742 u32 i2r_max_sts = IWL_MVM_FTM_I2R_MAX_STS > 1 ? 1 :
743 IWL_MVM_FTM_I2R_MAX_STS;
744
745 target->r2i_ndp_params = IWL_MVM_FTM_R2I_MAX_REP |
746 (IWL_MVM_FTM_R2I_MAX_STS << IWL_LOCATION_MAX_STS_POS);
747 target->i2r_ndp_params = IWL_MVM_FTM_I2R_MAX_REP |
748 (i2r_max_sts << IWL_LOCATION_MAX_STS_POS);
749 target->r2i_max_total_ltf = IWL_MVM_FTM_R2I_MAX_TOTAL_LTF;
750 target->i2r_max_total_ltf = IWL_MVM_FTM_I2R_MAX_TOTAL_LTF;
751 }
752
iwl_mvm_ftm_start_v12(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)753 static int iwl_mvm_ftm_start_v12(struct iwl_mvm *mvm,
754 struct ieee80211_vif *vif,
755 struct cfg80211_pmsr_request *req)
756 {
757 struct iwl_tof_range_req_cmd_v12 cmd;
758 struct iwl_host_cmd hcmd = {
759 .id = iwl_cmd_id(TOF_RANGE_REQ_CMD, LOCATION_GROUP, 0),
760 .dataflags[0] = IWL_HCMD_DFL_DUP,
761 .data[0] = &cmd,
762 .len[0] = sizeof(cmd),
763 };
764 u8 i;
765 int err;
766
767 iwl_mvm_ftm_cmd_common(mvm, vif, (void *)&cmd, req);
768
769 for (i = 0; i < cmd.num_of_ap; i++) {
770 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
771 struct iwl_tof_range_req_ap_entry_v8 *target = &cmd.ap[i];
772 u32 flags;
773
774 err = iwl_mvm_ftm_put_target_v7(mvm, vif, peer, (void *)target);
775 if (err)
776 return err;
777
778 iwl_mvm_ftm_set_ndp_params(mvm, target);
779
780 /*
781 * If secure LTF is turned off, replace the flag with PMF only
782 */
783 flags = le32_to_cpu(target->initiator_ap_flags);
784 if ((flags & IWL_INITIATOR_AP_FLAGS_SECURED) &&
785 !IWL_MVM_FTM_INITIATOR_SECURE_LTF) {
786 flags &= ~IWL_INITIATOR_AP_FLAGS_SECURED;
787 flags |= IWL_INITIATOR_AP_FLAGS_PMF;
788 target->initiator_ap_flags = cpu_to_le32(flags);
789 }
790 }
791
792 return iwl_mvm_ftm_send_cmd(mvm, &hcmd);
793 }
794
iwl_mvm_ftm_start(struct iwl_mvm * mvm,struct ieee80211_vif * vif,struct cfg80211_pmsr_request * req)795 int iwl_mvm_ftm_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
796 struct cfg80211_pmsr_request *req)
797 {
798 bool new_api = fw_has_api(&mvm->fw->ucode_capa,
799 IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ);
800 int err;
801
802 lockdep_assert_held(&mvm->mutex);
803
804 if (mvm->ftm_initiator.req)
805 return -EBUSY;
806
807 if (new_api) {
808 u8 cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, LOCATION_GROUP,
809 TOF_RANGE_REQ_CMD,
810 IWL_FW_CMD_VER_UNKNOWN);
811
812 switch (cmd_ver) {
813 case 12:
814 err = iwl_mvm_ftm_start_v12(mvm, vif, req);
815 break;
816 case 11:
817 err = iwl_mvm_ftm_start_v11(mvm, vif, req);
818 break;
819 case 9:
820 case 10:
821 err = iwl_mvm_ftm_start_v9(mvm, vif, req);
822 break;
823 case 8:
824 err = iwl_mvm_ftm_start_v8(mvm, vif, req);
825 break;
826 default:
827 err = iwl_mvm_ftm_start_v7(mvm, vif, req);
828 break;
829 }
830 } else {
831 err = iwl_mvm_ftm_start_v5(mvm, vif, req);
832 }
833
834 if (!err) {
835 mvm->ftm_initiator.req = req;
836 mvm->ftm_initiator.req_wdev = ieee80211_vif_to_wdev(vif);
837 }
838
839 return err;
840 }
841
iwl_mvm_ftm_abort(struct iwl_mvm * mvm,struct cfg80211_pmsr_request * req)842 void iwl_mvm_ftm_abort(struct iwl_mvm *mvm, struct cfg80211_pmsr_request *req)
843 {
844 struct iwl_tof_range_abort_cmd cmd = {
845 .request_id = req->cookie,
846 };
847
848 lockdep_assert_held(&mvm->mutex);
849
850 if (req != mvm->ftm_initiator.req)
851 return;
852
853 iwl_mvm_ftm_reset(mvm);
854
855 if (iwl_mvm_send_cmd_pdu(mvm, iwl_cmd_id(TOF_RANGE_ABORT_CMD,
856 LOCATION_GROUP, 0),
857 0, sizeof(cmd), &cmd))
858 IWL_ERR(mvm, "failed to abort FTM process\n");
859 }
860
iwl_mvm_ftm_find_peer(struct cfg80211_pmsr_request * req,const u8 * addr)861 static int iwl_mvm_ftm_find_peer(struct cfg80211_pmsr_request *req,
862 const u8 *addr)
863 {
864 int i;
865
866 for (i = 0; i < req->n_peers; i++) {
867 struct cfg80211_pmsr_request_peer *peer = &req->peers[i];
868
869 if (ether_addr_equal_unaligned(peer->addr, addr))
870 return i;
871 }
872
873 return -ENOENT;
874 }
875
iwl_mvm_ftm_get_host_time(struct iwl_mvm * mvm,__le32 fw_gp2_ts)876 static u64 iwl_mvm_ftm_get_host_time(struct iwl_mvm *mvm, __le32 fw_gp2_ts)
877 {
878 u32 gp2_ts = le32_to_cpu(fw_gp2_ts);
879 u32 curr_gp2, diff;
880 u64 now_from_boot_ns;
881
882 iwl_mvm_get_sync_time(mvm, &curr_gp2, &now_from_boot_ns);
883
884 if (curr_gp2 >= gp2_ts)
885 diff = curr_gp2 - gp2_ts;
886 else
887 diff = curr_gp2 + (U32_MAX - gp2_ts + 1);
888
889 return now_from_boot_ns - (u64)diff * 1000;
890 }
891
iwl_mvm_ftm_get_lci_civic(struct iwl_mvm * mvm,struct cfg80211_pmsr_result * res)892 static void iwl_mvm_ftm_get_lci_civic(struct iwl_mvm *mvm,
893 struct cfg80211_pmsr_result *res)
894 {
895 struct iwl_mvm_loc_entry *entry;
896
897 list_for_each_entry(entry, &mvm->ftm_initiator.loc_list, list) {
898 if (!ether_addr_equal_unaligned(res->addr, entry->addr))
899 continue;
900
901 if (entry->lci_len) {
902 res->ftm.lci_len = entry->lci_len;
903 res->ftm.lci = entry->buf;
904 }
905
906 if (entry->civic_len) {
907 res->ftm.civicloc_len = entry->civic_len;
908 res->ftm.civicloc = entry->buf + entry->lci_len;
909 }
910
911 /* we found the entry we needed */
912 break;
913 }
914 }
915
iwl_mvm_ftm_range_resp_valid(struct iwl_mvm * mvm,u8 request_id,u8 num_of_aps)916 static int iwl_mvm_ftm_range_resp_valid(struct iwl_mvm *mvm, u8 request_id,
917 u8 num_of_aps)
918 {
919 lockdep_assert_held(&mvm->mutex);
920
921 if (request_id != (u8)mvm->ftm_initiator.req->cookie) {
922 IWL_ERR(mvm, "Request ID mismatch, got %u, active %u\n",
923 request_id, (u8)mvm->ftm_initiator.req->cookie);
924 return -EINVAL;
925 }
926
927 if (num_of_aps > mvm->ftm_initiator.req->n_peers) {
928 IWL_ERR(mvm, "FTM range response invalid\n");
929 return -EINVAL;
930 }
931
932 return 0;
933 }
934
iwl_mvm_ftm_rtt_smoothing(struct iwl_mvm * mvm,struct cfg80211_pmsr_result * res)935 static void iwl_mvm_ftm_rtt_smoothing(struct iwl_mvm *mvm,
936 struct cfg80211_pmsr_result *res)
937 {
938 struct iwl_mvm_smooth_entry *resp;
939 s64 rtt_avg, rtt = res->ftm.rtt_avg;
940 u32 undershoot, overshoot;
941 u8 alpha;
942 bool found;
943
944 if (!IWL_MVM_FTM_INITIATOR_ENABLE_SMOOTH)
945 return;
946
947 WARN_ON(rtt < 0);
948
949 if (res->status != NL80211_PMSR_STATUS_SUCCESS) {
950 IWL_DEBUG_INFO(mvm,
951 ": %pM: ignore failed measurement. Status=%u\n",
952 res->addr, res->status);
953 return;
954 }
955
956 found = false;
957 list_for_each_entry(resp, &mvm->ftm_initiator.smooth.resp, list) {
958 if (!memcmp(res->addr, resp->addr, ETH_ALEN)) {
959 found = true;
960 break;
961 }
962 }
963
964 if (!found) {
965 resp = kzalloc(sizeof(*resp), GFP_KERNEL);
966 if (!resp)
967 return;
968
969 memcpy(resp->addr, res->addr, ETH_ALEN);
970 list_add_tail(&resp->list, &mvm->ftm_initiator.smooth.resp);
971
972 resp->rtt_avg = rtt;
973
974 IWL_DEBUG_INFO(mvm, "new: %pM: rtt_avg=%lld\n",
975 resp->addr, resp->rtt_avg);
976 goto update_time;
977 }
978
979 if (res->host_time - resp->host_time >
980 IWL_MVM_FTM_INITIATOR_SMOOTH_AGE_SEC * 1000000000) {
981 resp->rtt_avg = rtt;
982
983 IWL_DEBUG_INFO(mvm, "expired: %pM: rtt_avg=%lld\n",
984 resp->addr, resp->rtt_avg);
985 goto update_time;
986 }
987
988 /* Smooth the results based on the tracked RTT average */
989 undershoot = IWL_MVM_FTM_INITIATOR_SMOOTH_UNDERSHOOT;
990 overshoot = IWL_MVM_FTM_INITIATOR_SMOOTH_OVERSHOOT;
991 alpha = IWL_MVM_FTM_INITIATOR_SMOOTH_ALPHA;
992
993 rtt_avg = (alpha * rtt + (100 - alpha) * resp->rtt_avg) / 100;
994
995 IWL_DEBUG_INFO(mvm,
996 "%pM: prev rtt_avg=%lld, new rtt_avg=%lld, rtt=%lld\n",
997 resp->addr, resp->rtt_avg, rtt_avg, rtt);
998
999 /*
1000 * update the responder's average RTT results regardless of
1001 * the under/over shoot logic below
1002 */
1003 resp->rtt_avg = rtt_avg;
1004
1005 /* smooth the results */
1006 if (rtt_avg > rtt && (rtt_avg - rtt) > undershoot) {
1007 res->ftm.rtt_avg = rtt_avg;
1008
1009 IWL_DEBUG_INFO(mvm,
1010 "undershoot: val=%lld\n",
1011 (rtt_avg - rtt));
1012 } else if (rtt_avg < rtt && (rtt - rtt_avg) >
1013 overshoot) {
1014 res->ftm.rtt_avg = rtt_avg;
1015 IWL_DEBUG_INFO(mvm,
1016 "overshoot: val=%lld\n",
1017 (rtt - rtt_avg));
1018 }
1019
1020 update_time:
1021 resp->host_time = res->host_time;
1022 }
1023
iwl_mvm_debug_range_resp(struct iwl_mvm * mvm,u8 index,struct cfg80211_pmsr_result * res)1024 static void iwl_mvm_debug_range_resp(struct iwl_mvm *mvm, u8 index,
1025 struct cfg80211_pmsr_result *res)
1026 {
1027 s64 rtt_avg = div_s64(res->ftm.rtt_avg * 100, 6666);
1028
1029 IWL_DEBUG_INFO(mvm, "entry %d\n", index);
1030 IWL_DEBUG_INFO(mvm, "\tstatus: %d\n", res->status);
1031 IWL_DEBUG_INFO(mvm, "\tBSSID: %pM\n", res->addr);
1032 IWL_DEBUG_INFO(mvm, "\thost time: %llu\n", res->host_time);
1033 IWL_DEBUG_INFO(mvm, "\tburst index: %hhu\n", res->ftm.burst_index);
1034 IWL_DEBUG_INFO(mvm, "\tsuccess num: %u\n", res->ftm.num_ftmr_successes);
1035 IWL_DEBUG_INFO(mvm, "\trssi: %d\n", res->ftm.rssi_avg);
1036 IWL_DEBUG_INFO(mvm, "\trssi spread: %hhu\n", res->ftm.rssi_spread);
1037 IWL_DEBUG_INFO(mvm, "\trtt: %lld\n", res->ftm.rtt_avg);
1038 IWL_DEBUG_INFO(mvm, "\trtt var: %llu\n", res->ftm.rtt_variance);
1039 IWL_DEBUG_INFO(mvm, "\trtt spread: %llu\n", res->ftm.rtt_spread);
1040 IWL_DEBUG_INFO(mvm, "\tdistance: %lld\n", rtt_avg);
1041 }
1042
1043 static void
iwl_mvm_ftm_pasn_update_pn(struct iwl_mvm * mvm,struct iwl_tof_range_rsp_ap_entry_ntfy_v6 * fw_ap)1044 iwl_mvm_ftm_pasn_update_pn(struct iwl_mvm *mvm,
1045 struct iwl_tof_range_rsp_ap_entry_ntfy_v6 *fw_ap)
1046 {
1047 struct iwl_mvm_ftm_pasn_entry *entry;
1048
1049 lockdep_assert_held(&mvm->mutex);
1050
1051 list_for_each_entry(entry, &mvm->ftm_initiator.pasn_list, list) {
1052 if (memcmp(fw_ap->bssid, entry->addr, sizeof(entry->addr)))
1053 continue;
1054
1055 memcpy(entry->rx_pn, fw_ap->rx_pn, sizeof(entry->rx_pn));
1056 memcpy(entry->tx_pn, fw_ap->tx_pn, sizeof(entry->tx_pn));
1057 return;
1058 }
1059 }
1060
iwl_mvm_ftm_get_range_resp_ver(struct iwl_mvm * mvm)1061 static u8 iwl_mvm_ftm_get_range_resp_ver(struct iwl_mvm *mvm)
1062 {
1063 if (!fw_has_api(&mvm->fw->ucode_capa,
1064 IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ))
1065 return 5;
1066
1067 /* Starting from version 8, the FW advertises the version */
1068 if (mvm->cmd_ver.range_resp >= 8)
1069 return mvm->cmd_ver.range_resp;
1070 else if (fw_has_api(&mvm->fw->ucode_capa,
1071 IWL_UCODE_TLV_API_FTM_RTT_ACCURACY))
1072 return 7;
1073
1074 /* The first version of the new range request API */
1075 return 6;
1076 }
1077
iwl_mvm_ftm_resp_size_validation(u8 ver,unsigned int pkt_len)1078 static bool iwl_mvm_ftm_resp_size_validation(u8 ver, unsigned int pkt_len)
1079 {
1080 switch (ver) {
1081 case 8:
1082 return pkt_len == sizeof(struct iwl_tof_range_rsp_ntfy_v8);
1083 case 7:
1084 return pkt_len == sizeof(struct iwl_tof_range_rsp_ntfy_v7);
1085 case 6:
1086 return pkt_len == sizeof(struct iwl_tof_range_rsp_ntfy_v6);
1087 case 5:
1088 return pkt_len == sizeof(struct iwl_tof_range_rsp_ntfy_v5);
1089 default:
1090 WARN_ONCE(1, "FTM: unsupported range response version %u", ver);
1091 return false;
1092 }
1093 }
1094
iwl_mvm_ftm_range_resp(struct iwl_mvm * mvm,struct iwl_rx_cmd_buffer * rxb)1095 void iwl_mvm_ftm_range_resp(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
1096 {
1097 struct iwl_rx_packet *pkt = rxb_addr(rxb);
1098 unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);
1099 struct iwl_tof_range_rsp_ntfy_v5 *fw_resp_v5 = (void *)pkt->data;
1100 struct iwl_tof_range_rsp_ntfy_v6 *fw_resp_v6 = (void *)pkt->data;
1101 struct iwl_tof_range_rsp_ntfy_v7 *fw_resp_v7 = (void *)pkt->data;
1102 struct iwl_tof_range_rsp_ntfy_v8 *fw_resp_v8 = (void *)pkt->data;
1103 int i;
1104 bool new_api = fw_has_api(&mvm->fw->ucode_capa,
1105 IWL_UCODE_TLV_API_FTM_NEW_RANGE_REQ);
1106 u8 num_of_aps, last_in_batch;
1107 u8 notif_ver = iwl_mvm_ftm_get_range_resp_ver(mvm);
1108
1109 lockdep_assert_held(&mvm->mutex);
1110
1111 if (!mvm->ftm_initiator.req) {
1112 return;
1113 }
1114
1115 if (unlikely(!iwl_mvm_ftm_resp_size_validation(notif_ver, pkt_len)))
1116 return;
1117
1118 if (new_api) {
1119 if (iwl_mvm_ftm_range_resp_valid(mvm, fw_resp_v8->request_id,
1120 fw_resp_v8->num_of_aps))
1121 return;
1122
1123 num_of_aps = fw_resp_v8->num_of_aps;
1124 last_in_batch = fw_resp_v8->last_report;
1125 } else {
1126 if (iwl_mvm_ftm_range_resp_valid(mvm, fw_resp_v5->request_id,
1127 fw_resp_v5->num_of_aps))
1128 return;
1129
1130 num_of_aps = fw_resp_v5->num_of_aps;
1131 last_in_batch = fw_resp_v5->last_in_batch;
1132 }
1133
1134 IWL_DEBUG_INFO(mvm, "Range response received\n");
1135 IWL_DEBUG_INFO(mvm, "request id: %lld, num of entries: %hhu\n",
1136 mvm->ftm_initiator.req->cookie, num_of_aps);
1137
1138 for (i = 0; i < num_of_aps && i < IWL_MVM_TOF_MAX_APS; i++) {
1139 struct cfg80211_pmsr_result result = {};
1140 struct iwl_tof_range_rsp_ap_entry_ntfy_v6 *fw_ap;
1141 int peer_idx;
1142
1143 if (new_api) {
1144 if (notif_ver == 8) {
1145 fw_ap = &fw_resp_v8->ap[i];
1146 iwl_mvm_ftm_pasn_update_pn(mvm, fw_ap);
1147 } else if (notif_ver == 7) {
1148 fw_ap = (void *)&fw_resp_v7->ap[i];
1149 } else {
1150 fw_ap = (void *)&fw_resp_v6->ap[i];
1151 }
1152
1153 result.final = fw_ap->last_burst;
1154 result.ap_tsf = le32_to_cpu(fw_ap->start_tsf);
1155 result.ap_tsf_valid = 1;
1156 } else {
1157 /* the first part is the same for old and new APIs */
1158 fw_ap = (void *)&fw_resp_v5->ap[i];
1159 /*
1160 * FIXME: the firmware needs to report this, we don't
1161 * even know the number of bursts the responder picked
1162 * (if we asked it to)
1163 */
1164 result.final = 0;
1165 }
1166
1167 peer_idx = iwl_mvm_ftm_find_peer(mvm->ftm_initiator.req,
1168 fw_ap->bssid);
1169 if (peer_idx < 0) {
1170 IWL_WARN(mvm,
1171 "Unknown address (%pM, target #%d) in FTM response\n",
1172 fw_ap->bssid, i);
1173 continue;
1174 }
1175
1176 switch (fw_ap->measure_status) {
1177 case IWL_TOF_ENTRY_SUCCESS:
1178 result.status = NL80211_PMSR_STATUS_SUCCESS;
1179 break;
1180 case IWL_TOF_ENTRY_TIMING_MEASURE_TIMEOUT:
1181 result.status = NL80211_PMSR_STATUS_TIMEOUT;
1182 break;
1183 case IWL_TOF_ENTRY_NO_RESPONSE:
1184 result.status = NL80211_PMSR_STATUS_FAILURE;
1185 result.ftm.failure_reason =
1186 NL80211_PMSR_FTM_FAILURE_NO_RESPONSE;
1187 break;
1188 case IWL_TOF_ENTRY_REQUEST_REJECTED:
1189 result.status = NL80211_PMSR_STATUS_FAILURE;
1190 result.ftm.failure_reason =
1191 NL80211_PMSR_FTM_FAILURE_PEER_BUSY;
1192 result.ftm.busy_retry_time = fw_ap->refusal_period;
1193 break;
1194 default:
1195 result.status = NL80211_PMSR_STATUS_FAILURE;
1196 result.ftm.failure_reason =
1197 NL80211_PMSR_FTM_FAILURE_UNSPECIFIED;
1198 break;
1199 }
1200 memcpy(result.addr, fw_ap->bssid, ETH_ALEN);
1201 result.host_time = iwl_mvm_ftm_get_host_time(mvm,
1202 fw_ap->timestamp);
1203 result.type = NL80211_PMSR_TYPE_FTM;
1204 result.ftm.burst_index = mvm->ftm_initiator.responses[peer_idx];
1205 mvm->ftm_initiator.responses[peer_idx]++;
1206 result.ftm.rssi_avg = fw_ap->rssi;
1207 result.ftm.rssi_avg_valid = 1;
1208 result.ftm.rssi_spread = fw_ap->rssi_spread;
1209 result.ftm.rssi_spread_valid = 1;
1210 result.ftm.rtt_avg = (s32)le32_to_cpu(fw_ap->rtt);
1211 result.ftm.rtt_avg_valid = 1;
1212 result.ftm.rtt_variance = le32_to_cpu(fw_ap->rtt_variance);
1213 result.ftm.rtt_variance_valid = 1;
1214 result.ftm.rtt_spread = le32_to_cpu(fw_ap->rtt_spread);
1215 result.ftm.rtt_spread_valid = 1;
1216
1217 iwl_mvm_ftm_get_lci_civic(mvm, &result);
1218
1219 iwl_mvm_ftm_rtt_smoothing(mvm, &result);
1220
1221 cfg80211_pmsr_report(mvm->ftm_initiator.req_wdev,
1222 mvm->ftm_initiator.req,
1223 &result, GFP_KERNEL);
1224
1225 if (fw_has_api(&mvm->fw->ucode_capa,
1226 IWL_UCODE_TLV_API_FTM_RTT_ACCURACY))
1227 IWL_DEBUG_INFO(mvm, "RTT confidence: %hhu\n",
1228 fw_ap->rttConfidence);
1229
1230 iwl_mvm_debug_range_resp(mvm, i, &result);
1231 }
1232
1233 if (last_in_batch) {
1234 cfg80211_pmsr_complete(mvm->ftm_initiator.req_wdev,
1235 mvm->ftm_initiator.req,
1236 GFP_KERNEL);
1237 iwl_mvm_ftm_reset(mvm);
1238 }
1239 }
1240
iwl_mvm_ftm_lc_notif(struct iwl_mvm * mvm,struct iwl_rx_cmd_buffer * rxb)1241 void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
1242 {
1243 struct iwl_rx_packet *pkt = rxb_addr(rxb);
1244 const struct ieee80211_mgmt *mgmt = (void *)pkt->data;
1245 size_t len = iwl_rx_packet_payload_len(pkt);
1246 struct iwl_mvm_loc_entry *entry;
1247 const u8 *ies, *lci, *civic, *msr_ie;
1248 size_t ies_len, lci_len = 0, civic_len = 0;
1249 size_t baselen = IEEE80211_MIN_ACTION_SIZE +
1250 sizeof(mgmt->u.action.u.ftm);
1251 static const u8 rprt_type_lci = IEEE80211_SPCT_MSR_RPRT_TYPE_LCI;
1252 static const u8 rprt_type_civic = IEEE80211_SPCT_MSR_RPRT_TYPE_CIVIC;
1253
1254 if (len <= baselen)
1255 return;
1256
1257 lockdep_assert_held(&mvm->mutex);
1258
1259 ies = mgmt->u.action.u.ftm.variable;
1260 ies_len = len - baselen;
1261
1262 msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
1263 &rprt_type_lci, 1, 4);
1264 if (msr_ie) {
1265 lci = msr_ie + 2;
1266 lci_len = msr_ie[1];
1267 }
1268
1269 msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
1270 &rprt_type_civic, 1, 4);
1271 if (msr_ie) {
1272 civic = msr_ie + 2;
1273 civic_len = msr_ie[1];
1274 }
1275
1276 entry = kmalloc(sizeof(*entry) + lci_len + civic_len, GFP_KERNEL);
1277 if (!entry)
1278 return;
1279
1280 memcpy(entry->addr, mgmt->bssid, ETH_ALEN);
1281
1282 entry->lci_len = lci_len;
1283 if (lci_len)
1284 memcpy(entry->buf, lci, lci_len);
1285
1286 entry->civic_len = civic_len;
1287 if (civic_len)
1288 memcpy(entry->buf + lci_len, civic, civic_len);
1289
1290 list_add_tail(&entry->list, &mvm->ftm_initiator.loc_list);
1291 }
1292