wifi: cfg80211: derive S1G beacon TSF from S1G fields

cfg80211_inform_bss_frame_data() parses S1G beacons with the extension
frame layout, but still reads the TSF from the regular probe response
layout after the S1G branch. For S1G beacons that reads bytes at the
regular management-frame timestamp offset instead of the S1G timestamp.

Use the 32-bit S1G beacon timestamp and the S1G Beacon Compatibility
element's TSF completion field when informing an S1G BSS. Keep the
regular management-frame timestamp read in the non-S1G branch.

Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results")
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Tested-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Reviewed-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Link: https://patch.msgid.link/20260611161943.91069-6-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e1c09040a5c81a5b8a37349e5f7d38d0441c40ca..5c97b5bd5d69c4e4297cdea3f2ceab633d24ad9d 100644 (file)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -3314,14 +3314,15 @@ cfg80211_inform_bss_frame_data(struct wiphy *wiphy,
                bssid = ext->u.s1g_beacon.sa;
                capability = le16_to_cpu(compat->compat_info);
                beacon_interval = le16_to_cpu(compat->beacon_int);
+               tsf = le32_to_cpu(ext->u.s1g_beacon.timestamp);
+               tsf |= (u64)le32_to_cpu(compat->tsf_completion) << 32;
        } else {
                bssid = mgmt->bssid;
                beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
                capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
+               tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
        }
 
-       tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
-
        if (ieee80211_is_probe_resp(mgmt->frame_control))
                ftype = CFG80211_BSS_FTYPE_PRESP;
        else if (ext)