mlme.c 133.2 KB
Newer Older
1 2
/*
 * BSS client mode implementation
3
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
4 5 6 7
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
8
 * Copyright 2013-2014  Intel Mobile Communications GmbH
9 10 11 12 13 14
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

15
#include <linux/delay.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/pm_qos.h>
23
#include <linux/crc32.h>
24
#include <linux/slab.h>
25
#include <linux/export.h>
26
#include <net/mac80211.h>
27
#include <asm/unaligned.h>
J
Johannes Berg 已提交
28

29
#include "ieee80211_i.h"
30
#include "driver-ops.h"
J
Johannes Berg 已提交
31 32
#include "rate.h"
#include "led.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36 37 38 39
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
40
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
41 42
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
43

44 45 46 47 48 49 50 51 52
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
53 54

/*
55 56 57 58 59 60
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
61
 */
62 63 64 65
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
66

J
Johannes Berg 已提交
67 68 69 70
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
71
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
72 73 74 75 76
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
77 78 79 80 81
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
82

83 84 85 86 87 88 89
/*
 * Weight given to the latest Beacon frame when calculating average signal
 * strength for Beacon frames received in the current BSS. This must be
 * between 1 and 15.
 */
#define IEEE80211_SIGNAL_AVE_WEIGHT	3

90 91 92 93 94 95
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
96 97 98 99 100 101 102 103 104 105
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
106 107
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
108
{
109
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
110

111 112 113
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
114 115
}

116
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
117
{
118
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
119 120
		return;

121 122 123
	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
		return;

J
Johannes Berg 已提交
124
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
125
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
126 127
}

128 129
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
130 131
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

132 133 134
	if (unlikely(!sdata->u.mgd.associated))
		return;

135 136
	ifmgd->probe_send_count = 0;

137 138 139 140 141 142 143
	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
		return;

	mod_timer(&sdata->u.mgd.conn_mon_timer,
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

144
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
145
{
146
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
147 148
}

149 150 151 152
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
153
			     const struct ieee80211_ht_cap *ht_cap,
154 155
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
156
			     struct cfg80211_chan_def *chandef, bool tracking)
157
{
158
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
159 160 161 162 163 164 165 166
	struct cfg80211_chan_def vht_chandef;
	u32 ht_cfreq, ret;

	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
	chandef->center_freq2 = 0;

167
	if (!ht_cap || !ht_oper || !sband->ht_cap.ht_supported) {
168 169 170 171 172 173
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

174 175
	if (!(ht_cap->cap_info &
	      cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
176
		ret = IEEE80211_STA_DISABLE_40MHZ;
177 178 179
		goto out;
	}

180 181 182
	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
183
	if (!tracking && channel->center_freq != ht_cfreq) {
184 185 186 187 188 189 190
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
191 192 193 194
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213
		ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	/* check 40 MHz support, if we have it */
	if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
		switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
		case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 += 10;
			break;
		case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
			chandef->width = NL80211_CHAN_WIDTH_40;
			chandef->center_freq1 -= 10;
			break;
		}
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
214 215
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	vht_chandef.chan = channel;
	vht_chandef.center_freq1 =
		ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
					       channel->band);
	vht_chandef.center_freq2 = 0;

	switch (vht_oper->chan_width) {
	case IEEE80211_VHT_CHANWIDTH_USE_HT:
		vht_chandef.width = chandef->width;
233
		vht_chandef.center_freq1 = chandef->center_freq1;
234 235 236 237 238 239 240 241 242
		break;
	case IEEE80211_VHT_CHANWIDTH_80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80;
		break;
	case IEEE80211_VHT_CHANWIDTH_160MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_160;
		break;
	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
243 244 245 246
		vht_chandef.center_freq2 =
			ieee80211_channel_to_frequency(
				vht_oper->center_freq_seg2_idx,
				channel->band);
247 248
		break;
	default:
249
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
250 251 252
			sdata_info(sdata,
				   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
				   vht_oper->chan_width);
253 254 255 256 257
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
258
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
259 260
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
261 262 263 264 265 266 267 268 269 270
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
271
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
272 273
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
274 275 276 277 278 279 280 281 282
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

305 306 307 308
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

309 310 311 312 313 314 315 316
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
317
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
318 319
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
320 321 322
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
			      IEEE80211_STA_DISABLE_VHT;
323
			break;
324 325
		}

326
		ret |= ieee80211_chandef_downgrade(chandef);
327 328
	}

329
	if (chandef->width != vht_chandef.width && !tracking)
330 331 332 333 334 335 336
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

337 338
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
339
			       const struct ieee80211_ht_cap *ht_cap,
340 341 342
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
			       const u8 *bssid, u32 *changed)
343 344
{
	struct ieee80211_local *local = sdata->local;
345
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
346
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
347
	struct ieee80211_channel *chan;
348
	struct cfg80211_chan_def chandef;
349
	u16 ht_opmode;
350 351 352
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
353

354 355
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
356 357
		return 0;

358 359 360 361 362 363 364
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

365 366 367 368 369 370 371 372 373 374
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

375
	chan = sdata->vif.bss_conf.chandef.chan;
J
Johannes Berg 已提交
376
	sband = local->hw.wiphy->bands[chan->band];
377

378
	/* calculate new channel (type) based on HT/VHT operation IEs */
379 380 381
	flags = ieee80211_determine_chantype(sdata, sband, chan,
					     ht_cap, ht_oper, vht_oper,
					     &chandef, true);
382 383 384 385 386 387 388 389 390 391

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
392
		flags |= ieee80211_chandef_downgrade(&chandef);
393 394
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
395
		flags |= ieee80211_chandef_downgrade(&chandef);
396 397
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
398
		flags |= ieee80211_chandef_downgrade(&chandef);
399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
		   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
		   chandef.center_freq1, chandef.center_freq2);

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
425
	case NL80211_CHAN_WIDTH_40:
426
		new_sta_bw = IEEE80211_STA_RX_BW_40;
427
		break;
428 429 430 431 432 433
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
434
		break;
435 436
	default:
		return -EINVAL;
437
	}
438

439 440
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
441

442 443 444 445 446
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
447

448 449 450 451 452 453 454
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
455

456 457 458 459
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
460
	}
461

462
	return 0;
463 464
}

J
Johannes Berg 已提交
465 466
/* frame sending functions */

J
Johannes Berg 已提交
467
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
468
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

486
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
487 488 489 490 491 492 493 494 495 496 497 498 499 500
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

501 502 503 504 505 506 507 508 509 510
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

536 537
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
538 539
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
540 541 542 543
{
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
544
	u32 mask, ap_bf_sts, our_bf_sts;
545 546 547 548

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
549
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
550 551 552 553

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
554 555 556 557 558 559 560 561 562 563
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
		cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
	}

564 565 566 567 568 569 570 571
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;

572 573 574 575 576 577 578 579 580 581
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

582
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
583
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
584 585 586
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

J
Johannes Berg 已提交
587 588 589 590 591 592 593 594 595
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
	u8 *pos, qos_info;
	size_t offset = 0, noffset;
596
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
597 598
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
599 600
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
601
	u32 rate_flags, rates = 0;
J
Johannes Berg 已提交
602

603
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
604

J
Johannes Berg 已提交
605 606 607 608 609 610
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
611
	chan = chanctx_conf->def.chan;
612
	rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
J
Johannes Berg 已提交
613 614
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
615
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
616 617 618 619 620 621 622 623

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
624 625 626 627
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
628 629 630 631 632 633
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
634 635 636 637 638 639 640 641
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			if ((rate_flags & sband->bitrates[i].flags)
			    != rate_flags)
				continue;
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
642 643 644 645 646 647 648 649 650
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
651
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
J
Johannes Berg 已提交
652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675
			assoc_data->ie_len + /* extra IEs */
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

	if (sband->band == IEEE80211_BAND_2GHZ) {
		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
			capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
			capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
	    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

676 677 678
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

J
Johannes Berg 已提交
679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720
	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(mgmt, 0, 24);
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
721 722 723
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
724 725 726 727 728 729 730 731 732 733 734 735
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
736 737 738 739
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
740 741 742 743
			}
		}
	}

744 745
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
746 747 748 749
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
750 751
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
752
	}
J
Johannes Berg 已提交
753

754
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
J
Johannes Berg 已提交
755 756 757 758 759 760 761 762 763 764 765 766
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

	/* if present, add any custom IEs that go before HT */
767
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_ht, ARRAY_SIZE(before_ht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

J
Johannes Berg 已提交
788 789 790 791
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

792
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
793
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
794
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
795

796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
		};
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

824
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
825 826
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
827

J
Johannes Berg 已提交
828
	/* if present, add any custom non-vendor IEs that go after HT */
829
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
830 831 832 833 834 835 836 837
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

838 839
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
840 841
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
842 843 844 845 846
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

847
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
848 849 850
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
851
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
852 853 854 855 856
		noffset = assoc_data->ie_len;
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
	}

J
Johannes Berg 已提交
857 858
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
859
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
860 861 862
	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
863 864 865
	ieee80211_tx_skb(sdata, skb);
}

866 867 868 869 870 871
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

872 873
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
874 875
		return;

876 877
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
878

879 880
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
881 882
}

883 884 885 886 887
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
			     int powersave)
{
	struct sk_buff *skb;
888
	struct ieee80211_hdr_3addr *nullfunc;
889
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
890

891 892
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
	if (!skb)
893 894
		return;

895
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
896
	if (powersave)
897
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
898

899 900
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
901 902 903 904

	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

905
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
906 907
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

908
	ieee80211_tx_skb(sdata, skb);
909 910
}

911 912 913 914 915 916 917 918 919 920 921
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
922
	if (!skb)
923
		return;
924

925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
	memset(nullfunc, 0, 30);
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

941 942 943 944 945
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
946
	struct ieee80211_local *local = sdata->local;
947
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
948
	int ret;
949

950
	if (!ieee80211_sdata_running(sdata))
951 952
		return;

953
	sdata_lock(sdata);
954 955 956
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

957 958
	if (!ifmgd->associated)
		goto out;
959

960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
994
		sdata_info(sdata,
995
			   "failed to finalize channel switch, disconnecting\n");
996 997 998 999
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1000

1001
	/* XXX: shouldn't really modify cfg80211-owned data! */
1002
	ifmgd->associated->channel = sdata->csa_chandef.chan;
1003

1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1024

1025 1026 1027 1028 1029
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1030

1031 1032 1033
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1034 1035 1036 1037 1038 1039
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1040
		return;
1041
	}
1042 1043
}

1044 1045
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1046 1047
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1048 1049 1050

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1051 1052 1053 1054 1055 1056
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1057 1058 1059 1060
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1061 1062 1063 1064
static void ieee80211_chswitch_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
1065

1066
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1067 1068
}

1069
static void
J
Johannes Berg 已提交
1070
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1071 1072
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1073
				 bool beacon)
1074
{
1075
	struct ieee80211_local *local = sdata->local;
1076
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1077
	struct cfg80211_bss *cbss = ifmgd->associated;
1078
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1079
	struct ieee80211_chanctx *chanctx;
1080
	enum ieee80211_band current_band;
1081
	struct ieee80211_csa_ie csa_ie;
1082
	struct ieee80211_channel_switch ch_switch;
1083
	int res;
1084

1085
	sdata_assert_lock(sdata);
1086

1087
	if (!cbss)
1088 1089
		return;

1090
	if (local->scanning)
1091 1092
		return;

1093
	/* disregard subsequent announcements if we are already processing */
1094
	if (sdata->vif.csa_active)
1095 1096
		return;

1097
	current_band = cbss->channel->band;
1098
	memset(&csa_ie, 0, sizeof(csa_ie));
1099 1100
	res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
					   ifmgd->flags,
1101
					   ifmgd->associated->bssid, &csa_ie);
1102
	if (res	< 0)
1103
		ieee80211_queue_work(&local->hw,
1104
				     &ifmgd->csa_connection_drop_work);
1105
	if (res)
1106
		return;
1107

1108
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1109 1110 1111
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
1112
			   ifmgd->associated->bssid,
1113 1114 1115
			   csa_ie.chandef.chan->center_freq,
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
			   csa_ie.chandef.center_freq2);
1116 1117 1118 1119 1120
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1121
	mutex_lock(&local->mtx);
1122
	mutex_lock(&local->chanctx_mtx);
1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		mutex_unlock(&local->chanctx_mtx);
		mutex_unlock(&local->mtx);
		return;
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1137
	if (local->use_chanctx) {
1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148
		u32 num_chanctx = 0;
		list_for_each_entry(chanctx, &local->chanctx_list, list)
		       num_chanctx++;

		if (num_chanctx > 1 ||
		    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
			sdata_info(sdata,
				   "not handling chan-switch with channel contexts\n");
			ieee80211_queue_work(&local->hw,
					     &ifmgd->csa_connection_drop_work);
			mutex_unlock(&local->chanctx_mtx);
1149
			mutex_unlock(&local->mtx);
1150 1151
			return;
		}
J
Johannes Berg 已提交
1152 1153
	}

1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169
	ch_switch.timestamp = timestamp;
	ch_switch.device_timestamp = device_timestamp;
	ch_switch.block_tx = csa_ie.mode;
	ch_switch.chandef = csa_ie.chandef;
	ch_switch.count = csa_ie.count;

	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		mutex_unlock(&local->chanctx_mtx);
		mutex_unlock(&local->mtx);
		return;
	}

1170 1171 1172
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1173
		sdata_info(sdata,
1174 1175
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1176
		ieee80211_queue_work(&local->hw,
J
Johannes Berg 已提交
1177
				     &ifmgd->csa_connection_drop_work);
1178
		mutex_unlock(&local->chanctx_mtx);
1179
		mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
1180 1181
		return;
	}
1182
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1183

1184
	sdata->vif.csa_active = true;
1185
	sdata->csa_chandef = csa_ie.chandef;
1186
	sdata->csa_block_tx = csa_ie.mode;
J
Johannes Berg 已提交
1187

1188
	if (sdata->csa_block_tx)
1189 1190
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1191
	mutex_unlock(&local->mtx);
1192

1193
	if (local->ops->channel_switch) {
1194
		/* use driver's channel switch callback */
1195
		drv_channel_switch(local, &ch_switch);
1196 1197 1198 1199
		return;
	}

	/* channel switch handled in software */
1200
	if (csa_ie.count <= 1)
1201
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1202
	else
1203
		mod_timer(&ifmgd->chswitch_timer,
1204
			  TU_TO_EXP_TIME(csa_ie.count * cbss->beacon_interval));
1205 1206
}

1207 1208 1209 1210 1211 1212
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1213
{
1214 1215
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1216
	int i, chan_increment;
1217
	bool have_chan_pwr = false;
1218

1219 1220
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1221
		return false;
1222

1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
	case IEEE80211_BAND_2GHZ:
	case IEEE80211_BAND_60GHZ:
		chan_increment = 1;
		break;
	case IEEE80211_BAND_5GHZ:
		chan_increment = 4;
		break;
1237
	}
1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1249
				*chan_pwr = triplet->chans.max_power;
1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1261 1262 1263 1264 1265
	if (have_chan_pwr)
		*pwr_reduction = *pwr_constr_elem;
	return have_chan_pwr;
}

1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1280 1281 1282 1283
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1284 1285
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1286
{
1287 1288 1289
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1290
	int new_ap_level;
1291

1292 1293 1294 1295 1296 1297
	if (country_ie && pwr_constr_ie &&
	    mgmt->u.probe_resp.capab_info &
		cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT)) {
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1298 1299 1300 1301 1302 1303 1304 1305
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1306
	}
1307

1308
	if (!has_80211h_pwr && !has_cisco_pwr)
1309
		return 0;
1310

1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
		sdata_info(sdata,
			   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			   pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			   sdata->u.mgd.bssid);
		new_ap_level = pwr_level_80211h;
	} else {  /* has_cisco_pwr is always true here. */
		sdata_info(sdata,
			   "Limiting TX power to %d dBm as advertised by %pM\n",
			   pwr_level_cisco, sdata->u.mgd.bssid);
		new_ap_level = pwr_level_cisco;
	}
1327

1328 1329
	if (sdata->ap_power_level == new_ap_level)
		return 0;
1330

1331 1332 1333 1334
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1335 1336
}

1337 1338 1339 1340 1341 1342
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1343 1344 1345 1346
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1347
	if (local->scanning)
J
Johannes Berg 已提交
1348 1349
		return;

1350 1351 1352 1353 1354 1355 1356
	if (conf->dynamic_ps_timeout > 0 &&
	    !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
		if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
			ieee80211_send_nullfunc(local, sdata, 1);
1357

1358 1359 1360 1361 1362 1363
		if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
		    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1381 1382 1383 1384
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1385
	bool authorized = false;
1386 1387 1388 1389

	if (!mgd->powersave)
		return false;

1390 1391 1392
	if (mgd->broken_ap)
		return false;

1393 1394 1395
	if (!mgd->associated)
		return false;

1396
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1397 1398
		return false;

1399
	if (!mgd->have_beacon)
1400 1401
		return false;

1402 1403 1404
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1405
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1406 1407
	rcu_read_unlock();

J
Johannes Berg 已提交
1408
	return authorized;
1409 1410
}

1411
/* need to hold RTNL or interface lock */
1412
void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1413 1414 1415
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1416
	int timeout;
1417 1418 1419 1420 1421 1422 1423

	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1424
		if (!ieee80211_sdata_running(sdata))
1425
			continue;
1426 1427 1428 1429 1430 1431 1432 1433
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1434 1435 1436 1437 1438 1439
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1440
	if (count == 1 && ieee80211_powersave_allowed(found)) {
1441 1442 1443
		s32 beaconint_us;

		if (latency < 0)
M
Mark Gross 已提交
1444
			latency = pm_qos_request(PM_QOS_NETWORK_LATENCY);
1445 1446 1447 1448

		beaconint_us = ieee80211_tu_to_usec(
					found->vif.bss_conf.beacon_int);

1449
		timeout = local->dynamic_ps_forced_timeout;
1450 1451
		if (timeout < 0) {
			/*
1452 1453
			 * Go to full PSM if the user configures a very low
			 * latency requirement.
1454 1455 1456
			 * The 2000 second value is there for compatibility
			 * until the PM_QOS_NETWORK_LATENCY is configured
			 * with real values.
1457
			 */
1458 1459
			if (latency > (1900 * USEC_PER_MSEC) &&
			    latency != (2000 * USEC_PER_SEC))
1460
				timeout = 0;
1461 1462
			else
				timeout = 100;
1463
		}
1464
		local->hw.conf.dynamic_ps_timeout = timeout;
1465

1466
		if (beaconint_us > latency) {
1467
			local->ps_sdata = NULL;
1468 1469
		} else {
			int maxslp = 1;
1470
			u8 dtimper = found->u.mgd.dtim_period;
1471 1472 1473 1474 1475

			/* If the TIM IE is invalid, pretend the value is 1 */
			if (!dtimper)
				dtimper = 1;
			else if (dtimper > 1)
1476 1477 1478
				maxslp = min_t(int, dtimper,
						    latency / beaconint_us);

1479
			local->hw.conf.max_sleep_period = maxslp;
1480
			local->hw.conf.ps_dtim_period = dtimper;
1481
			local->ps_sdata = found;
1482
		}
1483
	} else {
1484
		local->ps_sdata = NULL;
1485
	}
1486 1487 1488 1489

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1490 1491 1492 1493 1494 1495 1496 1497 1498 1499
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1512
					IEEE80211_MAX_QUEUE_MAP,
1513 1514
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1515 1516 1517 1518 1519 1520 1521 1522
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1523
	struct ieee80211_if_managed *ifmgd;
1524 1525
	unsigned long flags;
	int q;
1526 1527 1528 1529 1530

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1531 1532
	ifmgd = &sdata->u.mgd;

1533 1534 1535
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1536
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1537 1538
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1539 1540 1541 1542 1543
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1562 1563
	}

1564
	if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
1565
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1566
		if (drv_tx_frames_pending(local)) {
1567 1568 1569
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1570
		} else {
1571 1572
			ieee80211_send_nullfunc(local, sdata, 1);
			/* Flush to get the tx status of nullfunc frame */
1573
			ieee80211_flush_queues(local, sdata);
1574
		}
1575 1576
	}

1577 1578
	if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
	      (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
1579 1580 1581 1582 1583
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1584 1585 1586 1587 1588 1589
}

void ieee80211_dynamic_ps_timer(unsigned long data)
{
	struct ieee80211_local *local = (void *) data;

1590
	if (local->quiescing || local->suspended)
1591 1592
		return;

1593
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1594 1595
}

1596 1597 1598 1599 1600 1601 1602
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
	struct delayed_work *delayed_work =
		container_of(work, struct delayed_work, work);
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1603
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1604

1605 1606 1607 1608 1609 1610 1611 1612
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1613 1614
}

J
Johannes Berg 已提交
1615
/* MLME */
1616
static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
1617
				     struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
1618
				     const u8 *wmm_param, size_t wmm_param_len)
1619 1620
{
	struct ieee80211_tx_queue_params params;
1621
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1622 1623
	size_t left;
	int count;
J
Johannes Berg 已提交
1624 1625
	const u8 *pos;
	u8 uapsd_queues = 0;
1626

1627
	if (!local->ops->conf_tx)
1628
		return false;
1629

J
Johannes Berg 已提交
1630
	if (local->hw.queues < IEEE80211_NUM_ACS)
1631
		return false;
1632 1633

	if (!wmm_param)
1634
		return false;
1635

1636
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1637
		return false;
K
Kalle Valo 已提交
1638 1639

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1640
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1641

1642
	count = wmm_param[6] & 0x0f;
1643
	if (count == ifmgd->wmm_last_param_set)
1644
		return false;
1645
	ifmgd->wmm_last_param_set = count;
1646 1647 1648 1649 1650 1651

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
1652
	sdata->wmm_acm = 0;
1653 1654 1655
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
1656
		bool uapsd = false;
1657 1658 1659
		int queue;

		switch (aci) {
1660
		case 1: /* AC_BK */
J
Johannes Berg 已提交
1661
			queue = 3;
J
Johannes Berg 已提交
1662
			if (acm)
Y
Yoni Divinsky 已提交
1663
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
1664 1665
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
1666
			break;
1667
		case 2: /* AC_VI */
J
Johannes Berg 已提交
1668
			queue = 1;
J
Johannes Berg 已提交
1669
			if (acm)
Y
Yoni Divinsky 已提交
1670
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
1671 1672
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
1673
			break;
1674
		case 3: /* AC_VO */
J
Johannes Berg 已提交
1675
			queue = 0;
J
Johannes Berg 已提交
1676
			if (acm)
Y
Yoni Divinsky 已提交
1677
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
1678 1679
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
1680
			break;
1681
		case 0: /* AC_BE */
1682
		default:
J
Johannes Berg 已提交
1683
			queue = 2;
J
Johannes Berg 已提交
1684
			if (acm)
Y
Yoni Divinsky 已提交
1685
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
1686 1687
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
1688 1689 1690 1691 1692 1693
			break;
		}

		params.aifs = pos[0] & 0x0f;
		params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params.cw_min = ecw2cw(pos[1] & 0x0f);
1694
		params.txop = get_unaligned_le16(pos + 2);
1695
		params.acm = acm;
K
Kalle Valo 已提交
1696 1697
		params.uapsd = uapsd;

J
Johannes Berg 已提交
1698 1699 1700 1701 1702
		mlme_dbg(sdata,
			 "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
			 queue, aci, acm,
			 params.aifs, params.cw_min, params.cw_max,
			 params.txop, params.uapsd);
1703 1704
		sdata->tx_conf[queue] = params;
		if (drv_conf_tx(local, sdata, queue, &params))
J
Johannes Berg 已提交
1705 1706 1707
			sdata_err(sdata,
				  "failed to set TX queue parameters for queue %d\n",
				  queue);
1708
	}
1709 1710

	/* enable WMM or activate new settings */
1711
	sdata->vif.bss_conf.qos = true;
1712
	return true;
1713 1714
}

1715 1716 1717 1718
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

1719
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
1720 1721 1722 1723 1724 1725 1726 1727 1728 1729
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
1730 1731
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
1732
{
J
Johannes Berg 已提交
1733
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1734
	u32 changed = 0;
J
Johannes Berg 已提交
1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
J
Johannes Berg 已提交
1748
	if (ieee80211_get_sdata_band(sdata) == IEEE80211_BAND_5GHZ)
1749
		use_short_slot = true;
1750

1751 1752 1753
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
1754
	}
1755

1756 1757
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
1758
		changed |= BSS_CHANGED_ERP_PREAMBLE;
1759
	}
1760

J
Johannes Berg 已提交
1761 1762 1763
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
1764 1765 1766 1767 1768
	}

	return changed;
}

1769
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1770
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
1771
				     u32 bss_info_changed)
1772
{
1773
	struct ieee80211_bss *bss = (void *)cbss->priv;
1774
	struct ieee80211_local *local = sdata->local;
1775
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
1776

J
Johannes Berg 已提交
1777
	bss_info_changed |= BSS_CHANGED_ASSOC;
1778
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
1779
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
1780

1781
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
1782
		beacon_loss_count * bss_conf->beacon_int));
1783

1784 1785
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
1786

1787 1788
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

1789
	if (sdata->vif.p2p) {
1790
		const struct cfg80211_bss_ies *ies;
1791

1792 1793 1794 1795 1796 1797 1798 1799
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
1800 1801
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
1802
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
1803 1804
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
1805 1806
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
1807
		}
1808
		rcu_read_unlock();
1809 1810
	}

J
Johannes Berg 已提交
1811
	/* just to be sure */
1812
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
1813

1814
	ieee80211_led_assoc(local, 1);
1815

1816
	if (sdata->u.mgd.have_beacon) {
1817 1818 1819 1820 1821 1822 1823
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1824
		bss_conf->beacon_rate = bss->beacon_rate;
1825
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
1826
	} else {
1827
		bss_conf->beacon_rate = NULL;
1828
		bss_conf->dtim_period = 0;
1829
	}
1830

1831
	bss_conf->assoc = 1;
1832

1833
	/* Tell the driver to monitor connection quality (if supported) */
1834
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
1835
	    bss_conf->cqm_rssi_thold)
1836 1837
		bss_info_changed |= BSS_CHANGED_CQM;

1838
	/* Enable ARP filtering */
1839
	if (bss_conf->arp_addr_cnt)
1840 1841
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
1842
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
1843

J
Johannes Berg 已提交
1844 1845 1846
	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, -1);
	mutex_unlock(&local->iflist_mtx);
1847

1848
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
1849 1850
	ieee80211_recalc_ps_vif(sdata);

1851
	netif_carrier_on(sdata->dev);
1852 1853
}

1854
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1855 1856
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
1857
{
1858
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1859
	struct ieee80211_local *local = sdata->local;
1860
	u32 changed = 0;
1861

1862
	sdata_assert_lock(sdata);
1863

1864 1865 1866
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
1867 1868 1869
	if (WARN_ON(!ifmgd->associated))
		return;

1870 1871
	ieee80211_stop_poll(sdata);

1872
	ifmgd->associated = NULL;
1873 1874
	netif_carrier_off(sdata->dev);

1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
1886 1887 1888
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

1889 1890
	/* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
	if (tx)
1891
		ieee80211_flush_queues(local, sdata);
1892

1893 1894
	/* deauthenticate/disassociate now */
	if (tx || frame_buf)
1895 1896
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
					       reason, tx, frame_buf);
1897 1898 1899

	/* flush out frame */
	if (tx)
1900
		ieee80211_flush_queues(local, sdata);
1901

1902 1903 1904
	/* clear bssid only after building the needed mgmt frames */
	memset(ifmgd->bssid, 0, ETH_ALEN);

1905
	/* remove AP and TDLS peers */
1906
	sta_info_flush(sdata);
1907 1908

	/* finally reset all BSS / config parameters */
1909 1910 1911
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
1912 1913
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
1914

J
Janusz Dziedzic 已提交
1915 1916 1917
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
1918

1919
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
1920 1921
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
1922 1923
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
1924

1925
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
1926

1927 1928 1929
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

1930
	/* Disable ARP filtering */
1931
	if (sdata->vif.bss_conf.arp_addr_cnt)
1932 1933
		changed |= BSS_CHANGED_ARP_FILTER;

1934 1935 1936
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

1937 1938
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
1939
	ieee80211_bss_info_change_notify(sdata, changed);
1940

1941 1942 1943
	/* disassociated - set to defaults now */
	ieee80211_set_wmm_default(sdata, false);

1944 1945 1946 1947
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
1948

1949
	sdata->vif.bss_conf.dtim_period = 0;
1950 1951
	sdata->vif.bss_conf.beacon_rate = NULL;

1952
	ifmgd->have_beacon = false;
1953

1954
	ifmgd->flags = 0;
1955
	mutex_lock(&local->mtx);
1956
	ieee80211_vif_release_channel(sdata);
1957 1958

	sdata->vif.csa_active = false;
1959
	ifmgd->csa_waiting_bcn = false;
1960 1961 1962 1963 1964
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1965
	mutex_unlock(&local->mtx);
1966 1967

	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
1968
}
1969

1970 1971 1972 1973 1974 1975 1976 1977
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
1978 1979
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
1980
	 */
J
Johannes Berg 已提交
1981 1982 1983
	if (is_multicast_ether_addr(hdr->addr1))
		return;

1984
	ieee80211_sta_reset_conn_monitor(sdata);
1985
}
1986

1987 1988 1989
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1990
	struct ieee80211_local *local = sdata->local;
1991

1992
	mutex_lock(&local->mtx);
1993 1994
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
1995

1996
	__ieee80211_stop_poll(sdata);
1997 1998 1999 2000

	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, -1);
	mutex_unlock(&local->iflist_mtx);
2001 2002

	if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
2003
		goto out;
2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2015 2016
out:
	mutex_unlock(&local->mtx);
2017 2018 2019
}

void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2020
			     struct ieee80211_hdr *hdr, bool ack)
2021
{
F
Felix Fietkau 已提交
2022
	if (!ieee80211_is_data(hdr->frame_control))
2023 2024 2025 2026
	    return;

	if (ieee80211_is_nullfunc(hdr->frame_control) &&
	    sdata->u.mgd.probe_send_count > 0) {
2027
		if (ack)
2028
			ieee80211_sta_reset_conn_monitor(sdata);
2029 2030
		else
			sdata->u.mgd.nullfunc_failed = true;
2031
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2032
		return;
2033
	}
2034 2035 2036

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2037 2038
}

2039 2040 2041 2042
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2043
	u8 *dst = ifmgd->associated->bssid;
2044
	u8 unicast_limit = max(1, max_probe_tries - 3);
2045 2046 2047 2048 2049 2050 2051 2052

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2053

2054 2055 2056 2057 2058 2059 2060
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2061 2062
	ifmgd->probe_send_count++;

2063 2064
	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
		ifmgd->nullfunc_failed = false;
2065
		ieee80211_send_nullfunc(sdata->local, sdata, 0);
2066
	} else {
2067 2068
		int ssid_len;

2069
		rcu_read_lock();
2070
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2071 2072 2073 2074 2075 2076
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

		ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
2077
					 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
2078
					 ifmgd->associated->channel, false);
2079
		rcu_read_unlock();
2080
	}
2081

2082
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2083
	run_again(sdata, ifmgd->probe_timeout);
2084
	if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
2085
		ieee80211_flush_queues(sdata->local, sdata);
2086 2087
}

J
Johannes Berg 已提交
2088 2089
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2090 2091
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2092
	bool already = false;
2093

2094
	if (!ieee80211_sdata_running(sdata))
2095 2096
		return;

2097
	sdata_lock(sdata);
2098 2099 2100 2101

	if (!ifmgd->associated)
		goto out;

2102 2103 2104 2105 2106 2107 2108
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2109
	if (beacon) {
J
Johannes Berg 已提交
2110
		mlme_dbg_ratelimited(sdata,
2111 2112
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2113

2114 2115 2116 2117
		ieee80211_cqm_rssi_notify(&sdata->vif,
					  NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
					  GFP_KERNEL);
	}
2118

J
Johannes Berg 已提交
2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2130
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2131 2132
		already = true;

E
Eliad Peller 已提交
2133 2134
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2135 2136
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2137 2138 2139
	if (already)
		goto out;

2140 2141 2142 2143
	mutex_lock(&sdata->local->iflist_mtx);
	ieee80211_recalc_ps(sdata->local, -1);
	mutex_unlock(&sdata->local->iflist_mtx);

2144 2145
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2146
 out:
2147
	sdata_unlock(sdata);
2148 2149
}

2150 2151 2152 2153 2154
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2155
	struct cfg80211_bss *cbss;
2156 2157
	struct sk_buff *skb;
	const u8 *ssid;
2158
	int ssid_len;
2159 2160 2161 2162

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2163
	sdata_assert_lock(sdata);
2164

2165 2166 2167 2168 2169 2170 2171
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2172 2173
		return NULL;

2174
	rcu_read_lock();
2175
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2176 2177 2178 2179 2180
	if (WARN_ON_ONCE(ssid == NULL))
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2181
	skb = ieee80211_build_probe_req(sdata, cbss->bssid,
J
Johannes Berg 已提交
2182
					(u32) -1, cbss->channel,
2183
					ssid + 2, ssid_len,
2184
					NULL, 0, true);
2185
	rcu_read_unlock();
2186 2187 2188 2189 2190

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2191
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2192
{
2193
	struct ieee80211_local *local = sdata->local;
2194
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2195
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2196

2197
	sdata_lock(sdata);
2198
	if (!ifmgd->associated) {
2199
		sdata_unlock(sdata);
2200 2201 2202
		return;
	}

2203 2204
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2205
			       true, frame_buf);
2206
	mutex_lock(&local->mtx);
2207
	sdata->vif.csa_active = false;
2208
	ifmgd->csa_waiting_bcn = false;
2209 2210 2211 2212 2213
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2214
	mutex_unlock(&local->mtx);
2215

2216 2217
	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
			      IEEE80211_DEAUTH_FRAME_LEN);
2218
	sdata_unlock(sdata);
2219 2220
}

2221
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2222 2223 2224
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2225
			     u.mgd.beacon_connection_loss_work);
2226 2227 2228 2229
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct sta_info *sta;

	if (ifmgd->associated) {
2230
		rcu_read_lock();
2231 2232 2233
		sta = sta_info_get(sdata, ifmgd->bssid);
		if (sta)
			sta->beacon_loss_count++;
2234
		rcu_read_unlock();
2235
	}
J
Johannes Berg 已提交
2236

2237
	if (ifmgd->connection_loss) {
2238 2239
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2240
		__ieee80211_disconnect(sdata);
2241
	} else {
2242
		ieee80211_mgd_probe_ap(sdata, true);
2243 2244 2245 2246 2247 2248 2249 2250 2251
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2252
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2253 2254
}

2255 2256 2257
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2258
	struct ieee80211_hw *hw = &sdata->local->hw;
2259

J
Johannes Berg 已提交
2260 2261
	trace_api_beacon_loss(sdata);

2262
	sdata->u.mgd.connection_loss = false;
2263
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2264 2265 2266
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2267 2268 2269 2270 2271
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2272 2273
	trace_api_connection_loss(sdata);

2274
	sdata->u.mgd.connection_loss = true;
2275 2276 2277 2278 2279
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2280 2281 2282 2283 2284
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2285
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2286 2287 2288 2289 2290 2291

	if (!assoc) {
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2292
		sdata->u.mgd.flags = 0;
2293
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2294
		ieee80211_vif_release_channel(sdata);
2295
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2296 2297
	}

2298
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2299 2300 2301 2302 2303 2304 2305
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2306
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2307 2308 2309
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2310
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2311 2312

	pos = mgmt->u.auth.variable;
2313
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2314 2315 2316
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
J
Johannes Berg 已提交
2317
	drv_mgd_prepare_tx(sdata->local, sdata);
2318 2319 2320
	if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2321
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2322 2323 2324
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2325
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2326 2327
}

2328 2329
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2330 2331 2332 2333 2334 2335
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
	struct sta_info *sta;

2336
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2337 2338

	if (len < 24 + 6)
2339
		return;
J
Johannes Berg 已提交
2340 2341

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2342
		return;
J
Johannes Berg 已提交
2343 2344 2345

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2346
	if (!ether_addr_equal(bssid, mgmt->bssid))
2347
		return;
J
Johannes Berg 已提交
2348 2349 2350 2351 2352 2353

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2354 2355 2356 2357 2358
	    auth_transaction != ifmgd->auth_data->expected_transaction) {
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2359
		return;
2360
	}
J
Johannes Berg 已提交
2361 2362

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2363 2364
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2365
		ieee80211_destroy_auth_data(sdata, false);
2366
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2367
		return;
J
Johannes Berg 已提交
2368 2369 2370 2371 2372 2373
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2374
	case WLAN_AUTH_SAE:
J
Johannes Berg 已提交
2375 2376 2377 2378 2379
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2380
			return;
J
Johannes Berg 已提交
2381 2382 2383 2384 2385
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2386
		return;
J
Johannes Berg 已提交
2387 2388
	}

J
Johannes Berg 已提交
2389
	sdata_info(sdata, "authenticated\n");
J
Johannes Berg 已提交
2390 2391
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
2392
	ifmgd->auth_data->timeout_started = true;
2393
	run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
2394

2395 2396 2397 2398 2399 2400
	if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
	    ifmgd->auth_data->expected_transaction != 2) {
		/*
		 * Report auth frame to user space for processing since another
		 * round of Authentication frames is still needed.
		 */
2401
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2402
		return;
2403 2404
	}

J
Johannes Berg 已提交
2405 2406 2407 2408 2409 2410 2411 2412
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
		goto out_err;
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
J
Johannes Berg 已提交
2413
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
J
Johannes Berg 已提交
2414 2415 2416 2417
		goto out_err;
	}
	mutex_unlock(&sdata->local->sta_mtx);

2418
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2419
	return;
J
Johannes Berg 已提交
2420 2421 2422 2423 2424
 out_err:
	mutex_unlock(&sdata->local->sta_mtx);
	/* ignore frame -- wait for timeout */
}

2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

static const char *ieee80211_get_reason_code_string(u16 reason_code)
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
2481

2482 2483
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
2484
{
2485
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2486
	const u8 *bssid = NULL;
2487 2488
	u16 reason_code;

2489
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2490

2491
	if (len < 24 + 2)
2492
		return;
2493

J
Johannes Berg 已提交
2494
	if (!ifmgd->associated ||
2495
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2496
		return;
2497

2498
	bssid = ifmgd->associated->bssid;
2499 2500 2501

	reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);

2502 2503
	sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
		   bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
2504

2505 2506
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2507
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2508 2509 2510
}


2511 2512
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
2513
{
2514
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2515 2516
	u16 reason_code;

2517
	sdata_assert_lock(sdata);
2518

J
Johannes Berg 已提交
2519
	if (len < 24 + 2)
2520
		return;
2521

J
Johannes Berg 已提交
2522
	if (!ifmgd->associated ||
2523
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2524
		return;
2525 2526 2527

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

J
Johannes Berg 已提交
2528 2529
	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
		   mgmt->sa, reason_code);
2530

2531 2532
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

2533
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
2534 2535
}

2536 2537 2538 2539
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
2540 2541
				int *min_rate, int *min_rate_index,
				int shift, u32 rate_flags)
2542 2543 2544 2545
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
2546
		int rate = supp_rates[i] & 0x7f;
2547 2548
		bool is_basic = !!(supp_rates[i] & 0x80);

2549
		if ((rate * 5 * (1 << shift)) > 110)
2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564
			*have_higher_than_11mbit = true;

		/*
		 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
		 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
		 *
		 * Note: Even through the membership selector and the basic
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
		if (!!(supp_rates[i] & 0x80) &&
		    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
2565 2566 2567 2568 2569 2570 2571 2572 2573
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];
			if ((rate_flags & br->flags) != rate_flags)
				continue;

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
2574 2575 2576
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
2577 2578
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
2579 2580 2581 2582 2583 2584 2585
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
2586

J
Johannes Berg 已提交
2587 2588 2589 2590 2591
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
					 bool assoc)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

2592
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2593 2594 2595 2596 2597 2598

	if (!assoc) {
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2599
		sdata->u.mgd.flags = 0;
2600
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2601
		ieee80211_vif_release_channel(sdata);
2602
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2603 2604 2605 2606 2607 2608 2609 2610
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2611
				    struct ieee80211_mgmt *mgmt, size_t len)
2612
{
2613
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2614
	struct ieee80211_local *local = sdata->local;
2615
	struct ieee80211_supported_band *sband;
2616
	struct sta_info *sta;
J
Johannes Berg 已提交
2617 2618
	u8 *pos;
	u16 capab_info, aid;
2619
	struct ieee802_11_elems elems;
J
Johannes Berg 已提交
2620
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2621 2622
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
2623
	u32 changed = 0;
2624
	int err;
2625
	bool ret;
2626

J
Johannes Berg 已提交
2627
	/* AssocResp and ReassocResp have identical structure */
2628 2629

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
2630
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
2631

2632
	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
J
Johannes Berg 已提交
2633 2634
		sdata_info(sdata, "invalid AID value 0x%x; bits 15:14 not set\n",
			   aid);
2635 2636
	aid &= ~(BIT(15) | BIT(14));

2637 2638 2639
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
2640 2641
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
2642 2643 2644 2645
		aid = 0;
		ifmgd->broken_ap = true;
	}

J
Johannes Berg 已提交
2646
	pos = mgmt->u.assoc_resp.variable;
2647
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2648

2649
	if (!elems.supp_rates) {
J
Johannes Berg 已提交
2650
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
2651
		return false;
2652 2653
	}

2654
	ifmgd->aid = aid;
2655

2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
	if ((assoc_data->wmm && !elems.wmm_param) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	     (!elems.ht_cap_elem || !elems.ht_operation)) ||
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	     (!elems.vht_cap_elem || !elems.vht_operation))) {
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
				       false, &bss_elems);
		if (assoc_data->wmm &&
		    !elems.wmm_param && bss_elems.wmm_param) {
			elems.wmm_param = bss_elems.wmm_param;
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
		if (!elems.ht_cap_elem && bss_elems.ht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_cap_elem = bss_elems.ht_cap_elem;
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
		if (!elems.ht_operation && bss_elems.ht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
			elems.ht_operation = bss_elems.ht_operation;
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
		if (!elems.vht_cap_elem && bss_elems.vht_cap_elem &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_cap_elem = bss_elems.vht_cap_elem;
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
		if (!elems.vht_operation && bss_elems.vht_operation &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
			elems.vht_operation = bss_elems.vht_operation;
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

2719 2720 2721 2722 2723 2724 2725
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
		sdata_info(sdata,
2726 2727 2728
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
2729 2730 2731 2732 2733
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    (!elems.vht_cap_elem || !elems.vht_operation)) {
		sdata_info(sdata,
2734 2735 2736
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
2737 2738
	}

2739 2740 2741 2742 2743
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
2744
	sta = sta_info_get(sdata, cbss->bssid);
2745 2746
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
2747 2748
		ret = false;
		goto out;
2749
	}
2750

J
Johannes Berg 已提交
2751
	sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
2752

2753
	/* Set up internal HT/VHT capabilities */
2754
	if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
2755
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
2756
						  elems.ht_cap_elem, sta);
2757

M
Mahesh Palivela 已提交
2758 2759
	if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
2760
						    elems.vht_cap_elem, sta);
M
Mahesh Palivela 已提交
2761

2762 2763 2764 2765 2766 2767
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
2768

2769 2770 2771 2772 2773 2774 2775 2776 2777 2778 2779 2780 2781 2782 2783
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
	if (elems.opmode_notif &&
	    !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
		u8 nss;

		nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

2784
	rate_control_rate_init(sta);
2785

2786
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
J
Johannes Berg 已提交
2787
		set_sta_flag(sta, WLAN_STA_MFP);
2788

2789
	sta->sta.wme = elems.wmm_param;
2790

2791
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
2792 2793 2794
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
2795 2796 2797
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
2798 2799
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
2800 2801
		ret = false;
		goto out;
2802 2803
	}

2804
	mutex_unlock(&sdata->local->sta_mtx);
2805

2806 2807 2808 2809 2810 2811 2812 2813
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;

2814
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
2815
		ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
J
Johannes Berg 已提交
2816
					 elems.wmm_param_len);
2817
	else
2818 2819
		ieee80211_set_wmm_default(sdata, false);
	changed |= BSS_CHANGED_QOS;
2820

J
Johannes Berg 已提交
2821 2822 2823 2824
	/* set AID and assoc capability,
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->aid = aid;
	bss_conf->assoc_capability = capab_info;
2825
	ieee80211_set_associated(sdata, cbss, changed);
2826

2827 2828 2829 2830 2831 2832 2833
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

2834
	/*
J
Johannes Berg 已提交
2835 2836
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
2837
	 */
J
Johannes Berg 已提交
2838
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
2839
	ieee80211_sta_reset_beacon_monitor(sdata);
2840

2841 2842 2843 2844
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
2845 2846
}

2847 2848 2849
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
2850 2851 2852 2853 2854
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
2855
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
2856 2857
	u8 *pos;
	bool reassoc;
2858
	struct cfg80211_bss *bss;
J
Johannes Berg 已提交
2859

2860
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2861 2862

	if (!assoc_data)
2863
		return;
2864
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
2865
		return;
J
Johannes Berg 已提交
2866 2867 2868 2869 2870 2871 2872

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
2873
		return;
J
Johannes Berg 已提交
2874 2875 2876 2877 2878 2879

	reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
2880 2881 2882 2883
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
2884 2885

	pos = mgmt->u.assoc_resp.variable;
2886
	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
J
Johannes Berg 已提交
2887 2888

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
2889 2890
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
2891
		u32 tu, ms;
2892
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
2893
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
2894 2895 2896
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
2897
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
2898
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
2899
		if (ms > IEEE80211_ASSOC_TIMEOUT)
2900 2901
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
2902 2903
	}

2904
	bss = assoc_data->bss;
J
Johannes Berg 已提交
2905 2906

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
2907 2908
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
J
Johannes Berg 已提交
2909 2910
		ieee80211_destroy_assoc_data(sdata, false);
	} else {
2911
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
J
Johannes Berg 已提交
2912
			/* oops -- internal error -- send timeout for now */
2913
			ieee80211_destroy_assoc_data(sdata, false);
2914
			cfg80211_assoc_timeout(sdata->dev, bss);
2915
			return;
J
Johannes Berg 已提交
2916
		}
2917
		sdata_info(sdata, "associated\n");
2918 2919 2920 2921 2922 2923 2924

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
		ieee80211_destroy_assoc_data(sdata, true);
2925 2926 2927 2928 2929 2930

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
				uapsd_queues |= BIT(ac);
J
Johannes Berg 已提交
2931 2932
	}

2933
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues);
J
Johannes Berg 已提交
2934
}
J
Johannes Berg 已提交
2935

2936
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
2937
				  struct ieee80211_mgmt *mgmt, size_t len,
2938
				  struct ieee80211_rx_status *rx_status,
2939
				  struct ieee802_11_elems *elems)
2940 2941
{
	struct ieee80211_local *local = sdata->local;
2942
	struct ieee80211_bss *bss;
2943
	struct ieee80211_channel *channel;
2944

2945
	sdata_assert_lock(sdata);
2946

2947 2948
	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
	if (!channel)
2949 2950 2951
		return;

	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
2952
					channel);
2953 2954
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
2955
		ieee80211_rx_bss_put(local, bss);
2956
	}
2957 2958 2959
}


2960
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
2961
					 struct sk_buff *skb)
2962
{
J
Johannes Berg 已提交
2963
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
2964
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
2965 2966
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
	size_t baselen, len = skb->len;
2967 2968
	struct ieee802_11_elems elems;

2969 2970
	ifmgd = &sdata->u.mgd;

2971
	sdata_assert_lock(sdata);
2972

2973
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
2974 2975
		return; /* ignore ProbeResp to foreign address */

2976 2977 2978 2979 2980
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
2981
			       false, &elems);
2982

2983
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
2984

2985
	if (ifmgd->associated &&
2986
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
2987
		ieee80211_reset_ap_probe(sdata);
J
Johannes Berg 已提交
2988 2989

	if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
2990
	    ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
J
Johannes Berg 已提交
2991
		/* got probe response, continue with auth */
J
Johannes Berg 已提交
2992
		sdata_info(sdata, "direct probe responded\n");
J
Johannes Berg 已提交
2993 2994
		ifmgd->auth_data->tries = 0;
		ifmgd->auth_data->timeout = jiffies;
2995
		ifmgd->auth_data->timeout_started = true;
2996
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
2997
	}
2998 2999
}

3000 3001 3002
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3003 3004 3005
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3006 3007 3008 3009 3010 3011 3012 3013 3014 3015
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3016 3017 3018 3019 3020
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3021
	(1ULL << WLAN_EID_HT_OPERATION);
3022

3023 3024 3025
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
3026
{
3027
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3028
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3029 3030
	size_t baselen;
	struct ieee802_11_elems elems;
3031
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
3032 3033
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
3034
	struct sta_info *sta;
3035
	u32 changed = 0;
3036
	bool erp_valid;
J
Johannes Berg 已提交
3037
	u8 erp_value = 0;
3038
	u32 ncrc;
3039
	u8 *bssid;
3040
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
3041

3042
	sdata_assert_lock(sdata);
3043

3044 3045 3046
	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
3047
		return;
3048

J
Johannes Berg 已提交
3049 3050 3051 3052
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
3053
		return;
J
Johannes Berg 已提交
3054 3055
	}

3056
	if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
J
Johannes Berg 已提交
3057
		rcu_read_unlock();
3058
		return;
J
Johannes Berg 已提交
3059
	}
3060
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
3061
	rcu_read_unlock();
3062

3063
	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
3064
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
J
Johannes Berg 已提交
3065
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3066
				       len - baselen, false, &elems);
3067

3068
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3069 3070 3071 3072
		if (elems.tim && !elems.parse_error) {
			const struct ieee80211_tim_ie *tim_ie = elems.tim;
			ifmgd->dtim_period = tim_ie->dtim_period;
		}
3073
		ifmgd->have_beacon = true;
3074
		ifmgd->assoc_data->need_beacon = false;
3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085
		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
			if (elems.tim)
				sdata->vif.bss_conf.sync_dtim_count =
					elems.tim->dtim_count;
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
3086 3087
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
3088
		ifmgd->assoc_data->timeout_started = true;
3089 3090
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3091
	}
3092

J
Johannes Berg 已提交
3093
	if (!ifmgd->associated ||
3094
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3095
		return;
J
Johannes Berg 已提交
3096
	bssid = ifmgd->associated->bssid;
3097

3098 3099 3100 3101
	/* Track average RSSI from the Beacon frames of the current AP */
	ifmgd->last_beacon_signal = rx_status->signal;
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3102
		ifmgd->ave_beacon_signal = rx_status->signal * 16;
3103
		ifmgd->last_cqm_event_signal = 0;
3104
		ifmgd->count_beacon_signal = 1;
3105
		ifmgd->last_ave_beacon_signal = 0;
3106 3107 3108 3109 3110
	} else {
		ifmgd->ave_beacon_signal =
			(IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
			 (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
			 ifmgd->ave_beacon_signal) / 16;
3111
		ifmgd->count_beacon_signal++;
3112
	}
3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125

	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = ifmgd->ave_beacon_signal;
		int last_sig = ifmgd->last_ave_beacon_signal;

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3126
			drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
3127 3128 3129 3130
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3131
			drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
3132 3133 3134
		}
	}

3135
	if (bss_conf->cqm_rssi_thold &&
3136
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3137
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158
		int sig = ifmgd->ave_beacon_signal / 16;
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				GFP_KERNEL);
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				GFP_KERNEL);
		}
	}

3159
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3160
		mlme_dbg_ratelimited(sdata,
3161
				     "cancelling AP probe due to a received beacon\n");
3162
		ieee80211_reset_ap_probe(sdata);
3163 3164
	}

J
Johannes Berg 已提交
3165 3166 3167 3168
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3169
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3170

3171 3172
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3173
					  len - baselen, false, &elems,
3174 3175
					  care_about_ies, ncrc);

3176
	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
3177 3178 3179
		bool directed_tim = ieee80211_check_tim(elems.tim,
							elems.tim_len,
							ifmgd->aid);
3180
		if (directed_tim) {
3181
			if (local->hw.conf.dynamic_ps_timeout > 0) {
3182 3183 3184 3185 3186
				if (local->hw.conf.flags & IEEE80211_CONF_PS) {
					local->hw.conf.flags &= ~IEEE80211_CONF_PS;
					ieee80211_hw_config(local,
							    IEEE80211_CONF_CHANGE_PS);
				}
3187
				ieee80211_send_nullfunc(local, sdata, 0);
3188
			} else if (!local->pspolling && sdata->u.mgd.powersave) {
3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200
				local->pspolling = true;

				/*
				 * Here is assumed that the driver will be
				 * able to send ps-poll frame and receive a
				 * response even though power save mode is
				 * enabled, but some drivers might require
				 * to disable power save here. This needs
				 * to be investigated.
				 */
				ieee80211_send_pspoll(local, sdata);
			}
3201 3202
		}
	}
J
Johannes Berg 已提交
3203

3204
	if (sdata->vif.p2p) {
J
Janusz Dziedzic 已提交
3205
		struct ieee80211_p2p_noa_attr noa = {};
3206 3207 3208 3209 3210
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
3211
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
3228 3229 3230 3231 3232
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

3233 3234 3235
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

3236
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
3237
		return;
3238
	ifmgd->beacon_crc = ncrc;
3239
	ifmgd->beacon_crc_valid = true;
3240

3241
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
3242

3243
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
3244
					 rx_status->device_timestamp,
3245 3246
					 &elems, true);

3247 3248
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
3249 3250 3251
				     elems.wmm_param_len))
		changed |= BSS_CHANGED_QOS;

3252 3253
	/*
	 * If we haven't had a beacon before, tell the driver about the
3254
	 * DTIM period (and beacon timing if desired) now.
3255
	 */
3256
	if (!ifmgd->have_beacon) {
3257 3258 3259 3260 3261
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
		if (elems.tim)
			bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
		else
			bss_conf->dtim_period = 1;
3262 3263 3264 3265 3266 3267 3268 3269 3270 3271 3272 3273 3274

		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
			if (elems.tim)
				sdata->vif.bss_conf.sync_dtim_count =
					elems.tim->dtim_count;
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		}

3275 3276
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
3277 3278 3279 3280 3281

		mutex_lock(&local->iflist_mtx);
		ieee80211_recalc_ps(local, -1);
		mutex_unlock(&local->iflist_mtx);

3282
		ieee80211_recalc_ps_vif(sdata);
3283 3284
	}

3285
	if (elems.erp_info) {
J
Johannes Berg 已提交
3286 3287 3288 3289
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
3290
	}
J
Johannes Berg 已提交
3291 3292 3293
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
3294

3295
	mutex_lock(&local->sta_mtx);
3296 3297
	sta = sta_info_get(sdata, bssid);

3298 3299
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
3300 3301 3302 3303 3304
				elems.vht_operation, bssid, &changed)) {
		mutex_unlock(&local->sta_mtx);
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
3305 3306
		cfg80211_tx_mlme_mgmt(sdata->dev, deauth_buf,
				      sizeof(deauth_buf));
3307
		return;
3308
	}
3309 3310 3311 3312

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
					    rx_status->band, true);
3313
	mutex_unlock(&local->sta_mtx);
3314

3315 3316 3317
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
3318 3319
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
3320

3321
	ieee80211_bss_info_change_notify(sdata, changed);
3322 3323
}

3324 3325
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
3326 3327 3328 3329
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
3330 3331
	struct ieee802_11_elems elems;
	int ies_len;
3332 3333 3334 3335 3336

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

3337
	sdata_lock(sdata);
3338

J
Johannes Berg 已提交
3339 3340
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
3341
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
3342 3343 3344 3345 3346
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
3347
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3348 3349
		break;
	case IEEE80211_STYPE_DEAUTH:
3350
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3351 3352
		break;
	case IEEE80211_STYPE_DISASSOC:
3353
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3354 3355 3356
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
3357
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
3358 3359
		break;
	case IEEE80211_STYPE_ACTION:
3360
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
3361 3362 3363
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
3364 3365 3366 3367 3368 3369

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
3370
				ies_len, true, &elems);
3371 3372 3373 3374

			if (elems.parse_error)
				break;

3375
			ieee80211_sta_process_chanswitch(sdata,
3376 3377 3378
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3379 3380 3381 3382 3383 3384 3385 3386 3387 3388
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
3389
				ies_len, true, &elems);
3390 3391 3392 3393 3394 3395 3396 3397

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
3398
			ieee80211_sta_process_chanswitch(sdata,
3399 3400 3401
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
3402
		}
3403
		break;
3404
	}
3405
	sdata_unlock(sdata);
3406 3407
}

J
Johannes Berg 已提交
3408
static void ieee80211_sta_timer(unsigned long data)
3409
{
J
Johannes Berg 已提交
3410 3411
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
3412

3413
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3414 3415
}

3416
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
3417
					  u8 *bssid, u8 reason, bool tx)
3418
{
3419
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
3420

3421
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
3422
			       tx, frame_buf);
3423

3424 3425
	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
			      IEEE80211_DEAUTH_FRAME_LEN);
3426 3427
}

J
Johannes Berg 已提交
3428 3429 3430 3431 3432
static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
3433
	u32 tx_flags = 0;
J
Johannes Berg 已提交
3434

3435
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3436 3437 3438 3439 3440 3441 3442

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
3443 3444
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
3445 3446 3447 3448 3449 3450 3451 3452 3453 3454

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3455 3456
	drv_mgd_prepare_tx(local, sdata);

J
Johannes Berg 已提交
3457
	if (auth_data->bss->proberesp_ies) {
3458 3459 3460
		u16 trans = 1;
		u16 status = 0;

J
Johannes Berg 已提交
3461 3462 3463
		sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
			   auth_data->bss->bssid, auth_data->tries,
			   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
3464 3465

		auth_data->expected_transaction = 2;
3466 3467 3468 3469 3470 3471 3472

		if (auth_data->algorithm == WLAN_AUTH_SAE) {
			trans = auth_data->sae_trans;
			status = auth_data->sae_status;
			auth_data->expected_transaction = trans;
		}

3473 3474 3475 3476
		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
			tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
				   IEEE80211_TX_INTFL_MLME_CONN_TX;

3477 3478
		ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
				    auth_data->data, auth_data->data_len,
J
Johannes Berg 已提交
3479
				    auth_data->bss->bssid,
3480 3481
				    auth_data->bss->bssid, NULL, 0, 0,
				    tx_flags);
J
Johannes Berg 已提交
3482 3483 3484
	} else {
		const u8 *ssidie;

J
Johannes Berg 已提交
3485 3486 3487
		sdata_info(sdata, "direct probe to %pM (try %d/%i)\n",
			   auth_data->bss->bssid, auth_data->tries,
			   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
3488

3489
		rcu_read_lock();
J
Johannes Berg 已提交
3490
		ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
3491 3492
		if (!ssidie) {
			rcu_read_unlock();
J
Johannes Berg 已提交
3493
			return -EINVAL;
3494
		}
J
Johannes Berg 已提交
3495 3496 3497 3498 3499
		/*
		 * Direct probe is sent to broadcast address as some APs
		 * will not answer to direct packet in unassociated state.
		 */
		ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
3500
					 NULL, 0, (u32) -1, true, 0,
J
Johannes Berg 已提交
3501
					 auth_data->bss->channel, false);
3502
		rcu_read_unlock();
J
Johannes Berg 已提交
3503 3504
	}

3505
	if (tx_flags == 0) {
3506
		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
3507
		auth_data->timeout_started = true;
3508
		run_again(sdata, auth_data->timeout);
3509
	} else {
3510 3511 3512 3513
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
		auth_data->timeout_started = true;
		run_again(sdata, auth_data->timeout);
3514
	}
J
Johannes Berg 已提交
3515 3516 3517 3518 3519 3520 3521 3522 3523

	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

3524
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3525 3526 3527

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
3528 3529
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
3530 3531 3532 3533 3534 3535 3536 3537 3538 3539

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
3540 3541 3542
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
3543 3544
	ieee80211_send_assoc(sdata);

3545 3546
	if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
3547
		assoc_data->timeout_started = true;
3548
		run_again(sdata, assoc_data->timeout);
3549
	} else {
3550 3551 3552 3553 3554
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
3555
	}
J
Johannes Berg 已提交
3556 3557 3558 3559

	return 0;
}

3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570 3571
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

3572
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
3573 3574
{
	struct ieee80211_local *local = sdata->local;
3575
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3576

3577
	sdata_lock(sdata);
3578

3579 3580 3581 3582 3583 3584 3585 3586 3587 3588
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
		if (ifmgd->auth_data &&
		    (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
			if (status_acked) {
				ifmgd->auth_data->timeout =
					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
3589
				run_again(sdata, ifmgd->auth_data->timeout);
3590 3591 3592
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
3593
			ifmgd->auth_data->timeout_started = true;
3594 3595 3596 3597 3598 3599
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
3600
				run_again(sdata, ifmgd->assoc_data->timeout);
3601 3602 3603
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
3604
			ifmgd->assoc_data->timeout_started = true;
3605 3606 3607
		}
	}

3608
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619 3620 3621 3622
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
		} else if (ieee80211_probe_auth(sdata)) {
			u8 bssid[ETH_ALEN];

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

3623
			cfg80211_auth_timeout(sdata->dev, bssid);
J
Johannes Berg 已提交
3624
		}
3625
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
3626
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
3627

3628
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
3629
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
3630
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
3631
		    ieee80211_do_assoc(sdata)) {
3632
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
J
Johannes Berg 已提交
3633 3634

			ieee80211_destroy_assoc_data(sdata, false);
3635
			cfg80211_assoc_timeout(sdata->dev, bss);
J
Johannes Berg 已提交
3636
		}
3637
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
3638
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
3639

3640
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
3641
	    ifmgd->associated) {
3642
		u8 bssid[ETH_ALEN];
3643
		int max_tries;
3644

3645
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
3646

3647
		if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
3648
			max_tries = max_nullfunc_tries;
3649
		else
3650
			max_tries = max_probe_tries;
3651

3652 3653 3654
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
3655 3656
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3657 3658 3659 3660
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
3661 3662
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
3663 3664 3665
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
3666
				ieee80211_sta_connection_lost(sdata, bssid,
3667 3668
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
3669 3670
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
3671
			run_again(sdata, ifmgd->probe_timeout);
3672
		else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
J
Johannes Berg 已提交
3673 3674 3675
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
3676
			ieee80211_sta_connection_lost(sdata, bssid,
3677
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
3678
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
3679 3680 3681 3682
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
3683 3684
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
3685 3686 3687 3688
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
3689 3690 3691 3692
			wiphy_debug(local->hw.wiphy,
				    "%s: No probe response from AP %pM"
				    " after %dms, disconnecting.\n",
				    sdata->name,
3693
				    bssid, probe_wait_ms);
3694

3695
			ieee80211_sta_connection_lost(sdata, bssid,
3696
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
3697 3698 3699
		}
	}

3700
	sdata_unlock(sdata);
3701 3702
}

J
Johannes Berg 已提交
3703 3704 3705 3706 3707
static void ieee80211_sta_bcn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_local *local = sdata->local;
3708
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3709 3710 3711 3712

	if (local->quiescing)
		return;

3713
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3714 3715
		return;

3716
	sdata->u.mgd.connection_loss = false;
3717 3718
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730
}

static void ieee80211_sta_conn_mon_timer(unsigned long data)
{
	struct ieee80211_sub_if_data *sdata =
		(struct ieee80211_sub_if_data *) data;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

	if (local->quiescing)
		return;

3731
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
3732 3733
		return;

3734
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
3746 3747
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
3748 3749
	u32 flags;

3750
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
3751
		__ieee80211_stop_poll(sdata);
3752

J
Johannes Berg 已提交
3753
		/* let's probe the connection once */
3754 3755 3756 3757
		flags = sdata->local->hw.flags;
		if (!(flags & IEEE80211_HW_CONNECTION_MONITOR))
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
J
Johannes Berg 已提交
3758
		/* and do all the other regular work too */
J
Johannes Berg 已提交
3759
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
3760
	}
J
Johannes Berg 已提交
3761
}
3762

3763
#ifdef CONFIG_PM
3764 3765 3766 3767 3768 3769 3770
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

3771 3772 3773 3774 3775
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

3776
		/*
3777 3778 3779
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
3780
		 */
3781
		ieee80211_send_deauth_disassoc(sdata, bssid,
3782 3783 3784
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
3785 3786 3787 3788
		if (ifmgd->assoc_data)
			ieee80211_destroy_assoc_data(sdata, false);
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
3789 3790 3791 3792 3793 3794 3795
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

	sdata_unlock(sdata);
}

3796 3797 3798 3799
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

3800
	sdata_lock(sdata);
3801
	if (!ifmgd->associated) {
3802
		sdata_unlock(sdata);
3803 3804 3805 3806 3807 3808 3809 3810 3811 3812
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
3813
		sdata_unlock(sdata);
3814 3815
		return;
	}
3816
	sdata_unlock(sdata);
3817 3818 3819
}
#endif

J
Johannes Berg 已提交
3820 3821
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
3822
{
3823
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3824

3825
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
3826
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
3827
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
3828 3829
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
3830 3831
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
3832
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
3833 3834
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
3835
	setup_timer(&ifmgd->timer, ieee80211_sta_timer,
S
Sujith 已提交
3836
		    (unsigned long) sdata);
J
Johannes Berg 已提交
3837 3838 3839 3840
	setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
		    (unsigned long) sdata);
	setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
		    (unsigned long) sdata);
3841
	setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
J
Johannes Berg 已提交
3842 3843
		    (unsigned long) sdata);

3844
	ifmgd->flags = 0;
3845
	ifmgd->powersave = sdata->wdev.ps;
3846 3847
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
3848
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
3849

3850
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
3851 3852 3853
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
3854 3855
}

3856 3857
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
3858
{
3859
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
3860

3861 3862
	/* Restart STA timers */
	rcu_read_lock();
3863 3864 3865 3866
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
3867 3868
	rcu_read_unlock();
}
J
Johannes Berg 已提交
3869

3870 3871 3872 3873 3874 3875 3876
int ieee80211_max_network_latency(struct notifier_block *nb,
				  unsigned long data, void *dummy)
{
	s32 latency_usec = (s32) data;
	struct ieee80211_local *local =
		container_of(nb, struct ieee80211_local,
			     network_latency_notifier);
3877

3878 3879 3880
	mutex_lock(&local->iflist_mtx);
	ieee80211_recalc_ps(local, latency_usec);
	mutex_unlock(&local->iflist_mtx);
3881

3882
	return NOTIFY_OK;
J
Johannes Berg 已提交
3883 3884
}

J
Johannes Berg 已提交
3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

3897
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

3910
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

3929 3930
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
3931 3932 3933
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3934
	const struct ieee80211_ht_cap *ht_cap = NULL;
3935
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
3936
	const struct ieee80211_vht_operation *vht_oper = NULL;
3937
	struct ieee80211_supported_band *sband;
3938
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
3939
	int ret;
3940

3941 3942
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
3943 3944 3945 3946
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

3947 3948
	rcu_read_lock();

J
Johannes Berg 已提交
3949 3950
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
	    sband->ht_cap.ht_supported) {
3951
		const u8 *ht_oper_ie, *ht_cap_ie;
3952

3953
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
3954 3955
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
3956

3957 3958 3959 3960 3961
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
3962 3963 3964
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
3965 3966
	}

J
Johannes Berg 已提交
3967 3968
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
	    sband->vht_cap.vht_supported) {
3969
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
3970

3971 3972
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
3973 3974 3975 3976
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
3977
			sdata_info(sdata,
J
Johannes Berg 已提交
3978
				   "AP advertised VHT without HT, disabling both\n");
3979 3980
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
3981
		}
3982 3983 3984 3985 3986 3987

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
3988 3989
	}

J
Johannes Berg 已提交
3990 3991
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
3992
						     ht_cap, ht_oper, vht_oper,
3993
						     &chandef, false);
3994

J
Johannes Berg 已提交
3995 3996
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
3997

3998 3999
	rcu_read_unlock();

4000 4001 4002
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4003
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4004 4005 4006 4007 4008 4009 4010
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4011 4012 4013 4014

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4015
		goto out;
4016

4017
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4018
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4019 4020 4021
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4022 4023
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4024
	return ret;
4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043 4044 4045 4046 4047 4048 4049 4050
}

static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss, bool assoc)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
	bool have_sta = false;
	int err;

	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
J
Johannes Berg 已提交
4051
	if (new_sta) {
4052 4053 4054
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
4055
		struct ieee80211_chanctx_conf *chanctx_conf;
4056
		struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
4057
		const struct cfg80211_bss_ies *ies;
4058 4059
		int shift;
		u32 rate_flags;
4060 4061 4062 4063 4064 4065

		sband = local->hw.wiphy->bands[cbss->channel->band];

		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			sta_info_free(local, new_sta);
4066
			return -EINVAL;
4067
		}
4068 4069 4070 4071 4072 4073
		shift = ieee80211_vif_get_shift(&sdata->vif);

		rcu_read_lock();
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
		if (WARN_ON(!chanctx_conf)) {
			rcu_read_unlock();
E
Eytan Lifshitz 已提交
4074
			sta_info_free(local, new_sta);
4075 4076 4077 4078
			return -EINVAL;
		}
		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
		rcu_read_unlock();
4079 4080 4081 4082 4083

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
4084 4085
				    &min_rate, &min_rate_index,
				    shift, rate_flags);
4086 4087 4088 4089 4090 4091 4092 4093 4094 4095

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
		 */
		if (!basic_rates && min_rate_index >= 0) {
J
Johannes Berg 已提交
4096 4097
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
4098 4099 4100
			basic_rates = BIT(min_rate_index);
		}

J
Johannes Berg 已提交
4101
		new_sta->sta.supp_rates[cbss->channel->band] = rates;
4102 4103 4104
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
J
Johannes Berg 已提交
4105
		if (cbss->channel->band == IEEE80211_BAND_2GHZ &&
4106 4107 4108 4109 4110 4111 4112
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

4113 4114
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
4115
		rcu_read_lock();
4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			const u8 *tim_ie;

			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						  ies->data, ies->len);
			if (tim_ie && tim_ie[1] >= 2)
				sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
			else
				sdata->vif.bss_conf.sync_dtim_count = 0;
		} else if (!(local->hw.flags &
					IEEE80211_HW_TIMING_BEACON_ONLY)) {
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
4142
		rcu_read_unlock();
4143 4144

		/* tell driver about BSSID, basic rates and timing */
4145
		ieee80211_bss_info_change_notify(sdata,
4146 4147
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
4148 4149

		if (assoc)
J
Johannes Berg 已提交
4150
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
4151

J
Johannes Berg 已提交
4152 4153
		err = sta_info_insert(new_sta);
		new_sta = NULL;
4154
		if (err) {
J
Johannes Berg 已提交
4155 4156 4157
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
4158 4159 4160
			return err;
		}
	} else
4161
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
4162 4163 4164 4165

	return 0;
}

4166 4167 4168
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
4169
{
J
Johannes Berg 已提交
4170 4171 4172
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
4173
	u16 auth_alg;
J
Johannes Berg 已提交
4174 4175 4176
	int err;

	/* prepare auth data structure */
J
Johannes Berg 已提交
4177

4178 4179 4180 4181 4182
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
J
Johannes Berg 已提交
4183
		if (IS_ERR(local->wep_tx_tfm))
4184
			return -EOPNOTSUPP;
4185 4186 4187 4188 4189 4190 4191 4192
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
4193 4194 4195
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
4196 4197
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4198
	}
4199

4200 4201
	auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
4202
	if (!auth_data)
J
Johannes Berg 已提交
4203
		return -ENOMEM;
4204

J
Johannes Berg 已提交
4205
	auth_data->bss = req->bss;
4206

4207 4208 4209 4210 4211 4212 4213 4214 4215
	if (req->sae_data_len >= 4) {
		__le16 *pos = (__le16 *) req->sae_data;
		auth_data->sae_trans = le16_to_cpu(pos[0]);
		auth_data->sae_status = le16_to_cpu(pos[1]);
		memcpy(auth_data->data, req->sae_data + 4,
		       req->sae_data_len - 4);
		auth_data->data_len += req->sae_data_len - 4;
	}

4216
	if (req->ie && req->ie_len) {
4217 4218 4219
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
4220
	}
4221

J
Johannes Berg 已提交
4222
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
4223 4224 4225
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
4226 4227
	}

J
Johannes Berg 已提交
4228
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
4229

J
Johannes Berg 已提交
4230
	/* try to authenticate/probe */
4231

J
Johannes Berg 已提交
4232 4233 4234 4235
	if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
	    ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
4236 4237
	}

J
Johannes Berg 已提交
4238 4239
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
4240

J
Johannes Berg 已提交
4241 4242
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
4243

4244 4245 4246 4247 4248 4249 4250
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4251 4252
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      sizeof(frame_buf));
4253
	}
J
Johannes Berg 已提交
4254

J
Johannes Berg 已提交
4255
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
4256

4257 4258
	err = ieee80211_prep_connection(sdata, req->bss, false);
	if (err)
J
Johannes Berg 已提交
4259
		goto err_clear;
J
Johannes Berg 已提交
4260

J
Johannes Berg 已提交
4261 4262 4263 4264 4265 4266 4267
	err = ieee80211_probe_auth(sdata);
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
4268
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
4269
	return 0;
J
Johannes Berg 已提交
4270 4271

 err_clear:
4272 4273
	memset(ifmgd->bssid, 0, ETH_ALEN);
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4274 4275 4276 4277
	ifmgd->auth_data = NULL;
 err_free:
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
4278 4279
}

4280 4281 4282 4283 4284 4285 4286 4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297 4298 4299 4300 4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314 4315 4316 4317
static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
					const u8 *wmm_param, int len)
{
	const u8 *pos;
	size_t left;

	if (len < 8)
		return false;

	if (wmm_param[5] != 1 /* version */)
		return false;

	pos = wmm_param + 8;
	left = len - 8;

	for (; left >= 4; left -= 4, pos += 4) {
		u8 aifsn = pos[0] & 0x0f;
		u8 ecwmin = pos[1] & 0x0f;
		u8 ecwmax = (pos[1] & 0xf0) >> 4;
		int aci = (pos[0] >> 5) & 0x03;

		if (aifsn < 2) {
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
				   aifsn, aci);
			return false;
		}
		if (ecwmin > ecwmax) {
			sdata_info(sdata,
				   "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
				   ecwmin, ecwmax, aci);
			return false;
		}
	}

	return true;
}

4318 4319
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
4320
{
J
Johannes Berg 已提交
4321
	struct ieee80211_local *local = sdata->local;
4322
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4323
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
4324
	struct ieee80211_mgd_assoc_data *assoc_data;
4325
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
4326
	struct ieee80211_supported_band *sband;
4327
	const u8 *ssidie, *ht_ie, *vht_ie;
4328
	int i, err;
4329

J
Johannes Berg 已提交
4330 4331 4332 4333
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

4334 4335 4336 4337 4338 4339 4340 4341 4342 4343 4344
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
	if (!ssidie) {
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

4345 4346 4347 4348 4349 4350 4351
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

4352 4353
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      sizeof(frame_buf));
4354
	}
J
Johannes Berg 已提交
4355 4356 4357 4358

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
4359
	}
4360

J
Johannes Berg 已提交
4361 4362 4363 4364
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
4365

J
Johannes Berg 已提交
4366 4367 4368 4369
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
4370
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
4371
		ieee80211_destroy_auth_data(sdata, match);
4372 4373
	}

J
Johannes Berg 已提交
4374
	/* prepare assoc data */
4375

4376 4377
	ifmgd->beacon_crc_valid = false;

4378 4379 4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391 4392 4393 4394 4395 4396 4397 4398 4399 4400 4401 4402 4403 4404 4405 4406 4407 4408 4409 4410 4411 4412 4413
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);
	if (assoc_data->wmm) {
		/* try to check validity of WMM params IE */
		const struct cfg80211_bss_ies *ies;
		const u8 *wp, *start, *end;

		rcu_read_lock();
		ies = rcu_dereference(req->bss->ies);
		start = ies->data;
		end = start + ies->len;

		while (true) {
			wp = cfg80211_find_vendor_ie(
				WLAN_OUI_MICROSOFT,
				WLAN_OUI_TYPE_MICROSOFT_WMM,
				start, end - start);
			if (!wp)
				break;
			start = wp + wp[1] + 2;
			/* if this IE is too short, try the next */
			if (wp[1] <= 4)
				continue;
			/* if this IE is WMM params, we found what we wanted */
			if (wp[6] == 1)
				break;
		}

		if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
							wp[1] - 2)) {
			assoc_data->wmm = false;
			ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
		}
		rcu_read_unlock();
	}

J
Johannes Berg 已提交
4414 4415 4416 4417 4418 4419 4420
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
4421
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
4422 4423
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
4424
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
4425
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4426
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4427
			netdev_info(sdata->dev,
4428
				    "disabling HT/VHT due to WEP/TKIP use\n");
4429 4430
		}
	}
4431

4432
	if (req->flags & ASSOC_REQ_DISABLE_HT) {
4433
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4434 4435
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
	}
B
Ben Greear 已提交
4436

4437 4438 4439
	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4440 4441 4442
	/* Also disable HT if we don't support it or the AP doesn't use WMM */
	sband = local->hw.wiphy->bands[req->bss->channel->band];
	if (!sband->ht_cap.ht_supported ||
4443 4444
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4445
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4446 4447
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4448 4449
			netdev_info(sdata->dev,
				    "disabling HT as WMM/QoS is not supported by the AP\n");
4450
	}
J
Johannes Berg 已提交
4451

4452 4453
	/* disable VHT if we don't support it or the AP doesn't use WMM */
	if (!sband->vht_cap.vht_supported ||
4454 4455
	    local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
	    ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
4456
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4457 4458
		if (!bss->wmm_used &&
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
4459 4460
			netdev_info(sdata->dev,
				    "disabling VHT as WMM/QoS is not supported by the AP\n");
4461 4462
	}

B
Ben Greear 已提交
4463 4464 4465 4466
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

4467 4468 4469 4470
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

4471
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
4472 4473 4474
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
4475

J
Johannes Berg 已提交
4476
	assoc_data->bss = req->bss;
4477

J
Johannes Berg 已提交
4478 4479
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
4480
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
4481
		else
4482
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
4483
	} else
4484
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
4485

J
Johannes Berg 已提交
4486 4487 4488
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
4489

4490
	rcu_read_lock();
4491 4492 4493 4494 4495
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
4496
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
4497 4498 4499 4500 4501 4502
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4503
	rcu_read_unlock();
4504

K
Kalle Valo 已提交
4505
	if (bss->wmm_used && bss->uapsd_supported &&
4506
	    (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
4507
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
4508 4509
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
4510
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
4511 4512 4513
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

4514
	if (req->prev_bssid)
J
Johannes Berg 已提交
4515
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
4516 4517 4518 4519 4520 4521 4522 4523 4524

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

4525 4526 4527 4528 4529
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

4530 4531 4532 4533 4534
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

4535 4536
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
4537 4538
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
4539

J
Johannes Berg 已提交
4540 4541 4542
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
4543
	ifmgd->dtim_period = 0;
4544
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
4545

4546 4547 4548
	err = ieee80211_prep_connection(sdata, req->bss, true);
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
4549

4550 4551
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
4552

4553 4554 4555 4556 4557 4558 4559 4560 4561
	if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
4562
		assoc_data->timeout_started = true;
4563 4564 4565 4566 4567
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
		const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
						    beacon_ies->data,
						    beacon_ies->len);
4568 4569
		u8 dtim_count = 0;

4570 4571 4572 4573
		if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
			const struct ieee80211_tim_ie *tim;
			tim = (void *)(tim_ie + 2);
			ifmgd->dtim_period = tim->dtim_period;
4574
			dtim_count = tim->dtim_count;
4575
		}
4576
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
4577
		assoc_data->timeout = jiffies;
4578
		assoc_data->timeout_started = true;
4579 4580 4581 4582 4583 4584 4585

		if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
4586 4587
	} else {
		assoc_data->timeout = jiffies;
4588
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
4589
	}
4590 4591
	rcu_read_unlock();

4592
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
4593

P
Paul Stewart 已提交
4594 4595 4596 4597 4598 4599 4600 4601 4602 4603
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
4604 4605
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
4606 4607
	}

4608
	return 0;
J
Johannes Berg 已提交
4609
 err_clear:
4610 4611
	memset(ifmgd->bssid, 0, ETH_ALEN);
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
4612 4613 4614 4615
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
4616 4617
}

4618
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
4619
			 struct cfg80211_deauth_request *req)
4620
{
4621
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4622
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4623
	bool tx = !req->local_state_change;
4624

4625 4626 4627 4628 4629 4630
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
4631

4632
		drv_mgd_prepare_tx(sdata->local, sdata);
4633 4634
		ieee80211_send_deauth_disassoc(sdata, req->bssid,
					       IEEE80211_STYPE_DEAUTH,
4635
					       req->reason_code, tx,
4636
					       frame_buf);
4637
		ieee80211_destroy_auth_data(sdata, false);
4638 4639
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
4640

4641
		return 0;
4642 4643
	}

4644 4645
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
4646 4647 4648 4649 4650
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

4651 4652
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
4653 4654
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
4655 4656
		return 0;
	}
4657

4658
	return -ENOTCONN;
4659
}
4660

4661
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
4662
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
4663
{
4664
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4665
	u8 bssid[ETH_ALEN];
4666
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
4667

J
Johannes Berg 已提交
4668 4669 4670 4671 4672 4673
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
4674
	if (ifmgd->associated != req->bss)
4675 4676
		return -ENOLINK;

J
Johannes Berg 已提交
4677
	sdata_info(sdata,
4678 4679
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
4680

4681
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
4682 4683 4684
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
4685

4686 4687
	cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
			      IEEE80211_DEAUTH_FRAME_LEN);
4688

4689 4690
	return 0;
}
4691

4692
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
4693 4694 4695
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4696 4697 4698 4699 4700 4701 4702 4703 4704 4705
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
4706
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
4707

4708
	sdata_lock(sdata);
4709 4710
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4711
		ieee80211_destroy_assoc_data(sdata, false);
4712 4713
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
4714 4715 4716
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
	del_timer_sync(&ifmgd->timer);
4717
	sdata_unlock(sdata);
4718 4719
}

4720 4721 4722 4723 4724 4725
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

J
Johannes Berg 已提交
4726 4727
	trace_api_cqm_rssi_notify(sdata, rssi_event);

4728 4729 4730
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);