mlme.c 166.2 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3
/*
 * BSS client mode implementation
4
 * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
5 6 7 8
 * Copyright 2004, Instant802 Networks, Inc.
 * Copyright 2005, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
9
 * Copyright 2013-2014  Intel Mobile Communications GmbH
10
 * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
11
 * Copyright (C) 2018 - 2020 Intel Corporation
12 13
 */

14
#include <linux/delay.h>
15
#include <linux/fips.h>
16 17 18 19
#include <linux/if_ether.h>
#include <linux/skbuff.h>
#include <linux/if_arp.h>
#include <linux/etherdevice.h>
20
#include <linux/moduleparam.h>
21
#include <linux/rtnetlink.h>
22
#include <linux/crc32.h>
23
#include <linux/slab.h>
24
#include <linux/export.h>
25
#include <net/mac80211.h>
26
#include <asm/unaligned.h>
J
Johannes Berg 已提交
27

28
#include "ieee80211_i.h"
29
#include "driver-ops.h"
J
Johannes Berg 已提交
30 31
#include "rate.h"
#include "led.h"
32
#include "fils_aead.h"
33

34
#define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
35
#define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
36
#define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
37
#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
38 39 40
#define IEEE80211_AUTH_MAX_TRIES	3
#define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
#define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
41
#define IEEE80211_ASSOC_TIMEOUT_LONG	(HZ / 2)
42 43
#define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
#define IEEE80211_ASSOC_MAX_TRIES	3
J
Johannes Berg 已提交
44

45 46 47 48 49 50 51 52 53
static int max_nullfunc_tries = 2;
module_param(max_nullfunc_tries, int, 0644);
MODULE_PARM_DESC(max_nullfunc_tries,
		 "Maximum nullfunc tx tries before disconnecting (reason 4).");

static int max_probe_tries = 5;
module_param(max_probe_tries, int, 0644);
MODULE_PARM_DESC(max_probe_tries,
		 "Maximum probe tries before disconnecting (reason 4).");
J
Johannes Berg 已提交
54 55

/*
56 57 58 59 60 61
 * Beacon loss timeout is calculated as N frames times the
 * advertised beacon interval.  This may need to be somewhat
 * higher than what hardware might detect to account for
 * delays in the host processing frames. But since we also
 * probe on beacon miss before declaring the connection lost
 * default to what we want.
J
Johannes Berg 已提交
62
 */
63 64 65 66
static int beacon_loss_count = 7;
module_param(beacon_loss_count, int, 0644);
MODULE_PARM_DESC(beacon_loss_count,
		 "Number of beacon intervals before we decide beacon was lost.");
67

J
Johannes Berg 已提交
68 69 70 71
/*
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
72
#define IEEE80211_CONNECTION_IDLE_TIME	(30 * HZ)
J
Johannes Berg 已提交
73 74 75 76 77
/*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
78 79 80 81 82
static int probe_wait_ms = 500;
module_param(probe_wait_ms, int, 0644);
MODULE_PARM_DESC(probe_wait_ms,
		 "Maximum time(ms) to wait for probe response"
		 " before disconnecting (reason 4).");
83

84 85 86 87 88 89
/*
 * How many Beacon frames need to have been used in average signal strength
 * before starting to indicate signal change events.
 */
#define IEEE80211_SIGNAL_AVE_MIN_COUNT	4

J
Johannes Berg 已提交
90 91 92 93 94 95 96 97 98 99
/*
 * We can have multiple work items (and connection probing)
 * scheduling this timer, but we need to take care to only
 * reschedule it when it should fire _earlier_ than it was
 * asked for before, or if it's not pending right now. This
 * function ensures that. Note that it then is required to
 * run this function for all timeouts after the first one
 * has happened -- the work that runs from this timer will
 * do that.
 */
100 101
static void run_again(struct ieee80211_sub_if_data *sdata,
		      unsigned long timeout)
J
Johannes Berg 已提交
102
{
103
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
104

105 106 107
	if (!timer_pending(&sdata->u.mgd.timer) ||
	    time_before(timeout, sdata->u.mgd.timer.expires))
		mod_timer(&sdata->u.mgd.timer, timeout);
J
Johannes Berg 已提交
108 109
}

110
void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
111
{
112
	if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
J
Johannes Berg 已提交
113 114
		return;

115
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
116 117
		return;

J
Johannes Berg 已提交
118
	mod_timer(&sdata->u.mgd.bcn_mon_timer,
119
		  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
J
Johannes Berg 已提交
120 121
}

122 123
void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
{
124 125
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

126
	if (unlikely(!ifmgd->associated))
127 128
		return;

129 130
	if (ifmgd->probe_send_count)
		ifmgd->probe_send_count = 0;
131

132
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
133 134
		return;

135
	mod_timer(&ifmgd->conn_mon_timer,
136 137 138
		  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
}

139
static int ecw2cw(int ecw)
J
Johannes Berg 已提交
140
{
141
	return (1 << ecw) - 1;
J
Johannes Berg 已提交
142 143
}

144 145 146 147 148 149
static u32
ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_supported_band *sband,
			     struct ieee80211_channel *channel,
			     const struct ieee80211_ht_operation *ht_oper,
			     const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
150
			     const struct ieee80211_he_operation *he_oper,
151
			     struct cfg80211_chan_def *chandef, bool tracking)
152
{
153
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
154
	struct cfg80211_chan_def vht_chandef;
155
	struct ieee80211_sta_ht_cap sta_ht_cap;
156 157
	u32 ht_cfreq, ret;

158 159 160
	memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

161
	memset(chandef, 0, sizeof(struct cfg80211_chan_def));
162 163 164
	chandef->chan = channel;
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = channel->center_freq;
165
	chandef->freq1_offset = channel->freq_offset;
166

167
	if (!ht_oper || !sta_ht_cap.ht_supported) {
168 169 170
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
171 172 173 174 175 176 177 178
		goto out;
	}

	chandef->width = NL80211_CHAN_WIDTH_20;

	ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
						  channel->band);
	/* check that channel matches the right operating channel */
179
	if (!tracking && channel->center_freq != ht_cfreq) {
180 181 182 183 184 185 186
		/*
		 * It's possible that some APs are confused here;
		 * Netgear WNDR3700 sometimes reports 4 higher than
		 * the actual channel in association responses, but
		 * since we look at probe response/beacon data here
		 * it should be OK.
		 */
187 188 189 190
		sdata_info(sdata,
			   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
			   channel->center_freq, ht_cfreq,
			   ht_oper->primary_chan, channel->band);
191 192 193
		ret = IEEE80211_STA_DISABLE_HT |
		      IEEE80211_STA_DISABLE_VHT |
		      IEEE80211_STA_DISABLE_HE;
194 195 196 197
		goto out;
	}

	/* check 40 MHz support, if we have it */
198
	if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
199
		ieee80211_chandef_ht_oper(ht_oper, chandef);
200 201 202
	} else {
		/* 40 MHz (and 80 MHz) must be supported for VHT */
		ret = IEEE80211_STA_DISABLE_VHT;
203 204
		/* also mark 40 MHz disabled */
		ret |= IEEE80211_STA_DISABLE_40MHZ;
205 206 207 208 209 210 211 212
		goto out;
	}

	if (!vht_oper || !sband->vht_cap.vht_supported) {
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

213
	vht_chandef = *chandef;
L
Luca Coelho 已提交
214 215 216 217 218 219 220 221 222 223 224 225
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && he_oper &&
	    (le32_to_cpu(he_oper->he_oper_params) &
	     IEEE80211_HE_OPERATION_VHT_OPER_INFO)) {
		struct ieee80211_vht_operation he_oper_vht_cap;

		/*
		 * Set only first 3 bytes (other 2 aren't used in
		 * ieee80211_chandef_vht_oper() anyway)
		 */
		memcpy(&he_oper_vht_cap, he_oper->optional, 3);
		he_oper_vht_cap.basic_mcs_set = cpu_to_le16(0);

226 227
		if (!ieee80211_chandef_vht_oper(&sdata->local->hw,
						&he_oper_vht_cap, ht_oper,
L
Luca Coelho 已提交
228 229 230 231 232 233 234
						&vht_chandef)) {
			if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
				sdata_info(sdata,
					   "HE AP VHT information is invalid, disable HE\n");
			ret = IEEE80211_STA_DISABLE_HE;
			goto out;
		}
235 236
	} else if (!ieee80211_chandef_vht_oper(&sdata->local->hw, vht_oper,
					       ht_oper, &vht_chandef)) {
237
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
238
			sdata_info(sdata,
239
				   "AP VHT information is invalid, disable VHT\n");
240 241 242 243 244
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (!cfg80211_chandef_valid(&vht_chandef)) {
245
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
246 247
			sdata_info(sdata,
				   "AP VHT information is invalid, disable VHT\n");
248 249 250 251 252 253 254 255 256 257
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
		ret = 0;
		goto out;
	}

	if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
258
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
259 260
			sdata_info(sdata,
				   "AP VHT information doesn't match HT, disable VHT\n");
261 262 263 264 265 266 267 268 269
		ret = IEEE80211_STA_DISABLE_VHT;
		goto out;
	}

	*chandef = vht_chandef;

	ret = 0;

out:
270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291
	/*
	 * When tracking the current AP, don't do any further checks if the
	 * new chandef is identical to the one we're currently using for the
	 * connection. This keeps us from playing ping-pong with regulatory,
	 * without it the following can happen (for example):
	 *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
	 *  - AP advertises regdom US
	 *  - CRDA loads regdom US with 80 MHz prohibited (old database)
	 *  - the code below detects an unsupported channel, downgrades, and
	 *    we disconnect from the AP in the caller
	 *  - disconnect causes CRDA to reload world regdomain and the game
	 *    starts anew.
	 * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
	 *
	 * It seems possible that there are still scenarios with CSA or real
	 * bandwidth changes where a this could happen, but those cases are
	 * less common and wouldn't completely prevent using the AP.
	 */
	if (tracking &&
	    cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
		return ret;

292 293 294 295
	/* don't print the message below for VHT mismatch if VHT is disabled */
	if (ret & IEEE80211_STA_DISABLE_VHT)
		vht_chandef = *chandef;

296 297 298 299 300 301 302 303
	/*
	 * Ignore the DISABLED flag when we're already connected and only
	 * tracking the APs beacon for bandwidth changes - otherwise we
	 * might get disconnected here if we connect to an AP, update our
	 * regulatory information based on the AP's country IE and the
	 * information we have is wrong/outdated and disables the channel
	 * that we're actually using for the connection to the AP.
	 */
304
	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
305 306
					tracking ? 0 :
						   IEEE80211_CHAN_DISABLED)) {
307 308
		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
			ret = IEEE80211_STA_DISABLE_HT |
309 310
			      IEEE80211_STA_DISABLE_VHT |
			      IEEE80211_STA_DISABLE_HE;
311
			break;
312 313
		}

314
		ret |= ieee80211_chandef_downgrade(chandef);
315 316
	}

317 318
	if (!he_oper || !cfg80211_chandef_usable(sdata->wdev.wiphy, chandef,
						 IEEE80211_CHAN_NO_HE))
319 320
		ret |= IEEE80211_STA_DISABLE_HE;

321
	if (chandef->width != vht_chandef.width && !tracking)
322 323 324 325 326 327 328
		sdata_info(sdata,
			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");

	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
	return ret;
}

329 330
static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
			       struct sta_info *sta,
331
			       const struct ieee80211_ht_cap *ht_cap,
332 333
			       const struct ieee80211_ht_operation *ht_oper,
			       const struct ieee80211_vht_operation *vht_oper,
L
Luca Coelho 已提交
334
			       const struct ieee80211_he_operation *he_oper,
335
			       const u8 *bssid, u32 *changed)
336 337
{
	struct ieee80211_local *local = sdata->local;
338
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
L
Luca Coelho 已提交
339 340 341
	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
	struct ieee80211_supported_band *sband =
		local->hw.wiphy->bands[chan->band];
342
	struct cfg80211_chan_def chandef;
343
	u16 ht_opmode;
344 345 346
	u32 flags;
	enum ieee80211_sta_rx_bandwidth new_sta_bw;
	int ret;
347

348 349
	/* if HT was/is disabled, don't track any bandwidth changes */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
350 351
		return 0;

352 353 354 355
	/* don't check VHT if we associated as non-VHT station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		vht_oper = NULL;

L
Luca Coelho 已提交
356 357 358 359 360
	/* don't check HE if we associated as non-HE station */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HE ||
	    !ieee80211_get_he_sta_cap(sband))
		he_oper = NULL;

361 362 363
	if (WARN_ON_ONCE(!sta))
		return -EINVAL;

364 365 366 367 368 369 370 371 372 373
	/*
	 * if bss configuration changed store the new one -
	 * this may be applicable even if channel is identical
	 */
	ht_opmode = le16_to_cpu(ht_oper->operation_mode);
	if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
		*changed |= BSS_CHANGED_HT;
		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
	}

L
Luca Coelho 已提交
374
	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
375
	flags = ieee80211_determine_chantype(sdata, sband, chan,
L
Luca Coelho 已提交
376
					     ht_oper, vht_oper, he_oper,
377
					     &chandef, true);
378 379 380 381 382 383 384 385 386 387

	/*
	 * Downgrade the new channel if we associated with restricted
	 * capabilities. For example, if we associated as a 20 MHz STA
	 * to a 40 MHz AP (due to regulatory, capabilities or config
	 * reasons) then switching to a 40 MHz channel now won't do us
	 * any good -- we couldn't use it with the AP.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_80P80)
388
		flags |= ieee80211_chandef_downgrade(&chandef);
389 390
	if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
	    chandef.width == NL80211_CHAN_WIDTH_160)
391
		flags |= ieee80211_chandef_downgrade(&chandef);
392 393
	if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
	    chandef.width > NL80211_CHAN_WIDTH_20)
394
		flags |= ieee80211_chandef_downgrade(&chandef);
395 396 397 398 399

	if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
		return 0;

	sdata_info(sdata,
400 401 402 403 404 405
		   "AP %pM changed bandwidth, new config is %d.%03d MHz, "
		   "width %d (%d.%03d/%d MHz)\n",
		   ifmgd->bssid, chandef.chan->center_freq,
		   chandef.chan->freq_offset, chandef.width,
		   chandef.center_freq1, chandef.freq1_offset,
		   chandef.center_freq2);
406 407 408

	if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
				      IEEE80211_STA_DISABLE_VHT |
409
				      IEEE80211_STA_DISABLE_HE |
410 411 412 413 414 415 416 417 418 419 420 421 422 423 424
				      IEEE80211_STA_DISABLE_40MHZ |
				      IEEE80211_STA_DISABLE_80P80MHZ |
				      IEEE80211_STA_DISABLE_160MHZ)) ||
	    !cfg80211_chandef_valid(&chandef)) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth in a way we can't support - disconnect\n",
			   ifmgd->bssid);
		return -EINVAL;
	}

	switch (chandef.width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
		new_sta_bw = IEEE80211_STA_RX_BW_20;
		break;
425
	case NL80211_CHAN_WIDTH_40:
426
		new_sta_bw = IEEE80211_STA_RX_BW_40;
427
		break;
428 429 430 431 432 433
	case NL80211_CHAN_WIDTH_80:
		new_sta_bw = IEEE80211_STA_RX_BW_80;
		break;
	case NL80211_CHAN_WIDTH_80P80:
	case NL80211_CHAN_WIDTH_160:
		new_sta_bw = IEEE80211_STA_RX_BW_160;
434
		break;
435 436
	default:
		return -EINVAL;
437
	}
438

439 440
	if (new_sta_bw > sta->cur_max_bandwidth)
		new_sta_bw = sta->cur_max_bandwidth;
441

442 443 444 445 446
	if (new_sta_bw < sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
	}
447

448 449 450 451 452 453 454
	ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
	if (ret) {
		sdata_info(sdata,
			   "AP %pM changed bandwidth to incompatible one - disconnect\n",
			   ifmgd->bssid);
		return ret;
	}
455

456 457 458 459
	if (new_sta_bw > sta->sta.bandwidth) {
		sta->sta.bandwidth = new_sta_bw;
		rate_control_rate_update(local, sband, sta,
					 IEEE80211_RC_BW_CHANGED);
460
	}
461

462
	return 0;
463 464
}

J
Johannes Berg 已提交
465 466
/* frame sending functions */

J
Johannes Berg 已提交
467
static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
468
				struct sk_buff *skb, u8 ap_ht_param,
J
Johannes Berg 已提交
469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485
				struct ieee80211_supported_band *sband,
				struct ieee80211_channel *channel,
				enum ieee80211_smps_mode smps)
{
	u8 *pos;
	u32 flags = channel->flags;
	u16 cap;
	struct ieee80211_sta_ht_cap ht_cap;

	BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));

	memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
	ieee80211_apply_htcap_overrides(sdata, &ht_cap);

	/* determine capability flags */
	cap = ht_cap.cap;

486
	switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
J
Johannes Berg 已提交
487 488 489 490 491 492 493 494 495 496 497 498 499 500
	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
		if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
		if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
			cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
			cap &= ~IEEE80211_HT_CAP_SGI_40;
		}
		break;
	}

501 502 503 504 505 506 507 508 509 510
	/*
	 * If 40 MHz was disabled associate as though we weren't
	 * capable of 40 MHz -- some broken APs will never fall
	 * back to trying to transmit in 20 MHz.
	 */
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
		cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
		cap &= ~IEEE80211_HT_CAP_SGI_40;
	}

J
Johannes Berg 已提交
511 512 513 514 515 516
	/* set SM PS mode properly */
	cap &= ~IEEE80211_HT_CAP_SM_PS;
	switch (smps) {
	case IEEE80211_SMPS_AUTOMATIC:
	case IEEE80211_SMPS_NUM_MODES:
		WARN_ON(1);
517
		/* fall through */
J
Johannes Berg 已提交
518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536
	case IEEE80211_SMPS_OFF:
		cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_STATIC:
		cap |= WLAN_HT_CAP_SM_PS_STATIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	case IEEE80211_SMPS_DYNAMIC:
		cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
			IEEE80211_HT_CAP_SM_PS_SHIFT;
		break;
	}

	/* reserve and fill IE */
	pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
	ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
}

537 538 539 540
/* This function determines vht capability flags for the association
 * and builds the IE.
 * Note - the function may set the owner of the MU-MIMO capability
 */
541 542
static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb,
543 544
				 struct ieee80211_supported_band *sband,
				 struct ieee80211_vht_cap *ap_vht_cap)
545
{
546
	struct ieee80211_local *local = sdata->local;
547 548 549
	u8 *pos;
	u32 cap;
	struct ieee80211_sta_vht_cap vht_cap;
550
	u32 mask, ap_bf_sts, our_bf_sts;
551 552 553 554

	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));

	memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
555
	ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
556 557 558 559

	/* determine capability flags */
	cap = vht_cap.cap;

J
Johannes Berg 已提交
560
	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
561 562 563 564 565 566
		u32 bw = cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;

		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
		if (bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
		    bw == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
			cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
J
Johannes Berg 已提交
567 568 569 570
	}

	if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
		cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
571
		cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
J
Johannes Berg 已提交
572 573
	}

574 575 576 577 578 579
	/*
	 * Some APs apparently get confused if our capabilities are better
	 * than theirs, so restrict what we advertise in the assoc request.
	 */
	if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597
		cap &= ~(IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
			 IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
	else if (!(ap_vht_cap->vht_cap_info &
			cpu_to_le32(IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
		cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;

	/*
	 * If some other vif is using the MU-MIMO capablity we cannot associate
	 * using MU-MIMO - this will lead to contradictions in the group-id
	 * mechanism.
	 * Ownership is defined since association request, in order to avoid
	 * simultaneous associations with MU-MIMO.
	 */
	if (cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE) {
		bool disable_mu_mimo = false;
		struct ieee80211_sub_if_data *other;

		list_for_each_entry_rcu(other, &local->interfaces, list) {
598
			if (other->vif.mu_mimo_owner) {
599 600 601 602 603 604 605
				disable_mu_mimo = true;
				break;
			}
		}
		if (disable_mu_mimo)
			cap &= ~IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
		else
606
			sdata->vif.mu_mimo_owner = true;
607
	}
608

609 610 611 612 613 614 615 616 617 618
	mask = IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;

	ap_bf_sts = le32_to_cpu(ap_vht_cap->vht_cap_info) & mask;
	our_bf_sts = cap & mask;

	if (ap_bf_sts < our_bf_sts) {
		cap &= ~mask;
		cap |= ap_bf_sts;
	}

619
	/* reserve and fill IE */
M
Mahesh Palivela 已提交
620
	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
621 622 623
	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
}

L
Luca Coelho 已提交
624 625 626 627 628 629 630 631 632
/* This function determines HE capability flags for the association
 * and builds the IE.
 */
static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
				struct sk_buff *skb,
				struct ieee80211_supported_band *sband)
{
	u8 *pos;
	const struct ieee80211_sta_he_cap *he_cap = NULL;
633
	struct ieee80211_chanctx_conf *chanctx_conf;
L
Luca Coelho 已提交
634
	u8 he_cap_size;
635 636 637 638 639 640 641 642 643 644
	bool reg_cap = false;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!WARN_ON_ONCE(!chanctx_conf))
		reg_cap = cfg80211_chandef_usable(sdata->wdev.wiphy,
						  &chanctx_conf->def,
						  IEEE80211_CHAN_NO_HE);

	rcu_read_unlock();
L
Luca Coelho 已提交
645 646

	he_cap = ieee80211_get_he_sta_cap(sband);
647
	if (!he_cap || !reg_cap)
L
Luca Coelho 已提交
648 649 650 651 652 653 654 655 656 657 658 659 660 661 662
		return;

	/*
	 * TODO: the 1 added is because this temporarily is under the EXTENSION
	 * IE. Get rid of it when it moves.
	 */
	he_cap_size =
		2 + 1 + sizeof(he_cap->he_cap_elem) +
		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
				      he_cap->he_cap_elem.phy_cap_info);
	pos = skb_put(skb, he_cap_size);
	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
}

J
Johannes Berg 已提交
663 664 665 666 667 668 669
static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	struct sk_buff *skb;
	struct ieee80211_mgmt *mgmt;
670
	u8 *pos, qos_info, *ie_start;
J
Johannes Berg 已提交
671
	size_t offset = 0, noffset;
672
	int i, count, rates_len, supp_rates_len, shift;
J
Johannes Berg 已提交
673 674
	u16 capab;
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
675 676
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
677
	u32 rates = 0;
678 679 680 681 682 683 684
	struct element *ext_capa = NULL;

	/* we know it's writable, cast away the const */
	if (assoc_data->ie_len)
		ext_capa = (void *)cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY,
						      assoc_data->ie,
						      assoc_data->ie_len);
J
Johannes Berg 已提交
685

686
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
687

J
Johannes Berg 已提交
688 689 690 691 692 693
	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (WARN_ON(!chanctx_conf)) {
		rcu_read_unlock();
		return;
	}
694
	chan = chanctx_conf->def.chan;
J
Johannes Berg 已提交
695 696
	rcu_read_unlock();
	sband = local->hw.wiphy->bands[chan->band];
697
	shift = ieee80211_vif_get_shift(&sdata->vif);
J
Johannes Berg 已提交
698 699 700 701 702 703 704 705

	if (assoc_data->supp_rates_len) {
		/*
		 * Get all rates supported by the device and the AP as
		 * some APs don't like getting a superset of their rates
		 * in the association request (e.g. D-Link DAP 1353 in
		 * b-only mode)...
		 */
706 707 708 709
		rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
						     assoc_data->supp_rates,
						     assoc_data->supp_rates_len,
						     &rates);
J
Johannes Berg 已提交
710 711 712 713 714 715
	} else {
		/*
		 * In case AP not provide any supported rates information
		 * before association, we send information element(s) with
		 * all rates that we support.
		 */
716 717 718 719 720
		rates_len = 0;
		for (i = 0; i < sband->n_bitrates; i++) {
			rates |= BIT(i);
			rates_len++;
		}
J
Johannes Berg 已提交
721 722 723 724 725 726 727 728 729
	}

	skb = alloc_skb(local->hw.extra_tx_headroom +
			sizeof(*mgmt) + /* bit too much but doesn't matter */
			2 + assoc_data->ssid_len + /* SSID */
			4 + rates_len + /* (extended) rates */
			4 + /* power capability */
			2 + 2 * sband->n_channels + /* supported channels */
			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
M
Mahesh Palivela 已提交
730
			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
L
Luca Coelho 已提交
731 732 733
			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
				sizeof(struct ieee80211_he_mcs_nss_supp) +
				IEEE80211_HE_PPE_THRES_MAX_LEN +
J
Johannes Berg 已提交
734
			assoc_data->ie_len + /* extra IEs */
735
			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
J
Johannes Berg 已提交
736 737 738 739 740 741 742 743 744
			9, /* WMM */
			GFP_KERNEL);
	if (!skb)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	capab = WLAN_CAPABILITY_ESS;

745
	if (sband->band == NL80211_BAND_2GHZ) {
746 747
		capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
		capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
J
Johannes Berg 已提交
748 749 750 751 752 753
	}

	if (assoc_data->capability & WLAN_CAPABILITY_PRIVACY)
		capab |= WLAN_CAPABILITY_PRIVACY;

	if ((assoc_data->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
754
	    ieee80211_hw_check(&local->hw, SPECTRUM_MGMT))
J
Johannes Berg 已提交
755 756
		capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;

757 758 759
	if (ifmgd->flags & IEEE80211_STA_ENABLE_RRM)
		capab |= WLAN_CAPABILITY_RADIO_MEASURE;

760
	mgmt = skb_put_zero(skb, 24);
J
Johannes Berg 已提交
761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784
	memcpy(mgmt->da, assoc_data->bss->bssid, ETH_ALEN);
	memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
	memcpy(mgmt->bssid, assoc_data->bss->bssid, ETH_ALEN);

	if (!is_zero_ether_addr(assoc_data->prev_bssid)) {
		skb_put(skb, 10);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_REASSOC_REQ);
		mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.reassoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
		memcpy(mgmt->u.reassoc_req.current_ap, assoc_data->prev_bssid,
		       ETH_ALEN);
	} else {
		skb_put(skb, 4);
		mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						  IEEE80211_STYPE_ASSOC_REQ);
		mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
		mgmt->u.assoc_req.listen_interval =
				cpu_to_le16(local->hw.conf.listen_interval);
	}

	/* SSID */
	pos = skb_put(skb, 2 + assoc_data->ssid_len);
785
	ie_start = pos;
J
Johannes Berg 已提交
786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801
	*pos++ = WLAN_EID_SSID;
	*pos++ = assoc_data->ssid_len;
	memcpy(pos, assoc_data->ssid, assoc_data->ssid_len);

	/* add all rates which were marked to be used above */
	supp_rates_len = rates_len;
	if (supp_rates_len > 8)
		supp_rates_len = 8;

	pos = skb_put(skb, supp_rates_len + 2);
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = supp_rates_len;

	count = 0;
	for (i = 0; i < sband->n_bitrates; i++) {
		if (BIT(i) & rates) {
802 803 804
			int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						5 * (1 << shift));
			*pos++ = (u8) rate;
J
Johannes Berg 已提交
805 806 807 808 809 810 811 812 813 814 815 816
			if (++count == 8)
				break;
		}
	}

	if (rates_len > count) {
		pos = skb_put(skb, rates_len - count + 2);
		*pos++ = WLAN_EID_EXT_SUPP_RATES;
		*pos++ = rates_len - count;

		for (i++; i < sband->n_bitrates; i++) {
			if (BIT(i) & rates) {
817 818 819 820
				int rate;
				rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
						    5 * (1 << shift));
				*pos++ = (u8) rate;
J
Johannes Berg 已提交
821 822 823 824
			}
		}
	}

825 826
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT ||
	    capab & WLAN_CAPABILITY_RADIO_MEASURE) {
J
Johannes Berg 已提交
827 828 829 830
		pos = skb_put(skb, 4);
		*pos++ = WLAN_EID_PWR_CAPABILITY;
		*pos++ = 2;
		*pos++ = 0; /* min tx power */
831 832
		 /* max tx power */
		*pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
833
	}
J
Johannes Berg 已提交
834

835 836 837 838 839 840 841 842 843
	/*
	 * Per spec, we shouldn't include the list of channels if we advertise
	 * support for extended channel switching, but we've always done that;
	 * (for now?) apply this restriction only on the (new) 6 GHz band.
	 */
	if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT &&
	    (sband->band != NL80211_BAND_6GHZ ||
	     !ext_capa || ext_capa->datalen < 1 ||
	     !(ext_capa->data[0] & WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING))) {
J
Johannes Berg 已提交
844 845 846 847 848 849 850 851 852 853 854
		/* TODO: get this in reg domain format */
		pos = skb_put(skb, 2 * sband->n_channels + 2);
		*pos++ = WLAN_EID_SUPPORTED_CHANNELS;
		*pos++ = 2 * sband->n_channels;
		for (i = 0; i < sband->n_channels; i++) {
			*pos++ = ieee80211_frequency_to_channel(
					sband->channels[i].center_freq);
			*pos++ = 1; /* one channel in the subband*/
		}
	}

855 856
	/* Set MBSSID support for HE AP if needed */
	if (ieee80211_hw_check(&local->hw, SUPPORTS_ONLY_HE_MULTI_BSSID) &&
857 858 859
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) && assoc_data->ie_len &&
	    ext_capa && ext_capa->datalen >= 3)
		ext_capa->data[2] |= WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
860

J
Johannes Berg 已提交
861
	/* if present, add any custom IEs that go before HT */
862
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
863 864 865 866 867 868 869 870 871 872
		static const u8 before_ht[] = {
			WLAN_EID_SSID,
			WLAN_EID_SUPP_RATES,
			WLAN_EID_EXT_SUPP_RATES,
			WLAN_EID_PWR_CAPABILITY,
			WLAN_EID_SUPPORTED_CHANNELS,
			WLAN_EID_RSN,
			WLAN_EID_QOS_CAPA,
			WLAN_EID_RRM_ENABLED_CAPABILITIES,
			WLAN_EID_MOBILITY_DOMAIN,
873 874
			WLAN_EID_FAST_BSS_TRANSITION,	/* reassoc only */
			WLAN_EID_RIC_DATA,		/* reassoc only */
J
Johannes Berg 已提交
875 876
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
		};
877 878 879 880
		static const u8 after_ric[] = {
			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
			WLAN_EID_HT_CAPABILITY,
			WLAN_EID_BSS_COEX_2040,
881
			/* luckily this is almost always there */
882 883 884 885
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
886
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
887 888 889 890 891 892 893 894 895 896 897
			WLAN_EID_VHT_CAPABILITY,
			WLAN_EID_OPMODE_NOTIF,
		};

		noffset = ieee80211_ie_split_ric(assoc_data->ie,
						 assoc_data->ie_len,
						 before_ht,
						 ARRAY_SIZE(before_ht),
						 after_ric,
						 ARRAY_SIZE(after_ric),
						 offset);
898
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
899 900 901
		offset = noffset;
	}

J
Johannes Berg 已提交
902 903 904 905
	if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
			 !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

906
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
907
		ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
908
				    sband, chan, sdata->smps_mode);
J
Johannes Berg 已提交
909

910 911 912
	/* if present, add any custom IEs that go before VHT */
	if (assoc_data->ie_len) {
		static const u8 before_vht[] = {
913 914 915 916
			/*
			 * no need to list the ones split off before HT
			 * or generated here
			 */
917 918 919 920 921
			WLAN_EID_BSS_COEX_2040,
			WLAN_EID_EXT_CAPABILITY,
			WLAN_EID_QOS_TRAFFIC_CAPA,
			WLAN_EID_TIM_BCAST_REQ,
			WLAN_EID_INTERWORKING,
922
			/* 60 GHz (Multi-band, DMG, MMS) can't happen */
923
		};
924 925

		/* RIC already taken above, so no need to handle here anymore */
926 927 928
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_vht, ARRAY_SIZE(before_vht),
					     offset);
929
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
930 931 932
		offset = noffset;
	}

L
Luca Coelho 已提交
933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959
	/* if present, add any custom IEs that go before HE */
	if (assoc_data->ie_len) {
		static const u8 before_he[] = {
			/*
			 * no need to list the ones split off before VHT
			 * or generated here
			 */
			WLAN_EID_OPMODE_NOTIF,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FUTURE_CHAN_GUIDANCE,
			/* 11ai elements */
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_SESSION,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_PUBLIC_KEY,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_KEY_CONFIRM,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_HLP_CONTAINER,
			WLAN_EID_EXTENSION, WLAN_EID_EXT_FILS_IP_ADDR_ASSIGN,
			/* TODO: add 11ah/11aj/11ak elements */
		};

		/* RIC already taken above, so no need to handle here anymore */
		noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
					     before_he, ARRAY_SIZE(before_he),
					     offset);
		pos = skb_put(skb, noffset - offset);
		memcpy(pos, assoc_data->ie + offset, noffset - offset);
		offset = noffset;
	}

960
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
961 962
		ieee80211_add_vht_ie(sdata, skb, sband,
				     &assoc_data->ap_vht_cap);
963

964 965 966 967 968 969 970 971 972
	/*
	 * If AP doesn't support HT, mark HE as disabled.
	 * If on the 5GHz band, make sure it supports VHT.
	 */
	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT ||
	    (sband->band == NL80211_BAND_5GHZ &&
	     ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

L
Luca Coelho 已提交
973 974 975 976
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		ieee80211_add_he_ie(sdata, skb, sband);

	/* if present, add any custom non-vendor IEs that go after HE */
977
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
978 979 980
		noffset = ieee80211_ie_split_vendor(assoc_data->ie,
						    assoc_data->ie_len,
						    offset);
981
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
982 983 984
		offset = noffset;
	}

985 986
	if (assoc_data->wmm) {
		if (assoc_data->uapsd) {
987 988
			qos_info = ifmgd->uapsd_queues;
			qos_info |= (ifmgd->uapsd_max_sp_len <<
J
Johannes Berg 已提交
989 990 991 992 993
				     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
		} else {
			qos_info = 0;
		}

994
		pos = ieee80211_add_wmm_info_ie(skb_put(skb, 9), qos_info);
J
Johannes Berg 已提交
995 996 997
	}

	/* add any remaining custom (i.e. vendor specific here) IEs */
998
	if (assoc_data->ie_len) {
J
Johannes Berg 已提交
999
		noffset = assoc_data->ie_len;
1000
		skb_put_data(skb, assoc_data->ie + offset, noffset - offset);
J
Johannes Berg 已提交
1001 1002
	}

1003 1004 1005 1006 1007 1008
	if (assoc_data->fils_kek_len &&
	    fils_encrypt_assoc_req(skb, assoc_data) < 0) {
		dev_kfree_skb(skb);
		return;
	}

1009 1010 1011 1012 1013
	pos = skb_tail_pointer(skb);
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = kmemdup(ie_start, pos - ie_start, GFP_ATOMIC);
	ifmgd->assoc_req_ies_len = pos - ie_start;

1014
	drv_mgd_prepare_tx(local, sdata, 0);
J
Johannes Berg 已提交
1015

J
Johannes Berg 已提交
1016
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
1017
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1018 1019
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
						IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
1020 1021 1022
	ieee80211_tx_skb(sdata, skb);
}

1023 1024 1025 1026 1027 1028
void ieee80211_send_pspoll(struct ieee80211_local *local,
			   struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_pspoll *pspoll;
	struct sk_buff *skb;

1029 1030
	skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
	if (!skb)
1031 1032
		return;

1033 1034
	pspoll = (struct ieee80211_pspoll *) skb->data;
	pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1035

1036 1037
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
1038 1039
}

1040 1041
void ieee80211_send_nullfunc(struct ieee80211_local *local,
			     struct ieee80211_sub_if_data *sdata,
1042
			     bool powersave)
1043 1044
{
	struct sk_buff *skb;
1045
	struct ieee80211_hdr_3addr *nullfunc;
1046
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1047

L
Luca Coelho 已提交
1048 1049 1050 1051 1052
	/* Don't send NDPs when STA is connected HE */
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
		return;

1053 1054
	skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
		!ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
1055
	if (!skb)
1056 1057
		return;

1058
	nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
1059
	if (powersave)
1060
		nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
1061

1062 1063
	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
					IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
1064

1065
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1066 1067
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

1068
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
1069 1070
		IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;

1071
	ieee80211_tx_skb(sdata, skb);
1072 1073
}

1074 1075 1076 1077 1078 1079 1080 1081 1082 1083
static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
					  struct ieee80211_sub_if_data *sdata)
{
	struct sk_buff *skb;
	struct ieee80211_hdr *nullfunc;
	__le16 fc;

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return;

L
Luca Coelho 已提交
1084 1085 1086 1087
	/* Don't send NDPs when connected HE */
	if (!(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
		return;

1088
	skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
1089
	if (!skb)
1090
		return;
1091

1092 1093
	skb_reserve(skb, local->hw.extra_tx_headroom);

1094
	nullfunc = skb_put_zero(skb, 30);
1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
			 IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
	nullfunc->frame_control = fc;
	memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
	memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
	memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);

	IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
	ieee80211_tx_skb(sdata, skb);
}

1107 1108 1109 1110 1111
/* spectrum management related things */
static void ieee80211_chswitch_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
1112
	struct ieee80211_local *local = sdata->local;
1113
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1114
	int ret;
1115

1116
	if (!ieee80211_sdata_running(sdata))
1117 1118
		return;

1119
	sdata_lock(sdata);
1120 1121 1122
	mutex_lock(&local->mtx);
	mutex_lock(&local->chanctx_mtx);

1123 1124
	if (!ifmgd->associated)
		goto out;
1125

1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136
	if (!sdata->vif.csa_active)
		goto out;

	/*
	 * using reservation isn't immediate as it may be deferred until later
	 * with multi-vif. once reservation is complete it will re-schedule the
	 * work with no reserved_chanctx so verify chandef to check if it
	 * completed successfully
	 */

	if (sdata->reserved_chanctx) {
1137 1138 1139 1140
		struct ieee80211_supported_band *sband = NULL;
		struct sta_info *mgd_sta = NULL;
		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;

1141 1142 1143 1144 1145 1146 1147 1148
		/*
		 * with multi-vif csa driver may call ieee80211_csa_finish()
		 * many times while waiting for other interfaces to use their
		 * reservations
		 */
		if (sdata->reserved_ready)
			goto out;

1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190
		if (sdata->vif.bss_conf.chandef.width !=
		    sdata->csa_chandef.width) {
			/*
			 * For managed interface, we need to also update the AP
			 * station bandwidth and align the rate scale algorithm
			 * on the bandwidth change. Here we only consider the
			 * bandwidth of the new channel definition (as channel
			 * switch flow does not have the full HT/VHT/HE
			 * information), assuming that if additional changes are
			 * required they would be done as part of the processing
			 * of the next beacon from the AP.
			 */
			switch (sdata->csa_chandef.width) {
			case NL80211_CHAN_WIDTH_20_NOHT:
			case NL80211_CHAN_WIDTH_20:
			default:
				bw = IEEE80211_STA_RX_BW_20;
				break;
			case NL80211_CHAN_WIDTH_40:
				bw = IEEE80211_STA_RX_BW_40;
				break;
			case NL80211_CHAN_WIDTH_80:
				bw = IEEE80211_STA_RX_BW_80;
				break;
			case NL80211_CHAN_WIDTH_80P80:
			case NL80211_CHAN_WIDTH_160:
				bw = IEEE80211_STA_RX_BW_160;
				break;
			}

			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
			sband =
				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
		}

		if (sdata->vif.bss_conf.chandef.width >
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1191 1192 1193 1194 1195 1196 1197 1198 1199 1200
		ret = ieee80211_vif_use_reserved_context(sdata);
		if (ret) {
			sdata_info(sdata,
				   "failed to use reserved channel context, disconnecting (err=%d)\n",
				   ret);
			ieee80211_queue_work(&sdata->local->hw,
					     &ifmgd->csa_connection_drop_work);
			goto out;
		}

1201 1202 1203 1204 1205 1206 1207
		if (sdata->vif.bss_conf.chandef.width <
		    sdata->csa_chandef.width) {
			mgd_sta->sta.bandwidth = bw;
			rate_control_rate_update(local, sband, mgd_sta,
						 IEEE80211_RC_BW_CHANGED);
		}

1208 1209 1210 1211 1212
		goto out;
	}

	if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
					&sdata->csa_chandef)) {
1213
		sdata_info(sdata,
1214
			   "failed to finalize channel switch, disconnecting\n");
1215 1216 1217 1218
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
		goto out;
	}
1219

1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239
	ifmgd->csa_waiting_bcn = true;

	ieee80211_sta_reset_beacon_monitor(sdata);
	ieee80211_sta_reset_conn_monitor(sdata);

out:
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
	sdata_unlock(sdata);
}

static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	int ret;

	sdata_assert_lock(sdata);

	WARN_ON(!sdata->vif.csa_active);
1240

1241 1242 1243 1244 1245
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
1246

1247 1248 1249
	sdata->vif.csa_active = false;
	ifmgd->csa_waiting_bcn = false;

1250 1251 1252 1253 1254 1255
	ret = drv_post_channel_switch(sdata);
	if (ret) {
		sdata_info(sdata,
			   "driver post channel switch failed, disconnecting\n");
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
1256
		return;
1257
	}
1258 1259

	cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
1260 1261
}

1262 1263
void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
{
J
Johannes Berg 已提交
1264 1265
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1266 1267 1268

	trace_api_chswitch_done(sdata, success);
	if (!success) {
1269 1270 1271 1272 1273 1274
		sdata_info(sdata,
			   "driver channel switch failed, disconnecting\n");
		ieee80211_queue_work(&sdata->local->hw,
				     &ifmgd->csa_connection_drop_work);
	} else {
		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
1275 1276 1277 1278
	}
}
EXPORT_SYMBOL(ieee80211_chswitch_done);

1279
static void ieee80211_chswitch_timer(struct timer_list *t)
1280 1281
{
	struct ieee80211_sub_if_data *sdata =
1282
		from_timer(sdata, t, u.mgd.chswitch_timer);
1283

1284
	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
1285 1286
}

1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312
static void
ieee80211_sta_abort_chanswitch(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	if (!local->ops->abort_channel_switch)
		return;

	mutex_lock(&local->mtx);

	mutex_lock(&local->chanctx_mtx);
	ieee80211_vif_unreserve_chanctx(sdata);
	mutex_unlock(&local->chanctx_mtx);

	if (sdata->csa_block_tx)
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);

	sdata->csa_block_tx = false;
	sdata->vif.csa_active = false;

	mutex_unlock(&local->mtx);

	drv_abort_channel_switch(sdata);
}

1313
static void
J
Johannes Berg 已提交
1314
ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
1315 1316
				 u64 timestamp, u32 device_timestamp,
				 struct ieee802_11_elems *elems,
1317
				 bool beacon)
1318
{
1319
	struct ieee80211_local *local = sdata->local;
1320
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1321
	struct cfg80211_bss *cbss = ifmgd->associated;
1322
	struct ieee80211_chanctx_conf *conf;
J
Johannes Berg 已提交
1323
	struct ieee80211_chanctx *chanctx;
1324
	enum nl80211_band current_band;
1325
	struct ieee80211_csa_ie csa_ie;
1326
	struct ieee80211_channel_switch ch_switch;
1327
	int res;
1328

1329
	sdata_assert_lock(sdata);
1330

1331
	if (!cbss)
1332 1333
		return;

1334
	if (local->scanning)
1335 1336
		return;

1337
	current_band = cbss->channel->band;
1338
	res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
1339
					   ifmgd->flags,
1340
					   ifmgd->associated->bssid, &csa_ie);
1341 1342 1343 1344

	if (!res) {
		ch_switch.timestamp = timestamp;
		ch_switch.device_timestamp = device_timestamp;
1345
		ch_switch.block_tx = csa_ie.mode;
1346 1347 1348 1349 1350
		ch_switch.chandef = csa_ie.chandef;
		ch_switch.count = csa_ie.count;
		ch_switch.delay = csa_ie.max_switch_time;
	}

1351
	if (res < 0) {
1352
		ieee80211_queue_work(&local->hw,
1353
				     &ifmgd->csa_connection_drop_work);
1354
		return;
1355 1356
	}

1357 1358 1359 1360 1361
	if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {
		if (res)
			ieee80211_sta_abort_chanswitch(sdata);
		else
			drv_channel_switch_rx_beacon(sdata, &ch_switch);
1362 1363 1364 1365 1366
		return;
	} else if (sdata->vif.csa_active || res) {
		/* disregard subsequent announcements if already processing */
		return;
	}
1367

1368
	if (!cfg80211_chandef_usable(local->hw.wiphy, &csa_ie.chandef,
1369 1370
				     IEEE80211_CHAN_DISABLED)) {
		sdata_info(sdata,
1371 1372 1373
			   "AP %pM switches to unsupported channel "
			   "(%d.%03d MHz, width:%d, CF1/2: %d.%03d/%d MHz), "
			   "disconnecting\n",
1374
			   ifmgd->associated->bssid,
1375
			   csa_ie.chandef.chan->center_freq,
1376
			   csa_ie.chandef.chan->freq_offset,
1377
			   csa_ie.chandef.width, csa_ie.chandef.center_freq1,
1378
			   csa_ie.chandef.freq1_offset,
1379
			   csa_ie.chandef.center_freq2);
1380 1381 1382 1383 1384
		ieee80211_queue_work(&local->hw,
				     &ifmgd->csa_connection_drop_work);
		return;
	}

1385
	if (cfg80211_chandef_identical(&csa_ie.chandef,
1386 1387
				       &sdata->vif.bss_conf.chandef) &&
	    (!csa_ie.mode || !beacon)) {
1388 1389 1390 1391 1392 1393 1394 1395 1396
		if (ifmgd->csa_ignored_same_chan)
			return;
		sdata_info(sdata,
			   "AP %pM tries to chanswitch to same channel, ignore\n",
			   ifmgd->associated->bssid);
		ifmgd->csa_ignored_same_chan = true;
		return;
	}

1397 1398 1399 1400 1401 1402 1403 1404
	/*
	 * Drop all TDLS peers - either we disconnect or move to a different
	 * channel from this point on. There's no telling what our peer will do.
	 * The TDLS WIDER_BW scenario is also problematic, as peers might now
	 * have an incompatible wider chandef.
	 */
	ieee80211_teardown_tdls_peers(sdata);

1405
	mutex_lock(&local->mtx);
1406
	mutex_lock(&local->chanctx_mtx);
1407 1408 1409 1410 1411
	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
					 lockdep_is_held(&local->chanctx_mtx));
	if (!conf) {
		sdata_info(sdata,
			   "no channel context assigned to vif?, disconnecting\n");
1412
		goto drop_connection;
1413 1414 1415 1416
	}

	chanctx = container_of(conf, struct ieee80211_chanctx, conf);

1417
	if (local->use_chanctx &&
1418
	    !ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA)) {
1419 1420
		sdata_info(sdata,
			   "driver doesn't support chan-switch with channel contexts\n");
1421
		goto drop_connection;
J
Johannes Berg 已提交
1422 1423
	}

1424 1425 1426
	if (drv_pre_channel_switch(sdata, &ch_switch)) {
		sdata_info(sdata,
			   "preparing for channel switch failed, disconnecting\n");
1427
		goto drop_connection;
1428 1429
	}

1430 1431 1432
	res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
					    chanctx->mode, false);
	if (res) {
J
Johannes Berg 已提交
1433
		sdata_info(sdata,
1434 1435
			   "failed to reserve channel context for channel switch, disconnecting (err=%d)\n",
			   res);
1436
		goto drop_connection;
J
Johannes Berg 已提交
1437
	}
1438
	mutex_unlock(&local->chanctx_mtx);
J
Johannes Berg 已提交
1439

1440
	sdata->vif.csa_active = true;
1441
	sdata->csa_chandef = csa_ie.chandef;
1442
	sdata->csa_block_tx = csa_ie.mode;
1443
	ifmgd->csa_ignored_same_chan = false;
J
Johannes Berg 已提交
1444

1445
	if (sdata->csa_block_tx)
1446 1447
		ieee80211_stop_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
1448
	mutex_unlock(&local->mtx);
1449

1450 1451 1452
	cfg80211_ch_switch_started_notify(sdata->dev, &csa_ie.chandef,
					  csa_ie.count);

1453
	if (local->ops->channel_switch) {
1454
		/* use driver's channel switch callback */
1455
		drv_channel_switch(local, sdata, &ch_switch);
1456 1457 1458 1459
		return;
	}

	/* channel switch handled in software */
1460
	if (csa_ie.count <= 1)
1461
		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
1462
	else
1463
		mod_timer(&ifmgd->chswitch_timer,
1464 1465
			  TU_TO_EXP_TIME((csa_ie.count - 1) *
					 cbss->beacon_interval));
1466 1467
	return;
 drop_connection:
1468 1469 1470 1471 1472 1473 1474 1475
	/*
	 * This is just so that the disconnect flow will know that
	 * we were trying to switch channel and failed. In case the
	 * mode is 1 (we are not allowed to Tx), we will know not to
	 * send a deauthentication frame. Those two fields will be
	 * reset when the disconnection worker runs.
	 */
	sdata->vif.csa_active = true;
1476
	sdata->csa_block_tx = csa_ie.mode;
1477

1478 1479 1480
	ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
	mutex_unlock(&local->chanctx_mtx);
	mutex_unlock(&local->mtx);
1481 1482
}

1483 1484 1485 1486 1487 1488
static bool
ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
				 struct ieee80211_channel *channel,
				 const u8 *country_ie, u8 country_ie_len,
				 const u8 *pwr_constr_elem,
				 int *chan_pwr, int *pwr_reduction)
1489
{
1490 1491
	struct ieee80211_country_ie_triplet *triplet;
	int chan = ieee80211_frequency_to_channel(channel->center_freq);
1492
	int i, chan_increment;
1493
	bool have_chan_pwr = false;
1494

1495 1496
	/* Invalid IE */
	if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
1497
		return false;
1498

1499 1500 1501 1502 1503 1504 1505
	triplet = (void *)(country_ie + 3);
	country_ie_len -= 3;

	switch (channel->band) {
	default:
		WARN_ON_ONCE(1);
		/* fall through */
1506 1507
	case NL80211_BAND_2GHZ:
	case NL80211_BAND_60GHZ:
1508 1509
		chan_increment = 1;
		break;
1510
	case NL80211_BAND_5GHZ:
1511 1512
		chan_increment = 4;
		break;
1513
	}
1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524

	/* find channel */
	while (country_ie_len >= 3) {
		u8 first_channel = triplet->chans.first_channel;

		if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
			goto next;

		for (i = 0; i < triplet->chans.num_channels; i++) {
			if (first_channel + i * chan_increment == chan) {
				have_chan_pwr = true;
1525
				*chan_pwr = triplet->chans.max_power;
1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536
				break;
			}
		}
		if (have_chan_pwr)
			break;

 next:
		triplet++;
		country_ie_len -= 3;
	}

1537
	if (have_chan_pwr && pwr_constr_elem)
1538
		*pwr_reduction = *pwr_constr_elem;
1539 1540 1541
	else
		*pwr_reduction = 0;

1542 1543 1544
	return have_chan_pwr;
}

1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558
static void ieee80211_find_cisco_dtpc(struct ieee80211_sub_if_data *sdata,
				      struct ieee80211_channel *channel,
				      const u8 *cisco_dtpc_ie,
				      int *pwr_level)
{
	/* From practical testing, the first data byte of the DTPC element
	 * seems to contain the requested dBm level, and the CLI on Cisco
	 * APs clearly state the range is -127 to 127 dBm, which indicates
	 * a signed byte, although it seemingly never actually goes negative.
	 * The other byte seems to always be zero.
	 */
	*pwr_level = (__s8)cisco_dtpc_ie[4];
}

1559 1560 1561 1562
static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_channel *channel,
				       struct ieee80211_mgmt *mgmt,
				       const u8 *country_ie, u8 country_ie_len,
1563 1564
				       const u8 *pwr_constr_ie,
				       const u8 *cisco_dtpc_ie)
1565
{
1566 1567 1568
	bool has_80211h_pwr = false, has_cisco_pwr = false;
	int chan_pwr = 0, pwr_reduction_80211h = 0;
	int pwr_level_cisco, pwr_level_80211h;
1569
	int new_ap_level;
1570
	__le16 capab = mgmt->u.probe_resp.capab_info;
1571

1572 1573 1574
	if (country_ie &&
	    (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
	     capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
1575 1576 1577
		has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
			sdata, channel, country_ie, country_ie_len,
			pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
1578 1579 1580 1581 1582 1583 1584 1585
		pwr_level_80211h =
			max_t(int, 0, chan_pwr - pwr_reduction_80211h);
	}

	if (cisco_dtpc_ie) {
		ieee80211_find_cisco_dtpc(
			sdata, channel, cisco_dtpc_ie, &pwr_level_cisco);
		has_cisco_pwr = true;
1586
	}
1587

1588
	if (!has_80211h_pwr && !has_cisco_pwr)
1589
		return 0;
1590

1591 1592 1593 1594 1595
	/* If we have both 802.11h and Cisco DTPC, apply both limits
	 * by picking the smallest of the two power levels advertised.
	 */
	if (has_80211h_pwr &&
	    (!has_cisco_pwr || pwr_level_80211h <= pwr_level_cisco)) {
1596 1597 1598 1599 1600
		new_ap_level = pwr_level_80211h;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1601 1602 1603 1604
		sdata_dbg(sdata,
			  "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
			  pwr_level_80211h, chan_pwr, pwr_reduction_80211h,
			  sdata->u.mgd.bssid);
1605
	} else {  /* has_cisco_pwr is always true here. */
1606 1607 1608 1609 1610
		new_ap_level = pwr_level_cisco;

		if (sdata->ap_power_level == new_ap_level)
			return 0;

1611 1612 1613
		sdata_dbg(sdata,
			  "Limiting TX power to %d dBm as advertised by %pM\n",
			  pwr_level_cisco, sdata->u.mgd.bssid);
1614
	}
1615

1616 1617 1618 1619
	sdata->ap_power_level = new_ap_level;
	if (__ieee80211_recalc_txpower(sdata))
		return BSS_CHANGED_TXPOWER;
	return 0;
1620 1621
}

1622 1623 1624 1625 1626 1627
/* powersave */
static void ieee80211_enable_ps(struct ieee80211_local *local,
				struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_conf *conf = &local->hw.conf;

J
Johannes Berg 已提交
1628 1629 1630 1631
	/*
	 * If we are scanning right now then the parameters will
	 * take effect when scan finishes.
	 */
1632
	if (local->scanning)
J
Johannes Berg 已提交
1633 1634
		return;

1635
	if (conf->dynamic_ps_timeout > 0 &&
1636
	    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) {
1637 1638 1639
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(conf->dynamic_ps_timeout));
	} else {
1640
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
1641
			ieee80211_send_nullfunc(local, sdata, true);
1642

1643 1644
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
		    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
1645 1646 1647 1648
			return;

		conf->flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665
	}
}

static void ieee80211_change_ps(struct ieee80211_local *local)
{
	struct ieee80211_conf *conf = &local->hw.conf;

	if (local->ps_sdata) {
		ieee80211_enable_ps(local, local->ps_sdata);
	} else if (conf->flags & IEEE80211_CONF_PS) {
		conf->flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
		del_timer_sync(&local->dynamic_ps_timer);
		cancel_work_sync(&local->dynamic_ps_enable_work);
	}
}

1666 1667 1668 1669
static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *mgd = &sdata->u.mgd;
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1670
	bool authorized = false;
1671 1672 1673 1674

	if (!mgd->powersave)
		return false;

1675 1676 1677
	if (mgd->broken_ap)
		return false;

1678 1679 1680
	if (!mgd->associated)
		return false;

1681
	if (mgd->flags & IEEE80211_STA_CONNECTION_POLL)
1682 1683
		return false;

1684
	if (!mgd->have_beacon)
1685 1686
		return false;

1687 1688 1689
	rcu_read_lock();
	sta = sta_info_get(sdata, mgd->bssid);
	if (sta)
J
Johannes Berg 已提交
1690
		authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1691 1692
	rcu_read_unlock();

J
Johannes Berg 已提交
1693
	return authorized;
1694 1695
}

1696
/* need to hold RTNL or interface lock */
J
Johannes Berg 已提交
1697
void ieee80211_recalc_ps(struct ieee80211_local *local)
1698 1699 1700
{
	struct ieee80211_sub_if_data *sdata, *found = NULL;
	int count = 0;
1701
	int timeout;
1702

1703
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS)) {
1704 1705 1706 1707 1708
		local->ps_sdata = NULL;
		return;
	}

	list_for_each_entry(sdata, &local->interfaces, list) {
1709
		if (!ieee80211_sdata_running(sdata))
1710
			continue;
1711 1712 1713 1714 1715 1716 1717 1718
		if (sdata->vif.type == NL80211_IFTYPE_AP) {
			/* If an AP vif is found, then disable PS
			 * by setting the count to zero thereby setting
			 * ps_sdata to NULL.
			 */
			count = 0;
			break;
		}
1719 1720 1721 1722 1723 1724
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			continue;
		found = sdata;
		count++;
	}

1725
	if (count == 1 && ieee80211_powersave_allowed(found)) {
J
Johannes Berg 已提交
1726
		u8 dtimper = found->u.mgd.dtim_period;
1727

1728
		timeout = local->dynamic_ps_forced_timeout;
J
Johannes Berg 已提交
1729 1730
		if (timeout < 0)
			timeout = 100;
1731
		local->hw.conf.dynamic_ps_timeout = timeout;
1732

J
Johannes Berg 已提交
1733 1734 1735 1736 1737 1738
		/* If the TIM IE is invalid, pretend the value is 1 */
		if (!dtimper)
			dtimper = 1;

		local->hw.conf.ps_dtim_period = dtimper;
		local->ps_sdata = found;
1739
	} else {
1740
		local->ps_sdata = NULL;
1741
	}
1742 1743 1744 1745

	ieee80211_change_ps(local);
}

E
Eliad Peller 已提交
1746 1747 1748 1749 1750 1751 1752 1753 1754 1755
void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
{
	bool ps_allowed = ieee80211_powersave_allowed(sdata);

	if (sdata->vif.bss_conf.ps != ps_allowed) {
		sdata->vif.bss_conf.ps = ps_allowed;
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
	}
}

1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767
void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_disable_work);

	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}

	ieee80211_wake_queues_by_reason(&local->hw,
1768
					IEEE80211_MAX_QUEUE_MAP,
1769 1770
					IEEE80211_QUEUE_STOP_REASON_PS,
					false);
1771 1772 1773 1774 1775 1776 1777 1778
}

void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
{
	struct ieee80211_local *local =
		container_of(work, struct ieee80211_local,
			     dynamic_ps_enable_work);
	struct ieee80211_sub_if_data *sdata = local->ps_sdata;
1779
	struct ieee80211_if_managed *ifmgd;
1780 1781
	unsigned long flags;
	int q;
1782 1783 1784 1785 1786

	/* can only happen when PS was just disabled anyway */
	if (!sdata)
		return;

1787 1788
	ifmgd = &sdata->u.mgd;

1789 1790 1791
	if (local->hw.conf.flags & IEEE80211_CONF_PS)
		return;

1792
	if (local->hw.conf.dynamic_ps_timeout > 0) {
1793 1794
		/* don't enter PS if TX frames are pending */
		if (drv_tx_frames_pending(local)) {
1795 1796 1797 1798 1799
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
			return;
		}
1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817

		/*
		 * transmission can be stopped by others which leads to
		 * dynamic_ps_timer expiry. Postpone the ps timer if it
		 * is not the actual idle state.
		 */
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		for (q = 0; q < local->hw.queues; q++) {
			if (local->queue_stop_reasons[q]) {
				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				mod_timer(&local->dynamic_ps_timer, jiffies +
					  msecs_to_jiffies(
					  local->hw.conf.dynamic_ps_timeout));
				return;
			}
		}
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1818 1819
	}

1820
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
1821
	    !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
1822
		if (drv_tx_frames_pending(local)) {
1823 1824 1825
			mod_timer(&local->dynamic_ps_timer, jiffies +
				  msecs_to_jiffies(
				  local->hw.conf.dynamic_ps_timeout));
1826
		} else {
1827
			ieee80211_send_nullfunc(local, sdata, true);
1828
			/* Flush to get the tx status of nullfunc frame */
1829
			ieee80211_flush_queues(local, sdata, false);
1830
		}
1831 1832
	}

1833 1834
	if (!(ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
	      ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) ||
1835 1836 1837 1838 1839
	    (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
		local->hw.conf.flags |= IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
1840 1841
}

1842
void ieee80211_dynamic_ps_timer(struct timer_list *t)
1843
{
1844
	struct ieee80211_local *local = from_timer(local, t, dynamic_ps_timer);
1845

1846
	ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
1847 1848
}

1849 1850
void ieee80211_dfs_cac_timer_work(struct work_struct *work)
{
1851
	struct delayed_work *delayed_work = to_delayed_work(work);
1852 1853 1854
	struct ieee80211_sub_if_data *sdata =
		container_of(delayed_work, struct ieee80211_sub_if_data,
			     dfs_cac_timer_work);
1855
	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
1856

1857 1858 1859 1860 1861 1862 1863 1864
	mutex_lock(&sdata->local->mtx);
	if (sdata->wdev.cac_started) {
		ieee80211_vif_release_channel(sdata);
		cfg80211_cac_event(sdata->dev, &chandef,
				   NL80211_RADAR_CAC_FINISHED,
				   GFP_KERNEL);
	}
	mutex_unlock(&sdata->local->mtx);
1865 1866
}

1867 1868 1869 1870 1871
static bool
__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1872
	bool ret = false;
1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916
	int ac;

	if (local->hw.queues < IEEE80211_NUM_ACS)
		return false;

	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
		int non_acm_ac;
		unsigned long now = jiffies;

		if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
		    tx_tspec->admitted_time &&
		    time_after(now, tx_tspec->time_slice_start + HZ)) {
			tx_tspec->consumed_tx_time = 0;
			tx_tspec->time_slice_start = now;

			if (tx_tspec->downgraded)
				tx_tspec->action =
					TX_TSPEC_ACTION_STOP_DOWNGRADE;
		}

		switch (tx_tspec->action) {
		case TX_TSPEC_ACTION_STOP_DOWNGRADE:
			/* take the original parameters */
			if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			tx_tspec->downgraded = false;
			ret = true;
			break;
		case TX_TSPEC_ACTION_DOWNGRADE:
			if (time_after(now, tx_tspec->time_slice_start + HZ)) {
				tx_tspec->action = TX_TSPEC_ACTION_NONE;
				ret = true;
				break;
			}
			/* downgrade next lower non-ACM AC */
			for (non_acm_ac = ac + 1;
			     non_acm_ac < IEEE80211_NUM_ACS;
			     non_acm_ac++)
				if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
					break;
1917 1918 1919 1920 1921 1922
			/* Usually the loop will result in using BK even if it
			 * requires admission control, but such a configuration
			 * makes no sense and we have to transmit somehow - the
			 * AC selection does the same thing.
			 * If we started out trying to downgrade from BK, then
			 * the extra condition here might be needed.
1923
			 */
1924 1925
			if (non_acm_ac >= IEEE80211_NUM_ACS)
				non_acm_ac = IEEE80211_AC_BK;
1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959
			if (drv_conf_tx(local, sdata, ac,
					&sdata->tx_conf[non_acm_ac]))
				sdata_err(sdata,
					  "failed to set TX queue parameters for queue %d\n",
					  ac);
			tx_tspec->action = TX_TSPEC_ACTION_NONE;
			ret = true;
			schedule_delayed_work(&ifmgd->tx_tspec_wk,
				tx_tspec->time_slice_start + HZ - now + 1);
			break;
		case TX_TSPEC_ACTION_NONE:
			/* nothing now */
			break;
		}
	}

	return ret;
}

void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
{
	if (__ieee80211_sta_handle_tspec_ac_params(sdata))
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
}

static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata;

	sdata = container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.tx_tspec_wk.work);
	ieee80211_sta_handle_tspec_ac_params(sdata);
}

J
Johannes Berg 已提交
1960
/* MLME */
L
Luca Coelho 已提交
1961 1962 1963 1964 1965
static bool
ieee80211_sta_wmm_params(struct ieee80211_local *local,
			 struct ieee80211_sub_if_data *sdata,
			 const u8 *wmm_param, size_t wmm_param_len,
			 const struct ieee80211_mu_edca_param_set *mu_edca)
1966
{
1967
	struct ieee80211_tx_queue_params params[IEEE80211_NUM_ACS];
1968
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
1969
	size_t left;
1970
	int count, mu_edca_count, ac;
J
Johannes Berg 已提交
1971 1972
	const u8 *pos;
	u8 uapsd_queues = 0;
1973

1974
	if (!local->ops->conf_tx)
1975
		return false;
1976

J
Johannes Berg 已提交
1977
	if (local->hw.queues < IEEE80211_NUM_ACS)
1978
		return false;
1979 1980

	if (!wmm_param)
1981
		return false;
1982

1983
	if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
1984
		return false;
K
Kalle Valo 已提交
1985 1986

	if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
1987
		uapsd_queues = ifmgd->uapsd_queues;
K
Kalle Valo 已提交
1988

1989
	count = wmm_param[6] & 0x0f;
1990 1991 1992 1993 1994 1995 1996
	/* -1 is the initial value of ifmgd->mu_edca_last_param_set.
	 * if mu_edca was preset before and now it disappeared tell
	 * the driver about it.
	 */
	mu_edca_count = mu_edca ? mu_edca->mu_qos_info & 0x0f : -1;
	if (count == ifmgd->wmm_last_param_set &&
	    mu_edca_count == ifmgd->mu_edca_last_param_set)
1997
		return false;
1998
	ifmgd->wmm_last_param_set = count;
1999
	ifmgd->mu_edca_last_param_set = mu_edca_count;
2000 2001 2002 2003 2004 2005

	pos = wmm_param + 8;
	left = wmm_param_len - 8;

	memset(&params, 0, sizeof(params));

Y
Yoni Divinsky 已提交
2006
	sdata->wmm_acm = 0;
2007 2008 2009
	for (; left >= 4; left -= 4, pos += 4) {
		int aci = (pos[0] >> 5) & 0x03;
		int acm = (pos[0] >> 4) & 0x01;
K
Kalle Valo 已提交
2010
		bool uapsd = false;
2011 2012

		switch (aci) {
2013
		case 1: /* AC_BK */
2014
			ac = IEEE80211_AC_BK;
J
Johannes Berg 已提交
2015
			if (acm)
Y
Yoni Divinsky 已提交
2016
				sdata->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
K
Kalle Valo 已提交
2017 2018
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
				uapsd = true;
L
Luca Coelho 已提交
2019 2020 2021
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_bk;
2022
			break;
2023
		case 2: /* AC_VI */
2024
			ac = IEEE80211_AC_VI;
J
Johannes Berg 已提交
2025
			if (acm)
Y
Yoni Divinsky 已提交
2026
				sdata->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
K
Kalle Valo 已提交
2027 2028
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
				uapsd = true;
L
Luca Coelho 已提交
2029 2030 2031
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vi;
2032
			break;
2033
		case 3: /* AC_VO */
2034
			ac = IEEE80211_AC_VO;
J
Johannes Berg 已提交
2035
			if (acm)
Y
Yoni Divinsky 已提交
2036
				sdata->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
K
Kalle Valo 已提交
2037 2038
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
				uapsd = true;
L
Luca Coelho 已提交
2039 2040 2041
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_vo;
2042
			break;
2043
		case 0: /* AC_BE */
2044
		default:
2045
			ac = IEEE80211_AC_BE;
J
Johannes Berg 已提交
2046
			if (acm)
Y
Yoni Divinsky 已提交
2047
				sdata->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
K
Kalle Valo 已提交
2048 2049
			if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
				uapsd = true;
L
Luca Coelho 已提交
2050 2051 2052
			params[ac].mu_edca = !!mu_edca;
			if (mu_edca)
				params[ac].mu_edca_param_rec = mu_edca->ac_be;
2053 2054 2055
			break;
		}

2056
		params[ac].aifs = pos[0] & 0x0f;
2057

2058
		if (params[ac].aifs < 2) {
2059 2060
			sdata_info(sdata,
				   "AP has invalid WMM params (AIFSN=%d for ACI %d), will use 2\n",
2061 2062
				   params[ac].aifs, aci);
			params[ac].aifs = 2;
2063
		}
2064 2065 2066 2067 2068
		params[ac].cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
		params[ac].cw_min = ecw2cw(pos[1] & 0x0f);
		params[ac].txop = get_unaligned_le16(pos + 2);
		params[ac].acm = acm;
		params[ac].uapsd = uapsd;
K
Kalle Valo 已提交
2069

2070
		if (params[ac].cw_min == 0 ||
2071
		    params[ac].cw_min > params[ac].cw_max) {
2072 2073 2074 2075 2076
			sdata_info(sdata,
				   "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n",
				   params[ac].cw_min, params[ac].cw_max, aci);
			return false;
		}
2077
		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
2078 2079
	}

2080 2081 2082 2083 2084 2085 2086 2087 2088 2089
	/* WMM specification requires all 4 ACIs. */
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
		if (params[ac].cw_min == 0) {
			sdata_info(sdata,
				   "AP has invalid WMM params (missing AC %d), using defaults\n",
				   ac);
			return false;
		}
	}

2090
	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
J
Johannes Berg 已提交
2091
		mlme_dbg(sdata,
2092 2093 2094 2095 2096 2097 2098 2099
			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
			 ac, params[ac].acm,
			 params[ac].aifs, params[ac].cw_min, params[ac].cw_max,
			 params[ac].txop, params[ac].uapsd,
			 ifmgd->tx_tspec[ac].downgraded);
		sdata->tx_conf[ac] = params[ac];
		if (!ifmgd->tx_tspec[ac].downgraded &&
		    drv_conf_tx(local, sdata, ac, &params[ac]))
J
Johannes Berg 已提交
2100
			sdata_err(sdata,
2101 2102
				  "failed to set TX queue parameters for AC %d\n",
				  ac);
2103
	}
2104 2105

	/* enable WMM or activate new settings */
2106
	sdata->vif.bss_conf.qos = true;
2107
	return true;
2108 2109
}

2110 2111 2112 2113
static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	lockdep_assert_held(&sdata->local->mtx);

2114
	sdata->u.mgd.flags &= ~IEEE80211_STA_CONNECTION_POLL;
2115 2116 2117 2118 2119 2120 2121 2122 2123 2124
	ieee80211_run_deferred_scan(sdata->local);
}

static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
{
	mutex_lock(&sdata->local->mtx);
	__ieee80211_stop_poll(sdata);
	mutex_unlock(&sdata->local->mtx);
}

J
Johannes Berg 已提交
2125 2126
static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
					   u16 capab, bool erp_valid, u8 erp)
2127
{
J
Johannes Berg 已提交
2128
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2129
	struct ieee80211_supported_band *sband;
2130
	u32 changed = 0;
J
Johannes Berg 已提交
2131 2132 2133 2134
	bool use_protection;
	bool use_short_preamble;
	bool use_short_slot;

2135 2136 2137 2138
	sband = ieee80211_get_sband(sdata);
	if (!sband)
		return changed;

J
Johannes Berg 已提交
2139 2140 2141 2142 2143 2144 2145 2146 2147
	if (erp_valid) {
		use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
		use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
	} else {
		use_protection = false;
		use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
	}

	use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
2148
	if (sband->band == NL80211_BAND_5GHZ)
2149
		use_short_slot = true;
2150

2151 2152 2153
	if (use_protection != bss_conf->use_cts_prot) {
		bss_conf->use_cts_prot = use_protection;
		changed |= BSS_CHANGED_ERP_CTS_PROT;
2154
	}
2155

2156 2157
	if (use_short_preamble != bss_conf->use_short_preamble) {
		bss_conf->use_short_preamble = use_short_preamble;
2158
		changed |= BSS_CHANGED_ERP_PREAMBLE;
2159
	}
2160

J
Johannes Berg 已提交
2161 2162 2163
	if (use_short_slot != bss_conf->use_short_slot) {
		bss_conf->use_short_slot = use_short_slot;
		changed |= BSS_CHANGED_ERP_SLOT;
2164 2165 2166 2167 2168
	}

	return changed;
}

2169
static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
2170
				     struct cfg80211_bss *cbss,
J
Johannes Berg 已提交
2171
				     u32 bss_info_changed)
2172
{
2173
	struct ieee80211_bss *bss = (void *)cbss->priv;
2174
	struct ieee80211_local *local = sdata->local;
2175
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
2176

J
Johannes Berg 已提交
2177
	bss_info_changed |= BSS_CHANGED_ASSOC;
2178
	bss_info_changed |= ieee80211_handle_bss_capability(sdata,
2179
		bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
2180

2181
	sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
2182
		beacon_loss_count * bss_conf->beacon_int));
2183

2184 2185
	sdata->u.mgd.associated = cbss;
	memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
2186

2187 2188
	ieee80211_check_rate_mask(sdata);

2189 2190
	sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;

2191 2192
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
2193
		const struct cfg80211_bss_ies *ies;
2194

2195 2196 2197 2198 2199 2200 2201 2202
		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies) {
			int ret;

			ret = cfg80211_get_p2p_attr(
					ies->data, ies->len,
					IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
J
Janusz Dziedzic 已提交
2203 2204
					(u8 *) &bss_conf->p2p_noa_attr,
					sizeof(bss_conf->p2p_noa_attr));
2205
			if (ret >= 2) {
J
Janusz Dziedzic 已提交
2206 2207
				sdata->u.mgd.p2p_noa_index =
					bss_conf->p2p_noa_attr.index;
2208 2209
				bss_info_changed |= BSS_CHANGED_P2P_PS;
			}
2210
		}
2211
		rcu_read_unlock();
2212 2213
	}

J
Johannes Berg 已提交
2214
	/* just to be sure */
2215
	ieee80211_stop_poll(sdata);
J
Johannes Berg 已提交
2216

2217
	ieee80211_led_assoc(local, 1);
2218

2219
	if (sdata->u.mgd.have_beacon) {
2220 2221 2222 2223 2224 2225 2226
		/*
		 * If the AP is buggy we may get here with no DTIM period
		 * known, so assume it's 1 which is the only safe assumption
		 * in that case, although if the TIM IE is broken powersave
		 * probably just won't work at all.
		 */
		bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
2227
		bss_conf->beacon_rate = bss->beacon_rate;
2228
		bss_info_changed |= BSS_CHANGED_BEACON_INFO;
2229
	} else {
2230
		bss_conf->beacon_rate = NULL;
2231
		bss_conf->dtim_period = 0;
2232
	}
2233

2234
	bss_conf->assoc = 1;
2235

2236
	/* Tell the driver to monitor connection quality (if supported) */
2237
	if (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI &&
2238
	    bss_conf->cqm_rssi_thold)
2239 2240
		bss_info_changed |= BSS_CHANGED_CQM;

2241
	/* Enable ARP filtering */
2242
	if (bss_conf->arp_addr_cnt)
2243 2244
		bss_info_changed |= BSS_CHANGED_ARP_FILTER;

J
Johannes Berg 已提交
2245
	ieee80211_bss_info_change_notify(sdata, bss_info_changed);
2246

J
Johannes Berg 已提交
2247
	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2248
	ieee80211_recalc_ps(local);
J
Johannes Berg 已提交
2249
	mutex_unlock(&local->iflist_mtx);
2250

2251
	ieee80211_recalc_smps(sdata);
E
Eliad Peller 已提交
2252 2253
	ieee80211_recalc_ps_vif(sdata);

2254
	netif_carrier_on(sdata->dev);
2255 2256
}

2257
static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
2258 2259
				   u16 stype, u16 reason, bool tx,
				   u8 *frame_buf)
2260
{
2261
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2262
	struct ieee80211_local *local = sdata->local;
2263
	u32 changed = 0;
2264

2265
	sdata_assert_lock(sdata);
2266

2267 2268 2269
	if (WARN_ON_ONCE(tx && !frame_buf))
		return;

J
Johannes Berg 已提交
2270 2271 2272
	if (WARN_ON(!ifmgd->associated))
		return;

2273 2274
	ieee80211_stop_poll(sdata);

2275
	ifmgd->associated = NULL;
2276 2277
	netif_carrier_off(sdata->dev);

2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288
	/*
	 * if we want to get out of ps before disassoc (why?) we have
	 * to do it before sending disassoc, as otherwise the null-packet
	 * won't be valid.
	 */
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		local->hw.conf.flags &= ~IEEE80211_CONF_PS;
		ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
	}
	local->ps_sdata = NULL;

E
Eliad Peller 已提交
2289 2290 2291
	/* disable per-vif ps */
	ieee80211_recalc_ps_vif(sdata);

2292 2293 2294
	/* make sure ongoing transmission finishes */
	synchronize_net();

2295 2296 2297 2298 2299 2300
	/*
	 * drop any frame before deauth/disassoc, this can be data or
	 * management frame. Since we are disconnecting, we should not
	 * insist sending these frames which can take time and delay
	 * the disconnection and possible the roaming.
	 */
2301
	if (tx)
2302
		ieee80211_flush_queues(local, sdata, true);
2303

2304
	/* deauthenticate/disassociate now */
2305 2306 2307 2308 2309 2310 2311 2312 2313
	if (tx || frame_buf) {
		/*
		 * In multi channel scenarios guarantee that the virtual
		 * interface is granted immediate airtime to transmit the
		 * deauthentication frame by calling mgd_prepare_tx, if the
		 * driver requested so.
		 */
		if (ieee80211_hw_check(&local->hw, DEAUTH_NEED_MGD_TX_PREP) &&
		    !ifmgd->have_beacon)
2314
			drv_mgd_prepare_tx(sdata->local, sdata, 0);
2315

2316 2317 2318
		ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid,
					       ifmgd->bssid, stype, reason,
					       tx, frame_buf);
2319
	}
2320

2321
	/* flush out frame - make sure the deauth was actually sent */
2322
	if (tx)
2323
		ieee80211_flush_queues(local, sdata, false);
2324

2325
	/* clear bssid only after building the needed mgmt frames */
2326
	eth_zero_addr(ifmgd->bssid);
2327

2328
	/* remove AP and TDLS peers */
2329
	sta_info_flush(sdata);
2330 2331

	/* finally reset all BSS / config parameters */
2332 2333 2334
	changed |= ieee80211_reset_erp_info(sdata);

	ieee80211_led_assoc(local, 0);
J
Johannes Berg 已提交
2335 2336
	changed |= BSS_CHANGED_ASSOC;
	sdata->vif.bss_conf.assoc = false;
2337

J
Janusz Dziedzic 已提交
2338 2339 2340
	ifmgd->p2p_noa_index = -1;
	memset(&sdata->vif.bss_conf.p2p_noa_attr, 0,
	       sizeof(sdata->vif.bss_conf.p2p_noa_attr));
2341

2342
	/* on the next assoc, re-program HT/VHT parameters */
B
Ben Greear 已提交
2343 2344
	memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
	memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
2345 2346
	memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
	memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
2347 2348 2349 2350 2351 2352 2353

	/* reset MU-MIMO ownership and group data */
	memset(sdata->vif.bss_conf.mu_group.membership, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.membership));
	memset(sdata->vif.bss_conf.mu_group.position, 0,
	       sizeof(sdata->vif.bss_conf.mu_group.position));
	changed |= BSS_CHANGED_MU_GROUPS;
2354
	sdata->vif.mu_mimo_owner = false;
2355

2356
	sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
2357

2358 2359 2360
	del_timer_sync(&local->dynamic_ps_timer);
	cancel_work_sync(&local->dynamic_ps_enable_work);

2361
	/* Disable ARP filtering */
2362
	if (sdata->vif.bss_conf.arp_addr_cnt)
2363 2364
		changed |= BSS_CHANGED_ARP_FILTER;

2365 2366 2367
	sdata->vif.bss_conf.qos = false;
	changed |= BSS_CHANGED_QOS;

2368 2369
	/* The BSSID (not really interesting) and HT changed */
	changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
J
Johannes Berg 已提交
2370
	ieee80211_bss_info_change_notify(sdata, changed);
2371

2372
	/* disassociated - set to defaults now */
2373
	ieee80211_set_wmm_default(sdata, false, false);
2374

2375 2376 2377 2378
	del_timer_sync(&sdata->u.mgd.conn_mon_timer);
	del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
	del_timer_sync(&sdata->u.mgd.timer);
	del_timer_sync(&sdata->u.mgd.chswitch_timer);
2379

2380
	sdata->vif.bss_conf.dtim_period = 0;
2381 2382
	sdata->vif.bss_conf.beacon_rate = NULL;

2383
	ifmgd->have_beacon = false;
2384

2385
	ifmgd->flags = 0;
2386
	mutex_lock(&local->mtx);
2387
	ieee80211_vif_release_channel(sdata);
2388 2389

	sdata->vif.csa_active = false;
2390
	ifmgd->csa_waiting_bcn = false;
2391
	ifmgd->csa_ignored_same_chan = false;
2392 2393 2394 2395 2396
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2397
	mutex_unlock(&local->mtx);
2398

2399 2400 2401 2402
	/* existing TX TSPEC sessions no longer exist */
	memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
	cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);

2403
	sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2404
}
2405

2406 2407 2408 2409 2410 2411 2412 2413
void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
			     struct ieee80211_hdr *hdr)
{
	/*
	 * We can postpone the mgd.timer whenever receiving unicast frames
	 * from AP because we know that the connection is working both ways
	 * at that time. But multicast frames (and hence also beacons) must
	 * be ignored here, because we need to trigger the timer during
J
Johannes Berg 已提交
2414 2415
	 * data idle periods for sending the periodic probe request to the
	 * AP we're connected to.
2416
	 */
J
Johannes Berg 已提交
2417 2418 2419
	if (is_multicast_ether_addr(hdr->addr1))
		return;

2420
	ieee80211_sta_reset_conn_monitor(sdata);
2421
}
2422

2423 2424 2425
static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2426
	struct ieee80211_local *local = sdata->local;
2427

2428
	mutex_lock(&local->mtx);
2429 2430
	if (!(ifmgd->flags & IEEE80211_STA_CONNECTION_POLL))
		goto out;
2431

2432
	__ieee80211_stop_poll(sdata);
2433 2434

	mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
2435
	ieee80211_recalc_ps(local);
2436
	mutex_unlock(&local->iflist_mtx);
2437

2438
	if (ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
2439
		goto out;
2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450

	/*
	 * We've received a probe response, but are not sure whether
	 * we have or will be receiving any beacons or data, so let's
	 * schedule the timers again, just in case.
	 */
	ieee80211_sta_reset_beacon_monitor(sdata);

	mod_timer(&ifmgd->conn_mon_timer,
		  round_jiffies_up(jiffies +
				   IEEE80211_CONNECTION_IDLE_TIME));
2451 2452
out:
	mutex_unlock(&local->mtx);
2453 2454
}

2455 2456 2457 2458 2459
static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_hdr *hdr,
					   u16 tx_time)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
S
Sara Sharon 已提交
2460
	u16 tid = ieee80211_get_tid(hdr);
2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489
	int ac = ieee80211_ac_from_tid(tid);
	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
	unsigned long now = jiffies;

	if (likely(!tx_tspec->admitted_time))
		return;

	if (time_after(now, tx_tspec->time_slice_start + HZ)) {
		tx_tspec->consumed_tx_time = 0;
		tx_tspec->time_slice_start = now;

		if (tx_tspec->downgraded) {
			tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
			schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
		}
	}

	if (tx_tspec->downgraded)
		return;

	tx_tspec->consumed_tx_time += tx_time;

	if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
		tx_tspec->downgraded = true;
		tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
		schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
	}
}

2490
void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
2491
			     struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
2492
{
2493 2494
	ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);

F
Felix Fietkau 已提交
2495
	if (!ieee80211_is_data(hdr->frame_control))
2496 2497
	    return;

2498
	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
2499
	    sdata->u.mgd.probe_send_count > 0) {
2500
		if (ack)
2501
			ieee80211_sta_reset_conn_monitor(sdata);
2502 2503
		else
			sdata->u.mgd.nullfunc_failed = true;
2504
		ieee80211_queue_work(&sdata->local->hw, &sdata->work);
2505
		return;
2506
	}
2507 2508 2509

	if (ack)
		ieee80211_sta_reset_conn_monitor(sdata);
2510 2511
}

2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
					  const u8 *src, const u8 *dst,
					  const u8 *ssid, size_t ssid_len,
					  struct ieee80211_channel *channel)
{
	struct sk_buff *skb;

	skb = ieee80211_build_probe_req(sdata, src, dst, (u32)-1, channel,
					ssid, ssid_len, NULL, 0,
					IEEE80211_PROBE_FLAG_DIRECTED);
	if (skb)
		ieee80211_tx_skb(sdata, skb);
}

2526 2527 2528 2529
static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ssid;
2530
	u8 *dst = ifmgd->associated->bssid;
2531
	u8 unicast_limit = max(1, max_probe_tries - 3);
J
Johannes Berg 已提交
2532
	struct sta_info *sta;
2533 2534 2535 2536 2537 2538 2539 2540

	/*
	 * Try sending broadcast probe requests for the last three
	 * probe requests after the first ones failed since some
	 * buggy APs only support broadcast probe requests.
	 */
	if (ifmgd->probe_send_count >= unicast_limit)
		dst = NULL;
2541

2542 2543 2544 2545 2546 2547 2548
	/*
	 * When the hardware reports an accurate Tx ACK status, it's
	 * better to send a nullfunc frame instead of a probe request,
	 * as it will kick us off the AP quickly if we aren't associated
	 * anymore. The timeout will be reset if the frame is ACKed by
	 * the AP.
	 */
2549 2550
	ifmgd->probe_send_count++;

J
Johannes Berg 已提交
2551 2552 2553 2554 2555 2556 2557 2558
	if (dst) {
		mutex_lock(&sdata->local->sta_mtx);
		sta = sta_info_get(sdata, dst);
		if (!WARN_ON(!sta))
			ieee80211_check_fast_rx(sta);
		mutex_unlock(&sdata->local->sta_mtx);
	}

2559
	if (ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
2560
		ifmgd->nullfunc_failed = false;
2561 2562 2563 2564
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE))
			ifmgd->probe_send_count--;
		else
			ieee80211_send_nullfunc(sdata->local, sdata, false);
2565
	} else {
2566 2567
		int ssid_len;

2568
		rcu_read_lock();
2569
		ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
2570 2571 2572 2573 2574
		if (WARN_ON_ONCE(ssid == NULL))
			ssid_len = 0;
		else
			ssid_len = ssid[1];

2575 2576 2577
		ieee80211_mlme_send_probe_req(sdata, sdata->vif.addr, dst,
					      ssid + 2, ssid_len,
					      ifmgd->associated->channel);
2578
		rcu_read_unlock();
2579
	}
2580

2581
	ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
2582
	run_again(sdata, ifmgd->probe_timeout);
2583 2584
}

J
Johannes Berg 已提交
2585 2586
static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
				   bool beacon)
2587 2588
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
2589
	bool already = false;
2590

2591
	if (!ieee80211_sdata_running(sdata))
2592 2593
		return;

2594
	sdata_lock(sdata);
2595 2596 2597 2598

	if (!ifmgd->associated)
		goto out;

2599 2600 2601 2602 2603 2604 2605
	mutex_lock(&sdata->local->mtx);

	if (sdata->local->tmp_channel || sdata->local->scanning) {
		mutex_unlock(&sdata->local->mtx);
		goto out;
	}

2606
	if (beacon) {
J
Johannes Berg 已提交
2607
		mlme_dbg_ratelimited(sdata,
2608 2609
				     "detected beacon loss from AP (missed %d beacons) - probing\n",
				     beacon_loss_count);
J
Johannes Berg 已提交
2610

2611
		ieee80211_cqm_beacon_loss_notify(&sdata->vif, GFP_KERNEL);
2612
	}
2613

J
Johannes Berg 已提交
2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624
	/*
	 * The driver/our work has already reported this event or the
	 * connection monitoring has kicked in and we have already sent
	 * a probe request. Or maybe the AP died and the driver keeps
	 * reporting until we disassociate...
	 *
	 * In either case we have to ignore the current call to this
	 * function (except for setting the correct probe reason bit)
	 * because otherwise we would reset the timer every time and
	 * never check whether we received a probe response!
	 */
2625
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
J
Johannes Berg 已提交
2626 2627
		already = true;

E
Eliad Peller 已提交
2628 2629
	ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;

2630 2631
	mutex_unlock(&sdata->local->mtx);

J
Johannes Berg 已提交
2632 2633 2634
	if (already)
		goto out;

2635
	mutex_lock(&sdata->local->iflist_mtx);
J
Johannes Berg 已提交
2636
	ieee80211_recalc_ps(sdata->local);
2637 2638
	mutex_unlock(&sdata->local->iflist_mtx);

2639 2640
	ifmgd->probe_send_count = 0;
	ieee80211_mgd_probe_ap_send(sdata);
2641
 out:
2642
	sdata_unlock(sdata);
2643 2644
}

2645 2646 2647 2648 2649
struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
					  struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2650
	struct cfg80211_bss *cbss;
2651 2652
	struct sk_buff *skb;
	const u8 *ssid;
2653
	int ssid_len;
2654 2655 2656 2657

	if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
		return NULL;

2658
	sdata_assert_lock(sdata);
2659

2660 2661 2662 2663 2664 2665 2666
	if (ifmgd->associated)
		cbss = ifmgd->associated;
	else if (ifmgd->auth_data)
		cbss = ifmgd->auth_data->bss;
	else if (ifmgd->assoc_data)
		cbss = ifmgd->assoc_data->bss;
	else
2667 2668
		return NULL;

2669
	rcu_read_lock();
2670
	ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
2671 2672
	if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
		      "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
2673 2674 2675 2676
		ssid_len = 0;
	else
		ssid_len = ssid[1];

2677
	skb = ieee80211_build_probe_req(sdata, sdata->vif.addr, cbss->bssid,
J
Johannes Berg 已提交
2678
					(u32) -1, cbss->channel,
2679
					ssid + 2, ssid_len,
2680
					NULL, 0, IEEE80211_PROBE_FLAG_DIRECTED);
2681
	rcu_read_unlock();
2682 2683 2684 2685 2686

	return skb;
}
EXPORT_SYMBOL(ieee80211_ap_probereq_get);

2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704
static void ieee80211_report_disconnect(struct ieee80211_sub_if_data *sdata,
					const u8 *buf, size_t len, bool tx,
					u16 reason)
{
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = tx ? DEAUTH_TX_EVENT : DEAUTH_RX_EVENT,
		.u.mlme.reason = reason,
	};

	if (tx)
		cfg80211_tx_mlme_mgmt(sdata->dev, buf, len);
	else
		cfg80211_rx_mlme_mgmt(sdata->dev, buf, len);

	drv_event_callback(sdata->local, sdata, &event);
}

2705
static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
2706
{
2707
	struct ieee80211_local *local = sdata->local;
2708
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2709
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
2710
	bool tx;
2711

2712
	sdata_lock(sdata);
2713
	if (!ifmgd->associated) {
2714
		sdata_unlock(sdata);
2715 2716 2717
		return;
	}

2718 2719
	tx = !sdata->csa_block_tx;

2720 2721 2722 2723 2724
	/* AP is probably out of range (or not reachable for another reason) so
	 * remove the bss struct for that AP.
	 */
	cfg80211_unlink_bss(local->hw.wiphy, ifmgd->associated);

2725 2726
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
			       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
2727
			       tx, frame_buf);
2728
	mutex_lock(&local->mtx);
2729
	sdata->vif.csa_active = false;
2730
	ifmgd->csa_waiting_bcn = false;
2731 2732 2733 2734 2735
	if (sdata->csa_block_tx) {
		ieee80211_wake_vif_queues(local, sdata,
					  IEEE80211_QUEUE_STOP_REASON_CSA);
		sdata->csa_block_tx = false;
	}
2736
	mutex_unlock(&local->mtx);
2737

2738
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
2739 2740
				    WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);

2741
	sdata_unlock(sdata);
2742 2743
}

2744
static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
J
Johannes Berg 已提交
2745 2746 2747
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
2748
			     u.mgd.beacon_connection_loss_work);
2749 2750
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

2751 2752
	if (ifmgd->associated)
		ifmgd->beacon_loss_count++;
J
Johannes Berg 已提交
2753

2754
	if (ifmgd->connection_loss) {
2755 2756
		sdata_info(sdata, "Connection to AP %pM lost\n",
			   ifmgd->bssid);
2757
		__ieee80211_disconnect(sdata);
2758
	} else {
2759
		ieee80211_mgd_probe_ap(sdata, true);
2760 2761 2762 2763 2764 2765 2766 2767 2768
	}
}

static void ieee80211_csa_connection_drop_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.csa_connection_drop_work);

2769
	__ieee80211_disconnect(sdata);
J
Johannes Berg 已提交
2770 2771
}

2772 2773 2774
void ieee80211_beacon_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2775
	struct ieee80211_hw *hw = &sdata->local->hw;
2776

J
Johannes Berg 已提交
2777 2778
	trace_api_beacon_loss(sdata);

2779
	sdata->u.mgd.connection_loss = false;
2780
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
2781 2782 2783
}
EXPORT_SYMBOL(ieee80211_beacon_loss);

2784 2785 2786 2787 2788
void ieee80211_connection_loss(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_hw *hw = &sdata->local->hw;

J
Johannes Berg 已提交
2789 2790
	trace_api_connection_loss(sdata);

2791
	sdata->u.mgd.connection_loss = true;
2792 2793 2794 2795 2796
	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
}
EXPORT_SYMBOL(ieee80211_connection_loss);


J
Johannes Berg 已提交
2797 2798 2799 2800 2801
static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
					bool assoc)
{
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

2802
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2803 2804

	if (!assoc) {
2805 2806 2807 2808 2809 2810
		/*
		 * we are not authenticated yet, the only timer that could be
		 * running is the timeout for the authentication response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
J
Johannes Berg 已提交
2811 2812
		sta_info_destroy_addr(sdata, auth_data->bss->bssid);

2813
		eth_zero_addr(sdata->u.mgd.bssid);
J
Johannes Berg 已提交
2814
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
2815
		sdata->u.mgd.flags = 0;
2816
		mutex_lock(&sdata->local->mtx);
J
Johannes Berg 已提交
2817
		ieee80211_vif_release_channel(sdata);
2818
		mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
2819 2820
	}

2821
	cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
J
Johannes Berg 已提交
2822 2823 2824 2825
	kfree(auth_data);
	sdata->u.mgd.auth_data = NULL;
}

2826
static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
2827
					 bool assoc, bool abandon)
2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;

	sdata_assert_lock(sdata);

	if (!assoc) {
		/*
		 * we are not associated yet, the only timer that could be
		 * running is the timeout for the association response which
		 * which is not relevant anymore.
		 */
		del_timer_sync(&sdata->u.mgd.timer);
		sta_info_destroy_addr(sdata, assoc_data->bss->bssid);

		eth_zero_addr(sdata->u.mgd.bssid);
		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
		sdata->u.mgd.flags = 0;
2845 2846
		sdata->vif.mu_mimo_owner = false;

2847 2848 2849
		mutex_lock(&sdata->local->mtx);
		ieee80211_vif_release_channel(sdata);
		mutex_unlock(&sdata->local->mtx);
2850 2851 2852

		if (abandon)
			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
2853 2854 2855 2856 2857 2858
	}

	kfree(assoc_data);
	sdata->u.mgd.assoc_data = NULL;
}

J
Johannes Berg 已提交
2859 2860 2861
static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
{
2862
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
2863 2864 2865
	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
	u8 *pos;
	struct ieee802_11_elems elems;
2866
	u32 tx_flags = 0;
J
Johannes Berg 已提交
2867 2868

	pos = mgmt->u.auth.variable;
2869 2870
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, auth_data->bss->bssid);
J
Johannes Berg 已提交
2871 2872 2873
	if (!elems.challenge)
		return;
	auth_data->expected_transaction = 4;
2874
	drv_mgd_prepare_tx(sdata->local, sdata, 0);
2875
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
2876 2877
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
2878
	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
J
Johannes Berg 已提交
2879 2880 2881
			    elems.challenge - 2, elems.challenge_len + 2,
			    auth_data->bss->bssid, auth_data->bss->bssid,
			    auth_data->key, auth_data->key_len,
2882
			    auth_data->key_idx, tx_flags);
J
Johannes Berg 已提交
2883 2884
}

2885 2886 2887
static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
				    const u8 *bssid)
{
2888
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2889
	struct sta_info *sta;
2890
	bool result = true;
2891

2892 2893 2894 2895 2896 2897
	sdata_info(sdata, "authenticated\n");
	ifmgd->auth_data->done = true;
	ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
	ifmgd->auth_data->timeout_started = true;
	run_again(sdata, ifmgd->auth_data->timeout);

2898 2899 2900 2901 2902
	/* move station state to auth */
	mutex_lock(&sdata->local->sta_mtx);
	sta = sta_info_get(sdata, bssid);
	if (!sta) {
		WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
2903 2904
		result = false;
		goto out;
2905 2906 2907
	}
	if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
		sdata_info(sdata, "failed moving %pM to auth\n", bssid);
2908 2909
		result = false;
		goto out;
2910 2911
	}

2912 2913 2914
out:
	mutex_unlock(&sdata->local->sta_mtx);
	return result;
2915 2916
}

2917 2918
static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
				   struct ieee80211_mgmt *mgmt, size_t len)
J
Johannes Berg 已提交
2919 2920 2921 2922
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 bssid[ETH_ALEN];
	u16 auth_alg, auth_transaction, status_code;
2923 2924 2925 2926
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = AUTH_EVENT,
	};
J
Johannes Berg 已提交
2927

2928
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
2929 2930

	if (len < 24 + 6)
2931
		return;
J
Johannes Berg 已提交
2932 2933

	if (!ifmgd->auth_data || ifmgd->auth_data->done)
2934
		return;
J
Johannes Berg 已提交
2935 2936 2937

	memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

2938
	if (!ether_addr_equal(bssid, mgmt->bssid))
2939
		return;
J
Johannes Berg 已提交
2940 2941 2942 2943 2944 2945

	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
	status_code = le16_to_cpu(mgmt->u.auth.status_code);

	if (auth_alg != ifmgd->auth_data->algorithm ||
2946 2947 2948 2949 2950
	    (auth_alg != WLAN_AUTH_SAE &&
	     auth_transaction != ifmgd->auth_data->expected_transaction) ||
	    (auth_alg == WLAN_AUTH_SAE &&
	     (auth_transaction < ifmgd->auth_data->expected_transaction ||
	      auth_transaction > 2))) {
2951 2952 2953 2954
		sdata_info(sdata, "%pM unexpected authentication state: alg %d (expected %d) transact %d (expected %d)\n",
			   mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
			   auth_transaction,
			   ifmgd->auth_data->expected_transaction);
2955
		return;
2956
	}
J
Johannes Berg 已提交
2957 2958

	if (status_code != WLAN_STATUS_SUCCESS) {
2959 2960 2961 2962 2963 2964
		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);

		if (auth_alg == WLAN_AUTH_SAE &&
		    status_code == WLAN_STATUS_ANTI_CLOG_REQUIRED)
			return;

J
Johannes Berg 已提交
2965 2966
		sdata_info(sdata, "%pM denied authentication (status %d)\n",
			   mgmt->sa, status_code);
2967
		ieee80211_destroy_auth_data(sdata, false);
2968 2969 2970
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
2971
		return;
J
Johannes Berg 已提交
2972 2973 2974 2975 2976 2977
	}

	switch (ifmgd->auth_data->algorithm) {
	case WLAN_AUTH_OPEN:
	case WLAN_AUTH_LEAP:
	case WLAN_AUTH_FT:
2978
	case WLAN_AUTH_SAE:
2979 2980 2981
	case WLAN_AUTH_FILS_SK:
	case WLAN_AUTH_FILS_SK_PFS:
	case WLAN_AUTH_FILS_PK:
J
Johannes Berg 已提交
2982 2983 2984 2985 2986
		break;
	case WLAN_AUTH_SHARED_KEY:
		if (ifmgd->auth_data->expected_transaction != 4) {
			ieee80211_auth_challenge(sdata, mgmt, len);
			/* need another frame */
2987
			return;
J
Johannes Berg 已提交
2988 2989 2990 2991 2992
		}
		break;
	default:
		WARN_ONCE(1, "invalid auth alg %d",
			  ifmgd->auth_data->algorithm);
2993
		return;
J
Johannes Berg 已提交
2994 2995
	}

2996 2997
	event.u.mlme.status = MLME_SUCCESS;
	drv_event_callback(sdata->local, sdata, &event);
2998 2999 3000 3001
	if (ifmgd->auth_data->algorithm != WLAN_AUTH_SAE ||
	    (auth_transaction == 2 &&
	     ifmgd->auth_data->expected_transaction == 2)) {
		if (!ieee80211_mark_sta_auth(sdata, bssid))
3002
			return; /* ignore frame -- wait for timeout */
3003 3004 3005 3006
	} else if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
		   auth_transaction == 2) {
		sdata_info(sdata, "SAE peer confirmed\n");
		ifmgd->auth_data->peer_confirmed = true;
3007 3008
	}

3009
	cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
J
Johannes Berg 已提交
3010 3011
}

3012 3013 3014
#define case_WLAN(type) \
	case WLAN_REASON_##type: return #type

3015
const char *ieee80211_get_reason_code_string(u16 reason_code)
3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067
{
	switch (reason_code) {
	case_WLAN(UNSPECIFIED);
	case_WLAN(PREV_AUTH_NOT_VALID);
	case_WLAN(DEAUTH_LEAVING);
	case_WLAN(DISASSOC_DUE_TO_INACTIVITY);
	case_WLAN(DISASSOC_AP_BUSY);
	case_WLAN(CLASS2_FRAME_FROM_NONAUTH_STA);
	case_WLAN(CLASS3_FRAME_FROM_NONASSOC_STA);
	case_WLAN(DISASSOC_STA_HAS_LEFT);
	case_WLAN(STA_REQ_ASSOC_WITHOUT_AUTH);
	case_WLAN(DISASSOC_BAD_POWER);
	case_WLAN(DISASSOC_BAD_SUPP_CHAN);
	case_WLAN(INVALID_IE);
	case_WLAN(MIC_FAILURE);
	case_WLAN(4WAY_HANDSHAKE_TIMEOUT);
	case_WLAN(GROUP_KEY_HANDSHAKE_TIMEOUT);
	case_WLAN(IE_DIFFERENT);
	case_WLAN(INVALID_GROUP_CIPHER);
	case_WLAN(INVALID_PAIRWISE_CIPHER);
	case_WLAN(INVALID_AKMP);
	case_WLAN(UNSUPP_RSN_VERSION);
	case_WLAN(INVALID_RSN_IE_CAP);
	case_WLAN(IEEE8021X_FAILED);
	case_WLAN(CIPHER_SUITE_REJECTED);
	case_WLAN(DISASSOC_UNSPECIFIED_QOS);
	case_WLAN(DISASSOC_QAP_NO_BANDWIDTH);
	case_WLAN(DISASSOC_LOW_ACK);
	case_WLAN(DISASSOC_QAP_EXCEED_TXOP);
	case_WLAN(QSTA_LEAVE_QBSS);
	case_WLAN(QSTA_NOT_USE);
	case_WLAN(QSTA_REQUIRE_SETUP);
	case_WLAN(QSTA_TIMEOUT);
	case_WLAN(QSTA_CIPHER_NOT_SUPP);
	case_WLAN(MESH_PEER_CANCELED);
	case_WLAN(MESH_MAX_PEERS);
	case_WLAN(MESH_CONFIG);
	case_WLAN(MESH_CLOSE);
	case_WLAN(MESH_MAX_RETRIES);
	case_WLAN(MESH_CONFIRM_TIMEOUT);
	case_WLAN(MESH_INVALID_GTK);
	case_WLAN(MESH_INCONSISTENT_PARAM);
	case_WLAN(MESH_INVALID_SECURITY);
	case_WLAN(MESH_PATH_ERROR);
	case_WLAN(MESH_PATH_NOFORWARD);
	case_WLAN(MESH_PATH_DEST_UNREACHABLE);
	case_WLAN(MAC_EXISTS_IN_MBSS);
	case_WLAN(MESH_CHAN_REGULATORY);
	case_WLAN(MESH_CHAN);
	default: return "<unknown>";
	}
}
J
Johannes Berg 已提交
3068

3069 3070
static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len)
3071
{
3072
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3073
	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
3074

3075
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3076

3077
	if (len < 24 + 2)
3078
		return;
3079

3080 3081 3082 3083 3084
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3085 3086 3087
	if (ifmgd->associated &&
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
		const u8 *bssid = ifmgd->associated->bssid;
3088

3089 3090 3091
		sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));
3092

3093
		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
3094

3095 3096 3097 3098
		ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false,
					    reason_code);
		return;
	}
3099

3100 3101 3102
	if (ifmgd->assoc_data &&
	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
		const u8 *bssid = ifmgd->assoc_data->bss->bssid;
3103

3104 3105 3106 3107 3108
		sdata_info(sdata,
			   "deauthenticated from %pM while associating (Reason: %u=%s)\n",
			   bssid, reason_code,
			   ieee80211_get_reason_code_string(reason_code));

3109
		ieee80211_destroy_assoc_data(sdata, false, true);
3110 3111 3112 3113

		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
		return;
	}
3114 3115 3116
}


3117 3118
static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
				       struct ieee80211_mgmt *mgmt, size_t len)
3119
{
3120
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3121 3122
	u16 reason_code;

3123
	sdata_assert_lock(sdata);
3124

J
Johannes Berg 已提交
3125
	if (len < 24 + 2)
3126
		return;
3127

J
Johannes Berg 已提交
3128
	if (!ifmgd->associated ||
3129
	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3130
		return;
3131 3132 3133

	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);

3134 3135 3136 3137 3138
	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
		return;
	}

3139 3140 3141
	sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
		   mgmt->sa, reason_code,
		   ieee80211_get_reason_code_string(reason_code));
3142

3143 3144
	ieee80211_set_disassoc(sdata, 0, 0, false, NULL);

3145
	ieee80211_report_disconnect(sdata, (u8 *)mgmt, len, false, reason_code);
3146 3147
}

3148 3149 3150 3151
static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
				u8 *supp_rates, unsigned int supp_rates_len,
				u32 *rates, u32 *basic_rates,
				bool *have_higher_than_11mbit,
3152
				int *min_rate, int *min_rate_index,
3153
				int shift)
3154 3155 3156 3157
{
	int i, j;

	for (i = 0; i < supp_rates_len; i++) {
3158
		int rate = supp_rates[i] & 0x7f;
3159 3160
		bool is_basic = !!(supp_rates[i] & 0x80);

3161
		if ((rate * 5 * (1 << shift)) > 110)
3162 3163 3164
			*have_higher_than_11mbit = true;

		/*
3165 3166
		 * Skip HT, VHT and HE BSS membership selectors since they're
		 * not rates.
3167
		 *
3168
		 * Note: Even though the membership selector and the basic
3169 3170 3171
		 *	 rate flag share the same bit, they are not exactly
		 *	 the same.
		 */
3172
		if (supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY) ||
3173 3174
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY) ||
		    supp_rates[i] == (0x80 | BSS_MEMBERSHIP_SELECTOR_HE_PHY))
3175 3176 3177
			continue;

		for (j = 0; j < sband->n_bitrates; j++) {
3178 3179 3180 3181 3182 3183 3184
			struct ieee80211_rate *br;
			int brate;

			br = &sband->bitrates[j];

			brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
			if (brate == rate) {
3185 3186 3187
				*rates |= BIT(j);
				if (is_basic)
					*basic_rates |= BIT(j);
3188 3189
				if ((rate * 5) < *min_rate) {
					*min_rate = rate * 5;
3190 3191 3192 3193 3194 3195 3196
					*min_rate_index = j;
				}
				break;
			}
		}
	}
}
3197

3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209 3210
static bool ieee80211_twt_req_supported(const struct sta_info *sta,
					const struct ieee802_11_elems *elems)
{
	if (elems->ext_capab_len < 10)
		return false;

	if (!(elems->ext_capab[9] & WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT))
		return false;

	return sta->sta.he_cap.he_cap_elem.mac_cap_info[0] &
		IEEE80211_HE_MAC_CAP0_TWT_RES;
}

3211 3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223
static int ieee80211_recalc_twt_req(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee802_11_elems *elems)
{
	bool twt = ieee80211_twt_req_supported(sta, elems);

	if (sdata->vif.bss_conf.twt_requester != twt) {
		sdata->vif.bss_conf.twt_requester = twt;
		return BSS_CHANGED_TWT;
	}
	return 0;
}

J
Johannes Berg 已提交
3224 3225
static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
				    struct cfg80211_bss *cbss,
3226 3227
				    struct ieee80211_mgmt *mgmt, size_t len,
				    struct ieee802_11_elems *elems)
3228
{
3229
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
3230
	struct ieee80211_local *local = sdata->local;
3231
	struct ieee80211_supported_band *sband;
3232
	struct sta_info *sta;
J
Johannes Berg 已提交
3233
	u16 capab_info, aid;
J
Johannes Berg 已提交
3234
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
3235 3236
	const struct cfg80211_bss_ies *bss_ies = NULL;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
J
Johannes Berg 已提交
3237
	u32 changed = 0;
3238
	int err;
3239
	bool ret;
3240

J
Johannes Berg 已提交
3241
	/* AssocResp and ReassocResp have identical structure */
3242 3243

	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
J
Johannes Berg 已提交
3244
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
3245

3246 3247 3248 3249 3250
	/*
	 * The 5 MSB of the AID field are reserved
	 * (802.11-2016 9.4.1.8 AID field)
	 */
	aid &= 0x7ff;
3251

3252 3253 3254
	ifmgd->broken_ap = false;

	if (aid == 0 || aid > IEEE80211_MAX_AID) {
J
Johannes Berg 已提交
3255 3256
		sdata_info(sdata, "invalid AID value %d (out of range), turn off PS\n",
			   aid);
3257 3258 3259 3260
		aid = 0;
		ifmgd->broken_ap = true;
	}

3261
	if (!elems->supp_rates) {
J
Johannes Berg 已提交
3262
		sdata_info(sdata, "no SuppRates element in AssocResp\n");
J
Johannes Berg 已提交
3263
		return false;
3264 3265
	}

3266
	sdata->vif.bss_conf.aid = aid;
3267
	ifmgd->tdls_chan_switch_prohibited =
3268 3269
		elems->ext_capab && elems->ext_capab_len >= 5 &&
		(elems->ext_capab[4] & WLAN_EXT_CAPA5_TDLS_CH_SW_PROHIBITED);
3270

3271 3272 3273 3274 3275 3276 3277
	/*
	 * Some APs are erroneously not including some information in their
	 * (re)association response frames. Try to recover by using the data
	 * from the beacon or probe response. This seems to afflict mobile
	 * 2G/3G/4G wifi routers, reported models include the "Onda PN51T",
	 * "Vodafone PocketWiFi 2", "ZTE MF60" and a similar T-Mobile device.
	 */
3278
	if ((assoc_data->wmm && !elems->wmm_param) ||
3279
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3280
	     (!elems->ht_cap_elem || !elems->ht_operation)) ||
3281
	    (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3282
	     (!elems->vht_cap_elem || !elems->vht_operation))) {
3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295
		const struct cfg80211_bss_ies *ies;
		struct ieee802_11_elems bss_elems;

		rcu_read_lock();
		ies = rcu_dereference(cbss->ies);
		if (ies)
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
					  GFP_ATOMIC);
		rcu_read_unlock();
		if (!bss_ies)
			return false;

		ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
3296 3297 3298
				       false, &bss_elems,
				       mgmt->bssid,
				       assoc_data->bss->bssid);
3299
		if (assoc_data->wmm &&
3300 3301
		    !elems->wmm_param && bss_elems.wmm_param) {
			elems->wmm_param = bss_elems.wmm_param;
3302 3303 3304 3305 3306 3307 3308 3309
			sdata_info(sdata,
				   "AP bug: WMM param missing from AssocResp\n");
		}

		/*
		 * Also check if we requested HT/VHT, otherwise the AP doesn't
		 * have to include the IEs in the (re)association response.
		 */
3310
		if (!elems->ht_cap_elem && bss_elems.ht_cap_elem &&
3311
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3312
			elems->ht_cap_elem = bss_elems.ht_cap_elem;
3313 3314 3315
			sdata_info(sdata,
				   "AP bug: HT capability missing from AssocResp\n");
		}
3316
		if (!elems->ht_operation && bss_elems.ht_operation &&
3317
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
3318
			elems->ht_operation = bss_elems.ht_operation;
3319 3320 3321
			sdata_info(sdata,
				   "AP bug: HT operation missing from AssocResp\n");
		}
3322
		if (!elems->vht_cap_elem && bss_elems.vht_cap_elem &&
3323
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3324
			elems->vht_cap_elem = bss_elems.vht_cap_elem;
3325 3326 3327
			sdata_info(sdata,
				   "AP bug: VHT capa missing from AssocResp\n");
		}
3328
		if (!elems->vht_operation && bss_elems.vht_operation &&
3329
		    !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
3330
			elems->vht_operation = bss_elems.vht_operation;
3331 3332 3333 3334 3335
			sdata_info(sdata,
				   "AP bug: VHT operation missing from AssocResp\n");
		}
	}

3336 3337 3338 3339 3340
	/*
	 * We previously checked these in the beacon/probe response, so
	 * they should be present here. This is just a safety net.
	 */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
3341
	    (!elems->wmm_param || !elems->ht_cap_elem || !elems->ht_operation)) {
3342
		sdata_info(sdata,
3343 3344 3345
			   "HT AP is missing WMM params or HT capability/operation\n");
		ret = false;
		goto out;
3346 3347 3348
	}

	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
3349
	    (!elems->vht_cap_elem || !elems->vht_operation)) {
3350
		sdata_info(sdata,
3351 3352 3353
			   "VHT AP is missing VHT capability/operation\n");
		ret = false;
		goto out;
3354 3355
	}

3356 3357 3358 3359 3360
	mutex_lock(&sdata->local->sta_mtx);
	/*
	 * station info was already allocated and inserted before
	 * the association and should be available to us
	 */
3361
	sta = sta_info_get(sdata, cbss->bssid);
3362 3363
	if (WARN_ON(!sta)) {
		mutex_unlock(&sdata->local->sta_mtx);
3364 3365
		ret = false;
		goto out;
3366
	}
3367

3368 3369 3370 3371 3372 3373
	sband = ieee80211_get_sband(sdata);
	if (!sband) {
		mutex_unlock(&sdata->local->sta_mtx);
		ret = false;
		goto out;
	}
3374

L
Luca Coelho 已提交
3375
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
3376
	    (!elems->he_cap || !elems->he_operation)) {
L
Luca Coelho 已提交
3377 3378 3379 3380 3381 3382 3383
		mutex_unlock(&sdata->local->sta_mtx);
		sdata_info(sdata,
			   "HE AP is missing HE capability/operation\n");
		ret = false;
		goto out;
	}

3384
	/* Set up internal HT/VHT capabilities */
3385
	if (elems->ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
B
Ben Greear 已提交
3386
		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
3387
						  elems->ht_cap_elem, sta);
3388

3389
	if (elems->vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
M
Mahesh Palivela 已提交
3390
		ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
3391
						    elems->vht_cap_elem, sta);
M
Mahesh Palivela 已提交
3392

3393 3394
	if (elems->he_operation && !(ifmgd->flags & IEEE80211_STA_DISABLE_HE) &&
	    elems->he_cap) {
L
Luca Coelho 已提交
3395
		ieee80211_he_cap_ie_to_sta_he_cap(sdata, sband,
3396 3397
						  elems->he_cap,
						  elems->he_cap_len,
L
Luca Coelho 已提交
3398 3399 3400
						  sta);

		bss_conf->he_support = sta->sta.he_cap.has_he;
3401 3402 3403 3404 3405 3406 3407 3408
		if (elems->rsnx && elems->rsnx_len &&
		    (elems->rsnx[0] & WLAN_RSNX_CAPA_PROTECTED_TWT) &&
		    wiphy_ext_feature_isset(local->hw.wiphy,
					    NL80211_EXT_FEATURE_PROTECTED_TWT))
			bss_conf->twt_protected = true;
		else
			bss_conf->twt_protected = false;

3409
		changed |= ieee80211_recalc_twt_req(sdata, sta, elems);
L
Luca Coelho 已提交
3410 3411
	} else {
		bss_conf->he_support = false;
3412
		bss_conf->twt_requester = false;
3413
		bss_conf->twt_protected = false;
L
Luca Coelho 已提交
3414 3415 3416
	}

	if (bss_conf->he_support) {
3417
		bss_conf->he_bss_color.color =
3418
			le32_get_bits(elems->he_operation->he_oper_params,
3419
				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3420 3421 3422 3423 3424 3425 3426
		bss_conf->he_bss_color.partial =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_PARTIAL_BSS_COLOR);
		bss_conf->he_bss_color.disabled =
			le32_get_bits(elems->he_operation->he_oper_params,
				      IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED);
		changed |= BSS_CHANGED_HE_BSS_COLOR;
L
Luca Coelho 已提交
3427 3428

		bss_conf->htc_trig_based_pkt_ext =
3429
			le32_get_bits(elems->he_operation->he_oper_params,
3430
			      IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
L
Luca Coelho 已提交
3431
		bss_conf->frame_time_rts_th =
3432
			le32_get_bits(elems->he_operation->he_oper_params,
3433
			      IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
L
Luca Coelho 已提交
3434 3435 3436 3437 3438 3439 3440 3441 3442

		bss_conf->multi_sta_back_32bit =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP;

		bss_conf->ack_enabled =
			sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
			IEEE80211_HE_MAC_CAP2_ACK_EN;

3443 3444 3445
		bss_conf->uora_exists = !!elems->uora_element;
		if (elems->uora_element)
			bss_conf->uora_ocw_range = elems->uora_element[0];
L
Luca Coelho 已提交
3446

3447 3448
		ieee80211_he_op_ie_to_bss_conf(&sdata->vif, elems->he_operation);
		ieee80211_he_spr_ie_to_bss_conf(&sdata->vif, elems->he_spr);
L
Luca Coelho 已提交
3449 3450 3451
		/* TODO: OPEN: what happens if BSS color disable is set? */
	}

S
Sara Sharon 已提交
3452 3453 3454 3455 3456 3457 3458 3459
	if (cbss->transmitted_bss) {
		bss_conf->nontransmitted = true;
		ether_addr_copy(bss_conf->transmitter_bssid,
				cbss->transmitted_bss->bssid);
		bss_conf->bssid_indicator = cbss->max_bssid_indicator;
		bss_conf->bssid_index = cbss->bssid_index;
	}

3460 3461 3462 3463 3464 3465
	/*
	 * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
	 * in their association response, so ignore that data for our own
	 * configuration. If it changed since the last beacon, we'll get the
	 * next beacon and update then.
	 */
3466

3467 3468 3469 3470 3471
	/*
	 * If an operating mode notification IE is present, override the
	 * NSS calculation (that would be done in rate_control_rate_init())
	 * and use the # of streams from that element.
	 */
3472 3473
	if (elems->opmode_notif &&
	    !(*elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
3474 3475
		u8 nss;

3476
		nss = *elems->opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
3477 3478 3479 3480 3481
		nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
		nss += 1;
		sta->sta.rx_nss = nss;
	}

3482
	rate_control_rate_init(sta);
3483

3484
	if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED) {
J
Johannes Berg 已提交
3485
		set_sta_flag(sta, WLAN_STA_MFP);
3486 3487 3488 3489
		sta->sta.mfp = true;
	} else {
		sta->sta.mfp = false;
	}
3490

3491
	sta->sta.wme = elems->wmm_param && local->hw.queues >= IEEE80211_NUM_ACS;
3492

3493
	err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
3494 3495 3496
	if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
		err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
	if (err) {
J
Johannes Berg 已提交
3497 3498 3499
		sdata_info(sdata,
			   "failed to move station %pM to desired state\n",
			   sta->sta.addr);
3500 3501
		WARN_ON(__sta_info_destroy(sta));
		mutex_unlock(&sdata->local->sta_mtx);
3502 3503
		ret = false;
		goto out;
3504 3505
	}

3506
	mutex_unlock(&sdata->local->sta_mtx);
3507

3508 3509 3510 3511 3512 3513 3514
	/*
	 * Always handle WMM once after association regardless
	 * of the first value the AP uses. Setting -1 here has
	 * that effect because the AP values is an unsigned
	 * 4-bit value.
	 */
	ifmgd->wmm_last_param_set = -1;
3515
	ifmgd->mu_edca_last_param_set = -1;
3516

3517
	if (ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
3518
		ieee80211_set_wmm_default(sdata, false, false);
3519 3520 3521
	} else if (!ieee80211_sta_wmm_params(local, sdata, elems->wmm_param,
					     elems->wmm_param_len,
					     elems->mu_edca_param_set)) {
3522 3523 3524 3525 3526 3527 3528 3529 3530 3531 3532
		/* still enable QoS since we might have HT/VHT */
		ieee80211_set_wmm_default(sdata, false, true);
		/* set the disable-WMM flag in this case to disable
		 * tracking WMM parameter changes in the beacon if
		 * the parameters weren't actually valid. Doing so
		 * avoids changing parameters very strangely when
		 * the AP is going back and forth between valid and
		 * invalid parameters.
		 */
		ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
	}
3533
	changed |= BSS_CHANGED_QOS;
3534

3535
	if (elems->max_idle_period_ie) {
3536
		bss_conf->max_idle_period =
3537
			le16_to_cpu(elems->max_idle_period_ie->max_idle_period);
3538
		bss_conf->protected_keep_alive =
3539
			!!(elems->max_idle_period_ie->idle_options &
3540 3541 3542 3543 3544 3545 3546
			   WLAN_IDLE_OPTIONS_PROTECTED_KEEP_ALIVE);
		changed |= BSS_CHANGED_KEEP_ALIVE;
	} else {
		bss_conf->max_idle_period = 0;
		bss_conf->protected_keep_alive = false;
	}

3547
	/* set assoc capability (AID was already set earlier),
J
Johannes Berg 已提交
3548 3549
	 * ieee80211_set_associated() will tell the driver */
	bss_conf->assoc_capability = capab_info;
3550
	ieee80211_set_associated(sdata, cbss, changed);
3551

3552 3553 3554 3555 3556 3557 3558
	/*
	 * If we're using 4-addr mode, let the AP know that we're
	 * doing so, so that it can create the STA VLAN on its side
	 */
	if (ifmgd->use_4addr)
		ieee80211_send_4addr_nullfunc(local, sdata);

3559
	/*
J
Johannes Berg 已提交
3560 3561
	 * Start timer to probe the connection to the AP now.
	 * Also start the timer that will detect beacon loss.
3562
	 */
J
Johannes Berg 已提交
3563
	ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
3564
	ieee80211_sta_reset_beacon_monitor(sdata);
3565

3566 3567 3568 3569
	ret = true;
 out:
	kfree(bss_ies);
	return ret;
3570 3571
}

3572 3573 3574
static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
					 struct ieee80211_mgmt *mgmt,
					 size_t len)
J
Johannes Berg 已提交
3575 3576 3577 3578 3579
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
	u16 capab_info, status_code, aid;
	struct ieee802_11_elems elems;
3580
	int ac, uapsd_queues = -1;
J
Johannes Berg 已提交
3581 3582
	u8 *pos;
	bool reassoc;
3583
	struct cfg80211_bss *bss;
3584 3585 3586 3587
	struct ieee80211_event event = {
		.type = MLME_EVENT,
		.u.mlme.data = ASSOC_EVENT,
	};
J
Johannes Berg 已提交
3588

3589
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
3590 3591

	if (!assoc_data)
3592
		return;
3593
	if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
3594
		return;
J
Johannes Berg 已提交
3595 3596 3597 3598 3599 3600 3601

	/*
	 * AssocResp and ReassocResp have identical structure, so process both
	 * of them in this function.
	 */

	if (len < 24 + 6)
3602
		return;
J
Johannes Berg 已提交
3603

3604
	reassoc = ieee80211_is_reassoc_resp(mgmt->frame_control);
J
Johannes Berg 已提交
3605 3606 3607 3608
	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
	status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);

J
Johannes Berg 已提交
3609 3610 3611 3612
	sdata_info(sdata,
		   "RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
		   reassoc ? "Rea" : "A", mgmt->sa,
		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
J
Johannes Berg 已提交
3613

3614 3615 3616 3617
	if (assoc_data->fils_kek_len &&
	    fils_decrypt_assoc_resp(sdata, (u8 *)mgmt, &len, assoc_data) < 0)
		return;

J
Johannes Berg 已提交
3618
	pos = mgmt->u.assoc_resp.variable;
3619 3620
	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
			       mgmt->bssid, assoc_data->bss->bssid);
J
Johannes Berg 已提交
3621 3622

	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
3623 3624
	    elems.timeout_int &&
	    elems.timeout_int->type == WLAN_TIMEOUT_ASSOC_COMEBACK) {
J
Johannes Berg 已提交
3625
		u32 tu, ms;
3626
		tu = le32_to_cpu(elems.timeout_int->value);
J
Johannes Berg 已提交
3627
		ms = tu * 1024 / 1000;
J
Johannes Berg 已提交
3628 3629 3630
		sdata_info(sdata,
			   "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
			   mgmt->sa, tu, ms);
J
Johannes Berg 已提交
3631
		assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
3632
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
3633
		if (ms > IEEE80211_ASSOC_TIMEOUT)
3634 3635
			run_again(sdata, assoc_data->timeout);
		return;
J
Johannes Berg 已提交
3636 3637
	}

3638
	bss = assoc_data->bss;
J
Johannes Berg 已提交
3639 3640

	if (status_code != WLAN_STATUS_SUCCESS) {
J
Johannes Berg 已提交
3641 3642
		sdata_info(sdata, "%pM denied association (code=%d)\n",
			   mgmt->sa, status_code);
3643
		ieee80211_destroy_assoc_data(sdata, false, false);
3644 3645 3646
		event.u.mlme.status = MLME_DENIED;
		event.u.mlme.reason = status_code;
		drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
3647
	} else {
3648
		if (!ieee80211_assoc_success(sdata, bss, mgmt, len, &elems)) {
J
Johannes Berg 已提交
3649
			/* oops -- internal error -- send timeout for now */
3650
			ieee80211_destroy_assoc_data(sdata, false, false);
3651
			cfg80211_assoc_timeout(sdata->dev, bss);
3652
			return;
J
Johannes Berg 已提交
3653
		}
3654 3655
		event.u.mlme.status = MLME_SUCCESS;
		drv_event_callback(sdata->local, sdata, &event);
3656
		sdata_info(sdata, "associated\n");
3657 3658 3659 3660 3661 3662

		/*
		 * destroy assoc_data afterwards, as otherwise an idle
		 * recalc after assoc_data is NULL but before associated
		 * is set can cause the interface to go idle
		 */
3663
		ieee80211_destroy_assoc_data(sdata, true, false);
3664 3665 3666 3667 3668

		/* get uapsd queues configuration */
		uapsd_queues = 0;
		for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
			if (sdata->tx_conf[ac].uapsd)
3669
				uapsd_queues |= ieee80211_ac_to_qos_mask[ac];
J
Johannes Berg 已提交
3670 3671
	}

3672 3673
	cfg80211_rx_assoc_resp(sdata->dev, bss, (u8 *)mgmt, len, uapsd_queues,
			       ifmgd->assoc_req_ies, ifmgd->assoc_req_ies_len);
J
Johannes Berg 已提交
3674
}
J
Johannes Berg 已提交
3675

3676
static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3677
				  struct ieee80211_mgmt *mgmt, size_t len,
3678
				  struct ieee80211_rx_status *rx_status)
3679 3680
{
	struct ieee80211_local *local = sdata->local;
3681
	struct ieee80211_bss *bss;
3682
	struct ieee80211_channel *channel;
3683

3684
	sdata_assert_lock(sdata);
3685

3686 3687
	channel = ieee80211_get_channel_khz(local->hw.wiphy,
					ieee80211_rx_status_to_khz(rx_status));
3688
	if (!channel)
3689 3690
		return;

3691
	bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, channel);
3692 3693
	if (bss) {
		sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
3694
		ieee80211_rx_bss_put(local, bss);
3695
	}
3696 3697 3698
}


3699
static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
J
Johannes Berg 已提交
3700
					 struct sk_buff *skb)
3701
{
J
Johannes Berg 已提交
3702
	struct ieee80211_mgmt *mgmt = (void *)skb->data;
3703
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
3704
	struct ieee80211_rx_status *rx_status = (void *) skb->cb;
3705
	struct ieee80211_channel *channel;
J
Johannes Berg 已提交
3706
	size_t baselen, len = skb->len;
3707

3708 3709
	ifmgd = &sdata->u.mgd;

3710
	sdata_assert_lock(sdata);
3711

3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726
	/*
	 * According to Draft P802.11ax D6.0 clause 26.17.2.3.2:
	 * "If a 6 GHz AP receives a Probe Request frame  and responds with
	 * a Probe Response frame [..], the Address 1 field of the Probe
	 * Response frame shall be set to the broadcast address [..]"
	 * So, on 6GHz band we should also accept broadcast responses.
	 */
	channel = ieee80211_get_channel(sdata->local->hw.wiphy,
					rx_status->freq);
	if (!channel)
		return;

	if (!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
	    (channel->band != NL80211_BAND_6GHZ ||
	     !is_broadcast_ether_addr(mgmt->da)))
3727 3728
		return; /* ignore ProbeResp to foreign address */

3729 3730 3731 3732
	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

3733
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
3734

3735
	if (ifmgd->associated &&
3736
	    ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
3737
		ieee80211_reset_ap_probe(sdata);
3738 3739
}

3740 3741 3742
/*
 * This is the canonical list of information elements we care about,
 * the filter code also gives us all changes to the Microsoft OUI
3743 3744 3745
 * (00:50:F2) vendor IE which is used for WMM which we need to track,
 * as well as the DTPC IE (part of the Cisco OUI) used for signaling
 * changes to requested client power.
3746 3747 3748 3749 3750 3751 3752 3753 3754 3755
 *
 * We implement beacon filtering in software since that means we can
 * avoid processing the frame here and in cfg80211, and userspace
 * will not be able to tell whether the hardware supports it or not.
 *
 * XXX: This list needs to be dynamic -- userspace needs to be able to
 *	add items it requires. It also needs to be able to tell us to
 *	look out for other vendor IEs.
 */
static const u64 care_about_ies =
3756 3757 3758 3759 3760
	(1ULL << WLAN_EID_COUNTRY) |
	(1ULL << WLAN_EID_ERP_INFO) |
	(1ULL << WLAN_EID_CHANNEL_SWITCH) |
	(1ULL << WLAN_EID_PWR_CONSTRAINT) |
	(1ULL << WLAN_EID_HT_CAPABILITY) |
3761 3762
	(1ULL << WLAN_EID_HT_OPERATION) |
	(1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
3763

3764 3765 3766 3767 3768
static void ieee80211_handle_beacon_sig(struct ieee80211_sub_if_data *sdata,
					struct ieee80211_if_managed *ifmgd,
					struct ieee80211_bss_conf *bss_conf,
					struct ieee80211_local *local,
					struct ieee80211_rx_status *rx_status)
3769
{
3770
	/* Track average RSSI from the Beacon frames of the current AP */
3771

3772 3773
	if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
		ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
3774
		ewma_beacon_signal_init(&ifmgd->ave_beacon_signal);
3775
		ifmgd->last_cqm_event_signal = 0;
3776
		ifmgd->count_beacon_signal = 1;
3777
		ifmgd->last_ave_beacon_signal = 0;
3778
	} else {
3779
		ifmgd->count_beacon_signal++;
3780
	}
3781

3782 3783
	ewma_beacon_signal_add(&ifmgd->ave_beacon_signal, -rx_status->signal);

3784 3785
	if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
3786
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3787
		int last_sig = ifmgd->last_ave_beacon_signal;
3788 3789 3790
		struct ieee80211_event event = {
			.type = RSSI_EVENT,
		};
3791 3792 3793 3794 3795 3796 3797 3798

		/*
		 * if signal crosses either of the boundaries, invoke callback
		 * with appropriate parameters
		 */
		if (sig > ifmgd->rssi_max_thold &&
		    (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3799 3800
			event.u.rssi.data = RSSI_EVENT_HIGH;
			drv_event_callback(local, sdata, &event);
3801 3802 3803 3804
		} else if (sig < ifmgd->rssi_min_thold &&
			   (last_sig >= ifmgd->rssi_max_thold ||
			   last_sig == 0)) {
			ifmgd->last_ave_beacon_signal = sig;
3805 3806
			event.u.rssi.data = RSSI_EVENT_LOW;
			drv_event_callback(local, sdata, &event);
3807 3808 3809
		}
	}

3810
	if (bss_conf->cqm_rssi_thold &&
3811
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT &&
3812
	    !(sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI)) {
3813
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
3814 3815 3816
		int last_event = ifmgd->last_cqm_event_signal;
		int thold = bss_conf->cqm_rssi_thold;
		int hyst = bss_conf->cqm_rssi_hyst;
3817

3818 3819 3820 3821 3822 3823
		if (sig < thold &&
		    (last_event == 0 || sig < last_event - hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
3824
				sig, GFP_KERNEL);
3825 3826 3827 3828 3829 3830
		} else if (sig > thold &&
			   (last_event == 0 || sig > last_event + hyst)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
3831
				sig, GFP_KERNEL);
3832 3833 3834
		}
	}

3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857
	if (bss_conf->cqm_rssi_low &&
	    ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
		int sig = -ewma_beacon_signal_read(&ifmgd->ave_beacon_signal);
		int last_event = ifmgd->last_cqm_event_signal;
		int low = bss_conf->cqm_rssi_low;
		int high = bss_conf->cqm_rssi_high;

		if (sig < low &&
		    (last_event == 0 || last_event >= low)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
				sig, GFP_KERNEL);
		} else if (sig > high &&
			   (last_event == 0 || last_event <= high)) {
			ifmgd->last_cqm_event_signal = sig;
			ieee80211_cqm_rssi_notify(
				&sdata->vif,
				NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
				sig, GFP_KERNEL);
		}
	}
3858 3859
}

S
Sara Sharon 已提交
3860 3861 3862 3863 3864 3865 3866 3867 3868 3869
static bool ieee80211_rx_our_beacon(const u8 *tx_bssid,
				    struct cfg80211_bss *bss)
{
	if (ether_addr_equal(tx_bssid, bss->bssid))
		return true;
	if (!bss->transmitted_bss)
		return false;
	return ether_addr_equal(tx_bssid, bss->transmitted_bss->bssid);
}

3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902
static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
				     struct ieee80211_mgmt *mgmt, size_t len,
				     struct ieee80211_rx_status *rx_status)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
	size_t baselen;
	struct ieee802_11_elems elems;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_channel *chan;
	struct sta_info *sta;
	u32 changed = 0;
	bool erp_valid;
	u8 erp_value = 0;
	u32 ncrc;
	u8 *bssid;
	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_assert_lock(sdata);

	/* Process beacon from the current BSS */
	baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
	if (baselen > len)
		return;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		rcu_read_unlock();
		return;
	}

3903 3904
	if (ieee80211_rx_status_to_khz(rx_status) !=
	    ieee80211_channel_to_khz(chanctx_conf->def.chan)) {
3905 3906 3907 3908 3909 3910 3911
		rcu_read_unlock();
		return;
	}
	chan = chanctx_conf->def.chan;
	rcu_read_unlock();

	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
S
Sara Sharon 已提交
3912
	    ieee80211_rx_our_beacon(mgmt->bssid, ifmgd->assoc_data->bss)) {
3913
		ieee802_11_parse_elems(mgmt->u.beacon.variable,
3914 3915 3916
				       len - baselen, false, &elems,
				       mgmt->bssid,
				       ifmgd->assoc_data->bss->bssid);
3917

3918
		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
S
Sara Sharon 已提交
3919 3920 3921

		if (elems.dtim_period)
			ifmgd->dtim_period = elems.dtim_period;
3922 3923 3924 3925 3926 3927 3928
		ifmgd->have_beacon = true;
		ifmgd->assoc_data->need_beacon = false;
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
			sdata->vif.bss_conf.sync_tsf =
				le64_to_cpu(mgmt->u.beacon.timestamp);
			sdata->vif.bss_conf.sync_device_ts =
				rx_status->device_timestamp;
S
Sara Sharon 已提交
3929
			sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
3930
		}
S
Sara Sharon 已提交
3931 3932 3933 3934 3935 3936 3937 3938 3939

		if (elems.mbssid_config_ie)
			bss_conf->profile_periodicity =
				elems.mbssid_config_ie->profile_periodicity;

		if (elems.ext_capab_len >= 11 &&
		    (elems.ext_capab[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			bss_conf->ema_ap = true;

3940 3941 3942 3943 3944 3945 3946 3947
		/* continue assoc process */
		ifmgd->assoc_data->timeout = jiffies;
		ifmgd->assoc_data->timeout_started = true;
		run_again(sdata, ifmgd->assoc_data->timeout);
		return;
	}

	if (!ifmgd->associated ||
S
Sara Sharon 已提交
3948
	    !ieee80211_rx_our_beacon(mgmt->bssid,  ifmgd->associated))
3949 3950 3951 3952 3953 3954
		return;
	bssid = ifmgd->associated->bssid;

	if (!(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
		ieee80211_handle_beacon_sig(sdata, ifmgd, bss_conf,
					    local, rx_status);
3955

3956
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL) {
J
Johannes Berg 已提交
3957
		mlme_dbg_ratelimited(sdata,
3958
				     "cancelling AP probe due to a received beacon\n");
3959
		ieee80211_reset_ap_probe(sdata);
3960 3961
	}

J
Johannes Berg 已提交
3962 3963 3964 3965
	/*
	 * Push the beacon loss detection into the future since
	 * we are processing a beacon from the AP just now.
	 */
3966
	ieee80211_sta_reset_beacon_monitor(sdata);
J
Johannes Berg 已提交
3967

3968 3969
	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
3970
					  len - baselen, false, &elems,
3971 3972
					  care_about_ies, ncrc,
					  mgmt->bssid, bssid);
3973

3974
	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
3975
	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
3976 3977 3978 3979 3980
		if (local->hw.conf.dynamic_ps_timeout > 0) {
			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
				ieee80211_hw_config(local,
						    IEEE80211_CONF_CHANGE_PS);
3981
			}
3982
			ieee80211_send_nullfunc(local, sdata, false);
3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994
		} else if (!local->pspolling && sdata->u.mgd.powersave) {
			local->pspolling = true;

			/*
			 * Here is assumed that the driver will be
			 * able to send ps-poll frame and receive a
			 * response even though power save mode is
			 * enabled, but some drivers might require
			 * to disable power save here. This needs
			 * to be investigated.
			 */
			ieee80211_send_pspoll(local, sdata);
3995 3996
		}
	}
J
Johannes Berg 已提交
3997

3998 3999
	if (sdata->vif.p2p ||
	    sdata->vif.driver_flags & IEEE80211_VIF_GET_NOA_UPDATE) {
J
Janusz Dziedzic 已提交
4000
		struct ieee80211_p2p_noa_attr noa = {};
4001 4002 4003 4004 4005
		int ret;

		ret = cfg80211_get_p2p_attr(mgmt->u.beacon.variable,
					    len - baselen,
					    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
4006
					    (u8 *) &noa, sizeof(noa));
J
Janusz Dziedzic 已提交
4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022
		if (ret >= 2) {
			if (sdata->u.mgd.p2p_noa_index != noa.index) {
				/* valid noa_attr and index changed */
				sdata->u.mgd.p2p_noa_index = noa.index;
				memcpy(&bss_conf->p2p_noa_attr, &noa, sizeof(noa));
				changed |= BSS_CHANGED_P2P_PS;
				/*
				 * make sure we update all information, the CRC
				 * mechanism doesn't look at P2P attributes.
				 */
				ifmgd->beacon_crc_valid = false;
			}
		} else if (sdata->u.mgd.p2p_noa_index != -1) {
			/* noa_attr not found and we had valid noa_attr before */
			sdata->u.mgd.p2p_noa_index = -1;
			memset(&bss_conf->p2p_noa_attr, 0, sizeof(bss_conf->p2p_noa_attr));
4023 4024 4025 4026 4027
			changed |= BSS_CHANGED_P2P_PS;
			ifmgd->beacon_crc_valid = false;
		}
	}

4028 4029 4030
	if (ifmgd->csa_waiting_bcn)
		ieee80211_chswitch_post_beacon(sdata);

4031 4032 4033 4034 4035 4036 4037 4038
	/*
	 * Update beacon timing and dtim count on every beacon appearance. This
	 * will allow the driver to use the most updated values. Do it before
	 * comparing this one with last received beacon.
	 * IMPORTANT: These parameters would possibly be out of sync by the time
	 * the driver will use them. The synchronized view is currently
	 * guaranteed only in certain callbacks.
	 */
4039
	if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
4040 4041 4042 4043
		sdata->vif.bss_conf.sync_tsf =
			le64_to_cpu(mgmt->u.beacon.timestamp);
		sdata->vif.bss_conf.sync_device_ts =
			rx_status->device_timestamp;
S
Sara Sharon 已提交
4044
		sdata->vif.bss_conf.sync_dtim_count = elems.dtim_count;
4045 4046
	}

4047
	if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
4048
		return;
4049
	ifmgd->beacon_crc = ncrc;
4050
	ifmgd->beacon_crc_valid = true;
4051

4052
	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status);
4053

4054
	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
4055
					 rx_status->device_timestamp,
4056 4057
					 &elems, true);

4058 4059
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
	    ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
L
Luca Coelho 已提交
4060 4061
				     elems.wmm_param_len,
				     elems.mu_edca_param_set))
4062 4063
		changed |= BSS_CHANGED_QOS;

4064 4065
	/*
	 * If we haven't had a beacon before, tell the driver about the
4066
	 * DTIM period (and beacon timing if desired) now.
4067
	 */
4068
	if (!ifmgd->have_beacon) {
4069
		/* a few bogus AP send dtim_period = 0 or no TIM IE */
S
Sara Sharon 已提交
4070
		bss_conf->dtim_period = elems.dtim_period ?: 1;
4071

4072 4073
		changed |= BSS_CHANGED_BEACON_INFO;
		ifmgd->have_beacon = true;
4074 4075

		mutex_lock(&local->iflist_mtx);
J
Johannes Berg 已提交
4076
		ieee80211_recalc_ps(local);
4077 4078
		mutex_unlock(&local->iflist_mtx);

4079
		ieee80211_recalc_ps_vif(sdata);
4080 4081
	}

4082
	if (elems.erp_info) {
J
Johannes Berg 已提交
4083 4084 4085 4086
		erp_valid = true;
		erp_value = elems.erp_info[0];
	} else {
		erp_valid = false;
4087
	}
J
Johannes Berg 已提交
4088 4089 4090
	changed |= ieee80211_handle_bss_capability(sdata,
			le16_to_cpu(mgmt->u.beacon.capab_info),
			erp_valid, erp_value);
4091

4092
	mutex_lock(&local->sta_mtx);
4093 4094
	sta = sta_info_get(sdata, bssid);

4095 4096
	changed |= ieee80211_recalc_twt_req(sdata, sta, &elems);

4097 4098
	if (ieee80211_config_bw(sdata, sta,
				elems.ht_cap_elem, elems.ht_operation,
L
Luca Coelho 已提交
4099 4100
				elems.vht_operation, elems.he_operation,
				bssid, &changed)) {
4101
		mutex_unlock(&local->sta_mtx);
4102 4103 4104
		sdata_info(sdata,
			   "failed to follow AP %pM bandwidth change, disconnect\n",
			   bssid);
4105 4106 4107
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_DEAUTH_LEAVING,
				       true, deauth_buf);
4108 4109 4110
		ieee80211_report_disconnect(sdata, deauth_buf,
					    sizeof(deauth_buf), true,
					    WLAN_REASON_DEAUTH_LEAVING);
4111
		return;
4112
	}
4113 4114 4115

	if (sta && elems.opmode_notif)
		ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
4116
					    rx_status->band);
4117
	mutex_unlock(&local->sta_mtx);
4118

4119 4120 4121
	changed |= ieee80211_handle_pwr_constr(sdata, chan, mgmt,
					       elems.country_elem,
					       elems.country_elem_len,
4122 4123
					       elems.pwr_constr_elem,
					       elems.cisco_dtpc_elem);
4124

4125
	ieee80211_bss_info_change_notify(sdata, changed);
4126 4127
}

4128 4129
void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
				  struct sk_buff *skb)
4130 4131 4132 4133
{
	struct ieee80211_rx_status *rx_status;
	struct ieee80211_mgmt *mgmt;
	u16 fc;
4134 4135
	struct ieee802_11_elems elems;
	int ies_len;
4136 4137 4138 4139 4140

	rx_status = (struct ieee80211_rx_status *) skb->cb;
	mgmt = (struct ieee80211_mgmt *) skb->data;
	fc = le16_to_cpu(mgmt->frame_control);

4141
	sdata_lock(sdata);
4142

J
Johannes Berg 已提交
4143 4144
	switch (fc & IEEE80211_FCTL_STYPE) {
	case IEEE80211_STYPE_BEACON:
4145
		ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
J
Johannes Berg 已提交
4146 4147 4148 4149 4150
		break;
	case IEEE80211_STYPE_PROBE_RESP:
		ieee80211_rx_mgmt_probe_resp(sdata, skb);
		break;
	case IEEE80211_STYPE_AUTH:
4151
		ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4152 4153
		break;
	case IEEE80211_STYPE_DEAUTH:
4154
		ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4155 4156
		break;
	case IEEE80211_STYPE_DISASSOC:
4157
		ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4158 4159 4160
		break;
	case IEEE80211_STYPE_ASSOC_RESP:
	case IEEE80211_STYPE_REASSOC_RESP:
4161
		ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
J
Johannes Berg 已提交
4162 4163
		break;
	case IEEE80211_STYPE_ACTION:
4164
		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
4165 4166 4167
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.chan_switch.variable);
4168 4169 4170 4171

			if (ies_len < 0)
				break;

4172
			/* CSA IE cannot be overridden, no need for BSSID */
4173 4174
			ieee802_11_parse_elems(
				mgmt->u.action.u.chan_switch.variable,
4175
				ies_len, true, &elems, mgmt->bssid, NULL);
4176 4177 4178 4179

			if (elems.parse_error)
				break;

4180
			ieee80211_sta_process_chanswitch(sdata,
4181 4182 4183
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4184 4185 4186 4187 4188 4189 4190 4191
		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
			ies_len = skb->len -
				  offsetof(struct ieee80211_mgmt,
					   u.action.u.ext_chan_switch.variable);

			if (ies_len < 0)
				break;

4192 4193 4194 4195
			/*
			 * extended CSA IE can't be overridden, no need for
			 * BSSID
			 */
4196 4197
			ieee802_11_parse_elems(
				mgmt->u.action.u.ext_chan_switch.variable,
4198
				ies_len, true, &elems, mgmt->bssid, NULL);
4199 4200 4201 4202 4203 4204 4205 4206

			if (elems.parse_error)
				break;

			/* for the handling code pretend this was also an IE */
			elems.ext_chansw_ie =
				&mgmt->u.action.u.ext_chan_switch.data;

J
Johannes Berg 已提交
4207
			ieee80211_sta_process_chanswitch(sdata,
4208 4209 4210
						 rx_status->mactime,
						 rx_status->device_timestamp,
						 &elems, false);
4211
		}
4212
		break;
4213
	}
4214
	sdata_unlock(sdata);
4215 4216
}

4217
static void ieee80211_sta_timer(struct timer_list *t)
4218
{
J
Johannes Berg 已提交
4219
	struct ieee80211_sub_if_data *sdata =
4220
		from_timer(sdata, t, u.mgd.timer);
4221

4222
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
4223 4224
}

4225
static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
4226
					  u8 *bssid, u8 reason, bool tx)
4227
{
4228
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
4229

4230
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
4231
			       tx, frame_buf);
4232

4233 4234
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    reason);
4235 4236
}

4237
static int ieee80211_auth(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4238 4239 4240 4241
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
4242
	u32 tx_flags = 0;
4243 4244
	u16 trans = 1;
	u16 status = 0;
4245
	u16 prepare_tx_duration = 0;
J
Johannes Berg 已提交
4246

4247
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4248 4249 4250 4251 4252 4253 4254

	if (WARN_ON_ONCE(!auth_data))
		return -EINVAL;

	auth_data->tries++;

	if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
J
Johannes Berg 已提交
4255 4256
		sdata_info(sdata, "authentication with %pM timed out\n",
			   auth_data->bss->bssid);
J
Johannes Berg 已提交
4257 4258 4259 4260 4261 4262 4263 4264 4265 4266

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, auth_data->bss);

		return -ETIMEDOUT;
	}

4267 4268 4269 4270 4271
	if (auth_data->algorithm == WLAN_AUTH_SAE)
		prepare_tx_duration =
			jiffies_to_msecs(IEEE80211_AUTH_TIMEOUT_SAE);

	drv_mgd_prepare_tx(local, sdata, prepare_tx_duration);
J
Johannes Berg 已提交
4272

4273 4274 4275
	sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
		   auth_data->bss->bssid, auth_data->tries,
		   IEEE80211_AUTH_MAX_TRIES);
J
Johannes Berg 已提交
4276

4277
	auth_data->expected_transaction = 2;
4278

4279 4280 4281 4282 4283
	if (auth_data->algorithm == WLAN_AUTH_SAE) {
		trans = auth_data->sae_trans;
		status = auth_data->sae_status;
		auth_data->expected_transaction = trans;
	}
J
Johannes Berg 已提交
4284

4285 4286 4287
	if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
			   IEEE80211_TX_INTFL_MLME_CONN_TX;
J
Johannes Berg 已提交
4288

4289 4290 4291 4292 4293
	ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
			    auth_data->data, auth_data->data_len,
			    auth_data->bss->bssid,
			    auth_data->bss->bssid, NULL, 0, 0,
			    tx_flags);
J
Johannes Berg 已提交
4294

4295
	if (tx_flags == 0) {
4296 4297 4298 4299 4300
		if (auth_data->algorithm == WLAN_AUTH_SAE)
			auth_data->timeout = jiffies +
				IEEE80211_AUTH_TIMEOUT_SAE;
		else
			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
4301
	} else {
4302 4303
		auth_data->timeout =
			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
4304
	}
J
Johannes Berg 已提交
4305

4306 4307 4308
	auth_data->timeout_started = true;
	run_again(sdata, auth_data->timeout);

J
Johannes Berg 已提交
4309 4310 4311 4312 4313 4314 4315 4316
	return 0;
}

static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
	struct ieee80211_local *local = sdata->local;

4317
	sdata_assert_lock(sdata);
J
Johannes Berg 已提交
4318 4319 4320

	assoc_data->tries++;
	if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
J
Johannes Berg 已提交
4321 4322
		sdata_info(sdata, "association with %pM timed out\n",
			   assoc_data->bss->bssid);
J
Johannes Berg 已提交
4323 4324 4325 4326 4327 4328 4329 4330 4331 4332

		/*
		 * Most likely AP is not in the range so remove the
		 * bss struct for that AP.
		 */
		cfg80211_unlink_bss(local->hw.wiphy, assoc_data->bss);

		return -ETIMEDOUT;
	}

J
Johannes Berg 已提交
4333 4334 4335
	sdata_info(sdata, "associate with %pM (try %d/%d)\n",
		   assoc_data->bss->bssid, assoc_data->tries,
		   IEEE80211_ASSOC_MAX_TRIES);
J
Johannes Berg 已提交
4336 4337
	ieee80211_send_assoc(sdata);

4338
	if (!ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
4339
		assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
4340
		assoc_data->timeout_started = true;
4341
		run_again(sdata, assoc_data->timeout);
4342
	} else {
4343 4344 4345 4346 4347
		assoc_data->timeout =
			round_jiffies_up(jiffies +
					 IEEE80211_ASSOC_TIMEOUT_LONG);
		assoc_data->timeout_started = true;
		run_again(sdata, assoc_data->timeout);
4348
	}
J
Johannes Berg 已提交
4349 4350 4351 4352

	return 0;
}

4353 4354 4355 4356 4357 4358 4359 4360 4361 4362 4363 4364
void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
				  __le16 fc, bool acked)
{
	struct ieee80211_local *local = sdata->local;

	sdata->u.mgd.status_fc = fc;
	sdata->u.mgd.status_acked = acked;
	sdata->u.mgd.status_received = true;

	ieee80211_queue_work(&local->hw, &sdata->work);
}

4365
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
4366 4367
{
	struct ieee80211_local *local = sdata->local;
4368
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4369

4370
	sdata_lock(sdata);
4371

4372 4373 4374 4375 4376
	if (ifmgd->status_received) {
		__le16 fc = ifmgd->status_fc;
		bool status_acked = ifmgd->status_acked;

		ifmgd->status_received = false;
4377
		if (ifmgd->auth_data && ieee80211_is_auth(fc)) {
4378
			if (status_acked) {
4379 4380 4381 4382 4383 4384 4385 4386 4387
				if (ifmgd->auth_data->algorithm ==
				    WLAN_AUTH_SAE)
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SAE;
				else
					ifmgd->auth_data->timeout =
						jiffies +
						IEEE80211_AUTH_TIMEOUT_SHORT;
4388
				run_again(sdata, ifmgd->auth_data->timeout);
4389 4390 4391
			} else {
				ifmgd->auth_data->timeout = jiffies - 1;
			}
4392
			ifmgd->auth_data->timeout_started = true;
4393 4394 4395 4396 4397 4398
		} else if (ifmgd->assoc_data &&
			   (ieee80211_is_assoc_req(fc) ||
			    ieee80211_is_reassoc_req(fc))) {
			if (status_acked) {
				ifmgd->assoc_data->timeout =
					jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
4399
				run_again(sdata, ifmgd->assoc_data->timeout);
4400 4401 4402
			} else {
				ifmgd->assoc_data->timeout = jiffies - 1;
			}
4403
			ifmgd->assoc_data->timeout_started = true;
4404 4405 4406
		}
	}

4407
	if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
J
Johannes Berg 已提交
4408 4409 4410 4411 4412 4413 4414
	    time_after(jiffies, ifmgd->auth_data->timeout)) {
		if (ifmgd->auth_data->done) {
			/*
			 * ok ... we waited for assoc but userspace didn't,
			 * so let's just kill the auth data
			 */
			ieee80211_destroy_auth_data(sdata, false);
4415
		} else if (ieee80211_auth(sdata)) {
J
Johannes Berg 已提交
4416
			u8 bssid[ETH_ALEN];
4417 4418 4419 4420 4421
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = AUTH_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4422 4423 4424 4425 4426

			memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);

			ieee80211_destroy_auth_data(sdata, false);

4427
			cfg80211_auth_timeout(sdata->dev, bssid);
4428
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4429
		}
4430
	} else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
4431
		run_again(sdata, ifmgd->auth_data->timeout);
J
Johannes Berg 已提交
4432

4433
	if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
J
Johannes Berg 已提交
4434
	    time_after(jiffies, ifmgd->assoc_data->timeout)) {
4435
		if ((ifmgd->assoc_data->need_beacon && !ifmgd->have_beacon) ||
J
Johannes Berg 已提交
4436
		    ieee80211_do_assoc(sdata)) {
4437
			struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
4438 4439 4440 4441 4442
			struct ieee80211_event event = {
				.type = MLME_EVENT,
				.u.mlme.data = ASSOC_EVENT,
				.u.mlme.status = MLME_TIMEOUT,
			};
J
Johannes Berg 已提交
4443

4444
			ieee80211_destroy_assoc_data(sdata, false, false);
4445
			cfg80211_assoc_timeout(sdata->dev, bss);
4446
			drv_event_callback(sdata->local, sdata, &event);
J
Johannes Berg 已提交
4447
		}
4448
	} else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
4449
		run_again(sdata, ifmgd->assoc_data->timeout);
J
Johannes Berg 已提交
4450

4451
	if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL &&
J
Johannes Berg 已提交
4452
	    ifmgd->associated) {
4453
		u8 bssid[ETH_ALEN];
4454
		int max_tries;
4455

4456
		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
4457

4458
		if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS))
4459
			max_tries = max_nullfunc_tries;
4460
		else
4461
			max_tries = max_probe_tries;
4462

4463 4464 4465
		/* ACK received for nullfunc probing frame */
		if (!ifmgd->probe_send_count)
			ieee80211_reset_ap_probe(sdata);
4466 4467
		else if (ifmgd->nullfunc_failed) {
			if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4468 4469 4470 4471
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, try %d/%i\n",
					 bssid, ifmgd->probe_send_count,
					 max_tries);
4472 4473
				ieee80211_mgd_probe_ap_send(sdata);
			} else {
J
Johannes Berg 已提交
4474 4475 4476
				mlme_dbg(sdata,
					 "No ack for nullfunc frame to AP %pM, disconnecting.\n",
					 bssid);
4477
				ieee80211_sta_connection_lost(sdata, bssid,
4478 4479
					WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
					false);
4480 4481
			}
		} else if (time_is_after_jiffies(ifmgd->probe_timeout))
4482
			run_again(sdata, ifmgd->probe_timeout);
4483
		else if (ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS)) {
J
Johannes Berg 已提交
4484 4485 4486
			mlme_dbg(sdata,
				 "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
				 bssid, probe_wait_ms);
4487
			ieee80211_sta_connection_lost(sdata, bssid,
4488
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
4489
		} else if (ifmgd->probe_send_count < max_tries) {
J
Johannes Berg 已提交
4490 4491 4492 4493
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, try %d/%i\n",
				 bssid, probe_wait_ms,
				 ifmgd->probe_send_count, max_tries);
4494 4495
			ieee80211_mgd_probe_ap_send(sdata);
		} else {
J
Johannes Berg 已提交
4496 4497 4498 4499
			/*
			 * We actually lost the connection ... or did we?
			 * Let's make sure!
			 */
4500 4501 4502
			mlme_dbg(sdata,
				 "No probe response from AP %pM after %dms, disconnecting.\n",
				 bssid, probe_wait_ms);
4503

4504
			ieee80211_sta_connection_lost(sdata, bssid,
4505
				WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
J
Johannes Berg 已提交
4506 4507 4508
		}
	}

4509
	sdata_unlock(sdata);
4510 4511
}

4512
static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4513 4514
{
	struct ieee80211_sub_if_data *sdata =
4515
		from_timer(sdata, t, u.mgd.bcn_mon_timer);
4516
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4517

4518
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4519 4520
		return;

4521
	sdata->u.mgd.connection_loss = false;
4522 4523
	ieee80211_queue_work(&sdata->local->hw,
			     &sdata->u.mgd.beacon_connection_loss_work);
J
Johannes Berg 已提交
4524 4525
}

4526
static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
J
Johannes Berg 已提交
4527 4528
{
	struct ieee80211_sub_if_data *sdata =
4529
		from_timer(sdata, t, u.mgd.conn_mon_timer);
J
Johannes Berg 已提交
4530 4531 4532
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_local *local = sdata->local;

4533
	if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
M
Michal Kazior 已提交
4534 4535
		return;

4536
	ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
J
Johannes Berg 已提交
4537 4538 4539 4540 4541 4542 4543 4544 4545 4546 4547
}

static void ieee80211_sta_monitor_work(struct work_struct *work)
{
	struct ieee80211_sub_if_data *sdata =
		container_of(work, struct ieee80211_sub_if_data,
			     u.mgd.monitor_work);

	ieee80211_mgd_probe_ap(sdata, false);
}

J
Johannes Berg 已提交
4548 4549
static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
{
4550
	if (sdata->vif.type == NL80211_IFTYPE_STATION) {
4551
		__ieee80211_stop_poll(sdata);
4552

J
Johannes Berg 已提交
4553
		/* let's probe the connection once */
4554
		if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
4555 4556
			ieee80211_queue_work(&sdata->local->hw,
					     &sdata->u.mgd.monitor_work);
4557
	}
J
Johannes Berg 已提交
4558
}
4559

4560
#ifdef CONFIG_PM
4561 4562 4563 4564 4565 4566 4567
void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

	sdata_lock(sdata);

4568 4569 4570 4571 4572
	if (ifmgd->auth_data || ifmgd->assoc_data) {
		const u8 *bssid = ifmgd->auth_data ?
				ifmgd->auth_data->bss->bssid :
				ifmgd->assoc_data->bss->bssid;

4573
		/*
4574 4575 4576
		 * If we are trying to authenticate / associate while suspending,
		 * cfg80211 won't know and won't actually abort those attempts,
		 * thus we need to do that ourselves.
4577
		 */
4578
		ieee80211_send_deauth_disassoc(sdata, bssid, bssid,
4579 4580 4581
					       IEEE80211_STYPE_DEAUTH,
					       WLAN_REASON_DEAUTH_LEAVING,
					       false, frame_buf);
4582
		if (ifmgd->assoc_data)
4583
			ieee80211_destroy_assoc_data(sdata, false, true);
4584 4585
		if (ifmgd->auth_data)
			ieee80211_destroy_auth_data(sdata, false);
4586 4587 4588 4589
		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
				      IEEE80211_DEAUTH_FRAME_LEN);
	}

4590 4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617
	/* This is a bit of a hack - we should find a better and more generic
	 * solution to this. Normally when suspending, cfg80211 will in fact
	 * deauthenticate. However, it doesn't (and cannot) stop an ongoing
	 * auth (not so important) or assoc (this is the problem) process.
	 *
	 * As a consequence, it can happen that we are in the process of both
	 * associating and suspending, and receive an association response
	 * after cfg80211 has checked if it needs to disconnect, but before
	 * we actually set the flag to drop incoming frames. This will then
	 * cause the workqueue flush to process the association response in
	 * the suspend, resulting in a successful association just before it
	 * tries to remove the interface from the driver, which now though
	 * has a channel context assigned ... this results in issues.
	 *
	 * To work around this (for now) simply deauth here again if we're
	 * now connected.
	 */
	if (ifmgd->associated && !sdata->local->wowlan) {
		u8 bssid[ETH_ALEN];
		struct cfg80211_deauth_request req = {
			.reason_code = WLAN_REASON_DEAUTH_LEAVING,
			.bssid = bssid,
		};

		memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
		ieee80211_mgd_deauth(sdata, &req);
	}

4618 4619 4620
	sdata_unlock(sdata);
}

4621 4622 4623 4624
void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

4625
	sdata_lock(sdata);
4626
	if (!ifmgd->associated) {
4627
		sdata_unlock(sdata);
4628 4629 4630 4631 4632 4633 4634 4635 4636 4637
		return;
	}

	if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
		sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
		mlme_dbg(sdata, "driver requested disconnect after resume\n");
		ieee80211_sta_connection_lost(sdata,
					      ifmgd->associated->bssid,
					      WLAN_REASON_UNSPECIFIED,
					      true);
4638
		sdata_unlock(sdata);
4639 4640
		return;
	}
4641
	sdata_unlock(sdata);
4642 4643 4644
}
#endif

J
Johannes Berg 已提交
4645 4646
/* interface setup */
void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
4647
{
4648
	struct ieee80211_if_managed *ifmgd;
J
Johannes Berg 已提交
4649

4650
	ifmgd = &sdata->u.mgd;
J
Johannes Berg 已提交
4651
	INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
4652
	INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
4653 4654
	INIT_WORK(&ifmgd->beacon_connection_loss_work,
		  ieee80211_beacon_connection_loss_work);
4655 4656
	INIT_WORK(&ifmgd->csa_connection_drop_work,
		  ieee80211_csa_connection_drop_work);
4657
	INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_mgd_work);
4658 4659
	INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
			  ieee80211_tdls_peer_del_work);
4660 4661 4662 4663
	timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
	timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
	timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
	timer_setup(&ifmgd->chswitch_timer, ieee80211_chswitch_timer, 0);
4664 4665
	INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
			  ieee80211_sta_handle_tspec_ac_params_wk);
J
Johannes Berg 已提交
4666

4667
	ifmgd->flags = 0;
4668
	ifmgd->powersave = sdata->wdev.ps;
4669 4670
	ifmgd->uapsd_queues = sdata->local->hw.uapsd_queues;
	ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
J
Janusz Dziedzic 已提交
4671
	ifmgd->p2p_noa_index = -1;
J
Johannes Berg 已提交
4672

4673
	if (sdata->local->hw.wiphy->features & NL80211_FEATURE_DYNAMIC_SMPS)
4674 4675 4676
		ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
	else
		ifmgd->req_smps = IEEE80211_SMPS_OFF;
4677 4678 4679 4680 4681

	/* Setup TDLS data */
	spin_lock_init(&ifmgd->teardown_lock);
	ifmgd->teardown_skb = NULL;
	ifmgd->orig_teardown_skb = NULL;
4682 4683
}

4684 4685
/* scan finished notification */
void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
J
Johannes Berg 已提交
4686
{
4687
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
4688

4689 4690
	/* Restart STA timers */
	rcu_read_lock();
4691 4692 4693 4694
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (ieee80211_sdata_running(sdata))
			ieee80211_restart_sta_timer(sdata);
	}
4695 4696
	rcu_read_unlock();
}
J
Johannes Berg 已提交
4697

J
Johannes Berg 已提交
4698 4699 4700 4701 4702 4703 4704 4705 4706 4707 4708 4709
static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
				     struct cfg80211_bss *cbss)
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	const u8 *ht_cap_ie, *vht_cap_ie;
	const struct ieee80211_ht_cap *ht_cap;
	const struct ieee80211_vht_cap *vht_cap;
	u8 chains = 1;

	if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
		return chains;

4710
	ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
J
Johannes Berg 已提交
4711 4712 4713 4714 4715 4716 4717 4718 4719 4720 4721 4722
	if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
		ht_cap = (void *)(ht_cap_ie + 2);
		chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
		/*
		 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
		 *	 "Tx Unequal Modulation Supported" fields.
		 */
	}

	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
		return chains;

4723
	vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
J
Johannes Berg 已提交
4724 4725 4726 4727 4728 4729 4730 4731 4732 4733 4734 4735 4736 4737 4738 4739 4740 4741
	if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
		u8 nss;
		u16 tx_mcs_map;

		vht_cap = (void *)(vht_cap_ie + 2);
		tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
		for (nss = 8; nss > 0; nss--) {
			if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
					IEEE80211_VHT_MCS_NOT_SUPPORTED)
				break;
		}
		/* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
		chains = max(chains, nss);
	}

	return chains;
}

L
Luca Coelho 已提交
4742 4743 4744 4745 4746 4747
static bool
ieee80211_verify_sta_he_mcs_support(struct ieee80211_supported_band *sband,
				    const struct ieee80211_he_operation *he_op)
{
	const struct ieee80211_sta_he_cap *sta_he_cap =
		ieee80211_get_he_sta_cap(sband);
4748
	u16 ap_min_req_set;
L
Luca Coelho 已提交
4749 4750 4751 4752 4753
	int i;

	if (!sta_he_cap || !he_op)
		return false;

4754 4755
	ap_min_req_set = le16_to_cpu(he_op->he_mcs_nss_set);

L
Luca Coelho 已提交
4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785 4786 4787 4788 4789 4790 4791 4792 4793 4794 4795 4796 4797 4798 4799 4800 4801 4802 4803
	/* Need to go over for 80MHz, 160MHz and for 80+80 */
	for (i = 0; i < 3; i++) {
		const struct ieee80211_he_mcs_nss_supp *sta_mcs_nss_supp =
			&sta_he_cap->he_mcs_nss_supp;
		u16 sta_mcs_map_rx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i]);
		u16 sta_mcs_map_tx =
			le16_to_cpu(((__le16 *)sta_mcs_nss_supp)[2 * i + 1]);
		u8 nss;
		bool verified = true;

		/*
		 * For each band there is a maximum of 8 spatial streams
		 * possible. Each of the sta_mcs_map_* is a 16-bit struct built
		 * of 2 bits per NSS (1-8), with the values defined in enum
		 * ieee80211_he_mcs_support. Need to make sure STA TX and RX
		 * capabilities aren't less than the AP's minimum requirements
		 * for this HE BSS per SS.
		 * It is enough to find one such band that meets the reqs.
		 */
		for (nss = 8; nss > 0; nss--) {
			u8 sta_rx_val = (sta_mcs_map_rx >> (2 * (nss - 1))) & 3;
			u8 sta_tx_val = (sta_mcs_map_tx >> (2 * (nss - 1))) & 3;
			u8 ap_val = (ap_min_req_set >> (2 * (nss - 1))) & 3;

			if (ap_val == IEEE80211_HE_MCS_NOT_SUPPORTED)
				continue;

			/*
			 * Make sure the HE AP doesn't require MCSs that aren't
			 * supported by the client
			 */
			if (sta_rx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    sta_tx_val == IEEE80211_HE_MCS_NOT_SUPPORTED ||
			    (ap_val > sta_rx_val) || (ap_val > sta_tx_val)) {
				verified = false;
				break;
			}
		}

		if (verified)
			return true;
	}

	/* If here, STA doesn't meet AP's HE min requirements */
	return false;
}

4804 4805
static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
				  struct cfg80211_bss *cbss)
4806 4807 4808
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
4809
	const struct ieee80211_ht_cap *ht_cap = NULL;
4810
	const struct ieee80211_ht_operation *ht_oper = NULL;
J
Johannes Berg 已提交
4811
	const struct ieee80211_vht_operation *vht_oper = NULL;
L
Luca Coelho 已提交
4812
	const struct ieee80211_he_operation *he_oper = NULL;
4813
	struct ieee80211_supported_band *sband;
4814
	struct cfg80211_chan_def chandef;
J
Johannes Berg 已提交
4815
	int ret;
4816 4817
	u32 i;
	bool have_80mhz;
4818

4819 4820
	sband = local->hw.wiphy->bands[cbss->channel->band];

J
Johannes Berg 已提交
4821 4822 4823 4824
	ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
			  IEEE80211_STA_DISABLE_80P80MHZ |
			  IEEE80211_STA_DISABLE_160MHZ);

4825 4826 4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837
	/* disable HT/VHT/HE if we don't support them */
	if (!sband->ht_cap.ht_supported) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

	if (!sband->vht_cap.vht_supported)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	if (!ieee80211_get_he_sta_cap(sband))
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;

4838 4839
	rcu_read_lock();

4840
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
4841
		const u8 *ht_oper_ie, *ht_cap_ie;
4842

4843
		ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
4844 4845
		if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
			ht_oper = (void *)(ht_oper_ie + 2);
4846

4847 4848 4849 4850 4851
		ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
		if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
			ht_cap = (void *)(ht_cap_ie + 2);

		if (!ht_cap) {
4852 4853 4854
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ht_oper = NULL;
		}
4855 4856
	}

4857
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)) {
4858
		const u8 *vht_oper_ie, *vht_cap;
J
Johannes Berg 已提交
4859

4860 4861
		vht_oper_ie = ieee80211_bss_get_ie(cbss,
						   WLAN_EID_VHT_OPERATION);
J
Johannes Berg 已提交
4862 4863 4864 4865
		if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
			vht_oper = (void *)(vht_oper_ie + 2);
		if (vht_oper && !ht_oper) {
			vht_oper = NULL;
J
Johannes Berg 已提交
4866
			sdata_info(sdata,
4867
				   "AP advertised VHT without HT, disabling HT/VHT/HE\n");
4868 4869
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
4870
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
4871
		}
4872 4873 4874 4875 4876 4877

		vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
		if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
			vht_oper = NULL;
		}
4878 4879
	}

4880
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HE)) {
L
Luca Coelho 已提交
4881 4882 4883 4884 4885 4886 4887 4888 4889 4890 4891 4892
		const struct cfg80211_bss_ies *ies;
		const u8 *he_oper_ie;

		ies = rcu_dereference(cbss->ies);
		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
						  ies->data, ies->len);
		if (he_oper_ie &&
		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
			he_oper = (void *)(he_oper_ie + 3);
		else
			he_oper = NULL;

4893
		if (!ieee80211_verify_sta_he_mcs_support(sband, he_oper))
L
Luca Coelho 已提交
4894 4895 4896
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
	}

4897 4898 4899 4900 4901 4902 4903 4904 4905 4906 4907 4908 4909 4910
	/* Allow VHT if at least one channel on the sband supports 80 MHz */
	have_80mhz = false;
	for (i = 0; i < sband->n_channels; i++) {
		if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
						IEEE80211_CHAN_NO_80MHZ))
			continue;

		have_80mhz = true;
		break;
	}

	if (!have_80mhz)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

J
Johannes Berg 已提交
4911 4912
	ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
						     cbss->channel,
L
Luca Coelho 已提交
4913
						     ht_oper, vht_oper, he_oper,
4914
						     &chandef, false);
4915

J
Johannes Berg 已提交
4916 4917
	sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
				      local->rx_chains);
4918

4919 4920
	rcu_read_unlock();

4921 4922 4923
	/* will change later if needed */
	sdata->smps_mode = IEEE80211_SMPS_OFF;

4924
	mutex_lock(&local->mtx);
J
Johannes Berg 已提交
4925 4926 4927 4928 4929 4930 4931
	/*
	 * If this fails (possibly due to channel context sharing
	 * on incompatible channels, e.g. 80+80 and 160 sharing the
	 * same control channel) try to use a smaller bandwidth.
	 */
	ret = ieee80211_vif_use_channel(sdata, &chandef,
					IEEE80211_CHANCTX_SHARED);
4932 4933 4934 4935

	/* don't downgrade for 5 and 10 MHz channels, though. */
	if (chandef.width == NL80211_CHAN_WIDTH_5 ||
	    chandef.width == NL80211_CHAN_WIDTH_10)
4936
		goto out;
4937

4938
	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
4939
		ifmgd->flags |= ieee80211_chandef_downgrade(&chandef);
4940 4941 4942
		ret = ieee80211_vif_use_channel(sdata, &chandef,
						IEEE80211_CHANCTX_SHARED);
	}
4943 4944
 out:
	mutex_unlock(&local->mtx);
J
Johannes Berg 已提交
4945
	return ret;
4946 4947
}

S
Sara Sharon 已提交
4948 4949 4950 4951 4952 4953 4954 4955 4956 4957 4958 4959 4960 4961 4962 4963 4964 4965 4966 4967 4968 4969 4970 4971 4972 4973 4974 4975 4976 4977 4978 4979 4980 4981
static bool ieee80211_get_dtim(const struct cfg80211_bss_ies *ies,
			       u8 *dtim_count, u8 *dtim_period)
{
	const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
	const u8 *idx_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, ies->data,
					 ies->len);
	const struct ieee80211_tim_ie *tim = NULL;
	const struct ieee80211_bssid_index *idx;
	bool valid = tim_ie && tim_ie[1] >= 2;

	if (valid)
		tim = (void *)(tim_ie + 2);

	if (dtim_count)
		*dtim_count = valid ? tim->dtim_count : 0;

	if (dtim_period)
		*dtim_period = valid ? tim->dtim_period : 0;

	/* Check if value is overridden by non-transmitted profile */
	if (!idx_ie || idx_ie[1] < 3)
		return valid;

	idx = (void *)(idx_ie + 2);

	if (dtim_count)
		*dtim_count = idx->dtim_count;

	if (dtim_period)
		*dtim_period = idx->dtim_period;

	return true;
}

4982
static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
4983 4984
				     struct cfg80211_bss *cbss, bool assoc,
				     bool override)
4985 4986 4987 4988 4989
{
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_bss *bss = (void *)cbss->priv;
	struct sta_info *new_sta = NULL;
4990
	struct ieee80211_supported_band *sband;
4991
	bool have_sta = false;
4992 4993
	int err;

4994 4995
	sband = local->hw.wiphy->bands[cbss->channel->band];

4996 4997 4998
	if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
		return -EINVAL;

4999 5000 5001 5002
	/* If a reconfig is happening, bail out */
	if (local->in_reconfig)
		return -EBUSY;

5003 5004 5005 5006 5007 5008 5009 5010 5011 5012 5013
	if (assoc) {
		rcu_read_lock();
		have_sta = sta_info_get(sdata, cbss->bssid);
		rcu_read_unlock();
	}

	if (!have_sta) {
		new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
		if (!new_sta)
			return -ENOMEM;
	}
5014

5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027
	/*
	 * Set up the information for the new channel before setting the
	 * new channel. We can't - completely race-free - change the basic
	 * rates bitmap and the channel (sband) that it refers to, but if
	 * we set it up before we at least avoid calling into the driver's
	 * bss_info_changed() method with invalid information (since we do
	 * call that from changing the channel - only for IDLE and perhaps
	 * some others, but ...).
	 *
	 * So to avoid that, just set up all the new information before the
	 * channel, but tell the driver to apply it only afterwards, since
	 * it might need the new channel for that.
	 */
J
Johannes Berg 已提交
5028
	if (new_sta) {
5029 5030 5031
		u32 rates = 0, basic_rates = 0;
		bool have_higher_than_11mbit;
		int min_rate = INT_MAX, min_rate_index = -1;
J
Johannes Berg 已提交
5032
		const struct cfg80211_bss_ies *ies;
5033
		int shift = ieee80211_vif_get_shift(&sdata->vif);
5034 5035 5036 5037 5038

		ieee80211_get_rates(sband, bss->supp_rates,
				    bss->supp_rates_len,
				    &rates, &basic_rates,
				    &have_higher_than_11mbit,
5039
				    &min_rate, &min_rate_index,
5040
				    shift);
5041 5042 5043 5044 5045 5046 5047 5048

		/*
		 * This used to be a workaround for basic rates missing
		 * in the association response frame. Now that we no
		 * longer use the basic rates from there, it probably
		 * doesn't happen any more, but keep the workaround so
		 * in case some *other* APs are buggy in different ways
		 * we can connect -- with a warning.
5049 5050
		 * Allow this workaround only in case the AP provided at least
		 * one rate.
5051
		 */
5052 5053 5054 5055 5056 5057 5058
		if (min_rate_index < 0) {
			sdata_info(sdata,
				   "No legacy rates in association response\n");

			sta_info_free(local, new_sta);
			return -EINVAL;
		} else if (!basic_rates) {
J
Johannes Berg 已提交
5059 5060
			sdata_info(sdata,
				   "No basic rates, using min rate instead\n");
5061 5062 5063
			basic_rates = BIT(min_rate_index);
		}

5064 5065 5066 5067 5068 5069
		if (rates)
			new_sta->sta.supp_rates[cbss->channel->band] = rates;
		else
			sdata_info(sdata,
				   "No rates found, keeping mandatory only\n");

5070 5071 5072
		sdata->vif.bss_conf.basic_rates = basic_rates;

		/* cf. IEEE 802.11 9.2.12 */
5073
		if (cbss->channel->band == NL80211_BAND_2GHZ &&
5074 5075 5076 5077 5078 5079 5080
		    have_higher_than_11mbit)
			sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
		else
			sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;

		memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);

5081 5082
		/* set timing information */
		sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
J
Johannes Berg 已提交
5083
		rcu_read_lock();
5084 5085 5086 5087 5088
		ies = rcu_dereference(cbss->beacon_ies);
		if (ies) {
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
S
Sara Sharon 已提交
5089 5090 5091 5092

			ieee80211_get_dtim(ies,
					   &sdata->vif.bss_conf.sync_dtim_count,
					   NULL);
5093 5094
		} else if (!ieee80211_hw_check(&sdata->local->hw,
					       TIMING_BEACON_ONLY)) {
5095 5096 5097 5098 5099 5100 5101 5102 5103 5104 5105
			ies = rcu_dereference(cbss->proberesp_ies);
			/* must be non-NULL since beacon IEs were NULL */
			sdata->vif.bss_conf.sync_tsf = ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_presp;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		} else {
			sdata->vif.bss_conf.sync_tsf = 0;
			sdata->vif.bss_conf.sync_device_ts = 0;
			sdata->vif.bss_conf.sync_dtim_count = 0;
		}
J
Johannes Berg 已提交
5106
		rcu_read_unlock();
5107
	}
5108

5109 5110 5111 5112 5113 5114 5115 5116 5117 5118 5119 5120 5121 5122
	if (new_sta || override) {
		err = ieee80211_prep_channel(sdata, cbss);
		if (err) {
			if (new_sta)
				sta_info_free(local, new_sta);
			return -EINVAL;
		}
	}

	if (new_sta) {
		/*
		 * tell driver about BSSID, basic rates and timing
		 * this was set up above, before setting the channel
		 */
5123
		ieee80211_bss_info_change_notify(sdata,
5124 5125
			BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
			BSS_CHANGED_BEACON_INT);
5126 5127

		if (assoc)
J
Johannes Berg 已提交
5128
			sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
5129

J
Johannes Berg 已提交
5130 5131
		err = sta_info_insert(new_sta);
		new_sta = NULL;
5132
		if (err) {
J
Johannes Berg 已提交
5133 5134 5135
			sdata_info(sdata,
				   "failed to insert STA entry for the AP (error %d)\n",
				   err);
5136 5137 5138
			return err;
		}
	} else
5139
		WARN_ON_ONCE(!ether_addr_equal(ifmgd->bssid, cbss->bssid));
5140

5141 5142 5143 5144
	/* Cancel scan to ensure that nothing interferes with connection */
	if (local->scanning)
		ieee80211_scan_cancel(local);

5145 5146 5147
	return 0;
}

5148 5149 5150
/* config hooks */
int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
		       struct cfg80211_auth_request *req)
J
Johannes Berg 已提交
5151
{
J
Johannes Berg 已提交
5152 5153 5154
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
	struct ieee80211_mgd_auth_data *auth_data;
5155
	u16 auth_alg;
J
Johannes Berg 已提交
5156
	int err;
5157
	bool cont_auth;
J
Johannes Berg 已提交
5158 5159

	/* prepare auth data structure */
J
Johannes Berg 已提交
5160

5161 5162 5163 5164 5165
	switch (req->auth_type) {
	case NL80211_AUTHTYPE_OPEN_SYSTEM:
		auth_alg = WLAN_AUTH_OPEN;
		break;
	case NL80211_AUTHTYPE_SHARED_KEY:
5166
		if (fips_enabled)
5167
			return -EOPNOTSUPP;
5168 5169 5170 5171 5172 5173 5174 5175
		auth_alg = WLAN_AUTH_SHARED_KEY;
		break;
	case NL80211_AUTHTYPE_FT:
		auth_alg = WLAN_AUTH_FT;
		break;
	case NL80211_AUTHTYPE_NETWORK_EAP:
		auth_alg = WLAN_AUTH_LEAP;
		break;
5176 5177 5178
	case NL80211_AUTHTYPE_SAE:
		auth_alg = WLAN_AUTH_SAE;
		break;
5179 5180 5181 5182 5183 5184 5185 5186 5187
	case NL80211_AUTHTYPE_FILS_SK:
		auth_alg = WLAN_AUTH_FILS_SK;
		break;
	case NL80211_AUTHTYPE_FILS_SK_PFS:
		auth_alg = WLAN_AUTH_FILS_SK_PFS;
		break;
	case NL80211_AUTHTYPE_FILS_PK:
		auth_alg = WLAN_AUTH_FILS_PK;
		break;
5188 5189
	default:
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
5190
	}
5191

5192
	if (ifmgd->assoc_data)
5193 5194
		return -EBUSY;

5195
	auth_data = kzalloc(sizeof(*auth_data) + req->auth_data_len +
5196
			    req->ie_len, GFP_KERNEL);
J
Johannes Berg 已提交
5197
	if (!auth_data)
J
Johannes Berg 已提交
5198
		return -ENOMEM;
5199

J
Johannes Berg 已提交
5200
	auth_data->bss = req->bss;
5201

5202
	if (req->auth_data_len >= 4) {
5203 5204 5205 5206 5207 5208
		if (req->auth_type == NL80211_AUTHTYPE_SAE) {
			__le16 *pos = (__le16 *) req->auth_data;

			auth_data->sae_trans = le16_to_cpu(pos[0]);
			auth_data->sae_status = le16_to_cpu(pos[1]);
		}
5209 5210 5211
		memcpy(auth_data->data, req->auth_data + 4,
		       req->auth_data_len - 4);
		auth_data->data_len += req->auth_data_len - 4;
5212 5213
	}

5214 5215 5216 5217 5218 5219 5220
	/* Check if continuing authentication or trying to authenticate with the
	 * same BSS that we were in the process of authenticating with and avoid
	 * removal and re-addition of the STA entry in
	 * ieee80211_prep_connection().
	 */
	cont_auth = ifmgd->auth_data && req->bss == ifmgd->auth_data->bss;

5221
	if (req->ie && req->ie_len) {
5222 5223 5224
		memcpy(&auth_data->data[auth_data->data_len],
		       req->ie, req->ie_len);
		auth_data->data_len += req->ie_len;
J
Johannes Berg 已提交
5225
	}
5226

J
Johannes Berg 已提交
5227
	if (req->key && req->key_len) {
J
Johannes Berg 已提交
5228 5229 5230
		auth_data->key_len = req->key_len;
		auth_data->key_idx = req->key_idx;
		memcpy(auth_data->key, req->key, req->key_len);
J
Johannes Berg 已提交
5231 5232
	}

J
Johannes Berg 已提交
5233
	auth_data->algorithm = auth_alg;
J
Johannes Berg 已提交
5234

J
Johannes Berg 已提交
5235
	/* try to authenticate/probe */
5236

5237 5238 5239 5240 5241 5242 5243
	if (ifmgd->auth_data) {
		if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE) {
			auth_data->peer_confirmed =
				ifmgd->auth_data->peer_confirmed;
		}
		ieee80211_destroy_auth_data(sdata, cont_auth);
	}
5244

J
Johannes Berg 已提交
5245 5246
	/* prep auth_data so we don't go into idle on disassoc */
	ifmgd->auth_data = auth_data;
J
Johannes Berg 已提交
5247

5248 5249 5250 5251 5252 5253 5254 5255 5256
	/* If this is continuation of an ongoing SAE authentication exchange
	 * (i.e., request to send SAE Confirm) and the peer has already
	 * confirmed, mark authentication completed since we are about to send
	 * out SAE Confirm.
	 */
	if (cont_auth && req->auth_type == NL80211_AUTHTYPE_SAE &&
	    auth_data->peer_confirmed && auth_data->sae_trans == 2)
		ieee80211_mark_sta_auth(sdata, req->bss->bssid);

5257 5258 5259
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5260 5261 5262
		sdata_info(sdata,
			   "disconnect from AP %pM for new auth to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5263 5264 5265 5266
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5267 5268 5269
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5270
	}
J
Johannes Berg 已提交
5271

J
Johannes Berg 已提交
5272
	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
5273

5274
	err = ieee80211_prep_connection(sdata, req->bss, cont_auth, false);
5275
	if (err)
J
Johannes Berg 已提交
5276
		goto err_clear;
J
Johannes Berg 已提交
5277

5278
	err = ieee80211_auth(sdata);
J
Johannes Berg 已提交
5279 5280 5281 5282 5283 5284
	if (err) {
		sta_info_destroy_addr(sdata, req->bss->bssid);
		goto err_clear;
	}

	/* hold our own reference */
5285
	cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
5286
	return 0;
J
Johannes Berg 已提交
5287 5288

 err_clear:
5289
	eth_zero_addr(ifmgd->bssid);
5290
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5291
	ifmgd->auth_data = NULL;
5292 5293 5294
	mutex_lock(&sdata->local->mtx);
	ieee80211_vif_release_channel(sdata);
	mutex_unlock(&sdata->local->mtx);
J
Johannes Berg 已提交
5295 5296
	kfree(auth_data);
	return err;
J
Johannes Berg 已提交
5297 5298
}

5299 5300
int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
			struct cfg80211_assoc_request *req)
5301
{
J
Johannes Berg 已提交
5302
	struct ieee80211_local *local = sdata->local;
5303
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5304
	struct ieee80211_bss *bss = (void *)req->bss->priv;
J
Johannes Berg 已提交
5305
	struct ieee80211_mgd_assoc_data *assoc_data;
5306
	const struct cfg80211_bss_ies *beacon_ies;
J
Johannes Berg 已提交
5307
	struct ieee80211_supported_band *sband;
5308
	const u8 *ssidie, *ht_ie, *vht_ie;
5309
	int i, err;
5310
	bool override = false;
5311

J
Johannes Berg 已提交
5312 5313 5314 5315
	assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
	if (!assoc_data)
		return -ENOMEM;

5316 5317
	rcu_read_lock();
	ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
5318
	if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
5319 5320 5321 5322 5323 5324 5325 5326
		rcu_read_unlock();
		kfree(assoc_data);
		return -EINVAL;
	}
	memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
	assoc_data->ssid_len = ssidie[1];
	rcu_read_unlock();

5327 5328 5329
	if (ifmgd->associated) {
		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];

5330 5331 5332
		sdata_info(sdata,
			   "disconnect from AP %pM for new assoc to %pM\n",
			   ifmgd->associated->bssid, req->bss->bssid);
5333 5334 5335 5336
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       WLAN_REASON_UNSPECIFIED,
				       false, frame_buf);

5337 5338 5339
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    WLAN_REASON_UNSPECIFIED);
5340
	}
J
Johannes Berg 已提交
5341 5342 5343 5344

	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
		err = -EBUSY;
		goto err_free;
J
Johannes Berg 已提交
5345
	}
5346

J
Johannes Berg 已提交
5347 5348 5349 5350
	if (ifmgd->assoc_data) {
		err = -EBUSY;
		goto err_free;
	}
5351

J
Johannes Berg 已提交
5352 5353 5354 5355
	if (ifmgd->auth_data) {
		bool match;

		/* keep sta info, bssid if matching */
5356
		match = ether_addr_equal(ifmgd->bssid, req->bss->bssid);
J
Johannes Berg 已提交
5357
		ieee80211_destroy_auth_data(sdata, match);
5358 5359
	}

J
Johannes Berg 已提交
5360
	/* prepare assoc data */
5361

5362 5363
	ifmgd->beacon_crc_valid = false;

5364 5365 5366
	assoc_data->wmm = bss->wmm_used &&
			  (local->hw.queues >= IEEE80211_NUM_ACS);

J
Johannes Berg 已提交
5367 5368 5369 5370 5371 5372 5373
	/*
	 * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
	 * We still associate in non-HT mode (11a/b/g) if any one of these
	 * ciphers is configured as pairwise.
	 * We can set this to true for non-11n hardware, that'll be checked
	 * separately along with the peer capabilities.
	 */
5374
	for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
5375 5376
		if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
5377
		    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
5378
			ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5379
			ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
L
Luca Coelho 已提交
5380
			ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5381
			netdev_info(sdata->dev,
5382
				    "disabling HT/VHT/HE due to WEP/TKIP use\n");
5383 5384
		}
	}
5385

J
Johannes Berg 已提交
5386 5387
	sband = local->hw.wiphy->bands[req->bss->channel->band];

5388 5389 5390
	/* also disable HT/VHT/HE if the AP doesn't use WMM */
	if (!bss->wmm_used) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5391
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5392 5393 5394
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
		netdev_info(sdata->dev,
			    "disabling HT/VHT/HE as WMM/QoS is not supported by the AP\n");
5395 5396
	}

B
Ben Greear 已提交
5397 5398 5399 5400
	memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
	memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
	       sizeof(ifmgd->ht_capa_mask));

5401 5402 5403 5404
	memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
	memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
	       sizeof(ifmgd->vht_capa_mask));

5405
	if (req->ie && req->ie_len) {
J
Johannes Berg 已提交
5406 5407 5408
		memcpy(assoc_data->ie, req->ie, req->ie_len);
		assoc_data->ie_len = req->ie_len;
	}
5409

5410 5411 5412 5413 5414 5415 5416 5417 5418 5419 5420 5421 5422 5423 5424
	if (req->fils_kek) {
		/* should already be checked in cfg80211 - so warn */
		if (WARN_ON(req->fils_kek_len > FILS_MAX_KEK_LEN)) {
			err = -EINVAL;
			goto err_free;
		}
		memcpy(assoc_data->fils_kek, req->fils_kek,
		       req->fils_kek_len);
		assoc_data->fils_kek_len = req->fils_kek_len;
	}

	if (req->fils_nonces)
		memcpy(assoc_data->fils_nonces, req->fils_nonces,
		       2 * FILS_NONCE_LEN);

J
Johannes Berg 已提交
5425
	assoc_data->bss = req->bss;
5426

J
Johannes Berg 已提交
5427 5428
	if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
		if (ifmgd->powersave)
5429
			sdata->smps_mode = IEEE80211_SMPS_DYNAMIC;
J
Johannes Berg 已提交
5430
		else
5431
			sdata->smps_mode = IEEE80211_SMPS_OFF;
J
Johannes Berg 已提交
5432
	} else
5433
		sdata->smps_mode = ifmgd->req_smps;
J
Johannes Berg 已提交
5434

J
Johannes Berg 已提交
5435 5436 5437
	assoc_data->capability = req->bss->capability;
	assoc_data->supp_rates = bss->supp_rates;
	assoc_data->supp_rates_len = bss->supp_rates_len;
5438

5439
	rcu_read_lock();
5440 5441 5442 5443 5444
	ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
	if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
		assoc_data->ap_ht_param =
			((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
	else
5445
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
5446 5447 5448 5449 5450 5451
	vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
	if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
		memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
		       sizeof(struct ieee80211_vht_cap));
	else
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5452
	rcu_read_unlock();
5453

5454
	if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
5455
		 ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK),
5456 5457 5458
	     "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
		sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;

K
Kalle Valo 已提交
5459
	if (bss->wmm_used && bss->uapsd_supported &&
5460
	    (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
5461
		assoc_data->uapsd = true;
K
Kalle Valo 已提交
5462 5463
		ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
	} else {
5464
		assoc_data->uapsd = false;
K
Kalle Valo 已提交
5465 5466 5467
		ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
	}

5468
	if (req->prev_bssid)
J
Johannes Berg 已提交
5469
		memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
5470 5471 5472 5473 5474 5475 5476 5477 5478

	if (req->use_mfp) {
		ifmgd->mfp = IEEE80211_MFP_REQUIRED;
		ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
	} else {
		ifmgd->mfp = IEEE80211_MFP_DISABLED;
		ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
	}

5479 5480 5481 5482 5483
	if (req->flags & ASSOC_REQ_USE_RRM)
		ifmgd->flags |= IEEE80211_STA_ENABLE_RRM;
	else
		ifmgd->flags &= ~IEEE80211_STA_ENABLE_RRM;

5484 5485 5486 5487 5488
	if (req->crypto.control_port)
		ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
	else
		ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;

5489 5490
	sdata->control_port_protocol = req->crypto.control_port_ethertype;
	sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
5491 5492
	sdata->control_port_over_nl80211 =
					req->crypto.control_port_over_nl80211;
5493
	sdata->control_port_no_preauth = req->crypto.control_port_no_preauth;
5494 5495
	sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
							sdata->vif.type);
5496

J
Johannes Berg 已提交
5497 5498 5499
	/* kick off associate process */

	ifmgd->assoc_data = assoc_data;
5500
	ifmgd->dtim_period = 0;
5501
	ifmgd->have_beacon = false;
J
Johannes Berg 已提交
5502

5503 5504 5505 5506 5507 5508 5509 5510 5511 5512 5513 5514 5515 5516 5517 5518 5519 5520 5521 5522 5523 5524 5525 5526
	/* override HT/VHT configuration only if the AP and we support it */
	if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
		struct ieee80211_sta_ht_cap sta_ht_cap;

		if (req->flags & ASSOC_REQ_DISABLE_HT)
			override = true;

		memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
		ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);

		/* check for 40 MHz disable override */
		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ) &&
		    sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
		    !(sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
			override = true;

		if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
		    req->flags & ASSOC_REQ_DISABLE_VHT)
			override = true;
	}

	if (req->flags & ASSOC_REQ_DISABLE_HT) {
		ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
5527
		ifmgd->flags |= IEEE80211_STA_DISABLE_HE;
5528 5529 5530 5531 5532 5533
	}

	if (req->flags & ASSOC_REQ_DISABLE_VHT)
		ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;

	err = ieee80211_prep_connection(sdata, req->bss, true, override);
5534 5535
	if (err)
		goto err_clear;
J
Johannes Berg 已提交
5536

5537 5538
	rcu_read_lock();
	beacon_ies = rcu_dereference(req->bss->beacon_ies);
5539

5540
	if (ieee80211_hw_check(&sdata->local->hw, NEED_DTIM_BEFORE_ASSOC) &&
5541 5542 5543 5544 5545 5546 5547 5548
	    !beacon_ies) {
		/*
		 * Wait up to one beacon interval ...
		 * should this be more if we miss one?
		 */
		sdata_info(sdata, "waiting for beacon from %pM\n",
			   ifmgd->bssid);
		assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
5549
		assoc_data->timeout_started = true;
5550 5551
		assoc_data->need_beacon = true;
	} else if (beacon_ies) {
S
Sara Sharon 已提交
5552
		const u8 *ie;
5553 5554
		u8 dtim_count = 0;

S
Sara Sharon 已提交
5555 5556 5557
		ieee80211_get_dtim(beacon_ies, &dtim_count,
				   &ifmgd->dtim_period);

5558
		ifmgd->have_beacon = true;
J
Johannes Berg 已提交
5559
		assoc_data->timeout = jiffies;
5560
		assoc_data->timeout_started = true;
5561

5562
		if (ieee80211_hw_check(&local->hw, TIMING_BEACON_ONLY)) {
5563 5564 5565 5566 5567
			sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
			sdata->vif.bss_conf.sync_device_ts =
				bss->device_ts_beacon;
			sdata->vif.bss_conf.sync_dtim_count = dtim_count;
		}
S
Sara Sharon 已提交
5568 5569 5570 5571 5572 5573 5574 5575 5576 5577 5578

		ie = cfg80211_find_ext_ie(WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION,
					  beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 3)
			sdata->vif.bss_conf.profile_periodicity = ie[4];

		ie = cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY,
				      beacon_ies->data, beacon_ies->len);
		if (ie && ie[1] >= 11 &&
		    (ie[10] & WLAN_EXT_CAPA11_EMA_SUPPORT))
			sdata->vif.bss_conf.ema_ap = true;
5579 5580
	} else {
		assoc_data->timeout = jiffies;
5581
		assoc_data->timeout_started = true;
J
Johannes Berg 已提交
5582
	}
5583 5584
	rcu_read_unlock();

5585
	run_again(sdata, assoc_data->timeout);
J
Johannes Berg 已提交
5586

P
Paul Stewart 已提交
5587 5588 5589 5590 5591 5592 5593 5594 5595 5596
	if (bss->corrupt_data) {
		char *corrupt_type = "data";
		if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_BEACON) {
			if (bss->corrupt_data &
					IEEE80211_BSS_CORRUPT_PROBE_RESP)
				corrupt_type = "beacon and probe response";
			else
				corrupt_type = "beacon";
		} else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
			corrupt_type = "probe response";
J
Johannes Berg 已提交
5597 5598
		sdata_info(sdata, "associating with AP with corrupt %s\n",
			   corrupt_type);
P
Paul Stewart 已提交
5599 5600
	}

5601
	return 0;
J
Johannes Berg 已提交
5602
 err_clear:
5603
	eth_zero_addr(ifmgd->bssid);
5604
	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
J
Johannes Berg 已提交
5605 5606 5607 5608
	ifmgd->assoc_data = NULL;
 err_free:
	kfree(assoc_data);
	return err;
5609 5610
}

5611
int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
5612
			 struct cfg80211_deauth_request *req)
5613
{
5614
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5615
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
5616
	bool tx = !req->local_state_change;
5617

5618 5619 5620 5621 5622 5623
	if (ifmgd->auth_data &&
	    ether_addr_equal(ifmgd->auth_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting authentication with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));
5624

5625
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5626
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5627
					       IEEE80211_STYPE_DEAUTH,
5628
					       req->reason_code, tx,
5629
					       frame_buf);
5630
		ieee80211_destroy_auth_data(sdata, false);
5631 5632 5633
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5634

5635
		return 0;
5636 5637
	}

5638 5639 5640 5641 5642 5643 5644
	if (ifmgd->assoc_data &&
	    ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) {
		sdata_info(sdata,
			   "aborting association with %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5645
		drv_mgd_prepare_tx(sdata->local, sdata, 0);
5646
		ieee80211_send_deauth_disassoc(sdata, req->bssid, req->bssid,
5647 5648 5649
					       IEEE80211_STYPE_DEAUTH,
					       req->reason_code, tx,
					       frame_buf);
5650
		ieee80211_destroy_assoc_data(sdata, false, true);
5651 5652 5653 5654 5655 5656
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
		return 0;
	}

5657 5658
	if (ifmgd->associated &&
	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
5659 5660 5661 5662 5663
		sdata_info(sdata,
			   "deauthenticating from %pM by local choice (Reason: %u=%s)\n",
			   req->bssid, req->reason_code,
			   ieee80211_get_reason_code_string(req->reason_code));

5664 5665
		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
				       req->reason_code, tx, frame_buf);
5666 5667 5668
		ieee80211_report_disconnect(sdata, frame_buf,
					    sizeof(frame_buf), true,
					    req->reason_code);
5669 5670
		return 0;
	}
5671

5672
	return -ENOTCONN;
5673
}
5674

5675
int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
5676
			   struct cfg80211_disassoc_request *req)
J
Johannes Berg 已提交
5677
{
5678
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
5679
	u8 bssid[ETH_ALEN];
5680
	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
J
Johannes Berg 已提交
5681

J
Johannes Berg 已提交
5682 5683 5684 5685 5686 5687
	/*
	 * cfg80211 should catch this ... but it's racy since
	 * we can receive a disassoc frame, process it, hand it
	 * to cfg80211 while that's in a locked section already
	 * trying to tell us that the user wants to disconnect.
	 */
5688
	if (ifmgd->associated != req->bss)
5689 5690
		return -ENOLINK;

J
Johannes Berg 已提交
5691
	sdata_info(sdata,
5692 5693
		   "disassociating from %pM by local choice (Reason: %u=%s)\n",
		   req->bss->bssid, req->reason_code, ieee80211_get_reason_code_string(req->reason_code));
5694

5695
	memcpy(bssid, req->bss->bssid, ETH_ALEN);
5696 5697 5698
	ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
			       req->reason_code, !req->local_state_change,
			       frame_buf);
5699

5700 5701
	ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
				    req->reason_code);
5702

5703 5704
	return 0;
}
5705

5706
void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
5707 5708 5709
{
	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;

5710 5711 5712 5713 5714 5715 5716 5717 5718 5719
	/*
	 * Make sure some work items will not run after this,
	 * they will not do anything but might not have been
	 * cancelled when disconnecting.
	 */
	cancel_work_sync(&ifmgd->monitor_work);
	cancel_work_sync(&ifmgd->beacon_connection_loss_work);
	cancel_work_sync(&ifmgd->request_smps_work);
	cancel_work_sync(&ifmgd->csa_connection_drop_work);
	cancel_work_sync(&ifmgd->chswitch_work);
5720
	cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
5721

5722
	sdata_lock(sdata);
5723 5724
	if (ifmgd->assoc_data) {
		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
5725
		ieee80211_destroy_assoc_data(sdata, false, false);
5726 5727
		cfg80211_assoc_timeout(sdata->dev, bss);
	}
5728 5729
	if (ifmgd->auth_data)
		ieee80211_destroy_auth_data(sdata, false);
5730 5731 5732 5733 5734 5735
	spin_lock_bh(&ifmgd->teardown_lock);
	if (ifmgd->teardown_skb) {
		kfree_skb(ifmgd->teardown_skb);
		ifmgd->teardown_skb = NULL;
		ifmgd->orig_teardown_skb = NULL;
	}
5736 5737 5738
	kfree(ifmgd->assoc_req_ies);
	ifmgd->assoc_req_ies = NULL;
	ifmgd->assoc_req_ies_len = 0;
5739
	spin_unlock_bh(&ifmgd->teardown_lock);
5740
	del_timer_sync(&ifmgd->timer);
5741
	sdata_unlock(sdata);
5742 5743
}

5744 5745
void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
			       enum nl80211_cqm_rssi_threshold_event rssi_event,
5746
			       s32 rssi_level,
5747 5748 5749 5750
			       gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

5751
	trace_api_cqm_rssi_notify(sdata, rssi_event, rssi_level);
J
Johannes Berg 已提交
5752

5753
	cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, rssi_level, gfp);
5754 5755
}
EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
5756 5757 5758 5759 5760 5761 5762 5763 5764 5765

void ieee80211_cqm_beacon_loss_notify(struct ieee80211_vif *vif, gfp_t gfp)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	trace_api_cqm_beacon_loss_notify(sdata->local, sdata);

	cfg80211_cqm_beacon_loss_notify(sdata->dev, gfp);
}
EXPORT_SYMBOL(ieee80211_cqm_beacon_loss_notify);